WO2022057000A1 - 一种数据代理方法、系统及代理服务器 - Google Patents

一种数据代理方法、系统及代理服务器 Download PDF

Info

Publication number
WO2022057000A1
WO2022057000A1 PCT/CN2020/122547 CN2020122547W WO2022057000A1 WO 2022057000 A1 WO2022057000 A1 WO 2022057000A1 CN 2020122547 W CN2020122547 W CN 2020122547W WO 2022057000 A1 WO2022057000 A1 WO 2022057000A1
Authority
WO
WIPO (PCT)
Prior art keywords
domain name
intranet
information
server
access
Prior art date
Application number
PCT/CN2020/122547
Other languages
English (en)
French (fr)
Inventor
陈加伟
谢文伟
王力鹏
Original Assignee
厦门网宿有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 厦门网宿有限公司 filed Critical 厦门网宿有限公司
Publication of WO2022057000A1 publication Critical patent/WO2022057000A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0281—Proxies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]

Definitions

  • the present application relates to the field of Internet technologies, and in particular, to a data proxy method, system and proxy server.
  • VPN Virtual Private Network
  • Web Virtual Private Network provides web-based intranet application access control, allowing users to access web applications that are only open to the internal network.
  • WebVPN does not require users to install client software or browser plug-ins. Users can directly access the login page through the browser for authentication, which greatly reduces the threshold for using VPN technology and improves user experience.
  • the user's request goes through the VPN proxy server first. In this way, the domain name in the user's request all points to the proxy domain name. How the proxy server can effectively distinguish the actual access target of the user's request has become one of the WebVPN technologies. big problem.
  • the purpose of the present application is to provide a data proxy method, system and proxy server, which can effectively distinguish the actual access target requested by the user.
  • the present application provides a data proxy method on the one hand, the method includes: receiving an access request sent by a client, where the destination IP address in the access request points to a proxy server; The domain name is restored to the original intranet domain name, and a resource acquisition request is initiated to the intranet server pointed to by the original intranet domain name; the response data fed back by the intranet server for the resource acquisition request is received, and in the response data
  • the domain name information is included and the domain name information conforms to the replacement rule
  • the domain name information is replaced with a virtual domain name
  • the generic domain name of the virtual domain name is the proxy domain name
  • a response containing the virtual domain name is fed back to the client data.
  • the destination IP address in the access request is obtained by direct resolution by a public DNS server, or is obtained by resolution by an intelligent DNS server, wherein the intelligent DNS server receives the domain name resolution request forwarded by the public DNS server, and The parsing result is responded to the client through the public DNS server.
  • the method further includes: receiving authorization response data responded by an authentication server; in the case that the authorization response data includes domain name information and the domain name information complies with a replacement rule, replacing the domain name information is a virtual domain name, and the authorization response data including the virtual domain name is fed back to the client.
  • the client generates the access request based on the received authorization response data or the response data.
  • the resource acquisition request is obtained by rewriting based on the access request.
  • restoring the access domain name in the access request to the original intranet domain name includes: identifying the rewriting rule when the original intranet domain name is rewritten, and extracting all the access requests.
  • the access domain name is restored; the access domain name is restored to the original intranet domain name according to the rewriting rule.
  • the domain name information conforming to the replacement rule includes: matching the domain name information in the generic domain name whitelist, and if there is a target generic domain name matching the domain name information, determining that the domain name information conforms to the replacement rule. rule.
  • replacing the domain name information with a virtual domain name includes: rewriting the domain name information into a virtual domain name according to a rewriting rule when the original intranet domain name is rewritten, and replacing the virtual domain name with the virtual domain name. The corresponding domain name information in the response data.
  • the method further includes: judging whether the response data contains a cookie setting item, and if it contains a cookie setting item, rewriting the authority domain name in the domain information in the cookie setting item to the virtual domain name, And cache the association relationship between the cookie information and the authority domain name.
  • the method further includes: when the intranet access request sent by the client is received again, if the original intranet domain name obtained after restoration of the access domain name of the intranet access request contains the The authority domain name in the association relationship is the cookie information corresponding to the authority domain name that is carried when the resource acquisition request is sent to the intranet server pointed to by the original intranet domain name.
  • another aspect of the present application also provides a proxy server, the proxy server includes a memory and a processor, the memory is used to store a computer program, and when the computer program is executed by the processor, the above-mentioned data proxy method.
  • the present application also provides a data proxy system on the other hand, the data proxy system includes a proxy server, a public DNS server, an intelligent DNS server and an intranet server, wherein: the public DNS server is used for receiving The domain name resolution request sent by the client, and when recognizing that the domain name in the domain name resolution request contains the specified generic domain name, it directly responds to the domain name resolution request based on the IP address of the proxy server, or converts the domain name to the domain name resolution request.
  • the public DNS server is used for receiving The domain name resolution request sent by the client, and when recognizing that the domain name in the domain name resolution request contains the specified generic domain name, it directly responds to the domain name resolution request based on the IP address of the proxy server, or converts the domain name to the domain name resolution request.
  • the resolution request is forwarded to the smart DNS server; the smart DNS server is used to generate a destination IP address corresponding to the domain name resolution request, and feed back the destination IP address to the client, so that the client Initiate an access request to the proxy server pointed to by the destination IP address; the proxy server is used to restore the access domain name in the access request to the original intranet domain name, and to the intranet domain name pointed to by the original intranet domain name.
  • the web server initiates a resource acquisition request; receives the response data fed back by the intranet server for the resource acquisition request, and when the response data includes domain name information and the domain name information conforms to the replacement rule, convert the domain name
  • the information is replaced with a virtual domain name, the generic domain name of the virtual domain name is the proxy domain name, and response data including the virtual domain name is fed back to the client.
  • the public DNS server when the public DNS server receives the domain name resolution request carrying the specified pan-domain name, it can directly respond to the domain name resolution request based on the IP address of the proxy server, or can forward the domain name resolution request. to the smart DNS server.
  • the intelligent DNS server can resolve the IP address of the corresponding proxy server, and provide the IP address to the client, so that the client can initiate an access request to the corresponding proxy server. In this way, through the determination method of the generic domain name, even if a new subdomain name under the generic domain name appears, the new subdomain name can be guided to the proxy server.
  • the proxy server receives the access request initiated by the client, and can restore the corresponding original intranet domain name according to the access domain name in the access request.
  • the proxy server can identify the corresponding intranet server according to the original intranet domain name, so as to initiate a resource acquisition request to the intranet server.
  • the proxy server receives the response data fed back by the intranet server, if the response data contains domain name information, and the domain name information conforms to the replacement rules, it indicates that the domain name information represents the intranet domain name.
  • the proxy server can replace the domain name information with a virtual domain name, and feed back response data including the virtual domain name to the client, so that the access domain name in the new access request sent by the client based on the response data is the virtual domain name.
  • the client since the intranet domain name cannot be directly accessed through the public network, the client sends and receives the processed virtual domain name. After the virtual domain name is processed by the proxy server, it can be converted into the corresponding original intranet domain name and the real domain name of the intranet application, so that the proxy server can identify the actually requested intranet application and obtain it from the corresponding intranet server.
  • the intranet resources requested by the client complete the data proxy process.
  • FIG. 1 is a schematic diagram of the architecture of a data proxy system provided by an embodiment of the present application.
  • FIG. 2 is a schematic diagram of steps of a data proxy method provided by an embodiment of the present application.
  • FIG. 3 is a schematic structural diagram of a proxy server provided by an embodiment of the present application.
  • the present application provides a data proxy method, which can be applied to the system architecture shown in FIG. 1 .
  • the system architecture may include a client, a proxy server, an authentication server, a public domain name system (Domain Name System, DNS for short) server, an intelligent DNS server, and an intranet server.
  • DNS Domain Name System
  • the client may be a user's terminal device, and the user may send an access request through a browser installed on the client.
  • the public DNS server is generally the DNS server deployed by the network operator.
  • the DNS resolution request sent by the client can be received by the public DNS server.
  • the public DNS server has limited operation and configuration authority open to the outside world, and generally only simple configuration is allowed.
  • a simple forwarding rule can be configured on the public DNS server, so that the DNS resolution request including a specific pan-domain name can be forwarded to the intelligent DNS server.
  • Smart DNS servers are generally deployed by network service providers.
  • the developers of the network service providers can freely configure relevant operation rules on the smart DNS server, receive DNS resolution requests forwarded by public DNS servers, and execute them according to preset rules. to parse.
  • the authentication server can be used to authenticate the user's identity, to determine whether the user's identity is legal, and to issue corresponding access rights to intranet resources.
  • the proxy server can be used as a virtual private network (Virtual Private Network, referred to as VPN) gateway to receive access requests from clients, and can establish a communication connection with the intranet server through the VPN network to forward the access requests sent by the client to the corresponding intranet
  • the server receives the response data from the intranet server for the access request, and then sends the response data to the client.
  • the proxy server can realize the data proxy between the client and the intranet server.
  • the intranet server may be an origin server deployed in the intranet environment, running an application program providing services for responding to access requests.
  • the proxy server establishes a communication connection with the intranet server through a VPN network
  • the used VPN network may be based on a wide area software-defined network (Software-Defined Wide Area Network, SD-WAN for short for short) ) architecture implementation.
  • a client when a client needs to access intranet resources, it can first perform authority authentication through an authentication server. Specifically, the client can initiate a login request to the proxy server, and the proxy server forwards the login request to the authentication server for authorization verification.
  • the authorization response data can include pages that access intranet resources, such as function index pages.
  • the index page can contain jump entries for accessing various intranet resources. For example, the index page may contain access portals of various branches in the enterprise, and may also contain data support portals of various businesses.
  • the links of these access portals are written into the page code, and the links can contain the domain name corresponding to the intranet resource, that is, the original intranet domain name, for example, the original intranet domain name of the Shanghai branch It can be SH.wangsu.com.
  • the index page containing these original intranet domain names is directly displayed to the client, when the client sends an access request directly based on these original intranet domain names, it cannot be received by the proxy server, and thus cannot be accessed through the proxy server. network resources, which will cause access failure.
  • the proxy server can rewrite the original intranet domain name in the index page, so as to guide the access request initiated by the client based on the index page through the rewritten access link. to the proxy server for processing.
  • the proxy server may follow a preset rewriting rule when rewriting the original intranet domain name.
  • a specified generic domain name can be preset, and the rewritten original intranet domain name needs to include the specified generic domain name.
  • the original intranet domain name can be SH.wangsu.com
  • the specified generic domain name can be set as wsvpn.com
  • the specified generic domain name can be the proxy domain name, that is, the domain name pointing to the VPN proxy service.
  • the proxy domain name will be included in the original intranet domain name of the server, so that the access request sent based on the rewritten domain name can be directed to the proxy server through DNS scheduling.
  • the original intranet domain name when rewriting the original intranet domain name, can be converted into a corresponding string through a hash algorithm or other encoding algorithm, and then the string can be used as a prefix, and the proxy domain name can be used as a suffix.
  • the rewritten original intranet domain name is formed, which can also be called a virtual domain name.
  • the string key1 after SH.wangsu.com is hashed, the string key1 can be obtained, and then key1.wsvpn.com can be used as a virtual domain name rewritten based on the original intranet domain name.
  • the proxy server may locally store the mapping relationship between the original intranet domain name and the character string, so as to identify the original intranet domain name based on the mapping relationship when receiving an access request from the client.
  • the proxy server may restore the character string to the original intranet domain name based on an inverse operation.
  • the proxy server when it rewrites the original intranet domain name in the index page, it can also add other identification information to the virtual domain name.
  • other identification information can be combined with the character string corresponding to the original intranet domain name to form a new character string to form the above-mentioned Key1.
  • the proxy server can respond to the index page to the client, so that the client can access corresponding intranet resources based on the index page.
  • the browser can display the index page and generate the corresponding access request based on the user's choice.
  • the client needs to obtain the destination address of the access request. The destination address is obtained by sending a domain name resolution request to the public DNS server. Since the original intranet domain name in the index page has been rewritten into the corresponding virtual domain name, the access domain name in the domain name resolution request sent by the client is the virtual domain name.
  • the public DNS server may forward the domain name resolution request to the smart DNS server when recognizing that the domain name in the domain name resolution request includes the specified generic domain name.
  • a simple forwarding policy may be configured in the public DNS server in advance, so as to realize forwarding the domain name resolution request of the specified pan domain name to the intelligent DNS server.
  • public DNS servers are generally deployed by network operators and have less configuration rights open to the outside world. Therefore, it is impossible to configure resolution rules directly on the public DNS server, so that the domain name containing the specified pan-domain name can be directly resolved to the proxy server.
  • the resolution request containing the specified pan-domain domain name is forwarded to be processed by the intelligent DNS server. It can be understood that, if the resolution policy can be directly configured on the public DNS server, the functions implemented by the smart DNS server in the embodiment of the present application can be implemented by the public DNS server.
  • the smart DNS server may be an additionally deployed DNS server, and the smart DNS server may be dedicated to processing a domain name resolution request carrying the above-mentioned virtual domain name.
  • a mapping relationship table between the specified generic domain name and the IP address of the proxy server can be stored. In this way, after receiving the domain name resolution request forwarded by the public DNS server, the intelligent DNS server can obtain the IP address of the proxy server by recognizing the pan-domain name therein.
  • a dedicated proxy server can be set on each enterprise side.
  • the smart DNS server can also be configured The mapping relationship between the enterprise and the proxy server.
  • the intelligent DNS server can extract the enterprise information in the domain name resolution request.
  • the virtual domain name can contain enterprise information, and the query and the extracted The proxy server that matches the corporate information. Then, the IP address of the matching proxy server can be identified as the response IP.
  • the IP address can be fed back to the client through the public DNS server.
  • the client can complete the process of domain name resolution, so as to construct an access request, and send the access request to the corresponding proxy server.
  • the access request may be a request conforming to a network communication protocol, for example, the access request may contain quintuple information.
  • the IP address of the proxy server can be used as the destination IP address.
  • a proxy domain name in order to enable the proxy server to normally process the access request sent by the client, a proxy domain name can be pre-configured in the proxy server, and a generic domain name certificate for supporting the proxy domain name can be configured at the same time.
  • the proxy domain name may be the above-mentioned designated generic domain name.
  • the proxy domain name may be *.wsvpn.com, and a certificate of the generic domain name may be configured in the proxy server to support access to the generic domain name.
  • the proxy server after receiving the access request sent by the client, can extract the access domain name therein, and can restore the access domain name to the corresponding original intranet domain name, so as to point to the original intranet domain name.
  • the intranet server initiates a resource acquisition request.
  • the access request received by the proxy server is http://key1.wsvpn.com, where key1.wsvpn.com is a virtual domain name obtained by rewriting the original intranet domain name, and wsvpn.com is the corresponding proxy domain name.
  • the proxy server can extract the key1 in the virtual domain name (access domain name) from the access request, and identify the rewriting rule when the original intranet domain name is rewritten, for example, the rewriting rule can be the above-mentioned hash algorithm or other codes algorithm. Then, the proxy server may perform an inverse operation on the extracted key1 according to the rewriting rule, so as to restore the access domain name to the corresponding original intranet domain name, for example, the original intranet domain name may be SH.wangsu.com.
  • the proxy server can rewrite the access request to generate a resource acquisition request and send it to the target intranet server pointed to by the original intranet domain name to acquire intranet resources.
  • the method of rewriting the access request may include rewriting the virtual domain name in the URL of the access request to the original intranet domain name to obtain a new URL, and the proxy server generates a resource acquisition request sent to the target intranet server based on the new URL.
  • the intranet server may feed back the corresponding resource as response data to the proxy server. Since the response data may contain a response page, that is, a new page displayed in response to an access request, and the response page data is likely to contain other access links, that is, the response page will contain the original intranet domain name.
  • the proxy server The response page also needs to be rewritten to ensure that the access request generated by the client based on the response page can be received by the proxy server, and the proxy server can identify the intranet domain name of the user's real request.
  • the proxy server For the rewriting method, reference may be made to the rewriting method of the index page above, which will not be repeated here.
  • the proxy server does not need to rewrite all domain names in the index page or the response page, because some domain names do not require data proxying.
  • the proxy server is performing In the process of page rewriting, you can first determine whether the domain name information contained in the page conforms to the replacement rule. The basis for the determination may be whether the domain name information is in the whitelist of the pan-domain domain name of the proxy server. If it is, it means that the domain name information complies with the replacement rules, and the domain name needs to be rewritten and replaced. However, if the domain name information is not in the whitelist of the pan-domain name, there is no need to rewrite and replace it.
  • the response data includes domain name A and domain name B, where domain name A is an existing domain name in the public network, or a domain name pointing to other resource servers, then the domain name A can be directly accessed by the client, and the domain name A It is not stored in the pan-domain whitelist, so it does not need to be rewritten and replaced.
  • the domain name B points to the enterprise's intranet server, so it needs to be rewritten and replaced so that subsequent clients can normally access the intranet server through the domain name B.
  • the proxy server can bind the authority domain name with the cookie information and cache the association relationship, so that the cookie information that should be carried in the access request can be queried based on the association relationship.
  • the response data fed back by the intranet server may include set-cookie
  • its domain value may be the intranet domain name, that is, the authority domain name corresponding to the cookie information, that is, the client When the client initiates an access request for an authorized domain name, it needs to carry the corresponding cookie information for verification by the intranet server.
  • the access requests initiated by the client are all sent based on the rewritten virtual domain name, so the proxy server needs to modify the domain value of the set-cookie in the response data to the corresponding virtual domain name , so that the client automatically carries the cookie information when sending an access request based on the virtual domain name.
  • the information in the domain field may also be directly deleted.
  • the proxy server can locally bind the cookie information with the authority domain name, and cache the association relationship between the two.
  • the proxy server can Determine whether the restored original intranet domain name contains the authority domain name saved in the association relationship, and if so, obtain the cookie information corresponding to the authority domain name according to the saved association relationship, and then send the original intranet domain name to the intranet server pointed to by the original intranet domain name.
  • sending a resource acquisition request carry the cookie information corresponding to the authority domain name. Based on this, it can be ensured that the resource acquisition request sent to the intranet server can correctly carry the required cookie information, preventing the intranet server from denying access due to incomplete cookie information.
  • the proxy server can determine whether the response data contains a cookie setting item (set-cookie), and recognizes that the response data contains a cookie setting item After that, the domain information can be detected.
  • the domain information can carry the authority domain name bound to the cookie information, which is generally the original intranet domain name. It is necessary to rewrite the authority domain name to the corresponding virtual domain name, so that the client can locally
  • the cookie information is generated according to set-cookie, the cookie information is associated with the authority domain name, and the association between the authority domain name and the cookie information is established, so that the proxy server can query the association based on the original intranet domain name restored from the access domain name relationship, and determine whether there is corresponding cookie information.
  • set-cookie the cookie setting item
  • the client after replacing the authority domain name in the domain information with the corresponding virtual domain name, when the client can locally set the corresponding cookie information based on the received set-cookie, it can then follow the virtual domain name in the access request. Find the corresponding cookie information, and carry the cookie information for resource access.
  • the authority domain name in the domain information may be a complete domain name or a generic domain name, that is, when the authority domain name is a generic domain name , the client needs to carry the cookie information when sending requests to each subdomain under the generic domain name.
  • the proxy server needs to further confirm the cookie information. , so that the resource acquisition request sent to the intranet server carries the correct cookie information, thereby preventing abnormal access.
  • the cookie information of these two subdomains can be associated with the generic domain name baidu.com.
  • the proxy server receives the access request from the client, if the original intranet domain name after restoration of the access domain name in the access request has the pan-domain name, it can carry the cookie information associated with the pan-domain name and send it to the proxy server.
  • the intranet server sends a resource acquisition request.
  • an embodiment of the present application provides a data proxy method, which is applied to a proxy server. Please refer to FIG. 2 .
  • the method includes the following steps.
  • S1 Receive an access request sent by the client, wherein the destination IP address in the access request points to the proxy server.
  • the request sent by the client received by the proxy server is generated by the client based on the authorization response information or response information fed back by the proxy server, so the access domain name in the access request is a virtual domain name rewritten by the proxy server.
  • Domain name after DNS resolution, the virtual domain name is resolved to the IP address pointing to the proxy server, so that the destination IP in the access request points to the proxy server, and then the access request is received by the proxy server.
  • S3 Restore the access domain name in the access request to the original intranet domain name, and initiate a resource acquisition request to the intranet server pointed to by the original intranet domain name.
  • S5 Receive the response data fed back by the intranet server for the resource acquisition request, and replace the domain name information with a virtual domain name if the response data includes domain name information and the domain name information complies with the replacement rule , the generic domain name of the virtual domain name is the proxy domain name, and the response data including the virtual domain name is fed back to the client.
  • the intranet resource access request sent by the client can be proxied
  • the server receives, and the proxy server can identify the target intranet application actually requested by the client based on the virtual domain name, thereby realizing the distinction of different intranet applications; further, since the format of the virtual domain name is the normal format of the domain name, when the page When there is domain name format verification or other processing logic, since the format remains unchanged, no verification exception will occur, and the problem that the page logic cannot be executed normally due to rewriting is avoided.
  • the present application further provides a proxy server, the proxy server includes a memory and a processor, the memory is used to store a computer program, and the computer program can realize the above data when executed by the processor proxy method.
  • the present application also provides a data proxy system, the data proxy system includes a proxy server, a public DNS server, an intelligent DNS server and an intranet server, wherein:
  • the public DNS server is used for receiving the domain name resolution request sent by the client, and when recognizing that the domain name in the domain name resolution request contains the specified generic domain name, directly resolves the domain name based on the IP address of the proxy server responding to the request, or forwarding the domain name resolution request to the smart DNS server;
  • the intelligent DNS server is used to generate a destination IP address corresponding to the domain name resolution request, and feed back the destination IP address to the client, so that the client sends the proxy server pointed to by the destination IP address initiate an access request;
  • the proxy server is configured to restore the access domain name in the access request to the original intranet domain name, and initiate a resource acquisition request to the intranet server pointed to by the original intranet domain name; receive the intranet domain name
  • the server obtains the response data fed back by the resource acquisition request, and replaces the domain name information with a virtual domain name in the case that the response data contains domain name information and the domain name information conforms to the replacement rule, and the virtual domain name is the generic name of the virtual domain name.
  • the domain name is the proxy domain name, and the response data including the virtual domain name is fed back to the client.
  • the smart DNS server is configured with a mapping relationship table between enterprise information and proxy servers, and the smart DNS server includes:
  • an enterprise information matching unit configured to extract the enterprise information in the domain name resolution request, and query the proxy server matching the extracted enterprise information in the mapping relationship table;
  • the IP address feedback unit is configured to feed back the IP address of the matched proxy server as the destination IP address to the client.
  • the proxy server includes:
  • an intranet domain name information extraction unit configured to identify the rewriting rule when the original intranet domain name is rewritten, and extract the access domain name in the access request;
  • a rewriting unit configured to restore the access domain name to the original intranet domain name according to the rewriting rule.
  • the proxy server further includes:
  • the domain information rewriting unit is used to determine whether the response data contains a cookie setting item, if it contains a cookie setting item, rewrite the authority domain name in the domain information in the cookie setting item to a virtual domain name, and establish the cookie information and the Association relationship between authority domain names.
  • the domain information rewriting unit includes:
  • a cache module used to cache the association relationship between the authority domain name and the cookie information
  • the cookie query module is configured to, when receiving the intranet access request sent by the client again, if the original intranet domain name obtained after the restoration of the access domain name of the intranet access request includes the authority domain name in the association relationship , the cookie information corresponding to the authority domain name is carried when the resource acquisition request is sent to the intranet server pointed to by the original intranet domain name.
  • the system further includes an authentication server, the authentication server is configured to receive the login request forwarded by the proxy server, and after verifying the authority of the client, feedback authorization to the proxy server response information; wherein, in the case that the authorization response data includes domain name information and the domain name information conforms to the replacement rule, the proxy server replaces the domain name information with a virtual domain name.
  • the authentication server is configured to receive the login request forwarded by the proxy server, and after verifying the authority of the client, feedback authorization to the proxy server response information; wherein, in the case that the authorization response data includes domain name information and the domain name information conforms to the replacement rule, the proxy server replaces the domain name information with a virtual domain name.
  • the public DNS server when the public DNS server receives a domain name resolution request carrying a specified pan-domain name, it can directly respond to it based on the IP of the proxy server, or forward the domain name resolution request to the intelligent DNS server. .
  • the intelligent DNS server can resolve the IP address of the corresponding proxy server, and provide the IP address to the client, so that the client can initiate an access request to the corresponding proxy server. In this way, through the determination method of the generic domain name, even if a new subdomain name under the generic domain name appears, the new subdomain name can be guided to the proxy server.
  • the access domain name in the access request initiated by the client is a virtual domain name rewritten based on the original intranet domain name.
  • the virtual domain name can be restored to the corresponding original intranet domain name after being processed by the proxy server.
  • the proxy server can identify the corresponding intranet server according to the original intranet domain name, so as to initiate a resource acquisition request to the intranet server. After the proxy server receives the response data fed back by the intranet server, if the response data contains domain name information and the domain name information complies with the replacement rule, it indicates that the domain name information represents the intranet domain name.
  • the proxy server can replace the domain name information with a virtual domain name, and feed back response data including the virtual domain name to the client, so that the access domain name in the new access request sent by the client based on the response data is the virtual domain name.
  • the client since the intranet domain name cannot be directly accessed through the public network, the client sends and receives the processed virtual domain name. After the virtual domain name is processed by the proxy server, it can be converted into the corresponding intranet domain name, so that the proxy server can identify the actually requested intranet application, and obtain the intranet resources requested by the client from the corresponding intranet server. Data brokering process.
  • each embodiment can be implemented by means of software plus a necessary general hardware platform, and certainly can also be implemented by hardware.
  • the above-mentioned technical solutions can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic A disc, an optical disc, etc., includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments or some parts of the embodiments.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本申请公开了一种数据代理方法、系统及代理服务器，其中，所述方法包括：接收客户端发送的访问请求，所述访问请求中的目的IP地址指向代理服务器，所述访问请求中的访问域名为基于原始内网域名改写生成的虚拟域名；将所述访问请求中的所述访问域名还原为所述原始内网域名，并向所述原始内网域名指向的内网服务器发起资源获取请求；接收所述内网服务器针对所述资源获取请求反馈的响应数据，并在所述响应数据中包含域名信息以及所述域名信息符合替换规则的情况下，将所述域名信息替换为虚拟域名，所述虚拟域名的泛域名为代理域名，并向客户端反馈包含所述虚拟域名的响应数据。

Description

一种数据代理方法、系统及代理服务器
交叉引用
本申请要求于2020年09月16日递交的名称为“一种数据代理方法、系统及代理服务器”、申请号为202010973585.0的中国专利申请的优先权，其通过引用被全部并入本申请。
技术领域
本申请涉及互联网技术领域，特别涉及一种数据代理方法、系统及代理服务器。
背景技术
随着网络安全形势日益严峻，为了阻断来自外部网络的攻击，越来越多的企业和机构将业务限制在内部网络中，禁止来自外部网络的访问，然而很多时候机构内部人员又需要从外部网络访问内部应用，虚拟专用网络(Virtual Private Network，简称为VPN)技术便应运而生。
网页虚拟专用网络(Web Virtual Private Network，简称为WebVPN)提供基于web的内网应用访问控制，允许用户访问只对内部网络开放的web应用。区别于传统VPN技术，WebVPN无需用户安装客户端软件或者浏览器插件，用户可以直接通过浏览器访问登录页面进行身份验证，这大大降低了VPN技术的使用门槛，提升了用户体验。但是在现有的WebVPN系统中，用户的请求先经由VPN代理服务器，如此一来，用户请求中的域名都指向代理域名，代理服务器如何有效区分用户请求实际访问的目标，成为WebVPN技术中的一大难题。
发明内容
本申请的目的在于提供一种数据代理方法、系统及代理服务器，能够有效地区分用户请求实际访问的目标。
为实现上述目的，本申请一方面提供一种数据代理方法，所述方法包括： 接收客户端发送的访问请求，所述访问请求中的目的IP地址指向代理服务器；将所述访问请求中的访问域名还原为原始内网域名，并向所述原始内网域名指向的内网服务器发起资源获取请求；接收所述内网服务器针对所述资源获取请求反馈的响应数据，并在所述响应数据中包含域名信息以及所述域名信息符合替换规则的情况下，将所述域名信息替换为虚拟域名，所述虚拟域名的泛域名为代理域名，并向所述客户端反馈包含所述虚拟域名的响应数据。
在一实施例中，所述访问请求中的目的IP地址由公共DNS服务器直接解析得到，或者由智能DNS服务器解析得到的，其中所述智能DNS服务器接收公共DNS服务器转发的域名解析请求，并将解析结果通过所述公共DNS服务器响应给所述客户端。
在一实施例中，所述方法进一步包含：接收鉴权服务器响应的授权响应数据；在所述授权响应数据中包含域名信息以及所述域名信息符合替换规则的情况下，将所述域名信息替换为虚拟域名，并向所述客户端反馈包含所述虚拟域名的授权响应数据。
在一实施例中，所述客户端基于接收到的所述授权响应数据或所述响应数据生成所述访问请求。
在一实施例中，所述资源获取请求基于所述访问请求改写得到。
在一实施例中，将所述访问请求中的所述访问域名还原为所述原始内网域名包括：识别所述原始内网域名被改写时的改写规则，并提取所述访问请求中的所述访问域名；按照所述改写规则将所述访问域名还原为所述原始内网域名。
在一实施例中，所述域名信息符合替换规则包括：将所述域名信息在泛域名白名单中进行匹配，若存在与所述域名信息相匹配的目标泛域名，判定所述域名信息符合替换规则。
在一实施例中，将所述域名信息替换为虚拟域名包括：按照所述原始内网域名被改写时的改写规则，将所述域名信息改写为虚拟域名，并利用所述虚拟域名替换所述响应数据中对应的域名信息。
在一实施例中，所述方法还包括：判断所述响应数据中是否包含cookie设置项，若包含cookie设置项，将所述cookie设置项中domain信息内的权限域名改写为所述虚拟域名，并缓存cookie信息与所述权限域名之间的关联关系。
在一实施例中，所述方法还包括：当再次接收到所述客户端发送的内网访问请求时，若所述内网访问请求的访问域名还原后得到的原始内网域名中包含所述关联关系中的权限域名，则在向所述原始内网域名指向的内网服务器发送资源获取请求时，携带的所述权限域名对应的cookie信息。
为实现上述目的，本申请另一方面还提一种代理服务器，所述代理服务器包括存储器和处理器，所述存储器用于存储计算机程序，所述计算机程序被所述处理器执行时，实现上述的数据代理方法。
为实现上述目的，本申请另一方面还提供一种数据代理系统，所述数据代理系统包括代理服务器、公共DNS服务器、智能DNS服务器以及内网服务器，其中：所述公共DNS服务器，用于接收客户端发来的域名解析请求，并在识别出所述域名解析请求中的域名包含指定泛域名时，直接基于所述代理服务器的IP地址对所述域名解析请求进行响应，或者将所述域名解析请求转发至所述智能DNS服务器；所述智能DNS服务器，用于生成所述域名解析请求对应的目的IP地址，并将所述目的IP地址反馈给所述客户端，以使得所述客户端向所述目的IP地址指向的代理服务器发起访问请求；所述代理服务器，用于将所述访问请求中的所述访问域名还原为原始内网域名，并向所述原始内网域名指向的内网服务器发起资源获取请求；接收所述内网服务器针对所述资源获取请求反馈的响应数据，并在所述响应数据中包含域名信息以及所述域名信息符合替换规则的情况下，将所述域名信息替换为虚拟域名，所述虚拟域名的泛域名为代理域名，并向所述客户端反馈包含所述虚拟域名的响应数据。
由上可见，本申请提供的技术方案，当公共DNS服务器接收到携带指定泛域名的域名解析请求时，可直接基于代理服务器的IP地址对该域名解析请求进行响应，或者可以将域名解析请求转发至智能DNS服务器处。智能DNS服务器可以解析出对应的代理服务器的IP地址，并将该IP地址提供给客户端，使得客户端能够向对应的代理服务器发起访问请求。这样，经过泛域名的判定方式，即使出现泛域名下新的子域名，也能够将新的子域名引导至代理服务器处。
代理服务器接收到客户端发起的访问请求，可根据访问请求中的访问域名，还原出对应的原始内网域名。代理服务器可以根据该原始内网域名，识别出对应的内网服务器，从而向内网服务器发起资源获取请求。代理服务器接收到内网服务器反馈的响应数据后，如果该响应数据中包含域名信息，并且该域 名信息符合替换规则，那么表明该域名信息表征的是内网域名。代理服务器可以将该域名信息替换为虚拟域名，并向客户端反馈包含该虚拟域名的响应数据，从而使得客户端后续基于响应数据发出的新的访问请求中的访问域名为虚拟域名。
由上可见，由于内网域名不能通过公网直接访问，因此客户端发出和接收到的都可以是经过处理的虚拟域名。该虚拟域名经过代理服务器处理后，可以转换为对应的原始内网域名，及内网应用的真实域名，从而由代理服务器识别出实际请求的内网应用，并从对应的内网服务器上获取到客户端请求的内网资源，完成数据代理过程。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请实施例提供的一种数据代理系统的架构示意图；
图2是本申请实施例提供的一种数据代理方法的步骤示意图；
图3是本申请实施例提供的一种代理服务器的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施例作详细描述。
本申请提供一种数据代理方法，该方法可以应用于如图1所示的系统架构中。请参阅图1，该系统架构中可以包括客户端、代理服务器、鉴权服务器、公共域名系统(Domain Name System，简称为DNS)服务器、智能DNS服务器以及内网服务器。
其中，客户端可以是用户的终端设备，用户可通过安装在客户端的浏览器发送访问请求。
公共DNS服务器一般为网络运营商部署的DNS服务器，客户端发送的DNS解析请求可被公共DNS服务器接收，公共DNS服务器对外开放的操作配 置权限较小，一般仅允许进行简单的配置，在本申请的实施例中，可通过在公共DNS服务器上配置简单的转发规则，实现将包含特定泛域名的DNS解析请求转发至智能DNS服务器。
智能DNS服务器一般由网络服务提供商部署，网络服务提供商的开发人员可在智能DNS服务器上自由配置相关的操作规则，可以接收由公共DNS服务器转发的DNS解析请求，并按照预设规则对其进行解析。
鉴权服务器可以用于对用户身份进行鉴权认证，以确定用户身份是否合法，并下发对应的内网资源访问权限。
代理服务器可以作为虚拟专用网络(Virtual Private Network，简称为VPN)网关，接收客户端的访问请求，并可通过VPN网络与内网服务器建立通信连接，以转发客户端发送的访问请求至对应的内网服务器，并接收内网服务器针对访问请求的响应数据，进而将响应数据发送至客户端。代理服务器，可实现客户端与内网服务器之间的数据代理。
内网服务器可以为部署在内网环境中的源站服务器，运行有提供服务的应用程序，用于对访问请求进行响应。
值得注意的是，在一个实施例中，代理服务器通过VPN网络与内网服务器建立通信连接，其中所使用的VPN网络可基于广域软件定义网络(Software-Defined Wide Area Network，简称为SD-WAN)架构实现。
在一个实施例中，当客户端需要访问内网资源时，可以先通过鉴权服务器进行权限认证。具体地，客户端可以向代理服务器发起登陆请求，代理服务器将登陆请求转发至鉴权服务器进行权限验证，鉴权服务器可根据用户信息用户权限进行验证，并在验证通过后，反馈授权响应数据，授权响应数据中可包含访问内网资源的页面，例如，功能索引页面。在索引页面中，可以包含用于访问各项内网资源的跳转入口。例如，索引页面中可以包含企业内各个分支机构的访问入口，还可以包含各项业务的数据支持入口等。在鉴权服务器响应的索引页面中，这些访问入口的链接均被写入页面代码中，链接中可包含对应内网资源的域名，即原始内网域名，例如，上海分支机构的原始内网域名可以是SH.wangsu.com。然而，如果直接向客户端展示包含这些原始内网域名的索引页面，那么当客户端直接基于这些原始内网域名时发出访问请求时，是无法被代理服务器接收的，进而无法通过代理服务器访问内网资源，这样会导致访问失 败。鉴于此，代理服务器在接收到鉴权服务器反馈的授权响应数据后，可对索引页面其中的原始内网域名进行改写，以通过改写后的访问链接，将客户端基于索引页面发起的访问请求引导至代理服务器处进行处理。
在一个实施例中，代理服务器在对原始内网域名进行改写时，可以遵循预设的改写规则。
首先，可以预先设置一个指定泛域名，改写后的原始内网域名需要包含该指定泛域名。举例来说，原始内网域名例如可以是SH.wangsu.com，那么可以设置指定泛域名为wsvpn.com，其中，该指定泛域名便可以为代理域名，即指向VPN代理服务的域名，改写后的原始内网域名中，都将包含该代理域名，如此一来，便可通过DNS调度，将基于改写后的域名发送的访问请求引导至代理服务器。
其次，在对原始内网域名进行改写时，可以通过哈希算法或者其它编码算法，将原始内网域名转换为对应的字符串，然后该字符串可以作为前缀，并将代理域名作为后缀，共同形成改写后的原始内网域名，也可称为虚拟域名。例如，SH.wangsu.com经过哈希运算之后，可以得到字符串key1，然后便可以将key1.wsvpn.com作为基于原始内网域名改写得到的虚拟域名。值得注意的是，在对原始内网域名转换为对应的字符串时，也可基于其他规则进行设定，只需保证不同的原始内网域名对应的字符串也不同即可，从而使得代理服务器可基于字符串识别出对应的原始内网域名。
在一实施例中，代理服务器可在本地保存原始内网域名与字符串的映射关系，用于在接收到客户端的访问请求时，基于映射关系，识别出原始内网域名。
在一实施例中，若原始内网域名所对应的字符串是基于预设算法得到的，代理服务器可基于逆运算将字符串还原为原始内网域名。
在一实施例中，代理服务器在于索引页面中的原始内网域名进行改写时，还可以在虚拟域名中添加其他识别信息，例如，虚拟域名中还可以包含企业信息，用于区分客户端所属的企业，这样，当网络服务提供商在为多个不同的企业提供代理服务时，可根据虚拟域名中的企业信息来进行流量调度，具体将在下文说明。在本实施中，其他识别信息可与原始内网域名对应的字符串组合成为一新的字符串，以构成上述Key1。
在一实施例中，代理服务器在对索引页面中的原始内网域名的改写完成后，可将索引页面响应给客户端，使得客户端可基于索引页面访问相应的内网资源。客户端在接收到响应信息后，浏览器可对索引页面进行展示，并基于用户的选择生成相应的访问请求，在生成访问请求前，客户端需先获取访问请求的目的地址，具体的，可通过向公共DNS服务器发送域名解析请求来获取目的地址。由于索引页面中的原始内网域名已被改写成对应的虚拟域名，因此，客户端发出的域名解析请求中的访问域名为虚拟域名。
在一实施例中，公共DNS服务器接收到客户端发送的域名解析请求后，可在识别出域名解析请求中的域名包含指定泛域名时，将所述域名解析请求转发至智能DNS服务器。在本实施例中，可预先在公共DNS服务器中配置简单的转发策略，来实现将指定泛域名的域名解析请求转发至智能DNS服务器。如上文所述，公共DNS服务器一般有网络运营商部署，对外开放的配置权限较少，因此无法直接在公共DNS服务器上配置解析规则，使得可直接将包含指定泛域名的域名解析为代理服务器的地址，从而通过配置简单的转发策略，将包含指定泛域名的解析请求转发由智能DNS服务器来处理。可以理解的是，若可直接在公共DNS服务器上配置解析策略，本申请实施例中的智能DNS服务器所实现的功能可由公共DNS服务器来实现。
在本实施例中，智能DNS服务器可以是额外部署的DNS服务器，该智能DNS服务器可以专用于处理携带上述虚拟域名的域名解析请求。在智能DNS服务器中，可以存储指定泛域名与代理服务器IP地址的映射关系表。这样，智能DNS服务器接收到公共DNS服务器转发的域名解析请求后，通过识别其中的泛域名，便可以解析得到代理服务器的IP地址。
在一个实施例中，由于同时需要进行数据代理的企业不止一家，在每个企业侧可设有专门的代理服务器，为了将访问请求引导至对应的代理服务器上，在智能DNS服务器中还可以配置企业与代理服务器之间的映射关系。这样，智能DNS服务器在接收到域名解析请求时，可以提取域名解析请求中的企业信息，如上文所述，虚拟域名中可包含企业信息，并在所述映射关系表中查询与提取的所述企业信息相匹配的代理服务器。然后，可以识别该相匹配的代理服务器的IP地址，作为响应IP。
在本实施例中，智能DNS服务器解析得到代理服务器的IP地址后，便 可以通过公共DNS服务器，将该IP地址反馈给客户端。这样，客户端便可以完成域名解析的过程，从而可以构建访问请求，并将该访问请求发送至对应的代理服务器处。该访问请求可以是符合网络通信协议的请求，例如在该访问请求中可以包含五元组信息。其中，代理服务器的IP地址便可以作为目的IP地址。
在一个实施例中，为了使得代理服务器能够正常处理客户端发来的访问请求，可以预先在代理服务器中配置代理域名，同时一并配置用于支持该代理域名的泛域名证书。其中，该代理域名便可以是上述的指定泛域名。例如，该代理域名可以是*.wsvpn.com，并且在代理服务器中可以配置该泛域名的证书，从而支持该泛域名的访问。
在一实施例中，代理服务器接收到客户端发来的访问请求后，可以提取其中的访问域名，并可以将该访问域名还原为对应的原始内网域名，从而向所述原始内网域名指向的内网服务器发起资源获取请求。举例来说，代理服务器接收到的访问请求为http://key1.wsvpn.com，其中key1.wsvpn.com为原始内网域名改写得到的虚拟域名，wsvpn.com为对应的代理域名。此时，代理服务器可以从访问请求中提取出虚拟域名(访问域名)中的key1，并识别原始内网域名被改写时的改写规则，该改写规则例如可以是上述的哈希算法或者其它的编码算法。然后，代理服务器可以按照该改写规则，对提取的key1进行逆运算，从而将访问域名还原为对应的原始内网域名，该原始内网域名例如可以是SH.wangsu.com。
在得到原始内网域名后，代理服务器可以对访问请求进行改写，以生成资源获取请求，并发往原始内网域名指向的目标内网服务器，以获取内网资源。其中，改写访问请求的方式可包含，将访问请求的URL中的虚拟域名改写为原始内网域名以得到新的URL，代理服务器基于新的URL生成发往目标内网服务器的资源获取请求。
在本实施例中，内网服务器接收到代理服务器发来的资源获取请求后，可以将对应的资源作为响应数据反馈给代理服务器。由于响应数据中可能包含响应页面，即响应访问请求而展示的新页面，而响应页面数据中很可能其他访问链接，也就是响应页面中会包含原始内网域名，在这种情况下，代理服务器还需对响应页面进行改写，以保证客户端基于响应页面生成的访问请求可被代理服务器接收，并且可让代理服务器能识别出用户真实的请求的内网域名，其 中，代理服务器对响应页面的改写方法可参照上述索引页面的改写方法，在此不再赘述。
值得注意的是，在一实施例中，代理服务器并不需要对索引页面或者响应页面中的所有域名都进行改写，因为有些域名并不需要进行数据代理，在这种场景下，代理服务器在进行页面改写的过程中，可以先判断页面中包含的域名信息是否符合替换规则。判断的依据可以是，该域名信息是否在代理服务器的泛域名白名单中。如果在，则说明该域名信息符合替换规则，需要进行域名改写和替换。而如果该域名信息不在泛域名白名单中，则无需对其进行改写和替换。举例来说，响应数据中包括域名A和域名B，其中，域名A是公网中已经存在的域名，或者是指向其它资源服务器的域名，那么该域名A可以由客户端直接访问，该域名A不会存储于泛域名白名单中，因此无需对其进行改写和替换。而域名B指向该企业的内网服务器，因此为了后续客户端能够正常通过该域名B对内网服务器进行访问，就需要对其进行改写和替换。
为了防止因访问请求中携带的cookie信息不全导致的访问异常，代理服务器可以将权限域名与cookie信息进行绑定并缓存关联关系，从而可基于关联关系查询访问请求应该携带的cookie信息。
在本申请的一个实施例中，由于内网服务器反馈的响应数据中可能包含set-cookie，其域(domain)值可为内网域名，即该cookie信息对应的权限域名，也就是说，客户端在针对权限域名发起访问请求时，需携带对应的cookie信息以供内网服务器进行验证。
然而，本申请所提供的实施例中，客户端发起的访问请求，都是基于改写后的虚拟域名发出的，因此代理服务器需要将响应数据中的set-cookie的domain值修改为对应的虚拟域名，使得客户端基于该虚拟域名发送访问请求时，自动携带该cookie信息。值得注意的是，在本申请的其他实施例中，也可直接将domain字段中的信息进行删除。
同时，代理服务器可在本地将cookie信息与权限域名进行绑定，并缓存两者的关联关系，当再次接收到所述客户端发送的内网访问请求时，在对访问域名进行还原后，可判断还原得到的原始内网域名中是否包含有关联关系中保存的权限域名，若包含，则可根据保存的关联关系获得权限域名对应的cookie信息，进而在向原始内网域名指向的内网服务器发送资源获取请求时，携带的 所述权限域名对应的cookie信息。基于此，可保证发往内网服务器的资源获取请求可正确携带所需的cookie信息，避免内网服务器因cookie信息不全而拒绝访问。
具体地，在本实施例中，代理服务器在接收到内网服务器反馈的响应数据后，可以判断该响应数据中是否包含cookie设置项(set-cookie)，在识别出响应数据中包含cookie设置项后，可以检测其中的domain信息，该domain信息内可以携带与cookie信息相绑定的权限域名，一般为原始内网域名，则需要将权限域名改写为对应的虚拟域名，从而使得客户端本地在根据set-cookie生成cookie信息时，将该cookie信息与权限域名相关联，同时建立权限域名与cookie信息之间的关联关系，使得代理服务器可基于访问域名还原得到的原始内网域名来查询该关联关系，并确定是否有对应的cookie信息。具体地，内网域名的改写及还原的方式，可以参考前文的描述，这里便不再赘述。
在本实施例中，将domain信息中的权限域名替换为对应的虚拟域名之后，当客户端可基于接收到的set-cookie在本地设置对应的cookie信息，后续便可以根据访问请求中的虚拟域名查找到对应的cookie信息，并携带该cookie信息进行资源访问，在实际应用中，domain信息中的权限域名可能为完整的域名，也可能为泛域名，也就是说，当权限域名为泛域名时，客户端向该泛域名下的各子域名发送请求时，都需要携带该cookie信息，然而由于改写得到的虚拟域名无法体现出这种关联关系，因此，需要由代理服务器进一步进行cookie信息的确认，使得发往内网服务器的资源获取请求中，携带有正确的cookie信息，从而防止访问异常。
例如，泛域名baidu.com下可以有www.baidu.com和tieba.baidu.com这两个子域名，那么可以将这两个子域名的cookie信息均与泛域名baidu.com关联。这样，代理服务器在接收到客户端发来的访问请求时，如果访问请求中的访问域名还原后的原始内网域名中具备该泛域名，那么可以携带与该泛域名相关联的cookie信息，向内网服务器发送资源获取请求。
基于以上描述的内容，本申请一个实施例提供一种数据代理方法，应用于代理服务器，请参阅图2，所述方法包括以下步骤。
S1：接收客户端发送的访问请求，其中所述访问请求中的目的IP地址指向代理服务器。
基于上述实施例可知，代理服务器接收到的客户端发送的请求，是由客户端基于代理服务器反馈的授权响应信息或响应信息生成的，因此访问请求中的访问域名是由代理服务器改写得到的虚拟域名，经过DNS解析，该虚拟域名被解析为指向代理服务器的IP地址，从而使得访问请求中的目的IP指向代理服务器，进而该访问请求被代理服务器接收。
S3：将所述访问请求中的所述访问域名还原为所述原始内网域名，并向所述原始内网域名指向的内网服务器发起资源获取请求。
S5：接收所述内网服务器针对所述资源获取请求反馈的响应数据，并在所述响应数据中包含域名信息以及所述域名信息符合替换规则的情况下，将所述域名信息替换为虚拟域名，所述虚拟域名的泛域名为代理域名，并向客户端反馈包含所述虚拟域名的响应数据。
综上所述，本申请实施例所提供的数据代理方法，通过将发送给客户端操作的页面信息中的原始内网域名改写为虚拟域名，使得客户端发出的内网资源访问请求可被代理服务器接收，并且代理服务器可基于虚拟域名识别出客户端实际请求的目标内网应用，从而实现不同内网应用的区分；更进一步的，由于虚拟域名的格式为域名的正常格式，因此，当页面存在域名格式校验或其他处理逻辑时，由于格式不变，使得不会发生校验异常的情况，避免因改写而导致页面逻辑无法正常执行的问题。
请参阅图3，本申请还提供一种代理服务器，所述代理服务器包括存储器和处理器，所述存储器用于存储计算机程序，所述计算机程序被所述处理器执行时，可以实现上述的数据代理方法。
基于相同的发明构思，本申请还提供一种数据代理系统，所述数据代理系统包括代理服务器、公共DNS服务器、智能DNS服务器以及内网服务器，其中：
所述公共DNS服务器，用于接收客户端发来的域名解析请求，并在识别出所述域名解析请求中的域名包含指定泛域名时，直接基于所述代理服务器的IP地址对所述域名解析请求进行响应，或者将所述域名解析请求转发至所述智能DNS服务器；
所述智能DNS服务器，用于生成所述域名解析请求对应的目的IP地址，并将所述目的IP地址反馈给所述客户端，以使得所述客户端向所述目的IP地址指 向的代理服务器发起访问请求；
所述代理服务器，用于将所述访问请求中的所述访问域名还原为所述原始内网域名，并向所述原始内网域名指向的内网服务器发起资源获取请求；接收所述内网服务器针对所述资源获取请求反馈的响应数据，并在所述响应数据中包含域名信息以及所述域名信息符合替换规则的情况下，将所述域名信息替换为虚拟域名，所述虚拟域名的泛域名为代理域名，并向客户端反馈包含所述虚拟域名的响应数据。
在一个实施例中，所述智能DNS服务器中配置有企业信息与代理服务器的映射关系表，所述智能DNS服务器包括：
企业信息匹配单元，用于提取所述域名解析请求中的企业信息，并在所述映射关系表中查询与提取的所述企业信息相匹配的代理服务器；
IP地址反馈单元，用于将所述相匹配的代理服务器的IP地址作为目的IP地址反馈给所述客户端。
在一个实施例中，所述代理服务器包括：
内网域名信息提取单元，用于识别所述原始内网域名被改写时的改写规则，并提取所述访问请求中的所述访问域名；
改写单元，用于按照所述改写规则将所述访问域名还原为所述原始内网域名。
在一个实施例中，所述代理服务器还包括：
domain信息改写单元，用于判断所述响应数据中是否包含cookie设置项，若包含cookie设置项，将所述cookie设置项中domain信息内的权限域名改写为虚拟域名，并建立cookie信息与所述权限域名之间的关联关系。
在一个实施例中，所述domain信息改写单元包括：
缓存模块，用于缓存所述权限域名与cookie信息的关联关系；
cookie查询模块，用于当再次接收到所述客户端发送的内网访问请求时，若所述内网访问请求的访问域名还原后得到的原始内网域名中包含所述关联关系中的权限域名，则在向所述原始内网域名指向的内网服务器发送资源获取请求时，携带的所述权限域名对应的cookie信息。
在一个实施例中，所述系统还包括鉴权服务器，所述鉴权服务器用于接收所述代理服务器转发的登陆请求，并在验证通过所述客户端的权限后，向所 述代理服务器反馈授权响应信息；其中，在所述授权响应数据中包含域名信息以及所述域名信息符合替换规则的情况下，所述代理服务器将所述域名信息被替换为虚拟域名。
由上可见，本申请提供的技术方案，当公共DNS服务器接收到携带指定泛域名的域名解析请求时，可以直接基于代理服务器的IP对其进行响应，或者将域名解析请求转发至智能DNS服务器处。智能DNS服务器可以解析出对应的代理服务器的IP地址，并将该IP地址提供给客户端，使得客户端能够向对应的代理服务器发起访问请求。这样，经过泛域名的判定方式，即使出现泛域名下新的子域名，也能够将新的子域名引导至代理服务器处。
客户端发起的访问请求中的访问域名，是基于原始内网域名改写得到的虚拟域名，该虚拟域名经过代理服务器处理后，可以还原为对应的原始内网域名。代理服务器可以根据该原始内网域名，识别出对应的内网服务器，从而向内网服务器发起资源获取请求。代理服务器接收到内网服务器反馈的响应数据后，如果该响应数据中包含域名信息，并且该域名信息符合替换规则，那么表明该域名信息表征的是内网域名。代理服务器可以将该域名信息替换为虚拟域名，并向客户端反馈包含该虚拟域名的响应数据，从而使得客户端后续基于响应数据发出的新的访问请求中的访问域名为虚拟域名。
由上可见，由于内网域名不能通过公网直接访问，因此客户端发出和接收到的都可以是经过处理的虚拟域名。该虚拟域名经过代理服务器处理后，可以转换为对应的内网域名，从而由代理服务器识别出实际请求的内网应用，并从对应的内网服务器上获取到客户端请求的内网资源，完成数据代理过程。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，针对系统和代理服务器的实施例来说，均可以参照前述方法的实施例的介绍对照解释。
通过以上的实施例的描述，本领域的技术人员可以清楚地了解到各实施例可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件。基于这样的理解，上述技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在计算机可读存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可 以是个人计算机，服务器，或者网络设备等)执行各个实施例或者实施例的某些部分所述的方法。
以上所述仅为本申请的部分实施例，并不用以限制本申请，凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (17)

  1. 一种数据代理方法，包括：
    接收客户端发送的访问请求，其中，所述访问请求中的目的IP地址指向代理服务器；
    将所述访问请求中的所述访问域名还原为原始内网域名，并向所述原始内网域名指向的内网服务器发起资源获取请求；
    接收所述内网服务器针对所述资源获取请求反馈的响应数据，并在所述响应数据中包含域名信息以及所述域名信息符合替换规则的情况下，将所述域名信息替换为虚拟域名，所述虚拟域名的泛域名为代理域名，并向所述客户端反馈包含所述虚拟域名的所述响应数据。
  2. 根据权利要求1所述的方法，其中，所述访问请求中的目的IP地址由公共DNS服务器直接解析得到，或者由智能DNS服务器解析得到的，其中所述智能DNS服务器接收公共DNS服务器转发的域名解析请求，并将解析结果通过所述公共DNS服务器响应给所述客户端。
  3. 根据权利要求1所述的方法，其中，所述方法进一步包含：
    接收鉴权服务器响应的授权响应数据；
    在所述授权响应数据中包含域名信息以及所述域名信息符合替换规则的情况下，将所述域名信息替换为虚拟域名，并向所述客户端反馈包含所述虚拟域名的授权响应数据。
  4. 根据权利要求1或3所述的方法，其中，所述客户端基于接收到的所述授权响应数据或所述响应数据生成所述访问请求。
  5. 根据权利要求1所述的方法，其中，所述资源获取请求基于所述访问请求改写得到。
  6. 根据权利要求1所述的方法，其中，将所述访问请求中的所述访问域名还原为所述原始内网域名包括：
    识别所述原始内网域名被改写时的改写规则，并提取所述访问请求中的所述访问域名；
    按照所述改写规则将所述访问域名还原为所述原始内网域名。
  7. 根据权利要求1所述的方法，其中，所述域名信息符合替换规则包括：
    将所述域名信息在泛域名白名单中进行匹配，若存在与所述域名信息相匹配的目标泛域名，判定所述域名信息符合替换规则。
  8. 根据权利要求1或7所述的方法，其中，将所述域名信息替换为虚拟域名包括：
    按照所述原始内网域名被改写时的改写规则，将所述域名信息改写为虚拟域名，并利用所述虚拟域名替换所述响应数据中对应的域名信息。
  9. 根据权利要求1所述的方法，其中，所述方法还包括：
    判断所述响应数据中是否包含cookie设置项，若包含cookie设置项，将所述cookie设置项中domain信息内的权限域名改写为所述虚拟域名，并缓存cookie信息与所述权限域名之间的关联关系。
  10. 根据权利要求9所述的方法，其中，所述方法还包括：
    当再次接收到所述客户端发送的内网访问请求时，若所述内网访问请求的访问域名还原后得到的原始内网域名中包含所述关联关系中的权限域名，则在向所述原始内网域名指向的内网服务器发送资源获取请求时，携带的所述权限域名对应的cookie信息。
  11. 一种代理服务器，包括存储器和处理器，所述存储器用于存储计算机程序，所述计算机程序被所述处理器执行时，实现如权利要求1至10中任一所述的方法。
  12. 一种数据代理系统，包括代理服务器、公共DNS服务器、智能DNS服务器以及内网服务器，其中：
    所述公共DNS服务器，用于接收客户端发来的域名解析请求，并在识别出所述域名解析请求中的域名包含指定泛域名时直接基于所述代理服务器的IP地址对所述域名解析请求进行响应，或者将所述域名解析请求转发至所述智能DNS服务器；
    所述智能DNS服务器，用于生成所述域名解析请求对应的目的IP地址，并将所述目的IP地址反馈给所述客户端，以使得所述客户端向所述目的IP地址指向的代理服务器发起访问请求；
    所述代理服务器，用于将所述访问请求中的访问域名还原为原始内网域名，并向所述原始内网域名指向的内网服务器发起资源获取请求；接收所述内网服务器针对所述资源获取请求反馈的响应数据，并在所述响应数据中包含域名信息以及所述域名信息符合替换规则的情况下，将所述域名信息替换为虚拟域名，所述虚拟域名的泛域名为代理域名，并向客户端反馈包含所述虚拟域名的响应数据。
  13. 根据权利要求12所述的系统，其中，所述智能DNS服务器中配置有企业信息与代理服务器的映射关系表，所述智能DNS服务器包括：
    企业信息匹配单元，用于提取所述域名解析请求中的企业信息，并在所述映射关系表中查询与提取的所述企业信息相匹配的代理服务器；
    IP地址反馈单元，用于将所述相匹配的代理服务器的IP地址作为目的IP地址反馈给所述客户端。
  14. 根据权利要求12所述的系统，其中，所述代理服务器包括：
    内网域名信息提取单元，用于识别所述原始内网域名被改写时的改写规则，并提取所述访问请求中的所述访问域名；
    改写单元，用于按照所述改写规则将所述访问域名还原为所述原始内网域名。
  15. 根据权利要求12所述的系统，其中，所述代理服务器还包括：
    domain信息改写单元，用于判断所述响应数据中是否包含cookie设置项，若包含cookie设置项，将所述cookie设置项中domain信息内的权限域名改写为 代理域名，并建立cookie信息与所述权限域名之间的关联关系。
  16. 根据权利要求15所述的系统，其中，所述domain信息改写单元包括：
    缓存模块，用于缓存所述权限域名与cookie信息的关联关系；
    cookie查询模块，用于当再次接收到所述客户端发送的内网访问请求时，若所述内网访问请求的访问域名还原后得到的原始内网域名中包含所述关联关系中的权限域名，则在向所述原始内网域名指向的内网服务器发送资源获取请求时，携带的所述权限域名对应的cookie信息。
  17. 根据权利要求12所述的系统，其中，所述系统还包括鉴权服务器，所述鉴权服务器用于接收所述代理服务器转发的登陆请求，并在验证通过所述客户端的权限后，向所述代理服务器反馈授权响应信息；其中，在所述授权响应数据中包含域名信息以及所述域名信息符合替换规则的情况下，所述代理服务器将所述域名信息替换为虚拟域名。
PCT/CN2020/122547 2020-09-16 2020-10-21 一种数据代理方法、系统及代理服务器 WO2022057000A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010973585.0A CN112272158A (zh) 2020-09-16 2020-09-16 一种数据代理方法、系统及代理服务器
CN202010973585.0 2020-09-16

Publications (1)

Publication Number Publication Date
WO2022057000A1 true WO2022057000A1 (zh) 2022-03-24

Family

ID=74349538

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/122547 WO2022057000A1 (zh) 2020-09-16 2020-10-21 一种数据代理方法、系统及代理服务器

Country Status (2)

Country Link
CN (1) CN112272158A (zh)
WO (1) WO2022057000A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114466066A (zh) * 2022-04-13 2022-05-10 北京指掌易科技有限公司 基于Web的反向代理方法、装置、介质及电子设备
CN115190107A (zh) * 2022-07-07 2022-10-14 四川川大智胜系统集成有限公司 基于泛域名多子系统管理方法、管理终端及可读存储介质
CN115442158A (zh) * 2022-11-07 2022-12-06 易方信息科技股份有限公司 一种网络请求方法、系统及存储介质和终端设备
CN115589426A (zh) * 2022-09-08 2023-01-10 中冶赛迪信息技术(重庆)有限公司 一种网络服务调用方法及系统
CN116170240A (zh) * 2023-04-26 2023-05-26 北京微步在线科技有限公司 私有化部署服务的访问方法、装置、电子设备及存储介质

Families Citing this family (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113163024B (zh) * 2021-03-12 2023-04-07 网宿科技股份有限公司 报文处理方法、服务器及存储介质
CN112714197B (zh) * 2021-03-29 2021-08-03 杭州优云科技有限公司 一种零配置实现https代理的方法、装置及网络设备
CN113315852B (zh) * 2021-04-27 2023-11-24 北京奇艺世纪科技有限公司 一种域名解析的方法、装置及系统
CN113194099B (zh) * 2021-04-30 2023-04-18 网宿科技股份有限公司 一种数据代理方法及代理服务器
CN113381978B (zh) * 2021-05-12 2023-06-27 网宿科技股份有限公司 一种安全登录方法和装置
CN113381979B (zh) * 2021-05-12 2023-05-23 网宿科技股份有限公司 一种访问请求代理方法及代理服务器
CN113364741A (zh) * 2021-05-17 2021-09-07 网宿科技股份有限公司 一种应用访问方法及代理服务器
EP4343585A1 (en) * 2021-05-19 2024-03-27 Wangsu Science & Technology Co., Ltd. Resource acquisition method and system, webvpn proxy server and server
CN113556388B (zh) * 2021-07-14 2023-06-13 杭州玳数科技有限公司 代理服务方法、代理服务平台、计算机设备和存储介质
CN114189493B (zh) * 2021-11-08 2024-04-12 深圳市酷开网络科技股份有限公司 分布式信令通信方法、计算机设备、信令系统及存储介质
CN114374669B (zh) * 2022-01-11 2024-04-26 杭州迪普科技股份有限公司 Vpn客户端代理dns解析方法及系统
CN114422472B (zh) * 2022-01-19 2024-03-12 中国农业银行股份有限公司 网络地址转换方法、装置及电子设备
CN114710314B (zh) * 2022-02-21 2023-06-06 深圳腾银信息咨询有限责任公司 一种配置化的软件服务平台访问方法、装置、系统及介质
CN114640533B (zh) * 2022-03-29 2023-11-24 北京有竹居网络技术有限公司 传输消息的方法、装置、存储介质及电子设备
CN115174675B (zh) * 2022-06-30 2023-10-17 北京华御数观科技有限公司 一种kafka服务访问方法
CN115714756A (zh) * 2022-10-24 2023-02-24 阿里巴巴（中国）有限公司 私有网络的访问方法和系统
CN115987956B (zh) * 2022-12-28 2024-03-12 中国电子产业工程有限公司 Web代理应用的资源引用方法、电子设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103067417A (zh) * 2011-10-19 2013-04-24 华耀(中国)科技有限公司 VPN中安全代理的Web服务映射方法及其系统
WO2013143403A1 (zh) * 2012-03-31 2013-10-03 北京奇虎科技有限公司 一种访问网站的方法和系统
CN106878458A (zh) * 2017-03-24 2017-06-20 福建中金在线信息科技有限公司 一种代理访问方法及系统
CN109889626A (zh) * 2019-03-20 2019-06-14 湖南快乐阳光互动娱乐传媒有限公司 获取ip地址和dns地址的对应关系的方法及装置、系统

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101242336B (zh) * 2008-03-13 2010-12-01 杭州华三通信技术有限公司 远程访问内网Web服务器的方法及Web代理服务器
CN102769618B (zh) * 2012-07-18 2015-03-11 北京星网锐捷网络技术有限公司 Web访问处理方法、网络设备及通信系统
US20180191856A1 (en) * 2016-12-29 2018-07-05 Synology Inc. Cross-domain communication methods and proxy servers using the same
US10778684B2 (en) * 2017-04-07 2020-09-15 Citrix Systems, Inc. Systems and methods for securely and transparently proxying SAAS applications through a cloud-hosted or on-premise network gateway for enhanced security and visibility
CN109787951B (zh) * 2018-11-22 2022-09-02 北京奇艺世纪科技有限公司 一种网络数据访问方法、装置及电子设备
CN110266661B (zh) * 2019-06-04 2021-09-14 东软集团股份有限公司 一种授权方法、装置及设备
CN110602269B (zh) * 2019-10-22 2022-10-21 北京天融信网络安全技术有限公司 一种转换域名的方法
CN110808897A (zh) * 2019-11-06 2020-02-18 深信服科技股份有限公司 代理访问方法、用户设备、存储介质、装置及系统
CN110855766A (zh) * 2019-11-06 2020-02-28 北京天融信网络安全技术有限公司 一种访问Web资源的方法、装置及代理服务器

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103067417A (zh) * 2011-10-19 2013-04-24 华耀(中国)科技有限公司 VPN中安全代理的Web服务映射方法及其系统
WO2013143403A1 (zh) * 2012-03-31 2013-10-03 北京奇虎科技有限公司 一种访问网站的方法和系统
CN106878458A (zh) * 2017-03-24 2017-06-20 福建中金在线信息科技有限公司 一种代理访问方法及系统
CN109889626A (zh) * 2019-03-20 2019-06-14 湖南快乐阳光互动娱乐传媒有限公司 获取ip地址和dns地址的对应关系的方法及装置、系统

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114466066A (zh) * 2022-04-13 2022-05-10 北京指掌易科技有限公司 基于Web的反向代理方法、装置、介质及电子设备
CN114466066B (zh) * 2022-04-13 2022-07-22 北京指掌易科技有限公司 基于Web的反向代理方法、装置、介质及电子设备
CN115190107A (zh) * 2022-07-07 2022-10-14 四川川大智胜系统集成有限公司 基于泛域名多子系统管理方法、管理终端及可读存储介质
CN115589426A (zh) * 2022-09-08 2023-01-10 中冶赛迪信息技术(重庆)有限公司 一种网络服务调用方法及系统
CN115442158A (zh) * 2022-11-07 2022-12-06 易方信息科技股份有限公司 一种网络请求方法、系统及存储介质和终端设备
CN116170240A (zh) * 2023-04-26 2023-05-26 北京微步在线科技有限公司 私有化部署服务的访问方法、装置、电子设备及存储介质
CN116170240B (zh) * 2023-04-26 2023-08-01 北京微步在线科技有限公司 私有化部署服务的访问方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
CN112272158A (zh) 2021-01-26

Similar Documents

Publication Publication Date Title
WO2022057000A1 (zh) 一种数据代理方法、系统及代理服务器
US10785037B2 (en) Managing secure content in a content delivery network
US10666608B2 (en) Transparent proxy authentication via DNS processing
US10505985B1 (en) Hostname validation and policy evasion prevention
US8910270B2 (en) Remote access to private network resources from outside the network
WO2022056996A1 (zh) 一种安全访问内网应用的方法和装置
WO2022247751A1 (zh) 远程访问应用的方法、系统、装置、设备及存储介质
US10230691B2 (en) Systems, devices, and methods for improved domain name system firewall protection
CN113381979B (zh) 一种访问请求代理方法及代理服务器
WO2022057002A1 (zh) 一种异常请求处理方法和装置
US20210334330A1 (en) Encoding-free javascript stringify for clientless vpn
US11616853B2 (en) Dynamic domain discovery and proxy configuration
US20200228498A1 (en) Message Processing Method, Electronic Device, and Readable Storage Medium
CN113194099B (zh) 一种数据代理方法及代理服务器
JP2005501354A (ja) 単一ｉｐアドレスを介して複数のウェブ・ドメインによりウェブ・サービスを提供する方法およびシステム
CN114338597A (zh) 一种网络访问方法及装置
US11184318B2 (en) 302 redirecting method, URL generating method and system, and domain-name resolving method and system
CN115913583A (zh) 业务数据访问方法、装置和设备及计算机存储介质
US11323426B2 (en) Method to identify users behind a shared VPN tunnel
CN112260991B (zh) 一种鉴权管理方法和装置
CN114095473A (zh) 网络业务的处理方法、装置和系统

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20953857

Country of ref document: EP

Kind code of ref document: A1