WO2017024588A1 - 业务处理方法及装置 - Google Patents

业务处理方法及装置 Download PDF

Info

Publication number
WO2017024588A1
WO2017024588A1 PCT/CN2015/086893 CN2015086893W WO2017024588A1 WO 2017024588 A1 WO2017024588 A1 WO 2017024588A1 CN 2015086893 W CN2015086893 W CN 2015086893W WO 2017024588 A1 WO2017024588 A1 WO 2017024588A1
Authority
WO
WIPO (PCT)
Prior art keywords
user agent
access request
connection
network server
proxy node
Prior art date
Application number
PCT/CN2015/086893
Other languages
English (en)
French (fr)
Inventor
韦安妮
熊春山
郭建华
唐妙然
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201580075161.XA priority Critical patent/CN107209751B/zh
Priority to PCT/CN2015/086893 priority patent/WO2017024588A1/zh
Publication of WO2017024588A1 publication Critical patent/WO2017024588A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning

Definitions

  • the present invention relates to the field of communications, and in particular, to a service processing method and apparatus.
  • An intermediate proxy node is a portal site.
  • the intermediate proxy node only provides one search service, that is, the webpage of the intermediate proxy node only contains an input box, and the user can input the web address of the website to be accessed in the input box, and the intermediate proxy node sends the web address to the website. Send the business data returned by the website to the user.
  • the intermediate proxy node can be a portal.
  • the related art provides a service processing method, including: the intermediate proxy node establishes a connection with the user agent (English agent: UA for short), and provides the webpage of the intermediate proxy node to the user agent.
  • the webpage only includes an input box for providing a search service; when the user agent inputs a web address in the input box, the intermediate proxy node establishes a connection with the web server according to the web address, processes the web address, and forwards the webpage to the web server;
  • the server generates service data and sends it to the intermediate agent node; the intermediate agent node processes the service data and sends it to the user agent.
  • the intermediate proxy node needs to process the received information each time, and the processing process occupies more resources of the intermediate proxy node.
  • the embodiment of the present invention provides a service processing method and device.
  • the technical solution is as follows:
  • a service processing method comprising:
  • the intermediate proxy node intercepts the access request sent by the user agent to the network server;
  • the intermediate proxy node establishes a connection with the user agent according to the access request, and provides a predetermined webpage to the user agent on the connection, the predetermined webpage including whether the access request is processed by the intermediate proxy node Setting options;
  • the intermediate proxy node receives an operation letter triggered by the user agent according to the setting option interest
  • the intermediate proxy node intercepts an access request sent by the user agent to the network server again, and forwards the access request to the network directly The server, the inhibit processing option, prohibits the intermediate proxy node from processing the access request.
  • the forwarding the access request to the network server directly includes:
  • the intermediate proxy node acquires a prohibited type of the operation information, and the prohibited type is one of a prohibition, a prohibition within a predetermined time period, and a permanent prohibition;
  • the intermediate proxy node detects whether the access request is intercepted for the first time after receiving the operation information, and when the access request is intercepted for the first time after receiving the operation information, Forwarding the access request directly to the web server; or
  • the intermediate agent node acquires a current duration, and detects whether the current duration exceeds a predetermined duration of the predetermined time period, when the current duration does not exceed the predetermined duration
  • the access request is directly forwarded to the network server, where the current time duration is the time when the operation information is received, and the current time duration end time is the time when the access request is intercepted. or,
  • the intermediate proxy node forwards the access request directly to the network server.
  • the method further includes:
  • the intermediate agent node When the operation information is generated by the user agent triggering the processing option, the intermediate agent node reads the access request recorded after the interception, processes the access request, and forwards the access request to the network server.
  • the allow processing option indicates that the intermediate proxy node is allowed to process the access request.
  • the intermediate proxy node receives the operation information that is triggered by the user agent according to the setting option, and includes:
  • the intermediate proxy node receives the operation information sent by the user agent through an application layer;
  • the intermediate proxy node receives the response data packet sent by the user agent, and reads the operation information from a predetermined field in a header field of the response data packet.
  • the intermediate proxy node intercepts an access request sent by the user agent to the network server, including:
  • the intermediate proxy node intercepts a transmission control protocol TCP connection request sent by the user agent to the network server;
  • the intermediate proxy node reads information in the TCP connection request, and replaces the network server with the user agent to establish a TCP connection according to the information;
  • the intermediate proxy node intercepts the access request sent by the user agent to the network server on the TCP connection.
  • the intermediate proxy node establishes a connection with the user agent according to the access request, and is in the connection Providing the predetermined webpage to the user agent, including:
  • the intermediate proxy node sends first indication information to the user agent on the TCP connection, where the first indication information is used to instruct the user agent to send a connection establishment request to the intermediate proxy node;
  • the intermediate proxy node establishes the connection with the user agent according to the connection establishment request
  • the intermediate proxy node receives a webpage acquisition request sent by the user agent on the connection, and the webpage acquisition request is used to request the predetermined webpage;
  • the intermediate proxy node provides the predetermined webpage to the user agent according to the webpage acquisition request.
  • the intermediate proxy node intercepts an access request sent by the user agent to the network server, including:
  • the intermediate proxy node intercepts a TCP connection request sent by the user agent to the network server;
  • the intermediate proxy node reads information in the TCP connection request, and replaces the network server with the user agent to establish a TCP connection according to the information;
  • the intermediate proxy node After the TCP connection is established, the intermediate proxy node establishes a proxy connection with the user agent by using a pre-stored digital certificate corresponding to the network server;
  • the intermediate proxy node intercepts the access request sent by the user agent to the network server on the proxy connection.
  • the intermediate proxy node establishes a connection with the user agent according to the access request, and in the connection Providing the predetermined webpage to the user agent, including:
  • the intermediate proxy node sends second indication information to the user agent on the proxy connection, where the second indication information is used to instruct the user proxy to send a connection establishment request to the intermediate proxy node;
  • the intermediate proxy node establishes the connection with the user agent according to the connection establishment request
  • the intermediate proxy node receives a webpage acquisition request sent by the user agent on the connection, and the webpage acquisition request is used to request the predetermined webpage;
  • the intermediate proxy node provides the predetermined webpage to the user agent according to the webpage acquisition request.
  • the intermediate proxy node utilizes pre-stored and The digital certificate corresponding to the network server establishes a proxy connection with the user agent, including:
  • the intermediate proxy node sends a first digital certificate to the user agent, where the first digital certificate is a digital certificate issued by a certificate authority and corresponding to the network server, and the second digital certificate of the certificate authority is pre- Configuring in the user agent or an operating system of the terminal in which the user agent is installed, so that the user agent verifies the first digital certificate according to the second digital certificate, after the verification is passed,
  • An intermediate proxy node establishes the proxy connection; or,
  • the intermediate proxy node sends a third digital certificate and a fourth digital certificate to the user agent, the third digital certificate being a digital certificate issued by an unauthorized certificate authority and corresponding to the network server, the fourth number
  • the certificate is a digital certificate of the non-authorized certificate authority, so that the user agent verifies the third digital certificate according to the fourth digital certificate, and establishes the proxy connection with the intermediate agent node after the verification is passed .
  • a service processing apparatus for use in an intermediate proxy node, the apparatus comprising:
  • An interception module is configured to intercept an access request sent by the user agent to the network server;
  • a webpage providing module configured to establish a connection with the user agent according to the access request intercepted by the request interception module, and provide a predetermined webpage to the user agent on the connection, the predetermined webpage
  • the page includes a setting option of whether to process the access request through the intermediate proxy node
  • An information receiving module configured to receive operation information triggered by the user agent according to the setting option
  • a first processing module configured to: when the operation information received by the information receiving module is generated by the user agent triggering a forbidden processing option, intercepting an access request sent by the user agent to the network server again, The access request is forwarded directly to the network server, and the inhibit processing option indicates that the intermediate proxy node is prohibited from processing the access request.
  • the first processing module includes:
  • a type obtaining unit configured to acquire a prohibited type of the operation information, where the prohibited type is one of prohibition, prohibition within a predetermined time period, and permanent prohibition;
  • a first processing unit configured to detect, when the prohibition type acquired by the type acquiring unit is the current prohibition, whether to intercept the access request for the first time after receiving the operation information, when the operation information is received And when the access request is intercepted for the first time, the access request is directly forwarded to the network server;
  • a second processing unit configured to: when the forbidden type acquired by the type acquiring unit is forbidden within a predetermined time period, acquire a current duration, and detect whether the current duration exceeds a predetermined duration of the predetermined time period, When the current duration does not exceed the predetermined duration, the access request is directly forwarded to the network server, and the start time of the current duration is the time when the operation information is received, and the end time of the current duration is The time at which the access request is intercepted; or,
  • a third processing unit configured to forward the access request to the network server directly when the forbidden type acquired by the type acquiring unit is permanently prohibited.
  • the device further includes:
  • a second processing module configured to: when the operation information received by the information receiving module is generated by the user agent triggering a processing option, reading the access request recorded after the intercepting, the access request The processing is forwarded to the network server, and the allow processing option indicates that the intermediate proxy node is allowed to process the access request.
  • the information receiving module includes:
  • a first receiving unit configured to receive the operation information that is sent by the user agent by using an application layer
  • a second receiving unit configured to receive a response data packet sent by the user agent, from the number of responses
  • the operation information is read in a predetermined field in the header field of the packet.
  • the request intercepting module includes:
  • a first intercepting unit configured to intercept a transmission control protocol TCP connection request sent by the user agent to the network server
  • a first connection establishing unit configured to read information in the TCP connection request intercepted by the first intercepting unit, and replace the network server to establish a TCP connection with the user agent according to the information;
  • a second intercepting unit configured to intercept, on the TCP connection established by the first connection establishing unit, the access request sent by the user agent to the network server.
  • the webpage providing module includes:
  • a first sending unit configured to send first indication information to the user agent on the TCP connection, where the first indication information is used to instruct the user agent to send a connection establishment request to the intermediate proxy node;
  • a second connection establishing unit configured to establish the connection with the user agent according to the connection establishment request
  • a third receiving unit configured to receive, by using the connection established by the second connection establishing unit, a webpage obtaining request sent by the user agent, where the webpage obtaining request is used to request the predetermined webpage;
  • a first providing unit configured to provide the predetermined webpage to the user agent according to the webpage obtaining request.
  • the request intercepting module includes:
  • a third intercepting unit configured to intercept a TCP connection request sent by the user agent to the network server
  • a third connection establishing unit configured to read information in the TCP connection request intercepted by the third intercepting unit, and replace the network server to establish a TCP connection with the user agent according to the information;
  • a fourth connection establishing unit configured to use the TCP connection established by the third connection establishing unit After the establishment is completed, establishing a proxy connection with the user agent by using a pre-stored digital certificate corresponding to the network server;
  • a fourth intercepting unit configured to intercept, on the proxy connection established by the fourth connection establishing unit, the access request sent by the user agent to the network server.
  • the webpage providing module includes:
  • a second sending unit configured to send second indication information to the user agent on the proxy connection, where the second indication information is used to instruct the user agent to send a connection establishment request to the intermediate proxy node;
  • a fifth connection establishing unit configured to establish the connection with the user agent according to the connection establishment request
  • a fourth receiving unit configured to receive a webpage obtaining request sent by the user agent on the connection established by the fifth connection establishing unit, where the webpage obtaining request is used to request the predetermined webpage;
  • a second providing unit configured to provide the predetermined webpage to the user agent according to the webpage obtaining request.
  • the fourth connection establishing unit is specifically configured to be used :
  • the first digital certificate is a digital certificate issued by a certificate authority and corresponding to the network server
  • the second digital certificate of the certificate authority is pre-configured in the user In an operating system of the terminal or the terminal in which the user agent is installed, so that the user agent verifies the first digital certificate according to the second digital certificate, and after the verification is passed, establishes with the intermediate agent node Agent connection; or,
  • the third digital certificate is a digital certificate issued by an unauthorized certificate authority and corresponding to the network server
  • the fourth digital certificate is the non- Authorizing a digital certificate of the certificate authority to enable the user agent to verify the third digital certificate according to the fourth digital certificate, and establish the proxy connection with the intermediate agent node after the verification is passed.
  • a service processing apparatus for use in an intermediate proxy node, the apparatus comprising: a bus, and a processor, a memory, a transmitter, and a receiver coupled to the bus.
  • the memory is for storing a plurality of instructions, the instructions being configured to be executed by the processor;
  • the receiver is configured to intercept an access request sent by the user agent to the network server;
  • the processor configured to establish a connection with the user agent according to the access request intercepted by the receiver, and provide a predetermined webpage to the user agent on the connection, where the predetermined webpage includes whether The intermediate proxy node processes the setting options of the access request;
  • the receiver is further configured to receive operation information triggered by the user agent according to the setting option; when the operation information is generated by the user agent triggering a forbidden processing option, intercepting the user agent again Determining an access request sent by the network server, the prohibiting processing option indicating that the intermediate proxy node is prohibited from processing the access request;
  • the transmitter is configured to forward the access request directly to the network server.
  • the processor is further configured to acquire a prohibited type of the operation information, where the prohibition type is one of a prohibition, a prohibition during a predetermined time period, and a permanent prohibition;
  • the processor is further configured to: when the prohibition type is the current prohibition, detecting whether the access request is intercepted for the first time after receiving the operation information, where the transmitter is further configured to detect when the processor detects And when the access request is intercepted for the first time after receiving the operation information, forwarding the access request directly to the network server; or
  • the processor is further configured to: when the prohibition type is forbidden within a predetermined time period, acquire a current duration, and detect whether the current duration exceeds a predetermined duration of the predetermined time period, the transmitter is further used to When the processor detects that the current duration does not exceed the predetermined duration, the access request is directly forwarded to the network server, and the start time of the current duration is a time when the operation information is received. The end time of the current duration is the time when the access request is intercepted this time; or,
  • the transmitter is further configured to forward the access request to the network server directly when the prohibition type is permanently prohibited.
  • the processor is further configured to: when the operation information is triggered by the user agent to enable a processing option, read the access request recorded after interception;
  • the transmitter is further configured to forward to the network server after the processor processes the access request, and the permission processing option indicates that the intermediate proxy node is allowed to process the access request.
  • the receiver is specifically configured to receive the The operation information sent by the user agent through the application layer; or receiving the response data packet sent by the user agent, and reading the operation information from a predetermined field in the header field of the response data packet.
  • the receiver is further configured to intercept a transmission control protocol TCP connection request sent by the user agent to the network server;
  • the processor is further configured to read information in the TCP connection request intercepted by the receiver, and replace the network server to establish a TCP connection with the user agent according to the information;
  • the transmitter is further configured to intercept, on the TCP connection established by the processor, the access request sent by the user agent to the network server.
  • the transmitter is further configured to send first indication information to the user agent on the TCP connection, where the first indication information is used to instruct the user agent to send a connection establishment request to the intermediate proxy node;
  • the processor is further configured to establish the connection with the user agent according to the connection establishment request;
  • the receiver is further configured to receive a webpage obtaining request sent by the user agent on the connection established by the processor, where the webpage obtaining request is used to request the predetermined webpage;
  • the processor is further configured to provide the predetermined webpage to the user agent according to the webpage obtaining request.
  • the receiver is further configured to intercept a TCP connection request sent by the user agent to the network server;
  • the processor is further configured to read information in the TCP connection request intercepted by the receiver, and replace the network server to establish a TCP connection with the user agent according to the information; after the TCP connection is established Afterwards, establishing a proxy connection with the user agent by using a pre-stored digital certificate corresponding to the network server;
  • the receiver is further configured to intercept, by the proxy connection established by the processor, the access request sent by the user agent to the network server.
  • the transmitter is further configured to send second indication information to the user agent on the proxy connection, where the second indication information is used to instruct the user agent to send a connection establishment request to the intermediate proxy node;
  • the processor is further configured to establish the connection with the user agent according to the connection establishment request;
  • the receiver is further configured to receive a webpage obtaining request sent by the user agent on the connection established by the processor, where the webpage obtaining request is used to request the predetermined webpage;
  • the processor is further configured to provide the predetermined webpage to the user agent according to the webpage obtaining request.
  • the transmitter is further configured to send, to the user agent, a first digital certificate, where the first digital certificate is a digital certificate issued by a certificate authority and corresponding to the network server, and the second certificate authority
  • the digital certificate is pre-configured in an operating system of the user agent or a terminal in which the user agent is installed, so that the user agent verifies the first digital certificate according to the second digital certificate, after the verification is passed, Establishing the proxy connection with the intermediate proxy node; or,
  • the transmitter is further configured to send, to the user agent, a third digital certificate and a fourth digital certificate, where the third digital certificate is a digital certificate issued by an unauthorized certificate authority and corresponding to the network server,
  • the fourth digital certificate is a digital certificate of the non-authorized certificate authority, so that the user agent verifies the third digital certificate according to the fourth digital certificate, and after the verification is passed, establishes with the intermediate agent node Said proxy connection.
  • the predetermined webpage includes a setting option of processing the access request through the intermediate proxy node, and intercepting the access sent by the user agent to the web server again when receiving the operation information generated by the user agent triggering the prohibition processing option
  • the request directly forwards the access request to the network server, and when the user agent selects that the intermediate proxy node does not need to process the access request, the access request is not processed, and the access request is directly forwarded to the network server, and the intermediate generation is solved.
  • the node needs to process the received information, it takes up more resources and achieves the effect of saving resources.
  • FIG. 1 is a flowchart of a method for processing a service according to an embodiment of the present invention
  • FIG. 2 is a flowchart of still another method for processing a service according to an embodiment of the present invention.
  • FIG. 3 is a flowchart of an application of a first service processing method according to an embodiment of the present invention.
  • FIG. 4A is a flowchart of still another method for processing a service according to an embodiment of the present invention.
  • 4B is a schematic diagram of establishing a TLS connection according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of an application of a second service processing method according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a service processing apparatus according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of still another service processing apparatus according to an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of a service processing apparatus according to an embodiment of the present invention.
  • FIG. 1 is a flowchart of a method for processing a service according to an embodiment of the present invention.
  • the service processing method may include:
  • step 101 the intermediate proxy node intercepts the access request sent by the user agent to the network server.
  • Step 102 The intermediate proxy node establishes a connection with the user agent according to the access request, and provides a predetermined webpage to the user agent on the connection, the predetermined webpage including setting options for processing the access request through the intermediate proxy node.
  • Step 103 The intermediate proxy node receives operation information triggered by the user agent according to the setting option.
  • Step 104 When the operation information is generated by the user agent triggering the prohibition processing option, the intermediate proxy node intercepts the access request sent by the user agent to the network server again, and directly forwards the access request. For the web server, the inhibit processing option indicates that the intermediate proxy node is prohibited from processing the access request.
  • the service processing method provided by the embodiment of the present invention provides a predetermined webpage by providing a user webpage, the predetermined webpage including a setting option of processing an access request through an intermediate proxy node, and receiving a user agent triggering prohibition processing option.
  • the operation information is intercepted, the access request sent by the user agent to the network server is intercepted, and the access request is directly forwarded to the network server, and the access request is not processed when the user agent selects that the intermediate proxy node does not need to process the access request, directly Forwarding the access request to the network server solves the problem that the intermediate agent node needs to process the received information every time and occupy more resources, thereby achieving the effect of saving resources.
  • the service processing method may include:
  • Step 201 The intermediate proxy node intercepts a TCP (Transmission Control Protocol) connection request sent by the user agent to the network server.
  • TCP Transmission Control Protocol
  • the intermediate proxy node may be a portal or other site, which is not limited in this embodiment.
  • the connection may be an unencrypted connection based on a hypertext transfer protocol (English: hypertext transfer protocol; HTTP), or a condom based on the lower layer.
  • Hypertext transfer protocol over secure socket layer English: security socket layer; abbreviation: SSL
  • protocol/transport layer security English: transport layer security; TLS
  • HTTPS hypertext transfer protocol over secure socket layer
  • HTTPS Hypertext transfer protocol over secure socket layer
  • the user agent establishes a non-encrypted TCP connection with the network server as an example.
  • the intermediate agent node may intercept the TCP connection request.
  • Step 202 The intermediate proxy node reads the information in the TCP connection request, and replaces the network server with the user agent to establish a TCP connection according to the information.
  • the TCP connection port includes port 80 and port 443. If the user agent needs to access the network server based on the HTTP protocol, the port of the TCP connection is port 80. If the user agent needs to access the network server based on the HTTPS protocol, the port of the TCP connection is Port 443. In this embodiment, the user agent accesses the network server based on the HTTP protocol as an example. In this case, the port of the TCP connection is port 80.
  • the information in the TCP connection request includes the source Internet protocol (English: Internet) Protocol; abbreviated as: IP) address, source port, destination IP address, destination port, the source is the user agent, and the destination is the network server.
  • the intermediate proxy node uses the above information to replace the network server, and establishes a port with the user agent as a port 80 port TCP connection.
  • Step 203 The intermediate proxy node intercepts the access request sent by the user agent to the network server on the TCP connection.
  • the access request may specifically request access to a webpage of the web server or an object in the web server.
  • the access request includes www.ottserver.com; when the user agent needs to access the object in the web server, and the web server
  • the object's uniform resource identifier (English: uniform resource identifier; URI for short) is www.ottserver.com/picture1.gif, the access request includes www.ottserver.com/picture1.gif.
  • Step 204 The intermediate proxy node sends first indication information to the user agent on the TCP connection, where the first indication information is used to instruct the user agent to send a connection establishment request to the intermediate proxy node.
  • the first indication information includes a redirect response message.
  • the redirect response message can be HTTP Redirection.
  • the location header field of the redirect response message may include type information, where the type information is used to indicate a connection type that the user agent requests to establish.
  • the type information may carry HTTPS, and the HTTPS is used to indicate the HTTPS protocol;
  • the redirect response message needs to indicate that the user agent establishes an unencrypted connection the type information may be It carries HTTP, and HTTP is used to indicate the HTTP protocol. This example is described by taking HTTP as the type information.
  • the connection establishment request is used to request to establish an unencrypted connection, and the port of the non-encrypted connection is port 80.
  • the redirect response message needs to include the URL of the intermediate proxy node, so that the user agent sends a connection establishment request to the intermediate proxy node when accessing the URL of the intermediate proxy node.
  • a TCP connection is established between the user agent and the intermediate agent node, and the connection establishment request is a TCP connection request.
  • Step 205 The intermediate proxy node establishes a connection with the user agent according to the connection establishment request.
  • the information in the TCP connection request includes a source IP address, a source port, a destination IP address, a destination port, a source end is a user agent, and a destination end is an intermediate agent node, and the intermediate agent node uses the above information and the user agent.
  • the establishment port is a TCP port of port 80.
  • Step 206 The intermediate proxy node receives, on the connection, a webpage obtaining request sent by the user agent, where the webpage obtaining request is used to request a predetermined webpage, whether the predetermined webpage includes the intermediate proxy node Set options for access requests.
  • the user agent After establishing the TCP connection with the intermediate proxy node, the user agent also needs to send a webpage acquisition request to the intermediate proxy node, and the webpage acquisition request is used to request a predetermined webpage, and the predetermined webpage may be a webpage of the intermediate proxy node.
  • Step 207 The intermediate proxy node provides the predetermined webpage to the user agent according to the webpage obtaining request.
  • the predetermined webpage includes a setting option of whether to process the access request through the intermediate proxy node.
  • the predetermined webpage includes prompt information of “whether the access request is processed by the intermediate proxy node”, and an “allow” setting option and a “prohibited” setting option are provided below the prompting information.
  • the predetermined webpage may further include other content set according to user requirements or operator policies.
  • the predetermined webpage may further include push information such as hot news, benefits provided by the operator to process the access request through the intermediate proxy node, tariff information provided by the operator to process the access request through the intermediate proxy node, and the like, this embodiment
  • Other content included in the reservation page is not limited.
  • Step 208 The intermediate proxy node receives the operation information triggered by the user agent according to the setting option.
  • the user agent After the user agent displays the predetermined webpage, if the user wants to process the access request through the intermediate proxy node, click the "Allow” setting option, the user agent triggers the generation of the operation information; if the user does not want to process the access request through the intermediate proxy node, click "Prohibit "Set options, user agent triggers to generate operational information.
  • the user agent also needs to send the operation information to the intermediate agent node.
  • the embodiment provides two ways of receiving the operation information corresponding to the manner in which the user agent sends the operation information. The following two implementation modes are respectively introduced:
  • the intermediate proxy node receives operational information sent by the user agent through the application layer.
  • the user agent may send the operation information to the intermediate proxy node in the PUT request based on the HTTP protocol, or the user agent may also carry the operation information in the other message based on the HTTP protocol and send the message to the intermediate proxy node.
  • the example is not limited.
  • the intermediate proxy node receives the response data packet sent by the user agent and reads the operation information from a predetermined field in the header field of the response data packet.
  • the user agent Since the intermediate proxy node provides the predetermined web page to the user agent in step 207, the user agent needs to send the response data packet to the intermediate proxy node after receiving the predetermined web page.
  • the user agent When the user agent generates the operation information, the user agent has not sent the response data packet to the intermediate agent node, and the user The agent may send the operation information through the response data packet; when the user agent generates the operation information, the user agent has sent the response data packet to the intermediate agent node, and the user agent may generate an additional response data packet through the response data packet. Send operation information.
  • the user agent may set operation information in a predetermined field in the header field of the response data packet, and send the set response data packet to the intermediate proxy node, and the intermediate proxy node reads the operation information from the predetermined field.
  • the predetermined field may be an option field or other fields, which is not limited in this embodiment.
  • Step 209 When the operation information is generated by the user agent triggering the prohibition processing option, the intermediate proxy node intercepts the access request sent by the user agent to the network server again, and forwards the access request to the network server directly, and the prohibition processing option indicates that the intermediate agent is prohibited. The node processes the access request.
  • the prohibition processing option is the "prohibited" setting option in the above example.
  • the user agent automatically disconnects the TCP connection established with the intermediate proxy node, and sends an access request to the network server again, and the intermediate proxy node intercepts the user.
  • the access request sent by the proxy again does not process the access request, and directly forwards the access request to the network server, thereby saving resources of the intermediate proxy node.
  • the user agent does not disconnect the TCP connection established with the intermediate proxy node, and sends an access request to the network server again, and the intermediate proxy node intercepts the access request sent by the user agent again on the maintained TCP connection, and does not The access request is processed, and the access request is directly forwarded to the network server, thereby saving resources of the intermediate proxy node.
  • the intermediate proxy node may intercept the access request sent by other user agents or sent by the user agent to other network servers, after intercepting the access request, the intermediate proxy node needs to detect whether the access request is the user agent again.
  • the web server sent. the intermediate proxy node can read the quaternary information in the TCP connection request sent by the user agent to the network server again, according to the source IP address, the source port, the destination IP address, and the destination in the quaternary information.
  • the end port determines whether the access request is an access request sent by the user agent to the web server again.
  • the prohibition processing option may include "this prohibition”, "prohibition within a predetermined period of time", and "permanent prohibition”.
  • the duration of the predetermined time period may be manually set or modified.
  • the duration of the initially set predetermined time period is one day, one month, etc., and the duration of the predetermined time period may be modified subsequently. For one week, one year, etc., this embodiment does not limit the reservation.
  • the intermediate proxy node Since different forbidden processing options are set in the predetermined web page, the intermediate proxy node also detects whether the access request needs to be processed after intercepting the access request again. Specifically, forwarding the access request directly to the network server includes:
  • the intermediate agent node acquires the prohibition type of the operation information, and the prohibition type is one of the prohibition, the prohibition during the predetermined time period, and the permanent prohibition;
  • the intermediate proxy node detects whether the access request is intercepted for the first time after receiving the operation information, and when the access request is intercepted for the first time after receiving the operation information, the access request is directly forwarded to the network server; or ,
  • the intermediate agent node acquires the current duration and detects whether the current duration exceeds a predetermined duration of the predetermined time period, and when the current duration does not exceed the predetermined duration, the access request is directly forwarded to the network server.
  • the start time of the current duration is the time at which the operation information is received, and the end time of the current duration is the time at which the access request is intercepted; or
  • the intermediate proxy node forwards the access request directly to the web server.
  • different operation information when the operation information is sent through the application layer, different operation information may be directly set for different prohibition types, and the intermediate agent node may determine the prohibition type according to which operation information is read.
  • different values can be set for different prohibition types, and the intermediate proxy node determines the prohibition type based on the read value.
  • the intermediate proxy node may determine the processing method of the access request according to the forbidden type.
  • the intermediate proxy node can detect whether the access request is intercepted for the first time after receiving the operation information, and when the access request is intercepted for the first time after receiving the operation information, the intermediate proxy node does not process the access request. Directly forward the access request to the web server. After that, when the user agent does not disconnect from the intermediate proxy node, the intermediate proxy node can continue to intercept the access request sent by the user agent to the network server directly on the connection, and process the access request and forward it to the network server.
  • the access request may be the URL of the web server or the URI or service data of the object in the web server; when the user agent disconnects the intermediate proxy node, the intermediate proxy node performs step 201.
  • the intermediate agent node may use the time when the operation information is received as the start time, and the time when the current access request is intercepted as the end time, The current duration and the predetermined duration of the predetermined time period; whether the current duration is less than the predetermined duration; when the current duration is less than the predetermined duration, the access request is not processed, and the access request is directly forwarded to the network server; when the current duration is greater than the predetermined duration When the duration is long, the access request is processed and forwarded to the web server.
  • the intermediate proxy node may not detect the access request, and does not process the access request, and directly forwards the access request to the network server.
  • Step 210 When the operation information is generated by the user agent triggering the processing option, the intermediate agent node reads the access request recorded after the interception, processes the access request and forwards the request to the network server, and the permission processing option indicates that the middle is allowed.
  • the proxy node processes the access request.
  • the allowable processing option is the "Allow" setting option in the above example.
  • the intermediate agent node may set the input box in the predetermined webpage to an inputtable state, and the user may input the web server's web address or the object in the web server in the input box.
  • the URI the user agent generates an access request carrying the URL of the network locator or the URI of the object, and sends the access request to the intermediate proxy node, and the intermediate proxy node processes the access request and forwards the request to the network server.
  • the user agent may display a shortcut key in the predetermined webpage.
  • the intermediate proxy node reads the access request recorded before the interception.
  • the access request is processed and forwarded to the web server.
  • the intermediate proxy node needs to continue to access the network server by default, and directly reads the access request recorded after intercepting the access request, and processes the access request and forwards the request to the access request.
  • the intermediate proxy node forwards the access request to the network server, it also needs to establish a connection with the network server, and the connection may be an unencrypted connection or an encrypted connection.
  • the process of establishing a connection between the intermediate proxy node and the network server is an existing process, and is not described herein.
  • the network server sends the service data to the intermediate proxy node, and the intermediate proxy node determines whether to process the service data according to whether the access request corresponding to the service data is processed. If the intermediate proxy node processes the access request corresponding to the service data, the intermediate proxy node processes the service data and forwards the service data to the user agent; if the intermediate proxy node does not process the access request corresponding to the service data, Medium The inter-agent node does not process the service data and directly forwards the service data to the user agent.
  • the webpage may further include a URI of the object, and the intermediate proxy node further needs to add a proxy indication to the URI of the object, and the proxy indicates an intermediate proxy node for indicating the transit service.
  • the proxy indication may be the URL of the intermediate proxy node www.portal.com.
  • the service processing method provided by the embodiment of the present invention provides a predetermined webpage by providing a user webpage, the predetermined webpage including a setting option of processing an access request through an intermediate proxy node, and receiving a user agent triggering prohibition processing option.
  • the operation information is intercepted, the access request sent by the user agent to the network server is intercepted, and the access request is directly forwarded to the network server, and the access request is not processed when the user agent selects that the intermediate proxy node does not need to process the access request, directly Forwarding the access request to the network server solves the problem that the intermediate agent node needs to process the received information every time and occupy more resources, thereby achieving the effect of saving resources.
  • the access request is processed and then forwarded to the network server, and the user does not need to input the web server URL again in the input box to generate an access request, thereby simplifying access to the network server. Operation improves the efficiency of access to the web server.
  • the process of establishing a TCP connection, an intermediate proxy node, and a network server to establish an encrypted connection is described below as an example to describe the flow of the service processing method. Please refer to the application flow chart of the first service processing method shown in FIG. 3, where the intermediate proxy node is a portal, the user proxy is a UA, and the network server is an OTT server.
  • the portal intercepts the TCP connection request sent by the UA to the OTT server, and replaces the OTT server with the UA to establish a TCP connection (port 80) according to the information in the TCP connection request.
  • Step 302 The Portal intercepts the GET request sent by the UA to the OTT server.
  • the GET request is an access request.
  • Step 303 The Portal sends a redirect response message to the UA and/or type information that needs to be accessed through the HTTPS protocol.
  • the HTTPS protocol is the lower layer HTTP protocol using the SSL/TLS protocol.
  • step 304 a TCP connection (port 80) is established between the UA and the Portal.
  • step 305 the UA sends a GET request to the Portal.
  • the GET request includes www.portal.com, and the GET request is a webpage acquisition request.
  • step 306 the Portal replies to the UA with a 200 ok response and a predetermined web page.
  • the predetermined webpage is a webpage of www.portal.com, and the predetermined webpage includes setting options for processing a GET request through the portal.
  • Step 307 the UA triggers the setting option.
  • the UA triggers the allow processing option the "go to” option is displayed in the predetermined webpage, the UA triggers the "go to” option, and step 308 is performed; when the UA triggers the "predetermined time”
  • step 321 is performed.
  • step 308 the Portal reads the GET request recorded after the interception.
  • Portal parses www.ottserver.com from the GET request.
  • a TCP connection (port 443) is established between the Portal and the OTT server.
  • Step 310 A TLS handshake process between the Portal and the OTT Server.
  • step 311 the Portal sends an encrypted GET request to the OTT server.
  • the GET request includes www.ottserver.com.
  • step 312 the OTT Server returns the encrypted 200ok response and the webpage to the Portal.
  • the webpage is the webpage of www.ottserver.com.
  • step 313 after the Portal decrypts the 200ok response, the Portal adds a portal indication to the 200ok response.
  • step 314 the Portal sends a 200ok response to the UA.
  • step 315 the UA sends a GET request to the Portal.
  • step 316 the Portal parses the GET request.
  • Portal parses www.ottserver.com/picture1.gif from the GET request.
  • step 317 the Portal sends an encrypted GET request to the OTT server.
  • the GET request includes www.ottserver.com/picture1.gif.
  • step 318 the OTT server returns the encrypted 200ok response and picture 1 to the Portal.
  • step 319 after the Portal decrypts the 200ok response, the Portal adds a portal indication to the 200ok response.
  • the portal indication added by Portal is: www.portal.com.
  • step 320 the Portal sends a 200ok response to the UA, and the process ends.
  • Step 321 The UA sends operation information to the Portal, and disconnects the TCP connection with the Portal. At this point, Portal starts the timer.
  • Step 322 The Portal intercepts the TCP connection request sent by the UA to the OTT server again, and replaces the TCP connection (80 port) between the OTT server and the UA according to the information in the TCP connection request.
  • step 323 the Portal intercepts the GET request sent by the UA to the OTT server.
  • the GET request is an access request.
  • Step 324 The Portal detects whether the current duration exceeds a predetermined duration of the timer, and sends an encrypted GET request to the OTT server when the current duration does not exceed the predetermined duration.
  • the GET request includes www.ottserver.com.
  • step 325 the OTT server returns the encrypted 200ok response and the webpage to the Portal.
  • the webpage is the webpage of www.ottserver.com.
  • step 326 after the Portal decrypts the 200ok response, the Portal sends a 200ok response to the UA.
  • the service processing method may include:
  • step 401 the intermediate proxy node intercepts the TCP connection request sent by the user agent to the network server.
  • the intermediate proxy node may be a portal or other site, which is not limited in this embodiment.
  • the connection may be an HTTP-based non-encrypted connection or an HTTPS-based encrypted connection based on the underlying SSL protocol/TLS protocol.
  • the user agent establishes an encrypted connection with the network server as an example. Since the TCP connection needs to be established before establishing the encrypted connection, the intermediate agent node may intercept the TCP when the user agent sends a TCP connection request to the network server. Connection request.
  • Step 402 The intermediate proxy node reads the information in the TCP connection request, and replaces the network server with the user agent to establish a TCP connection according to the information.
  • the port of the TCP connection is 443.
  • Step 403 After the TCP connection is established, the intermediate proxy node establishes a proxy connection with the user agent by using the pre-stored digital certificate corresponding to the network server.
  • Step 401' the user agent sends the TLS protocol version number, the encryption algorithm list, and the first random number to the intermediate proxy node.
  • Step 402' if the intermediate proxy node supports the TLS protocol version, an encryption algorithm selected from the encryption algorithm list transmits the TLS protocol version number, the encryption algorithm, the session identifier, and the second random number to the user agent.
  • Step 403' the intermediate proxy node sends a digital certificate corresponding to the network server to the user agent.
  • Step 404' the intermediate proxy node sends a first completion message to the user agent.
  • Step 405 ′ the user agent verifies the digital certificate. After the verification is passed, the public key in the digital certificate is obtained, a pre-master key is generated, and the pre-master key is encrypted by using the public key, and the obtained public key is sent to the intermediate proxy node. Exchange information.
  • Step 406' the user agent sends a change password description to the intermediate proxy node, informing the intermediate proxy node to initiate the negotiated parameters.
  • the user agent generates the first key according to the first random number, the second random number, the pre-master key, and the encryption algorithm.
  • Step 407' the user agent sends a second completion message to the intermediate proxy node.
  • Step 408' the intermediate proxy node sends a change password description to the user agent, informing the user agent to initiate the negotiated parameters.
  • the intermediate proxy node decrypts the public key exchange information using the private key to obtain a pre-master key, and generates a second key according to the first random number, the second random number, the pre-master key, and the encryption algorithm.
  • step 409' the intermediate proxy node sends a third completion message to the user agent.
  • the intermediate proxy node needs to obtain a digital certificate and a private key corresponding to the network server before establishing an encrypted connection with the user agent.
  • the digital certificate includes at least a public key, an owner name, and a digital signature of the certificate authority.
  • a signature is a hash value obtained by hashing information to verify whether the information has been tampered with.
  • the digital signature in this embodiment is used to verify whether the digital certificate has been tampered with.
  • the intermediate proxy node establishes a proxy connection with the user agent by using the pre-stored digital certificate corresponding to the network server, including:
  • the intermediate proxy node sends a first digital certificate to the user agent.
  • the first digital certificate is a digital certificate issued by the certificate authority and corresponding to the network server, and the second digital certificate of the certificate authority is pre-configured in the user agent or installed with the user agent.
  • the user agent verifies the first digital certificate according to the second digital certificate, and after the verification is passed, establishes a proxy connection with the intermediate proxy node. Pick up; or,
  • the intermediate proxy node sends a third digital certificate and a fourth digital certificate to the user agent, the third digital certificate is a digital certificate issued by an unauthorized certificate authority and corresponding to the network server, and the fourth digital certificate is a digital certificate of the non-authorized certificate authority. So that the user agent verifies the third digital certificate according to the fourth digital certificate, and after the verification is passed, establishes a proxy connection with the intermediate proxy node.
  • the digital certificate corresponding to the network server may be a real digital certificate of the network server, or may be a digital certificate other than the real digital certificate, and the other digital certificate has a corresponding relationship with the network server.
  • the other digital certificate may be a proxy digital certificate or a fake digital certificate, and the specific content is as follows.
  • the certificate authority can be an authorized certificate authority or an unauthorized certificate authority.
  • the authorized certificate authority When the certificate authority is an authorized certificate authority, the authorized certificate authority issues a proxy digital certificate of the network server for the trusted intermediate agent node according to security monitoring and the like, and the agent digital certificate is the first digital certificate.
  • the authorization certificate issuing authority may issue different proxy digital certificates for each network server, and may also issue the same proxy digital certificate for multiple different network servers, which is not limited in this embodiment.
  • the proxy digital certificate of the network server may also be a sub-certificate on the digital certificate chain of the network server.
  • This sub-certificate can be issued by a network server or by another third-party authorized certificate authority.
  • the proxy digital certificate may be the same as the real digital certificate issued by the authorized certificate authority for the network server, or may be different from the real digital certificate. That is, the proxy digital certificate and the real digital certificate can have different public and private key pairs.
  • the non-authorized certificate authority issues a digital certificate of the network server for the intermediate agent node, and the digital certificate at this time is a fake digital certificate, and the fake digital certificate is the first digital certificate.
  • the user agent verifies the digital certificate, it checks whether the root certificate of the certificate authority of the digital certificate is in the list of the trusted certificate authority (English: Certificate Authority; CA), and the root certificate is the second digital certificate. If the root certificate is located in the trusted CA list, the digital signature in the digital certificate is verified according to the public key of the root certificate. If the verification of the digital signature is successful, the verification of the digital certificate is successful; if the verification of the digital signature fails , the verification of the digital certificate fails; if the root certificate is not in the list of trusted CAs, the verification of the digital certificate fails.
  • the root certificate authority of the digital certificate is in the list of the trusted certificate authority (English: Certificate Authority; CA)
  • the root certificate is the second digital certificate. If the root certificate is located in the trusted CA list, the digital signature in the digital certificate is verified according to the public key of the root certificate. If the verification of the digital signature is successful, the verification of the digital certificate is successful; if the verification of the digital signature fails , the verification of the digital certificate fails; if the root certificate
  • the digital certificate corresponding to the network server obtained by the intermediate proxy node may be issued by a multi-level certificate authority.
  • the digital certificate corresponding to the network server obtained by the intermediate agent node is issued by the intermediate certificate authority Issuer, and the digital certificate issued by the intermediate certificate authority Issuer is issued by the advanced certificate authority Root CA.
  • the user agent searches for the digital certificate of the certificate authority step by step, and detects whether the root certificate of the certificate authority of the digital certificate is located in the trusted CA list, and if the root certificate is located in the trusted CA list, according to the root certificate
  • the public key verifies the digital signature in the lower-level digital certificate.
  • the digital signature in the lower-level digital certificate is verified according to the public key of the lower-level digital certificate until the verification of all the digital signatures is successful.
  • the verification of the certificate is successful; if the verification of one of the digital signatures fails, the verification of the digital certificate fails; if the root certificate is not in the list of trusted CAs, the verification of the digital certificate fails.
  • the root certificate of the authorized certificate authority is pre-configured in the user agent or the operating system of the terminal where the user agent is installed, that is, the authorized certificate authority
  • the root certificate is pre-configured in the list of trusted CAs; when the certificate authority is an unauthorized certificate authority, the root certificate of the non-authorized certificate authority needs to be added to the list of trusted CAs.
  • the intermediate proxy node may obtain a digital certificate chain sent by an unauthorized certificate authority, where the digital certificate chain includes at least a digital certificate of an unauthorized certificate authority, that is, a self-signed root certificate, that is, a fourth The digital certificate, and the counterfeit digital certificate of the network server, the intermediate agent node sends the digital certificate chain to the user agent, and the fake digital certificate is a third digital certificate.
  • the user agent When the user agent verifies the digital certificate, it reads the public key of the root certificate in the received digital certificate chain, and verifies the digital signature in the fake digital certificate according to the public key. If the verification of the digital signature is successful, the counterfeit number is The verification of the certificate is successful; if the verification of the digital signature fails, the verification of the fake digital certificate fails.
  • the fake digital certificate obtained by the intermediate proxy node may be issued by a multi-level non-authorized certificate authority, that is, the certificate chain further includes a digital certificate of a multi-level non-authorized certificate authority.
  • the digital certificate corresponding to the network server obtained by the intermediate agent node is issued by the non-authorized intermediate certificate authority Issuer, and the digital certificate of the unauthorized intermediate certificate authority Issuer is not authorized. Issued by the senior certification authority Root CA.
  • the user agent searches for the digital certificate of the unauthorized certificate authority step by step from the received digital certificate, and verifies the digital signature in the lower level digital certificate according to the public key of the root certificate.
  • the public key of the lower-level digital certificate verifies the digital signature in the lower-level digital certificate until the verification of the digital certificate is successful after all the digital signatures are successfully verified; if the verification of one of the digital signatures fails, the verification of the digital certificate fails. .
  • Step 404 The intermediate proxy node intercepts the access request sent by the user agent to the network server on the proxy connection.
  • the access request may specifically request access to a webpage of the web server or an object in the web server.
  • the access request includes www.ottserver.com; when the user agent needs to access the object in the web server, and the web server
  • the object's uniform resource identifier (English: uniform resource identifier; URI for short) is www.ottserver.com/picture1.gif, the access request includes www.ottserver.com/picture1.gif.
  • Step 405 The intermediate proxy node sends second indication information to the user agent on the proxy connection, where the second indication information is used to instruct the user proxy to send a connection establishment request to the intermediate proxy node.
  • the second indication information includes a redirect response message.
  • the redirect response message refers to the description in step 204, which is not described here.
  • the HTTPS is carried in the type information as an example.
  • the connection establishment request is used to request to establish an encrypted connection
  • the port of the encrypted connection is port 443.
  • the intermediate proxy node may appoint an encryption key and a decryption key with the user agent in the process of establishing a proxy connection with the user agent.
  • the intermediate proxy node may encrypt the redirect response message by using the encryption key, and send the encrypted ciphertext to the user agent, and the user agent decrypts the ciphertext by using the decryption key to obtain a redirect response message.
  • the user agent generates a connection establishment request according to the redirect response message, sends a connection establishment request to the intermediate proxy node, and the intermediate proxy node obtains a connection establishment request.
  • step 406 the intermediate proxy node establishes a connection with the user agent according to the connection establishment request.
  • the connection established between the intermediate proxy node and the user agent may be an encrypted connection or a non-encrypted connection TCP connection.
  • the intermediate proxy node establishes a connection with the user agent according to the connection establishment request, including: the intermediate proxy node establishes a TCP connection with the user agent according to the connection establishment request; after the TCP connection establishment is completed, the intermediate proxy node utilizes the intermediate proxy Node
  • the digital certificate establishes a connection with the user agent.
  • the flow of the intermediate proxy node establishing a TLS connection with the user agent is similar to the flow shown in Figure 4B, except that in step 404', the intermediate proxy node sends the digital certificate of the intermediate proxy node to the user agent.
  • Step 407 The intermediate proxy node receives, on the connection, a webpage acquisition request sent by the user agent, where the webpage acquisition request is used to request a predetermined webpage, and the predetermined webpage includes a setting option of whether the access request is processed by the intermediate proxy node.
  • the user agent After establishing the TCP connection with the intermediate proxy node, the user agent also needs to send a webpage acquisition request to the intermediate proxy node, and the webpage acquisition request is used to request a predetermined webpage, and the predetermined webpage may be a webpage of the intermediate proxy node.
  • Step 408 The intermediate proxy node provides the predetermined webpage to the user agent according to the webpage obtaining request.
  • the predetermined webpage includes a setting option of whether to process the access request through the intermediate proxy node.
  • the predetermined webpage includes prompt information of “whether the access request is processed by the intermediate proxy node”, and an “allow” setting option and a “prohibited” setting option are provided below the prompting information.
  • the predetermined webpage may further include other content set according to user requirements or operator policies.
  • the predetermined webpage may further include push information such as hot news, benefits provided by the operator to process the access request through the intermediate proxy node, tariff information provided by the operator to process the access request through the intermediate proxy node, and the like, this embodiment
  • Other content included in the reservation page is not limited.
  • step 409 the intermediate proxy node receives the operation information triggered by the user agent according to the setting option.
  • the user agent After the user agent displays the predetermined webpage, if the user wants to process the access request through the intermediate proxy node, click the "Allow” setting option, the user agent triggers the generation of the operation information; if the user does not want to process the access request through the intermediate proxy node, click "Prohibit "Set options, user agent triggers to generate operational information.
  • the user agent also needs to send the operation information to the intermediate agent node.
  • the embodiment provides two ways of receiving the operation information corresponding to the manner in which the user agent sends the operation information. The following two implementation modes are respectively introduced:
  • the intermediate proxy node receives operational information sent by the user agent through the application layer.
  • the user agent may send the operation information to the intermediate proxy node in the PUT request based on the HTTP protocol, or the user agent may also carry the operation information in the other message based on the HTTP protocol and send the message to the intermediate proxy node.
  • the example is not limited.
  • the intermediate proxy node receives the response data packet sent by the user agent and reads the operation information from a predetermined field in the header field of the response data packet.
  • the user agent Since the intermediate proxy node provides the predetermined web page to the user agent in step 207, the user agent needs to send the response data packet to the intermediate proxy node after receiving the predetermined web page.
  • the user agent When the user agent generates the operation information, the user agent has not sent the response data packet to the intermediate agent node, and the user agent can send the operation information through the response data packet; when the user agent generates the operation information, the user agent has sent the message to the intermediate agent node. After the response packet, the user agent can generate an additional response packet through which the operation information is sent.
  • the user agent may set operation information in a predetermined field in the header field of the response data packet, and send the set response data packet to the intermediate proxy node, and the intermediate proxy node reads the operation information from the predetermined field.
  • the predetermined field may be an option field or other fields, which is not limited in this embodiment.
  • Step 410 When the operation information is generated by the user agent triggering the prohibition processing option, the intermediate proxy node intercepts the access request sent by the user agent to the network server again, and forwards the access request to the network server directly, and the prohibition processing option indicates that the intermediate agent is prohibited. The node processes the access request.
  • the prohibition processing option is the "prohibited" setting option in the above example.
  • the user agent When the operation information is generated by the user agent triggering the prohibition processing option, the user agent automatically disconnects the encrypted connection established with the intermediate proxy node, and sends an access request to the network server again, and the intermediate proxy node intercepts the access request sent by the user agent again. The access request is not processed, and the access request is directly forwarded to the network server, thereby saving resources of the intermediate proxy node.
  • the process of intercepting the access request sent by the user agent by the intermediate agent node is described in detail in steps 401-404, and details are not described herein.
  • the intermediate proxy node may intercept the access request sent by other user agents or sent by the user agent to other network servers, after intercepting the access request, the intermediate proxy node needs to detect whether the access request is the user agent again.
  • the web server sent. the intermediate proxy node can read the quaternary information in the TCP connection request sent by the user agent to the network server again, according to the source IP address, the source port, the destination IP address, and the destination in the quaternary information.
  • the end port determines whether the access request is an access request sent by the user agent to the web server again.
  • the prohibition processing option may include "this prohibition”, "prohibition within a predetermined period of time", and “permanent prohibition”.
  • the duration of the predetermined time period can be manually set or modified, for example, initial setting
  • the duration of the predetermined time period is one day, one month, etc., and the duration of the predetermined time period may be modified to one week, one year, etc., and the present embodiment does not limit the reservation.
  • the intermediate proxy node Since different forbidden processing options are set in the predetermined web page, the intermediate proxy node also detects whether the access request needs to be processed after intercepting the access request again. Specifically, forwarding the access request directly to the network server includes:
  • the intermediate agent node acquires the prohibition type of the operation information, and the prohibition type is one of the prohibition, the prohibition during the predetermined time period, and the permanent prohibition;
  • the intermediate proxy node detects whether the access request is intercepted for the first time after receiving the operation information, and when the access request is intercepted for the first time after receiving the operation information, the access request is directly forwarded to the network server; or ,
  • the intermediate agent node acquires the current duration and detects whether the current duration exceeds a predetermined duration of the predetermined time period, and when the current duration does not exceed the predetermined duration, the access request is directly forwarded to the network server.
  • the start time of the current duration is the time at which the operation information is received, and the end time of the current duration is the time at which the access request is intercepted; or
  • the intermediate proxy node forwards the access request directly to the web server.
  • step 209 the process of detecting whether the intermediate proxy node needs to process the access request is described in detail in step 209, and details are not described herein.
  • Step 411 When the operation information is generated by the user agent triggering the processing option, the intermediate agent node reads the access request recorded after the interception, processes the access request and forwards the request to the network server, and the permission processing option indicates that the middle is allowed.
  • the proxy node processes the access request.
  • the allowable processing option is the "Allow" setting option in the above example.
  • the intermediate agent node may set the input box in the predetermined webpage to an inputtable state, and the user may input the web server's web address or the object in the web server in the input box.
  • the URI the user agent generates an access request carrying the URL of the network locator or the URI of the object, and sends the access request to the intermediate proxy node, and the intermediate proxy node processes the access request and forwards the request to the network server.
  • the user agent may display a shortcut key in the predetermined webpage.
  • the intermediate proxy node reads the access request recorded before the interception. For this The access request is processed and forwarded to the web server.
  • the intermediate proxy node needs to continue to access the network server by default, and directly reads the access request recorded after intercepting the access request, and processes the access request and forwards the request to the access request.
  • Network Server may display a shortcut key in the predetermined webpage.
  • the intermediate proxy node before the intermediate proxy node sends the access request to the network server, it also needs to establish a connection with the network server, and the connection may be an unencrypted connection or an encrypted connection.
  • the process of establishing a connection between the intermediate proxy node and the network server is an existing process, and is not described herein.
  • the network server sends the service data to the intermediate proxy node, and the intermediate proxy node determines whether to process the service data according to whether the access request corresponding to the service data is processed. If the intermediate proxy node processes the access request corresponding to the service data, the intermediate proxy node processes the service data and forwards the service data to the user agent; if the intermediate proxy node does not process the access request corresponding to the service data, The intermediate proxy node does not process the service data, and directly forwards the service data to the user agent.
  • the webpage may further include a URI of the object, and the intermediate proxy node further needs to add a proxy indication to the URI of the object, and the proxy indicates an intermediate proxy node for indicating the transit service.
  • the proxy indication may be the URL of the intermediate proxy node www.portal.com.
  • the service processing method provided by the embodiment of the present invention provides a predetermined webpage by providing a user webpage, the predetermined webpage including a setting option of processing an access request through an intermediate proxy node, and receiving a user agent triggering prohibition processing option.
  • the operation information is intercepted, the access request sent by the user agent to the network server is intercepted, and the access request is directly forwarded to the network server, and the access request is not processed when the user agent selects that the intermediate proxy node does not need to process the access request, directly Forwarding the access request to the network server solves the problem that the intermediate agent node needs to process the received information every time and occupy more resources, thereby achieving the effect of saving resources.
  • the access request is processed and then forwarded to the network server, and the user does not need to input the web server URL again in the input box to generate an access request, thereby simplifying access to the network server. Operation improves the efficiency of access to the web server.
  • the following takes the user agent and the intermediate proxy node to establish an encrypted connection, and the intermediate proxy node and the network server establish an encrypted connection as an example to describe the flow of the service processing method. Please refer to the application flow chart of the first service processing method shown in FIG. 5.
  • the intermediate proxy node is a portal
  • the user proxy is a UA
  • the network server is an OTT server.
  • the portal intercepts the TCP connection request sent by the UA to the OTT server, and replaces the OTT server with the UA to establish a TCP connection (port 443) according to the information in the TCP connection request.
  • Step 502 The Portal uses a TLS handshake process between the digital certificate corresponding to the OTT server and the UA.
  • step 503 the Portal intercepts the encrypted GET request sent by the UA to the OTT server.
  • the GET request is an access request.
  • Step 504 The Portal sends the encrypted redirect response message to the UA and/or the encrypted type information that needs to be accessed through the HTTPS protocol.
  • the HTTPS protocol is the lower layer HTTP protocol using the SSL/TLS protocol.
  • Step 505 A TCP connection (443 port) is established between the UA and the Portal. After the TCP connection is established, the TLS handshake process between the UA and the Portal.
  • the Portal provides the Portal's own digital certificate.
  • step 506 the UA sends an encrypted GET request to the Portal.
  • the GET request includes www.portal.com, and the GET request is a webpage acquisition request.
  • Step 507 After the Portal decrypts the GET request, the Portal replies with the encrypted 200ok response and the scheduled webpage to the UA.
  • the predetermined webpage is a webpage of www.portal.com, and the predetermined webpage includes setting options for processing a GET request through the portal.
  • Step 508 the UA triggers the setting option.
  • the UA triggers the allow processing option the "go to” option is displayed in the predetermined webpage, the UA triggers the "go to” option again, and step 509 is performed; when the UA triggers the "predetermined time” When the prohibition processing option is prohibited in the segment, step 522 is performed.
  • step 509 the Portal reads the GET request recorded after the interception.
  • Portal parses www.ottserver.com from the GET request.
  • a TCP connection (port 443) is established between the Portal and the OTT server.
  • Step 511 a TLS handshake process between the Portal and the OTT server.
  • step 512 the Portal sends an encrypted GET request to the OTT server.
  • the GET request includes www.ottserver.com.
  • step 513 the OTT Server returns the encrypted 200ok response and the webpage to the Portal.
  • the webpage is the webpage of www.ottserver.com.
  • step 514 after the Portal decrypts the 200ok response, the Portal adds a portal indication to the 200ok response.
  • step 515 the Portal sends an encrypted 200ok response to the UA.
  • step 516 the UA sends an encrypted GET request to the Portal.
  • step 517 after the Portal decrypts the GET request, the GET request is parsed.
  • Portal parses www.ottserver.com/picture1.gif from the GET request.
  • Step 518 the Portal sends an encrypted GET request to the OTT server.
  • the GET request includes www.ottserver.com/picture1.gif.
  • step 519 the OTT server returns an encrypted 200ok response to the Portal, and returns a picture 1.
  • step 520 after the Portal decrypts the 200ok response, the Portal adds a portal indication to the 200ok response.
  • the portal indication added by Portal is: www.portal.com.
  • step 521 the Portal sends an encrypted 200ok response to the UA, and the process ends.
  • Step 522 The UA sends the encrypted operation information to the Portal, and disconnects the TCP connection with the Portal. At this time, the Portal starts the timer.
  • the portal intercepts the TCP connection request sent by the UA to the OTT server again, and replaces the OTT server with the UA to establish a TCP connection (port 443) according to the information in the TCP connection request.
  • Step 524 The Portal uses a TLS handshake process between the digital certificate corresponding to the OTT server and the UA.
  • step 525 the Portal intercepts the encrypted GET request sent by the UA to the OTT server.
  • the GET request is an access request.
  • Step 526 The Portal detects whether the current duration exceeds a predetermined duration of the timer, and sends an encrypted GET request to the OTT server when the current duration does not exceed the predetermined duration.
  • the GET request includes www.ottserver.com.
  • step 527 the OTT server returns the encrypted 200ok response and the webpage to the Portal.
  • the webpage is the webpage of www.ottserver.com.
  • step 528 after the Portal decrypts the 200ok response, the Portal sends an encrypted 200ok response to the UA.
  • FIG. 6 is a schematic structural diagram of a service processing apparatus according to an embodiment of the present invention.
  • the service processing device is used in an intermediate proxy node, and may include:
  • the request intercepting module 610 is configured to intercept an access request sent by the user agent to the network server;
  • the webpage providing module 620 is configured to establish a connection with the user agent according to the access request intercepted by the request intercepting module 610, and provide a predetermined webpage to the user agent on the connection, where the predetermined webpage includes a setting option of processing the access request through the intermediate proxy node;
  • the information receiving module 630 is configured to receive operation information triggered by the user agent according to the setting option;
  • the first processing module 640 is configured to: when the operation information received by the information receiving module 630 is generated by the user agent triggering the prohibition processing option, intercept the access request sent by the user agent to the network server again, and forward the access request to the network server directly, prohibiting The processing option indicates that the intermediate proxy node is prohibited from processing the access request.
  • the service processing apparatus provides a predetermined webpage by providing a user webpage, and the predetermined webpage includes a setting option of processing an access request through an intermediate proxy node, and is generated when a user agent trigger prohibition processing option is received.
  • the operation information is intercepted, the access request sent by the user agent to the network server is intercepted, and the access request is directly forwarded to the network server, and the access request is not processed when the user agent selects that the intermediate proxy node does not need to process the access request, directly Forwarding the access request to the network server solves the problem that the intermediate agent node needs to process the received information every time and occupy more resources, thereby achieving the effect of saving resources.
  • FIG. 7 is a schematic structural diagram of still another service processing apparatus according to an embodiment of the present invention.
  • the service processing device is used in an intermediate proxy node, and may include:
  • the request intercepting module 710 is configured to intercept an access request sent by the user agent to the network server;
  • the webpage providing module 720 is configured to establish a connection with the user agent according to the access request intercepted by the request intercepting module 710, and provide a predetermined webpage to the user agent on the connection, where the predetermined webpage includes a setting option of processing the access request through the intermediate proxy node;
  • the information receiving module 730 is configured to receive operation information triggered by the user agent according to the setting option
  • the first processing module 740 is configured to: when the operation information received by the information receiving module 730 is generated by the user agent triggering the prohibition processing option, intercept the access request sent by the user agent to the network server again, and forward the access request directly to the network server, prohibiting The processing option indicates that the intermediate proxy node is prohibited from processing the access request.
  • the first processing module 740 includes:
  • the type obtaining unit 741 is configured to acquire a prohibited type of the operation information, and the prohibition type is one of the prohibition, the prohibition within the predetermined time period, and the permanent prohibition;
  • the first processing unit 742 is configured to detect, when the prohibition type acquired by the type obtaining unit 741 is the current prohibition, whether to intercept the access request for the first time after receiving the operation information, and when intercepting the access request for the first time after receiving the operation information, The access request is forwarded directly to the web server; or,
  • the second processing unit 743 is configured to: when the forbidden type acquired by the type obtaining unit 741 is forbidden within a predetermined time period, acquire the current duration, and detect whether the current duration exceeds a predetermined duration of the predetermined time period, when the current duration does not exceed the predetermined duration Forwarding the access request to the network server directly, the current time duration is the time when the operation information is received, and the current time duration end time is the time when the access request is intercepted; or
  • the third processing unit 744 is configured to directly forward the access request to the network server when the forbidden type acquired by the type obtaining unit 741 is permanently prohibited.
  • the device further includes:
  • the second processing module 750 is configured to: when the operation information received by the information receiving module 730 is triggered by the user agent, the access request recorded after the interception is read, and the access request is processed and then forwarded to the network server, Allow processing options means that the intermediate proxy node is allowed to process access requests.
  • the information receiving module 730 includes:
  • the first receiving unit 731 is configured to receive operation information sent by the user agent through the application layer; or
  • the second receiving unit 732 is configured to receive the response data packet sent by the user agent, and read the operation information from a predetermined field in the header field of the response data packet.
  • the request intercepting module 710 includes:
  • the first intercepting unit 711 is configured to intercept a transmission control protocol TCP connection request sent by the user agent to the network server;
  • the first connection establishing unit 712 is configured to read information in the TCP connection request intercepted by the first intercepting unit 711, and establish a TCP connection with the user agent according to the information replacement network server;
  • the second intercepting unit 713 is configured to intercept, on the TCP connection established by the first connection establishing unit 712, an access request sent by the user agent to the network server.
  • the webpage providing module 720 includes:
  • the first sending unit 721 is configured to send first indication information to the user agent on the TCP connection, where the first indication information is used to instruct the user agent to send a connection establishment request to the intermediate proxy node;
  • a second connection establishing unit 722 configured to establish a connection with the user agent according to the connection establishment request
  • the third receiving unit 723 is configured to receive, by using the connection established by the second connection establishing unit 722, a webpage obtaining request sent by the user agent, where the webpage obtaining request is used to request the predetermined webpage;
  • the first providing unit 724 is configured to provide a predetermined webpage to the user agent according to the webpage obtaining request.
  • the request intercepting module 710 includes:
  • the third intercepting unit 714 is configured to intercept a TCP connection request sent by the user agent to the network server;
  • the third connection establishing unit 715 is configured to read information in the TCP connection request intercepted by the third intercepting unit 714, and establish a TCP connection with the user agent according to the information replacement network server;
  • a fourth connection establishing unit 716 configured to establish a proxy connection with the user agent by using a pre-stored digital certificate corresponding to the network server after the establishment of the TCP connection established by the third connection establishing unit 715 is completed;
  • the fourth intercepting unit 717 is configured to intercept, on the proxy connection established by the fourth connection establishing unit 716, the access request sent by the user agent to the network server.
  • the webpage providing module 720 includes:
  • a second sending unit 725 configured to send second indication information to the user agent on the proxy connection, where the second indication information is used to instruct the user agent to send a connection establishment request to the intermediate proxy node;
  • a fifth connection establishing unit 726 configured to establish a connection with the user agent according to the connection establishment request
  • the fourth receiving unit 727 is configured to receive, by using the connection established by the fifth connection establishing unit 726, a webpage obtaining request sent by the user agent, where the webpage obtaining request is used to request the predetermined webpage;
  • the second providing unit 728 is configured to provide a predetermined webpage to the user agent according to the webpage obtaining request.
  • connection establishing unit 716 is specifically configured to:
  • the first digital certificate is a digital certificate issued by the certificate authority and corresponding to the network server
  • the second digital certificate of the certificate authority is pre-configured in the user agent or the terminal with the user agent installed
  • the user agent is configured to verify the first digital certificate according to the second digital certificate, and after the verification is passed, establish a proxy connection with the intermediate proxy node;
  • the third digital certificate is a digital certificate issued by an unauthorized certificate authority and corresponding to the network server
  • the fourth digital certificate is a digital certificate of the non-authorized certificate authority to enable the user
  • the agent verifies the third digital certificate according to the fourth digital certificate, and establishes a proxy connection with the intermediate proxy node after the verification is passed.
  • the service processing apparatus provides a predetermined webpage by providing a user web proxy, and the predetermined webpage includes a setting option of processing an access request through an intermediate proxy node, and is connected.
  • Receiving the operation information generated by the user agent triggering the prohibition processing option intercepting the access request sent by the user agent to the network server again, and forwarding the access request to the network server directly, and the user agent may select the intermediate agent node to process the access request.
  • the access request is directly forwarded to the network server, which solves the problem that the intermediate proxy node needs to process the received information every time and occupy more resources, thereby achieving the effect of saving resources.
  • the access request is processed and then forwarded to the network server, and the user does not need to input the web server URL again in the input box to generate an access request, thereby simplifying access to the network server. Operation improves the efficiency of access to the web server.
  • FIG. 8 is a schematic structural diagram of a service processing apparatus according to an embodiment of the present invention.
  • the service processing apparatus may include a bus 801, and a processor 802, a memory 803, a transmitter 804, and a receiver 805 connected to the bus.
  • the memory 803 is configured to store a number of instructions that are configured to be executed by the processor 802:
  • a receiver 805, configured to intercept an access request sent by the user agent to the network server;
  • the processor 802 is configured to establish a connection with the user agent according to the access request intercepted by the receiver 805, and provide a predetermined webpage to the user agent on the connection, where the predetermined webpage includes a setting option of processing the access request through the intermediate proxy node;
  • the receiver 805 is further configured to receive operation information triggered by the user agent according to the setting option; when the operation information is generated by the user agent triggering the prohibition processing option, intercepting the access request sent by the user agent to the network server again, the prohibition processing option indicates prohibition
  • the intermediate proxy node processes the access request;
  • the transmitter 804 is configured to forward the access request directly to the network server.
  • the service processing apparatus provides a predetermined webpage by providing a user webpage, and the predetermined webpage includes a setting option of processing an access request through an intermediate proxy node, and is generated when a user agent trigger prohibition processing option is received.
  • the operation information is intercepted, the access request sent by the user agent to the network server is intercepted, and the access request is directly forwarded to the network server, and the access request is not processed when the user agent selects that the intermediate proxy node does not need to process the access request, directly Forwarding the access request to the network server solves the problem that the intermediate agent node needs to process the received information every time and occupy more resources, thereby achieving the effect of saving resources.
  • the embodiment of the present invention further provides a service processing apparatus, where the service processing apparatus is used in an intermediate proxy node, and may include: a bus 801, and a processor 802, a memory 803, and a connection connected to the bus.
  • the memory 803 is configured to store a number of instructions that are configured to be executed by the processor 802:
  • a receiver 805, configured to intercept an access request sent by the user agent to the network server;
  • the processor 802 is configured to establish a connection with the user agent according to the access request intercepted by the receiver 805, and provide a predetermined webpage to the user agent on the connection, where the predetermined webpage includes a setting option of processing the access request through the intermediate proxy node;
  • the receiver 805 is further configured to receive operation information triggered by the user agent according to the setting option; when the operation information is generated by the user agent triggering the prohibition processing option, intercepting the access request sent by the user agent to the network server again, the prohibition processing option indicates prohibition
  • the intermediate proxy node processes the access request;
  • the transmitter 804 is configured to forward the access request directly to the network server.
  • the processor 802 is further configured to acquire a prohibited type of operation information, and prohibit the type from being prohibited, one of a predetermined period of time, and one of a permanent prohibition;
  • the processor 802 is further configured to: when the forbidden type is the current prohibition, detect whether the access request is intercepted for the first time after receiving the operation information, and the transmitter 804 is further configured to: when the processor 802 detects that the operation information is received, the first interception is performed. When accessing a request, forward the access request directly to the web server; or,
  • the processor 802 is further configured to: when the forbidden type is forbidden for a predetermined period of time, acquire the current duration, and detect whether the current duration exceeds a predetermined duration of the predetermined period of time, the transmitter 804 is further configured to: when the processor 802 detects the current duration When the predetermined duration is not exceeded, the access request is directly forwarded to the network server, and the current time start time is the time when the operation information is received, and the current time end time is the time when the access request is intercepted; or
  • the transmitter 804 is further configured to forward the access request directly to the network server when the forbidden type is permanently disabled.
  • the processor 802 is further configured to: when the operation information is triggered by the user agent to enable the processing option, read the access request recorded after the interception;
  • the transmitter 804 is further configured to forward the access request to the network server after the processor 802 processes the access request, allowing the processing option to allow the intermediate proxy node to process the access request.
  • the receiver 805 is specifically configured to receive operation information sent by the user agent through the application layer; or receive the response data packet sent by the user agent, and read the operation information from a predetermined field in the header field of the response data packet.
  • the receiver 805 is further configured to intercept a transmission control protocol TCP connection request sent by the user agent to the network server;
  • the processor 802 is further configured to read information in the TCP connection request intercepted by the receiver 805, and establish a TCP connection with the user agent according to the information replacement network server;
  • the transmitter 804 is further configured to intercept, on the TCP connection established by the processor 802, an access request sent by the user agent to the network server.
  • the transmitter 804 is further configured to send the first indication information to the user agent on the TCP connection, where the first indication information is used to instruct the user agent to send a connection establishment request to the intermediate proxy node;
  • the processor 802 is further configured to establish a connection with the user agent according to the connection establishment request;
  • the receiver 805 is further configured to receive, by using the connection established by the processor 802, a webpage obtaining request sent by the user agent, where the webpage obtaining request is used to request the predetermined webpage;
  • the processor 802 is further configured to provide a predetermined webpage to the user agent according to the webpage obtaining request.
  • the receiver 805 is further configured to intercept a TCP connection request sent by the user agent to the network server.
  • the processor 802 is further configured to read information in the TCP connection request intercepted by the receiver 805, establish a TCP connection with the user agent according to the information replacement network server, and use the pre-stored digital certificate corresponding to the network server after the TCP connection is established. Establish a proxy connection with the user agent;
  • the receiver 805 is further configured to intercept, on the proxy connection established by the processor 802, an access request sent by the user agent to the network server.
  • the transmitter 804 is further configured to send the second indication information to the user agent on the proxy connection, where the second indication information is used to instruct the user agent to send the connection establishment request to the intermediate proxy node;
  • the processor 802 is further configured to establish a connection with the user agent according to the connection establishment request;
  • the receiver 805 is further configured to receive, by using the connection established by the processor 802, a webpage obtaining request sent by the user agent, where the webpage obtaining request is used to request the predetermined webpage;
  • the processor 802 is further configured to provide a predetermined webpage to the user agent according to the webpage obtaining request.
  • the transmitter 804 is further configured to send the first digital certificate to the user agent, where the first digital certificate is a digital certificate issued by the certificate authority and corresponding to the network server, and the second digital certificate of the certificate authority is pre-configured in the In the operating system of the user agent or the terminal in which the user agent is installed, so that the user agent verifies the first digital certificate according to the second digital certificate, and establishes a proxy connection with the intermediate agent node after the verification is passed; or
  • the transmitter 804 is further configured to send a third digital certificate and a fourth digital certificate to the user agent, where the third digital certificate is a digital certificate issued by an unauthorized certificate authority and corresponding to the network server, and the fourth digital certificate is an unauthorized certificate authority Digital certificate to enable user agent based on fourth digital certificate
  • the third digital certificate is verified, and after the verification is passed, a proxy connection is established with the intermediate proxy node.
  • the service processing apparatus provides a predetermined webpage by providing a user webpage, and the predetermined webpage includes a setting option of processing an access request through an intermediate proxy node, and is generated when a user agent trigger prohibition processing option is received.
  • the operation information is intercepted, the access request sent by the user agent to the network server is intercepted, and the access request is directly forwarded to the network server, and the access request is not processed when the user agent selects that the intermediate proxy node does not need to process the access request, directly Forwarding the access request to the network server solves the problem that the intermediate agent node needs to process the received information every time and occupy more resources, thereby achieving the effect of saving resources.
  • the access request is processed and then forwarded to the network server, and the user does not need to input the web server URL again in the input box to generate an access request, thereby simplifying access to the network server. Operation improves the efficiency of access to the web server.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit may be only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined. Or can be integrated into another system System, or some features can be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product.
  • the technical solution of the present invention which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including
  • the instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Signal Processing (AREA)
  • Software Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Artificial Intelligence (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Data Mining & Analysis (AREA)
  • Evolutionary Computation (AREA)
  • Medical Informatics (AREA)
  • Information Transfer Between Computers (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明公开了一种业务处理方法及装置，涉及通信领域，所述方法包括：中间代理节点与用户代理建立连接，并在连接上向用户代理提供预定网页，预定网页包括是否通过中间代理节点处理访问请求的设置选项；中间代理节点接收用户代理根据设置选项所触发的操作信息；当操作信息由用户代理触发禁止处理选项所产生时，中间代理节点截获用户代理再次向网络服务器发送的访问请求，将访问请求直接转发给网络服务器。本发明解决了中间代理节点每次都需要对接收到的信息进行处理，占用较多资源的问题，达到了节省资源的效果。

Description

业务处理方法及装置 技术领域
本发明涉及通信领域，特别涉及一种业务处理方法及装置。
背景技术
中间代理节点是一种门户网站站点。通常，中间代理节点只提供一项搜索服务，即，中间代理节点的网页只包含一个输入框，用户可以在输入框中输入所要访问的网站的网址，由中间代理节点将该网址发送给网站，并将网站返回的业务数据发送给用户。其中，中间代理节点可以是Portal。
在中间代理节点存在的场景下，相关技术提供的一种业务处理方法包括：中间代理节点与用户代理(英文：user agent；简称：UA)建立连接，并将中间代理节点的网页提供给用户代理，该网页只包含用于提供搜索服务的输入框；当用户代理在该输入框中输入网址时，中间代理节点根据该网址与网络服务器建立连接，对该网址进行处理后转发给网络服务器；网络服务器生成业务数据发送给中间代理节点；中间代理节点对该业务数据进行处理后发送给用户代理。
中间代理节点每次都需要对接收到的信息进行处理，处理过程占用了中间代理节点较多的资源。
发明内容
为了解决中间代理节点每次都需要对接收到的信息进行处理，占用较多资源的问题，本发明实施例提供了一种业务处理方法及装置。所述技术方案如下：
第一方面，提供了一种业务处理方法，所述方法包括：
中间代理节点截获用户代理向网络服务器发送的访问请求；
所述中间代理节点根据所述访问请求与所述用户代理建立连接，并在所述连接上向所述用户代理提供预定网页，所述预定网页包括是否通过所述中间代理节点处理所述访问请求的设置选项；
所述中间代理节点接收所述用户代理根据所述设置选项所触发的操作信 息；
当所述操作信息由所述用户代理触发禁止处理选项所产生时，所述中间代理节点截获所述用户代理再次向所述网络服务器发送的访问请求，将所述访问请求直接转发给所述网络服务器，所述禁止处理选项表示禁止所述中间代理节点处理所述访问请求。
在第一方面的第一种可能的实现方式中，所述将所述访问请求直接转发给所述网络服务器，包括：
所述中间代理节点获取所述操作信息的禁止类型，所述禁止类型为本次禁止、预定时间段内禁止和永久禁止中的一种；
当所述禁止类型是本次禁止时，所述中间代理节点检测是否在接收到所述操作信息后首次截获所述访问请求，当在接收到所述操作信息后首次截获所述访问请求时，将所述访问请求直接转发给所述网络服务器；或者，
当所述禁止类型是预定时间段内禁止时，所述中间代理节点获取当前时长，并检测所述当时时长是否超过所述预定时间段的预定时长，当所述当前时长未超过所述预定时长时，将所述访问请求直接转发给所述网络服务器，所述当前时长的开始时刻是接收到所述操作信息的时刻，所述当前时长的结束时刻是本次截获所述访问请求的时刻；或者，
当所述禁止类型是永久禁止时，所述中间代理节点将所述访问请求直接转发给所述网络服务器。
结合第一方面或第一方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，所述方法，还包括：
当所述操作信息由所述用户代理触发允许处理选项所产生时，所述中间代理节点读取在截获后所记录的所述访问请求，对所述访问请求进行处理后转发给所述网络服务器，所述允许处理选项表示允许所述中间代理节点处理所述访问请求。
在第一方面的第三种可能的实现方式中，所述中间代理节点接收所述用户代理根据所述设置选项所触发的操作信息，包括：
所述中间代理节点接收所述用户代理通过应用层发送的所述操作信息；或者，
所述中间代理节点接收所述用户代理发送的应答数据包，从所述应答数据包的头域中的预定字段中读取所述操作信息。
结合第一方面或第一方面的第一种可能的实现方式或第一方面的第二种可能的实现方式或第一方面的第三种可能的实现方式，在第一方面的第四种可能的实现方式中，所述中间代理节点截获用户代理向网络服务器发送的访问请求，包括：
所述中间代理节点截获所述用户代理向所述网络服务器发送的传输控制协议TCP连接请求；
所述中间代理节点读取所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接；
所述中间代理节点在所述TCP连接上截获所述用户代理向所述网络服务器发送的所述访问请求。
结合第一方面的第四种可能的实现方式，在第一方面的第五种可能的实现方式中，所述中间代理节点根据所述访问请求与所述用户代理建立连接，并在所述连接上向所述用户代理提供所述预定网页，包括：
所述中间代理节点在所述TCP连接上向所述用户代理发送第一指示信息，所述第一指示信息用于指示所述用户代理向所述中间代理节点发送连接建立请求；
所述中间代理节点根据所述连接建立请求与所述用户代理建立所述连接；
所述中间代理节点在所述连接上接收所述用户代理发送的网页获取请求，所述网页获取请求用于请求所述预定网页；
所述中间代理节点根据所述网页获取请求向所述用户代理提供所述预定网页。
结合第一方面或第一方面的第一种可能的实现方式或第一方面的第二种可能的实现方式或第一方面的第三种可能的实现方式，在第一方面的第六种可能的实现方式中，所述中间代理节点截获用户代理向网络服务器发送的访问请求，包括：
所述中间代理节点截获所述用户代理向所述网络服务器发送的TCP连接请求；
所述中间代理节点读取所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接；
在所述TCP连接建立完成后，所述中间代理节点利用预存的与所述网络服务器对应的数字证书与所述用户代理建立代理连接；
所述中间代理节点在所述代理连接上截获所述用户代理向所述网络服务器发送的所述访问请求。
结合第一方面的第六种可能的实现方式，在第一方面的第七种可能的实现方式中，所述中间代理节点根据所述访问请求与所述用户代理建立连接，并在所述连接上向所述用户代理提供所述预定网页，包括：
所述中间代理节点在所述代理连接上向所述用户代理发送第二指示信息，所述第二指示信息用于指示所述用户代理向所述中间代理节点发送连接建立请求；
所述中间代理节点根据所述连接建立请求与所述用户代理建立所述连接；
所述中间代理节点在所述连接上接收所述用户代理发送的网页获取请求，所述网页获取请求用于请求所述预定网页；
所述中间代理节点根据所述网页获取请求向所述用户代理提供所述预定网页。
结合第一方面的第六种可能的实现方式或第一方面的第七种可能的实现方式，在第一方面的第八种可能的实现方式中，所述中间代理节点利用预存的与所述网络服务器对应的数字证书与所述用户代理建立代理连接，包括：
所述中间代理节点向所述用户代理发送第一数字证书，所述第一数字证书是证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述证书颁发机构的第二数字证书预先配置在所述用户代理中或安装有所述用户代理的终端的操作系统中，以使所述用户代理根据所述第二数字证书验证所述第一数字证书，在验证通过后，与所述中间代理节点建立所述代理连接；或者，
所述中间代理节点向所述用户代理发送第三数字证书和第四数字证书，所述第三数字证书是非授权证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述第四数字证书是所述非授权证书颁发机构的数字证书，以使所述用户代理根据所述第四数字证书验证所述第三数字证书，在验证通过后，与所述中间代理节点建立所述代理连接。
第二方面，提供了一种业务处理装置，用于中间代理节点中，所述装置包括：
请求截获模块，用于截获用户代理向网络服务器发送的访问请求；
网页提供模块，用于根据所述请求截获模块截获的所述访问请求与所述用户代理建立连接，并在所述连接上向所述用户代理提供预定网页，所述预定网 页包括是否通过所述中间代理节点处理所述访问请求的设置选项；
信息接收模块，用于接收所述用户代理根据所述设置选项所触发的操作信息；
第一处理模块，用于当所述信息接收模块接收的所述操作信息由所述用户代理触发禁止处理选项所产生时，截获所述用户代理再次向所述网络服务器发送的访问请求，将所述访问请求直接转发给所述网络服务器，所述禁止处理选项表示禁止所述中间代理节点处理所述访问请求。
在第二方面的第一种可能的实现方式中，所述第一处理模块，包括：
类型获取单元，用于获取所述操作信息的禁止类型，所述禁止类型为本次禁止、预定时间段内禁止和永久禁止中的一种；
第一处理单元，用于当所述类型获取单元获取的所述禁止类型是本次禁止时，检测是否在接收到所述操作信息后首次截获所述访问请求，当在接收到所述操作信息后首次截获所述访问请求时，将所述访问请求直接转发给所述网络服务器；或者，
第二处理单元，用于当所述类型获取单元获取的所述禁止类型是预定时间段内禁止时，获取当前时长，并检测所述当时时长是否超过所述预定时间段的预定时长，当所述当前时长未超过所述预定时长时，将所述访问请求直接转发给所述网络服务器，所述当前时长的开始时刻是接收到所述操作信息的时刻，所述当前时长的结束时刻是本次截获所述访问请求的时刻；或者，
第三处理单元，用于当所述类型获取单元获取的所述禁止类型是永久禁止时，将所述访问请求直接转发给所述网络服务器。
结合第二方面或第二方面的第一种可能的实现方式，在第二方面的第二种可能的实现方式中，所述装置，还包括：
第二处理模块，用于当所述信息接收模块接收的所述操作信息由所述用户代理触发允许处理选项所产生时，读取在截获后所记录的所述访问请求，对所述访问请求进行处理后转发给所述网络服务器，所述允许处理选项表示允许所述中间代理节点处理所述访问请求。
在第二方面的第三种可能的实现方式中，所述信息接收模块，包括：
第一接收单元，用于接收所述用户代理通过应用层发送的所述操作信息；或者，
第二接收单元，用于接收所述用户代理发送的应答数据包，从所述应答数 据包的头域中的预定字段中读取所述操作信息。
结合第二方面或第二方面的第一种可能的实现方式或第二方面的第二种可能的实现方式或第二方面的第三种可能的实现方式，在第二方面的第四种可能的实现方式中，所述请求截获模块，包括：
第一截获单元，用于截获所述用户代理向所述网络服务器发送的传输控制协议TCP连接请求；
第一连接建立单元，用于读取所述第一截获单元截获的所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接；
第二截获单元，用于在所述第一连接建立单元建立的所述TCP连接上截获所述用户代理向所述网络服务器发送的所述访问请求。
结合第二方面的第四种可能的实现方式，在第二方面的第五种可能的实现方式中，所述网页提供模块，包括：
第一发送单元，用于在所述TCP连接上向所述用户代理发送第一指示信息，所述第一指示信息用于指示所述用户代理向所述中间代理节点发送连接建立请求；
第二连接建立单元，用于根据所述连接建立请求与所述用户代理建立所述连接；
第三接收单元，用于在所述第二连接建立单元建立的所述连接上接收所述用户代理发送的网页获取请求，所述网页获取请求用于请求所述预定网页；
第一提供单元，用于根据所述网页获取请求向所述用户代理提供所述预定网页。
结合第二方面或第二方面的第一种可能的实现方式或第二方面的第二种可能的实现方式或第二方面的第三种可能的实现方式，在第二方面的第六种可能的实现方式中，所述请求截获模块，包括：
第三截获单元，用于截获所述用户代理向所述网络服务器发送的TCP连接请求；
第三连接建立单元，用于读取所述第三截获单元截获的所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接；
第四连接建立单元，用于在所述第三连接建立单元建立的所述TCP连接 建立完成后，利用预存的与所述网络服务器对应的数字证书与所述用户代理建立代理连接；
第四截获单元，用于在所述第四连接建立单元建立的所述代理连接上截获所述用户代理向所述网络服务器发送的所述访问请求。
结合第二方面的第六种可能的实现方式，在第二方面的第七种可能的实现方式中，所述网页提供模块，包括：
第二发送单元，用于在所述代理连接上向所述用户代理发送第二指示信息，所述第二指示信息用于指示所述用户代理向所述中间代理节点发送连接建立请求；
第五连接建立单元，用于根据所述连接建立请求与所述用户代理建立所述连接；
第四接收单元，用于在所述第五连接建立单元建立的所述连接上接收所述用户代理发送的网页获取请求，所述网页获取请求用于请求所述预定网页；
第二提供单元，用于根据所述网页获取请求向所述用户代理提供所述预定网页。
结合第二方面的第六种可能的实现方式或第二方面的第七种可能的实现方式，在第二方面的第八种可能的实现方式中，所述第四连接建立单元，具体用于：
向所述用户代理发送第一数字证书，所述第一数字证书是证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述证书颁发机构的第二数字证书预先配置在所述用户代理中或安装有所述用户代理的终端的操作系统中，以使所述用户代理根据所述第二数字证书验证所述第一数字证书，在验证通过后，与所述中间代理节点建立所述代理连接；或者，
向所述用户代理发送第三数字证书和第四数字证书，所述第三数字证书是非授权证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述第四数字证书是所述非授权证书颁发机构的数字证书，以使所述用户代理根据所述第四数字证书验证所述第三数字证书，在验证通过后，与所述中间代理节点建立所述代理连接。
第三方面，提供了一种业务处理装置，用于中间代理节点中，所述装置包括：总线，以及连接到所述总线的处理器、存储器、发射器和接收器。其中，所述存储器用于存储若干个指令，所述指令被配置成由所述处理器执行；
所述接收器，用于截获用户代理向网络服务器发送的访问请求；
所述处理器，用于根据所述接收器截获的所述访问请求与所述用户代理建立连接，并在所述连接上向所述用户代理提供预定网页，所述预定网页包括是否通过所述中间代理节点处理所述访问请求的设置选项；
所述接收器，还用于接收所述用户代理根据所述设置选项所触发的操作信息；当所述操作信息由所述用户代理触发禁止处理选项所产生时，截获所述用户代理再次向所述网络服务器发送的访问请求，所述禁止处理选项表示禁止所述中间代理节点处理所述访问请求；
所述发射器，用于将所述访问请求直接转发给所述网络服务器。
在第三方面的第一种可能的实现方式中，
所述处理器，还用于获取所述操作信息的禁止类型，所述禁止类型为本次禁止、预定时间段内禁止和永久禁止中的一种；
所述处理器，还用于当所述禁止类型是本次禁止时，检测是否在接收到所述操作信息后首次截获所述访问请求，所述发射器，还用于当所述处理器检测出在接收到所述操作信息后首次截获所述访问请求时，将所述访问请求直接转发给所述网络服务器；或者，
所述处理器，还用于当所述禁止类型是预定时间段内禁止时，获取当前时长，并检测所述当时时长是否超过所述预定时间段的预定时长，所述发射器，还用于当所述处理器检测出所述当前时长未超过所述预定时长时，将所述访问请求直接转发给所述网络服务器，所述当前时长的开始时刻是接收到所述操作信息的时刻，所述当前时长的结束时刻是本次截获所述访问请求的时刻；或者，
所述发射器，还用于当所述禁止类型是永久禁止时，将所述访问请求直接转发给所述网络服务器。
结合第三方面或第三方面的第一种可能的实现方式，在第三方面的第二种可能的实现方式中，
所述处理器，还用于当所述操作信息由所述用户代理触发允许处理选项所产生时，读取在截获后所记录的所述访问请求；
所述发射器，还用于在所述处理器对所述访问请求进行处理后转发给所述网络服务器，所述允许处理选项表示允许所述中间代理节点处理所述访问请求。
在第三方面的第三种可能的实现方式中，所述接收器，具体用于接收所述 用户代理通过应用层发送的所述操作信息；或者，接收所述用户代理发送的应答数据包，从所述应答数据包的头域中的预定字段中读取所述操作信息。
结合第三方面或第三方面的第一种可能的实现方式或第三方面的第二种可能的实现方式或第三方面的第三种可能的实现方式，在第三方面的第四种可能的实现方式中，
所述接收器，还用于截获所述用户代理向所述网络服务器发送的传输控制协议TCP连接请求；
所述处理器，还用于读取所述接收器截获的所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接；
所述发射器，还用于在所述处理器建立的所述TCP连接上截获所述用户代理向所述网络服务器发送的所述访问请求。
结合第三方面的第四种可能的实现方式，在第三方面的第五种可能的实现方式中，
所述发射器，还用于在所述TCP连接上向所述用户代理发送第一指示信息，所述第一指示信息用于指示所述用户代理向所述中间代理节点发送连接建立请求；
所述处理器，还用于根据所述连接建立请求与所述用户代理建立所述连接；
所述接收器，还用于在所述处理器建立的所述连接上接收所述用户代理发送的网页获取请求，所述网页获取请求用于请求所述预定网页；
所述处理器，还用于根据所述网页获取请求向所述用户代理提供所述预定网页。
结合第三方面或第三方面的第一种可能的实现方式或第三方面的第二种可能的实现方式或第三方面的第三种可能的实现方式，在第三方面的第六种可能的实现方式中，
所述接收器，还用于截获所述用户代理向所述网络服务器发送的TCP连接请求；
所述处理器，还用于读取所述接收器截获的所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接；在所述TCP连接建立完成后，利用预存的与所述网络服务器对应的数字证书与所述用户代理建立代理连接；
所述接收器，还用于在所述处理器建立的所述代理连接上截获所述用户代理向所述网络服务器发送的所述访问请求。
结合第三方面的第六种可能的实现方式，在第三方面的第七种可能的实现方式中，
所述发射器，还用于在所述代理连接上向所述用户代理发送第二指示信息，所述第二指示信息用于指示所述用户代理向所述中间代理节点发送连接建立请求；
所述处理器，还用于根据所述连接建立请求与所述用户代理建立所述连接；
所述接收器，还用于在所述处理器建立的所述连接上接收所述用户代理发送的网页获取请求，所述网页获取请求用于请求所述预定网页；
所述处理器，还用于根据所述网页获取请求向所述用户代理提供所述预定网页。
结合第三方面的第六种可能的实现方式或第三方面的第七种可能的实现方式，在第三方面的第八种可能的实现方式中，
所述发射器，还用于向所述用户代理发送第一数字证书，所述第一数字证书是证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述证书颁发机构的第二数字证书预先配置在所述用户代理中或安装有所述用户代理的终端的操作系统中，以使所述用户代理根据所述第二数字证书验证所述第一数字证书，在验证通过后，与所述中间代理节点建立所述代理连接；或者，
所述发射器，还用于向所述用户代理发送第三数字证书和第四数字证书，所述第三数字证书是非授权证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述第四数字证书是所述非授权证书颁发机构的数字证书，以使所述用户代理根据所述第四数字证书验证所述第三数字证书，在验证通过后，与所述中间代理节点建立所述代理连接。
本发明实施例提供的技术方案的有益效果是：
通过向用户代理提供预定网页，该预定网页包括是否通过中间代理节点处理访问请求的设置选项，当接收到用户代理触发禁止处理选项所产生的操作信息时，截获用户代理再次向网络服务器发送的访问请求，将该访问请求直接转发给网络服务器，可以在用户代理选择不需要中间代理节点处理访问请求时，不对该访问请求进行处理，直接将访问请求转发给网络服务器，解决了中间代 理节点每次都需要对接收到的信息进行处理，占用较多资源的问题，达到了节省资源的效果。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施例提供的一种业务处理方法的方法流程图；
图2是本发明实施例提供的又一种业务处理方法的方法流程图；
图3是本发明实施例提供的第一种业务处理方法的应用流程图；
图4A是本发明实施例提供的又一种业务处理方法的方法流程图；
图4B是本发明实施例提供的TLS连接的建立示意图；
图5是本发明实施例提供的第二种业务处理方法的应用流程图；
图6是本发明实施例提供的一种业务处理装置的结构示意图；
图7是本发明实施例提供的又一种业务处理装置的结构示意图；
图8是本发明实施例提供的一种业务处理装置的结构示意图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明实施方式作进一步地详细描述。
请参见图1，其示出了本发明实施例提供的一种业务处理方法的方法流程图。该业务处理方法，可以包括：
步骤101，中间代理节点截获用户代理向网络服务器发送的访问请求。
步骤102，中间代理节点根据访问请求与用户代理建立连接，并在该连接上向用户代理提供预定网页，该预定网页包括是否通过中间代理节点处理访问请求的设置选项。
步骤103，中间代理节点接收用户代理根据设置选项所触发的操作信息。
步骤104，当操作信息由用户代理触发禁止处理选项所产生时，中间代理节点截获用户代理再次向网络服务器发送的访问请求，将该访问请求直接转发 给网络服务器，该禁止处理选项表示禁止中间代理节点处理访问请求。
综上所述，本发明实施例提供的业务处理方法，通过向用户代理提供预定网页，该预定网页包括是否通过中间代理节点处理访问请求的设置选项，当接收到用户代理触发禁止处理选项所产生的操作信息时，截获用户代理再次向网络服务器发送的访问请求，将该访问请求直接转发给网络服务器，可以在用户代理选择不需要中间代理节点处理访问请求时，不对该访问请求进行处理，直接将访问请求转发给网络服务器，解决了中间代理节点每次都需要对接收到的信息进行处理，占用较多资源的问题，达到了节省资源的效果。
请参见图2，其示出了本发明实施例提供的又一种业务处理方法的方法流程图。该业务处理方法，可以包括：
步骤201，中间代理节点截获用户代理向网络服务器发送的TCP(transmission control protocol，传输控制协议)连接请求。
中间代理节点可以是Portal，也可以是其它站点，本实施例不作限定。
若用户代理需要访问网络服务器，需要先与网络服务器建立连接，该连接可以是基于超文本传输协议(英文：hyper text transfer protocol；简称：HTTP)的非加密连接，也可以是基于下层使用了安全套接层(英文：security socket layer；简称：SSL)协议/传输层安全(英文：transport layer security；简称，TLS)协议的超文本传输安全协议(英文：hyper text transfer protocol over secure socket layer；简称：HTTPS)的加密连接，用户代理再通过该连接访问网络服务器。本实施例以用户代理与网络服务器建立非加密的TCP连接为例进行说明，则在用户代理向网络服务器发送TCP连接请求时，中间代理节点可以截获到该TCP连接请求。
步骤202，中间代理节点读取TCP连接请求中的信息，根据该信息顶替网络服务器与用户代理建立TCP连接。
其中，TCP连接的端口包括80端口和443端口，若用户代理需要基于HTTP协议访问网络服务器，则TCP连接的端口为80端口；若用户代理需要基于HTTPS协议访问网络服务器，则TCP连接的端口为443端口。本实施例以用户代理基于HTTP协议访问网络服务器为例进行说明，此时，TCP连接的端口为80端口。
具体地，TCP连接请求中的信息包括源端因特网协议(英文：Internet  Protocol；简称：IP)地址，源端端口，目的端IP地址，目的端端口，源端为用户代理，目的端为网络服务器。中间代理节点利用上述信息顶替网络服务器，与用户代理建立端口是80端口的TCP连接。
步骤203，中间代理节点在TCP连接上截获用户代理向网络服务器发送的访问请求。
其中，访问请求可以具体请求访问网络服务器的主页或网络服务器中的对象。比如，当用户代理需要访问网络服务器的主页，且网络服务器的网址是www.ottserver.com时，访问请求包括www.ottserver.com；当用户代理需要访问网络服务器中的对象，且网络服务器中的对象的统一资源标示符(英文：uniform resource identifier；简称：URI)是www.ottserver.com/picture1.gif时，访问请求包括www.ottserver.com/picture1.gif。
步骤204，中间代理节点在TCP连接上向用户代理发送第一指示信息，该第一指示信息用于指示用户代理向中间代理节点发送连接建立请求。
其中，第一指示信息包括重定向响应消息。
重定向响应消息可以是HTTP Redirection。可选的，重定向响应消息的location头域中可以包括类型信息，该类型信息用于指示用户代理请求建立的连接类型。比如，当重定向响应消息需要指示用户代理建立加密连接时，可以在类型信息中携带HTTPS，HTTPS用于指示HTTPS协议；当重定向响应消息需要指示用户代理建立非加密连接时，可以在类型信息中携带HTTP，HTTP用于指示HTTP协议。本实施例以类型信息中携带HTTP为例进行说明，此时连接建立请求用于请求建立非加密连接，且非加密连接的端口为80端口。
另外，重定向响应消息需要包括中间代理节点的网址，以便用户代理在访问中间代理节点的网址时，向中间代理节点发送连接建立请求。本实施例中，用户代理与中间代理节点之间建立的是TCP连接，此时连接建立请求为TCP连接请求。
步骤205，中间代理节点根据连接建立请求与用户代理建立连接。
具体地，TCP连接请求中的信息包括源端IP地址，源端端口，目的端IP地址，目的端端口，源端为用户代理，目的端为中间代理节点，中间代理节点利用上述信息与用户代理建立端口是80端口的TCP连接。
步骤206，中间代理节点在该连接上接收用户代理发送的网页获取请求，该网页获取请求用于请求预定网页，该预定网页包括是否通过中间代理节点处 理访问请求的设置选项。
用户代理在与中间代理节点建立完TCP连接之后，还需要向中间代理节点发送网页获取请求，该网页获取请求用于请求预定网页，该预定网页可以是中间代理节点的网页。
步骤207，中间代理节点根据网页获取请求向用户代理提供预定网页。
本实施例中，预定网页中包括是否通过中间代理节点处理访问请求的设置选项。在一种可能的实现方式中，预定网页中包括“是否通过中间代理节点处理访问请求”的提示信息，并在该提示信息的下方提供“允许”设置选项和“禁止”设置选项。
可选的，预定网页还可以包括根据用户需求或运营商策略设置的其他内容。比如，预定网页还可以包括诸如热点新闻之类的推送信息、运营商提供的通过中间代理节点处理访问请求的好处、运营商提供的通过中间代理节点处理访问请求的资费信息等等，本实施例不对预定网页所包括的其他内容作限定。
步骤208，中间代理节点接收用户代理根据设置选项所触发的操作信息。
用户代理在显示预定网页后，若用户想要通过中间代理节点处理访问请求，则点击“允许”设置选项，用户代理触发生成操作信息；若用户不想通过中间代理节点处理访问请求，则点击“禁止”设置选项，用户代理触发生成操作信息。
用户代理还需要将操作信息发送给中间代理节点，对应于用户代理发送操作信息的方式，本实施例提供了两种接收操作信息的实现方式，下面分别对这两种实现方式进行介绍：
在第一种实现方式中，中间代理节点接收用户代理通过应用层发送的操作信息。
具体地，用户代理可以将操作信息携带在基于HTTP协议的PUT请求中发送给中间代理节点，或者，用户代理还可以将操作信息携带在基于HTTP协议的其他消息中发送给中间代理节点，本实施例不作限定。
在第二种实现方式中，中间代理节点接收用户代理发送的应答数据包，从应答数据包的头域中的预定字段中读取操作信息。
由于在步骤207中，中间代理节点向用户代理提供了预定网页，因此，用户代理在接收到预定网页之后，需要向中间代理节点发送应答数据包。当用户代理生成操作信息时，用户代理还未向中间代理节点发送应答数据包，则用户 代理可以通过该应答数据包发送操作信息；当用户代理生成操作信息时，用户代理已经向中间代理节点发送过应答数据包，则用户代理可以再生成一个额外的应答数据包，通过该应答数据包发送操作信息。
具体地，用户代理可以在应答数据包的头域中的预定字段中设置操作信息，将设置后的应答数据包发送给中间代理节点，中间代理节点从该预定字段中读取操作信息。其中，预定字段可以是option字段，也可以是其他字段，本实施例不作限定。
步骤209，当操作信息由用户代理触发禁止处理选项所产生时，中间代理节点截获用户代理再次向网络服务器发送的访问请求，将该访问请求直接转发给网络服务器，该禁止处理选项表示禁止中间代理节点处理访问请求。
其中，禁止处理选项即为上述举例中的“禁止”设置选项。
当操作信息由用户代理触发禁止处理选项所产生时，在一种实现方式中，用户代理会自动断开与中间代理节点建立的TCP连接，并再次向网络服务器发送访问请求，中间代理节点截获用户代理再次发送的访问请求，不对该访问请求进行处理，直接将该访问请求转发给网络服务器，从而节省了中间代理节点的资源。其中，中间代理节点截获用户代理发送的访问请求的过程详见步骤201-203的内容，此处不赘述。在另一种实现方式中，用户代理不断开与中间代理节点建立的TCP连接，并再次向网络服务器发送访问请求，中间代理节点在保持的TCP连接上截获用户代理再次发送的访问请求，不对该访问请求进行处理，直接将该访问请求转发给网络服务器，从而节省了中间代理节点的资源。
由于中间代理节点可能会截获其它用户代理发送的或该用户代理向其他网络服务器发送的访问请求，因此，中间代理节点在截获到访问请求后，还需要检测该访问请求是否是该用户代理再次向该网络服务器发送的。具体地，中间代理节点可以读取用户代理再次向网络服务器发送的TCP连接请求中的四元组信息，根据该四元组信息中的源端IP地址，源端端口，目的端IP地址，目的端端口确定该访问请求是否是该用户代理再次向该网络服务器发送的访问请求。
本实施例中，禁止处理选项可以包括“本次禁止”、“预定时间段内禁止”和“永久禁止”。其中，预定时间段的时长可以人为设置或修改，比如，初始设置的预定时间段的时长是一天、一个月等，后续还可以将预定时间段的时长修改 为一周、一年等，本实施例不作限定预定。
由于预定网页中设置了不同的禁止处理选项，因此，中间代理节点在再次截获访问请求后，还要检测是否需要对该访问请求进行处理。具体地，将访问请求直接转发给网络服务器，包括：
1)中间代理节点获取操作信息的禁止类型，该禁止类型为本次禁止、预定时间段内禁止和永久禁止中的一种；
2)当禁止类型是本次禁止时，中间代理节点检测是否在接收到操作信息后首次截获访问请求，当在接收到操作信息后首次截获访问请求时，将访问请求直接转发给网络服务器；或者，
3)当禁止类型是预定时间段内禁止时，中间代理节点获取当前时长，并检测当时时长是否超过预定时间段的预定时长，当当前时长未超过预定时长时，将访问请求直接转发给网络服务器，当前时长的开始时刻是接收到操作信息的时刻，当前时长的结束时刻是本次截获访问请求的时刻；或者，
4)当禁止类型是永久禁止时，中间代理节点将访问请求直接转发给网络服务器。
其中，当操作信息是通过应用层发送的时，可以直接对不同的禁止类型设置不同的操作信息，中间代理节点可以根据读取的是哪种操作信息来确定禁止类型。当操作信息是通过应答数据包发送时，可以对不同的禁止类型设置不同的数值，中间代理节点根据读取到的数值确定禁止类型。
在确定了禁止类型之后，中间代理节点可以按照禁止类型确定对访问请求的处理方式，下面分别根据三种禁止类型介绍对访问请求的处理方式：
1)当禁止类型是本次禁止时，中间代理节点可以检测是否在接收到操作信息后首次截获访问请求，当在接收到操作信息后首次截获访问请求时，中间代理节点不对该访问请求进行处理，直接将该访问请求转发给网络服务器。之后，当用户代理未断开与中间代理节点的连接时，中间代理节点可以直接在该连接上继续截获用户代理向网络服务器发送的访问请求，对该访问请求进行处理后转发给网络服务器，此时的访问请求可以是网络服务器的网址或网络服务器中的对象的URI或业务数据；当用户代理断开与中间代理节点的连接时，中间代理节点执行步骤201。
2)当禁止类型是预定时间段内禁止时，中间代理节点可以将接收到操作信息的时刻作为开始时刻，将本次截获到访问请求的时刻作为结束时刻，得到 当前时长，并获取预定时间段的预定时长；比较当前时长是否小于预定时长，当当前时长小于预定时长时，不对该访问请求进行处理，直接将该访问请求转发给网络服务器；当当前时长大于预定时长时，对该访问请求进行处理后转发给网络服务器。
3)当禁止类型是永久禁止时，中间代理节点可以不对该访问请求进行检测，且不对该访问请求进行处理，直接将该访问请求转发给网络服务器。
步骤210，当操作信息由用户代理触发允许处理选项所产生时，中间代理节点读取在截获后所记录的访问请求，对该访问请求进行处理后转发给网络服务器，该允许处理选项表示允许中间代理节点处理访问请求。
其中，允许处理选项即为上述举例中的“允许”设置选项。
当操作信息由用户代理触发允许处理选项所产生时，中间代理节点可以将预定网页中的输入框设置为可输入状态，用户可以在该输入框中输入网络服务器的网址或网络服务器中的对象的URI，用户代理生成携带网络定位器的网址或对象的URI的访问请求，将该访问请求发送给中间代理节点，中间代理节点对该访问请求进行处理后转发给网络服务器。
由于用户代理需要再次在输入框中输入网络服务器的网址或对象的URI，导致访问网络服务器的操作比较复杂，访问效率较低。本实施例中，当用户代理触发了允许处理选项后，用户代理可以在预定网页中显示快捷键，当用户代理触发该快捷键时，中间代理节点读取之前在截获后所记录的访问请求，对该访问请求进行处理后转发给网络服务器。或者，进一步地，当用户在触发允许处理选项后，中间代理节点默认用户代理需要继续访问网络服务器，直接读取之前在截获访问请求后所记录的访问请求，对该访问请求进行处理后转发给网络服务器。
需要说明的是，在中间代理节点将访问请求转发给网络服务器之前，还需要与网络服务器建立连接，该连接可以是非加密连接，也可以是加密连接。其中，中间代理节点与网络服务器建立连接的过程为现有过程，此处不作赘述。
在中间代理节点将访问请求转发给网络服务器之后，网络服务器会向中间代理节点发送业务数据，中间代理节点根据是否对与该业务数据对应的访问请求进行处理来确定是否对该业务数据进行处理。若中间代理节点对与该业务数据对应的访问请求进行了处理，则中间代理节点对该业务数据进行处理后转发给用户代理；若中间代理节点未对该业务数据对应的访问请求进行处理，则中 间代理节点不对该业务数据进行处理，直接将该业务数据转发给用户代理。
进一步地，当业务数据是网络服务器的网页时，该网页中还可以包括对象的URI，此时中间代理节点还需要对对象的URI添加代理指示，代理指示用于指示中转业务的中间代理节点，可以是中间代理节点的网址。比如，当中间代理节点是portal时，代理指示可以是中间代理节点的网址www.portal.com。
比如，当网页包括图片1的URI时，中间代理节点可以对www.ottserver.com/picture1.gif添加中间代理节点的网址www.portal.com，得到www.portal.com/view？q＝www.ottserver.com/picture1.gif。
综上所述，本发明实施例提供的业务处理方法，通过向用户代理提供预定网页，该预定网页包括是否通过中间代理节点处理访问请求的设置选项，当接收到用户代理触发禁止处理选项所产生的操作信息时，截获用户代理再次向网络服务器发送的访问请求，将该访问请求直接转发给网络服务器，可以在用户代理选择不需要中间代理节点处理访问请求时，不对该访问请求进行处理，直接将访问请求转发给网络服务器，解决了中间代理节点每次都需要对接收到的信息进行处理，占用较多资源的问题，达到了节省资源的效果。
另外，通过读取在截获后所记录的访问请求，对该访问请求进行处理后转发给网络服务器，不需要用户在输入框中再次输入网络服务器的网址来生成访问请求，从而简化访问网络服务器的操作，提高了对网络服务器的访问效率。
下面以用户代理和中间代理节点建立TCP连接、中间代理节点和网络服务器建立加密连接为例，对业务处理方法的流程进行描述。请参考图3所示的第一种业务处理方法的应用流程图，图3以中间代理节点是Portal、用户代理是UA、网络服务器是OTT Server。
步骤301，Portal截获UA向OTT Server发送的TCP连接请求，根据TCP连接请求中的信息顶替OTT Server与UA之间建立TCP连接(80端口)。
步骤302，Portal截获UA向OTT Server发送的GET请求。
其中，GET请求是访问请求。
步骤303，Portal向UA发送重定向响应消息和/或需要通过HTTPS协议访问的类型信息。
其中，HTTPS协议是下层使用了SSL/TLS协议的HTTP协议。
步骤304，UA和Portal之间建立TCP连接(80端口)。
步骤305，UA向Portal发送GET请求。
其中，GET请求包括www.portal.com，且GET请求是网页获取请求。
步骤306，Portal向UA回复200ok响应和预定网页。
其中，预定网页是www.portal.com的网页，且该预定网页包括是否通过Portal处理GET请求的设置选项。
步骤307，UA触发设置选项，当UA触发的是允许处理选项时，在预定网页中显示“go to”选项，UA再触发“go to”选项，执行步骤308；当UA触发的是“预定时间段内禁止”的禁止处理选项时，执行步骤321。
步骤308，Portal读取截获后记录的GET请求。
进一步地，Portal从GET请求解析出www.ottserver.com。
步骤309，Portal和OTT Server之间建立TCP连接(443端口)。
步骤310，Portal和OTT Server之间TLS握手过程。
步骤311，Portal向OTT Server发送加密的GET请求。
其中，GET请求包括www.ottserver.com。
步骤312，OTT Server向Portal回复加密的200ok响应和网页。
其中，该网页为www.ottserver.com的网页。
步骤313，Portal解密200ok响应后，对200ok响应添加portal指示。
其中，Portal添加的portal指示为：www.portal.com。例如www.portal.com/view？q＝www.ottserver.com/picture1.gif。
步骤314，Portal向UA发送200ok响应。
步骤315，UA向Portal发送GET请求。
GET请求包括www.portal.com/view？q＝www.ottserver.com/picture1.gif。
步骤316，Portal解析GET请求。
具体地，Portal从GET请求解析出www.ottserver.com/picture1.gif。
步骤317，Portal向OTT Server发送加密的GET请求。
其中，GET请求包括www.ottserver.com/picture1.gif。
步骤318，OTT Server向Portal回复加密的200ok响应和图片1。
步骤319，Portal解密200ok响应后，对200ok响应添加portal指示。
其中，Portal添加的portal指示为：www.portal.com。
步骤320，Portal向UA发送200ok响应，结束流程。
步骤321，UA向Portal发送操作信息，并断开与Portal之间的TCP连接， 此时Portal启动定时器。
步骤322，Portal截获UA再次向OTT Server发送的TCP连接请求，根据TCP连接请求中的信息顶替OTT Server与UA之间建立TCP连接(80端口)。
步骤323，Portal截获UA向OTT Server发送的GET请求。
其中，GET请求是访问请求。
步骤324，Portal检测当前时长是否超过定时器的预定时长，当当前时长未超过预定时长时，向OTT Server发送加密的GET请求。
其中，GET请求包括www.ottserver.com。
步骤325，OTT Server向Portal回复加密的200ok响应和网页。
其中，该网页为www.ottserver.com的网页。
步骤326，Portal解密200ok响应后，向UA发送200ok响应。
请参见图4A，其示出了本发明实施例提供的又一种业务处理方法的方法流程图。该业务处理方法，可以包括：
步骤401，中间代理节点截获用户代理向网络服务器发送的TCP连接请求。
中间代理节点可以是Portal，也可以是其它站点，本实施例不作限定。
若用户代理需要访问网络服务器，需要先与网络服务器建立连接，该连接可以是基于HTTP的非加密连接，也可以是基于下层使用了SSL协议/TLS协议的HTTPS的加密连接，用户代理再通过该连接访问网络服务器。本实施例以用户代理与网络服务器建立加密连接为例进行说明，由于在建立加密连接之前需要先建立TCP连接，则在用户代理向网络服务器发送TCP连接请求时，中间代理节点可以截获到该TCP连接请求。
步骤402，中间代理节点读取该TCP连接请求中的信息，根据该信息顶替网络服务器与用户代理建立TCP连接。
其中，中间代理节点根据TCP连接请求中的信息与用户代理建立TCP连接的过程详见步骤202中的描述，此处不赘述。其中，TCP连接的端口是443。
步骤403，在TCP连接建立完成后，中间代理节点利用预存的与网络服务器对应的数字证书与用户代理建立代理连接。
由于基于SSL协议的加密连接和基于TLS协议的加密连接的建立过程类似，下文以基于TLS协议的加密连接为例进行说明。请参考图4B所示的TLS连接的建立示意图，其示出了用户代理与中间代理节点建立TLS连接的过程。
步骤401’，用户代理向中间代理节点发送TLS协议版本号、加密算法列表和第一随机数。
步骤402’，若中间代理节点支持该TLS协议版本，则从加密算法列表中选择的一个加密算法，向用户代理发送TLS协议版本号、加密算法、会话标识和第二随机数。
步骤403’，中间代理节点向用户代理发送与网络服务器对应的数字证书。
步骤404’，中间代理节点向用户代理发送第一完成消息。
步骤405’，用户代理对数字证书进行验证，在验证通过后，获取数字证书中的公钥，生成预主密钥，并使用公钥加密预主密钥，向中间代理节点发送得到的公钥交换信息。
步骤406’，用户代理向中间代理节点发送更改密码说明，通知中间代理节点启动协商好的参数。
此时，用户代理根据第一随机数、第二随机数、预主密钥和加密算法生成第一密钥。
步骤407’，用户代理向中间代理节点发送第二完成消息。
步骤408’，中间代理节点向用户代理发送更改密码说明，通知用户代理启动协商好的参数。
此时，中间代理节点使用私钥解密公钥交换信息，得到预主密钥，根据第一随机数、第二随机数、预主密钥和加密算法生成第二密钥。
步骤409’，中间代理节点向用户代理发送第三完成消息。
需要说明的是，中间代理节点在与用户代理建立加密连接之前，还需要获取与网络服务器对应的数字证书和私钥，数字证书至少包括公钥、拥有者名称和证书颁发机构的数字签名，数字签名是指对信息进行哈希运算得到的哈希值，用于验证信息是否被篡改。本实施例中的数字签名用于验证数字证书是否被篡改。
其中，中间代理节点利用预存的与网络服务器对应的数字证书与用户代理建立代理连接，包括：
中间代理节点向用户代理发送第一数字证书，第一数字证书是证书颁发机构颁发的且与网络服务器对应的数字证书，证书颁发机构的第二数字证书预先配置在用户代理中或安装有用户代理的终端的操作系统中，以使用户代理根据第二数字证书验证第一数字证书，在验证通过后，与中间代理节点建立代理连 接；或者，
中间代理节点向用户代理发送第三数字证书和第四数字证书，第三数字证书是非授权证书颁发机构颁发的且与网络服务器对应的数字证书，第四数字证书是非授权证书颁发机构的数字证书，以使用户代理根据第四数字证书验证第三数字证书，在验证通过后，与中间代理节点建立代理连接。
其中，与网络服务器对应的数字证书可以是网络服务器的真实数字证书，也可以是除真实数字证书之外的其他数字证书，该其他数字证书与网络服务器之间存在对应关系。本实施例中，其他数字证书可以是代理数字证书，也可以是假冒的数字证书，具体内容如下所述。
在第一种实现方式中，证书颁发机构可以是授权证书颁发机构，也可以是非授权证书颁发机构。
当证书颁发机构是授权证书颁发机构时，授权证书颁发机构根据安全监控等需要为可信的中间代理节点颁发网络服务器的代理数字证书，该代理数字证书即第一数字证书。其中，授权证书颁发机构可以为每个网络服务器颁发不同的代理数字证书，也可以为多个不同的网络服务器颁发相同的代理数字证书，本实施例不作限定。
其中，网络服务器的代理数字证书也可以是网络服务器的数字证书链上的子证书。该子证书可以由网络服务器颁发，也可以由其他第三方授权证书颁发机构颁发。
本实施例中，代理数字证书可以与授权证书颁发机构为网络服务器颁发的真实数字证书相同，也可以与真实数字证书不同。即，代理数字证书与真实数字证书可以拥有不同的公钥和私钥对。
当证书颁发机构是非授权证书颁发机构时，非授权证书颁发机构为中间代理节点颁发网络服务器的数字证书，此时的数字证书是假冒的数字证书，该假冒的数字证书即第一数字证书。
在用户代理验证数字证书时，会检测该数字证书的证书颁发机构的根证书是否位于可信认证中心(英文：Certificate Authority；简称：CA)列表中，根证书即第二数字证书。若该根证书位于可信CA列表中，则根据该根证书的公钥验证数字证书中的数字签名，若对数字签名的验证成功，则对数字证书的验证成功；若对数字签名的验证失败，则对数字证书的验证失败；若该根证书不在可信CA列表中，则对数字证书的验证失败。
可选的，中间代理节点获取到的与网络服务器对应的数字证书可以是多级证书颁发机构颁发的。比如，中间代理节点获取到的与网络服务器对应的数字证书是中级证书颁发机构Issuer颁发的，中级证书颁发机构Issuer的数字证书是高级证书颁发机构Root CA颁发的。此时，用户代理逐级寻找证书颁发机构的数字证书，检测该数字证书的证书颁发机构的根证书是否位于可信CA列表中，若该根证书位于可信CA列表中，则根据该根证书的公钥验证下级数字证书中的数字签名，若对数字签名的验证成功，则根据下级数字证书的公钥验证下下级数字证书中的数字签名，直至对所有的数字签名验证成功后，对数字证书的验证成功；若对其中一个数字签名的验证失败，则对数字证书的验证失败；若该根证书不在可信CA列表中，则对数字证书的验证失败。
需要说明的是，当证书颁发机构是授权证书颁发机构时，该授权证书颁发机构的根证书预先配置在用户代理中或安装有用户代理的终端的操作系统中，即，该授权证书颁发机构的根证书预先配置在可信CA列表中；当证书颁发机构是非授权证书颁发机构时，还需要将该非授权证书颁发机构的根证书添加到可信CA列表中。
在一种添加方式中，可以与操作系统厂家或用户代理的厂家进行协商，将非授权证书颁发机构的根证书添加到可信CA列表中；在另一种添加方式中，可以提示用户安装非授权证书颁发机构的根证书，通过该非授权证书颁发机构的根证书添加到可信CA列表中。
在第二种实现方式中，中间代理节点可以获取非授权证书颁发机构发送的数字证书链，该数字证书链至少包括非授权证书颁发机构的数字证书，即自签名的根证书，也即第四数字证书，以及网络服务器的假冒的数字证书，中间代理节点将该数字证书链发送给用户代理，该假冒的数字证书即第三数字证书。
在用户代理验证数字证书时，会读取接收到的数字证书链中根证书的公钥，根据该公钥验证假冒的数字证书中的数字签名，若对数字签名的验证成功，则对假冒的数字证书的验证成功；若对数字签名的验证失败，则对假冒的数字证书的验证失败。
可选的，中间代理节点获取到的假冒的数字证书可以是多级非授权证书颁发机构颁发的，即，证书链还包括多级非授权证书颁发机构的数字证书。比如，中间代理节点获取到的与网络服务器对应的数字证书是非授权的中级证书颁发机构Issuer颁发的，非授权的中级证书颁发机构Issuer的数字证书是非授权 的高级证书颁发机构Root CA颁发的。此时，用户代理从接收到的数字证书中逐级寻找非授权的证书颁发机构的数字证书，根据根证书的公钥验证下级数字证书中的数字签名，若对数字签名的验证成功，则根据下级数字证书的公钥验证下下级数字证书中的数字签名，直至对所有的数字签名验证成功后，对数字证书的验证成功；若对其中一个数字签名的验证失败，则对数字证书的验证失败。
步骤404，中间代理节点在代理连接上截获用户代理向网络服务器发送的访问请求。
其中，访问请求可以具体请求访问网络服务器的主页或网络服务器中的对象。比如，当用户代理需要访问网络服务器的主页，且网络服务器的网址是www.ottserver.com时，访问请求包括www.ottserver.com；当用户代理需要访问网络服务器中的对象，且网络服务器中的对象的统一资源标示符(英文：uniform resource identifier；简称：URI)是www.ottserver.com/picture1.gif时，访问请求包括www.ottserver.com/picture1.gif。
步骤405，中间代理节点在代理连接上向用户代理发送第二指示信息，该第二指示信息用于指示用户代理向中间代理节点发送连接建立请求。
其中，第二指示信息包括重定向响应消息。重定向响应消息的内容详见步骤204中的描述，此处不赘述。本实施例以类型信息中携带HTTPS为例进行说明，此时连接建立请求用于请求建立加密连接，且加密连接的端口为443端口。
本实施例中，中间代理节点可以在与用户代理建立代理连接的过程中，与用户代理约定加密密钥和解密密钥。此时，中间代理节点可以使用加密密钥对重定向响应消息进行加密，将加密得到的密文发送给用户代理，用户代理使用解密密钥对密文进行解密后，得到重定向响应消息。用户代理根据重定向响应消息生成连接建立请求，将连接建立请求发送给中间代理节点，中间代理节点得到连接建立请求。
步骤406，中间代理节点根据连接建立请求与用户代理建立连接。
其中，中间代理节点与用户代理建立的连接可以是加密连接，也可以是非加密连接的TCP连接。当该连接是加密连接时，中间代理节点根据连接建立请求与用户代理建立连接，包括：中间代理节点根据连接建立请求与用户代理建立TCP连接；在TCP连接建立完成后，中间代理节点利用中间代理节点的 数字证书与用户代理建立连接。具体地，中间代理节点与用户代理建立TLS连接的流程与图4B所示的流程类似，不同的是，在步骤404’中，中间代理节点向用户代理发送的是中间代理节点的数字证书。
步骤407，中间代理节点在连接上接收用户代理发送的网页获取请求，该网页获取请求用于请求预定网页，该预定网页包括是否通过中间代理节点处理访问请求的设置选项。
用户代理在与中间代理节点建立完TCP连接之后，还需要向中间代理节点发送网页获取请求，该网页获取请求用于请求预定网页，该预定网页可以是中间代理节点的网页。
步骤408，中间代理节点根据网页获取请求向用户代理提供预定网页。
本实施例中，预定网页中包括是否通过中间代理节点处理访问请求的设置选项。在一种可能的实现方式中，预定网页中包括“是否通过中间代理节点处理访问请求”的提示信息，并在该提示信息的下方提供“允许”设置选项和“禁止”设置选项。
可选的，预定网页还可以包括根据用户需求或运营商策略设置的其他内容。比如，预定网页还可以包括诸如热点新闻之类的推送信息、运营商提供的通过中间代理节点处理访问请求的好处、运营商提供的通过中间代理节点处理访问请求的资费信息等等，本实施例不对预定网页所包括的其他内容作限定。
步骤409，中间代理节点接收用户代理根据设置选项所触发的操作信息。
用户代理在显示预定网页后，若用户想要通过中间代理节点处理访问请求，则点击“允许”设置选项，用户代理触发生成操作信息；若用户不想通过中间代理节点处理访问请求，则点击“禁止”设置选项，用户代理触发生成操作信息。
用户代理还需要将操作信息发送给中间代理节点，对应于用户代理发送操作信息的方式，本实施例提供了两种接收操作信息的实现方式，下面分别对这两种实现方式进行介绍：
在第一种实现方式中，中间代理节点接收用户代理通过应用层发送的操作信息。
具体地，用户代理可以将操作信息携带在基于HTTP协议的PUT请求中发送给中间代理节点，或者，用户代理还可以将操作信息携带在基于HTTP协议的其他消息中发送给中间代理节点，本实施例不作限定。
在第二种实现方式中，中间代理节点接收用户代理发送的应答数据包，从应答数据包的头域中的预定字段中读取操作信息。
由于在步骤207中，中间代理节点向用户代理提供了预定网页，因此，用户代理在接收到预定网页之后，需要向中间代理节点发送应答数据包。当用户代理生成操作信息时，用户代理还未向中间代理节点发送应答数据包，则用户代理可以通过该应答数据包发送操作信息；当用户代理生成操作信息时，用户代理已经向中间代理节点发送过应答数据包，则用户代理可以再生成一个额外的应答数据包，通过该应答数据包发送操作信息。
具体地，用户代理可以在应答数据包的头域中的预定字段中设置操作信息，将设置后的应答数据包发送给中间代理节点，中间代理节点从该预定字段中读取操作信息。其中，预定字段可以是option字段，也可以是其他字段，本实施例不作限定。
步骤410，当操作信息由用户代理触发禁止处理选项所产生时，中间代理节点截获用户代理再次向网络服务器发送的访问请求，将该访问请求直接转发给网络服务器，该禁止处理选项表示禁止中间代理节点处理访问请求。
其中，禁止处理选项即为上述举例中的“禁止”设置选项。
当操作信息由用户代理触发禁止处理选项所产生时，用户代理会自动断开与中间代理节点建立的加密连接，并再次向网络服务器发送访问请求，中间代理节点截获用户代理再次发送的访问请求，不对该访问请求进行处理，直接将该访问请求转发给网络服务器，从而节省了中间代理节点的资源。其中，中间代理节点截获用户代理发送的访问请求的过程详见步骤401-404的内容，此处不赘述。
由于中间代理节点可能会截获其它用户代理发送的或该用户代理向其他网络服务器发送的访问请求，因此，中间代理节点在截获到访问请求后，还需要检测该访问请求是否是该用户代理再次向该网络服务器发送的。具体地，中间代理节点可以读取用户代理再次向网络服务器发送的TCP连接请求中的四元组信息，根据该四元组信息中的源端IP地址，源端端口，目的端IP地址，目的端端口确定该访问请求是否是该用户代理再次向该网络服务器发送的访问请求。
本实施例中，禁止处理选项可以包括“本次禁止”、“预定时间段内禁止”和“永久禁止”。其中，预定时间段的时长可以人为设置或修改，比如，初始设置 的预定时间段的时长是一天、一个月等，后续还可以将预定时间段的时长修改为一周、一年等，本实施例不作限定预定。
由于预定网页中设置了不同的禁止处理选项，因此，中间代理节点在再次截获访问请求后，还要检测是否需要对该访问请求进行处理。具体地，将访问请求直接转发给网络服务器，包括：
1)中间代理节点获取操作信息的禁止类型，该禁止类型为本次禁止、预定时间段内禁止和永久禁止中的一种；
2)当禁止类型是本次禁止时，中间代理节点检测是否在接收到操作信息后首次截获访问请求，当在接收到操作信息后首次截获访问请求时，将访问请求直接转发给网络服务器；或者，
3)当禁止类型是预定时间段内禁止时，中间代理节点获取当前时长，并检测当时时长是否超过预定时间段的预定时长，当当前时长未超过预定时长时，将访问请求直接转发给网络服务器，当前时长的开始时刻是接收到操作信息的时刻，当前时长的结束时刻是本次截获访问请求的时刻；或者，
4)当禁止类型是永久禁止时，中间代理节点将访问请求直接转发给网络服务器。
具体地，中间代理节点检测是否需要对该访问请求进行处理的过程详见步骤209中的描述，此处不赘述。
步骤411，当操作信息由用户代理触发允许处理选项所产生时，中间代理节点读取在截获后所记录的访问请求，对该访问请求进行处理后转发给网络服务器，该允许处理选项表示允许中间代理节点处理访问请求。
其中，允许处理选项即为上述举例中的“允许”设置选项。
当操作信息由用户代理触发允许处理选项所产生时，中间代理节点可以将预定网页中的输入框设置为可输入状态，用户可以在该输入框中输入网络服务器的网址或网络服务器中的对象的URI，用户代理生成携带网络定位器的网址或对象的URI的访问请求，将该访问请求发送给中间代理节点，中间代理节点对该访问请求进行处理后转发给网络服务器。
由于用户代理需要再次在输入框中输入网络服务器的网址或对象的URI，导致访问网络服务器的操作比较复杂，访问效率较低。本实施例中，当用户代理触发了允许处理选项后，用户代理可以在预定网页中显示快捷键，当用户代理触发该快捷键时，中间代理节点读取之前在截获后所记录的访问请求，对该 访问请求进行处理后转发给网络服务器。或者，进一步地，当用户在触发允许处理选项后，中间代理节点默认用户代理需要继续访问网络服务器，直接读取之前在截获访问请求后所记录的访问请求，对该访问请求进行处理后转发给网络服务器。
需要说明的是，在中间代理节点将访问请求发送给网络服务器之前，还需要与网络服务器建立连接，该连接可以是非加密连接，也可以是加密连接。其中，中间代理节点与网络服务器建立连接的过程为现有过程，此处不作赘述。
在中间代理节点将访问请求发送给网络服务器之后，网络服务器会向中间代理节点发送业务数据，中间代理节点根据是否对与该业务数据对应的访问请求进行处理来确定是否对该业务数据进行处理。若中间代理节点对与该业务数据对应的访问请求进行了处理，则中间代理节点对该业务数据进行处理后转发给用户代理；若中间代理节点未对该业务数据对应的访问请求进行处理，则中间代理节点不对该业务数据进行处理，直接将该业务数据转发给用户代理。
进一步地，当业务数据是网络服务器的网页时，该网页中还可以包括对象的URI，此时中间代理节点还需要对对象的URI添加代理指示，代理指示用于指示中转业务的中间代理节点，可以是中间代理节点的网址。比如，当中间代理节点是portal时，代理指示可以是中间代理节点的网址www.portal.com。
比如，当网页包括图片1的URI时，中间代理节点可以对www.ottserver.com/picture1.gif添加中间代理节点的网址www.portal.com，得到www.portal.com/view？q＝www.ottserver.com/picture1.gif。
综上所述，本发明实施例提供的业务处理方法，通过向用户代理提供预定网页，该预定网页包括是否通过中间代理节点处理访问请求的设置选项，当接收到用户代理触发禁止处理选项所产生的操作信息时，截获用户代理再次向网络服务器发送的访问请求，将该访问请求直接转发给网络服务器，可以在用户代理选择不需要中间代理节点处理访问请求时，不对该访问请求进行处理，直接将访问请求转发给网络服务器，解决了中间代理节点每次都需要对接收到的信息进行处理，占用较多资源的问题，达到了节省资源的效果。
另外，通过读取在截获后所记录的访问请求，对该访问请求进行处理后转发给网络服务器，不需要用户在输入框中再次输入网络服务器的网址来生成访问请求，从而简化访问网络服务器的操作，提高了对网络服务器的访问效率。
下面以用户代理和中间代理节点建立加密连接、中间代理节点和网络服务器建立加密连接为例，对业务处理方法的流程进行描述。请参考图5所示的第一种业务处理方法的应用流程图，图5以中间代理节点是Portal、用户代理是UA、网络服务器是OTT Server。
步骤501，Portal截获UA向OTT Server发送的TCP连接请求，根据TCP连接请求中的信息顶替OTT Server与UA之间建立TCP连接(443端口)。
步骤502，Portal利用与OTT Server对应的数字证书与UA之间TLS握手过程。
步骤503，Portal截获UA向OTT Server发送的加密的GET请求。
其中，GET请求是访问请求。
步骤504，Portal向UA发送加密后的重定向响应消息和/或需要通过HTTPS协议访问的加密后的类型信息。
其中，HTTPS协议是下层使用了SSL/TLS协议的HTTP协议。
步骤505，UA和Portal之间建立TCP连接(443端口)，TCP连接建立完成后，UA和Portal之间TLS握手过程。
此时Portal提供的是Portal自己的数字证书。
步骤506，UA向Portal发送加密的GET请求。
其中，GET请求包括www.portal.com，且GET请求是网页获取请求。
步骤507，Portal解密GET请求后，向UA回复加密的200ok响应和预定网页。
其中，预定网页是www.portal.com的网页，且该预定网页包括是否通过Portal处理GET请求的设置选项。
步骤508，UA触发设置选项，当UA触发的是允许处理选项时，在预定网页中显示“go to”选项，UA再触发“go to”选项，执行步骤509；当UA触发的是“预定时间段内禁止”的禁止处理选项时，执行步骤522。
步骤509，Portal读取截获后记录的GET请求。
进一步地，Portal从GET请求解析出www.ottserver.com。
步骤510，Portal和OTT Server之间建立TCP连接(443端口)。
步骤511，Portal和OTT Server之间TLS握手过程。
步骤512，Portal向OTT Server发送加密的GET请求。
其中，GET请求包括www.ottserver.com。
步骤513，OTT Server向Portal回复加密的200ok响应和网页。
其中，该网页为www.ottserver.com的网页。
步骤514，Portal解密200ok响应后，对200ok响应添加portal指示。
其中，Portal添加的portal指示为：www.portal.com。例如www.portal.com/view？q＝www.ottserver.com/picture1.gif。
步骤515，Portal向UA发送加密的200ok响应。
步骤516，UA向Portal发送加密的GET请求。
GET请求包括www.portal.com/view？q＝www.ottserver.com/picture1.gif。
步骤517，Portal解密GET请求后，解析GET请求。
具体地，Portal从GET请求解析出www.ottserver.com/picture1.gif。
步骤518，Portal向OTT Server发送加密的GET请求，
其中，GET请求包括www.ottserver.com/picture1.gif。
步骤519，OTT Server向Portal回复加密的200ok响应，返回图片1。
步骤520，Portal解密200ok响应后，对200ok响应添加portal指示。
其中，Portal添加的portal指示为：www.portal.com。
步骤521，Portal向UA发送加密的200ok响应，结束流程。
步骤522，UA向Portal发送加密的操作信息，并断开与Portal之间的TCP连接，此时Portal启动定时器。
步骤523，Portal截获UA再次向OTT Server发送的TCP连接请求，根据TCP连接请求中的信息顶替OTT Server与UA之间建立TCP连接(443端口)。
步骤524，Portal利用与OTT Server对应的数字证书与UA之间TLS握手过程。
步骤525，Portal截获UA向OTT Server发送的加密的GET请求。
其中，GET请求是访问请求。
步骤526，Portal检测当前时长是否超过定时器的预定时长，当当前时长未超过预定时长时，向OTT Server发送加密的GET请求。
其中，GET请求包括www.ottserver.com。
步骤527，OTT Server向Portal回复加密的200ok响应和网页。
其中，该网页为www.ottserver.com的网页。
步骤528，Portal解密200ok响应后，向UA发送加密的200ok响应。
请参考图6，其示出了本发明实施例提供的一种业务处理装置的结构示意图。该业务处理装置用于中间代理节点中，可以包括：
请求截获模块610，用于截获用户代理向网络服务器发送的访问请求；
网页提供模块620，用于根据请求截获模块610截获的访问请求与用户代理建立连接，并在连接上向用户代理提供预定网页，预定网页包括是否通过中间代理节点处理访问请求的设置选项；
信息接收模块630，用于接收用户代理根据设置选项所触发的操作信息；
第一处理模块640，用于当信息接收模块630接收的操作信息由用户代理触发禁止处理选项所产生时，截获用户代理再次向网络服务器发送的访问请求，将访问请求直接转发给网络服务器，禁止处理选项表示禁止中间代理节点处理访问请求。
综上所述，本发明实施例提供的业务处理装置，通过向用户代理提供预定网页，该预定网页包括是否通过中间代理节点处理访问请求的设置选项，当接收到用户代理触发禁止处理选项所产生的操作信息时，截获用户代理再次向网络服务器发送的访问请求，将该访问请求直接转发给网络服务器，可以在用户代理选择不需要中间代理节点处理访问请求时，不对该访问请求进行处理，直接将访问请求转发给网络服务器，解决了中间代理节点每次都需要对接收到的信息进行处理，占用较多资源的问题，达到了节省资源的效果。
请参考图7，其示出了本发明实施例提供的又一种业务处理装置的结构示意图。该业务处理装置用于中间代理节点中，可以包括：
请求截获模块710，用于截获用户代理向网络服务器发送的访问请求；
网页提供模块720，用于根据请求截获模块710截获的访问请求与用户代理建立连接，并在连接上向用户代理提供预定网页，预定网页包括是否通过中间代理节点处理访问请求的设置选项；
信息接收模块730，用于接收用户代理根据设置选项所触发的操作信息；
第一处理模块740，用于当信息接收模块730接收的操作信息由用户代理触发禁止处理选项所产生时，截获用户代理再次向网络服务器发送的访问请求，将访问请求直接转发给网络服务器，禁止处理选项表示禁止中间代理节点处理访问请求。
可选的，第一处理模块740，包括：
类型获取单元741，用于获取操作信息的禁止类型，禁止类型为本次禁止、预定时间段内禁止和永久禁止中的一种；
第一处理单元742，用于当类型获取单元741获取的禁止类型是本次禁止时，检测是否在接收到操作信息后首次截获访问请求，当在接收到操作信息后首次截获访问请求时，将访问请求直接转发给网络服务器；或者，
第二处理单元743，用于当类型获取单元741获取的禁止类型是预定时间段内禁止时，获取当前时长，并检测当时时长是否超过预定时间段的预定时长，当当前时长未超过预定时长时，将访问请求直接转发给网络服务器，当前时长的开始时刻是接收到操作信息的时刻，当前时长的结束时刻是本次截获访问请求的时刻；或者，
第三处理单元744，用于当类型获取单元741获取的禁止类型是永久禁止时，将访问请求直接转发给网络服务器。
可选的，装置，还包括：
第二处理模块750，用于当信息接收模块730接收的操作信息由用户代理触发允许处理选项所产生时，读取在截获后所记录的访问请求，对访问请求进行处理后转发给网络服务器，允许处理选项表示允许中间代理节点处理访问请求。
可选的，信息接收模块730，包括：
第一接收单元731，用于接收用户代理通过应用层发送的操作信息；或者，
第二接收单元732，用于接收用户代理发送的应答数据包，从应答数据包的头域中的预定字段中读取操作信息。
可选的，请求截获模块710，包括：
第一截获单元711，用于截获用户代理向网络服务器发送的传输控制协议TCP连接请求；
第一连接建立单元712，用于读取第一截获单元711截获的TCP连接请求中的信息，根据信息顶替网络服务器与用户代理建立TCP连接；
第二截获单元713，用于在第一连接建立单元712建立的TCP连接上截获用户代理向网络服务器发送的访问请求。
可选的，网页提供模块720，包括：
第一发送单元721，用于在TCP连接上向用户代理发送第一指示信息，第一指示信息用于指示用户代理向中间代理节点发送连接建立请求；
第二连接建立单元722，用于根据连接建立请求与用户代理建立连接；
第三接收单元723，用于在第二连接建立单元722建立的连接上接收用户代理发送的网页获取请求，网页获取请求用于请求预定网页；
第一提供单元724，用于根据网页获取请求向用户代理提供预定网页。
可选的，请求截获模块710，包括：
第三截获单元714，用于截获用户代理向网络服务器发送的TCP连接请求；
第三连接建立单元715，用于读取第三截获单元714截获的TCP连接请求中的信息，根据信息顶替网络服务器与用户代理建立TCP连接；
第四连接建立单元716，用于在第三连接建立单元715建立的TCP连接建立完成后，利用预存的与网络服务器对应的数字证书与用户代理建立代理连接；
第四截获单元717，用于在第四连接建立单元716建立的代理连接上截获用户代理向网络服务器发送的访问请求。
可选的，网页提供模块720，包括：
第二发送单元725，用于在代理连接上向用户代理发送第二指示信息，第二指示信息用于指示用户代理向中间代理节点发送连接建立请求；
第五连接建立单元726，用于根据连接建立请求与用户代理建立连接；
第四接收单元727，用于在第五连接建立单元726建立的连接上接收用户代理发送的网页获取请求，网页获取请求用于请求预定网页；
第二提供单元728，用于根据网页获取请求向用户代理提供预定网页。
可选的，第四连接建立单元716，具体用于：
向用户代理发送第一数字证书，第一数字证书是证书颁发机构颁发的且与网络服务器对应的数字证书，证书颁发机构的第二数字证书预先配置在用户代理中或安装有用户代理的终端的操作系统中，以使用户代理根据第二数字证书验证第一数字证书，在验证通过后，与中间代理节点建立代理连接；或者，
向用户代理发送第三数字证书和第四数字证书，第三数字证书是非授权证书颁发机构颁发的且与网络服务器对应的数字证书，第四数字证书是非授权证书颁发机构的数字证书，以使用户代理根据第四数字证书验证第三数字证书，在验证通过后，与中间代理节点建立代理连接。
综上所述，本发明实施例提供的业务处理装置，通过向用户代理提供预定网页，该预定网页包括是否通过中间代理节点处理访问请求的设置选项，当接 收到用户代理触发禁止处理选项所产生的操作信息时，截获用户代理再次向网络服务器发送的访问请求，将该访问请求直接转发给网络服务器，可以在用户代理选择不需要中间代理节点处理访问请求时，不对该访问请求进行处理，直接将访问请求转发给网络服务器，解决了中间代理节点每次都需要对接收到的信息进行处理，占用较多资源的问题，达到了节省资源的效果。
另外，通过读取在截获后所记录的访问请求，对该访问请求进行处理后转发给网络服务器，不需要用户在输入框中再次输入网络服务器的网址来生成访问请求，从而简化访问网络服务器的操作，提高了对网络服务器的访问效率。
请参考图8，其示出了本发明实施例提供的一种业务处理装置的结构示意图。该业务处理装置，可以包括：总线801，以及连接到总线的处理器802、存储器803、发射器804和接收器805。其中，存储器803用于存储若干个指令，指令被配置成由处理器802执行：
接收器805，用于截获用户代理向网络服务器发送的访问请求；
处理器802，用于根据接收器805截获的访问请求与用户代理建立连接，并在连接上向用户代理提供预定网页，预定网页包括是否通过中间代理节点处理访问请求的设置选项；
接收器805，还用于接收用户代理根据设置选项所触发的操作信息；当操作信息由用户代理触发禁止处理选项所产生时，截获用户代理再次向网络服务器发送的访问请求，禁止处理选项表示禁止中间代理节点处理访问请求；
发射器804，用于将访问请求直接转发给网络服务器。
综上所述，本发明实施例提供的业务处理装置，通过向用户代理提供预定网页，该预定网页包括是否通过中间代理节点处理访问请求的设置选项，当接收到用户代理触发禁止处理选项所产生的操作信息时，截获用户代理再次向网络服务器发送的访问请求，将该访问请求直接转发给网络服务器，可以在用户代理选择不需要中间代理节点处理访问请求时，不对该访问请求进行处理，直接将访问请求转发给网络服务器，解决了中间代理节点每次都需要对接收到的信息进行处理，占用较多资源的问题，达到了节省资源的效果。
本发明实施例还提供了一种业务处理装置，该业务处理装置用于中间代理节点中，可以包括：总线801，以及连接到总线的处理器802、存储器803、发 射器804和接收器805。其中，存储器803用于存储若干个指令，指令被配置成由处理器802执行：
接收器805，用于截获用户代理向网络服务器发送的访问请求；
处理器802，用于根据接收器805截获的访问请求与用户代理建立连接，并在连接上向用户代理提供预定网页，预定网页包括是否通过中间代理节点处理访问请求的设置选项；
接收器805，还用于接收用户代理根据设置选项所触发的操作信息；当操作信息由用户代理触发禁止处理选项所产生时，截获用户代理再次向网络服务器发送的访问请求，禁止处理选项表示禁止中间代理节点处理访问请求；
发射器804，用于将访问请求直接转发给网络服务器。
可选的，处理器802，还用于获取操作信息的禁止类型，禁止类型为本次禁止、预定时间段内禁止和永久禁止中的一种；
处理器802，还用于当禁止类型是本次禁止时，检测是否在接收到操作信息后首次截获访问请求，发射器804，还用于当处理器802检测出在接收到操作信息后首次截获访问请求时，将访问请求直接转发给网络服务器；或者，
处理器802，还用于当禁止类型是预定时间段内禁止时，获取当前时长，并检测当时时长是否超过预定时间段的预定时长，发射器804，还用于当处理器802检测出当前时长未超过预定时长时，将访问请求直接转发给网络服务器，当前时长的开始时刻是接收到操作信息的时刻，当前时长的结束时刻是本次截获访问请求的时刻；或者，
发射器804，还用于当禁止类型是永久禁止时，将访问请求直接转发给网络服务器。
可选的，处理器802，还用于当操作信息由用户代理触发允许处理选项所产生时，读取在截获后所记录的访问请求；
发射器804，还用于在处理器802对访问请求进行处理后转发给网络服务器，允许处理选项表示允许中间代理节点处理访问请求。
可选的，接收器805，具体用于接收用户代理通过应用层发送的操作信息；或者，接收用户代理发送的应答数据包，从应答数据包的头域中的预定字段中读取操作信息。
可选的，接收器805，还用于截获用户代理向网络服务器发送的传输控制协议TCP连接请求；
处理器802，还用于读取接收器805截获的TCP连接请求中的信息，根据信息顶替网络服务器与用户代理建立TCP连接；
发射器804，还用于在处理器802建立的TCP连接上截获用户代理向网络服务器发送的访问请求。
可选的，发射器804，还用于在TCP连接上向用户代理发送第一指示信息，第一指示信息用于指示用户代理向中间代理节点发送连接建立请求；
处理器802，还用于根据连接建立请求与用户代理建立连接；
接收器805，还用于在处理器802建立的连接上接收用户代理发送的网页获取请求，网页获取请求用于请求预定网页；
处理器802，还用于根据网页获取请求向用户代理提供预定网页。
可选的，接收器805，还用于截获用户代理向网络服务器发送的TCP连接请求；
处理器802，还用于读取接收器805截获的TCP连接请求中的信息，根据信息顶替网络服务器与用户代理建立TCP连接；在TCP连接建立完成后，利用预存的与网络服务器对应的数字证书与用户代理建立代理连接；
接收器805，还用于在处理器802建立的代理连接上截获用户代理向网络服务器发送的访问请求。
可选的，发射器804，还用于在代理连接上向用户代理发送第二指示信息，第二指示信息用于指示用户代理向中间代理节点发送连接建立请求；
处理器802，还用于根据连接建立请求与用户代理建立连接；
接收器805，还用于在处理器802建立的连接上接收用户代理发送的网页获取请求，网页获取请求用于请求预定网页；
处理器802，还用于根据网页获取请求向用户代理提供预定网页。
可选的，发射器804，还用于向用户代理发送第一数字证书，第一数字证书是证书颁发机构颁发的且与网络服务器对应的数字证书，证书颁发机构的第二数字证书预先配置在用户代理中或安装有用户代理的终端的操作系统中，以使用户代理根据第二数字证书验证第一数字证书，在验证通过后，与中间代理节点建立代理连接；或者，
发射器804，还用于向用户代理发送第三数字证书和第四数字证书，第三数字证书是非授权证书颁发机构颁发的且与网络服务器对应的数字证书，第四数字证书是非授权证书颁发机构的数字证书，以使用户代理根据第四数字证书 验证第三数字证书，在验证通过后，与中间代理节点建立代理连接。
综上所述，本发明实施例提供的业务处理装置，通过向用户代理提供预定网页，该预定网页包括是否通过中间代理节点处理访问请求的设置选项，当接收到用户代理触发禁止处理选项所产生的操作信息时，截获用户代理再次向网络服务器发送的访问请求，将该访问请求直接转发给网络服务器，可以在用户代理选择不需要中间代理节点处理访问请求时，不对该访问请求进行处理，直接将访问请求转发给网络服务器，解决了中间代理节点每次都需要对接收到的信息进行处理，占用较多资源的问题，达到了节省资源的效果。
另外，通过读取在截获后所记录的访问请求，对该访问请求进行处理后转发给网络服务器，不需要用户在输入框中再次输入网络服务器的网址来生成访问请求，从而简化访问网络服务器的操作，提高了对网络服务器的访问效率。
需要说明的是：上述实施例提供的业务处理装置在进行业务处理时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将业务处理装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的业务处理装置与业务处理方法实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，可以仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系 统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应所述以权利要求的保护范围为准。

Claims (27)

  1. 一种业务处理方法，其特征在于，所述方法包括：
    中间代理节点截获用户代理向网络服务器发送的访问请求；
    所述中间代理节点根据所述访问请求与所述用户代理建立连接，并在所述连接上向所述用户代理提供预定网页，所述预定网页包括是否通过所述中间代理节点处理所述访问请求的设置选项；
    所述中间代理节点接收所述用户代理根据所述设置选项所触发的操作信息；
    当所述操作信息由所述用户代理触发禁止处理选项所产生时，所述中间代理节点截获所述用户代理再次向所述网络服务器发送的访问请求，将所述访问请求直接转发给所述网络服务器，所述禁止处理选项表示禁止所述中间代理节点处理所述访问请求。
  2. 根据权利要求1所述的方法，其特征在于，所述将所述访问请求直接转发给所述网络服务器，包括：
    所述中间代理节点获取所述操作信息的禁止类型，所述禁止类型为本次禁止、预定时间段内禁止和永久禁止中的一种；
    当所述禁止类型是本次禁止时，所述中间代理节点检测是否在接收到所述操作信息后首次截获所述访问请求，当在接收到所述操作信息后首次截获所述访问请求时，将所述访问请求直接转发给所述网络服务器；或者，
    当所述禁止类型是预定时间段内禁止时，所述中间代理节点获取当前时长，并检测所述当时时长是否超过所述预定时间段的预定时长，当所述当前时长未超过所述预定时长时，将所述访问请求直接转发给所述网络服务器，所述当前时长的开始时刻是接收到所述操作信息的时刻，所述当前时长的结束时刻是本次截获所述访问请求的时刻；或者，
    当所述禁止类型是永久禁止时，所述中间代理节点将所述访问请求直接转发给所述网络服务器。
  3. 根据权利要求1或2所述的方法，其特征在于，所述方法，还包括：
    当所述操作信息由所述用户代理触发允许处理选项所产生时，所述中间代理节点读取在截获后所记录的所述访问请求，对所述访问请求进行处理后转发给所述网络服务器，所述允许处理选项表示允许所述中间代理节点处理所述访 问请求。
  4. 根据权利要求1所述的方法，其特征在于，所述中间代理节点接收所述用户代理根据所述设置选项所触发的操作信息，包括：
    所述中间代理节点接收所述用户代理通过应用层发送的所述操作信息；或者，
    所述中间代理节点接收所述用户代理发送的应答数据包，从所述应答数据包的头域中的预定字段中读取所述操作信息。
  5. 根据权利要求1至4任一所述的方法，其特征在于，所述中间代理节点截获用户代理向网络服务器发送的访问请求，包括：
    所述中间代理节点截获所述用户代理向所述网络服务器发送的传输控制协议TCP连接请求；
    所述中间代理节点读取所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接；
    所述中间代理节点在所述TCP连接上截获所述用户代理向所述网络服务器发送的所述访问请求。
  6. 根据权利要求5所述的方法，其特征在于，所述中间代理节点根据所述访问请求与所述用户代理建立连接，并在所述连接上向所述用户代理提供所述预定网页，包括：
    所述中间代理节点在所述TCP连接上向所述用户代理发送第一指示信息，所述第一指示信息用于指示所述用户代理向所述中间代理节点发送连接建立请求；
    所述中间代理节点根据所述连接建立请求与所述用户代理建立所述连接；
    所述中间代理节点在所述连接上接收所述用户代理发送的网页获取请求，所述网页获取请求用于请求所述预定网页；
    所述中间代理节点根据所述网页获取请求向所述用户代理提供所述预定网页。
  7. 根据权利要求1至4任一所述的方法，其特征在于，所述中间代理节点截获用户代理向网络服务器发送的访问请求，包括：
    所述中间代理节点截获所述用户代理向所述网络服务器发送的TCP连接请求；
    所述中间代理节点读取所述TCP连接请求中的信息，根据所述信息顶替所 述网络服务器与所述用户代理建立TCP连接；
    在所述TCP连接建立完成后，所述中间代理节点利用预存的与所述网络服务器对应的数字证书与所述用户代理建立代理连接；
    所述中间代理节点在所述代理连接上截获所述用户代理向所述网络服务器发送的所述访问请求。
  8. 根据权利要求7所述的方法，其特征在于，所述中间代理节点根据所述访问请求与所述用户代理建立连接，并在所述连接上向所述用户代理提供所述预定网页，包括：
    所述中间代理节点在所述代理连接上向所述用户代理发送第二指示信息，所述第二指示信息用于指示所述用户代理向所述中间代理节点发送连接建立请求；
    所述中间代理节点根据所述连接建立请求与所述用户代理建立所述连接；
    所述中间代理节点在所述连接上接收所述用户代理发送的网页获取请求，所述网页获取请求用于请求所述预定网页；
    所述中间代理节点根据所述网页获取请求向所述用户代理提供所述预定网页。
  9. 根据权利要求7或8所述的方法，其特征在于，所述中间代理节点利用预存的与所述网络服务器对应的数字证书与所述用户代理建立代理连接，包括：
    所述中间代理节点向所述用户代理发送第一数字证书，所述第一数字证书是证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述证书颁发机构的第二数字证书预先配置在所述用户代理中或安装有所述用户代理的终端的操作系统中，以使所述用户代理根据所述第二数字证书验证所述第一数字证书，在验证通过后，与所述中间代理节点建立所述代理连接；或者，
    所述中间代理节点向所述用户代理发送第三数字证书和第四数字证书，所述第三数字证书是非授权证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述第四数字证书是所述非授权证书颁发机构的数字证书，以使所述用户代理根据所述第四数字证书验证所述第三数字证书，在验证通过后，与所述中间代理节点建立所述代理连接。
  10. 一种业务处理装置，其特征在于，用于中间代理节点中，所述装置包括：
    请求截获模块，用于截获用户代理向网络服务器发送的访问请求；
    网页提供模块，用于根据所述请求截获模块截获的所述访问请求与所述用户代理建立连接，并在所述连接上向所述用户代理提供预定网页，所述预定网页包括是否通过所述中间代理节点处理所述访问请求的设置选项；
    信息接收模块，用于接收所述用户代理根据所述设置选项所触发的操作信息；
    第一处理模块，用于当所述信息接收模块接收的所述操作信息由所述用户代理触发禁止处理选项所产生时，截获所述用户代理再次向所述网络服务器发送的访问请求，将所述访问请求直接转发给所述网络服务器，所述禁止处理选项表示禁止所述中间代理节点处理所述访问请求。
  11. 根据权利要求10所述的装置，其特征在于，所述第一处理模块，包括：
    类型获取单元，用于获取所述操作信息的禁止类型，所述禁止类型为本次禁止、预定时间段内禁止和永久禁止中的一种；
    第一处理单元，用于当所述类型获取单元获取的所述禁止类型是本次禁止时，检测是否在接收到所述操作信息后首次截获所述访问请求，当在接收到所述操作信息后首次截获所述访问请求时，将所述访问请求直接转发给所述网络服务器；或者，
    第二处理单元，用于当所述类型获取单元获取的所述禁止类型是预定时间段内禁止时，获取当前时长，并检测所述当时时长是否超过所述预定时间段的预定时长，当所述当前时长未超过所述预定时长时，将所述访问请求直接转发给所述网络服务器，所述当前时长的开始时刻是接收到所述操作信息的时刻，所述当前时长的结束时刻是本次截获所述访问请求的时刻；或者，
    第三处理单元，用于当所述类型获取单元获取的所述禁止类型是永久禁止时，将所述访问请求直接转发给所述网络服务器。
  12. 根据权利要求10或11所述的装置，其特征在于，所述装置，还包括：
    第二处理模块，用于当所述信息接收模块接收的所述操作信息由所述用户代理触发允许处理选项所产生时，读取在截获后所记录的所述访问请求，对所述访问请求进行处理后转发给所述网络服务器，所述允许处理选项表示允许所述中间代理节点处理所述访问请求。
  13. 根据权利要求10所述的装置，其特征在于，所述信息接收模块，包括：
    第一接收单元，用于接收所述用户代理通过应用层发送的所述操作信息；或者，
    第二接收单元，用于接收所述用户代理发送的应答数据包，从所述应答数据包的头域中的预定字段中读取所述操作信息。
  14. 根据权利要求10至13任一所述的装置，其特征在于，所述请求截获模块，包括：
    第一截获单元，用于截获所述用户代理向所述网络服务器发送的传输控制协议TCP连接请求；
    第一连接建立单元，用于读取所述第一截获单元截获的所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接；
    第二截获单元，用于在所述第一连接建立单元建立的所述TCP连接上截获所述用户代理向所述网络服务器发送的所述访问请求。
  15. 根据权利要求14所述的装置，其特征在于，所述网页提供模块，包括：
    第一发送单元，用于在所述TCP连接上向所述用户代理发送第一指示信息，所述第一指示信息用于指示所述用户代理向所述中间代理节点发送连接建立请求；
    第二连接建立单元，用于根据所述连接建立请求与所述用户代理建立所述连接；
    第三接收单元，用于在所述第二连接建立单元建立的所述连接上接收所述用户代理发送的网页获取请求，所述网页获取请求用于请求所述预定网页；
    第一提供单元，用于根据所述网页获取请求向所述用户代理提供所述预定网页。
  16. 根据权利要求10至13任一所述的装置，其特征在于，所述请求截获模块，包括：
    第三截获单元，用于截获所述用户代理向所述网络服务器发送的TCP连接请求；
    第三连接建立单元，用于读取所述第三截获单元截获的所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接；
    第四连接建立单元，用于在所述第三连接建立单元建立的所述TCP连接建立完成后，利用预存的与所述网络服务器对应的数字证书与所述用户代理建立代理连接；
    第四截获单元，用于在所述第四连接建立单元建立的所述代理连接上截获所述用户代理向所述网络服务器发送的所述访问请求。
  17. 根据权利要求16所述的装置，其特征在于，所述网页提供模块，包括：
    第二发送单元，用于在所述代理连接上向所述用户代理发送第二指示信息，所述第二指示信息用于指示所述用户代理向所述中间代理节点发送连接建立请求；
    第五连接建立单元，用于根据所述连接建立请求与所述用户代理建立所述连接；
    第四接收单元，用于在所述第五连接建立单元建立的所述连接上接收所述用户代理发送的网页获取请求，所述网页获取请求用于请求所述预定网页；
    第二提供单元，用于根据所述网页获取请求向所述用户代理提供所述预定网页。
  18. 根据权利要求16或17所述的装置，其特征在于，所述第四连接建立单元，具体用于：
    向所述用户代理发送第一数字证书，所述第一数字证书是证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述证书颁发机构的第二数字证书预先配置在所述用户代理中或安装有所述用户代理的终端的操作系统中，以使所述用户代理根据所述第二数字证书验证所述第一数字证书，在验证通过后，与所述中间代理节点建立所述代理连接；或者，
    向所述用户代理发送第三数字证书和第四数字证书，所述第三数字证书是非授权证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述第四数字证书是所述非授权证书颁发机构的数字证书，以使所述用户代理根据所述第四数字证书验证所述第三数字证书，在验证通过后，与所述中间代理节点建立所述代理连接。
  19. 一种业务处理装置，其特征在于，用于中间代理节点中，所述装置包括：总线，以及连接到所述总线的处理器、存储器、发射器和接收器。其中，所述存储器用于存储若干个指令，所述指令被配置成由所述处理器执行；
    所述接收器，用于截获用户代理向网络服务器发送的访问请求；
    所述处理器，用于根据所述接收器截获的所述访问请求与所述用户代理建立连接，并在所述连接上向所述用户代理提供预定网页，所述预定网页包括是否通过所述中间代理节点处理所述访问请求的设置选项；
    所述接收器，还用于接收所述用户代理根据所述设置选项所触发的操作信息；当所述操作信息由所述用户代理触发禁止处理选项所产生时，截获所述用 户代理再次向所述网络服务器发送的访问请求，所述禁止处理选项表示禁止所述中间代理节点处理所述访问请求；
    所述发射器，用于将所述访问请求直接转发给所述网络服务器。
  20. 根据权利要求19所述的装置，其特征在于，
    所述处理器，还用于获取所述操作信息的禁止类型，所述禁止类型为本次禁止、预定时间段内禁止和永久禁止中的一种；
    所述处理器，还用于当所述禁止类型是本次禁止时，检测是否在接收到所述操作信息后首次截获所述访问请求，所述发射器，还用于当所述处理器检测出在接收到所述操作信息后首次截获所述访问请求时，将所述访问请求直接转发给所述网络服务器；或者，
    所述处理器，还用于当所述禁止类型是预定时间段内禁止时，获取当前时长，并检测所述当时时长是否超过所述预定时间段的预定时长，所述发射器，还用于当所述处理器检测出所述当前时长未超过所述预定时长时，将所述访问请求直接转发给所述网络服务器，所述当前时长的开始时刻是接收到所述操作信息的时刻，所述当前时长的结束时刻是本次截获所述访问请求的时刻；或者，
    所述发射器，还用于当所述禁止类型是永久禁止时，将所述访问请求直接转发给所述网络服务器。
  21. 根据权利要求19或20所述的装置，其特征在于，
    所述处理器，还用于当所述操作信息由所述用户代理触发允许处理选项所产生时，读取在截获后所记录的所述访问请求；
    所述发射器，还用于在所述处理器对所述访问请求进行处理后转发给所述网络服务器，所述允许处理选项表示允许所述中间代理节点处理所述访问请求。
  22. 根据权利要求19所述的装置，其特征在于，所述接收器，具体用于接收所述用户代理通过应用层发送的所述操作信息；或者，接收所述用户代理发送的应答数据包，从所述应答数据包的头域中的预定字段中读取所述操作信息。
  23. 根据权利要求19至22任一所述的装置，其特征在于，
    所述接收器，还用于截获所述用户代理向所述网络服务器发送的传输控制协议TCP连接请求；
    所述处理器，还用于读取所述接收器截获的所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接；
    所述发射器，还用于在所述处理器建立的所述TCP连接上截获所述用户代 理向所述网络服务器发送的所述访问请求。
  24. 根据权利要求23所述的装置，其特征在于，
    所述发射器，还用于在所述TCP连接上向所述用户代理发送第一指示信息，所述第一指示信息用于指示所述用户代理向所述中间代理节点发送连接建立请求；
    所述处理器，还用于根据所述连接建立请求与所述用户代理建立所述连接；
    所述接收器，还用于在所述处理器建立的所述连接上接收所述用户代理发送的网页获取请求，所述网页获取请求用于请求所述预定网页；
    所述处理器，还用于根据所述网页获取请求向所述用户代理提供所述预定网页。
  25. 根据权利要求19至22任一所述的装置，其特征在于，
    所述接收器，还用于截获所述用户代理向所述网络服务器发送的TCP连接请求；
    所述处理器，还用于读取所述接收器截获的所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接；在所述TCP连接建立完成后，利用预存的与所述网络服务器对应的数字证书与所述用户代理建立代理连接；
    所述接收器，还用于在所述处理器建立的所述代理连接上截获所述用户代理向所述网络服务器发送的所述访问请求。
  26. 根据权利要求25所述的装置，其特征在于，
    所述发射器，还用于在所述代理连接上向所述用户代理发送第二指示信息，所述第二指示信息用于指示所述用户代理向所述中间代理节点发送连接建立请求；
    所述处理器，还用于根据所述连接建立请求与所述用户代理建立所述连接；
    所述接收器，还用于在所述处理器建立的所述连接上接收所述用户代理发送的网页获取请求，所述网页获取请求用于请求所述预定网页；
    所述处理器，还用于根据所述网页获取请求向所述用户代理提供所述预定网页。
  27. 根据权利要求25或26所述的装置，其特征在于，
    所述发射器，还用于向所述用户代理发送第一数字证书，所述第一数字证书是证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述证书颁发 机构的第二数字证书预先配置在所述用户代理中或安装有所述用户代理的终端的操作系统中，以使所述用户代理根据所述第二数字证书验证所述第一数字证书，在验证通过后，与所述中间代理节点建立所述代理连接；或者，
    所述发射器，还用于向所述用户代理发送第三数字证书和第四数字证书，所述第三数字证书是非授权证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述第四数字证书是所述非授权证书颁发机构的数字证书，以使所述用户代理根据所述第四数字证书验证所述第三数字证书，在验证通过后，与所述中间代理节点建立所述代理连接。
PCT/CN2015/086893 2015-08-13 2015-08-13 业务处理方法及装置 WO2017024588A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201580075161.XA CN107209751B (zh) 2015-08-13 2015-08-13 业务处理方法及装置
PCT/CN2015/086893 WO2017024588A1 (zh) 2015-08-13 2015-08-13 业务处理方法及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2015/086893 WO2017024588A1 (zh) 2015-08-13 2015-08-13 业务处理方法及装置

Publications (1)

Publication Number Publication Date
WO2017024588A1 true WO2017024588A1 (zh) 2017-02-16

Family

ID=57984585

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/086893 WO2017024588A1 (zh) 2015-08-13 2015-08-13 业务处理方法及装置

Country Status (2)

Country Link
CN (1) CN107209751B (zh)
WO (1) WO2017024588A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111953742B (zh) * 2020-07-22 2023-09-05 深信服科技股份有限公司 一种页面重定向方法、终端设备、中间设备及服务器

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101304345A (zh) * 2008-06-26 2008-11-12 北京邮电大学 用于自组织网络的介入式测量节点及其测量方法
US20100198759A1 (en) * 2009-02-04 2010-08-05 International Business Machines Corporation Portal Performance Optimization
CN102546737A (zh) * 2010-12-07 2012-07-04 中国电信股份有限公司 无线互联网门户接入系统及方法
US20120185911A1 (en) * 2010-09-30 2012-07-19 Khandys Polite Mlweb: a multilevel web application framework
CN103379040A (zh) * 2012-04-24 2013-10-30 阿里巴巴集团控股有限公司 一种高并发系统中控制并发数的装置和方法

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6167441A (en) * 1997-11-21 2000-12-26 International Business Machines Corporation Customization of web pages based on requester type
CN101771695A (zh) * 2010-01-07 2010-07-07 福建星网锐捷网络有限公司 Tcp连接的处理方法、系统及syn代理设备
US9544143B2 (en) * 2010-03-03 2017-01-10 Duo Security, Inc. System and method of notifying mobile devices to complete transactions
CN103067417B (zh) * 2011-10-19 2016-04-13 华耀(中国)科技有限公司 VPN中安全代理的Web服务映射方法及其系统
US9355223B2 (en) * 2013-03-29 2016-05-31 Citrix Systems, Inc. Providing a managed browser
CN104639534B (zh) * 2014-12-30 2019-02-12 北京奇虎科技有限公司 网站安全信息的加载方法和浏览器装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101304345A (zh) * 2008-06-26 2008-11-12 北京邮电大学 用于自组织网络的介入式测量节点及其测量方法
US20100198759A1 (en) * 2009-02-04 2010-08-05 International Business Machines Corporation Portal Performance Optimization
US20120185911A1 (en) * 2010-09-30 2012-07-19 Khandys Polite Mlweb: a multilevel web application framework
CN102546737A (zh) * 2010-12-07 2012-07-04 中国电信股份有限公司 无线互联网门户接入系统及方法
CN103379040A (zh) * 2012-04-24 2013-10-30 阿里巴巴集团控股有限公司 一种高并发系统中控制并发数的装置和方法

Also Published As

Publication number Publication date
CN107209751B (zh) 2020-09-08
CN107209751A (zh) 2017-09-26

Similar Documents

Publication Publication Date Title
CN109088889B (zh) 一种ssl加解密方法、系统及计算机可读存储介质
JP6612358B2 (ja) ネットワークアクセスデバイスをワイヤレスネットワークアクセスポイントにアクセスさせるための方法、ネットワークアクセスデバイス、アプリケーションサーバ、および不揮発性コンピュータ可読記憶媒体
US8532620B2 (en) Trusted mobile device based security
CA2774648C (en) Modular device authentication framework
EP2997693B1 (en) Secure session capability using public-key cryptography without access to the private key
US8904178B2 (en) System and method for secure remote access
US9130935B2 (en) System and method for providing access credentials
JP5047291B2 (ja) インターネットユーザに対して認証サービスを提供するための方法およびシステム
EP2820792B1 (en) Method of operating a computing device, computing device and computer program
US11736304B2 (en) Secure authentication of remote equipment
WO2019062666A1 (zh) 一种实现安全访问内部网络的系统、方法和装置
CN109510802B (zh) 鉴权方法、装置及系统
CN109792433B (zh) 用于将设备应用绑定到网络服务的方法和装置
CN101605137A (zh) 安全分布式文件系统
CN112714053B (zh) 通信连接方法及装置
US20170317836A1 (en) Service Processing Method and Apparatus
US20160315915A1 (en) Method for accessing a data memory of a cloud computer system using a modified domain name system (dns)
CN113225352A (zh) 一种数据传输方法、装置、电子设备及存储介质
JP6056970B2 (ja) 情報処理装置、端末機、情報処理システム及び情報処理方法
WO2017024588A1 (zh) 业务处理方法及装置
CN106464684B (zh) 业务处理方法及装置
KR20190014958A (ko) 접속 제어 장치 및 방법
CN114244569A (zh) Ssl vpn远程访问方法、系统和计算机设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15900786

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15900786

Country of ref document: EP

Kind code of ref document: A1