External network access method and apparatus, and computer device, readable storage medium and product

Abstract

The present application relates to an external network access method and apparatus, and a computer device, a readable storage medium and a product. The method comprises: upon receiving an external network access request sent by at least one internal network device, acquiring the priority with which each external network access request is transmitted to each of at least two gateway servers, wherein the priority is determined on the basis of connection attributes between the gateway servers and the internal network device (S202); sending the external network access request to a first gateway server having the highest priority, and performing network address translation (S204); when an anomaly occurs in the first gateway server during the process of network address translation, sending the external network access request to a second gateway server having the highest priority among the gateway servers other than the first gateway server (S206); performing network address translation (S208); and when the second gateway server converts an internal network address of the internal network device into a public network address of an external network indicated by the external network access request, obtaining an external network access result (S210).

Description

External network access methods, devices, computer equipment, readable storage media and products

[0001] Related applications

[0002] This application claims priority to Chinese patent application filed on November 25, 2024, application number 2024116892106, entitled "External Network Access Method, Apparatus, Computer Equipment, Readable Storage Medium and Product", the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of communication technology, and in particular to an external network access method, apparatus, computer equipment, readable storage medium, and product. Background Technology

[0004] As enterprise networks continue to expand, enterprises will gradually deploy more and more internal devices, which will cause a surge in requests from internal devices to access external networks.

[0005] Therefore, enterprises typically deploy a unified gateway server so that requests from various internal devices can be centrally collected and routed to the gateway server. This allows internal network devices to access the external network through the gateway server. However, this approach undoubtedly puts a certain amount of resource pressure on the gateway server, thereby affecting the efficiency of external network access. Summary of the Invention

[0006] According to various embodiments of this application, an external network access method, apparatus, computer device, computer-readable storage medium, and computer program product are provided.

[0007] In a first aspect, this application provides an external network access method, comprising: upon receiving an external network access request sent by at least one internal network device, for each external network access request, obtaining the priority of the external network access request being transmitted to at least two gateway servers; the priority is determined based on the connection attributes between the gateway server and the internal network device; for the first gateway server with the highest priority among the gateway servers, sending the external network access request to the first gateway server for network address translation; when an anomaly occurs in the first gateway server during the network address translation process, selecting the second gateway server with the highest priority other than the first gateway server from among the gateway servers; sending the external network access request to the second gateway server for network address translation; and obtaining the external network access result of the internal network device when the second gateway server translates the internal network address of the internal network device into the public network address of the external network indicated by the external network access request.

[0008] In one embodiment, sending an external network access request to a first gateway server for network address translation includes: sending the external network access request to the first gateway server; querying the external network whitelist of the internal network device that initiated the external network access request through the first gateway server; the external network whitelist records external network addresses that are allowed for access by internal network devices; and when the external network whitelist contains the external network address indicated by the external network access request, performing network address translation through the first gateway server.

[0009] In one embodiment, network address translation is performed through a first gateway server, including: obtaining the routing index of the internal network device that initiated the external network access request through the first gateway server; there is a one-to-one correspondence between the routing index and the internal network device; and performing network address translation based on the routing index.

[0010] In one embodiment, the method further includes: upon receiving an intranet access request sent by a target external network forwarded by each gateway server, obtaining a fixed network address for each gateway server; selecting a device that has a mapping relationship with the gateway server among the intranet devices; and updating the intranet access request based on the fixed network address and the target intranet address of the selected device to obtain a target access request; the target access request is used for the target external network to access the selected device.

[0011] In one embodiment, the method further includes: upon receiving a response signal from a selected device based on a target access request, sending the response signal to a gateway server; receiving a target result returned by the gateway server in response to the response signal; and the target result being generated after the gateway server converts the fixed network address carried in the response signal to obtain an external network address, and then sends the response signal to a target external network belonging to the external network address.

[0012] In one embodiment, the method further includes: receiving an encrypted access request sent by at least one intranet device through a data transmission channel established based on a network security protocol; and decrypting the encrypted access request to obtain an extranet access request.

[0013] Secondly, this application also provides an external network access device, comprising: a routing priority acquisition module, used to, upon receiving an external network access request sent by at least one internal network device, acquire the priority of each external network access request transmitted to at least two gateway servers; the priority is determined based on the connection attributes between the gateway server and the internal network device; a first network address translation module, used to send the external network access request to the first gateway server with the highest priority among the gateway servers for network address translation; a second gateway service determination module, used to, when an anomaly occurs in the network address translation process of the first gateway server, select the second gateway server with the highest priority other than the first gateway server from among the gateway servers; a second network address translation module, used to send the external network access request to the second gateway server for network address translation; and an external network access result generation module, used to obtain the external network access result of the internal network device when the second gateway server converts the internal network address of the internal network device into the public network address of the external network indicated by the external network access request.

[0014] In one embodiment, the first network address translation module is further configured to:

[0015] The external network access request is sent to the first gateway server. The first gateway server then queries the external network whitelist of the internal network device that initiated the external network access request; the external network whitelist records the external network addresses that the internal network device is allowed to access.

[0016] When the external network whitelist contains the external network address indicated by the external network access request, network address translation is performed through the first gateway server.

[0017] In one embodiment, the first network address translation module is further configured to:

[0018] The routing index of the internal network device that initiated the external network access request is obtained through the first gateway server; the routing index has a one-to-one correspondence with the internal network device; and

[0019] Based on the routing index, network address translation is performed.

[0020] In one embodiment, the device is further configured to:

[0021] Upon receiving an intranet access request sent from the target external network forwarded by each of the gateway servers, the fixed network address of each gateway server is obtained.

[0022] Among the aforementioned intranet devices, select devices that have a mapping relationship with the gateway server; and

[0023] Based on the fixed network address and the target intranet address of the selected device, the intranet access request is updated to obtain a target access request; the target access request is used for the target to access the selected device from the external network.

[0024] In one embodiment, the device is further configured to:

[0025] Upon receiving a response signal from the selected device based on the target access request, the response signal is sent to the gateway server; and

[0026] The gateway server receives the target result returned in response to the response signal; the target result is generated by the gateway server converting the fixed network address carried in the response signal to obtain an external network address, and then sending the response signal to the target external network belonging to the external network address.

[0027] In one embodiment, the device is further configured to:

[0028] Through a data transmission channel established based on network security protocols, it receives encrypted access requests from at least one intranet device; and

[0029] The encrypted access request is decrypted to obtain an external network access request.

[0030] Thirdly, this application also provides a computer device, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to perform the following steps: upon receiving an external network access request sent by at least one internal network device, for each external network access request, the priority of the external network access request being transmitted to at least two gateway servers is obtained; the priority is determined based on the connection attributes between the gateway server and the internal network device; for the first gateway server with the highest priority among all gateway servers, the external network access request is sent to the first gateway server for network address translation; when an anomaly occurs in the first gateway server during the network address translation process, the second gateway server with the highest priority other than the first gateway server is selected from all gateway servers; the external network access request is sent to the second gateway server for network address translation; and when the second gateway server translates the internal network address of the internal network device into the public network address of the external network indicated by the external network access request, the external network access result of the internal network device is obtained.

[0031] Fourthly, this application also provides a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it performs the following steps: upon receiving an external network access request sent by at least one internal network device, for each external network access request, the priority of the external network access request being transmitted to at least two gateway servers is obtained; the priority is determined based on the connection attributes between the gateway server and the internal network device; for the first gateway server with the highest priority among all gateway servers, the external network access request is sent to the first gateway server for network address translation; when an anomaly occurs in the first gateway server during the network address translation process, the second gateway server with the highest priority other than the first gateway server is selected from all gateway servers; the external network access request is sent to the second gateway server for network address translation; and when the second gateway server translates the internal network address of the internal network device into the public network address of the external network indicated by the external network access request, the external network access result of the internal network device is obtained.

[0032] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps: upon receiving an external network access request sent by at least one internal network device, for each external network access request, obtain the priority of the external network access request being transmitted to at least two gateway servers; the priority is determined based on the connection attributes between the gateway server and the internal network device; for the first gateway server with the highest priority among all gateway servers, send the external network access request to the first gateway server for network address translation; when an anomaly occurs in the first gateway server during the network address translation process, select the second gateway server with the highest priority other than the first gateway server from among all gateway servers; send the external network access request to the second gateway server for network address translation; and when the second gateway server translates the internal network address of the internal network device into the public network address of the external network indicated by the external network access request, obtain the external network access result of the internal network device.

[0033] Details of one or more embodiments of this application are set forth in the following drawings and description. Other features, objects, and advantages of this application will become apparent from the specification, drawings, and claims. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of this application or the conventional technology, the drawings used in the description of the embodiments or the conventional technology will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the disclosed drawings without creative effort.

[0035] Figure 1 shows the application environment of some external network access methods in some embodiments;

[0036] Figure 2 is a flowchart illustrating the external network access method in some embodiments;

[0037] Figure 3 is a schematic diagram of routing priorities in some embodiments;

[0038] Figure 4 is a schematic diagram of the second gateway server processing requests in some embodiments;

[0039] Figure 5 is a schematic diagram of the network address translation process in some embodiments;

[0040] Figure 6 is a schematic diagram of the external network whitelist in some embodiments;

[0041] Figure 7 is a flowchart illustrating the network address translation process in some other embodiments;

[0042] Figure 8 is a schematic diagram of route isolation in some embodiments;

[0043] Figure 9 is a schematic diagram of the process of external network accessing internal network devices in some embodiments;

[0044] Figure 10 is a schematic diagram of the process of external network accessing internal network devices in some other embodiments;

[0045] Figure 11 is a schematic diagram of the process of an intranet device responding to an external network access in some embodiments;

[0046] Figure 12 is a schematic diagram of the process of an intranet device responding to an external network access in some other embodiments;

[0047] Figure 13 is a flowchart illustrating the process of obtaining external network access requests in some embodiments;

[0048] Figure 14 shows the network structure diagram in some embodiments;

[0049] Figure 15 is a structural block diagram of the external network access device in some embodiments;

[0050] Figure 16 is an internal structure diagram of a computer device in some embodiments. Detailed Implementation

[0051] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0052] The external network access method provided in this application embodiment can be applied to the application environment shown in Figure 1. The control center 102 communicates with each internal network device 104 and each gateway server 106. The control center 102 can be understood as the central control center for each internal network device 104. For example, assuming the internal network devices are devices in each branch of an enterprise, the control center can be the control center of the enterprise headquarters, which can collect external network access requests initiated by devices in each branch. Internal network devices 104 can refer to terminal devices located in an internal network, such as an enterprise network. The gateway server 106 can be understood as a Network Address Translation (NAT) gateway, used to translate internal network addresses into public network addresses for external networks, thereby enabling connection to external networks.

[0053] When the control center 102 receives an external network access request from at least one internal network device 104, it first obtains the priority of each external network access request transmitted to at least two gateway servers 106. The priority is determined based on the connection attributes between the gateway server 106 and the internal network device 104. For the first gateway server with the highest priority among the gateway servers 106, the control center 102 sends the external network access request to the first gateway server for network address translation (NAT). If an anomaly occurs during the NAT process on the first gateway server, the control center 102 selects the second gateway server (excluding the first gateway server) with the highest priority from the gateway servers 106 and sends the external network access request to the second gateway server for NAT. The external network access result of the internal network device is obtained when the second gateway server translates the internal network address of the internal network device into the public network address indicated by the external network access request.

[0054] In an exemplary embodiment, as shown in FIG2, an external network access method is provided. Taking the application of this method to the control center 102 in FIG1 as an example, the method includes:

[0055] Step S202: When receiving an external network access request sent by at least one internal network device, for each external network access request, obtain the priority of the external network access request being transmitted to at least two gateway servers respectively.

[0056] In this context, an external network access request refers to a request command from an internal network device to access an external network. In practical applications, to obtain external resources, internal devices within an enterprise typically need to communicate with the external network. As the number of internal network devices increases, enterprises usually deploy a unified gateway server to centrally collect requests from various internal devices. This allows internal network devices to access the external network through the gateway server and enables centralized management and optimization of the internal network. However, this approach undoubtedly puts a certain amount of resource pressure on the gateway server, thus affecting the efficiency of external network access. Therefore, this embodiment deploys at least two gateway servers to alleviate the pressure on a single gateway server.

[0057] In some examples, there can be two gateway servers, which ensures both deployment cost control and meets the external network access needs of various internal network devices. Of course, in practical applications, an appropriate number of network servers can be deployed based on the actual situation. It's understood that these multiple gateway servers act as primary and backup servers for each other. That is, if the primary gateway server fails, the backup gateway server will promptly receive external network access requests processed by the primary gateway server. If the backup gateway server also fails, it will become the new primary gateway server, and the backup gateway server of the new primary gateway server will continue to process requests, ensuring that internal network devices can successfully access the external network. It should be noted that each gateway server can be either a primary or backup gateway server. The gateway servers are independent of each other and do not need to communicate with each other, nor do they need to run the VRRP (Virtual Router Redundancy Protocol). VRRP is a routing protocol used to solve the single point of failure problem in a local area network. Its main purpose is to ensure that when a router in the network fails, it can quickly switch to a backup router, thereby ensuring network reliability. However, considering that VRRP needs to periodically send VRRP messages to maintain the primary / backup relationship, this increases network load and configuration complexity. Therefore, in this example, the gateway servers do not need to run the VRRP protocol for easy configuration. As for network reliability, this embodiment will use policy routing to achieve more flexible traffic scheduling and load balancing, thereby improving network reliability.

[0058] Policy-based routing can be understood as a routing mechanism, primarily referring to configuring the MED (Multi-Exit Discriminator) attribute value for each gateway server. The MED attribute is a property in BGP (Border Gateway Protocol) used to select the optimal path from multiple routing paths. In other words, the control center establishes a communication link with each gateway server using the BGP protocol. The control center can flexibly configure the MED attribute value on each communication link to achieve load balancing. For example, the MED attribute value between the control center and the first gateway server can be 80, while the MED attribute value with the second gateway server can be 100. These MED attribute values ​​determine the priority of external network access requests sent by different internal devices to each gateway server. Priority refers to the transmission priority of external network access requests to gateway servers. The smaller the MED attribute value, the lower the transmission cost on that link, and the higher the priority. Again, using the previous example, the control center will prioritize sending external network access requests to the first gateway server because the MED attribute value corresponding to the first gateway server is lower than that of the second gateway server.

[0059] Furthermore, the priority can be pre-determined based on the connection attributes between the gateway server and the internal network devices, or in other words, the MED attribute value is pre-determined based on the connection attributes between the gateway server and the internal network devices. Connection attributes can be understood as the performance attributes of external network access requests generated by internal network devices when transmitted to the gateway server, such as bandwidth and latency. These performance attributes can be known from the historical external network access requests of each internal network device. Refer to Figure 3, which shows the MED attribute values ​​for different internal network devices on different gateway servers. For example, suppose an external network access request generated by internal network device 1 has higher bandwidth or lower latency when transmitted to the first gateway server, but lower bandwidth or higher latency on the second gateway server. Then, the control center can set the MED attribute value for the first gateway server to a smaller value, such as 80, and the MED attribute value for the second gateway server to a larger value, such as 100. That is, the external network access request initiated by internal network device 1 will be preferentially transmitted to the first gateway server. If the first gateway server fails, the second gateway server will then process the external network access request. Similarly, for intranet device 2, if its generated external network access requests have higher bandwidth or lower latency when transmitted to the second gateway server, but lower bandwidth or higher latency on the first gateway server, then the control center can set the MED attribute value for the second gateway server to a smaller value, such as 80, and the MED attribute value for the first gateway server to a larger value, such as 100. That is, external network access requests initiated by intranet device 2 will be preferentially transmitted to the second gateway server; only if the second gateway server fails will the first gateway server process the external network access request.

[0060] For example, when the control center receives an external network access request from at least one internal network device, it can obtain the priority of each internal network device when transmitting the request to each gateway server, so that each external network access request can be transmitted to the corresponding gateway server based on the priority.

[0061] Step S204: For the first gateway server, which has the highest priority among all gateway servers, the external network access request is sent to the first gateway server for network address translation.

[0062] In this context, "highest priority" can be understood as having the lowest MED attribute value. The first gateway server refers to the gateway server with the highest priority, or more specifically, the gateway server with the lowest MED attribute value between itself and the control center. Network address translation (NAT) is the process of converting the internal network address of an internal network device into its corresponding public network address. That is, the gateway server stores the corresponding public network address for connecting to the external network. By converting the internal network address into this public network address, the gateway server enables communication between internal devices and the external network.

[0063] For example, for each intranet device, after obtaining the priority of the external network access request generated by the intranet device and its transmission to each gateway server, the control center can filter out the highest priority first gateway server and prioritize transmitting the intranet device's external network access request to the first gateway server. The first gateway server can then obtain the intranet device's intranet address and the external network to be accessed carried in the external network access request, thereby converting the intranet address into the public IP address corresponding to the external network, enabling the intranet device to communicate with the external network.

[0064] Step S206: When the first gateway server encounters an anomaly during network address translation, select the second gateway server with the highest priority from among all gateway servers, excluding the first gateway server.

[0065] An anomaly in the first gateway server can include, but is not limited to, a disconnection of the communication link between the control center and the first gateway server, or a malfunction of the first gateway server itself. The second gateway server refers to the gateway server with the highest priority among all gateway servers, excluding the first gateway server.

[0066] For example, during the network address translation process of the first gateway server, if the first gateway server itself fails or an abnormal phenomenon such as the communication link between the control center and the first gateway server is broken, the control center can filter out the second gateway server with the highest priority other than the first gateway server, or in other words, filter out the backup gateway server corresponding to the first gateway server.

[0067] Step S208: Send the external network access request to the second gateway server for network address translation.

[0068] For example, after the control center identifies the second gateway server, it can resend the external network access requests processed by the first gateway server to the second gateway server for re-translation of network addresses. Since each gateway server operates independently, the external network access request will re-establish a session upon reaching the second gateway server, and network address translation will be performed using the public IP address on the second gateway server. As shown in Figure 4, which illustrates the request processing by the second gateway server, when the communication link between the control center and the first gateway server is broken, the control center will send the external network access request to the second gateway server for network address translation. In some examples, if an exception occurs during network address translation on the first gateway server, the external network access request processed by the first gateway server can be automatically transferred to the second gateway server.

[0069] Step S210: When the second gateway server converts the internal network address of the internal network device into the public network address of the external network indicated by the external network access request, the external network access result of the internal network device is obtained.

[0070] In this context, the external network refers to the external network that the internal network needs to access. A public IP address can be understood as a public address that connects to an external network. The external network access result can be used to characterize whether the internal device has successfully accessed the external network, and can include data such as successful and failed external network access, access duration, and access speed.

[0071] For example, after receiving the request from the first gateway server, the second gateway server also obtains the internal network address of the internal network device and the external network to be accessed carried in the external network access request. It then converts the internal network address into a public network address stored in the second gateway server, enabling the internal device to communicate with the external network. The control center can receive the external network access results from the second gateway server.

[0072] In this embodiment, when the control center receives an external network access request from at least one intranet device, it first determines the priority of each external network access request for transmission to at least two gateway servers. The external network access request is then sent to the highest-priority first gateway server for network address translation (NAT). If the first gateway server encounters an anomaly during NAT, the highest-priority second gateway server (excluding the first gateway server) is selected from the gateway servers, and the external network access request is sent to the second gateway server for NAT. The second gateway server then converts the intranet address of the intranet device into the public IP address indicated by the external network access request, generating the external network access result for the intranet device. In other words, this embodiment introduces multiple gateway servers, overcoming the resource pressure inherent in a single gateway server in traditional technologies. Furthermore, if one gateway server fails, the others can promptly receive external network access requests from the failed gateway server, improving external network access efficiency. Additionally, this embodiment sets the priority for transmitting external network access requests initiated by different intranet devices to each gateway server, ensuring orderly transmission of external network access requests and further improving external network access efficiency. Moreover, the priority is determined based on the connection attributes between the gateway server and the internal network devices, which improves the reliability of each priority level and thus improves the reliability of the entire external network access process.

[0073] In an exemplary embodiment, as shown in Figure 5, the external network access request is sent to the first gateway server for network address translation, including:

[0074] Step S502: Send the external network access request to the first gateway server, and query the external network whitelist of the internal network device that initiated the external network access request through the first gateway server.

[0075] The external network whitelist records the external network addresses that are allowed to be accessed by internal network devices. Understandably, for network operation and maintenance management and security reasons, it is not permissible for every internal network device to freely access external networks, such as certain video websites or gaming websites. Therefore, in this embodiment, the external network whitelist corresponding to each internal network device is stored in the gateway server to ensure network security.

[0076] For example, the control center can pre-design a corresponding external network whitelist for each intranet device based on business needs, recording the external networks that the intranet device is allowed to access, and publish this whitelist on each gateway server. After the control center sends an intranet device's external network access request to the first gateway server, the first gateway server can query the corresponding external network whitelist for that intranet device to determine whether communication between the intranet device and the external network is possible.

[0077] Step S504: When the external address indicating the external access request is included in the external whitelist, network address translation is performed through the first gateway server.

[0078] The external network address refers to the address of the external network that the internal network device wants to access.

[0079] For example, when the first gateway server determines that the external network whitelist contains an external network address indicating an external network access request, it means that the external network that the internal network device wants to access is allowed, and the first network server can then perform network address translation on the internal network address of the internal network device.

[0080] In one example, if an error occurs during the network address translation (NAT) process of an external network access request initiated by a certain internal network device by the first gateway server, the second network server will re-perform NAT translation for that external network access request. During this process, the second network server also needs to check whether its stored external network whitelist for that internal network device contains the external network address indicated by the external network access request. Only after confirming that the external network address is included will the NAT translation be performed.

[0081] For example, as shown in Figure 6, the control center designs an external network whitelist 1 for internal network device 1, which includes external network address 1 and external network address 2. The control center designs an external network whitelist 2 for internal network device 2, which includes external network address 3 and external network address 4. The control center publishes external network whitelist 1 and external network whitelist 2 to the first gateway server and the second gateway server. When the first gateway server and the second gateway server receive an external network access request initiated by internal network device 1 or internal network device 2, they can query their respective stored external network whitelist 1 or external network whitelist 2 to determine whether to continue with network address translation.

[0082] In this embodiment, considering network operation and maintenance management and security, the access permissions of each internal network device to the external network are restricted, and an external network whitelist is published on each gateway server, thereby improving network maintainability and network security.

[0083] In an exemplary embodiment, as shown in FIG7, network address translation is performed through a first gateway server, including:

[0084] Step S702: Obtain the routing index of the internal network device that initiated the external network access request through the first gateway server; there is a one-to-one correspondence between the routing index and the internal network device.

[0085] The routing index can be understood as an index of the routing table, which stores path information pointing to a specific network address. Its main function is to implement route selection, helping data packets travel from the source address to the destination. In this embodiment, different intranet devices can have corresponding routing tables in the gateway server, each with a unique identifier as a routing index, as shown in Figure 8. This design achieves route isolation because network communication interference between different intranet devices can occur in practical applications. By configuring an independent routing table for each intranet device, each device can independently plan and manage its own network address space without worrying about conflicts with other intranet devices, thus effectively avoiding network interference. Furthermore, the same network address range can be repeatedly allocated across different intranet devices.

[0086] For example, when the first gateway server performs network address translation on an external network access request initiated by an internal network device, it can first obtain the device identifier of the internal network device, and then query the unique identifier of the routing table of the internal network device, i.e., the routing index, based on the device identifier.

[0087] Step S704: Perform network address translation based on the routing index.

[0088] For example, after the first gateway server queries the routing index corresponding to each intranet device, it can perform network address translation based on each routing index to obtain a packet identified by the routing index. The packet records the public address after network address translation of the intranet address of the intranet device, and the external address of the external network that the intranet device wants to access.

[0089] It should be noted that network address translation based on routing indexes is applied to all gateway servers.

[0090] In this embodiment, by isolating the routes between various intranet devices, network communication interference between different intranet devices can be effectively avoided, thereby improving the accuracy of network address translation and thus improving the accuracy of intranet devices accessing the external network.

[0091] In an exemplary embodiment, as shown in FIG9, the process of accessing an internal network device from an external network further includes:

[0092] Step S902: Upon receiving an intranet access request sent from the target external network forwarded by each gateway server, obtain the fixed network address of each gateway server.

[0093] In this context, the target external network can refer to the external network requesting access to the internal network device. In one example, the target external network could be the external network indicated in the external network access request. The internal network access request can refer to the request instruction from the target external network to access the internal network device. The fixed network address is a randomly generated public IP address used to replace the target external network's external IP address. The fixed network address is pre-published to the internal network device, meaning the internal network device can learn the routing information of the fixed network address in advance.

[0094] For example, after an internal network device successfully accesses a target external network, if the target external network also needs to access the internal network device, it needs to send an access request for the internal network device to the gateway server. The gateway server will forward this internal network access request to the control center. After receiving the internal network access request, the control center will obtain a fixed network address pre-created by the gateway server for address translation.

[0095] Step S904: Among all intranet devices, select the devices that have a mapping relationship with the gateway server.

[0096] The mapping relationship can refer to a one-to-one mapping between a network server and internal network devices. The selected device is an internal network device that has a one-to-one mapping relationship with the gateway server. It's important to note that when an external network accesses an internal network device, the control center queries the internal network devices with a one-to-one mapping relationship with the gateway server, and then sends the internal network access request to the internal network device, enabling communication between the target external network and that internal network device. However, when an internal network device accesses an external network, the mapping relationship between the gateway server and internal network devices can be one-to-many, meaning one gateway server can handle external network access requests initiated by multiple internal network devices.

[0097] For example, after receiving an intranet access request forwarded by the gateway server, the control center can query the intranet devices that have a one-to-one mapping relationship with the gateway server, and send the intranet access request to the intranet device.

[0098] Step S906: Based on the fixed network address and the target intranet address of the selected device, update the intranet access request to obtain the target access request.

[0099] The target access request can be understood as an access request generated after address translation of the original intranet access request. The target access request is used for the target to access the selected device from the external network.

[0100] For example, an intranet access request will carry the external IP address of the target external network and the target address to be accessed. It should be noted that the target address here is the public IP address of the gateway server. The control center will convert the obtained fixed network address into an external IP address to obtain a new access request, and then send this new access request to the intranet device that has a one-to-one mapping relationship with the gateway server.

[0101] For example, referring to Figure 10, the target external network with external address 114.114.114.114 sends an internal network access request to the gateway server. In this case, the source address is the external address 114.114.114.114, and the destination address is the public address on the gateway server, i.e., 172.49.63.21. After the internal network access request passes through the gateway server, the control center obtains the fixed network address 100.0.0.1 configured on the gateway server. Then, it queries the internal network device 3 that has a one-to-one mapping relationship with the gateway server, or in other words, the internal network address 10.0.0.2 of internal network device 3 that has a one-to-one mapping relationship with the public address 172.49.63.21 on the gateway server. The control center will translate the current target address 172.49.63.2 into the internal network address 10.0.0.2, and then translate the external network address 114.114.114.114 into the fixed network address 100.0.0.1, thus obtaining a new access request.

[0102] In this embodiment, considering that when accessing an internal network device from the external network, the external network address is actually unknown, and the internal network device has not learned the relevant routing information, publishing a whitelist route for each external network would undoubtedly result in a huge number of routes that are difficult to manage. To solve this problem, this embodiment configures a fixed network address on the gateway server to replace the external network address. Since the internal network device learns the routing information of the fixed network address in advance, it can normally receive access initiated by the target external network, thus improving the reliability of external network access to the internal network device.

[0103] In an exemplary embodiment, as shown in FIG11, the process of the intranet device responding to the intranet access request further includes:

[0104] Step S1102: Upon receiving a response signal from the selected device based on the target access request, the response signal is sent to the gateway server.

[0105] The response signal can refer to the signal from the selected device in response to the target access request.

[0106] For example, after receiving a target access request, the selected device can generate a corresponding response signal and send the response signal to the control center. Upon receiving this response signal, the control center can forward it to the gateway server that has a one-to-one mapping relationship with the selected device.

[0107] Step S1104: Receive the target result returned by the gateway server in response to the response signal; the target result is generated after the gateway server converts the fixed network address carried in the response signal to obtain the external network address, and then sends the response signal to the target external network that belongs to the external network address.

[0108] For example, after receiving the response signal from the control center, the gateway server can translate the fixed network address carried in the response signal into the correct external network address. It can be understood that after sending the internal network access request to the control center, the gateway server stores the target external network address in its session table for reverse translation when the internal network device responds. After completing the address translation, the gateway server sends the translated response signal to the target external network and sends a result back to the control center, indicating that the response signal has been successfully sent to the target external network.

[0109] For example, referring to Figure 12, intranet device 3 returns a response signal to the target access request. The source address is the intranet address of intranet device 3, 10.0.0.2, and the destination address is the fixed network address, 100.0.0.1. The control center queries the gateway server with a one-to-one mapping relationship with intranet device 3 and sends the response signal to that gateway server. The gateway server queries its session table to find the external network address 114.114.114.114, converts the target address from the fixed network address 100.0.0.1 to the external address 114.114.114.114, and converts the source address from the intranet address 10.0.0.2 to the public address 172.49.63.21.

[0110] In this embodiment, when an internal network device responds to an internal network access request from an external network, an address reverse translation is performed to convert the fixed network address into the correct external network address, thereby improving the reliability of the internal network device's response to the internal network access request from the external network.

[0111] In an exemplary embodiment, as shown in Figure 13, the process of obtaining external network access requests further includes:

[0112] Step S1302: Receive an encrypted access request from at least one intranet device through a data transmission channel established based on a network security protocol.

[0113] The control center has a Point-of-Presence (POP). A POP is a network access point deployed at a specific geographical location within the network. These access points are typically established by network service providers in different regions to optimize network routing and provide better access speeds. The data transmission channel can be understood as the channel through which data is transmitted between the control center and the POP. As shown in Figure 14, each intranet device and the control center activates at the nearest POP. A data transmission channel can be established between the intranet device / control center and the POP using a network security protocol (Internet Protocol Security, IPSec). Encrypted access requests can be obtained by encrypting the original external network access request sent by the intranet device.

[0114] For example, after an internal network device generates an external network access request, the request is sent to the corresponding Point of Presence (POP). These POPs can be connected via VXLAN (Virtual eXtensible Local Area Network) tunnels. A VXLAN tunnel establishes a logical tunnel between the source and destination network devices, enabling interconnection between multiple data centers across different regions. The POP corresponding to the internal network device forwards the external network access request to the POP corresponding to the control center. The POP at the control center then encrypts the request and sends it to the control center via a data transmission channel.

[0115] Step S1304: Decrypt the encrypted access request to obtain the external network access request.

[0116] For example, after receiving an encrypted access request transmitted by a POP point through a data transmission channel, the control center can encrypt the encrypted access request to obtain the original external network access request initiated by the intranet device.

[0117] In this embodiment, data transmission is performed through a data transmission channel established based on a network security protocol, which improves the security of external network access request transmission and thus enhances the security of the external network access process.

[0118] In one embodiment, the external network access method includes the following steps:

[0119] Through the data transmission channel established based on IPSe, the headquarters control center receives external network access requests for a target external network from at least one branch intranet device forwarded by the corresponding POP point. For each external network access request, the headquarters control center obtains the routing priority of the external network access request to be transmitted to two NAT gateways, and sends the external network access request to the first NAT gateway with the highest priority. The first NAT gateway queries the external network whitelist of the branch intranet device that initiated the external network access request. The external network whitelist records the external network addresses that the branch intranet device is allowed to access. When the external network whitelist contains the external network address indicated by the external network access request, the first NAT gateway obtains the routing table index of the branch intranet device and performs network address translation based on the routing table index. If an error occurs during the network address translation process of the first NAT gateway, the other NAT gateway (hereinafter referred to as the second NAT gateway) will perform the network address translation again.

[0120] When the headquarters control center receives intranet access requests forwarded from the target external network by each NAT gateway, it obtains the fixed network address of each NAT gateway. Then, it selects devices from the intranet devices of each branch that have a one-to-one mapping relationship with that NAT gateway. Based on the fixed network address and the target intranet address of the selected device, it updates the intranet access request to obtain the target access request, which is used for the target external network to access the selected device. When the headquarters control center receives a response signal from the selected device based on the target access request, it sends the response signal to the NAT gateway with the one-to-one mapping relationship with the selected device. The NAT gateway translates the fixed network address carried in the response signal to obtain the external network address and sends the address-translated response signal to the target external network.

[0121] In this embodiment, when the headquarters control center receives an external network access request from at least one branch intranet device, it determines the priority of each external network access request and assigns it to one of the two NAT gateways. The request is then sent to the highest-priority first NAT gateway for network address translation (NAT). If the first NAT gateway encounters an anomaly during NAT translation, the request is forwarded to the second NAT gateway for NAT translation. The second NAT gateway then translates the intranet address of the branch intranet device into the public IP address indicated by the external network access request, generating the external network access result for the branch intranet device. In other words, this embodiment introduces multiple NAT gateways, overcoming the resource pressure inherent in a single unified gateway server in traditional technologies. Furthermore, if one NAT gateway fails, the others can promptly receive external network access requests from the failed gateway, improving external network access efficiency. Additionally, this embodiment sets priorities for transmitting external network access requests initiated by different branch intranet devices to various NAT gateways, ensuring orderly transmission of these requests and further improving external network access efficiency. Moreover, the priority is determined based on the connection attributes between the NAT gateway and the branch intranet devices, which improves the reliability of each priority and thus improves the reliability of the entire external network access process.

[0122] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0123] Based on the same inventive concept, this application also provides an external network access device for implementing the external network access method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the limitations in the one or more external network access device embodiments provided below can be found in the limitations of the external network access method described above, and will not be repeated here.

[0124] In an exemplary embodiment, as shown in FIG15, an external network access device is provided, comprising: a routing priority acquisition module 1502, configured to, upon receiving an external network access request sent by at least one internal network device, acquire the priority of each external network access request transmitted to at least two gateway servers; the priority is determined based on the connection attributes between the gateway server and the internal network device; a first network address translation module 1504, configured to send the external network access request to the first gateway server with the highest priority among the gateway servers for network address translation; a second gateway service determination module 1506, configured to, when an anomaly occurs in the network address translation process of the first gateway server, select the second gateway server with the highest priority other than the first gateway server from among the gateway servers; a second network address translation module 1508, configured to send the external network access request to the second gateway server for network address translation; and an external network access result generation module 1510, configured to, when the second gateway server converts the internal network address of the internal network device into the public network address of the external network indicated by the external network access request, obtain the external network access result of the internal network device.

[0125] In one embodiment, the first network address translation module 1504 is further configured to: send an external network access request to a first gateway server, and query the external network whitelist of the internal network device that initiated the external network access request through the first gateway server; the external network whitelist records external network addresses that are allowed to be accessed by the internal network device; and when the external network whitelist contains the external network address indicated by the external network access request, perform network address translation through the first gateway server.

[0126] In one embodiment, the first network address translation module 1504 is further configured to: obtain the routing index of the internal network device that initiated the external network access request through the first gateway server; the routing index has a one-to-one correspondence with the internal network device; and perform network address translation based on the routing index.

[0127] In one embodiment, the apparatus is further configured to: upon receiving an intranet access request forwarded by each gateway server from a target external network, obtain a fixed network address for each gateway server; among the intranet devices, select a device that has a mapping relationship with the gateway server; update the intranet access request based on the fixed network address and the target intranet address of the selected device to obtain a target access request; the target access request is used for the target external network to access the selected device.

[0128] In one embodiment, the apparatus is further configured to: upon receiving a response signal from a selected device based on a target access request, send the response signal to a gateway server; receive a target result returned by the gateway server in response to the response signal; the target result is generated after the gateway server converts the fixed network address carried in the response signal to obtain an external network address, and sends the response signal to a target external network belonging to the external network address.

[0129] In one embodiment, the apparatus is further configured to: receive an encrypted access request sent by at least one intranet device through a data transmission channel established based on a network security protocol; and decrypt the encrypted access request to obtain an extranet access request.

[0130] Each module in the aforementioned external network access device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0131] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram is shown in Figure 16. The computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is connected to the system bus via the I / O interfaces. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes non-volatile storage media and internal memory. The non-volatile storage media stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database of the computer device stores data accessed from the external network. The I / O interfaces of the computer device are used for exchanging information between the processor and external devices. The communication interface of the computer device is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements an external network access method.

[0132] Those skilled in the art will understand that the structure shown in Figure 16 is a block diagram of a partial structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. The computer device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0133] In an exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to perform the following steps: upon receiving an external network access request sent by at least one internal network device, for each external network access request, the priority of the external network access request being transmitted to at least two gateway servers is obtained; the priority is determined based on the connection attributes between the gateway server and the internal network device; for the first gateway server with the highest priority among all gateway servers, the external network access request is sent to the first gateway server for network address translation; when an anomaly occurs in the first gateway server during the network address translation process, the second gateway server with the highest priority (excluding the first gateway server) is selected from all gateway servers; the external network access request is sent to the second gateway server for network address translation; when the second gateway server translates the internal network address of the internal network device into the public network address of the external network indicated by the external network access request, the external network access result of the internal network device is obtained.

[0134] In one embodiment, when the processor executes the computer program, it further implements the following steps: sending an external network access request to a first gateway server; querying the external network whitelist of the internal network device that initiated the external network access request through the first gateway server; the external network whitelist records external network addresses that are allowed for access by internal network devices; and when the external network whitelist contains the external network address indicated by the external network access request, performing network address translation through the first gateway server.

[0135] In one embodiment, when the processor executes the computer program, it further performs the following steps: obtaining the routing index of the internal network device that initiated the external network access request through the first gateway server; there is a one-to-one correspondence between the routing index and the internal network device; and performing network address translation based on the routing index.

[0136] In one embodiment, when the processor executes the computer program, it further performs the following steps: upon receiving an intranet access request sent by the target external network forwarded by each gateway server, for each gateway server, it obtains the fixed network address of the gateway server; among the intranet devices, it filters out the selected devices that have a mapping relationship with the gateway server; based on the fixed network address and the target intranet address of the selected device, it updates the intranet access request to obtain the target access request; the target access request is used for the target external network to access the selected device.

[0137] In one embodiment, when the processor executes the computer program, it further performs the following steps: upon receiving a response signal from a selected device based on a target access request, it sends the response signal to a gateway server; it receives the target result returned by the gateway server in response to the response signal; the target result is generated after the gateway server converts the fixed network address carried in the response signal to obtain an external network address, and sends the response signal to the target external network belonging to the external network address.

[0138] In one embodiment, when the processor executes the computer program, it also performs the following steps: receiving an encrypted access request sent by at least one intranet device through a data transmission channel established based on a network security protocol; and decrypting the encrypted access request to obtain an extranet access request.

[0139] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, it performs the following steps: upon receiving an external network access request from at least one internal network device, for each external network access request, the priority of the external network access request being transmitted to at least two gateway servers is obtained; the priority is determined based on the connection attributes between the gateway server and the internal network device; for the first gateway server with the highest priority among all gateway servers, the external network access request is sent to the first gateway server for network address translation; when an anomaly occurs in the first gateway server during the network address translation process, the second gateway server with the highest priority (excluding the first gateway server) is selected from all gateway servers; the external network access request is sent to the second gateway server for network address translation; when the second gateway server translates the internal network address of the internal network device into the public network address of the external network indicated by the external network access request, the external network access result of the internal network device is obtained.

[0140] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: sending an external network access request to a first gateway server; querying the external network whitelist of the internal network device that initiated the external network access request through the first gateway server; the external network whitelist records external network addresses that are allowed for access by the internal network device; and when the external network whitelist contains the external network address indicated by the external network access request, performing network address translation through the first gateway server.

[0141] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: obtaining the routing index of the internal network device that initiated the external network access request through the first gateway server; there is a one-to-one correspondence between the routing index and the internal network device; and performing network address translation based on the routing index.

[0142] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: upon receiving an intranet access request sent by the target external network forwarded by each gateway server, for each gateway server, obtaining the fixed network address of the gateway server; among the intranet devices, selecting the devices that have a mapping relationship with the gateway server; updating the intranet access request based on the fixed network address and the target intranet address of the selected device to obtain the target access request; the target access request is used for the target external network to access the selected device.

[0143] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: upon receiving a response signal from the selected device based on the target access request, sending the response signal to the gateway server; receiving the target result returned by the gateway server in response to the response signal; the target result is generated after the gateway server converts the fixed network address carried in the response signal to obtain the external network address, and sends the response signal to the target external network belonging to the external network address.

[0144] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: receiving an encrypted access request sent by at least one intranet device through a data transmission channel established based on a network security protocol; and decrypting the encrypted access request to obtain an extranet access request.

[0145] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps: upon receiving an external network access request from at least one intranet device, for each external network access request, the priority of the external network access request being transmitted to at least two gateway servers is obtained; the priority is determined based on the connection attributes between the gateway server and the intranet device; for the first gateway server with the highest priority among all gateway servers, the external network access request is sent to the first gateway server for network address translation; when an anomaly occurs in the first gateway server during the network address translation process, the second gateway server with the highest priority (excluding the first gateway server) is selected from all gateway servers; the external network access request is sent to the second gateway server for network address translation; when the second gateway server translates the intranet address of the intranet device into the public IP address of the external network indicated by the external network access request, the external network access result of the intranet device is obtained.

[0146] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: sending an external network access request to a first gateway server; querying the external network whitelist of the internal network device that initiated the external network access request through the first gateway server; the external network whitelist records external network addresses that are allowed for access by the internal network device; and when the external network whitelist contains the external network address indicated by the external network access request, performing network address translation through the first gateway server.

[0147] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: obtaining the routing index of the internal network device that initiated the external network access request through the first gateway server; there is a one-to-one correspondence between the routing index and the internal network device; and performing network address translation based on the routing index.

[0148] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: upon receiving an intranet access request sent by the target external network forwarded by each gateway server, for each gateway server, obtaining the fixed network address of the gateway server; among the intranet devices, selecting the devices that have a mapping relationship with the gateway server; updating the intranet access request based on the fixed network address and the target intranet address of the selected device to obtain the target access request; the target access request is used for the target external network to access the selected device.

[0149] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: upon receiving a response signal from the selected device based on the target access request, sending the response signal to the gateway server; receiving the target result returned by the gateway server in response to the response signal; the target result is generated after the gateway server converts the fixed network address carried in the response signal to obtain the external network address, and sends the response signal to the target external network belonging to the external network address.

[0150] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: receiving an encrypted access request sent by at least one intranet device through a data transmission channel established based on a network security protocol; and decrypting the encrypted access request to obtain an extranet access request.

[0151] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0152] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0153] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0154] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for accessing the external network, characterized in that, The method includes: Upon receiving an external network access request from at least one internal network device, for each external network access request, the priority of the external network access request being transmitted to at least two gateway servers is determined; the priority is determined based on the connection attributes between the gateway server and the internal network device. For the first gateway server, which has the highest priority among all the gateway servers, the external network access request is sent to the first gateway server for network address translation. When the first gateway server encounters an anomaly during network address translation, the second gateway server with the highest priority, excluding the first gateway server, is selected from among the gateway servers. The external network access request is sent to the second gateway server for network address translation; and When the second gateway server converts the intranet address of the intranet device into the public IP address of the external network indicated by the external network access request, the external network access result of the intranet device is obtained.

2. The method according to claim 1, characterized in that, Sending the external network access request to the first gateway server for network address translation includes: The external network access request is sent to the first gateway server. The first gateway server then queries the external network whitelist of the internal network device that initiated the external network access request; the external network whitelist records the external network addresses that the internal network device is allowed to access. When the external network whitelist contains the external network address indicated by the external network access request, network address translation is performed through the first gateway server.

3. The method according to claim 2, characterized in that, The step of performing network address translation through the first gateway server includes: The routing index of the internal network device that initiated the external network access request is obtained through the first gateway server; the routing index has a one-to-one correspondence with the internal network device; and Based on the routing index, network address translation is performed.

4. The method according to claim 1, characterized in that, The method further includes: Upon receiving an intranet access request sent from the target external network forwarded by each of the gateway servers, the fixed network address of each gateway server is obtained. Among the aforementioned intranet devices, select devices that have a mapping relationship with the gateway server; and Based on the fixed network address and the target intranet address of the selected device, the intranet access request is updated to obtain a target access request; the target access request is used for the target to access the selected device from the external network.

5. The method according to claim 4, characterized in that, The method further includes: Upon receiving a response signal from the selected device based on the target access request, the response signal is sent to the gateway server; and The gateway server receives the target result returned in response to the response signal; the target result is generated by the gateway server converting the fixed network address carried in the response signal to obtain an external network address, and then sending the response signal to the target external network belonging to the external network address.

6. The method according to claim 1, characterized in that, The method further includes: Through a data transmission channel established based on network security protocols, it receives encrypted access requests from at least one intranet device; and The encrypted access request is decrypted to obtain an external network access request.

7. An external network access device, characterized in that, The device includes: The routing priority acquisition module is used to, upon receiving an external network access request sent by at least one internal network device, acquire the priority of each external network access request to be transmitted to at least two gateway servers; the priority is determined based on the connection attributes between the gateway server and the internal network device. The first network address translation module is used to send the external network access request to the first gateway server with the highest priority among all the gateway servers, and perform network address translation. The second gateway service module is used to select the second gateway server with the highest priority, excluding the first gateway server, from among the gateway servers when the first gateway server encounters an anomaly during the network address translation process. The second network address translation module is used to send the external network access request to the second gateway server for network address translation; and The module for generating external network access results is used to obtain the external network access result of the internal network device when the second gateway server converts the internal network address of the internal network device into the public network address of the external network indicated by the external network access request.

8. The apparatus according to claim 7, characterized in that, The first network address translation module is also used for: The external network access request is sent to the first gateway server, which then queries the external network whitelist of the internal network device that initiated the external network access request. The external network whitelist records the external network addresses that the internal network device is allowed to access. and When the external network whitelist contains the external network address indicated by the external network access request, network address translation is performed through the first gateway server.

9. The apparatus according to claim 9, characterized in that, The first network address translation module is also used for: The routing index of the internal network device that initiated the external network access request is obtained through the first gateway server; the routing index has a one-to-one correspondence with the internal network device; and Based on the routing index, network address translation is performed.

10. The apparatus according to claim 7, characterized in that, The device is also used for: Upon receiving an intranet access request sent from the target external network forwarded by each of the gateway servers, the fixed network address of each gateway server is obtained. Among the various intranet devices, select the devices that have a mapping relationship with the gateway server; and Based on the fixed network address and the target intranet address of the selected device, the intranet access request is updated to obtain a target access request; the target access request is used for the target to access the selected device from the external network.

11. The apparatus according to claim 10, characterized in that, The device is also used for: Upon receiving a response signal from the selected device based on the target access request, the response signal is sent to the gateway server; and Receive the target result returned by the gateway server in response to the response signal; The target result is generated by the gateway server converting the fixed network address carried in the response signal to obtain an external network address, and then sending the response signal to the target external network belonging to the external network address.

12. The apparatus according to claim 7, characterized in that, The device is also used for: Through a data transmission channel established based on network security protocols, it receives encrypted access requests from at least one intranet device; and The encrypted access request is decrypted to obtain an external network access request.

13. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

15. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images