CN115834655A

CN115834655A - Method and device for accessing server in private network

Info

Publication number: CN115834655A
Application number: CN202211317069.8A
Authority: CN
Inventors: 刘天驰
Original assignee: Alipay Hangzhou Information Technology Co Ltd
Current assignee: Alipay Hangzhou Information Technology Co Ltd
Priority date: 2022-10-26
Filing date: 2022-10-26
Publication date: 2023-03-21

Abstract

The embodiment of the specification relates to the technical field of network communication, and provides a method and a device for accessing a server in a private network. The method comprises the following steps: the proxy server node receives a cross-network connection request for the access sent by a client through a first connection; the cross-network connection request is used for the client in the external network to access the server in the private network; the proxy server node selects a public network connection corresponding to the service type accessed at this time from at least two public network connections between the proxy server node and the proxy client node; different service types correspond to different public network connections; the proxy server node sends the cross-network connection request to the proxy client node through the selected public network connection; and the agent service end node transmits the information of the current access between the client and the server by using the first connection and the selected public network connection. The embodiment of the specification can avoid mutual interference of the access flows of different service types.

Description

Method and device for accessing server in private network

Technical Field

One or more embodiments of the present specification relate to network communication technology, and more particularly, to a method and apparatus for accessing a server in a private network.

Background

With the popularization of cloud computing, a multi-cloud architecture that deploys application programs in multiple public clouds or multiple private clouds is increasingly common. In the multi-cloud environment, a large number of scenes need to cross-cloud and cross-network access to application programs in the private network, and the application programs in the private network become accessed service terminals so as to share data and services in different clouds and different networks.

In order to protect the private data of the user and network security, a firewall and other technologies are usually used in the private network to prevent an external network from accessing its internal server, which results in network isolation between the public network and the private network, which makes it difficult to access the server in the private network across clouds and networks. In order to solve the above problems, a cross-network proxy based on a private network penetration technology is developed and becomes one of the main schemes for connecting private networks in a cloudy scene.

However, the cross-network proxy realized based on the private network penetration technology at present has the problem that the flows of accesses of different service types interfere with each other.

Disclosure of Invention

One or more embodiments of the present specification describe a method and apparatus for accessing a server in a private network, which can avoid mutual interference of traffic of accesses of different service types.

According to a first aspect, there is provided a method of accessing a server in a private network, comprising:

the proxy server node receives a cross-network connection request for the access sent by a client through a first connection; the cross-network connection request is used for the client in the external network to access a server in a private network, and the cross-network connection request carries a private network address of the server;

the proxy server-side node determines the type of the accessed service;

the proxy server node selects a public network connection corresponding to the service type accessed this time from at least two public network connections between the proxy server node and the proxy client node; wherein, different service types correspond to different public network connections;

the proxy server node sends the cross-network connection request to the proxy client node through the selected public network connection;

after receiving a connection success message returned by the proxy client node, the proxy server node returns a connection success message to the client;

and the agent service end node transmits the information of the current access between the client and the server by using the first connection and the selected public network connection.

Wherein the first connection is a sock 5 protocol-based connection initiated by the client to the proxy server node; and/or, the cross-network connection request carries the service type information of the current access; correspondingly, the step of determining the service type of the current access by the proxy server end node comprises the following steps: and the proxy server node determines the type of the accessed service by analyzing the cross-network connection request.

Before generating the access, the method further comprises the following steps: and the proxy server node establishes the at least two public network connections with the proxy client node.

Wherein the proxy server node establishes the at least two public network connections with the proxy client node, including: after the proxy client node is started, the proxy server node establishes initial channel connection with the proxy client node; the agent server node dynamically updates the information of each service type required currently to the agent client node through the initial channel connection; and the proxy server node and the proxy client node dynamically set a corresponding public network connection for each service type required currently according to the dynamically updated information of the service types.

At least two accesses of the same service type multiplex the same public network connection in the at least two public network connections; wherein the at least two accesses are: access to at least one server in said private network connected to the same said proxy client node, initiated by at least one client connected to the same said proxy server node.

After the proxy server node receives the cross-network connection request and before the proxy server node sends the cross-network connection request to the proxy client node through the selected public network connection, the method further comprises the following steps: the proxy server node distributes a cross-network connection ID for the access;

the method further comprises the following steps:

the proxy server end node binds the cross-network connection ID with the first connection;

the proxy server node adds the cross-network connection ID in all the first information of the access sent to the proxy client node;

the proxy server node analyzes the cross-network connection ID from the second information sent by the proxy client node, deletes the cross-network connection ID in the second information, and then sends the second information to the client through the first connection bound with the analyzed cross-network connection ID; wherein the information comprises signaling and data.

The method further comprises the following steps: aiming at each public network connection in the at least two public network connections, a special sending queue and a special working thread for the public network connection are arranged in the agent service end node;

the agent server node transmits the information between the client and the server by using the first connection and the selected public network connection, and the method comprises the following steps: the agent server node receives information sent by a client through the first connection; the agent service end node uses the selected working thread special for the public network connection to place the received information into the selected sending queue special for the public network connection; and the agent service end node sequentially takes out information from the special sending queue for the public network connection by using the selected special working thread for the public network connection, and sends the taken out information to the agent client end node through the selected public network connection.

According to a second aspect, a method of accessing a server in a private network is provided, wherein at least two public network connections are established between an agent client node in the private network and an agent server node outside the private network, wherein different service types correspond to different public network connections; the method comprises the following steps:

the proxy client node receives a cross-network connection request aiming at the access from one of the at least two public network connections; the cross-network connection request carries a private network address of a service end in a private network;

the proxy client node establishes a second connection with the server according to a private network address carried in the cross-network connection request;

after the second connection is successfully established, the proxy client node returns a connection success message to the proxy server node through the public network connection receiving the cross-network connection request;

and the proxy client node transmits the information of the access between the client and the server by using a second connection and the public network connection receiving the cross-network connection request.

Wherein, the cross-network connection request received by the agent client node carries a cross-network connection ID;

after establishing the second connection, further comprising:

the proxy client node binds the cross-network connection ID with the second connection;

the proxy client node adds the cross-network connection ID in all second information of the current access sent to the proxy server node; the proxy client node sends all the first information to the server end through a second connection bound with the cross-network connection ID according to the cross-network connection ID carried in all the first information sent by the proxy server node; wherein the information comprises signaling and data.

The method further comprises the following steps: aiming at each public network connection in the at least two public network connections, a special sending queue and a special working thread for the public network connection are arranged in the agent client node;

the proxy client node transmits the information of the access between the client and the server by using a second connection and a public network connection which receives a cross-network connection request, and the information comprises: the proxy client node receives information sent by the server through the second connection; the agent client node uses the working thread special for public network connection which receives the cross-network connection request to place the received information into a sending queue special for the public network connection; and the agent server node sequentially takes out information from the special sending queue by using the special working thread and sends the taken out information to the agent server node through the public network connection.

According to a third aspect, there is provided a method of accessing a server in a private network, comprising:

the client establishes a first connection with the proxy server node; the client sends a cross-network connection request aiming at the access to the proxy server node through a first connection; the cross-network connection request is used for the client in the external network to access the server in the private network, and the cross-network connection request carries the private network address of the server.

According to a fourth aspect, there is provided an apparatus for accessing a server in a private network, for use in a proxy server node, the apparatus comprising:

the proxy server module is configured to establish a first connection with the client;

the cross-network server module is configured to establish at least two public network connections with the proxy client node, wherein different service types correspond to different public network connections;

the processing module is configured to receive a cross-network connection request for the current access sent by the client through the first connection established by the proxy server module; the cross-network connection request is used for the client in the external network to access a server in a private network, and the cross-network connection request carries a private network address of the server; determining the type of the service accessed this time; selecting a public network connection corresponding to the service type accessed this time from at least two public network connections established by the cross-network server module, and sending a cross-network connection request to the proxy client node through the selected public network connection; after receiving a connection success message returned by the proxy client node, sending the connection success message to the client through a first connection established by the proxy server module; and transmitting the information of the access between the client and the server through the first connection established by the proxy server module and the public network connection established by the cross-network server module.

According to a fifth aspect, there is provided an apparatus for accessing a server in a private network, for use in a proxy client node, the apparatus comprising:

the cross-network server unit is configured to establish at least two public network connections with the proxy server node outside the private network, wherein different service types correspond to different public network connections;

the control unit is configured to receive a cross-network connection request aiming at the current access from one of the at least two public network connections and analyze a private network address of a service end in a private network carried in the cross-network connection request; after the second connection is successfully established, a connection success message is returned to the proxy server node through the public network connection receiving the cross-network connection request; transmitting the information of the current access between the client and the server by utilizing the public network connection established by the cross-network server unit and the second connection established by the proxy client unit;

and the proxy client unit is configured to establish a second connection with the server according to the private network address carried in the cross-network connection request.

According to a sixth aspect, there is provided an apparatus for accessing a server in a private network, applied to a client, the apparatus comprising:

the connection establishing module is configured to establish a first connection with the proxy server node;

the information processing module is configured to send a cross-network connection request aiming at the current access to the proxy server node through the first connection; the cross-network connection request is used for the client in the external network to access the server in the private network, and the cross-network connection request carries the private network address of the server.

According to a seventh aspect, there is provided a computing device comprising a memory and a processor, the memory having stored therein executable code, the processor, when executing the executable code, implementing a method as described in any of the embodiments of the present specification.

The method and the device for accessing the server in the private network provided by each embodiment of the specification have at least the following beneficial effects:

1. at least two public network connections are established between the same agent server node and the same agent client node, different service types correspond to different public network connections, that is, the access flows of different service types are transmitted through different public network connections. In this way, the problem of mutual interference of accessed data of different service types is avoided.

2. Since the access of the same service type has the same requirements for network bandwidth, response timeliness and the like, in an embodiment of the present specification, each access of the same service type can reuse one public network connection between the proxy server node and the proxy client node, so that resources of the public network connection can be saved.

3. In the prior art, after access is initiated, an agent service end node sends an instruction for establishing a new public network connection to an agent client end node, and the agent client end node receives the instruction and then initiates establishment of a new public network connection to the agent service end node, so that extra time consumption in two aspects of sending the instruction and establishing the new public network connection is generated, and the extra time consumption can reach hundreds of milliseconds and even seconds in a multi-cloud data transmission scene of a cross-region and a country, and the efficiency of establishing the cross-network connection is seriously influenced. In the embodiment of the present description, the public network connection between the proxy server node and the proxy client node may be pre-established before the access is initiated, so that after the access is initiated, there is no additional time consumption in the two aspects of sending the instruction and newly establishing the public network connection in the prior art, and therefore, the time for establishing the cross-network connection from the client to the server can be shortened, and the efficiency of accessing the server in the private network can be improved.

4. In an embodiment of the present specification, at least two public network connections between the proxy server node and the proxy client node are dynamically established, that is, instead of fixedly setting a fixed number of public network connections in advance, at least two public network connections may be dynamically set according to various service types that need to be used within a period of time, so that a dynamic change requirement of a service can be met, and waste of public network connection resources is avoided.

5. In an embodiment of the present specification, a dedicated work thread and a dedicated transmission queue may be set in the agent client node and the agent server node for each public network connection, so that resources occupied by the work thread and the transmission queue may be dynamically adjusted according to a required amount of the service type corresponding to each public network connection for the resources, and the requirements of the services are better met.

Drawings

In order to more clearly illustrate the embodiments of the present specification or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, and it is obvious that the drawings in the following description are some embodiments of the present specification, and other drawings can be obtained by those skilled in the art without creative efforts.

Fig. 1 is a schematic diagram of a system architecture for realizing access to a service end in a private network based on a private network penetration technology.

Fig. 2 is a schematic diagram of a system architecture to which one embodiment of the present description applies.

Fig. 3 is a flowchart of a method for accessing a server in a private network applied to a proxy server node in one embodiment of the present description.

Fig. 4 is a flow diagram of a method of accessing a server in a private network applied to a proxy client node in one embodiment of the present description.

Fig. 5 is a flowchart of a method of accessing a server in a private network applied to a client in one embodiment of the present specification.

Fig. 6 is a schematic diagram of a client, a proxy server node, a proxy client node, and a server in an access private network implemented cooperatively in one embodiment of the present specification.

Fig. 7 is a schematic structural diagram of a proxy server node in one embodiment of the present specification.

Fig. 8 is a schematic diagram of a proxy client node in one embodiment of the present description.

Fig. 9 is a schematic structural diagram of a client in one embodiment of the present specification.

Detailed Description

Some proper names referred to in the embodiments of the present specification will be described first.

The server side: software that provides a certain service or a hardware device that carries the software.

Private network: and a Private network environment isolated from other network environments, such as a Virtual Private Cloud (VPC), a local area network, and the like.

Private network penetration: a network technology for accessing the service end in private network from external network includes setting up the network channel from private network to public network, utilizing said channel to launch network request from external network to the service end in private network in reverse direction, not exposing port directly from the service end in private network to public network and ensuring privacy of private network environment.

Referring to fig. 1, the method for accessing a server in a private network by using a private network penetration technology includes: setting an agent server node (which can be called an agent server) for a client in a public network, and setting an agent client node (which can be called an agent) for a server in a private network environment; when a client needs to access a server in a private network environment, the connection from the client to the proxy server node is established, the public network connection from the proxy server node to the proxy client node and the private network connection from the proxy client node to the server are established, so that the cross-network connection from the client of the external network to the server in the private network is realized, and the access of the client of the external network to the server in the private network is realized.

Referring to fig. 1, the number of the clients is m, and the number of the servers in the private network environment V is s, where m and s are positive integers greater than 1. E.g. s is larger than m, when multiple clients, e.g. m clients, simultaneously access m servers in the private network environment V, in the prior art, a public network connection from the proxy server node to the proxy client node is multiplexed. That is, only one public network connection is established between the same proxy server node and the same proxy client node, and m pieces of data accessed by m clients to m servers in the private network environment V are transmitted through the same public network connection. Therefore, the problem that the flows of accesses of different service types interfere with each other may be caused. For example, when the public network connection is shared to transmit m pieces of accessed data, a file download request based on an HTTP protocol corresponding to access 1 and a heartbeat message corresponding to access 2 may need to be transmitted at the same time, where the file download request is characterized by a large data transmission amount and is insensitive to delay, and the heartbeat message is small and sensitive to delay, because the public network connection between the proxy server node and the proxy client node is shared, the file download request for accessing 1 occupies a large amount of network resources to perform data transmission, so that the heartbeat message for accessing 2 cannot be transmitted in time, and finally, a user may have an exception such as timeout.

The scheme provided by the specification is described below with reference to the accompanying drawings.

It is first noted that the terminology used in the embodiments of the present invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used in the description of the invention and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

To facilitate understanding of the present specification, a description will first be made of a system architecture to which the present specification applies. As shown in fig. 2, the system architecture mainly includes: at least one client connected to the same proxy server node, a proxy server node (which may be referred to as proxy server) located in the public network, a proxy client node (which may be referred to as proxy agent) located in the private network environment V, at least one server connected to the proxy client node located in the private network environment V. As shown in fig. 2, n public network connections are established between the proxy server node and the proxy client node, where n is a positive integer greater than 1, and different public network connections correspond to different service types.

It should be understood that the number of clients m, the number of servers s, and the number of public network connections n in fig. 2 are merely illustrative. Any number may be selected and laid out as desired for the implementation.

In the embodiments of the present specification, the processing of the proxy server node (may be referred to as proxy server), the proxy client node (may be referred to as proxy agent), the client, and the server is involved. The following describes the above embodiments in different ways.

Fig. 3 is a flowchart of a method for accessing a server in a private network applied to a proxy server node in one embodiment of the present description. It is to be understood that the method may also be performed by any apparatus, device, platform, cluster of devices having computing, processing capabilities. Referring to fig. 2 and 3, the method includes:

step 301: the proxy server node receives a cross-network connection request for the access sent by a client through a first connection; the cross-network connection request is used for the client in the external network to access the server in the private network and carries the private network address of the server.

Step 303: and the proxy server-end node determines the service type of the access.

Step 305: the proxy server node selects a public network connection corresponding to the service type accessed this time from at least two public network connections between the proxy server node and the proxy client node; wherein, different service types correspond to different public network connections.

Step 307: and the proxy server node sends the cross-network connection request to the proxy client node through the selected public network connection.

Step 309: and after receiving the connection success message returned by the proxy client node, the proxy server node returns the connection success message to the client.

Step 311: and the agent service end node transmits the information of the current access between the client and the server by using the first connection and the selected public network connection.

As can be seen from the process shown in fig. 3, in the embodiment of this specification, at least two public network connections are established between the same proxy server node and the same proxy client node, and different service types correspond to different public network connections. Therefore, various defects caused by the fact that m client-side data accessed by m server-sides in a private network environment V are transmitted through the same public network connection in the prior art are avoided. In the embodiment of the present specification, the accessed traffic of different service types will be transmitted through different public network connections, and therefore will not interfere with each other.

Fig. 4 is a flow diagram of a method of accessing a server in a private network applied to a proxy client node in one embodiment of the present description. It is to be understood that the method may also be performed by any apparatus, device, platform, cluster of devices having computing, processing capabilities. Referring to fig. 2, fig. 3, and fig. 4, at least two public network connections are established between the proxy client node in the private network and the proxy server node outside the private network, wherein different service types correspond to different public network connections; the method comprises the following steps:

step 401: the proxy client node receives a cross-network connection request aiming at the current access from one of at least two public network connections; the cross-network connection request carries a private network address of a server in a private network.

Step 403: and the proxy client node establishes a second connection with the corresponding server according to the private network address carried in the cross-network connection request.

Step 405: after the second connection is established successfully, the proxy client node returns a connection success message to the proxy server node by receiving the public network connection of the cross-network connection request.

Step 407: and the proxy client node transmits the information of the access between the client and the server by using the second connection and the public network connection receiving the cross-network connection request.

Fig. 5 is a flowchart of a method of accessing a server in a private network applied to a client in one embodiment of the present description. It is to be understood that the method may also be performed by any apparatus, device, platform, cluster of devices having computing, processing capabilities. Referring to fig. 2, 3, 4 and 5, the method includes:

step 501: the client establishes a first connection with the proxy server node.

Step 503: the client sends a cross-network connection request aiming at the access to the proxy server node through a first connection; the cross-network connection request is used for the client in the external network to access the server in the private network, and the cross-network connection request carries the private network address of the server.

Each step in the above-described processes shown in fig. 3 to 5 will be described with reference to specific embodiments and fig. 2 and 6. The process of accessing the server in the private network, which is realized by the cooperation of the client, the proxy server node, the proxy client node and the server, comprises the following steps:

step 501 is executed first: the client establishes a first connection with the proxy server node.

Referring to fig. 2 and fig. 6, in this embodiment, the server is located in a private network environment V, and the client may be located in another private network environment or a public network.

When a client (denoted as client 1 for convenience of description) needs to use a service provided by a server (denoted as server 1 for convenience of description), access to the server 1 is initiated to request establishment of a first connection with a proxy server node. For example, the server 1 is a database located in a private network environment, and when the client 1 needs to access the database to obtain corresponding data stored in the database, the server may initiate establishment of a first connection, for example, a connection corresponding to access 1 of the service type a shown in fig. 6.

Here, the first connection may be a sock 5 protocol based connection that is established by the client 1 to the proxy server node.

As shown in fig. 6, the proxy server end node may specifically include two interfaces: one is called a proxy server and the other is called a cross-network server. The proxy client node may specifically include two interfaces: one is called a proxy client and the other is also called a cross-network server. The cross-network service end in the proxy service end node is used for connecting and exchanging information with the cross-network service end in the proxy client end node; the agent client is used for connecting with the server and exchanging information. Therefore, in this step 501, the client may establish a first connection with the proxy server.

Step 503 is executed next: the client sends a cross-network connection request aiming at the access to the proxy server node through the first connection; the cross-network connection request is used for the client in the external network to access the server in the private network, and the cross-network connection request carries the private network address of the server.

The cross-network connection request sent by the client can further carry the service type information of the current access and/or further carry the identification of the private network where the server is located. It can thus be seen that in one embodiment of the present description, client 1 can simultaneously carry, via the socks5 protocol, in the destination address of the cross-network connection request: the service type information of the current access, the identifier of the private network where the server 1 is located and the private network address of the server 1.

Step 301 is performed next: the proxy server node receives a cross-network connection request for the access sent by a client through a first connection; the cross-network connection request is used for the client in the external network to access the server in the private network and carries the private network address of the server.

As shown in fig. 6, in step 503, the client may send a cross-network connection request to the proxy server. Then, in this step 301, the cross-network connection request is received by the proxy server in the proxy server end node.

Step 303 is performed next: and the proxy server-end node determines the service type of the access.

As described above, the cross-network connection request sent by the client may further carry the service type information of the current access, and therefore, an implementation process of this step 303 includes: and the proxy server-end node determines the service type of the access by analyzing the cross-network connection request.

In another embodiment of the present specification, another implementation procedure of this step 303 includes: and the agent service end node determines the type of the accessed service according to the received instruction of the manager.

In the embodiments of the present specification, an access service type refers to a type of a service required for the access, for example, the service type is a web page for browsing a certain website, for example, the service type is downloading a certain file from a database, and for example, the service type is a certain capability test performed by a service end in a private network on a client.

Step 305 is performed next: the proxy server node selects a public network connection corresponding to the service type accessed this time from at least two public network connections between the proxy server node and the proxy client node; wherein, different service types correspond to different public network connections.

Different traffic types have different requirements on network bandwidth and on response speed. In the embodiment of the present specification, access of all service types does not share one public network connection between the proxy server node and the proxy client node, but different service types correspond to different public network connections, that is, information (including signaling and data) of access of different service types is transmitted through different public network connections, so that mutual interference is avoided. For example, referring to fig. 6, when a plurality of clients, such as m clients, where m is a positive integer greater than 1, simultaneously access m servers in the private network environment V, the m accessed traffic is not transmitted from one public network connection between the proxy server node and the proxy client node, but is shunted according to the traffic type. That is, referring to fig. 6, for access 1 corresponding to service type a (e.g. a file download request based on the HTTP protocol) and access 2 corresponding to service type B (e.g. sending a heartbeat message), according to the processing of this step 305, for the cross-network connection request of access 1, a public network connection corresponding to service type a is selected, for the cross-network connection request of access 2, a public network connection corresponding to service type B is selected, and then, information (including signaling and data) corresponding to access 1 is transmitted from the public network connection corresponding to service type a, and information (including signaling and data) corresponding to access 2 is transmitted from the public network connection corresponding to service type B.

As described above, at least two public network connections are established between the proxy server node and the proxy client node. The method of establishing the at least two public network connections is described below.

First, the time for establishing the at least two public network connections.

Timing 1: after the access of a new service type is initiated. For example, in step 303, after the proxy server node determines the service type of the current access, if there is no public network connection corresponding to the service type, the proxy server node is notified to establish the service type.

Timing 2: it is pre-established before access is generated.

By adopting the opportunity 2, after a new access is initiated at a client, extra time consumption for establishing the sending instruction of the public network connection and newly establishing the public network connection does not exist, and the extra time consumption can reach the second level in a multi-cloud data transmission scene of a cross-region and a country, so that the efficiency of establishing the cross-network connection is seriously influenced. By adopting the opportunity 2, when the client initiates an access, the public network connection which can transmit the accessed flow between the proxy server node and the proxy client node already exists, so that the time for establishing the cross-network connection from the client to the server can be shortened, and the efficiency of accessing the server in the private network is improved. When the opportunity 2 is adopted, the establishment of at least two public network connections with the proxy server-side node can be initiated immediately after the proxy client-side node is started.

Second, the way of establishing the at least two public network connections: and (4) dynamically establishing.

In an actual service implementation, the requirements of the service are dynamically changing. For example, in a certain time period, each client needs to access the service of the service type a and the service type B provided by each server in the private network; in another time period, the client needs to access the services of service types C and D provided by the service terminals in the private network. Therefore, in an embodiment of this specification, when the above-mentioned opportunity 2 is used, that is, when at least two public network connections between the proxy server node and the proxy client node are established before the access occurs, the public network connection corresponding to each service type is dynamically established, and the specific implementation process includes:

step S1: after the proxy client node is started, the proxy server node establishes an initial channel connection with the proxy client node.

The initial path connection is also a public network connection, such as a TCP connection.

And step S3: and the proxy server-end node dynamically updates the information of each service type required currently to the proxy client-end node through the initial channel connection.

Step S5: and the proxy server node and the proxy client node dynamically set a corresponding public network connection for each service type required currently according to the dynamically updated information of the service types.

In an embodiment of the present specification, in step S3, the proxy server-side node periodically sends information of all service types that need to be used in this period to the proxy client-side node through an initial channel connection, and in step S5, the proxy client-side node establishes, for each service type in this period, a corresponding cross-network channel, that is, a public network connection, to the proxy server-side node according to the received information. It can be understood that the types of services to be accessed may be different in different periods, and therefore, the number of the set public network connections and the types of services corresponding to the public network connections may also be dynamically changed in different periods.

Thirdly, the method for using at least two public network connections between the proxy server node and the proxy client node comprises the following steps: can be reused.

In one embodiment of the present description, at least two accesses of the same service type multiplex the same one of the at least two public network connections; wherein the at least two accesses are: access to at least one server connected to the same proxy client node in a private network, initiated by at least one client connected to the same proxy server node. For example, referring to fig. 6, among the plurality of clients, client 1 initiates access 1 corresponding to service type a, client 2 initiates access 2 corresponding to service type B, client 3 initiates access 3 corresponding to service type a, and client 1, client 2, and client 3 are all connected to the same proxy server node, so that, since the service types corresponding to access 1 and access 3 are both service type a, information (including signaling and data) of access 1 and access 3 are transmitted through the same public network connection (i.e., the public network connection corresponding to service type a). The service type corresponding to access 2 is different from the service types corresponding to access 1 and access 3, and therefore, the information of access 2 is transmitted through another public network connection (i.e., the public network connection corresponding to service type B).

Therefore, in this embodiment of the present specification, at least two public network connections between the proxy client node and the proxy server node may be dynamically established in advance before access occurs, and information of different service types may be transmitted using different public network connections, and information of the same service type may be transmitted using the same public network connection.

It should be noted that, when each access of the same service type is transmitted by multiplexing the same public network connection, in order to further distinguish information of different accesses transmitted in the same public network connection, after the proxy server node receives the cross-network connection request in step 301 and before the proxy server node sends the cross-network connection request to the proxy client node through the selected public network connection in step 307, the method further includes: the proxy server node distributes a cross-network connection ID for the access;

correspondingly, the method of the embodiment further comprises the following steps:

the proxy server end node binds the cross-network connection ID and the first connection;

in one transmission direction, the proxy server node adds a cross-network connection ID in all information (marked as first information) of the access sent to the proxy client node, such as a cross-network connection request, so that the proxy client node can distinguish each access according to the cross-network connection ID;

in another transmission direction, the proxy server-side node analyzes the cross-network connection ID from the information (marked as second information) sent by the proxy client-side node, deletes the cross-network connection ID carried in the second information, and then sends the second information to the correct client through the first connection bound with the analyzed cross-network connection ID.

Step 307 is executed next: and the proxy server node sends the cross-network connection request to the proxy client node through the selected public network connection.

For example, for the cross-network connection request sent by the client 1, the proxy server end node sends the cross-network connection request to the proxy client end node through the public network connection corresponding to the service type a.

If each access of the same service type is multiplexed with the same public network connection, in order to distinguish each access of the same service type transmitted through the same public network, in this step 307, the proxy server-side node first adds a cross-network connection ID allocated for this access in the cross-network connection request, and then sends the cross-network connection ID to the proxy client-side node.

Referring to fig. 6, in this step 307, the cross-network server in the proxy server node sends the cross-network connection request to the cross-network server in the proxy client node.

Step 401 is executed next: the proxy client node receives a cross-network connection request aiming at the current access from one of at least two public network connections; the cross-network connection request carries a private network address of a server in a private network.

As described above, the cross-network connection request may further carry a cross-network connection ID corresponding to the current access.

Step 403 is performed next: and the proxy client node establishes a second connection with the server according to the private network address of the server carried in the cross-network connection request.

Here, the private network address of the server is generally an intranet IP address of the server in the private network environment.

As described above, the cross-network connection request may further carry a cross-network connection ID corresponding to the access, and therefore, in this step 403, the proxy client node may further bind the cross-network connection ID carried in the cross-network connection request with the second connection, so as to represent which access corresponds to the second connection.

Referring to fig. 6, in this step 403, a proxy client in the proxy client node may establish a second connection with a server in the private network.

Step 405 is performed next: after the second connection is successfully established, the proxy client node returns a connection success message to the proxy server node through the public network connection receiving the cross-network connection request.

For example, for a cross-network connection request sent by the client 1, the proxy client node sends a connection success message to the proxy server node through the public network connection corresponding to the service type a.

Step 309 is performed next: and after receiving the connection success message returned by the proxy client node, the proxy server node returns a connection success message to the accessed client.

So far, the cross-network connection from the client to the server is successfully established. The client and the server can transmit the relevant data of the access.

Step 311 is performed next: and the agent service end node transmits the information of the current access between the client and the server by using the first connection and the selected public network connection.

In the embodiments of this specification, information includes both various signaling, messages, and data.

Because different service types correspond to different public network connections, in order to further improve processing efficiency, in one embodiment of the present specification, for each of at least two public network connections between a proxy client node and a proxy server node, a transmission queue and a working thread dedicated to the public network connection are set in the proxy server node;

thus, referring to fig. 6, the implementation process of this step 311 includes:

the agent service end node receives the information of the current visit 1 sent by the client 1 through the first connection;

the agent service end node uses the selected working thread special for public network connection, such as the working thread 1 special for public network connection of the service type A, and places the received information into a sending queue special for public network connection corresponding to the service type A, and the sending queue is marked as a sending queue 1;

and the agent server node sequentially takes out the information from the sending queue 1 by using the working thread 1 and sends the taken out information to the agent client node through the public network connection corresponding to the service type A.

It can be seen that each public network connection has an independent sending queue and working thread, and data of a large traffic type is only cached in the sending queue dedicated to the public network connection corresponding to the service type of the public network connection, so that more processing resources can be allocated to the large traffic type, and then the working thread dedicated to the public network connection of the service type of the public network connection is waited to send, thereby effectively isolating traffic of cross-network connections of different service types and reducing interference between cross-network connections of different traffic characteristics. As shown in fig. 7, if access 1 and access 3 are both file download connections and the service types are both file downloads, the transmitted file data will only be buffered in the sending queue 1 corresponding to the service type a and wait for the work thread 1 to send, while the data of access 2 of the service type B will be buffered in the sending queue 2 corresponding to the service type B and wait for the work thread 2 to send, which shows that the data transmission of access 2 is not affected by the data transmission of access 1 and access 3.

Step 407 is executed next: and the proxy client node transmits the information of the access between the client and the server by using a second connection and the public network connection receiving the cross-network connection request.

As mentioned above, the proxy client node will bind the cross-network connection ID with the second connection, and therefore, the process of this step 407 may include: in a transmission direction, the proxy client node adds cross-network connection ID in all second information of the current access sent to the proxy server node; in the other transmission direction, the agent client node analyzes the cross-network connection ID from the first information sent by the agent server node, deletes the cross-network connection ID in the first information, and then sends the first information to the server through a second connection bound with the analyzed cross-network connection ID; wherein the information comprises signaling and data.

Because different service types correspond to different public network connections, in order to further improve processing efficiency, in one embodiment of the present specification, for each of at least two public network connections between a proxy client node and a proxy server node, a dedicated transmission queue and a dedicated working thread for the public network connection are set in the proxy client node;

thus, referring to fig. 6, the implementation process of this step 407 includes:

the proxy client node receives information sent by a server, such as the server 1, through a second connection;

the agent client node uses the public network connection which receives the cross-network connection request, such as a special working thread of the public network connection corresponding to the service type A, and puts the received information into a special sending queue for the public network connection;

and the agent service end node sequentially takes out the information from the special sending queue by using the special working thread and sends the taken out information to the agent service end node through the public network connection.

In one embodiment of the present specification, there is provided an apparatus for accessing a server in a private network, the apparatus being used in a proxy server node, see fig. 7, and the apparatus comprising:

the proxy server module 701 is configured to establish a first connection with the client;

a cross-network server module 702 configured to establish at least two public network connections with the proxy client node, wherein different service types correspond to different public network connections;

a processing module 703 configured to receive, through the first connection established by the proxy server module 701, a cross-network connection request for the current access sent by the client; the cross-network connection request is used for the client in the external network to access a server in a private network, and the cross-network connection request carries a private network address of the server; determining the type of the accessed service; selecting a public network connection corresponding to the service type accessed this time from at least two public network connections established by the cross-network server module 702, and sending a cross-network connection request to the proxy client node through the selected public network connection; after receiving a connection success message returned by the proxy client node, sending the connection success message to the client through the first connection established by the proxy server module 701; the information of the current access between the client and the server is transmitted through the first connection established by the proxy server module 701 and the public network connection established by the cross-network server module 702.

In one embodiment of the present specification apparatus shown in fig. 7, the first connection is a socks5 protocol-based connection that is established by the client to the proxy server node.

In an embodiment of the apparatus in this specification shown in fig. 7, the cross-network connection request carries the service type information of this access; accordingly, the processing module 702 is configured to perform: and determining the type of the accessed service by analyzing the cross-network connection request.

In one embodiment of the present apparatus shown in fig. 7, before the access is generated, the cross-network server module 702 establishes the at least two public network connections with the proxy client node.

In one embodiment of the apparatus of the present description shown in fig. 7, the cross-network server module 702 is configured to perform:

after the agent client node is started, establishing initial channel connection with the agent client node;

dynamically updating the information of each service type required currently to the proxy client node through the initial channel connection; and

and the proxy client node dynamically sets a corresponding public network connection for each service type required currently according to the dynamically updated information of the service type.

In one embodiment of the present specification apparatus shown in fig. 7, the processing module 703 is configured to:

the same public network connection in at least two public network connections established by the at least two access multiplexing cross-network server modules 702 aiming at the same service type; wherein the at least two accesses are: access to at least one server connected to the same proxy client node in the private network, initiated by at least a client connected to the same proxy server node.

after receiving the cross-network connection request and before sending the cross-network connection request to the agent client node through the selected public network connection, distributing a cross-network connection ID for the access;

binding the cross-network connection ID with the first connection;

adding the cross-network connection ID in all the first information of the access sent to the proxy client node;

sending all second information to the client through a first connection bound with the cross-network connection ID according to the cross-network connection ID carried in all second information sent by the agent client node; wherein the information comprises signaling and data.

In an embodiment of the apparatus of this specification shown in fig. 7, for each of the at least two public network connections, a dedicated transmission queue and a dedicated work thread for the public network connection are set in the processing module 703;

the processing module 703 is configured to perform:

receiving information sent by a client through a first connection;

the selected working thread special for the public network connection is utilized to place the received information into the selected sending queue special for the public network connection;

and sequentially taking out the information from the sending queue special for the public network connection by using the selected working thread special for the public network connection, and sending the taken out information to the agent client node through the selected public network connection.

In an embodiment of the present specification, an apparatus for accessing a server in a private network is further provided, which is applied in a proxy client node, and referring to fig. 8, the apparatus includes:

a cross-network server unit 801 configured to establish at least two public network connections with the proxy server node outside the private network, where different service types correspond to different public network connections;

a control unit 802 configured to receive a cross-network connection request for the current access from one of the at least two public network connections, and analyze a private network address of a server in a private network carried in the cross-network connection request; after the second connection is established successfully, a connection success message is returned to the proxy server node through the public network connection receiving the cross-network connection request; transmitting the information of the current access between the client and the server by using the public network connection established by the cross-network server unit 801 and the second connection established by the proxy client unit 803;

the proxy client unit 803 is configured to establish a second connection with the server according to the private network address carried in the cross-network connection request.

In one embodiment of the present specification apparatus shown in fig. 8, the cross-network server unit 801 is configured to initiate establishment of at least two public network connections with the proxy server node before generating the current access.

In one embodiment of the present specification apparatus shown in fig. 8, the cross-network server unit 801 is configured to perform:

after the agent client node is started, initiating the establishment of an initial channel connection with the agent server node;

receiving the information of each currently required service type dynamically updated by the proxy server node through the initial channel connection; and

and according to the dynamically updated information of the service types, dynamically setting a corresponding public network connection for each service type required currently with the proxy service end node.

In one embodiment of the present specification apparatus shown in fig. 8, the control unit 802 is configured to perform:

multiplexing the same public network connection in at least two public network connections for at least two accesses of the same service type; wherein the at least two accesses are: access to at least one server in said private network connected to the same said proxy client node, initiated by at least a client connected to the same said proxy server node.

In an embodiment of the apparatus of this specification shown in fig. 8, the cross-network connection request received by the control unit 802 carries a cross-network connection ID;

the control unit 802 is further configured to perform:

after establishing the second connection, binding the cross-network connection ID with the second connection;

adding the cross-network connection ID to all second information of the current access sent to the proxy server node through the public network connection established by the cross-network server unit 801;

sending all the first information to a server through a second connection bound with the cross-network connection ID according to the cross-network connection ID carried in all the first information sent by the proxy server node; wherein the information includes signaling and data.

In an embodiment of the apparatus in this specification shown in fig. 8, in the control unit 802, for each public network connection of the at least two public network connections, a dedicated sending queue and a dedicated work thread for the public network connection are provided;

the control unit 802 is configured to perform:

receiving information sent by the server through the second connection;

utilizing a working thread special for public network connection receiving the cross-network connection request to place the received information into a sending queue special for the public network connection;

and sequentially taking out information from the special sending queue by using the special working thread, and sending the taken-out information to the agent service end node through the public network connection.

In one embodiment of the present specification, an apparatus for accessing a server in a private network is provided, which is applied to a client, and referring to fig. 9, the apparatus includes:

a connection establishing module 901 configured to establish a first connection with the proxy server node;

the information processing module 902 is configured to send a cross-network connection request for the current access to the proxy server-side node through the first connection; the cross-network connection request is used for the client in the external network to access the server in the private network, and carries the private network address of the server.

In an embodiment of the apparatus in this specification shown in fig. 9, the cross-network connection request further carries service type information of the current access and/or an identifier of the private network.

And/or the presence of a gas in the atmosphere,

in one embodiment of the present specification apparatus shown in fig. 9, the first connection is a socks5 protocol based connection that is established by the connection establishment module 901 to the proxy server end node.

An embodiment of the present specification provides a computer-readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method of any of the embodiments of the specification.

One embodiment of the present specification provides a computing device comprising a memory and a processor, the memory having stored therein executable code, the processor implementing a method in accordance with any one of the embodiments of the specification when executing the executable code.

It is to be understood that the illustrated construction of the embodiments of the present disclosure is not to be construed as specifically limiting the devices of the embodiments of the present disclosure. In other embodiments of the description, the apparatus may include more or fewer components than illustrated, or some components may be combined, some components may be separated, or a different arrangement of components may be used. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the apparatus embodiment, since it is substantially similar to the method embodiment, the description is relatively simple, and reference may be made to the partial description of the method embodiment for relevant points.

Those skilled in the art will recognize that the functionality described in this disclosure may be implemented in hardware, software, firmware, or any combination thereof, in one or more of the examples described above. When implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.

The above-mentioned embodiments, objects, technical solutions and advantages of the present invention are further described in detail, it should be understood that the above-mentioned embodiments are only exemplary embodiments of the present invention, and are not intended to limit the scope of the present invention, and any modifications, equivalent substitutions, improvements and the like made on the basis of the technical solutions of the present invention should be included in the scope of the present invention.

Claims

1. The method for accessing the server side in the private network comprises the following steps:

the proxy server-side node determines the type of the accessed service;

after receiving a connection success message returned by the agent client node, the agent service node returns a connection success message to the client;

2. The method of claim 1, wherein,

the first connection is a sock 5 protocol-based connection established by the client to the proxy server node;

and/or the presence of a gas in the gas,

the cross-network connection request carries the service type information of the access; correspondingly, the step of determining the service type of the current access by the proxy server end node comprises the following steps: and the proxy server node determines the service type of the current access by analyzing the cross-network connection request.

3. The method of claim 1, wherein prior to generating the current visit, further comprising:

and the proxy server node establishes the at least two public network connections with the proxy client node.

4. The method of claim 3, wherein the proxy server node establishing the at least two public network connections with the proxy client node comprises:

after the proxy client node is started, the proxy server node establishes initial channel connection with the proxy client node;

the agent server node dynamically updates the information of each service type required currently to the agent client node through the initial channel connection; and

and the proxy server node and the proxy client node dynamically set a corresponding public network connection for each service type required currently according to the dynamically updated information of the service types.

5. The method of claim 1, wherein the first and second light sources are selected from the group consisting of,

6. The method of claim 5, wherein after the proxy server end node receives the cross-network connection request and before the proxy server end node sends the cross-network connection request to the proxy client node over the selected public network connection, further comprising: the proxy server node distributes a cross-network connection ID for the access;

the method further comprises the following steps:

7. The method of claim 1, wherein the method further comprises: aiming at each public network connection in the at least two public network connections, a special sending queue and a special working thread for the public network connection are arranged in the agent service end node;

the agent server node transmits the information between the client and the server by using the first connection and the selected public network connection, and the method comprises the following steps:

the agent server node receives information sent by a client through the first connection;

the agent server node uses the selected working thread special for the public network connection to place the received information into the selected sending queue special for the public network connection;

and the agent server node sequentially takes out information from the special sending queue for the public network connection by using the selected special working thread for the public network connection, and sends the taken out information to the agent client node through the selected public network connection.

8. The method for accessing the server in the private network, wherein, there are at least two public network connections between agent client node in the private network and agent server node outside the private network, wherein, different business types correspond to different public network connections; the method comprises the following steps:

9. The method of claim 8, wherein prior to generating the current visit, further comprising:

the proxy client node initiates establishment of the at least two public network connections with the proxy server node.

10. The method of claim 9, wherein the proxy client node initiating establishment of the at least two public network connections with the proxy server node comprises:

the proxy client node receives the information of each service type which is dynamically updated by the proxy server node and is currently required through initial channel connection; and

and the agent client node and the agent server node dynamically set a corresponding public network connection for each service type required currently according to the dynamically updated information of the service types.

11. The method as set forth in claim 8, wherein,

12. The method of claim 11, wherein the cross-network connection request received by the proxy client node carries a cross-network connection ID;

after establishing the second connection, further comprising:

the proxy client node binds the cross-network connection ID carried in the cross-network connection request with the second connection;

the proxy client node adds the cross-network connection ID in all second information of the current access sent to the proxy server node;

the agent client node analyzes the cross-network connection ID from the first information sent by the agent server node, deletes the cross-network connection ID in the first information, and then sends the first information to the server through a second connection bound with the analyzed cross-network connection ID; wherein the information comprises signaling and data.

13. The method of claim 8, wherein the method further comprises: aiming at each public network connection in the at least two public network connections, a special sending queue and a special working thread for the public network connection are arranged in the agent client node;

the proxy client node transmits the information of the access between the client and the server by using a second connection and a public network connection which receives a cross-network connection request, and the information comprises:

the proxy client node receives information sent by the server through the second connection;

the agent client node uses the working thread special for public network connection which receives the cross-network connection request to place the received information into a sending queue special for the public network connection;

and the agent server node sequentially takes out information from the special sending queue by using the special working thread and sends the taken out information to the agent server node through the public network connection.

14. The method for accessing the server side in the private network comprises the following steps:

the client establishes a first connection with the proxy server node;

the client sends a cross-network connection request aiming at the access to the proxy server node through a first connection; the cross-network connection request is used for the client in the external network to access the server in the private network, and carries the private network address of the server.

15. The method of claim 14, wherein,

the cross-network connection request further carries the service type information of the current access and/or the identification of the private network;

and/or the presence of a gas in the gas,

the first connection is a socks5 protocol-based connection that is established by the client to a proxy server node.

16. An apparatus for accessing a server in a private network, applied in a proxy server node, the apparatus comprising:

17. Apparatus for accessing a server in a private network, for use in a proxy client node, the apparatus comprising:

the control unit is configured to receive a cross-network connection request aiming at the current access from one of the at least two public network connections, and analyze a private network address of a service end in a private network carried in the cross-network connection request; after the second connection is successfully established, a connection success message is returned to the proxy server node through the public network connection receiving the cross-network connection request; transmitting the information of the current access between the client and the server by utilizing the public network connection established by the cross-network server unit and the second connection established by the proxy client unit;

and the proxy client unit is configured to establish second connection with the server according to the private network address carried in the cross-network connection request.

18. The device for accessing the server side in the private network is applied to the client side and comprises the following components:

the connection establishing module is configured to establish a first connection with the proxy server-side node;

19. A computing device comprising a memory having executable code stored therein and a processor that, when executing the executable code, implements the method of any of claims 1-15.