CN111131173B

CN111131173B - Method for actively providing service by intranet

Info

Publication number: CN111131173B
Application number: CN201911220507.7A
Authority: CN
Inventors: 吴建强
Original assignee: Hangzhou Fugle Technology Co ltd
Current assignee: Hangzhou Fugle Technology Co ltd
Priority date: 2016-10-20
Filing date: 2016-10-20
Publication date: 2022-09-30
Anticipated expiration: 2036-10-20
Also published as: CN111131173A; CN111131172A; CN106453336A; CN106453336B; CN111131172B

Abstract

The invention discloses a method for actively providing services by an intranet, which comprises an intranet host and an extranet host, wherein the extranet host is provided with a monitoring feedback module; when the intranet host sends a connectable data packet to the extranet host and adds a connectable record to the network connection pool, the extranet host acquires the connectable data packet and selects an available connection from the network connection pool, and then the intranet host and the extranet host establish network communication; the intranet connection can simultaneously initiate a plurality of connection data packets to be connected with a plurality of extranet hosts; and after the external network host acquires the data packets of all the internal network hosts, returning the network links to the connection pool, and uniformly arranging and reusing or destroying the connection in the connection pool. The invention provides a method for actively providing calling service of an external network host by an internal network, thereby realizing real-time exchange of data and information of the internal network and the external network under the safety requirement.

Description

Method for actively providing service by intranet

The application is a method for actively providing calling service of an external network host by an internal network, and is a divisional application of a patent with application number 201610915145.3.

Technical Field

The invention relates to the field of message transmission between an internal network and an external network of a gateway in the Internet, in particular to the transmission of messages which are transmitted between the internal network and the external network in real time and actively transmitted through the internal network.

Background

With the continuous development of internet technology, the internet has penetrated into all aspects of social life as an infrastructure, and becomes one of the main ways for publicly releasing and acquiring information. In addition, with the rise and development of internet applications such as electronic commerce and cloud computing, the internet is gradually developing into an infrastructure with open distributed computing functions. However, due to the openness and complexity of the internet environment, the security of internet-based applications represented by Web applications is threatened unprecedentedly, and although many organizations adopt protection tools such as firewalls, intrusion detection systems and intrusion prevention systems and measures such as safer cryptography to ensure the security, attack reports of the internet still appear endlessly, so that all levels of organizations are serious in the security doubt of the internet.

At present, the need for data exchange between high-security networks and other low-security networks of some special institutional departments or enterprise and public institution technologies is increasingly evident, and for safety reasons, in order to ensure the security of sensitive data information and prevent the sensitive information on an internal server from being leaked, tampered, destroyed, monitored or invaded by viruses, a "physical isolation" mode is usually adopted, that is, two servers are arranged inside a system, so that an internal network and a public network are not directly or indirectly connected, but are logically connected. This means that network packets cannot flow from one network to another and that computers on trusted networks and computers on untrusted networks never have an actual connection. With the increase of services and the expansion of data volume, a device or a solution which not only meets the 'physical isolation' safety requirement but also can exchange data is established between an internal network and an external network, and the device or the solution becomes a research subject of a plurality of special institutional departments or enterprise and public institution technologies.

At present, when information exchange between two networks with different security levels is processed in China, an administrator is only allowed to manage a security isolation gatekeeper from a trust network (intranet) side, the management mode enables related data information to be operated or called only in the trust network, and the mode that an extranet accesses the intranet is not allowed, so that the calling requirement of a network (extranet) with lower security level on the information of the network (intranet) with higher security level is completely cut off, information updating is delayed, information among all the butt-joint departments is asymmetric, and the working efficiency is seriously influenced.

Disclosure of Invention

The invention provides a method for an internal network to actively provide an external network host calling service, aiming at the problems, the method enables the data of the external network and the internal network to start timely information transmission by a mode that the internal network firstly actively initiates a connection signal.

In order to solve the technical problem, the technical scheme of the name is as follows:

a method for actively providing calling service of an external network host by an internal network comprises the internal network host and the external network host, wherein the external network host is provided with a monitoring feedback module; and when the intranet host sends a connectable data packet to the extranet host and adds a connectable record to the network connection pool, the extranet host acquires the connectable data packet and selects an available connection from the network connection pool, and then the intranet host and the extranet host establish network communication.

Further, after the intranet host and the extranet host establish network communication, the extranet host sends a data packet to be processed to the intranet host, and the intranet host obtains the data packet and then analyzes and processes the data packet, and then protocols data of a required processing result and sends the data packet to the extranet host.

Further, the intranet host predefines a method attribute set for secure invocation, and the method attributes include parameter types and parameter values.

Further, the external network host sends a protocol data packet, which includes method attributes, method parameters and user information meeting the safety call predefined by the internal network host.

Further, the intranet host is provided with a cache mechanism, and when the intranet host processes a data packet sent by the same extranet host for multiple times within a certain time, the intranet host directly returns a cached first processing result to the extranet host.

Further, the intranet host and the extranet host are in different network segments.

Furthermore, the intranet host can actively send a connectable data packet at any time.

Further, the intranet connection may initiate connection of multiple connection data packets with multiple extranet hosts at the same time.

Further, the connection pool may set a maximum connection number, a minimum connection number, and a free connection number.

Further, after the external network host acquires all the data packets of the internal network host, the network link is returned to the connection pool, and the connection pool is uniformly arranged to reuse or destroy the connection.

Compared with the prior art, the invention has the advantages that:

1, a traditional passive message transmission mode is that an intranet server monitors a service port, passively waits for a client to send a network request and accordingly, and at the moment, the intranet service port is exposed and is easy to attack; the active mode of the invention is that the intranet server does not monitor any service port, is actively connected by the intranet server, and then receives the request of the client and corresponds to the request. In this mode, the intranet server does not expose any port, and therefore the completeness is high.

2, if a denial of service (DDoS) attack is applied in the traditional passive message transmission mode, it cannot continue or continuously provide service to the client. The initiative of the invention can not be attacked by denial of service (DDoS) at all, and can provide continuous uninterrupted service.

While conventional passive services are vulnerable to spoofed connections and attacks, the active service of the present invention cannot spoof because it actively provides a specific client connection.

And 4, the maximum connection number, the minimum connection number and the idle connection number are automatically set, so that the access amount is controlled, the server is prevented from being maliciously attacked, and the access on the new connection can be quickly responded due to the setting of the idle connection.

5, the connection of the internal and external networks is uniformly destroyed and reused, so that the redundancy is reduced.

Drawings

FIG. 1 is a flowchart of a method for an intranet to actively provide an extranet host calling service according to the present invention;

FIG. 2 is a schematic structural diagram of a method for actively providing an external network host calling service by an internal network according to the present invention;

fig. 3 is a schematic diagram of data transmission of an intranet and extranet host according to the method for actively providing an extranet host call service by an intranet of the present invention.

Detailed Description

The invention is further described with reference to the following figures and detailed description.

As shown in fig. 1, a method for an intranet to actively provide an external network host calling service includes an intranet host and an external network host, where the intranet host and the external network host are in different network segments. The outer net host is provided with a monitoring feedback module, and the inner net host is not provided with the monitoring feedback module; when the intranet host sends a connectable data packet to the extranet host, a connectable record (not shown in the figure) is added to the network connection pool, and the connection pool can set a maximum connection number, a minimum connection number and an idle connection number, so that malicious access is limited and guaranteed through the idle connection number, and when a new user is connected in, an enough channel is provided for access connection. Because the extranet host computer is provided with the monitoring feedback module, the extranet host computer can immediately know that the intranet can not be accessed and connected. The outer net host acquires the connectable data packet through the connection pool under the condition that the outer net host needs to access, the inner net host corresponding to the inner net can automatically learn whether the connection is successful at the moment, and the inner net host and the outer net host establish network communication at the moment. If the intranet host does not know that the extranet host is connected with the intranet host, the intranet host automatically selects to stop the service and finish the service, or continuously sends a connectable data packet to wait for the access of the extranet host. The intranet host can actively send the connectable data packets at any time to provide connection access for the extranet host, and the intranet host can initiate a plurality of connection data packets to be respectively connected with a plurality of extranet hosts.

After the network communication is established, the external network host waits for the service request information of the user, and when the service request information input by the user is obtained. As shown in fig. 3, a communication module of the extranet host sends a data packet to the intranet host, where the data packet includes a method attribute, a method parameter, and user information that meet security call predefined by the intranet host. After the intranet host acquires the data packet, analyzing and processing according to a predefined security calling method attribute set, wherein the method attribute comprises a parameter type and a parameter value. The intranet host machine carries out data agreement on the required processing result and sends a service response to the extranet host machine. The outer net host receives and processes the content of the service response, and after the outer net host acquires all the data packets of the inner net host, the outer net host returns the network link to the connection pool, and the connection pool uniformly arranges the connection for reuse or destroys the connection so as to reduce redundancy. And after initializing the network, the external network host waits for the next user service access and acquires the connection from the connection pool. If the intranet host does not process the service request successfully, the corresponding exception processing result is returned and sent to the extranet host.

Further, as an optimization, the intranet host is provided with a cache mechanism, and when the intranet host processes a data packet sent by the same extranet host for multiple times within a certain time, the intranet host directly returns a cached first-time processing result of the intranet host to the extranet host. This will greatly improve the response rate, giving the user a faster and better experience.

As shown in fig. 2, when the private network transmits information to the public internet for interaction, as with the external network host, only the internal network host acquires the user who accesses through the public internet, and the unspecified user does not have a corresponding method attribute set for secure invocation and does not provide corresponding response information. The user accessed by the public internet can establish corresponding response information only by sending a data packet which is predefined by the in-band network host and is in agreement with the method attribute, the method parameter and the user information for safe calling. The authentication is generally carried out by the user name and the password of the user, and the authentication can be provided for the intranet by the corresponding equipment such as a web shield and the like through the response information built in the equipment, so that the intranet determines whether to respond to the access of the user.

As shown in fig. 3, the intranet host and the extranet host both include a service module and a communication module. When the connection is not established, the intranet host initiates a process a1 from the service module, sends the process a2 to the communication module of the intranet host, and sends a connectable data packet to the communication module of the extranet host by the process a 2. The communication module of the extranet host receives the packet by the a3 process and decides whether to initiate a connection request if necessary. When a connection request needs to be initiated, a service module of the external network host starts a B1 process, information is transmitted to a communication module of the external network host, a process B2 is initiated by combining a user module, a safety calling method attribute, a method parameter and a data packet of user information are sent to a transmission module in the communication module of the internal network host, the transmission module initiates a process B3 to a delivery module and starts a B4 process, data transmitted by the external network host is sent to the service module of the internal network host, whether the information is responded is determined by the service module of the internal network host, and processes B5, B6, B7 and B8 are established in sequence according to the original path to feed back the response information.

Example 1:

in the external network host, the tax administrator needs to connect to the local internal network of the tax bureau at the internet end to inquire the tax income statistical table in this month. At this moment, corresponding login information of the input user needs to be confirmed, the system searches the accessible tax bureau intranet host through the connection pool, and if the access is successful, communication connection is established. If the connection mode of the host in the tax bureau is not accessible in the connection pool, the tax bureau can only wait, and the corresponding information to be inquired can not be accessed. The tax administrator can input the corresponding content to be inquired after establishing communication through the internet end connection success, so as to obtain the tax income statistical table in the month from the tax office intranet host. The input inquired content, the logged user information and the password are transmitted to a transmission module of the tax bureau internal network host through an AES encryption algorithm, and the encrypted information is transmitted to a delivery module for decryption through a user module of the external network host. Because the tax administrator only inquires, only the read-only database of the internal network host of the tax bureau is accessed to inquire the corresponding authorized service data. And the tax bureau internal network host encrypts the inquired information by an AES encryption algorithm through the delivery module, transmits the information to the transmission module, and feeds back the information to the corresponding external network host. The external network host acquires the feedback information through the user module, decrypts the feedback information, feeds the information back to the service module of the external network host, and presents the 'monthly tax income statistical table' to be inquired. The external network host has no other service request, and returns the connection mode to the connection pool by acquiring all the service information to be inquired.

The above description is only a preferred embodiment of the present invention, and it should be noted that, for those skilled in the art, many modifications and amendments can be made without departing from the spirit of the present invention, and these modifications and amendments should also be considered as within the scope of the present invention.

Claims

1. A method for actively providing service by an intranet is characterized by comprising an intranet host and an extranet host, wherein the extranet host is provided with a monitoring feedback module, and the intranet host is not provided with the monitoring feedback module; when the intranet host sends a connectable data packet to the extranet host and adds a connectable record to the network connection pool, the extranet host acquires the connectable data packet and selects an available connection from the network connection pool, and then the intranet host and the extranet host establish network communication; the intranet host corresponding to the intranet can automatically learn whether the connection is successful or not at the moment, and the intranet host and the extranet host establish network communication at the moment; the external network host is provided with the monitoring feedback module, so that the external network host can immediately know that the internal network access connection cannot be carried out;

the intranet access connection can simultaneously initiate a plurality of connection data packets to be connected with a plurality of extranet hosts; after the outer network host acquires the data packets of all the inner network hosts, returning the network connection to a connection pool, and uniformly arranging and reusing or destroying the connection in the connection pool;

the intranet host can actively send the connectable data packet at any time.

2. The method according to claim 1, wherein the intranet host is configured with a cache mechanism, and when there are multiple data packets sent by the same extranet host within a certain time period, the intranet host directly returns the cached first processing result of the intranet host to the extranet host.

3. The method according to claim 2, wherein the intranet host and the extranet host are in different network segments.

4. The method according to claim 1, wherein the connection pool has a maximum number of connections, a minimum number of connections, and a number of idle connections.