WO2019062666A1

WO2019062666A1 - System, method, and apparatus for securely accessing internal network

Info

Publication number: WO2019062666A1
Application number: PCT/CN2018/106976
Authority: WO
Inventors: 李齐
Original assignee: 阿里巴巴集团控股有限公司
Priority date: 2017-09-29
Filing date: 2018-09-21
Publication date: 2019-04-04
Also published as: TW201916628A; CN109587097A

Abstract

Disclosed are a system, method, and apparatus for securely accessing an internal network, said system comprising: a network access requesting end, an intermediary end, and an internal-network server; said network access requesting end is used for issuing a first request message used for requesting network access and is used for receiving a response message; said intermediary end is used for monitoring and hijacking the first request message of said network access requesting end; parsing the first request message and adding authentication information to the first request message to obtain a second request message; further, sending said second request message to a destination network address of said first request message; and, receiving a response message concerning the second request message and forwarding said response message to a client; said internal-network server is used for receiving the second request message and extracting authentication information from same, and determining whether the network access request has access permission; if so, then returning the response message. By means of the technical solution provided by the present invention, it is possible to accurately learn whether a client has permission to access an internal network, preventing unprivileged access requests.

Description

System, method and device for realizing secure access to internal network

The present application claims priority to Chinese Patent Application No. 201710905297.X filed on Sep. 29, 2017, entitled "A System, Method and Apparatus for Implementing Secure Access to Internal Networks", the entire contents of which are incorporated by reference. In this application.

Technical field

The present application relates to the field of network access, and in particular to a system for implementing secure access to an internal network. The present application also relates to a method and apparatus for securely accessing an internal network, a method and apparatus for receiving access by a server, a method and apparatus for processing data, and a method and apparatus for responding to a data.

Background technique

In the traditional enterprise network configuration, remote access is required by renting a DDN (Digital Data Network) leased line or frame relay. Such a communication scheme inevitably leads to high network communication and maintenance costs. For mobile users (mobile workers) and remote individual users, they usually enter the LAN of the enterprise through the dial-up line (Internet), but this will inevitably bring security risks.

In order to allow foreign employees to access intranet resources, the existing technology generally uses VPN solution; this method is to set up a VPN server in the internal network. After the local staff connects to the Internet, connect to the VPN server through the Internet, and then pass The VPN server enters the intranet.

In order to ensure data security, the communication data between the VPN server and the client is encrypted. With data encryption, data can be considered to be securely transmitted over a dedicated data link, just as a dedicated network is set up. But in fact, VPN uses the public link on the Internet. Therefore, VPN is called virtual private network. It essentially uses encryption technology to encapsulate a data communication tunnel on the public network. With VPN technology, users can use VPN to access intranet resources, whether they are on a business trip or at home, so that VPN can be widely used in enterprises.

However, there are also obvious problems in using VPN to access intranet resources. One of the main problems is that the server cannot accurately obtain the source of the client initiated by the http/https request, so that it is impossible to determine whether the client actually has access to the intranet.

Summary of the invention

The present invention provides a system for securely accessing a network to solve the problem that the server cannot accurately obtain the source of the client initiated by the http/https request. The present invention further provides a method and apparatus for secure access to an internal network, and a method and apparatus for receiving access by a server. The invention also provides a data processing method and device, and a data response method and device.

The present invention provides a system for implementing secure access to an internal network, including: a network access requesting end, a mediation end, and an internal network server;

The network access requesting end is configured to send a first request message for implementing a network access request, and receive a response message;

The mediation end is configured to listen to and hijack the first request message of the network access requesting end; parse the first request message, and add authentication information to the first request message to obtain a second request message; Sending, by the target network address of the first request message, the second request message; and receiving a response message to the second request message, and forwarding the response message to the client;

The internal network server is configured to receive the second request message, extract authentication information therefrom, and determine whether the network access request has access rights; if yes, return a response message.

Optionally, the mediator is disposed in the same mobile device as the network access requesting end.

Optionally, the network access request sent by the network access requesting end uses the http protocol, and the intermediate end performs an http handshake with the network access requesting end before receiving the first request message, where the intermediary The end performs an http handshake with the internal network server before issuing the second request message.

Optionally, the network access request sent by the network access requesting end is in an https manner, and the intermediate end performs an SSL handshake with the network access requesting end before receiving the first request message, and then The intermediary sends an SSL handshake with the internal network server according to the server_name field provided by the SSL handshake; after receiving the handshake success message returned by the internal network server, the intermediary sends a handshake to the network access requester. Success message.

Optionally, before the network access request is performed, the CA pseudo certificate is imported to the network access requesting end and the mediation end.

Optionally, the authentication information includes at least one of the following information: unique identification information of the terminal device where the network access request end is located; user identity authentication information.

Optionally, the authentication information is encrypted by an asymmetric algorithm.

Optionally, in the DLL injection manner, the global traffic hijacking process is injected into the network access request initiated by the network access requesting end to implement hijacking of the first request message.

The present invention also provides a method for securely accessing an internal network, comprising:

Hijacking a network access request issued by an application having a network access function; the network access request is referred to as a first request message;

Adding authentication information to the first request message to form a second request message;

Forwarding the second request message to a destination server of the network access request, that is, an internal network server;

Receiving response information returned by the internal network server;

The response information is forwarded to the application that issued the network access request.

Optionally, in the step of hijacking a network access request issued by an application having a network access function, the network access request is hijacked by using a hook function; and the hook function is injected into the network access request process in advance by using a DLL injection manner.

Optionally, if the first request message is in the http mode, before receiving the first request message, including performing an http handshake with an application that sends a network access request; before sending the second request message, The internal network server performs an http handshake.

Optionally, the network access request is in an https manner, and before the receiving the first request message, performing an SSL handshake with the network access requesting end, and then, according to the server_name field provided by the SSL handshake, and the internal The network server performs an SSL handshake; after receiving the handshake success message returned by the internal network server, it sends a handshake success message to the application that sends the network access request.

Optionally, the CA pseudo certificate is imported before the network access request sent by the network access function application is hijacked.

Optionally, the authentication information includes at least one of the following information: unique identification information of the terminal device; user identity authentication information.

Optionally, the authentication information is encrypted using an asymmetric encryption algorithm.

The present invention also provides a method for a server to receive an access, including:

Obtaining an access request that includes authentication information, and the access request is referred to as a second request message;

Extracting the authentication information;

Determining whether the access request is legal according to the authentication information;

If yes, return a response message.

Optionally, the authentication information is encrypted by using an asymmetric encryption algorithm, and determining, according to the authentication information, whether the access request is legal, including:

Decrypting the authentication information, where the authentication information includes at least one of the following information: unique identification information of the terminal device, user identity authentication information;

Verifying the validity of the access request based on the decrypted authentication information.

Optionally, the verifying the validity of the access request according to the decrypted authentication information includes at least one of the following manners:

Determining, according to the unique identification information of the terminal device included in the decrypted authentication information, that the terminal device that issued the access request is in the list, compared with the terminal device list that is allowed to be accessed by the server itself;

Determining, according to the decrypted user identity authentication information, a user list that is allowed to be accessed by the server itself, determining whether the user who issued the access request is in the list.

The invention also provides a data processing method, comprising:

Intercepting a first network access request, where the first network access request includes a source address and a target address;

Adding authentication information to the first network access request to obtain a second network access request;

Sending the second network access request to a computing device corresponding to the target address;

Receiving response information returned by the computing device corresponding to the target address;

Sending the response information to a computing device corresponding to the source address.

Optionally, the authentication information includes at least one of the following information: unique identification information of the computing device corresponding to the source address; user identity authentication information.

The invention also provides a data response method, comprising:

Obtain a network access request containing authentication information;

Extracting the authentication information from the network access request;

Determining, according to the authentication information, whether the network access request is legal;

If yes, return a response message.

The present invention also provides an apparatus for securely accessing an internal network, comprising:

a first request message hijacking unit, configured to hijack a network access request issued by an application having a network access function; the network access request is referred to as a first request message;

An authentication information adding unit, configured to add authentication information to the first request message to form a second request message;

a second request message forwarding unit, configured to forward the second request message to a destination server of the network access request, that is, an internal network server;

a response information receiving unit, configured to receive response information returned by the internal network server;

And a response information forwarding unit, configured to forward the response information to the application that issues the network access request.

The present invention also provides an apparatus for receiving access by a server, including:

An access request obtaining unit, configured to acquire an access request that includes authentication information, where the access request is referred to as a second request message;

An authentication information extracting unit, configured to extract the authentication information;

The access request legality determining unit is configured to determine, according to the authentication information, whether the access request is legal;

The response message returns to the unit, and when the result of the above unit is YES, is used to return a response message.

The invention also provides an apparatus for data processing, comprising:

a first network access request intercepting unit, configured to intercept a first network access request, where the first network access request includes a source address and a target address;

An authentication information adding unit, configured to add authentication information to the first network access request, to obtain a second network access request;

a second network access request sending unit, configured to send the second network access request to a computing device corresponding to the target address;

a response information receiving unit, configured to receive response information returned by the computing device corresponding to the target address;

And a response information sending unit, configured to send the response information to the computing device corresponding to the source address.

The invention also provides a data response device, comprising:

a network access request obtaining unit, configured to acquire a network access request that includes the authentication information;

An authentication information extracting unit, configured to extract the authentication information from the network access request;

The network access request legality determining unit is configured to determine, according to the authentication information, whether the network access request is legal;

The response information returning unit is configured to return a response message when the judgment result of the above unit is YES.

The invention also provides an electronic device comprising:

Processor;

a memory for storing a program for securely accessing an internal network, the device is powered on and runs the program for secure access to the internal network through the processor, and performs the following steps:

Receiving response information returned by the internal network server;

The invention also provides an electronic device comprising:

Processor;

a memory for storing a program for receiving access by the server, after the device is powered on and running the program by the processor to receive the accessed program, performing the following steps:

Extracting the authentication information;

If yes, return a response message.

The invention also provides an electronic device comprising:

Processor;

a memory for storing a program for data processing, after the device is powered on and runs the program of the data processing by the processor, performing the following steps:

The invention also provides an electronic device comprising:

Processor;

a memory for storing a program for data response, after the device is powered on and runs the program of the data response by the processor, performing the following steps:

Obtain a network access request containing authentication information;

Extracting the authentication information from the network access request;

If yes, return a response message.

The system for securely accessing the internal network and the corresponding method and device provided by the application, the client initiates an access request, and hijacks the request message to the intermediary; the intermediary analyzes the plaintext information, adds the encrypted information, and then requests the message. Sent to the server.

In accordance with an embodiment of the present application, advantages include:

By extracting the encrypted information, the server accurately obtains the source of the client initiated by the http/https request, so that the client can accurately know whether the client has the right to access the intranet and avoid unauthorized access requests.

According to an embodiment of the present application, the technical solution provided by the present application has the following advantages: since the VPN service is not needed, manual access and disconnection operations are eliminated, and no password is required for verification; a better user experience can be obtained. .

According to an embodiment of the present application, the technical solution provided by the present application has the following advantages: the intranet server can be directly connected, and the access speed is improved.

DRAWINGS

1 is a schematic diagram of a system for implementing secure access to an internal network according to a first embodiment of the present application;

2 is a schematic diagram of a request for accessing a network using the http protocol provided by the first embodiment of the present application;

3 is a schematic diagram of a request for accessing a network using the https protocol provided by the first embodiment of the present application;

4 is a flowchart of a method for securely accessing an internal network according to a second embodiment of the present application;

5 is a flowchart of a method for receiving an access by a server according to a third embodiment of the present application;

6 is a flowchart of a data processing method according to a fourth embodiment of the present application;

7 is a flowchart of a data response method according to a fifth embodiment of the present application;

8 is a schematic diagram of an apparatus for securely accessing an internal network according to a sixth embodiment of the present application;

9 is a schematic diagram of an apparatus for receiving access by a server according to a seventh embodiment of the present application;

10 is a schematic diagram of an apparatus for data processing according to an eighth embodiment of the present application;

11 is a schematic diagram of an apparatus for data response provided by a ninth embodiment of the present application;

FIG. 12 is a schematic diagram of an electronic device according to a tenth embodiment of the present application; FIG.

FIG. 13 is a schematic diagram of an electronic device according to an eleventh embodiment of the present application; FIG.

FIG. 14 is a schematic diagram of an electronic device according to a twelfth embodiment of the present application; FIG.

FIG. 15 is a schematic diagram of an electronic device according to a thirteenth embodiment of the present application.

Detailed ways

Numerous specific details are set forth in the description below in order to provide a thorough understanding of the invention. However, the present invention can be implemented in many other ways than those described herein, and a person skilled in the art can make a similar promotion without departing from the spirit of the invention, and thus the invention is not limited by the specific embodiments disclosed below.

The present application provides a system for secure access to an internal network, a method for secure access to an internal network, and a method for a server to receive access. The following provides an embodiment for a detailed description of the system and method. The system and method are mainly designed to access the intranet resources of the company, but the system and method can be used in all network systems having the same requirements, and are not specifically limited herein.

The key terms used in this application are described below.

The network access requesting end, in the present application, specifically refers to an application software capable of issuing a network access request, such as a browser or an APP; the application software is installed in a software platform of a hardware device such as a computer or a mobile phone.

The intermediary, in the present application, specifically refers to listening for an access request (referred to as a first request message in the present application) issued by the network access requester after being started, and hijacking the access request when pointing to a predetermined network address An application software module that accesses the request and adds authentication information to it, and then issues an access request (referred to as a second request message in the present application) to the predetermined network address. The application software module is generally disposed on the same terminal device as the network access requesting end, but it is not excluded that the main body is set on another terminal device, and only the device is configured to implement monitoring and hijacking the first A case of a program requesting information.

An internal network server, in this application, refers to a server that is capable of receiving network access requests over a network and acting as an entry point into a particular internal network.

The first embodiment of the present application provides a system for securely accessing an internal network. Please refer to FIG. 1 for an embodiment of the present invention. FIG. 1 is a schematic diagram of a system for securely accessing an internal network according to a first embodiment of the present application. The system for secure access to the internal network is described in detail below with reference to FIG. The embodiments described in the following description are intended to explain the principles of the system and are not intended to be limiting.

A system for securely accessing an internal network, comprising: a network access requester 101, a mediator 102, and an internal network server 103.

The network access requesting end 101 is configured to issue a first request message for implementing a network access request, and receive a response message.

The detailed working process of the above network access requesting end 101 will be described below.

The network access requesting end 101 is a software program disposed on a specific terminal device, and may be in the form of an APP application or a browser; the network access requesting end 101 can issue a network access request, and the network access request is mainly adopted by http. Agreement or https protocol. In the present application, the network access request sent by the network access requesting end 101 is referred to as a first request message.

The http protocol or the https protocol is currently the two main network application layer protocols for implementing network access; the latter is based on the former and combines the SSL protocol to achieve confidentiality of the access process.

For the case of using the https protocol, before the network access request is made, the CA pseudo-certificate needs to be imported to the network access requesting end 101 and the intermediation terminal 102, and the CA pseudo-certificate is at the network access requesting end 101 and the intermediary end 102. Establish an https connection between the use. The mediator 102 uses the CA pseudo certificate as a server.

In addition, a DLL injection method is also needed to inject a global traffic hijacking process into the network access request initiated by the network access requesting end 101 to implement monitoring and hijacking of the first request message. The process that implements the hijacking can be considered part of the mediation 102, merely deploying it in the network access request issued by the network access requesting end 101. The specific implementation can be implemented using the hook function. The so-called hook function is a special application program interface (API). The hook function can be used to change the original function of a system API. The basic method is to "touch" the hook function to the API function entry point that needs to be modified. Its address points to the new custom function.

In this embodiment, the global DLL injection method is used to inject the hook function into the http access process or the https access process; the so-called DLL injection is to put a DLL file into the address space of a process, so that it becomes the Part of the process; many applications are not a complete executable, but are split into relatively independent dynamic link libraries, DLL files, placed in the system. When a program is executed, the corresponding DLL file is called. In this embodiment, the hook function is put into each http access process or https access process initiated by the network access requesting end 101 by a global DLL injection method.

The mediation end 102 is configured to listen to and hijack the first request message of the network access requesting end, parse the first request message, and add authentication information to the first request message to obtain a second request message; Transmitting the second request message to a target network address of the first request message; and receiving a response message to the second request message, and forwarding the response message to the network access requesting end 101.

The mediator 102, as a unit for implementing intermediate forwarding of a network access request in the technical solution provided by the present application, is generally a software program, and is generally disposed in an APP application or a browser of the network access requesting end 101. On the terminal device where it is located; of course, it is not excluded that in some cases, it is arranged on a dedicated device or on a remote server. At this time, it is still necessary to arrange a program for monitoring and hijacking on the network access requesting end 101. .

In the system provided in this embodiment, the mediation terminal 102 implements the following functions:

First, the mediator 102 is used by the server as the network access requesting end; any network access request (referred to as the first request message in this embodiment) sent by the network access requesting end 101 is hijacked by hijacking. The mediator 102 responds to the first request message by the mediator 102 as a server; inevitably, in order to implement the process, the network access requesting end 101 and the mediation end 102 are first There is a need to have a handshake.

Secondly, the intermediary 102 obtains the second request message after adding the authentication information to the first request message, and is sent by the intermediary 102 as a requesting party to the internal network server 103 as the target server; After the response message of the internal network server 103, the response message is forwarded to the network access requesting end 101; inevitably, in order to implement the process, the intermediate end 102 and the internal network server 103 are further First, there is a need to have a handshake.

It can be seen that the premise that the mediation terminal 102 implements the above functions is to implement monitoring and hijacking of the network access request sent by the network access requesting end 101. The specific implementation manner of the first request message for intercepting and hijacking the network access requesting end may be various; one of the most probable ways is to inject the hook function into the network access request by using a global DLL injection manner as described above. In the http process and the https process, the network access request sent by the network access requesting end 101, that is, the first request message, is monitored and hijacked by the hook function. The hook function arranged in the http process of the network access requesting end and the https process in advance in the global DLL injection manner for realizing the above-mentioned snooping and hijacking should be regarded as a part of the mediation end 102. The process of the Hook function to implement the monitoring and hijacking is a technical means commonly used in the technical field, and will not be described in detail herein.

After the first request message is hijacked, the network access request (ie, the first request message) will not be able to directly access the server of its target URL, but the first request message is obtained by the intermediary 102, and The authentication information is added to the first request message to obtain a second request message.

The authentication information is used to prove that the user or the terminal that issued the access request has the access authority of the internal network server 103 to be accessed. The authentication information may adopt the following information: unique identification information of the terminal device where the network access request end is located; user identity authentication information. The above two types of authentication information may be used separately or simultaneously. Before the authentication information is added, the authentication information needs to be encrypted by an asymmetric encryption algorithm.

The unique identification information of the terminal device where the access requesting end 101 is located refers to the identification information of the terminal device, such as a laptop computer or a mobile phone, a tablet computer, etc., where the access requesting end 101 is arranged, such as the hardware serial number of the device or IMEI identification and other unique identifiers corresponding to the terminal device; since the mobile terminal devices are currently mainstream, these devices are directly associated with personal identity. Therefore, access rights to the intranet can be directly associated with a device, for example, can be set A mobile phone or an iPad has access to an internal network. Therefore, the unique identification information of the terminal device, whether it is the hardware serial number or the IMEI identifier, can be used to determine whether the access request has access rights. The information is added to the network access request, that is, the internal network server can determine whether the network access request has the access authority. Since the mediator 102 is generally located in the same hardware device as the network access requesting end 101, the hardware serial number or the IMEI identifier of the hardware device in which the mediator 102 is located can be directly read by the mediator 102; The hardware environment of the specific device is related to the system environment, and those skilled in the art can conveniently obtain related technical means. In addition, if the mediation end 102 is not disposed on the same hardware device as the network access requesting end 101, the hardware serial number or IMEI of the hardware device in which the network access requesting end 101 is disposed may be externally read. The identifier that identifies and corresponds to the network access requesting end 101 is recorded in the mediation terminal 102. In the case that the network access request from the network access requesting end 101 is intercepted, the corresponding network access requesting end can be directly used. The unique identification information of the terminal device of 101 is used as the authentication information.

The user identity authentication information is authentication information directly corresponding to a specific visitor, for example, an identity ID provided to a certain visitor for accessing an internal network; the information is managed and issued by the internal network server 103. The intermediary 102 stores the user identity authentication information directly related to the identity of the visitor, and adds the user identity authentication information to the first request message, so that the internal network server 103 can determine whether the party that issued the network request has the internal The basis for the access rights of the internal network managed by the web server 103.

Specifically, the manner of adding the authentication information to the first request message may take a plurality of possible manners. A method that may be mainly used is to add the authentication information to the header information of the first request message. Resolving the first request message to obtain its original header information; adding the authentication information to the header information in a preset format, and obtaining processed header information with the added authentication information; The header information is used as new header information, and the original header information in the first request message is replaced to obtain the second request information. The second request message may be used as a network request sent to a target network address of the first request message; naturally, the target network address of the second request message is directed to the internal network server 103.

After the mediator 102 sends the second request message to the internal network server 103, if the authentication is passed, the response message returned by the internal network server 103 is received; the mediator 102 needs to parse the response message. It is known that the response message is a response to which network access requester requests, and then sends the response message to the corresponding network access requester.

It should be further noted that the intermediary 102 first acts as a substitute for the server, establishes a process of http communication or https communication with the network access requesting end 101, and then acts as a substitute for the client, and the internal network server. The establishment of http communication or https communication, in the above process, must be carried out according to the communication rules of the corresponding protocol, including the handshake process of the initial communication; for the above different network protocols, the specific implementation process of the above two steps is different, the following respectively Explain.

For the manner of implementing the foregoing process by using the http protocol, reference may be made to FIG. 2, which is specifically described below in conjunction with FIG. 2.

If the network access request sent by the network access requesting end adopts the http protocol, the intermediary 102 first receives the connection request 1, the intermediary 2 and the network access request when receiving the first request message. The terminal performs handshake 2 to establish a TCP connection; when receiving the http request 3 of the first request message (a specific request during the execution of the http protocol), the intermediary 102 initiates a DNS according to the host field stored therein. Requesting, etc., obtaining an IP address of an internal network server pointed to by the network access request, and requesting establishing a connection relationship 4 with the internal network server 103 to be accessed; the internal network server 103 and the intermediary 102 After the handshake is performed, the second request message 6 obtained by adding the authentication information to the first request message obtained in the http request 3 step may be forwarded to the internal device. Web server 103; the internal network server 103 verifies the response http request 7; the mediator 102 forwards the received response message 8 to the network access Seeking end 101, to achieve a complete visit - response process; of course, a connection process may contain several http request and response process, part of the handshake may be performed only once.

For the manner of implementing the foregoing process by using the https protocol, reference may be made to FIG. 3, which is specifically described below in conjunction with FIG. 3.

If the network access request sent by the network access requesting end uses the https protocol, the intermediate end 102 performs an SSL handshake with the network access requesting end during the connection process before receiving the first request message. Then, the mediator performs an SSL handshake with the internal network server according to the server_name field provided by the SSL handshake 2'; the server_name field is the meaning of the server name, because the corresponding IP address may point to different The server needs a corresponding CA certificate for each server, so you need to use the server_name field to determine which CA certificate to use.

After the mediator 102 receives the signal handshake success 3', the mediator 102 sends a signal handshake success 4' to the network access requester 101; thereafter, the network access requester 101 can go to the mediation end. 102 initiates an https request, that is, a first request message 5'; after the intermediary 102 adds the authentication information to form a second request message, the second terminal sends a second request message 6' to the internal network server 103, the internal network server. After the verification 103 returns a response message 7', the intermediary 102 forwards the response message 8' to the network access requesting end 101, and the subsequent https request message and the response message of the secondary connection are still forwarded by the intermediary 102.

In general, whether the http request or the https request is used, the intermediary 102 is used as a server for transfer, and the intermediary 102 handshakes and connects with the network access requester 101 and the internal network server 103, respectively. At the beginning of the forwarding, the authentication information is added to the first request message. After the authentication succeeds, the message from the other party can be continued to be forwarded to one party.

The internal network server 103 is configured to receive the second request message, extract authentication information therefrom, and determine whether the network access request has access rights; if yes, return a response message.

In the present application, the internal network server 103 refers to a server capable of receiving a network access request through a network and serving as an entrance to a specific internal network. In this embodiment, the internal network server 103 is the target network address of the network access requesting end 101 and the mediation end 102, and the purpose thereof is to receive network access request information and provide response information according to the network access request information.

Adding the authentication information to the first request message of the network access requesting end 101 by the intermediary 102 to form a second request message, forwarding the second request message, and the internal network server 103 and the After the middle end 102 successfully hands over and establishes a connection relationship, the internal network server 103 receives the second request message including the authentication information, analyzes it, and determines its legality, that is, whether it is an access request with access rights. .

In this embodiment, the process of determining the validity of the second request message may be implemented by analyzing the header information of the second request message. In the foregoing description of the mediation end 102, the second request message The header information is processed post header information to which the authentication information is added, the encrypted authentication information is extracted from the header information, and the encrypted information is encrypted by a decryption method corresponding to an asymmetric encryption algorithm. The authentication information is decrypted to obtain authentication information, and the authentication information is at least one of unique identification information of the terminal device and user identity authentication information, because the authentication information is preset by the internal network server 103. And managing, the internal network server 103 pre-stores a terminal device list and a user list for which access is permitted, and therefore, the process of determining whether the network access request has access rights is substantially identifying and matching the authentication information. a process, the specific matching process includes at least one of: following the end of the decrypted authentication information The unique identification information of the device is compared with the list of terminal devices allowed to be accessed by the server itself, and it is determined whether the terminal device that issued the access request is in the list; according to the decrypted user identity authentication information and the The server itself stores a list of users allowed to access, and determines whether the user who issued the access request is in the list. If the matching result is consistent, it indicates that the access request has access rights, and the internal network server 103 immediately generates corresponding response information according to the message content (first request message) of the second request message, and points to the mediation end. 102 transmits the response information.

The process of returning the response information by the internal network server 103 has been described in the above description of the mediator 102, and details are not described herein again.

The second embodiment of the present application provides a method for securely accessing an internal network. Please refer to FIG. 4 for an understanding of the embodiment. FIG. 4 is a flowchart of the method for securely accessing an internal network.

The method provided in this embodiment has the same technical content as the system provided in the foregoing first embodiment, and the main body in the foregoing embodiment is mainly used as an implementation body of the method, and the technology in this embodiment is related to the technology in this embodiment. For details, refer to the related content of the foregoing first embodiment, and details are not described herein again.

As shown in FIG. 4, the method for securely accessing an internal network includes the following steps:

S101. Hijack a network access request issued by an application having a network access function; the network access request is referred to as a first request message.

The purpose of this step is to receive the original access request information. The original access request information is the first request message, and is sent by the network application requesting end such as the APP application or the browser to the destination server accessed by the network by using the http protocol or the https protocol.

The network access request issued by the application having the network access function refers to monitoring and hijacking the network access request originally sent to the destination server to receive the network access request first. In this embodiment, the hijacking process is: injecting a hook function into an http access process or an https access process by using a global DLL injection method.

When the first request message is hijacked, if the first request message is sent by using the http protocol, the sender of the first request message needs to perform an http handshake and handshake before receiving the first request message. After the success, the sender of the first request message may send the first request message; if the first request information is sent by using the https protocol, the CA pseudo certificate needs to be imported before the first request message is hijacked. And before the receiving the first request message, performing an SSL handshake with the sender of the first request message and the subsequent destination server, and after the success of the series of SSL handshakes, the sender of the first request message can be Sending the first request message.

S102. Add authentication information to the first request message to form a second request message.

The foregoing steps are performed to hijack the first request message, and the step is to add authentication information to the first request message to form a second request message, which is used to prove that the first request message is sent. The requesting end has access rights to the destination server to be accessed. The authentication information may adopt the following information: the unique identification information of the terminal device where the network access request end is located; the user identity authentication information, and the two types of the authentication information may be adopted separately or simultaneously. After the authentication information is encrypted by the asymmetric encryption algorithm, it is added in the header information of the first request message.

S103. Forward the second request message to a destination server of the network access request, that is, an internal network server.

The purpose of this step is to forward the second request message formed by the above steps to the destination server accessed by the network. The destination server in the present application is an internal network server.

Before forwarding the second request message to the internal network server, first establishing a contact with the internal network server, specifically: if the HTTP protocol is used, performing an http handshake with the internal network server; The https protocol is sent, and the SSL handshake with the sender of the first request message and the internal network server is completed in the step S101, the process is: the connection process before receiving the first request message And performing an SSL handshake with the network access requesting end, and then performing an SSL handshake with the internal network server according to the server_name field provided by the SSL handshake.

The second request message includes authentication information and the first request message, and the internal network server extracts the authentication information from the second request message, and the authentication information is obtained by a corresponding decryption method of an asymmetric encryption algorithm. Decrypting is performed, and it is determined whether the network access request has access authority according to the authentication information; if yes, a response message is returned.

S104. Receive response information returned by the internal network server.

When the result of the foregoing step is that the network access request has access rights and the internal network server returns response information, the step is configured to receive the returned response information.

S105. Forward the response information to the application that sends the network access request.

This step is for forwarding the received response information to the application that issues the network access request. The process needs to parse the response information, obtain a response to the network access request of the network application, and then send the response message to the corresponding network application.

A third embodiment of the present application provides a method for a server to receive an access. Please refer to FIG. 5 for an embodiment. FIG. 5 is a flowchart of a method for the server to receive an access.

The method provided in this embodiment has the same technical content as the system provided in the first embodiment, and the internal network server in the foregoing embodiment is mainly used as an implementation body of the method, and the embodiment and the foregoing For the technical details of the second embodiment, please refer to the related content of the first embodiment and the second embodiment, and details are not described herein again.

As shown in FIG. 5, the method for receiving access by the server includes the following steps:

S201. Acquire an access request that includes authentication information, and the access request is referred to as a second request message.

The purpose of this step is to receive an access request.

The access request including the authentication information refers to the second request message forwarded in step S103 in the second embodiment.

S202. Extract the authentication information.

The function of this step is to extract the authentication information in the second request message, and determine whether the user or the terminal that sent the access request has the access right by using the authentication information.

S203. Determine, according to the authentication information, whether the access request is legal.

This step is used to decrypt the authentication information, and thereby verify the validity of the access request.

The authentication information is encrypted by using an asymmetric encryption algorithm. Therefore, in this embodiment, the authentication information is decrypted by using a decryption method corresponding to the asymmetric encryption algorithm, and the decrypted authentication information includes at least one of the following information: The unique identification information of the terminal device, the user identity authentication information; correspondingly, the manner of verifying the validity of the access request includes at least one of the following manners: according to the uniqueness of the terminal device included in the decrypted authentication information The identification information is compared with the list of terminal devices allowed to be accessed by the server itself, determining whether the terminal device that issued the access request is in the list; and storing the decrypted user identity authentication information with the server itself The list of allowed users is compared, and it is determined whether the user who issued the access request is in the list.

S204, if yes, return a response message.

This step is used to respond accordingly according to the judgment result of the above step. If the judgment result proves that the access request has legality, the corresponding response information is returned according to the access request.

The fourth embodiment of the present application provides a data processing method. Please refer to FIG. 6 to understand the embodiment. FIG. 6 is a flowchart of a method for receiving access by the server.

As shown in FIG. 6, the data processing method includes the following steps:

S301. The first network access request is intercepted, where the first network access request includes a source address and a target address.

S302. Add authentication information to the first network access request to obtain a second network access request.

The authentication information includes at least one of the following information: unique identification information of the computing device corresponding to the source address; user identity authentication information.

S303. Send the second network access request to a computing device corresponding to the target address.

S304. Receive response information returned by the computing device corresponding to the target address.

S305. Send the response information to a computing device corresponding to the source address.

The method for data processing provided by this embodiment is substantially the same as the system for providing secure access to the internal network provided by the system provided by the first embodiment and the second embodiment, and only has a description in the expression. Adjustment. The implementation body of this embodiment is the mediation end in the first embodiment. The computing device corresponding to the source address in this embodiment represents the network access requesting end in the first embodiment. The computing device corresponding to the target address represents an internal network server in the first embodiment; the first network access request represents a first request message in the second embodiment, and the second network access request represents the The second request message in the second embodiment; for related content, refer to the first embodiment and the second embodiment of the present application, and details are not described herein again.

The fifth embodiment of the present application provides a data response method. Please refer to FIG. 7 for an understanding of the embodiment. FIG. 7 is a flowchart of the data response method.

As shown in FIG. 7, the method for data response includes the following steps:

S401. Acquire a network access request that includes authentication information.

S402. Extract the authentication information from the network access request.

S403. Determine, according to the authentication information, whether the network access request is legal.

S404, if yes, return response information.

A method for data response provided by this embodiment is substantially the same as the system provided by the first embodiment and the method for receiving access by the server provided by the third embodiment, and is only adjusted in the description. The implementation body of this embodiment is the internal network server in the first embodiment. For related content, please refer to the first embodiment and the third embodiment of the present application, and details are not described herein again.

The sixth embodiment of the present application provides an apparatus for securely accessing an internal network. Please refer to FIG. 8 to understand the embodiment. FIG. 8 is a schematic diagram of an apparatus for securely accessing an internal network according to the embodiment.

As shown in FIG. 8, the apparatus for securely accessing an internal network includes:

a first request message hijacking unit 201, configured to hijack a network access request issued by an application having a network access function; the network access request is referred to as a first request message;

The authentication information adding unit 202 is configured to add authentication information to the first request message to form a second request message.

a second request message forwarding unit 203, configured to forward the second request message to a destination server of the network access request, that is, an internal network server;

The response information receiving unit 204 is configured to receive response information returned by the internal network server;

The response information forwarding unit 205 is configured to forward the response information to the application that sends the network access request.

The seventh embodiment of the present application provides a device for receiving access by a server. Please refer to FIG. 9 for an understanding of the embodiment. FIG. 9 is a schematic diagram of a device for receiving access by a server according to the embodiment.

As shown in FIG. 9, the apparatus for receiving access by the server includes:

The access request obtaining unit 301 is configured to acquire an access request that includes authentication information, and the access request is referred to as a second request message.

The authentication information extracting unit 302 is configured to extract the authentication information;

The access request legality determining unit 303 is configured to determine, according to the authentication information, whether the access request is legal;

The response message returning unit 304 is configured to return a response message when the result of the above-mentioned unit is YES.

The eighth embodiment of the present application provides a device for data processing. Please refer to FIG. 10 for an embodiment of the present invention. FIG. 10 is a schematic diagram of a device for data processing according to the embodiment.

As shown in FIG. 10, the apparatus for data processing includes:

The first network access request intercepting unit 401 is configured to intercept the first network access request, where the first network access request includes a source address and a target address;

The authentication information adding unit 402 is configured to add the authentication information to the first network access request to obtain a second network access request.

a second network access request sending unit 403, configured to send the second network access request to a computing device corresponding to the target address;

The response information receiving unit 404 is configured to receive response information returned by the computing device corresponding to the target address;

The response information sending unit 405 is configured to send the response information to the computing device corresponding to the source address.

Preferably, the authentication information includes at least one of the following information: unique identification information of the computing device corresponding to the source address; user identity authentication information.

The ninth embodiment of the present application provides a device for data response. Please refer to FIG. 11 for an understanding of the embodiment. FIG. 11 is a schematic diagram of a device for responding to data according to the embodiment.

As shown in FIG. 11, the device for responding to the data includes:

The network access request obtaining unit 501 is configured to acquire a network access request that includes the authentication information.

The authentication information extracting unit 502 is configured to extract the authentication information from the network access request.

The network access request legality determining unit 503 is configured to determine, according to the authentication information, whether the network access request is legal;

The response information returning unit 504 is configured to return a response message when the determination result of the above unit is YES.

A tenth embodiment of the present application provides an electronic device. Referring to FIG. 12, it is a schematic diagram of an embodiment of the device. Since the device embodiment is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment. The device embodiments described below are merely illustrative.

The electronic device includes: a processor 601; a memory 602. The memory 602 is configured to store a program for securely accessing an internal network. After the device is powered on and runs the program for securely accessing the internal network through the processor 601, the following steps are performed:

Hijacking a network access request issued by an application having a network access function; the network access request is referred to as a first request message; adding authentication information to the first request message to form a second request message; and the second request message is Forwarding to the destination server of the network access request, ie, the internal network server; receiving response information returned by the internal network server; forwarding the response information to the application that issues the network access request.

An eleventh embodiment of the present application provides an electronic device. Referring to FIG. 13, a schematic diagram of an embodiment of the device is shown. Since the device embodiment is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment. The device embodiments described below are merely illustrative.

The electronic device includes: a processor 701; a memory 702. The memory 702 is configured to store a program that the server receives the access, and after the device is powered on and runs the program that is received by the server 701, the following steps are performed:

Acquiring an access request including the authentication information, the access request is referred to as a second request message; extracting the authentication information; determining, according to the authentication information, whether the access request is legal; if yes, returning a response message.

The twelfth embodiment of the present application provides an electronic device. Please refer to FIG. 14, which is a schematic diagram of an embodiment of the device. Since the device embodiment is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment. The device embodiments described below are merely illustrative.

The electronic device includes: a processor 801; a memory 802. The memory 802 is configured to store a program for data processing. After the device is powered on and runs the program of the data processing by the processor 801, the following steps are performed:

Intercepting a first network access request, where the first network access request includes a source address and a target address; adding authentication information to the first network access request to obtain a second network access request; and accessing the second network access The request is sent to the computing device corresponding to the target address; the response information returned by the computing device corresponding to the target address is received; and the response information is sent to the computing device corresponding to the source address.

A thirteenth embodiment of the present application provides an electronic device. Referring to FIG. 15, a schematic diagram of an embodiment of the device is shown. Since the device embodiment is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment. The device embodiments described below are merely illustrative.

The electronic device includes: a processor 901; a memory 902. The memory 902 is configured to store a program for data response. After the device is powered on and runs the program of the data response by the processor 901, the following steps are performed:

Obtaining a network access request that includes the authentication information; extracting the authentication information from the network access request; determining, according to the authentication information, whether the network access request is legal; if yes, returning the response information.

The present invention is disclosed in the above preferred embodiments, but it is not intended to limit the present invention, and any one skilled in the art can make possible variations and modifications without departing from the spirit and scope of the invention. The scope of protection should be determined by the scope defined by the claims of the present invention.

The present application is disclosed in the above preferred embodiments, but it is not intended to limit the present application, and any person skilled in the art can make possible changes and modifications without departing from the spirit and scope of the present application. The scope of protection should be based on the scope defined by the claims of the present application.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

The memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory. Memory is an example of a computer readable medium.

1. Computer readable media including both permanent and non-persistent, removable and non-removable media may be implemented by any method or technology. The information can be computer readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape storage or other magnetic storage devices or any other non-transportable media can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include non-transitory computer readable media, such as modulated data signals and carrier waves.

2. Those skilled in the art will appreciate that embodiments of the present application can be provided as a method, system, or computer program product. Thus, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment in combination of software and hardware. Moreover, the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

Claims

A system for implementing secure access to an internal network, comprising: a network access requesting end, a mediation end, and an internal network server;

The network access requesting end is configured to send a first request message for implementing a network access request, and receive a response message;

The mediation end is configured to listen to and hijack the first request message of the network access requesting end; parse the first request message, and add authentication information to the first request message to obtain a second request message; Sending, by the target network address of the first request message, the second request message; and receiving a response message to the second request message, and forwarding the response message to the client;

The internal network server is configured to receive the second request message, extract authentication information therefrom, and determine whether the network access request has access rights; if yes, return a response message.
The system of claim 1 wherein said mediator and said network access requesting end are disposed in the same mobile device.
The system according to claim 1, wherein the network access request sent by the network access requesting end adopts an http protocol, and the mediator requests the network access request before receiving the first request message. The end performs an http handshake, and the intermediary performs an http handshake with the internal network server before issuing the second request message.
The system according to claim 1, wherein the network access request sent by the network access requesting end adopts an https mode, and the mediation request and the network access request before receiving the first request message by the mediation end Ending an SSL handshake, and then the intermediary sends an SSL handshake with the internal network server according to the server_name field provided by the SSL handshake; after receiving the handshake success message returned by the internal network server, the intermediary sends a handshake message to the internal network server. The network access requesting end sends a handshake success message.
The system according to claim 4, wherein the CA pseudo certificate is imported to the network access requesting end and the intermediation end before the network access request is made.
The system according to claim 1, wherein the authentication information comprises at least one of the following: unique identification information of the terminal device where the network access request end is located; user identity authentication information.
The system of claim 1 wherein said authentication information is encrypted by an asymmetric algorithm.
The system according to claim 1, wherein the global traffic hijacking process is injected into the network access request initiated by the network access requesting end by means of DLL injection to implement hijacking of the first request message.
A method for securely accessing an internal network, comprising:

Hijacking a network access request issued by an application having a network access function; the network access request is referred to as a first request message;

Adding authentication information to the first request message to form a second request message;

Forwarding the second request message to a destination server of the network access request, that is, an internal network server;

Receiving response information returned by the internal network server;

The response information is forwarded to the application that issued the network access request.
The method for securely accessing an internal network according to claim 9, wherein in the step of hijacking a network access request issued by an application having a network access function, the network access request is hijacked by a hook function; The hook function is injected into the network access request process in advance by DLL injection.
The method for securely accessing an internal network according to claim 9, wherein, in the case that the first request message is in the http mode, before receiving the first request message, including the sending of the network access request The application performs an http handshake; and performs an http handshake with the internal network server before issuing the second request message.
The method for securely accessing an internal network according to claim 9, wherein the network access request is in an https manner, and an SSL handshake is performed with the network access requesting end before receiving the first request message. Then, according to the server_name field provided by the SSL handshake, an SSL handshake is performed with the internal network server; after receiving the handshake success message returned by the internal network server, a handshake success message is sent to the application that sends the network access request.
The method for securely accessing an internal network according to claim 12, wherein the CA pseudo certificate is imported before the network access request issued by the application having the network access function is hijacked.
The method for securely accessing an internal network according to claim 9, wherein the authentication information comprises at least one of the following: unique identification information of the terminal device; user identity authentication information.
The method for securely accessing an internal network according to claim 9, wherein the authentication information is encrypted using an asymmetric encryption algorithm.
A method for receiving access by a server, comprising:

Obtaining an access request that includes authentication information, and the access request is referred to as a second request message;

Extracting the authentication information;

Determining whether the access request is legal according to the authentication information;

If yes, return a response message.
The method according to claim 16, wherein the authentication information is encrypted by using an asymmetric encryption algorithm, and determining whether the access request is legal according to the authentication information comprises:

Decrypting the authentication information, where the authentication information includes at least one of the following information: unique identification information of the terminal device, user identity authentication information;

Verifying the validity of the access request based on the decrypted authentication information.
The method according to claim 17, wherein the verifying the validity of the access request according to the decrypted authentication information comprises at least one of the following manners:

Determining, according to the unique identification information of the terminal device included in the decrypted authentication information, that the terminal device that issued the access request is in the list, compared with the terminal device list that is allowed to be accessed by the server itself;

Determining, according to the decrypted user identity authentication information, a user list that is allowed to be accessed by the server itself, determining whether the user who issued the access request is in the list.
A data processing method, comprising:

Intercepting a first network access request, where the first network access request includes a source address and a target address;

Adding authentication information to the first network access request to obtain a second network access request;

Sending the second network access request to a computing device corresponding to the target address;

Receiving response information returned by the computing device corresponding to the target address;

Sending the response information to a computing device corresponding to the source address.
The method according to claim 19, wherein the authentication information comprises at least one of the following: unique identification information of the computing device corresponding to the source address; user identity authentication information.
A data response method, comprising:

Obtain a network access request containing authentication information;

Extracting the authentication information from the network access request;

Determining, according to the authentication information, whether the network access request is legal;

If yes, return a response message.
An electronic device, comprising:

Processor;

a memory for storing a program for securely accessing an internal network, the device is powered on and runs the program for secure access to the internal network through the processor, and performs the following steps:

Hijacking a network access request issued by an application having a network access function; the network access request is referred to as a first request message;

Adding authentication information to the first request message to form a second request message;

Forwarding the second request message to a destination server of the network access request, that is, an internal network server;

Receiving response information returned by the internal network server;

The response information is forwarded to the application that issued the network access request.
An electronic device, comprising:

Processor;

a memory for storing a program for receiving access by the server, after the device is powered on and running the program by the processor to receive the accessed program, performing the following steps:

Obtaining an access request that includes authentication information, and the access request is referred to as a second request message;

Extracting the authentication information;

Determining whether the access request is legal according to the authentication information;

If yes, return a response message.
An electronic device, comprising:

Processor;

a memory for storing a program for data processing, after the device is powered on and runs the program of the data processing by the processor, performing the following steps:

Intercepting a first network access request, where the first network access request includes a source address and a target address;

Adding authentication information to the first network access request to obtain a second network access request;

Sending the second network access request to a computing device corresponding to the target address;

Receiving response information returned by the computing device corresponding to the target address;

Sending the response information to a computing device corresponding to the source address.
An electronic device, comprising:

Processor;

a memory for storing a program for data response, after the device is powered on and runs the program of the data response by the processor, performing the following steps:

Obtain a network access request containing authentication information;

Extracting the authentication information from the network access request;

Determining, according to the authentication information, whether the network access request is legal;

If yes, return a response message.