WO2020248369A1

WO2020248369A1 - Firewall switching method and related apparatus

Info

Publication number: WO2020248369A1
Application number: PCT/CN2019/102347
Authority: WO
Inventors: 王绪军; 黄成尧; 谢文
Original assignee: 平安科技（深圳）有限公司
Priority date: 2019-06-10
Filing date: 2019-08-23
Publication date: 2020-12-17
Also published as: CN110324826A; CN110324826B

Abstract

Disclosed in embodiments of the present invention are a firewall switching method and a related apparatus, which are suitable for access control in security protection, the method comprising: an intranet firewall distribution device obtaining access device status information that a mobile wireless access device is connected to a first intranet firewall of a target intranet; when the intranet firewall distribution device determines that the mobile wireless access device meets conditions for switching the connected firewall, determining a second intranet firewall matched by the mobile wireless access device; once the mobile wireless access device establishes a connection to the second intranet firewall and disconnects from the first intranet firewall, by means of connecting to the second intranet firewall, providing a service of accessing the target intranet to a user terminal. By means of the present application, the efficiency with which users access the target intranet may be improved, and the access quality of accessing the target intranet is ensured.

Description

A firewall switching method and related device

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on June 10, 2019, the application number is 2019105036765, and the application name is "a method for accessing an intranet and related devices", the entire content of which is incorporated herein by reference Applying.

Technical field

This application relates to the field of communications, and in particular to a firewall switching method and related devices.

Background technique

With the integration of the global economy, more and more companies have carried out related businesses all over the world, which requires company employees to be dispatched to work around the world. In some office scenarios, corporate employees in other places need to access some resources of the company's intranet server, such as accessing corporate intranet webpages, accessing files stored in shared folders in intranet file servers, and so on. In the traditional way, it is usually implemented through a VPN (Virtual Private Network), which requires a VPN server to be established on the company's intranet. After external employees connect to the Internet through mobile phones, computers, etc., they connect to the VPN of the corporate intranet through the Internet. Server, and then access the corporate intranet through the VPN server. When enterprise employees connect to the intranet through computers and other terminals, they need to configure the parameters of the intranet VPN connection in advance, such as the address of the intranet VPN server, the user's login name and password, etc., and then dial and connect. Many user operations and long waiting time affect the connection efficiency.

Application content

This application provides a firewall switching method and related devices. Through this application, the efficiency of a user's access to a target intranet can be improved, and the network quality of the access to the target intranet can be guaranteed.

The first aspect of the embodiments of the present application provides a firewall switching method, including:

The intranet firewall distribution device obtains the status information of the access device connected to the mobile wireless access device and the first intranet firewall of the target intranet, and the first intranet firewall is the target device after receiving the mobile wireless access device After the intranet connection request of the target intranet, the firewall that matches the mobile wireless access device is determined from the multiple intranet firewalls deployed for the target intranet according to the intranet connection request, and the access The device status information includes the real-time geographic location of the mobile wireless access device;

When the intranet firewall distribution device determines based on the real-time geographic location that the mobile wireless access device satisfies the conditions for switching the connected firewall, it selects multiple devices deployed for the target intranet based on the access device status information. Determine the second intranet firewall matched by the mobile wireless access device in the intranet firewall;

The intranet firewall allocation device sends the second IP address of the second intranet firewall to the mobile wireless access device, so that the mobile wireless access device communicates with the first IP address according to the second IP address Second, the internal network firewall establishes a connection, and after the connection with the first internal network firewall is disconnected, the second internal network firewall transmits the internal network for the target internal network sent by the user terminal through the mobile wireless access device The access request is routed to the intranet server of the target intranet, and the second intranet firewall also passes the intranet request response message returned by the intranet server in response to the intranet access request through the mobile wireless access device Sent to the user terminal.

The second aspect of the embodiments of the present application provides an intranet firewall distribution device, including:

The status acquiring unit is configured to acquire the status information of the access device connected to the first intranet firewall of the target intranet by the mobile wireless access device, and the first intranet firewall is configured to receive the information sent by the mobile wireless access device After the intranet connection request for the target intranet, the firewall that matches the mobile wireless access device is determined from the multiple intranet firewalls deployed for the target intranet according to the intranet connection request, and the connection The incoming device status information includes the real-time geographic location of the mobile wireless access device;

The firewall determining unit is configured to, when it is determined according to the real-time geographic location that the mobile wireless access device meets the conditions for switching the connected firewall, select from multiple internal networks deployed for the target intranet according to the access device status information. Determine a second intranet firewall that matches the mobile wireless access device in the network firewall;

The address sending unit is configured to send the second IP address of the second intranet firewall to the mobile wireless access device, so that the mobile wireless access device communicates with the second IP address according to the second IP address. After the intranet firewall establishes a connection and disconnects from the first intranet firewall, the second intranet firewall transmits the intranet access request for the target intranet sent by the user terminal through the mobile wireless access device Routed to the intranet server of the target intranet, the second intranet firewall also sends the intranet request response message returned by the intranet server in response to the intranet access request to the mobile wireless access device The user terminal.

The third aspect of the embodiments of the present application provides an intranet firewall distribution device, including a processor, a memory, and a communication interface. The processor, the memory, and the communication interface are connected to each other, wherein the communication interface is used to receive and send data The memory is used to store program code, and the processor is used to call the program code. When the program code is executed by a computer, the computer executes any of the above-mentioned first aspect and each possible implementation of the first aspect. Any method.

The fourth aspect of the embodiments of the present application provides a computer non-volatile readable storage medium, the computer non-volatile readable storage medium stores a computer program, the computer program includes program instructions, and the program instructions are When executed by a computer, the computer is caused to execute any one of the foregoing first aspect and each possible implementation manner of the first aspect.

Through the embodiments of this application, the user does not need to configure any parameters before accessing the target intranet, which improves the access efficiency for the target intranet. At the same time, the intranet firewall distribution device determines that the mobile wireless access device meets the requirement of switching the connected firewall based on the real-time geographic location. When the conditions are met, the second intranet firewall is re-allocated for the mobile wireless access device to ensure that the intranet firewall connected to the mobile wireless access device is always the optimal intranet firewall that matches the status information of the access device, ensuring users The network quality of the terminal accessing the intranet.

Description of the drawings

FIG. 1 is a schematic diagram of a framework of an intranet access system provided by an embodiment of this application;

2 is a schematic diagram of system interaction of a firewall switching method provided by an embodiment of this application;

3 is a schematic diagram of system interaction of another firewall switching method provided by an embodiment of the application;

4 is a schematic structural diagram of an intranet firewall distribution device provided by an embodiment of the application;

Fig. 5 is a schematic structural diagram of another intranet firewall distribution device provided by an embodiment of the application.

Detailed ways

In the following, the firewall switching method and related devices provided by the embodiments of the present application will be described with reference to FIGS. 1 to 5.

Figure 1 is a schematic diagram of the framework of an intranet access system provided by an embodiment of the application. As shown in the figure, in the framework of the intranet access system, the intranet firewall 1, the intranet firewall 2, and the intranet firewall 3 are targeted Three intranet firewalls deployed in the intranet, mobile wireless access device 1 and mobile wireless access device 2 are respectively connected to the intranet firewall 1, the mobile wireless access device 3 is connected to the intranet firewall 3, and the user terminal 1 and The mobile wireless access device 2 is connected, and the user terminal 2 is connected with the mobile wireless access device.

Here, the target intranet is a local communication network that interconnects various computers, servers, and databases in a local geographic area of a specific enterprise, a specific institution, a specific school, etc. When the terminal or server in the target intranet communicates with the terminal or server in the target intranet, it is realized through the data link layer, and the communication message does not need to be routed through the router; in the terminal or server outside the target intranet When communicating, it is achieved through the network layer. The communication message sent by the terminal or server in the target intranet needs to be routed to the terminal or server outside the target intranet, the terminal or the terminal outside the target intranet, and The communication message returned by the server needs to be routed to the terminal or server on the target intranet after the router undergoes network address translation.

Here, the intranet firewall deployed for the target intranet can be a firewall deployed around the world for filtering data packets entering and leaving the target intranet. The intranet firewall is connected to the router of the target intranet through the WAN, and then passes through the target intranet. The router realizes the connection to the intranet server of the target intranet.

Here, the mobile wireless access device is a mobile wireless access device that can transmit wireless network signals and has a routing function. The mobile wireless access device will access the data network by inserting a SIM (Subscriber Identification Module) card. It can also access a wired network by inserting a network cable, and can also access a wireless network by connecting to WIFI. The user terminal can access the wireless network transmitted by the mobile wireless access device to connect with the mobile wireless access device.

Here, the intranet firewall distribution device may be a device that has a domain name resolution function for the target intranet, and stores the IP addresses and deployment locations of each intranet firewall deployed for the target intranet, such as GTM (Global Traffic Manager, global traffic manager) Management) equipment, etc.

Here, the user terminal may be a terminal device with a wireless network receiving function, such as a notebook computer, a mobile phone, and a tablet computer.

Referring to Figure 2, Figure 2 is a schematic diagram of system interaction of a firewall switching method provided by an embodiment of the application. As shown in the figure, the method may include:

S201: The mobile wireless access device sends an intranet connection request for the target intranet to the intranet firewall distribution device.

Specifically, the mobile wireless access device may send an intranet connection request to the intranet firewall distribution device after being triggered to start, or it may be after receiving a function start instruction sent by the user to access the target intranet Later, sending an intranet connection request to the intranet firewall distribution device, or when receiving an intranet access request for the target intranet sent by a connected user terminal, sending an intranet connection request to the intranet firewall distribution device Network connection request. The intranet connection request may carry the intranet domain name of the target intranet, so that the intranet firewall distribution device determines the intranet connection request for the target intranet after analyzing the intranet domain name.

S202: The intranet firewall distribution device determines the current geographic location of the mobile wireless access device according to the intranet connection request.

Specifically, the intranet connection request may carry the geographic location of the mobile wireless access device, and the intranet firewall distribution device directly obtains the geographic location of the mobile wireless access device from the intranet connection request; The intranet connection request may also carry the positioning information of the mobile wireless access device, and the intranet firewall distribution device may obtain the positioning information from the intranet connection request, and use positioning technology according to the positioning information , Determine the location of the mobile wireless access device, for example, the positioning information may be the IP address of the mobile wireless access device, GPS data, WIFI access point information, connection base station information, etc., the positioning technology It can be IP positioning technology, GPS positioning technology, WIFI positioning technology, base station positioning technology, etc.

Here, the intranet connection request sent by the mobile wireless access device may carry the identity verification information of the mobile wireless access device, and the intranet firewall distribution device may send a check to the mobile according to the identity verification information in the intranet connection request. The wireless access device performs identity verification. After the identity verification is passed, the current geographic location of the mobile wireless access device is determined. The identity verification information carried in the intranet connection request may include the access device identification code, the user name and password entered by the user, or One of the digital certificates of mobile wireless access devices.

S203: The intranet firewall allocation device determines a first intranet firewall matched by the mobile wireless access device from a plurality of intranet firewalls deployed for the target intranet according to the current geographic location.

Here, the intranet firewall distribution device can store the IP addresses and deployment locations of the firewalls separately deployed for multiple intranets. For example, there are subsidiary A and subsidiary B for company M, and subsidiary A and subsidiary B respectively. For the internal networks of the respective subsidiaries, and the internal networks need to be connected through the external network, the mobile wireless access device of company M can simultaneously store the IP addresses and deployment locations of each internal network firewall for the deployment of subsidiary A’s internal network , And the IP addresses and deployment locations of each intranet firewall deployed for subsidiary B's intranet. The intranet connection request may carry the intranet domain name of the target intranet, so that the intranet firewall distribution device, after receiving the intranet connection request, resolves the intranet domain name and determines the The intranet connection request is an intranet connection request for the target intranet, and the IP addresses and deployment locations of multiple intranet firewalls deployed for the target intranet are obtained.

Wherein, in an implementation manner for determining the first intranet firewall, the intranet firewall distribution device may determine all the intranet firewalls according to the geographic location and the deployment position of each intranet firewall deployed for the target intranet. Among the multiple intranet firewalls deployed for the target intranet, the intranet firewall closest to the mobile wireless access device is determined to be the first intranet firewall.

In another implementation manner of determining the first intranet firewall, all access areas for the target intranet are divided into intranet access sub-areas for each intranet firewall of the target intranet in advance, and A correspondence relationship between the intranet access sub-area and the intranet firewall of the target intranet is preset in the intranet firewall distribution device. The intranet firewall distribution device determines the first intranet access subregion where the mobile wireless access device is located according to the geographic location of the mobile wireless access device, and then corresponds the first intranet access subregion to The internal firewall of is determined to be the first internal firewall.

S204: The intranet firewall distribution device sends the first IP address of the first intranet firewall to the mobile wireless access device.

S205: The mobile wireless access device establishes a connection with the first intranet firewall according to the first IP address.

Specifically, the mobile wireless access device sends a firewall connection request to the first intranet firewall according to the first IP address, so that the first intranet firewall sends a firewall connection request to the mobile device according to the firewall connection request. After the identity verification of the access device is passed, a connection with the mobile wireless access device is established.

In an implementation manner, the firewall connection request carries the access device identification code of the mobile wireless access device, such as a MAC address, and the first intranet firewall determines that the access device identification code is preset When one of the identification codes of the access device is allowed to be connected, it is determined that the identity authentication of the mobile wireless access device is passed.

In another implementation manner, the firewall connection request carries the user name and password input by the user through the mobile wireless access device, and the first intranet firewall determines that the user name and password are preset users allowed to connect When one of the name and password is set, it is determined that the identity authentication of the mobile wireless access device is passed.

In yet another implementation manner, the firewall connection request carries the digital certificate of the mobile wireless access device, and the first intranet firewall is based on the access device digital certificate carried in the access device digital certificate. The issuer information of the access device determines the certificate issuer of the digital certificate of the access device; after the first intranet firewall obtains the issuer digital certificate of the certificate issuer, it passes the issuer contained in the issuer’s digital certificate The public key is used to decrypt the digital signature in the digital certificate of the access device using the public key of the issuing party to obtain the certificate fingerprint of the digital certificate of the access device. The first intranet firewall will use the specified Kazakhstan The Greek algorithm performs a hash calculation on the digital certificate of the access device to obtain the hash value of the digital certificate; the first intranet firewall determines that the hash value of the digital certificate obtained by the hash calculation of the first intranet firewall is When the fingerprints of the access device certificates are consistent, it is determined that the identity authentication of the mobile wireless access device is passed.

Here, the mobile wireless access device initiates a three-way handshake to establish a connection based on the TCP/IP protocol with the first intranet firewall. The specific steps are as follows: the mobile wireless access device sends a SYN to the first intranet firewall (Synchronize Sequence Numbers) data packet; after receiving the SYN data packet, the first intranet firewall sends a SYN+ACK (ACKnowledge Character) data packet to the mobile wireless access device; After receiving the SYN+ACK data packet, the mobile wireless access device feeds back an ACK data packet to the first intranet firewall; the first intranet firewall receives the ACK fed back by the mobile wireless access device After the data packet, the connection between the mobile wireless access device and the first intranet firewall is established.

S206: The intranet firewall distribution device obtains state information of the access device connected to the mobile wireless access device and the first intranet firewall.

The access device status information may include the real-time geographic location of the mobile wireless access device when the access device status information is acquired, or it may include when the access device status information is acquired, the mobile The network delay between the wireless access device and each intranet firewall deployed for the target intranet. The real-time geographic location of the mobile wireless access device may be determined by the intranet firewall distribution device through IP positioning, GPS positioning, WIFI positioning, base station positioning, and other positioning methods according to the positioning information sent by the mobile wireless access device. , It may also be directly sent by the mobile wireless access device to the intranet firewall. The network delay between the mobile wireless access device and each intranet firewall may be a one-way network delay between the mobile wireless access device and each intranet firewall, or it may be a round trip network delay. The network delay between the mobile wireless access device and each intranet firewall may be determined by the intranet firewall distribution device, or may be determined by the mobile wireless access device or each intranet firewall. , Sent to the intranet firewall distribution device.

S207: When the intranet firewall distribution device determines according to the real-time geographic location that the mobile wireless access device satisfies the conditions for switching the connected firewall, according to the state information of the access device, select the target intranet deployed A second intranet firewall matched by the mobile wireless access device is determined among the plurality of intranet firewalls.

Specifically, the intranet firewall distribution device may periodically obtain the current access device status information of the mobile wireless access device, and then periodically determine the mobile device based on the real-time geographic location contained in the access status information. Whether the wireless access device meets the conditions for switching the connected firewall in the current cycle; it can also obtain the access device status information of the mobile wireless access device when receiving the firewall switching request sent by the mobile wireless access device, and then According to the real-time geographic location included in the access status information, it is determined whether the mobile wireless access device does meet the conditions for switching the connected firewall, and the firewall switching request is that the mobile wireless access device is based on its geographic location, or The network status of the internal network accessed by oneself, etc., to determine that oneself meets the request to switch the connected firewall when the internal network firewall is replaced. For example, the mobile wireless access device monitors the packet loss rate of message transmission between itself and the first intranet firewall, and when it is determined that the packet loss rate is greater than a preset threshold, sends to the intranet firewall distribution device Firewall switch request.

Here, corresponding to the implementation manner in which the intranet firewall distribution device determines the first intranet firewall for the mobile wireless access device in step S203, the intranet firewall distribution device determines the mobile wireless access device Satisfying the condition for switching the connected firewall may include: In an implementation manner, the intranet firewall distribution device obtains the deployment positions of multiple intranet firewalls deployed for the target intranet, and the intranet firewall distribution device The real-time geographic location and the deployment positions of the multiple intranet firewalls deployed for the target intranet determine that the first intranet firewall is not among the multiple intranet firewalls deployed for the target intranet. In the case of the nearest firewall of the mobile wireless access device, it is determined that the mobile wireless access device satisfies the conditions of the firewall connected to the handover; in another implementation manner, the intranet firewall distribution device is determining the mobile wireless access When the incoming device transfers from the first intranet access sub-area to the second intranet access sub-area for the target intranet, it is determined that the mobile wireless access device satisfies the conditions for switching the connected firewall.

An implementation manner in which the intranet firewall distribution device determines a second intranet firewall matched by the mobile wireless access device from a plurality of intranet firewalls deployed for the target intranet according to the access device status information It may be: the intranet firewall distribution device determines the mobile wireless access device corresponding to the mobile wireless access device from a plurality of intranet firewalls deployed for the target intranet according to the real-time geographic location included in the access device status information The second intranet firewall. The intranet firewall distribution device determines the implementation manner of the second intranet firewall according to the real-time geographic location of the mobile wireless access device. For details, refer to the intranet firewall distribution device in step S203 for obtaining according to step S202 The geographic location of the mobile wireless access device determines the implementation manner of the first intranet firewall, which is not repeated here.

S208: The intranet firewall distribution device sends the second IP address of the second intranet firewall to the mobile wireless access device.

S209: The mobile wireless access device establishes a connection with the second intranet firewall according to the second IP address.

Specifically, the mobile wireless access device initiates a three-way handshake to establish a TCP/IP protocol-based connection with the second intranet firewall. For details, refer to the step S205 of the mobile wireless access device and the first intranet firewall The method of establishing a connection will not be described here.

S210: The mobile wireless access device disconnects from the first intranet firewall.

The mobile wireless access device initiates four waves to disconnect the TCP/IP connection with the first intranet firewall. The specific steps are as follows: the mobile wireless access device sends a FIN (Finish) to the first intranet firewall. Character, the end character) data packet; after receiving the FIN data packet, the first intranet firewall sends an ACK data packet to the mobile wireless access device; the first intranet firewall sends an ACK data packet to the mobile wireless access device The incoming device sends a FIN data packet; after receiving the FIN data packet, the mobile wireless access device sends an ACK data packet to the first intranet firewall; the first intranet firewall distribution device receives the ACK After the data packet, the disconnection of the connection between the mobile wireless access device and the first intranet firewall is completed.

S211: The user terminal sends an intranet access request for the target intranet to the mobile wireless access device.

Specifically, before step S211, the user terminal may send a wireless network connection request to the mobile wireless access device, and the mobile wireless access device may directly establish a connection with the user terminal, or through the wireless network After the user terminal identity information carried in the connection request is verified, a connection with the user terminal is established. The user terminal identity information may be the user name and password input by the user inputted by the user terminal to access the wireless network established by the mobile wireless access device, and may also be the biometric input received by the user terminal The information may also be terminal equipment identification information of the user terminal.

Here, step S211 is performed after step S210, that is, the intranet access request of the user terminal in step S211 is that after the mobile wireless access device is disconnected from the second intranet firewall, the user terminal Intranet access request to the target intranet.

S212: The mobile wireless access device sends the intranet access request to the second intranet firewall.

S213: The second intranet firewall routes the intranet access request to the intranet server of the target intranet.

Specifically, the intranet access request is an access request for a server in the target intranet, such as an access request for a Web server in the target intranet, an access request for an FTP server in the target intranet, and an access request for a server in the target intranet. State the access request of the mail server in the target intranet, etc. After the second intranet firewall receives the intranet access request sent by the mobile wireless access device, it sends the intranet access request to the router of the target intranet through the external network. The router routes the intranet access request to the corresponding intranet server in the target intranet through the target intranet.

S214: The intranet server returns an intranet request response message in response to the intranet access request to the second intranet firewall.

Specifically, after the intranet server generates an intranet request response message in response to the intranet access request, it sends the intranet request response message to the router of the target intranet through the target intranet, and the target The router of the internal network sends the internal network request response message to the second internal network firewall through the external network. For example, if the intranet access request is a request to obtain a file in a file server in the target intranet, the intranet request response message may be the file sent by the file server.

S215: The second intranet firewall sends the intranet request response message to the mobile wireless access device.

S216: The mobile wireless access device sends the intranet request response message to the user terminal.

In the embodiment of the present application, after the intranet firewall distribution device receives the intranet connection request for the target intranet sent by the mobile wireless access device, according to the intranet connection request from multiple intranet firewalls deployed for the target intranet The mobile wireless access device allocates a matching first intranet firewall to the mobile wireless access device. After the mobile wireless access device establishes a connection with the first intranet firewall, the intranet firewall distribution device judges whether it is satisfied according to the real-time geographic location of the mobile wireless access device The conditions for switching firewalls. When it is determined that the above conditions are met, the internal network firewall distribution device allocates the switched second internal network to the mobile wireless access device according to the status information of the access device connected to the first internal network firewall Firewall, after the mobile wireless access device establishes a connection with the second intranet firewall, it disconnects the connection with the first intranet firewall, and provides the user terminal with access to the target intranet service through the connection with the second intranet firewall. Through the embodiments of this application, the user does not need to configure any parameters before accessing the target intranet, which improves the access efficiency for the target intranet. At the same time, the intranet firewall distribution device determines that the mobile wireless access device meets the requirement of switching the connected firewall based on the real-time geographic location. When the conditions are met, the second intranet firewall is re-allocated for the mobile wireless access device to ensure that the intranet firewall connected to the mobile wireless access device is always the optimal intranet firewall that matches the status information of the access device, ensuring users The network quality of the terminal accessing the intranet.

Referring to FIG. 3, FIG. 3 is a schematic diagram of system interaction of another firewall switching method provided by an embodiment of the application. As shown in the figure, the method may include:

S301: The mobile wireless access device sends an intranet connection request for the target intranet to the intranet firewall distribution device.

S302: The intranet firewall distribution device determines the current network delay between the mobile wireless access device and each intranet firewall deployed for the target intranet according to the intranet connection request.

Specifically, an implementation manner for the intranet firewall distribution device to determine the current network delay between the mobile wireless access device and each intranet firewall may be: the intranet firewall distribution device sends to each intranet firewall The access device IP address of the mobile wireless access device, each intranet firewall sends a network delay test message to the mobile wireless access device according to the access device IP address, and the mobile wireless access device will receive The network delay test message is forwarded to the intranet firewall distribution device, and the network delay test message received by the intranet firewall distribution device carries the network delay test message for each intranet firewall deployed in the target intranet. The transmission time data of the mobile wireless access device and the reception time data of the network delay test message received by the mobile wireless access device, the intranet firewall distribution device according to the transmission time data and the reception time carried in each received network delay test message Data to determine the network delay between the mobile wireless access device and each intranet firewall deployed for the target intranet.

Another implementation manner for the intranet firewall distribution device to determine the current network delay between the mobile wireless access device and each intranet firewall may be: the intranet firewall distribution device directs the mobile wireless access device Send the firewall IP address of each intranet firewall deployed for the target intranet, the mobile wireless access device sends a network delay test message to each intranet firewall according to the firewall IP address, and each intranet firewall will receive The network delay test message is forwarded to the intranet firewall distribution device, and the network delay test message received by the intranet firewall distribution device carries the transmission time data for the mobile wireless access device to send the network delay test message, And the receiving time data of each intranet firewall deployed for the target intranet receiving the network delay test message; the intranet firewall distribution device according to the sending time data carried in each received network delay test message and The time data is received to determine the target network delay between the mobile wireless access device and each intranet firewall deployed for the target intranet.

An implementation manner for the mobile wireless access device to determine the current network delay between the mobile wireless access device and each intranet firewall may be: the intranet firewall distribution device sends to the mobile wireless access device For the firewall IP addresses of each intranet firewall deployed in the target intranet, the mobile wireless access device sends a network delay test message to each intranet firewall according to the IP address, and each intranet firewall receives the After the network delay test message, the network delay test message is returned to the mobile wireless access device; the mobile wireless access device sends the network delay test message to each intranet firewall according to the sending time data of the network delay test message, and receives The receiving time data of the network delay test message returned by each intranet firewall determines the network delay between the mobile wireless access device and each intranet firewall.

An implementation manner for determining the current network delay between the mobile wireless access device and each intranet firewall for each intranet firewall deployed in the target intranet may be: the intranet firewall distribution device sends to each intranet firewall The access device IP address of the mobile wireless access device, each intranet firewall sends a network delay test message to the mobile wireless access device according to the access device IP address, and the mobile wireless access device receives each After the network delay test message sent by the internal network firewall, the received network delay test message is returned to each internal network firewall, and each internal network firewall sends the network delay test message to the mobile wireless access device according to the sending time data of the network delay test message, and The receiving time data of the network delay test message returned by the mobile wireless access device is received, and the network delay between the mobile wireless access device and itself is determined.

S303: The intranet firewall distribution device determines a first intranet firewall matched by the mobile wireless access device from among multiple intranet firewalls deployed for the target intranet according to the current network delay.

Specifically, the intranet firewall distribution device determines that among the current network delays between the mobile wireless access device and each intranet firewall deployed for the target intranet, the smallest network delay corresponding to the intranet firewall is determined Describe the first intranet firewall.

S304: The intranet firewall distribution device sends the first IP address of the first intranet firewall to the mobile wireless access device.

S305. The mobile wireless access device establishes a connection with the first intranet firewall according to the first IP address.

S306: The intranet firewall distribution device obtains the access device status information of the mobile wireless access device.

S307: When the intranet firewall distribution device determines that the first intranet firewall is not the intranet firewall closest to the mobile wireless access device according to the real-time geographic location contained in the access device status information, The access device status information includes the intranet firewall corresponding to the smallest network delay among the real-time network delays between the mobile wireless access device and each intranet firewall, and is determined to be the second intranet firewall.

After the second intranet firewall is determined in step S307, the second IP address of the second intranet firewall is sent to the mobile wireless access device, so that the mobile wireless access device can connect to the connected intranet firewall For switching from the first intranet firewall to the second intranet firewall, for specific implementation steps, refer to the implementation manner of step S208 to step S216 in the embodiment corresponding to FIG. 2, and details are not described herein again.

In the embodiment of the present application, after the intranet firewall distribution device receives the intranet connection request for the target intranet sent by the mobile wireless access device, it will target one of the multiple intranet firewalls deployed on the target intranet and the mobile wireless access device. The first intranet firewall with the smallest current network delay is assigned to the mobile wireless access device. After the mobile wireless access device establishes a connection with the first intranet firewall, the intranet firewall determines that the first intranet firewall is not a distance When the mobile wireless access device is closest to the internal network firewall, the internal network firewall with the smallest network delay between the mobile wireless access device and the mobile wireless access device is determined as the second internal network firewall assigned and switched by the mobile wireless access device. After the device establishes a connection with the second intranet firewall, it disconnects the connection with the first intranet firewall, and provides the user terminal with the service of accessing the target intranet through the connection with the second intranet firewall. Through the embodiment of this application, the user does not need to configure any parameters before accessing the target intranet, which improves the access efficiency for the target intranet. At the same time, the intranet firewall distribution device determines that the mobile wireless access device meets the requirements of switching the connected intranet firewall. When the conditions are met, it is ensured that the mobile wireless access device is connected to the second intranet firewall with the smallest network delay between the mobile wireless access device and the mobile wireless access device, thereby ensuring the network quality of the user terminal accessing the intranet.

Referring to FIG. 4, FIG. 4 is a schematic structural diagram of a mobile wireless access device provided by an embodiment of the application. As shown in the figure, the intranet firewall distribution device 40 may at least include a state acquisition unit 401, a firewall determination unit 402, and Address sending unit 403, where:

The status obtaining unit 401 is configured to obtain status information of the access device connected to the first intranet firewall of the mobile wireless access device and the target intranet. After the intranet connection request for the target intranet, according to the intranet connection request, determine the firewall that matches the mobile wireless access device from among the multiple intranet firewalls deployed for the target intranet, the The access device status information includes the real-time geographic location of the mobile wireless access device;

The firewall determining unit 402 is configured to, when it is determined according to the real-time geographic location that the mobile wireless access device satisfies the conditions for switching the connected firewall, according to the status information of the access device, select the target intranet from multiple Determine the second intranet firewall matched by the mobile wireless access device in the intranet firewall;

The address sending unit 403 is configured to send the second IP address of the second intranet firewall to the mobile wireless access device, so that the mobile wireless access device compares the second IP address with the first 2. After the internal network firewall establishes a connection and disconnects from the first internal network firewall, the second internal network firewall transmits the user terminal’s internal network access to the target internal network sent by the user terminal through the mobile wireless access device The request is routed to the intranet server of the target intranet, and the second intranet firewall also sends the intranet request response message returned by the intranet server in response to the intranet access request through the mobile wireless access device To the user terminal.

Wherein, the firewall determining unit 402 is specifically configured to:

Acquiring deployment locations of multiple intranet firewalls deployed for the target intranet;

Determining that the first intranet firewall is not among the multiple intranet firewalls deployed for the target intranet according to the real-time geographic location and the deployment positions of the multiple intranet firewalls deployed for the target intranet, When the firewall is closest to the mobile wireless access device, it is determined that the mobile wireless access device satisfies the condition of the firewall connected to the handover.

Wherein, the state acquiring unit 401 is further configured to:

Receiving an intranet connection request sent by the mobile wireless access device for the target intranet;

Determining the current geographic location of the mobile wireless access device according to the intranet connection request;

Determine the first intranet firewall matched by the mobile wireless access device from among the multiple intranet firewalls deployed for the target intranet according to the current geographic location;

The first IP address of the first intranet firewall is sent to the mobile wireless access device, so that the mobile wireless access device establishes a connection with the first intranet firewall according to the first IP address.

Wherein, the status obtaining unit 401 is specifically configured to:

Determine, according to the current geographic location, the first intranet access subregion for the target intranet where the mobile wireless access device is located;

Determine the first intranet firewall corresponding to the first intranet access subarea according to the preset correspondence between the intranet access subarea and the firewall of the target intranet;

The firewall determining unit is specifically configured to:

When it is determined that the mobile wireless access device is transferred from the first intranet access subarea to the second intranet access subarea for the target intranet, it is determined that the mobile wireless access device satisfies the handover requirements. Conditions for connecting to the firewall.

Wherein, the intranet firewall connection request carries identity verification information of the mobile wireless access device;

The status obtaining unit 401 is specifically configured to:

Perform identity verification on the mobile wireless access device according to the identity verification information;

After the identity verification is passed, the current geographic location of the mobile wireless access device is determined.

Wherein, the firewall determining unit 402 is specifically configured to:

According to the real-time geographic location, a second intranet firewall matched by the mobile wireless access device is determined from a plurality of intranet firewalls deployed for the target intranet.

Wherein, the access device state information includes the network delay between the mobile wireless access device and each intranet firewall deployed for the target intranet when the access device state information is acquired;

The firewall determining unit 402 is specifically configured to:

Among the network delays between the mobile wireless access device and each intranet firewall deployed for the target intranet, the firewall corresponding to the smallest network delay is determined as the second intranet firewall.

Wherein, the firewall determining unit 402 is further configured to:

Send the access device IP address of the mobile wireless access device to each intranet firewall deployed for the target intranet, so that each intranet firewall sends the mobile wireless access device IP address to the mobile wireless access device according to the access device IP address. Send network delay test message;

Receive the network delay test message sent by each intranet firewall forwarded by the mobile wireless access device, and the network delay test message received by the intranet firewall distribution device carries the network delay sent by each intranet firewall Sending time data of the test message, and receiving time data of the network delay test message received by the mobile wireless access device;

Determine the network delay between the mobile wireless access device and each intranet firewall according to the sending time data and the receiving time data carried in each received network delay test message.

Wherein, the status obtaining unit 401 is specifically configured to:

Periodically obtain the access device status information of the mobile wireless access device connected to the first intranet firewall of the target intranet, or obtain the mobile wireless access device when the firewall switching request sent by the mobile wireless access device is received The state information of the access device connected to the first intranet firewall of the incoming device and the target intranet, the firewall switching request is that the mobile wireless access device determines that the mobile wireless access device satisfies the need to replace the connected intranet firewall When sending a request to switch the connected firewall.

In specific implementation, the intranet firewall distribution device can execute each step performed by the intranet firewall distribution device in the firewall switching method shown in Figures 2 to 3 through its built-in functional modules. For specific implementation details, please refer to Figure 2. The implementation details of each step in the embodiment corresponding to FIG. 3 will not be repeated here.

In the embodiment of the present application, after the state acquisition unit receives the intranet connection request for the target intranet sent by the mobile wireless access device, the state acquisition unit is based on the intranet connection request from multiple intranet firewalls deployed for the target intranet. The mobile wireless access device allocates a matching first intranet firewall. After the mobile wireless access device establishes a connection with the first intranet firewall, the state obtaining unit obtains the real-time geographic location of the mobile wireless access device, and the firewall determining unit is based on The real-time geographic location of the mobile wireless access device determines whether the conditions for switching firewalls are met. When it is determined that the above conditions are met, it is the mobile wireless access device based on the status information of the access device connected to the first intranet firewall. After assigning the switched second intranet firewall, the address sending unit sends the second IP address of the second intranet firewall to the mobile wireless access device. After the mobile wireless access device establishes a connection with the second intranet firewall, it disconnects from The first intranet firewall is connected, and the service of accessing the target intranet is provided for the user terminal through the connection with the second intranet firewall. Through the embodiment of this application, the user does not need to configure any parameters before accessing the target intranet, which improves the access efficiency for the target intranet. At the same time, the firewall determining unit determines based on the real-time geographic location that the mobile wireless access device meets the conditions for switching the connected firewall. When the mobile wireless access device is redistributed to the second intranet firewall to ensure that the intranet firewall connected to the mobile wireless access device is always the optimal intranet firewall that matches the status information of the access device, ensuring user terminal access The network quality of the intranet.

Referring to FIG. 5, FIG. 5 is a schematic structural diagram of another intranet firewall distribution device provided by an embodiment of the application. As shown in the figure, the intranet firewall distribution device 50 includes a processor 501, a memory 502, and a communication interface 503. The processor 501 is connected to the memory 502 and the communication interface 503. For example, the processor 501 may be connected to the memory 502 and the communication interface 503 through a bus.

The processor 501 is configured to support the internal firewall distribution device to perform the corresponding functions of the internal firewall distribution device in the firewall switching method described in FIGS. 2 to 3. The processor 501 may be a central processing unit (Central Processing Unit, CPU), a network processor (Network Processor, NP), a hardware chip, or any combination thereof. The foregoing hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (Programmable Logic Device, PLD), or a combination thereof. The aforementioned PLD may be a complex programmable logic device (Complex Programmable Logic Device, CPLD), a field programmable logic gate array (Field-Programmable Gate Array, FPGA), a general array logic (Generic Array Logic, GAL) or any combination thereof.

The memory 502 is used to store program codes and the like. The memory 502 includes internal memory, which may include at least one of the following: volatile memory (such as dynamic random access memory (DRAM), static RAM (SRAM), synchronous dynamic RAM (SDRAM), etc.) and non-volatile memory (For example, one-time programmable read-only memory (OTPROM), programmable ROM (PROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM). The memory 502 may also include external memory, external The memory may include at least one of the following: Hard Disk Drive (HDD) or Solid-State Drive (SSD), flash drive, such as high-density flash (CF), secure digital (SD), micro SD, mini type SD, limit number (xD), memory stick, etc.

The communication interface 503 is used to receive or send data.

The processor 501 may call the program code to perform the following operations:

Acquire the status information of the access device connected to the first intranet firewall of the mobile wireless access device and the target intranet, where the first intranet firewall is an intranet specific to the target intranet sent by the mobile wireless access device After the network connection request, the firewall that matches the mobile wireless access device is determined from multiple intranet firewalls deployed for the target intranet according to the intranet connection request, and the access device status information includes all State the real-time geographic location of the mobile wireless access device;

When it is determined according to the real-time geographic location that the mobile wireless access device satisfies the conditions for switching the connected firewalls, it is determined from the multiple intranet firewalls deployed for the target intranet according to the access device status information The second intranet firewall matched by the mobile wireless access device;

Sending the second IP address of the second intranet firewall to the mobile wireless access device, so that the mobile wireless access device establishes a connection with the second intranet firewall according to the second IP address, And after disconnecting from the first intranet firewall, the second intranet firewall routes the intranet access request for the target intranet sent by the user terminal through the mobile wireless access device to the target intranet The second intranet firewall also sends the intranet request response message returned by the intranet server in response to the intranet access request to the user terminal through the mobile wireless access device.

It should be noted that the implementation of each operation may also correspond to the corresponding description of the method embodiments shown in FIGS. 2 to 3; the processor 501 may also be used to perform other operations in the above method embodiments.

The embodiment of the present application also provides a computer non-volatile readable storage medium, the computer non-volatile readable storage medium stores a computer program, the computer program includes program instructions, and the program instructions are When the computer is caused to execute the method described in the foregoing embodiment, the computer may be a part of the aforementioned intranet firewall distribution device.

A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing relevant hardware through a computer program. The program can be stored in a computer readable storage medium. During execution, it may include the procedures of the above-mentioned method embodiments. Wherein, the storage medium may be a magnetic disk, an optical disc, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random Access Memory, RAM), etc.

Claims

A firewall switching method is characterized in that it comprises:

The intranet firewall distribution device obtains the status information of the access device connected to the mobile wireless access device and the first intranet firewall of the target intranet, and the first intranet firewall is the target device after receiving the mobile wireless access device After the intranet connection request of the target intranet, the firewall that matches the mobile wireless access device is determined from the multiple intranet firewalls deployed for the target intranet according to the intranet connection request, and the access The device status information includes the real-time geographic location of the mobile wireless access device;

When the intranet firewall distribution device determines based on the real-time geographic location that the mobile wireless access device satisfies the conditions for switching the connected firewall, it selects multiple devices deployed for the target intranet based on the access device status information. Determine the second intranet firewall matched by the mobile wireless access device in the intranet firewall;

The intranet firewall allocation device sends the second IP address of the second intranet firewall to the mobile wireless access device, so that the mobile wireless access device communicates with the first IP address according to the second IP address Second, the internal network firewall establishes a connection, and after the connection with the first internal network firewall is disconnected, the second internal network firewall transmits the internal network for the target internal network sent by the user terminal through the mobile wireless access device The access request is routed to the intranet server of the target intranet, and the second intranet firewall also passes the intranet request response message returned by the intranet server in response to the intranet access request through the mobile wireless access device Sent to the user terminal.
The method according to claim 1, wherein the determination by the intranet firewall distribution device that the mobile wireless access device meets the conditions for switching the connected firewall according to the real-time geographic location comprises:

Acquiring, by the intranet firewall distribution device, the deployment positions of multiple intranet firewalls deployed for the target intranet;

The intranet firewall allocation device determines that the first intranet firewall is not deployed for the target intranet based on the real-time geographic location and the deployment positions of the multiple intranet firewalls deployed for the target intranet Among the multiple intranet firewalls, when the firewall is closest to the mobile wireless access device, it is determined that the mobile wireless access device satisfies the condition for switching the connected firewall.
The method according to any one of claims 1 to 2, characterized in that, before the intranet firewall distribution device obtains the status information of the access device connected to the mobile wireless access device and the first intranet firewall of the target intranet, The method also includes:

Receiving, by the intranet firewall distribution device, the intranet connection request sent by the mobile wireless access device for the target intranet;

The intranet firewall distribution device determines the current geographic location of the mobile wireless access device according to the intranet connection request;

The intranet firewall allocation device determines the first intranet firewall matched by the mobile wireless access device from among the multiple intranet firewalls deployed for the target intranet according to the current geographic location;

The intranet firewall assigning device sends the first IP address of the first intranet firewall to the mobile wireless access device, so that the mobile wireless access device compares the first IP address with the first IP address An intranet firewall establishes a connection.
The method of claim 3, wherein the intranet firewall allocation device determines the mobile wireless access from a plurality of intranet firewalls deployed for the target intranet according to the current geographic location. The first intranet firewall matched by the device includes:

The intranet firewall allocation device determines, according to the current geographic location, the first intranet access subarea for the target intranet where the mobile wireless access device is located;

The intranet firewall distribution device determines the first intranet firewall corresponding to the first intranet access subregion according to the preset correspondence between the intranet access subarea and the target intranet firewall;

The determination by the intranet firewall distribution device that the mobile wireless access device meets the conditions for switching the connected firewall according to the real-time geographic location includes:

The intranet firewall distribution device determines that the mobile wireless access device is transferred from the first intranet access sub-area to the second intranet access sub-area for the target intranet. The incoming device satisfies the condition of the firewall connected to the switch.
The method according to claim 3, wherein the intranet firewall connection request carries identity verification information of the mobile wireless access device;

The determining, by the intranet firewall distribution device, of the current geographic location of the mobile wireless access device according to the intranet connection request includes:

The intranet firewall distribution device performs identity verification on the mobile wireless access device according to the identity verification information;

After the identity verification is passed, the intranet firewall distribution device determines the current geographic location of the mobile wireless access device.
The method according to any one of claims 1 to 5, wherein the intranet firewall distribution device determines the mobile wireless firewall from a plurality of intranet firewalls deployed for the target intranet according to the access device status information. The second intranet firewall matched by the access device includes:

According to the real-time geographic location, the intranet firewall allocation device determines a second intranet firewall matched by the mobile wireless access device from a plurality of intranet firewalls deployed for the target intranet.
The method according to any one of claims 1 to 6, wherein the access device status information includes when the access device status information is acquired, the mobile wireless access device and the target The network delay between the various intranet firewalls deployed on the network;

The intranet firewall distribution device determines from the multiple intranet firewalls deployed for the target intranet according to the access device status information that the second intranet firewall matched by the mobile wireless access device includes:

The intranet firewall distribution device determines the firewall corresponding to the smallest network delay among the network delays between the mobile wireless access device and each intranet firewall deployed for the target intranet as the second intranet Firewall.
The method according to claim 7, wherein the intranet firewall distribution device determines that the mobile wireless access device matches from a plurality of intranet firewalls deployed for the target intranet according to the access device status information Before the second intranet firewall, it also includes:

The intranet firewall distribution device sends the access device IP address of the mobile wireless access device to each intranet firewall deployed for the target intranet, so that each intranet firewall sends the access device IP address according to the access device IP address. Sending a network delay test message by the mobile wireless access device;

The intranet firewall distribution device receives the network delay test message sent by the various intranet firewalls forwarded by the mobile wireless access device, and the network delay test message received by the intranet firewall distribution device carries the respective internal Data of the sending time of the network firewall sending the network delay test message, and data of the receiving time of the mobile wireless access device receiving the network delay test message;

The intranet firewall distribution device determines the network delay between the mobile wireless access device and each intranet firewall according to the sending time data and the receiving time data carried in each received network delay test message.
The method according to any one of claims 1 to 8, wherein the acquiring, by the intranet firewall distribution device, the status information of the access device connected to the mobile wireless access device and the first intranet firewall of the target intranet comprises:

The intranet firewall distribution device periodically obtains the status information of the access device connected to the mobile wireless access device and the first intranet firewall of the target intranet, or, after receiving the firewall switching sent by the mobile wireless access device When requested, the state information of the access device connected to the first intranet firewall of the mobile wireless access device and the target intranet is obtained, and the firewall switching request indicates that the mobile wireless access device determines that the mobile wireless access device satisfies When replacing the connected intranet firewall, a request to switch the connected firewall is sent.
An intranet firewall distribution device is characterized in that it includes:

The status acquiring unit is configured to acquire the status information of the access device connected to the first intranet firewall of the target intranet by the mobile wireless access device, and the first intranet firewall is configured to receive the information sent by the mobile wireless access device After the intranet connection request for the target intranet, the firewall that matches the mobile wireless access device is determined from the multiple intranet firewalls deployed for the target intranet according to the intranet connection request, and the connection The incoming device status information includes the real-time geographic location of the mobile wireless access device;

The firewall determining unit is configured to, when it is determined according to the real-time geographic location that the mobile wireless access device meets the conditions for switching the connected firewall, select from multiple internal networks deployed for the target intranet according to the access device status information. Determine a second intranet firewall that matches the mobile wireless access device in the network firewall;

The address sending unit is configured to send the second IP address of the second intranet firewall to the mobile wireless access device, so that the mobile wireless access device communicates with the second IP address according to the second IP address. After the intranet firewall establishes a connection and disconnects from the first intranet firewall, the second intranet firewall transmits the intranet access request for the target intranet sent by the user terminal through the mobile wireless access device Routed to the intranet server of the target intranet, the second intranet firewall also sends the intranet request response message returned by the intranet server in response to the intranet access request to the mobile wireless access device The user terminal.
The device according to claim 10, wherein the firewall determining unit is specifically configured to:

Acquiring deployment locations of multiple intranet firewalls deployed for the target intranet;

Determining that the first intranet firewall is not among the multiple intranet firewalls deployed for the target intranet according to the real-time geographic location and the deployment positions of the multiple intranet firewalls deployed for the target intranet, When the firewall is closest to the mobile wireless access device, it is determined that the mobile wireless access device satisfies the condition of the firewall connected to the handover.
The device according to claims 10-11, wherein the state acquiring unit is further configured to:

Receiving an intranet connection request sent by the mobile wireless access device for the target intranet;

Determining the current geographic location of the mobile wireless access device according to the intranet connection request;

Determine the first intranet firewall matched by the mobile wireless access device from among the multiple intranet firewalls deployed for the target intranet according to the current geographic location;

The first IP address of the first intranet firewall is sent to the mobile wireless access device, so that the mobile wireless access device establishes a connection with the first intranet firewall according to the first IP address.
The device according to claim 12, wherein the state acquiring unit is specifically configured to:

Determine, according to the current geographic location, the first intranet access subregion for the target intranet where the mobile wireless access device is located;

Determine the first intranet firewall corresponding to the first intranet access subarea according to the preset correspondence between the intranet access subarea and the firewall of the target intranet;

The firewall determining unit is specifically configured to:

When it is determined that the mobile wireless access device is transferred from the first intranet access subarea to the second intranet access subarea for the target intranet, it is determined that the mobile wireless access device satisfies the handover requirements. Conditions for connecting to the firewall.
The device of claim 12, wherein the intranet firewall connection request carries identity verification information of the mobile wireless access device;

The status obtaining unit is specifically used for:

Perform identity verification on the mobile wireless access device according to the identity verification information;

After the identity verification is passed, the current geographic location of the mobile wireless access device is determined.
The device according to any one of claims 10 to 14, wherein the firewall determining unit is specifically configured to:

According to the real-time geographic location, a second intranet firewall matched by the mobile wireless access device is determined from a plurality of intranet firewalls deployed for the target intranet.
The device according to any one of claims 10-15, wherein the access device status information is included when the access device status information is acquired, the mobile wireless access device and the target The network delay between the various intranet firewalls deployed on the network;

The firewall determining unit is specifically used for:

Among the network delays between the mobile wireless access device and each intranet firewall deployed for the target intranet, the firewall corresponding to the smallest network delay is determined as the second intranet firewall.
The device according to claim 16, wherein the firewall determining unit is further configured to:

Send the access device IP address of the mobile wireless access device to each intranet firewall deployed for the target intranet, so that each intranet firewall sends the mobile wireless access device IP address to the mobile wireless access device according to the access device IP address. Send network delay test message;

Receive the network delay test message sent by each intranet firewall forwarded by the mobile wireless access device, and the network delay test message received by the intranet firewall distribution device carries the network delay sent by each intranet firewall Sending time data of the test message, and receiving time data of the network delay test message received by the mobile wireless access device;

Determine the network delay between the mobile wireless access device and each intranet firewall according to the sending time data and the receiving time data carried in each received network delay test message.
The device according to any one of claims 10-17, wherein the state acquiring unit is specifically configured to:

Periodically obtain the access device status information of the mobile wireless access device connected to the first intranet firewall of the target intranet, or obtain the mobile wireless access device when the firewall switching request sent by the mobile wireless access device is received The state information of the access device connected to the first intranet firewall of the incoming device and the target intranet, the firewall switching request is that the mobile wireless access device determines that the mobile wireless access device satisfies the need to replace the connected intranet firewall When sending a request to switch the connected firewall.
An intranet firewall distribution device is characterized by comprising a processor, a memory, and a communication interface, the processor, the memory and the communication interface are connected to each other, wherein the communication interface is used for receiving and sending data, and the memory is used for In storing program code, the processor is used to call the program code to execute the method according to any one of claims 1-9.
A computer nonvolatile readable storage medium, wherein the computer nonvolatile readable storage medium stores a computer program, the computer program includes program instructions, and the program instructions when executed by a processor The processor is caused to execute the method according to any one of claims 1-9.