TW202243443A - Method for accessing private network service and service gateway equipment - Google Patents

Abstract

A method for accessing private network service and a service gateway equipment are provided. The method for accessing private network service includes: communicatively connecting, by a service gateway equipment, to a user equipment (UE) in a public network through an encrypted connection; communicatively connecting, by the service gateway equipment, to a private network service server in a private network; and configuring, by the service gateway equipment, the private network service server to provide a private network service corresponding to a target service to the UE according to a the target service selected by a browser software of the UE.

Description

Private network service access method and service gateway device

This disclosure relates to a private network service access method and service gateway equipment.

Based on information security considerations, administrators must set up many information security policies to control the computer status or behavior of terminal devices accessing private networks. When a terminal device wants to use a virtual private network (Virtual Private Network, VPN) service, the terminal device must additionally install VPN software. The terminal device must execute the VPN software to perform authentication and authorization, establish a VPN tunnel, and obtain the Internet Protocol (IP) and routing of the private network before connecting to the private network. Therefore, it is very inconvenient for the user to use the private network service in the private network.

This disclosure provides a private network service access method and service gateway device, which allow users to select the private network they want to use (access) through the browser software on the user device without additional software installation. road service.

A private network service access method disclosed in this disclosure includes: connecting the service gateway device to the user equipment in the public network through encrypted connection communication; connecting the service gateway device to the private network in the private network The service server; and the private network service server is configured by the service gateway device according to the target service selected by the browser software of the user equipment, so that the private network service server provides the private network service corresponding to the target service to the user equipment.

A service gateway device disclosed in the present disclosure includes a processor, a storage medium, and a transceiver. The transceiver is connected to the user equipment in the public network through encrypted connection communication, and is connected to the private network service server in the private network, wherein the user equipment stores browser software. The storage medium stores multiple modules. The processor accesses and executes a plurality of modules, wherein the plurality of modules include a service module and a transduction module, wherein the service module controls the transduction module according to the target service selected by the browser software of the user equipment to configure private The network service server is used to provide the private network service corresponding to the target service to the user equipment by the private network service server.

Based on the above, the private network service access method and service gateway device disclosed in this disclosure can allow users to select the private network service they want to use (access) through the browser software on the user device, which improves the convenience of use . In addition, when the login information input by the user matches the pre-stored authentication information, the service gateway device can provide the private network service corresponding to the allowed service selected by the user to the browser software. Based on this, the security and convenience of private network service access can be significantly improved.

In order to make the above-mentioned features and advantages of the present disclosure more comprehensible, the following specific embodiments are described in detail together with the accompanying drawings.

FIG. 1 is a schematic diagram illustrating a private network service access system 100 according to an embodiment of the present disclosure. Please refer to FIG. 1 , the private network service access system 100 may include a user equipment 110 , a private network service server 120 and a service gateway device 130 .

The user equipment 110 may have a processing unit (such as a processor but not limited thereto), a communication unit (such as various communication chips, mobile communication chips, Bluetooth chips, WiFi chips, etc. but not limited thereto) and a storage unit (such as: Removable random access memory, flash memory, hard disk, etc. but not limited thereto) and other necessary components to run the user equipment 110 . The user equipment 110 is, for example, a commonly used terminal device. For example, the user equipment 110 may include a desktop computer, a notebook computer, a personal digital assistant (personal digital assistant, PDA), a smart phone, or a thin terminal (thin client), etc. A device with an IP address or networking capability. The user equipment 110 can be set in the public network 10 . The public network 10 is, for example, a network that can be accessed by any terminal device.

The user equipment 110 can store browser software 111 . The browser software 111 may be software for browsing webpages, for example, the browser software 111 may support hypertext markup language (html5).

The private network service server 120 may have a processing unit (for example: a processor but not limited thereto), a communication unit (for example: various communication chips, mobile communication chips, bluetooth chips, WiFi chips, etc. but not limited thereto) and storage Units (for example: removable random access memory, flash memory, hard disk, etc. but not limited thereto) are necessary components for running the private network service server 120 . The private network service server 120 can be set in the private network 20 . The private network 20 is, for example, a network that only authorized terminal devices can access.

The private network service server 120 can store one or more private network services. In this embodiment, the private network service may include but not limited to: secure shell protocol (secure shell, SSH), remote communication network (Telnet), remote desktop protocol (remote desktop protocol, RDP) or virtual network Computing (virtual network computing, VNC).

The service gateway device 130 may include a processor 131 , a storage medium 132 and a transceiver 133 .

The processor 131 is, for example, a central processing unit (central processing unit, CPU), or other programmable general purpose or special purpose micro control unit (micro control unit, MCU), microprocessor (microprocessor), digital signal processing Digital signal processor (DSP), programmable controller, application specific integrated circuit (ASIC), graphics processing unit (graphics processing unit, GPU), image signal processor (image signal processor, ISP) ), image processing unit (image processing unit, IPU), arithmetic logic unit (arithmetic logic unit, ALU), complex programmable logic device (complex programmable logic device, CPLD), field programmable logic gate array (field programmable gate array , FPGA) or other similar components or combinations of the above components. The processor 131 can be coupled to the storage medium 132 and the transceiver 133 , and access and execute multiple modules and various application programs stored in the storage medium 132 .

The storage medium 132 is, for example, any type of fixed or removable random access memory (random access memory, RAM), read-only memory (read-only memory, ROM), flash memory (flash memory) , a hard disk drive (hard disk drive, HDD), a solid state drive (solid state drive, SSD) or similar components or a combination of the above components for storing multiple modules or various application programs executable by the processor 131 . In this embodiment, the storage medium 132 can store multiple modules including a service module 1321 , an authentication module 1322 , and a transduction module 1323 , and their functions will be described later.

The transceiver 133 transmits and receives signals in a wireless or wired manner. The transceiver 130 may also perform operations such as low noise amplification, impedance matching, frequency mixing, up or down frequency conversion, filtering, amplification, and the like. The transceiver 133 of the service gateway device 130 can communicate with the user equipment 110 in the public network 10 through an encrypted connection, and can communicate with the private network service server 120 in the private network 20 .

In one embodiment, the authentication module 1322 can store authentication information associated with the user and a service list including at least one allowed service. Table 1 account number Authentication information Allow service User A account password Containment Protocol Service A (10.1.1.1/22) Virtual network computing service B (10.1.1.2/5900) User B certificate Containment Protocol Service A (10.1.1.1/22) Remote Desktop Protocol Service C (10.1.1.3/3389) User C SMS OTP Virtual network computing service B (10.1.1.2/5900) Remote Desktop Protocol Service C (10.1.1.3/3389) Remote Desktop Protocol Service D (10.1.1.4/3389)

Table 1 is an example of the content stored in the authentication module 1322 . Please refer to Table 1, the authentication module 1322 can store the authentication information associated with the user and the allowed service. For example, user A uses account password as authentication information, and the services that user A is allowed to use are secure shell protocol service A (10.1.1.1/22) and virtual network computing service B (10.1.1.2/5900). User B uses the certificate as authentication information, and the services that user B is allowed to use are Secure Shell Service A (10.1.1.1/22) and Remote Desktop Service C (10.1.1.3/3389). User C uses SMS one-time password (OTP) as authentication information, and the services that user C is allowed to use are virtual network computing service B (10.1.1.2/5900), remote desktop protocol service C (10.1.1.3/3389) and Remote Desktop Protocol Service D (10.1.1.4/3389).

In the following, user A will be used as an example to continue the description. When user A wants to use the user equipment 100 (set in the public network 10) to access the private network service in the private network 20, user A can use the browser software 111 to create a user in the public network 10 An encrypted connection between the device 100 and the service gateway device 130. For example, the browser software 111 can connect to the service module 1321 through HTTPS 443 port, and the present disclosure does not limit the way of establishing an encrypted connection.

FIG. 2 is a schematic diagram illustrating a login screen according to an embodiment of the present disclosure. Please refer to FIG. 2 and Table 1 at the same time. Since user A's authentication information is account password (user A uses account password as authentication), after user A uses browser software 111 to connect to service gateway device 130 through an encrypted connection, service module 1321 can provide The login page as shown in FIG. 2 is sent to the browser software 111 to receive the login information of user A.

After user A inputs the login information into the login page through the browser software 111, the authentication module 1322 can determine whether the login information input by user A is consistent with the authentication information stored in the authentication module 1322 (that is, in Table 1, associated with User A's authentication information) match. If the authentication module 1322 determines that the input login data matches the authentication data, the service module 1321 can control the transduction module 1323 to configure the private network service server 120 in the private network 20, so that the private network service server 120 provides the browser software 111 of the user equipment 110 with the private network service corresponding to the target service of the user equipment 110 . FIG. 3 is a schematic diagram illustrating a display permission service according to an embodiment of the present disclosure. Please refer to FIG. 3 and Table 1 at the same time. After the authentication module 1322 judges that the login information matches the authentication information, the service list stored by the authentication module 1322 indicates that the service that user A is allowed to use (that is, the allowed service) is Secure Shell Protocol Service A (10.1.1.1/22) and Virtual Network Computing Service B (10.1.1.2/5900), so the service module 1321 can provide a screen as shown in Figure 3 for the user to select at least One allows the service to choose the target service you want to use. After the user determines the target service, the user can send an instruction to the service module 1321 through the browser software 111 of the user equipment 110 . The service module 1321 can select a target service from at least one allowed service in the service list according to the instruction.

Assuming that the target service selected by user A (on the browser software 111) from the allowed services is the secure shell protocol service A (10.1.1.1/22), the transduction module 1323 of the service gateway device 130 can be connected to a private The network service server 120 configures the private network service server 120 to activate the private network service corresponding to the target service (secure shell protocol service A (10.1.1.1/22)). FIG. 4 is a schematic diagram illustrating a provision of a private network service corresponding to a target service according to an embodiment of the present disclosure, please refer to FIG. 4 . After the transduction module 1323 configures the private network service server 120 to start the private network service corresponding to the target service (that is, the secure shell protocol service A (10.1.1.1/22)), the service module 1321 can control the transduction The guide module 1323 configures the private network service server 120, so that the private network service server 120 provides the private network service corresponding to the target service (that is, the secure shell protocol service A (10.1.1.1/22)) to the user The browser software 111 of the device 110. In one embodiment, the private network service server 120 can provide the private network service to the user equipment 110 via the service gateway device 130 . For example, the transduction module 1323 can access the private network service server 120 to provide the connection status image of the private network service to the browser software 111 through the service module 1321 and the transceiver 133 . The disclosure does not limit the implementation of providing the private network service to the browser software 111 .

FIG. 5 is a flowchart illustrating a private network service access method according to an embodiment of the present disclosure, wherein the private network service access method can be implemented by the service gateway device 130 shown in FIG. 1 . In step S501, the service gateway device communicates with the user equipment in the public network through an encrypted connection; the service gateway device communicates with the private network service server in the private network. In step S502, the service gateway device configures the private network service server according to the target service selected by the browser software of the user equipment, so that the private network service server provides the private network service corresponding to the target service to the user equipment.

To sum up, the private network service access method and service gateway device disclosed in this disclosure can allow users to choose the private network service they want to use (access) through the browser software on the user device, which improves the user experience. convenience. In addition, when the login information input by the user matches the pre-stored authentication information, the present disclosure can provide the private network service corresponding to the allowed service to the browser software. Based on this, the security and convenience of private network service access can be effectively improved.

Although the present disclosure has been disclosed above with embodiments, it is not intended to limit the present disclosure. Anyone with ordinary knowledge in the technical field may make some changes and modifications without departing from the spirit and scope of the present disclosure. The scope of protection of this disclosure should be defined by the scope of the appended patent application.

100: Private network service access system 10: Public Internet 110: user equipment 111:Browser software 20: Private network 120: Private network service server 130: service gateway equipment 1321: service module 1322: authentication module 1323:transduction module S501, S502: steps

FIG. 1 is a schematic diagram illustrating a private network service access system according to an embodiment of the present disclosure. FIG. 2 is a schematic diagram illustrating a login screen according to an embodiment of the present disclosure. FIG. 3 is a schematic diagram illustrating a display permission service according to an embodiment of the present disclosure. FIG. 4 is a schematic diagram illustrating a provision of a private network service corresponding to a target service according to an embodiment of the present disclosure. FIG. 5 is a flowchart illustrating a private network service access method according to an embodiment of the present disclosure.

S501, S502: steps

Claims (5)

A private network service access method, comprising: The service gateway device is connected to the user equipment in the public network through encrypted connection communication; The service gateway device is communicatively connected to the private network service server in the private network; and The service gateway device configures the private network service server according to the target service selected by the browser software of the user equipment, so that the private network service server provides the private network corresponding to the target service. The network service is provided to the user equipment. A service gateway device, comprising: The transceiver is connected to the user equipment in the public network through an encrypted connection, and is connected to the private network service server in the private network, wherein the user equipment stores browser software; a storage medium for storing multiple modules; and A processor, accessing and executing the plurality of modules, wherein the plurality of modules include a service module and a transduction module, wherein The service module controls the transduction module to configure the private network service server according to the target service selected by the browser software of the user equipment, so as to be provided by the private network service server The private network service corresponding to the target service is provided to the user equipment. The service gateway device as described in claim 2, wherein The service module provides a login page to the browser software, and receives the user's login information through the login page. The service gateway device as described in claim 3, wherein The plurality of modules further includes an authentication module, wherein the authentication module stores authentication information associated with the user and at least one allowed service, wherein In response to the login information matching the authentication information, the service module selects the target service from the at least one allowed service according to an instruction of the browser software. The service gateway device as claimed in claim 2, wherein the private network service includes at least one of the following: Secure Shell Protocol, Remote Communications Network, Remote Desktop Protocol, and Virtual Network Computing.

Images