WO2023020606A1 - Procédé, système et appareil pour masquer une station source, et dispositif et support de stockage - Google Patents

Procédé, système et appareil pour masquer une station source, et dispositif et support de stockage Download PDF

Info

Publication number
WO2023020606A1
WO2023020606A1 PCT/CN2022/113500 CN2022113500W WO2023020606A1 WO 2023020606 A1 WO2023020606 A1 WO 2023020606A1 CN 2022113500 W CN2022113500 W CN 2022113500W WO 2023020606 A1 WO2023020606 A1 WO 2023020606A1
Authority
WO
WIPO (PCT)
Prior art keywords
connector
server
client
target
target application
Prior art date
Application number
PCT/CN2022/113500
Other languages
English (en)
Chinese (zh)
Inventor
胡金涌
Original Assignee
上海云盾信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 上海云盾信息技术有限公司 filed Critical 上海云盾信息技术有限公司
Publication of WO2023020606A1 publication Critical patent/WO2023020606A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1001—Protocols in which an application is distributed across nodes in the network for accessing one among a plurality of replicated servers
    • H04L67/1004—Server selection for load balancing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources

Definitions

  • the present disclosure relates to but is not limited to a method, system, device, equipment and storage medium for hiding a source site.
  • the Internet is an open world, and we can access content on the Internet because it is exposed on the Internet.
  • security threats on the Internet such as various scans and attacks from hackers
  • any application on the Internet may become a target of attacks, customers often try to hide the source server to which the application belongs to ensure the security of the source server.
  • proxies such as CDN, cloud WAF, or other types of four-layer or seven-layer security proxies.
  • Customers access proxy nodes and cannot directly access the source site. degree of concealment.
  • the proxy node IP list is generally set on the source site as a white list and access to other IPs is blocked.
  • maintaining such a security policy requires maintaining a proxy IP list, which is cumbersome and inefficient.
  • the present disclosure proposes a method, system, device, device and storage medium for hiding a source server, so that all inbound connections only need to be blocked on the target source server without maintaining complex security policies. It can prevent other servers from actively sending information or establishing a connection to the target application, reducing the risk of malicious attacks and ensuring the security of the target application.
  • the embodiment of the first aspect of the present disclosure proposes a method for hiding a source site, which is applied to a connector client, and the connector client is associated with at least one target application, including:
  • the session connection is an outgoing connection from the connector client to the at least one connector server station connection;
  • the target source server is determined from the multiple source servers corresponding to the target application, and the sending the access request to the target application in the target source server;
  • the embodiment of the second aspect of the present disclosure provides a method for hiding the source site, which is applied to the connector server, including:
  • the embodiment of the third aspect of the present disclosure provides a method of hiding the source site, which is applied to the edge node server, including:
  • the access request includes an identifier of the target application, and the identifier of the target application includes at least one of a domain name, a protocol, an IP address, and a port;
  • configuration information of a connector client bound to the target application according to the identifier of the target application, where the configuration information includes at least address information of at least one connector server corresponding to the connector client;
  • the embodiment of the fourth aspect of the present disclosure provides a method of hiding the source site, which is applied to the management platform, including:
  • Configuration information corresponding to at least one connector client, where the configuration information includes at least identification information of the connector client and address information of a connector server corresponding to the connector client;
  • the application configuration information includes at least one of a domain name of the target application, a back-to-source address, and identification information of an associated connector client;
  • the status information of the connector client periodically reported by the connector client via its corresponding connector server the status information at least including at least one of heartbeat information and system resource usage.
  • the embodiment of the fifth aspect of the present disclosure provides a system for hiding the source site, including: a management platform, an edge node server, a connector server, and a connector client;
  • the management platform is used to generate the application configuration information of the target application, and generate the configuration information corresponding to the connector client; send the configuration information of the connector client; send the application configuration information of the target application required by the edge node server and configuration information of the connector client associated with the target application; receiving and displaying the status information of the connector client periodically reported by the connector client via its corresponding connector server, the status information being at least including at least one of heartbeat information and system resource usage;
  • the edge node server is configured to receive the access request for the target application sent by the target terminal; and send the access request to the corresponding connector server according to the identifier of the target application included in the access request;
  • the connector server is configured to receive the access request sent by the edge node server; forward the access request to the corresponding connector client according to the previously established session connection with the connector client;
  • the connector client is configured to receive the access request sent by the connector server, and forward the access request to a corresponding target application.
  • the embodiment of the sixth aspect of the present disclosure provides a device for hiding the source site, which is applied to the connector client, including:
  • a configuration acquisition module configured to acquire address information of at least one connector server corresponding to the connector client, where the address information is address information of at least one connector server closest to the connector client;
  • Establishing a session module configured to establish a session connection with the at least one connector server according to the address information of the at least one connector server, the session connection is from the connector client to the at least one an outbound connection from a connector server;
  • the source server determining module is configured to, based on the session connection, if the access request for the target application forwarded by the connector server is received, based on the first load balancing strategy, from the plurality of source servers corresponding to the target application Determine the target source server;
  • a first sending module configured to send the access request to the target application in the target source server; send the received request response information to the connector server, and the request response information is determined by the The target application in the target source server performs feedback according to the access request.
  • the embodiment of the seventh aspect of the present disclosure provides a device for hiding the source site, which is applied to the connector server, including:
  • a receiving module configured to receive a connection request sent by at least one connector client
  • Establishing a session module configured to establish a session connection with the at least one connector client according to the connection request, and the session connection is an outgoing connection from the at least one connector client to the connector server station connection;
  • the receiving module is also used to receive the access request for the target application forwarded by the edge node server;
  • a connector client determining module configured to determine a target connector client corresponding to the target application from the at least one connector client based on a second load balancing strategy
  • the second sending module is configured to forward the access request to the target connector client according to the session connection corresponding to the target connector client.
  • the embodiment of the eighth aspect of the present disclosure provides a device for hiding a source site, which is applied to an edge node server, including:
  • the receiving module is configured to receive an access request for a target application sent by a target terminal, the access request includes an identifier of the target application, and the identifier of the target application includes one of domain name, protocol, IP address and port or more;
  • a configuration acquiring module configured to acquire configuration information of a connector client bound to the target application according to the identifier of the target application, the configuration information at least including at least one connector service corresponding to the connector client end address information;
  • a connector server determination module configured to determine a target connector server from each connector server corresponding to the target application according to the configuration information and the third load balancing strategy;
  • the third sending module is configured to forward the access request to the target connector server according to the address information of the target connector server.
  • the embodiment of the ninth aspect of the present disclosure provides a device for hiding the source site, which is applied to the management platform, including:
  • a configuration generating module configured to generate configuration information corresponding to at least one connector client, the configuration information at least including identification information of the connector client and address information of a connector server corresponding to the connector client; generating a target application Corresponding application configuration information, the application configuration information includes at least one of the domain name of the target application, the return address, and the identification information of the associated connector client;
  • a configuration sending module configured to send the configuration information required by the connector client; send the application configuration information of the target application required by the edge node server and the connector client configuration information associated with the target application;
  • a status information receiving module configured to receive and display the status information of the connector client periodically reported by the connector client via its corresponding connector server, the status information at least including heartbeat information and system resource usage at least one of the .
  • the embodiment of the tenth aspect of the present disclosure provides an electronic device, including a memory, a processor, and a computer program stored on the memory and operable on the processor, and the processor runs the computer program to Implement the method described in any one of the first to fourth aspects above.
  • the embodiment of the eleventh aspect of the present disclosure provides a computer-readable storage medium, on which a computer program is stored, and the program is executed by a processor to implement the method described in any one of the first to fourth aspects above.
  • the session connection between the connector client and the connector server is established through setting the connector client, and the session connection is an outbound connection between the connector client and the connector server.
  • the user accesses the target application, he first visits the edge node server, and the edge node server forwards the request to the connector client through the connector server, and the connector client forwards the request to the target application.
  • This method only needs to block all incoming connections on the target source server without maintaining complex security policies. It can prevent other servers from actively sending information or establishing a connection to the target application, reducing the risk of malicious attacks and ensuring the security of the target application.
  • FIG. 1 shows a schematic diagram of an exemplary system architecture to which the technical solutions of embodiments of the present disclosure can be applied;
  • FIG. 2 shows a signaling interaction diagram of a method for hiding a source station provided by an embodiment of the present disclosure
  • Fig. 3 shows a schematic diagram of application configuration information of a target application and configuration information of a connector client provided by an embodiment of the present disclosure
  • Fig. 4 shows a process of establishing a session connection between a connector client and a connector server provided by an embodiment of the present disclosure and a schematic diagram of the mapping relationship between the identification information of the connector client and the session;
  • Fig. 5 shows a schematic diagram of an edge node server selecting a connection server through load balancing and health checking and a connector server selecting a connector client through load balancing and health checking provided by an embodiment of the present disclosure
  • Fig. 6 shows a schematic diagram of a connector client reporting status information to a management platform via a connector server provided by an embodiment of the present disclosure
  • FIG. 7 shows a flowchart of a method for hiding an origin site provided by an embodiment of the present disclosure
  • FIG. 8 shows a schematic diagram of a connector client corresponding to multiple source servers provided by an embodiment of the present disclosure
  • FIG. 9 shows an operation flowchart of a connector client in a method for hiding an origin site provided by an embodiment of the present disclosure
  • Fig. 10 shows a flow chart of the operation of the connector server in a method for hiding the origin site provided by an embodiment of the present disclosure
  • Fig. 11 shows an operation flowchart of an edge node server in a method for hiding an origin site provided by an embodiment of the present disclosure
  • Fig. 12 shows an operation flowchart of the management platform in a method for hiding the origin site provided by an embodiment of the present disclosure
  • Fig. 13 shows a schematic structural diagram of a device applied to a connector client in a method for hiding an origin site provided by an embodiment of the present disclosure
  • Fig. 14 shows a schematic structural diagram of a device applied to a connector server in a method for hiding an origin site provided by an embodiment of the present disclosure
  • FIG. 15 shows a schematic structural diagram of a device applied to an edge node server in a method for hiding an origin site provided by an embodiment of the present disclosure
  • Fig. 16 shows a schematic structural diagram of a device applied to a management platform in a method for hiding an origin site provided by an embodiment of the present disclosure
  • Fig. 17 shows a schematic structural diagram of an electronic device provided by an embodiment of the present disclosure
  • Fig. 18 shows a schematic diagram of a storage medium provided by an embodiment of the present disclosure.
  • the embodiment of the present disclosure provides a method of hiding the source site, see Figure 1,
  • the network system architecture based on the method includes a connector server, a connector client, a source server, an edge node server, a management platform and a target terminal.
  • the source server can adopt VPC (Virtual Private Cloud, proprietary network)/NAT (Network Address Translation, network address translation)
  • the source server contains one or more target applications
  • the target applications can be internal applications in the intranet. It can also be an application in the public network.
  • the same target application can be deployed on multiple source servers.
  • the connector client can be a software program for network communication, and the connector client can be deployed in any network that can communicate with the target application.
  • the connector client can be deployed in the same network as the target application, or Can be deployed in any network capable of communicating with the target application.
  • one or more connector clients may be deployed in a network, and the same connector client may communicate with multiple target applications, and the same target application may also communicate with multiple connector clients.
  • FIG. 1 only schematically shows a connector client, which communicates with a target application in the source server.
  • a session connection can be established between the connector client and the connector server, and the session connection is an outbound connection between the connector client and the connector server, that is, an outbound communication connection.
  • the session protocol type of the session connection is an encryption protocol, and the encryption protocol includes at least one of HTTPS, HTTP/2, HTTP/3, Websocket, and TLS_TCP.
  • the session connection may also be established based on a tunnel protocol, and the tunnel protocol may be one of VPN, GRE, or IPsec. It should be understood that the session connection may also be established using other tunnel protocols, which is not specifically limited in the present disclosure.
  • the edge node server communicates with the connector server and the target terminal respectively, and the management platform communicates with the edge node server.
  • the target terminal may include but not limited to one or more of smart phones, tablet computers, laptop computers or desktop computers.
  • the transmission protocol between the target terminal and the edge node server may include at least one of HTTP, HTTPS, TCP or UDP.
  • the number of target terminals, edge node servers, connector servers, connector clients, and source servers in FIG. 1 is only illustrative, and there may be any number of target terminals, edge node servers , Connector Server, Connector Client, and Origin Server.
  • the network architecture may include one or more edge node servers and one or more connector servers, and FIG. 1 only schematically shows one edge node server and one connector server.
  • edge node server and the connector server mentioned in the embodiments of the present disclosure are two logical concepts, which are proposed separately to help understanding. In practice, they can be deployed separately or on the same server device , which is not specifically limited in the present disclosure.
  • the target terminal's access request for the target application is sent to the connector server via the edge node server.
  • the connector server determines the connector client associated with the target application, and sends the access request to the connector client through an outbound connection with the determined client. Finally, the connector client sends the access request to the corresponding target application.
  • the target source server to which the target application belongs can block all incoming connections to achieve the purpose of hiding the source site, and the target source server does not need to maintain complex security policies. It can prevent other servers from actively sending information or establishing a connection to the target application, reducing the risk of malicious attacks on the source server and ensuring the security of the target application.
  • Fig. 2 shows a signaling interaction diagram of a method for hiding a source station provided by an embodiment of the present disclosure.
  • the method at least includes steps 101 to 114, which are described in detail as follows:
  • Step 101 The management platform generates configuration information corresponding to at least one connector client, the configuration information at least including identification information of the connector client and address information of a connector server corresponding to the connector client.
  • the management platform may be a cloud computing platform, such as a private cloud or a public cloud.
  • the configuration information corresponding to the connector client includes at least identification information of the connector client and address information of a connector server corresponding to the connector client.
  • the identification information can be used to identify the connector client, and the identification information can be the IP address, MAC (Media Access Control Address, hardware address) address of the connector client, or an artificially set or automatically generated address that can identify the connector client. End character sequence, etc.
  • the connector client can be a software program for network communication, and the connector client is installed in the source server of groups such as enterprises, institutions or social organizations or in a network capable of communicating with the source server, so that it can be accessed through the connector client.
  • a session connection is established with the connector server, and remote access to the source server is realized through the established session connection, for example, remote access to a target application included in the source server is realized.
  • the connector server may be a server capable of communicating with the connector client, and may establish a session connection with the connector client for transmitting information. It should be understood that the address information of the connector server may include a domain name and/or an IP address, and if it is a domain name, it can be resolved to one or more IP addresses of the connector server according to the domain name. It should be noted that one connector server can communicate with one or more connector clients, which is not specifically limited in this disclosure.
  • the configuration information corresponding to the connector client is first generated on the management platform, and the configuration information can be used as the startup parameter corresponding to the connector client, to enable the connector client after configuring the connector client according to the configuration information.
  • the customer can configure the configuration information corresponding to the connector client by itself.
  • the management platform can support the configuration operation of the customer and receive the configuration information corresponding to the connector client configured by the customer. It is also possible for the customer to provide the relevant configuration information of the connector client to the service provider, and then the service provider configures the corresponding configuration information of the client's connector client on the management platform.
  • the management platform can also automatically generate configuration information corresponding to the connector client. Specifically, the management platform can assign the connector client identification information for identifying the connector client, and according to the entire network system The configuration information of all connector servers included in the schema, assigns the connector server corresponding to the connector client. Wherein, the configuration information of the connector server may include but not limited to the address information of the connector server, the number of associated connector clients, the upper limit of the number of associated connector clients, and the like. After the management platform assigns the identification information and the associated connector server to the connector client, it determines the identification information and the address information of the connector server corresponding to the connector client as the corresponding configuration of the connector client. information.
  • the connector client may be created on the management platform, and the management platform may provide the service provider with an interface for creating the connector client.
  • the connector client can run on a variety of platforms, such as VMware's virtual machine, Docker (application container engine), public cloud cloud host, etc.
  • the service provider uses the interface provided by the management platform to create connector clients running on different platforms.
  • the installation package and configuration information corresponding to the connector client are also generated.
  • the configuration information includes the identification information of the connector client, the address information of the connector server corresponding to the connector client, etc.
  • the address information of the connector server may include the domain name and/or IP address of the connector server.
  • one or more connector clients can be created on the management platform, and the configuration information corresponding to each connector client can include one or more address information of each connector server, so that after installing and starting the connector client in the source server or in a network capable of communicating with the source server, the connector client can communicate with one or more of the system architecture shown in Figure 1.
  • a connector server establishes a session connection.
  • Figure 3 shows the configuration information of a connector client, which includes the identification information of the connector client (taking id as an example): "connector client id: 12345", and the corresponding The domain name "companyA.connector.com” of the connector server.
  • the domain name included in the address information of the connector server will be resolved to at least two IP addresses of the connector server.
  • the connector client can establish session connections with multiple connector servers based on the resolved IP addresses of the multiple connector servers, so that when a certain session connection fails or fails, it can be connected through other session connection for information transfer.
  • the session connections established by the multiple connector servers may be session connections for transmitting the same information. In other words, some of the multiple session connections may be used as primary session connections, and others may be used as secondary session connections. When the main session connection fails, the information transmitted by the secondary session connection can be used for processing to ensure the stability of access.
  • Step 102 The management platform generates application configuration information corresponding to the target application, and the application configuration information includes at least one of the domain name of the target application, the return address, and the identification information of the associated connector client.
  • the target application can be the application in the intranet of groups such as enterprises, institutions or social organizations, such as OA system, Web (website), SSH (Secure Shell, secure shell protocol), VNC (Virtual Network Console, virtual network console) ), RDP (Remote Desktop Protocol, Remote Desktop Protocol), internal IAM (Identity and Access Management, identity identification and access management), etc.
  • the target application can also be an application program in the public network.
  • the management platform before accessing the target application, the management platform generates application configuration information corresponding to the target application.
  • the management platform can support user configuration operations. Users determine the target applications that allow remote access according to their own needs, and then configure the application configuration information corresponding to these target applications on the management platform.
  • the management platform can receive and store the applications configured by the user. configuration information, and associate the application configuration information with the corresponding target application.
  • the application configuration information may include at least one of various information such as a return-to-source address, a domain name of a target application, and identification information of a connector client associated with the target application.
  • the back-to-source address may include the IP address of the device where the target application is located, the port number opened to the outside world by the device where the target application is located, and the like.
  • the back-to-source address in the application configuration information corresponding to the target application shown in Figure 3 is 172.16.1.100:443, where 172.16.1.100 is the IP address of the device where the target application is located, that is, the IP address of the source server, and 443 indicates the target application
  • the open port of the device is port 443 (that is, the encrypted web browsing port).
  • the domain name of the target application included in the application configuration information in Figure 3 is "oa.companyA.com”
  • the back-to-source load balancing policy is "polling”
  • the unique identifier of the connector client associated with the target application is "binding connection server client: 12345".
  • the configuration information corresponding to the connector client and the application configuration information corresponding to the target application are generated on the management platform, and the target application is set by setting the identification information of the associated connector client in the application configuration information. Associated with the connector client.
  • the target application and the connector client can be in the same network, for example, both belong to the internal network, both belong to the public network, or belong to the same segment C network, etc.
  • the target application and the connector client can also be in different networks, for example, one in The public network, the other in the internal network, etc., are not specifically limited in this disclosure, as long as the target application and the connector client can communicate.
  • step 103 the management platform sends the configuration information required by the connector client.
  • the connector client may directly download the installation package of the connector client from the management platform, and install the connector client locally on the device that needs to install the connector client according to the downloaded installation package.
  • the device that needs to install the connector client sends an acquisition request to the management platform, and the management platform sends the installation package of the connector client to the device according to the received acquisition request.
  • the device downloads the installation package of the connector client from the management platform, it locally installs the connector client according to the installation package.
  • the device on which the connector client needs to be installed may be the source server, or other devices capable of communicating with the source server.
  • the cloud host of the device that needs to install the connector client can have the connector client pre-installed. Or, it may also be that the device downloads a complete connector client image file from the management platform for installation, and so on.
  • the embodiments of the present disclosure make no special limitation on how to install the connector client.
  • configuration information corresponding to the connector client can be requested from the management platform.
  • the management platform responds to the request and sends configuration information corresponding to the adapter client to the device.
  • the device installs the connector client and obtains the configuration information corresponding to the connector client from the management platform, it uses the configuration information to start the connector client.
  • the device sends a configuration information acquisition request to the management platform, and the configuration information acquisition request may include the identification information of the connector client, and the management platform may send the configuration information of the corresponding connector client to the management platform according to the identification information.
  • the device performs feedback.
  • one or more connector clients may be deployed on the same device.
  • multiple connector clients can be associated with the same target application, and for the same target application, the associated multiple connector clients can be classified as active connections Connector client and backup connector client, so that when the active connector client fails, the backup connector client can be used for communication, improving network stability.
  • the identification information of the multiple connector clients can be used as the identification information of the device.
  • device A contains two connector clients, two connection If the identification information of the device client is 123456 and 234567 respectively, then the identification information of the device A may be two, that is, 123456 and 234567, and so on.
  • one identification information may be configured for the device, and the identification information of the device may have a mapping relationship with the identification information of multiple connector clients.
  • Step 104 The connector client acquires address information of at least one connector server corresponding to the connector client, where the address information is address information of at least one connector server closest to the connector client.
  • the connector client acquires address information of at least one connector server corresponding to the connector client from the management platform.
  • the connector client can directly obtain configuration information corresponding to the connector client from the management platform.
  • the connector client can also indirectly obtain configuration information from the management platform through an intermediary, for example, the management platform sends the configuration information corresponding to the connector client to the configuration center, and the connector client then obtains the configuration information from the configuration center .
  • the connector client obtains address information of at least one connector server corresponding to the connector client from the configuration information.
  • the address information includes the IP address and/or domain name of the connector server.
  • the IP address and/or domain name of the connector server may be determined through anycast technology, intelligent resolution technology, and intelligent routing technology.
  • the address information of at least one connector server it can be obtained according to the geographic location of the connector server and the geographic location of the connector client, specifically obtaining the address information of at least one connector server whose geographic location is closest to the connector client .
  • the address information of the connector server may also be acquired according to the geographic location and in combination with at least one of factors such as network quality and network delay. For example, obtain at least one connector server with the best network quality from a certain number of connector servers closest to the connector client, or obtain from a certain number of connector servers closest to the connector client Obtain at least one connector server with the shortest network latency.
  • Step 105 The connector client establishes a session connection with at least one connector server according to the address information of at least one connector server, and the session connection is an outgoing connection from the connector client to the at least one connector server. station connection.
  • the connector client after the connector client is installed and the connector client is running normally, it is necessary to establish a session between at least one connector server corresponding to the connector client through the connector client connect. If the address information of the at least one connector server includes the IP address of the connector server, a session connection between the connector client and the at least one connector server is directly established according to the IP address of the at least one connector server.
  • the connector client sends the domain name resolution request of the at least one connector server to the domain name server.
  • the domain name server performs domain name resolution for each domain name, obtains the IP address corresponding to each domain name, and then sends the IP address corresponding to each domain name to the connector client.
  • the connector client receives the IP address corresponding to each domain name returned by the domain name server, and sends a connection request to the connector server corresponding to each IP address according to each IP address.
  • the connection request includes the identification information of the connector client , to establish and uniquely identify a session connection between the connector client and at least one corresponding connector server.
  • the session connection between the connector client and the connector server can be an encrypted session connection.
  • the connector client sends authentication information to the at least one connector server according to the acquired address information of the at least one connector server. After the authentication information is authenticated by at least one connector server, an encrypted session connection with the at least one connector server is established.
  • the above authentication information may include at least one of the connector client's identification information, certificate, key, encryption token and other information.
  • the authentication information may also include other arbitrary forms to identify the connector client.
  • Other authentication information of the terminal which is not limited in this embodiment of the present disclosure.
  • the authentication information sent by the connector client may include the identification information and the certificate of the connector client.
  • the connector server is also pre-configured with the certificate used to authenticate the connector client. After receiving the authentication information, the connector server compares the certificate included in the authentication information with the certificate stored in itself. If the two certificates are consistent , the authentication passes, otherwise the authentication fails.
  • the encryption protocol adopted for establishing the encrypted session connection may be at least one of HTTPS, HTTP/2, HTTP/3, Websocket, and TLS_TCP.
  • the connector client can also establish a session connection with at least one connector server based on a tunnel protocol, and the adopted tunnel protocol can be one of VPN, GRE or IPsec.
  • the session connection is an outbound connection from the connector client to the at least one connector server, and these session connections are active outbound communication connections of the connector client.
  • the connector client prohibits incoming connections. Specifically, you can configure the firewall of the device where the connector client is installed to prohibit incoming connection requests, so that all incoming requests except the session connections established above can be prohibited through the firewall. . In this way, it can be ensured that incoming information can only be received through the established session connection, and remote access to the target application program can be realized through the established session connection, while other incoming access can be avoided to ensure the security of the target application program.
  • the target application is an intranet application, the security of the intranet can be greatly improved.
  • Step 106 The connector server receives a connection request sent by at least one connector client, and establishes a session connection with the at least one connector client according to the connection request.
  • a connection request is sent to the connector server, and the connection request includes the identification information of the connector client. Since a connector client can establish a session connection with at least one connector server, the connector server can receive a connection request sent by at least one connector client, and establish a connection with this connector according to the identification information included in the received connection request.
  • a session connection between at least one connector client further, the session connection may be a session connection between the connector server and a connector client installed in the source server.
  • the number of connection requests received by the connector server may be multiple, and the connection requests include the identification information of the corresponding connector client.
  • the connector server respectively establishes a session connection with at least one connector client according to the multiple connection requests, and associates the identification information included in each connection request with the corresponding session connection.
  • the connector server stores the identification information included in the connection request and the corresponding session in the mapping relationship between the identification information of the connector client and the session.
  • the mapping relationship between the identification information of the connector client and the session is maintained on the connector server.
  • the connector server with the IP address "1.1.1.1” has established outbound session connections with the three connector clients respectively. Therefore, the mapping relationship maintained on the connector server includes connector client 12345: session 1, connector client 34567: session 2, and connector client 45678: session 3.
  • a connector client can establish a session connection with one or more connector servers, and a connector server can also connect with one or more connector clients, so that a certain connection can be avoided failure of a connector client or a connector server that interrupts remote access.
  • the session connection between the connector client and the connector server is established on port 443 (that is, the encrypted web browsing port), and the connection multiplexing of the application layer is realized on the session connection, and the The back-to-source request is implemented on the loop of the session connection.
  • the connector client can establish persistent session connections with multiple connector servers. For the source server, because the session connection corresponding to the connector client is outbound, the back-to-source access of the target application only depends on the session connection, and does not need to establish any inbound connection.
  • VPC Virtual Private Cloud, virtual private cloud
  • the connector client is created on the management platform and the application configuration information corresponding to the target application is set, and the connector client is installed on the source server and other devices that need to install the connector client, and the connector client and the connector server are established. session connection, and resolve the domain names of all target applications that allow remote access to the IP address of the edge node server, so that these target applications are directly published on the public network. Then the remote terminal can access the target application through the method provided by the embodiment of the present disclosure.
  • Step 107 The edge node server receives the access request for the target application sent by the target terminal, the access request includes the identifier of the target application, and the identifier of the target application includes at least one of domain name, protocol, IP address and port.
  • the edge node server provides functions such as DDoS (Distributed Denial of Service, distributed denial of service) cleaning, cache acceleration, WAF (Web Application Firewall, Web application protection system), load balancing, etc.
  • the edge node server can also be used as an edge security
  • the gateway provides functions such as identity authentication, rights management, and access control. When the target user accesses the target application, he first accesses the edge node server.
  • the target terminal when an employee working at home or on a business trip needs to access a target application in the company's intranet, he can view multiple target applications published by the company on the public network through the target terminal, and select the target application he needs to access. For example, Select by clicking.
  • the target terminal detects that a certain target application is clicked, it obtains the domain name of the clicked target application, and sends a resolution request for the domain name of the target application to the domain name server.
  • the domain name server resolves the domain name of the target application. Since the domain names of all target applications published on the public network have been resolved to the IP address of the edge node server, the domain name server can obtain the corresponding domain name for the current target application.
  • the IP address of the edge node server The domain name server returns the IP address obtained through domain name analysis to the target terminal. According to the IP address, the target terminal sends an access request to the corresponding edge node server, and the access request includes the identification of the target application that the target user needs to access.
  • the edge node server can also record the target user's access behavior log, which can include access time, access object, identity information, etc., and these information can facilitate the security management personnel of the enterprise to User behavior is audited and controlled.
  • Step 108 The edge node server obtains the configuration information of the connector client bound to the target application according to the identification of the target application.
  • the edge node server may obtain the application configuration information corresponding to each target application and the configuration information corresponding to the connector client bound to each target application from the management platform in advance. It should be noted that the edge node server may obtain the information directly from the management platform, or may obtain the information from an intermediary such as a configuration center, which is not specifically limited in this disclosure.
  • the edge node server After the edge node server receives the access request for the target application, it can obtain the identification of the target application included in the access request, determine the corresponding application configuration information according to the identification of the target application, and then determine the corresponding application configuration information according to the application configuration information. Identification information for the connector client associated with this target application. Based on the determined identification information of the connector client, configuration information corresponding to the connector client is determined, where the configuration information at least includes address information of at least one connector server corresponding to the connector client.
  • the edge node server requests or accepts push from the management platform about the application configuration information of the target application.
  • the management platform queries the application configuration information of the target application according to the query request sent by the edge node server and includes the identification of the target application, obtains the identification information of the connector client associated with the target application from the application configuration information, and then according to The identification information obtains the configuration information corresponding to the connector client, and sends the configuration information corresponding to the connector client to the edge node server.
  • Step 109 The edge node server determines the target connector server from each connector server corresponding to the target application based on the third load balancing policy and the acquired configuration information of the connector client.
  • the acquired configuration information of the connector client includes address information of at least one connector server corresponding to the connector client.
  • the edge node server is pre-configured with the third load balancing strategy, and the edge node server determines the target connector service from at least one connector server corresponding to the connector client based on the third load balancing strategy end.
  • the third load balancing strategy may be at least one of hash based on connector server IP, weighted round robin, and active/standby round robin.
  • the third load balancing strategy further needs to select a connector server satisfying a preset health condition from at least one connector server as a target connector server.
  • the preset health condition may include at least one of the network status with the connector server (such as network delay, network connectivity, connection establishment time), the response delay of the connector server (such as the first packet time), and the like.
  • the edge node server can obtain its network status, response delay of the connector server, etc. from the connector server.
  • the address information of the connector server included in the configuration information corresponding to the above-mentioned connector client may include the domain name and/or IP address of the connector server. If the address information is a domain name, the edge node server may use the connector The domain name resolution request of the server is sent to the domain name server for resolution, so that the domain name server returns the IP address of the corresponding connector server.
  • the address information of the connector server can be one or more, for example, there are multiple IP addresses of the connector server, or one or more IP addresses corresponding to the domain name fed back by the domain name server, and so on. Some of the connector servers corresponding to multiple address information can be used as the main connector server, and others can be used as the backup connector servers.
  • the edge node server After the edge node server obtains the IP address of each connector server corresponding to the target application, it establishes a communication connection with each connector server according to the obtained IP address, and obtains the IP address of each connector based on the communication connection. The network status of the server, the response delay of the connector server, etc. Then, according to the obtained information such as the network status and the response delay of the connector server, a connector server satisfying a preset health condition is selected from at least one connector server as the target connector server.
  • the preset health conditions may also include that the load is less than a preset threshold, and the network status, system status, and disk status are normal, and the preset health conditions may list some abnormalities in the network status, system status, and disk status Circumstances, such as network interruption, system resource usage exceeding the preset ratio, remaining disk storage space less than the preset value, etc.
  • the edge node server Before determining the target connector server, the edge node server first needs to obtain the system status information of each connector server corresponding to the target application, the system status information includes the load of the connector server, CPU usage percentage, memory usage percentage , disk IO, and network IO at least one.
  • the edge node server can directly obtain its system status information from the connector server. Specifically, after obtaining the IP address of each connector server corresponding to the target application, the edge node server establishes a communication connection with each connector server according to the obtained IP address. Then obtain the system state information of each connector server from each connector server respectively.
  • the edge node server may obtain the system state information of each connector server corresponding to the target application from the management platform.
  • each connector server can periodically report its own system status information to the management platform.
  • the management platform receives and stores the system status information of each connector server.
  • the management platform can also display system status information for each connector server.
  • the management platform can perform fault analysis and status analysis on each connector server according to the system status information of each connector server, and then display the system status information and analysis results of each connector server.
  • the edge node server when the edge node server receives the access request for the target application sent by the target terminal, it obtains the current system status information of each connector server corresponding to the target application from the management platform.
  • edge node server After the edge node server obtains the system status information of each connector server corresponding to the target application through any of the above methods, based on the third load balancing strategy, determine the connections that meet the preset health conditions from each connector server server server as the target connector server corresponding to the current access request.
  • the edge node server may select randomly or sequentially from them to determine a target connector server. As shown in Figure 5, assume that the edge node server determines the connector servers 1 and 2 corresponding to the target application, and then the edge node server performs load balancing and health checks on the connector servers 1 and 2 in the above-mentioned way, so that the connection Select a connector server that satisfies the preset health conditions from server servers 1 and 2 as the target connector server.
  • the edge node server can also determine at least two target connector servers, and send the access request to one of them. If the connector server fails and is unavailable, the access request is sent through another connector server This access request ensures the stability of access.
  • Step 110 The edge node server forwards the access request to the target connector server according to the address information of the target connector server.
  • the edge node server directly forwards the access request to the target connector server according to the IP address. If the address information only includes the domain name of the target connector server, the edge node server sends the domain name resolution request of the target connector server to the domain name server.
  • the domain name server performs domain name analysis on the domain name sent by the edge node server, obtains the IP address of each target connector server, forms an IP list for each IP address obtained, and returns the IP list to the edge node server. Contains the IP addresses of one or more target connector servers.
  • the edge node server receives the IP list returned by the domain name server, and selects an IP address from the IP list. Specifically, if the IP list includes only one IP address, the IP address is directly selected. If the IP list includes multiple IP addresses, an IP address of the active target connector server is selected from the multiple IP addresses. The edge node server establishes a communication connection between the target connector server corresponding to the selected IP address according to the selected IP address, and then sends the access request to the target connector server.
  • the edge node server may also perform two-way authentication with the target connector server to further ensure the security of the target application access. For example, the edge node server sends its own first certificate to the target connector server. The target connector server receives the first certificate of the edge node server, and verifies the first certificate, and verifies whether the first certificate is issued by a trusted CA center. The server returns a warning message, warning the edge node server that the first certificate is not trustworthy. After the verification is passed, the target connector server can compare the information in the certificate, such as the domain name and public key. If the domain name or public key conforms to the preset information transmission rules, the legal identity of the edge node server is recognized.
  • the edge node server sends its own first certificate to the target connector server.
  • the target connector server receives the first certificate of the edge node server, and verifies the first certificate, and verifies whether the first certificate is issued by a trusted CA center. The server returns a warning message, warning the edge node server that the first certificate is not trustworthy.
  • the target connector server can
  • the edge node server can also ask the target connector server to send its own second certificate. After receiving the second certificate, the edge node server can verify the second certificate. If it fails to pass the verification, it will refuse the connection. If verified, information can be transmitted between the two.
  • the two-way authentication is carried out between the edge node server and the target connector server through the above method.
  • the edge node server will not send the access request to For the target connector server, the security of intranet access is greatly improved.
  • the edge node server may first encrypt the access request, and send the encrypted data to the target connector server, so as to improve the security of data transmission.
  • Step 111 The connector server receives the access request for the target application forwarded by the edge node server, and determines the target connector client corresponding to the target application from at least one connector client based on the second load balancing strategy.
  • the connector server is a transit medium, which can realize the connection between the edge node server and the target application. Further, when the target application is located in the intranet, it can realize the connection between the edge node server and the intranet application get through. After the connector server starts, it waits for the connection between the edge node server and the connector client and forwards the access request from the edge node server.
  • the connector server After receiving the access request from the target terminal to the target application forwarded by the edge node server, the connector server determines each connector client associated with the target application from at least one connector client establishing a session connection.
  • the connector server determines all connector clients associated with the target application. Specifically, the identifier of the target application included in the access request is sent to the management platform.
  • the management platform obtains the application configuration information of the target application according to the identification of the target application, and queries the identification information of the connector client associated with the target application from the application configuration information.
  • the management platform sends the identification information of the connector client associated with the target application to the connector server.
  • the connector server receives identification information of a connector client associated with the target application.
  • the edge node server may also obtain the application configuration information of the target application from the management platform, and the edge node server forwards the access request and the application configuration information to the connector server.
  • the connector server can locally obtain the identification information of the connector client associated with the target application from the application configuration information.
  • the connector server After the connector server obtains the identification information of the connector client associated with the target application through any of the above methods, it establishes a session with the connector server according to the mapping relationship between the identification information of the connector client and the session stored locally. Each of the connected at least one connector client is determined to be associated with the target application.
  • the second load balancing strategy is pre-configured in the connector server. After the connector server obtains the identification information of the connector client The policy and the identification information of the connector client that has established the session connection and is associated with the target application determine the target connector client.
  • the second load balancing strategy may be at least one of hash based on connector client IP, weighted round robin, and active/standby round robin.
  • the second load balancing strategy also needs to select a connector client satisfying a preset health condition from at least one connector client as a target connector client.
  • the preset health condition may include at least one of the network status with the connector client (such as network delay, network connectivity, connection establishment time), the response delay of the connector client (such as the first packet time), and the like.
  • the connector server After the connector server obtains the identification information of the connector client that has established a session connection and is associated with the target application, it obtains the network status and response delay of each connector client through the session connection with each connector client and other information. Then select a connector client satisfying a preset health condition as a target connector client from at least one connector client according to the obtained network status, response delay and other information.
  • the preset health conditions may also include that the load is less than a preset threshold, and the network status, system status, and disk status are normal, and the preset health conditions may list some abnormalities in the network status, system status, and disk status Circumstances, such as network interruption, system resource usage exceeding the preset ratio, remaining disk storage space less than the preset value, etc.
  • the connector server Before determining the target connector client, the connector server first needs to obtain the status information of each connector client associated with the target application, the status information includes the heartbeat information, load, CPU usage percentage, At least one of memory usage percentage, disk IO, and network IO.
  • the connector server can directly obtain its status information from the connector client. After the connector server obtains the identification information of the connector clients that have established the session connection and are associated with the target application, they obtain the status information of each connector client through the session connection with each connector client.
  • each connector client may periodically report its own status information to the management platform via at least one connector server that establishes a session connection with itself.
  • the management platform receives and displays the status information of each connector client, so as to facilitate intuitive understanding of various operating statuses of the connector client.
  • the management platform can perform fault analysis and status analysis on each connector client based on the status information of each connector client. For example, based on the heartbeat information included in the status information of the connector client, it can be analyzed whether the connector client is normal. run. After the analysis results are obtained through analysis, the status information of each connector client and the corresponding analysis results are displayed.
  • the connector client reports status information to the management platform via the connector server that establishes a session connection with it.
  • the management platform performs data analysis based on the information reported by the connector client, and can display the connector in the form of a data report.
  • the client's status information, analysis results, etc. can also be monitored and alarmed when it is determined that the connector client is abnormal.
  • the connector server may store the correspondence between the identification information of each connector client and the status information. After the connector server obtains the identification information of the connector client associated with the target application, it may directly obtain the state information of the connector client associated with the target application from the locally stored correspondence.
  • the connector server may not store the correspondence between the identification information of the connector client and the status information. Instead, after obtaining the identification information of the connector client associated with the target application, the state of the connector client associated with the target application is obtained from the management platform according to the identification information of the connector client associated with the target application information.
  • the connector server After the connector server obtains the status information of each connector client that has established a session connection and corresponds to the target application through any of the above methods, based on the second load balancing strategy, determine from each connector client that meets the predetermined requirements. Set the connector client with the health condition as the target connector client corresponding to the current access request.
  • the number of target connector clients determined by the connector server may be one or more.
  • the number of target connector clients is multiple, that is, any number of two or more than two, one of the target connector clients can be used as the main target connector client, and the other ones are secondary The target connector client, so that when the primary target connector client fails or fails, the target application can be accessed through the secondary target connector client.
  • target application associated with the primary target connector client and the secondary target connector client should be the same, or the target application associated with the primary target connector client is included in the secondary target connector client Among the associated target applications, or between the primary target connector client and the secondary target connector client, there are partly the same associated target applications, and so on.
  • connector clients 1 and 2 are deployed in the source server, and both connector clients 1 and 2 are associated with the same source server.
  • the connector client 1 establishes session connections with the connector servers 1 and 2 respectively, and the session connections are established based on the tunneling protocol.
  • the session connection between connector client 1 and connector server 1 is the primary tunnel 1
  • the session connection between connector client 1 and connector server 2 is the backup tunnel 1.
  • the session connection between the connector client 2 and the connector server 1 is the primary tunnel 2
  • the session connection between the connector client 2 and the connector server 2 is the backup tunnel 2.
  • the edge node server selects connector server 1 as the target connector server through load balancing and health checks, and sends an access request for the target application to connector server 1.
  • the connector server 1 performs load balancing and health checks on the connector clients 1 and 2 according to the above method, so as to select a connector client that meets the preset health conditions as the target connection among the connector clients 1 and 2 server client. Assuming that the connector server 1 selects the connector client 2 as the target connector client, the connector server 1 sends the access request to the connector client 2 through the standby tunnel 2 . Then the connector client 2 sends the access request to the corresponding target application in the source server.
  • Step 112 The connector server forwards the access request to the target connector client according to the session connection corresponding to the target connector client.
  • the connector server obtains the target connector client from the locally stored mapping relationship between the identifier information of the connector client and the session according to the determined identification information of the target connector client.
  • the access request is forwarded to the target connector client through the session connection corresponding to the target connector client.
  • the connector server may also forward the access request to the target connector client in a polling manner.
  • a preset polling rule is configured in the connector server, and the preset polling rule specifies the polling sequence of each target connector client associated with the target application. Select one target connector client per target connector client associated. According to the identification information of the selected target connector client, obtain the session connection corresponding to the selected target connector client from the mapping relationship between the identification information and the session, and forward the access request to the target connector client through the obtained session connection .
  • the target terminal sends an access request to the edge node server, and the access request includes the domain name "oa.companyA.com" of the target application to be accessed.
  • the edge node server obtains the application configuration information corresponding to the domain name "oa.companyA.com” from the management platform.
  • the identifier of the connector client bound in the application configuration information is "12345", and also obtains the connector from the management platform. Configuration information of client 12345.
  • the edge node server After the edge node server obtains the application configuration information and the configuration information corresponding to the connector client, it sends a resolution request for the domain name "companyA.connector.com” of the connector server included in the configuration information corresponding to the connector client to the domain name server, and receives The resolved IP address "1.1.1.1” of the connector server returned by the domain name server, the edge node server establishes a communication connection with the connector server based on the IP address "1.1.1.1", and sends the access request and application configuration The information is sent to the connector server.
  • the connector server with the IP address "1.1.1.1” obtains the session connection corresponding to the connector client from the pre-stored mapping relationship according to the identifier "12345" of the connector client included in the application configuration information, and connects through the session The access request is sent to the connector client 12345 in Enterprise A's network.
  • Step 113 Based on the session connection between the connector client and the connector server, if the access request for the target application forwarded by the connector server is received, based on the first load balancing strategy, multiple Determine the target source server in the source server, and send the access request to the target application in the target source server.
  • the connector client may be configured with a mapping relationship between the domain name of each target application associated with it and the return-to-origin address.
  • the management platform may send the back-to-source address or application configuration information of each target application to the connector client.
  • the connector server obtains the application configuration information corresponding to the target application from the management platform or the edge node server, the application configuration information includes the return-to-source address corresponding to the target application, and the connector server forwards the access request to The application configuration information may also be sent to the connector client when connecting the connector client.
  • the connector client If the connector client receives an access request for the target application sent by the connector server through the session connection between the two, the connector client will locally query the target application's domain name according to the domain name of the target application included in the access request. Back to source address. Each source-back address found in the query is the address of each source server corresponding to the target application.
  • the connector client is pre-configured with the first load balancing policy. After the connector client obtains the return-to-origin address of each source server corresponding to the target The origin-return address of the target source server is determined from the origin-return address of the source server.
  • the first load balancing strategy may be at least one of source server IP-based hashing, weighted round robin, and active/standby round robin.
  • the first load balancing strategy also needs to select a source server satisfying a preset health condition from at least one source server as a target source server.
  • the preset health condition may include at least one of network status with the source server (such as network delay, network connectivity, connection establishment time), response delay of the source server (such as first packet time), and the like.
  • the connector client establishes a communication connection with each source server according to the back-to-source address of each source server, and obtains information such as the network status and response delay of each source server based on the established communication connection. Afterwards, based on the first load balancing policy and information such as the network status and response delay of each source server, a source server satisfying a preset health condition is determined from each source server as a target source server. Then the connector client sends the access request to the target application in the target source server according to the back-source address of the target source server.
  • the preset health conditions may also include that the load is less than a preset threshold, and the network status, system status, and disk status are normal, and the preset health conditions may list some abnormalities in the network status, system status, and disk status Circumstances, such as network interruption, system resource usage exceeding the preset ratio, remaining disk storage space less than the preset value, etc.
  • the connector client Before determining the target source server, the connector client first needs to obtain the system status information of each source server, the system status information includes the source server load, CPU usage percentage, memory usage percentage, disk IO, network IO one.
  • the connector client obtains the system status information of each source server from each source server respectively according to the return-to-source address of each source server. Then, based on the first load balancing policy and the system state information of each source server, determine the source server satisfying the preset health condition from each source server as the target source server. Then the connector client sends the access request to the target application in the target source server according to the back-source address of the target source server.
  • the connector client is associated with the source server 1, 2 and 3 respectively, assuming that the source server 1, 2 and 3 all include the target application corresponding to the current access request, then the connector client according to the first load Balance strategy, select a source server from source servers 1, 2 and 3 as the target source server, assuming that the selected target source server is source server 2, then send the access request to source server 2.
  • Step 114 The connector client sends the received request response information to the connector server, and the request response information is fed back by the target application in the target source server according to the access request.
  • the target application generates request response information according to the feedback of the access request, and sends the request response information to the connector client.
  • the connector client sends the request response information to the connector server through the session connection between itself and the connector server.
  • the connector server sends the request response information to the edge node server, and the edge node server sends the request response information to the target terminal.
  • the transmission protocol of the session connection between the connector client and the connector server may be an encrypted transmission protocol
  • the data between the connector client and the connector server are all encrypted transmissions to ensure Data security during transmission.
  • multiple connector clients may be associated with the same target application, and for the same target application, the associated multiple connector clients may include the active connector client and the standby connection
  • the active connector client fails, it can receive the target terminal’s access request to the target application through the session connection corresponding to the standby connector client, or send the target application’s access request to the target application through the session connection corresponding to the standby connector client.
  • a source server can also include multiple connector clients, which are divided into primary connector clients and secondary connector clients. After the primary connector client fails or the load limit is reached, the secondary connector client performs data transmission. .
  • the source server can also send its own health status information to the management platform every preset time period (such as 2min, 0.5h or 1h, etc.), and the management platform can judge whether the source server is abnormal according to the health status information of the source server. If there is an abnormality, an alarm message will be sent to the management personnel in time.
  • preset time period such as 2min, 0.5h or 1h, etc.
  • the remote user sends an access request to the edge node server, and the access request includes the identification of the target application.
  • the edge node server acquires the application configuration information of the target application to be accessed and the configuration information corresponding to the connector client associated with the target application from the management platform.
  • the edge node server sends the domain name resolution request of the domain name of the connector server included in the configuration information corresponding to the connector client to the domain name server, and sends the access request and application configuration information to the link server according to the IP address of the connector server returned by the domain name server. in the server server.
  • the domain name "companyA.connector.com” corresponds to the connector server with the IP address "1.1.1.1”.
  • the edge node server may send the access request and application configuration information to the connector server with the IP address "1.1.1.1”.
  • the connector server then sends the access request to the target application in enterprise A through the session connection with the connector client 12345 .
  • the session connection between the connector client and the connector server is established through setting the connector client, and the session connection is an outbound connection between the connector client and the connector server.
  • the user accesses the target application, he first visits the edge node server, and the edge node server forwards the request to the connector client through the connector server, and the connector client forwards the request to the target application. It is only necessary to block all incoming connections on the target source server without maintaining complex security policies. It can prevent other servers from actively sending information or establishing a connection to the target application, reducing the risk of malicious attacks and ensuring the security of the target application.
  • Some other embodiments of the present disclosure provide a method for hiding an origin site, and the method is applied to a connector client. Referring to Figure 9, the method specifically includes the following steps:
  • Step 201 The connector client acquires address information of at least one connector server corresponding to the connector client, where the address information is address information of at least one connector server closest to the connector client.
  • the connector client is deployed in any network that can communicate with the target application, and one or more connector clients are deployed in the network where the connector client is deployed.
  • the connector client receives configuration information corresponding to the connector client sent by the management platform.
  • the connector client can obtain configuration information directly from the management platform.
  • the connector client can also indirectly obtain configuration information from the management platform through an intermediary.
  • the management platform sends the configuration information corresponding to the Get that configuration information.
  • the connector client obtains the configuration information, it obtains address information of at least one connector server corresponding to the connector client from the configuration information.
  • the address information includes the IP address and/or domain name of the connector server.
  • Step 202 The connector client establishes a session connection with at least one connector server according to the address information of the at least one connector server, and the session connection is an outbound connection from the connector client to the at least one connector server.
  • the address information of the connector server is a domain name and/or an IP address determined by anycast technology, intelligent resolution technology, and intelligent routing technology. If the address information of the connector server only includes an IP address, the connector client establishes a session connection with the at least one connector server according to the IP address of the at least one connector server. If the address information of the connector server only includes the domain name of the connector server, the connector client sends the at least one domain name of the connector server to the domain name server; receives the IP address corresponding to each domain name returned by the domain name server; according to each The IP addresses respectively send connection requests to one or more connector servers, and the connection requests include identification information of the connector clients, so as to establish session connections between the connector clients and one or more connector servers.
  • the session connection is an outbound connection between the connector client and the connector server, which is an active outgoing communication connection of the connector client, and the connector client prohibits any incoming connection requests , so as to avoid malicious attacks from others and ensure the security of the target application.
  • prohibiting incoming connection requests may be configured in the firewall corresponding to the connector client, so that all incoming requests except the session connection established above can be prohibited through the firewall.
  • the transmission protocol of the session connection is an encrypted transmission protocol, that is, the data transmitted through the session connection is encrypted and then transmitted in ciphertext, so as to improve the security of data transmission.
  • the connector client can also send authentication information to at least one connector server according to the address information of at least one connector server; after the authentication information is authenticated by at least one connector server, establish an Encrypted session connections between .
  • the session protocol type of the encrypted session connection is an encryption protocol, and the encryption protocol includes at least one of HTTPS, HTTP/2, HTTP/3, Websocket, and TLS_TCP.
  • the session connection may also be established based on a tunnel protocol, where the tunnel protocol is one of VPN, GRE, or IPsec.
  • Step 203 Based on the established session connection, if the connector client receives an access request for the target application forwarded by the connector server, it determines the target application from multiple source servers corresponding to the target application based on the first load balancing strategy. The source server sends the access request to the target application in the target source server.
  • Step 204 The connector client sends the received request response information to the connector server, and the request response information is fed back by the target application in the target source server according to the access request.
  • the connector clients may include a primary connector client and a secondary connector client, and the secondary connector client is used when the primary connector client fails.
  • Multiple connector clients can be deployed on the source server.
  • the multiple connector clients include the active connector client and the backup connector client.
  • the active connector client and the backup connector client are the same as the target application Association; when the active connector client fails, the access request of the target terminal to the target application is received through the session connection corresponding to the backup connector client.
  • the connector client can also periodically report the status information of the connector client to the management platform via at least one connector server, and the status information includes at least one of heartbeat information and system status information.
  • the connector client establishes an outbound session connection with the connector server, and the access request for the target application is sent to the connector client through the session connection, and the connector client sends the The request is forwarded to the target application. It is only necessary to block all incoming connections on the target source server without maintaining complex security policies. It can prevent other servers from actively sending information or establishing a connection to the target application, reducing the risk of malicious attacks and ensuring the security of the target application.
  • Some embodiments of the present disclosure provide a method for hiding the origin site, which is applied to the connector server, see FIG. 10 , and the method specifically includes the following steps:
  • Step 301 The connector server receives a connection request sent by at least one connector client.
  • connection requests there may be multiple connection requests, and the connection requests include identification information of corresponding connector clients.
  • Step 302 The connector server establishes a session connection with at least one connector client according to the connection request, and the session connection is an outbound connection from the at least one connector client to the connector server.
  • the connector server respectively establishes a session connection with at least one connector client according to multiple connection requests, and associates the identification information of each connector client with the corresponding session connection.
  • Step 303 The connector server receives the access request for the target application forwarded by the edge node server, and determines the target connector client corresponding to the target application from at least one connector client based on the second load balancing strategy.
  • Step 304 The connector server forwards the access request to the target connector client according to the session connection corresponding to the target connector client.
  • the connector server forwards the access request to each target connector client according to the session connection associated with the identification information of the multiple target connector clients.
  • the connector server extracts the identification information of each connector client associated with the target application from the application configuration information; according to the identification information of each connector client, each connector client is obtained from the mapping relationship Corresponding session connection; Obtain the status information of each connector client through the corresponding session connection of each connector client or from the management platform; according to the status information of each connector server, based on the second load balancing strategy, from each Select a target connector client that satisfies the preset health conditions from the connector clients, and forward the access request to the target connector client through the session connection corresponding to the selected target connector client.
  • the connector server may also use a polling mechanism to forward the access request. Specifically, extract the identification information of each connector client associated with the target application from the application configuration information; select a target connector client from each connector client according to a preset polling rule; The identification information of the target connector client obtains the session connection corresponding to the selected target connector client from the mapping relationship; forwards the access request to the target connector client through the obtained session connection.
  • the connector server establishes an outbound session connection with the connector client, and the connector server sends an access request for the target application to the connector client through the session connection, and the connection
  • the server client forwards the request to the target application. It is only necessary to block all incoming connections on the target source server without maintaining complex security policies. It can prevent other servers from actively sending information or establishing a connection to the target application, reducing the risk of malicious attacks and ensuring the security of the target application.
  • Some embodiments of the present disclosure provide a method of hiding the origin site, which is applied to an edge node server, see FIG. 11 , and the method specifically includes the following steps:
  • Step 401 The edge node server receives an access request for a target application sent by a target terminal.
  • the access request includes an identifier of the target application, and the identifier of the target application includes at least one of domain name, protocol, IP address and port.
  • Step 402 The edge node server acquires configuration information of a connector client bound to the target application according to the target application identifier, the configuration information at least including address information of at least one connector server corresponding to the connector client.
  • Step 403 The edge node server determines the target connector server from each connector server corresponding to the target application based on the third load balancing policy and the acquired configuration information of the connector client.
  • Step 404 The edge node server forwards the access request to the target connector server according to the address information of the target connector server.
  • edge node server For the specific operation details of the edge node server, reference may be made to the operation of the edge node server in any of the foregoing embodiments, which will not be repeated here.
  • the edge node server forwards the access request and application configuration information to the connector server, and the connector server forwards the access request to the connector client through an outbound session connection with the connector client end, the connector client forwards the request to the target application. It is only necessary to block all incoming connections on the target source server without maintaining complex security policies. It can prevent other servers from actively sending information or establishing a connection to the target application, reducing the risk of malicious attacks and ensuring the security of the target application.
  • Some embodiments of the present disclosure provide a method of hiding the origin site, which is applied to the management platform, see Figure 12, the method specifically includes the following steps:
  • Step 501 The management platform generates configuration information corresponding to the connector client, the configuration information at least including identification information of the connector client and address information of a connector server corresponding to the connector client.
  • Step 502 The management platform generates application configuration information corresponding to the target application.
  • the application configuration information includes at least one of the domain name of the target application, the return address, and the identification information of the associated connector client.
  • Step 503 the management platform sends the configuration information required by the connector client.
  • Step 504 The management platform sends the application configuration information of the target application required by the edge node server and the configuration information of the connector client associated with the target application.
  • Step 505 The management platform receives and displays the status information of the connector client periodically reported by the connector client via its corresponding connector server.
  • the status information includes at least one of heartbeat information and system resource usage.
  • the configuration information of the connector client and the application configuration information of the target application are generated in the management platform, and the target application is associated with the connector client. And send the configuration information of the connector client to the connector client through the management platform.
  • the application configuration information of the target application required by the edge node server and the configuration information of the connector client associated with the target application are sent. Receive and display the status information of the connector client, and realize the status monitoring and alarm of the connector client.
  • remote terminals can access the target application, and only need to block all incoming connections on the target source server without maintaining complex security Strategy. It can prevent other servers from actively sending information to the target application or establishing a connection, reducing the risk of malicious attacks and ensuring the security of the target application.
  • An embodiment of the present disclosure provides a system for hiding source sites, as shown in FIG. 1 , the system includes: an edge node server, a connector server, a management platform, and a connector client;
  • the management platform is used to generate the application configuration information of the target application, and generate the configuration information corresponding to the connector client; send the configuration information of the connector client; send the application configuration information of the target application required by the edge node server and related to the target application
  • the configuration information of the connected connector client receive and display the status information of the connector client periodically reported by the connector client via its corresponding connector server, the status information includes at least one of heartbeat information and system resource usage one;
  • the edge node server is configured to receive the access request for the target application sent by the target terminal; and send the access request to the corresponding connector server according to the identification of the target application included in the access request;
  • the connector server is used to receive the access request sent by the edge node server; forward the access request to the corresponding connector client according to the previously established session connection with the connector client;
  • the connector client is used to receive the access request sent by the connector server, and forward the access request to the corresponding target application.
  • a session connection is an outbound connection from a connector client to a connector server.
  • the system for hiding the source site provided by the above-mentioned embodiments of the present disclosure is based on the same inventive concept as the method for hiding the source site provided by the embodiments of the present disclosure, and has the same beneficial effect as the method adopted, run or implemented by its stored application program .
  • An embodiment of the present disclosure also provides an apparatus for hiding an origin site, which is configured to perform operations of a connector client in the method for hiding an origin site provided in any of the above embodiments.
  • the device includes:
  • the configuration acquiring module 601 is configured to acquire address information of at least one connector server corresponding to the connector client, where the address information is the address information of at least one connector server closest to the connector client;
  • a session establishment module 602 configured to establish a session connection with at least one connector server according to the address information of at least one connector server, where the session connection is an outbound connection from a connector client to at least one connector server;
  • the source server determination module 603 is configured to determine the target source from multiple source servers corresponding to the target application based on the session connection, if the access request for the target application forwarded by the connector server is received, based on the first load balancing strategy server;
  • the first sending module 604 is configured to send the access request to the target application in the target source server; send the received request response information to the connector server, and the request response information is sent by the target application in the target source server according to the access request Give feedback.
  • the address information is a domain name and/or IP address determined by one of anycast technology, intelligent resolution technology, and intelligent routing technology, and establishes a session module 602, which is used to send at least one connector server to the domain name server if the address information is a domain name Domain name resolution request; receive the IP address corresponding to the domain name of at least one connector server sent by the domain name server; send a connection request to at least one connector server respectively according to each IP address, so as to establish a connector client and at least one connector Session connections between servers.
  • the configuration obtaining module 601 is configured to receive configuration information corresponding to the connector client sent by the management platform; obtain address information of at least one connector server corresponding to the connector client from the configuration information.
  • the session protocol type of the session connection is an encryption protocol, and the encryption protocol includes at least one of HTTPS, HTTP/2, HTTP/3, Websocket, and TLS_TCP.
  • the session establishment module 602 is configured to establish a session connection based on a tunnel protocol, and the tunnel protocol is one of VPN, GRE or IPsec.
  • the connector client is deployed in any network that can communicate with the target application, and one or more connector clients are deployed in the network where the connector client is deployed.
  • the device also includes: an information reporting module, configured to periodically report the status information of the connector client to the management platform via at least one connector server, where the status information includes at least one of heartbeat information and system status information.
  • the device for hiding the source site provided by the above-mentioned embodiments of the present disclosure is based on the same inventive concept as the method for hiding the source site provided by the embodiments of the present disclosure, and has the same beneficial effect as the method adopted, run or implemented by the stored application program .
  • An embodiment of the present disclosure also provides a device for hiding an origin site, which is used to perform the operations of the connector server in the method for hiding an origin site provided in any one of the above embodiments.
  • the device includes:
  • the receiving module 703 is also configured to receive the access request for the target application forwarded by the edge node server;
  • a connector client determining module 704 configured to determine a target connector client corresponding to the target application from at least one connector client based on a second load balancing strategy;
  • the second sending module 705 is configured to forward the access request to the target connector client according to the session connection corresponding to the target connector client.
  • connection request contains the identification information of the corresponding connector client
  • the session establishment module 702 is configured to respectively establish a session connection with at least one connector client according to multiple connection requests, and store a mapping relationship between each identification information and a corresponding session connection.
  • a connector client determination module 704 configured to determine each connector client associated with the target application from at least one connector client establishing a session connection; based on the second load balancing strategy, each determined connection Determine the target connector client in Connector Client.
  • the device for hiding the source site provided by the above-mentioned embodiments of the present disclosure is based on the same inventive concept as the method for hiding the source site provided by the embodiments of the present disclosure, and has the same beneficial effect as the method adopted, run or implemented by the stored application program .
  • An embodiment of the present disclosure also provides an apparatus for hiding an origin station, which is configured to perform operations of the edge node server in the method for hiding an origin station provided in any one of the above embodiments.
  • the device includes:
  • the receiving module 801 is configured to receive an access request for a target application sent by a target terminal, where the access request includes an identification of the target application, and the identification of the target application includes one or more of domain name, protocol, IP address, and port;
  • the configuration acquiring module 802 is configured to acquire configuration information of a connector client bound to the target application according to the identifier of the target application, where the configuration information includes at least address information of at least one connector server corresponding to the connector client;
  • the connector server determination module 803 is configured to determine the target connector server from each connector server corresponding to the target application according to the configuration information and the third load balancing strategy;
  • the third sending module 804 is configured to forward the access request to the target connector server according to the address information of the target connector server.
  • the device for hiding the source site provided by the above-mentioned embodiments of the present disclosure is based on the same inventive concept as the method for hiding the source site provided by the embodiments of the present disclosure, and has the same beneficial effect as the method adopted, run or implemented by the stored application program .
  • An embodiment of the present disclosure also provides an apparatus for hiding an origin site, which is used to perform the operations of the management platform in the method for hiding an origin site provided in any of the above embodiments.
  • the device includes:
  • the configuration generation module 901 is configured to generate configuration information corresponding to at least one connector client, the configuration information at least includes the identification information of the connector client and the address information of the connector server corresponding to the connector client; generates an application corresponding to the target application Configuration information, the application configuration information includes at least one of the domain name of the target application, the back-to-source address, and the identification information of the associated connector client;
  • the configuration sending module 902 is configured to send the configuration information required by the connector client; send the application configuration information of the target application required by the edge node server and the connector client configuration information associated with the target application;
  • the status information receiving module 903 is configured to receive and display the status information of the connector client periodically reported by the connector client via its corresponding connector server, the status information at least includes at least one of heartbeat information and system resource usage .
  • the device for hiding the source site provided by the above-mentioned embodiments of the present disclosure is based on the same inventive concept as the method for hiding the source site provided by the embodiments of the present disclosure, and has the same beneficial effect as the method adopted, run or implemented by the stored application program .
  • Embodiments of the present disclosure also provide an electronic device to implement the above method for hiding an origin site.
  • FIG. 17 shows a schematic diagram of an electronic device provided by some embodiments of the present disclosure.
  • the electronic device 10 includes: a processor 1000, a memory 1001, a bus 1002 and a communication interface 1003, the processor 1000, the communication interface 1003 and the memory 1001 are connected through the bus 1002; A computer program running on the processor 1000, when the processor 1000 runs the computer program, executes the method for hiding an origin site provided in any one of the foregoing implementations of the present disclosure.
  • the memory 1001 may include a high-speed random access memory (RAM: Random Access Memory), and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.
  • RAM Random Access Memory
  • non-volatile memory such as at least one disk memory.
  • the communication connection between the system network element and at least one other network element is realized through at least one communication interface 1003 (which may be wired or wireless), and Internet, wide area network, local network, metropolitan area network, etc. can be used.
  • the bus 1002 may be an ISA bus, a PCI bus or an EISA bus, etc.
  • the bus can be divided into address bus, data bus, control bus and so on.
  • the memory 1001 is used to store a program, and the processor 1000 executes the program after receiving an execution instruction, and the method for hiding the source site disclosed in any implementation manner of the aforementioned embodiments of the present disclosure can be applied to the processor 1000 in, or implemented by the processor 1000.
  • the processor 1000 may be an integrated circuit chip with signal processing capability.
  • each step of the above method may be implemented by an integrated logic circuit of hardware in the processor 1000 or instructions in the form of software.
  • the above-mentioned processor 1000 can be a general-purpose processor, including a central processing unit (Central Processing Unit, referred to as CPU), a network processor (Network Processor, referred to as NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), off-the-shelf programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.
  • DSP digital signal processor
  • ASIC application-specific integrated circuit
  • FPGA off-the-shelf programmable gate array
  • Various methods, steps and logic block diagrams disclosed in the embodiments of the present disclosure may be implemented or executed.
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the steps of the methods disclosed in the embodiments of the present disclosure may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register.
  • the storage medium is located in the memory 1001, and the processor 1000 reads the information in the memory 1001, and completes the steps of the above method in combination with its hardware.
  • the electronic device provided by the embodiment of the present disclosure is based on the same inventive concept as the method for hiding the source station provided by the embodiment of the present disclosure, and has the same beneficial effect as the method adopted, operated or realized.
  • the embodiment of the present disclosure also provides a computer-readable storage medium corresponding to the method for hiding the origin site provided in the foregoing embodiment.
  • a computer program that is, a program product.
  • the computer program When the computer program is run by a processor, it will execute the method for hiding the source site provided in any of the foregoing implementation manners.
  • examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random Access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other optical and magnetic storage media will not be repeated here.
  • PRAM phase change memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • RAM random Access memory
  • ROM read only memory
  • EEPROM electrically erasable programmable read only memory
  • flash memory or other optical and magnetic storage media will not be repeated here.
  • the computer-readable storage medium provided by the above-mentioned embodiments of the present disclosure is based on the same inventive concept as the method for hiding the source site provided by the embodiments of the present disclosure, and has the same beneficial effects as the method adopted, run or implemented by the stored application program .
  • the session connection between the connector client and the connector server is established through setting the connector client, the session connection is an outbound connection between the connector client and the connector server, and the user accesses the target application
  • the edge node server forwards the request to the connector client through the connector server, and the connector client forwards the request to the target application.
  • This method only needs to block all incoming connections on the target source server without maintaining complex security policies. It can prevent other servers from actively sending information or establishing a connection to the target application, reducing the risk of malicious attacks and ensuring the security of the target application.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer And Data Communications (AREA)

Abstract

La présente demande concerne un procédé, un système et un appareil pour masquer une station source, et un dispositif et un support de stockage. Le procédé comprend les étapes suivantes : acquisition d'informations d'adresse d'au moins un côté serveur de connecteur correspondant à un client de connecteur ; selon les informations d'adresse acquises, le client de connecteur établit une connexion de session avec l'au moins un côté serveur de connecteur, la connexion de session étant une connexion sortante du client de connecteur au côté serveur de connecteur ; et si le côté serveur de connecteur reçoit une demande d'accès à une application cible qui est transmise par un serveur de nœud de bord, envoi de la demande d'accès au client de connecteur sur la base de la connexion de session avec le client de connecteur, puis le client de connecteur transmet la demande d'accès à l'application cible, et envoi, par l'intermédiaire du côté serveur de connecteur et au serveur de nœud de bord, d'informations de réponse à la demande reçues qui sont renvoyées par l'application cible.
PCT/CN2022/113500 2021-08-20 2022-08-19 Procédé, système et appareil pour masquer une station source, et dispositif et support de stockage WO2023020606A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110962434.XA CN113872933B (zh) 2021-08-20 2021-08-20 隐藏源站的方法、系统、装置、设备及存储介质
CN202110962434.X 2021-08-20

Publications (1)

Publication Number Publication Date
WO2023020606A1 true WO2023020606A1 (fr) 2023-02-23

Family

ID=78988014

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/113500 WO2023020606A1 (fr) 2021-08-20 2022-08-19 Procédé, système et appareil pour masquer une station source, et dispositif et support de stockage

Country Status (2)

Country Link
CN (1) CN113872933B (fr)
WO (1) WO2023020606A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117914935A (zh) * 2024-03-05 2024-04-19 北京长亭科技有限公司 一种基于重路由技术的隐蔽通信方法及系统

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113872933B (zh) * 2021-08-20 2023-05-26 上海云盾信息技术有限公司 隐藏源站的方法、系统、装置、设备及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150150114A1 (en) * 2012-01-30 2015-05-28 Martello Technologies Corporation Method and System for Providing Secure Remote External Client Access to Device or Service on a Remote Network
CN108064443A (zh) * 2017-09-30 2018-05-22 深圳前海达闼云端智能科技有限公司 一种代理转发方法和装置、代理服务器和多级代理网络
CN109417536A (zh) * 2016-04-15 2019-03-01 高通股份有限公司 用于管理内容递送网络中的安全内容传输的技术
CN110166432A (zh) * 2019-04-17 2019-08-23 平安科技（深圳）有限公司 对内网目标服务的访问方法、提供内网目标服务的方法
CN113341798A (zh) * 2021-05-28 2021-09-03 上海云盾信息技术有限公司 远程访问应用的方法、系统、装置、设备及存储介质
CN113872933A (zh) * 2021-08-20 2021-12-31 上海云盾信息技术有限公司 隐藏源站的方法、系统、装置、设备及存储介质

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102347959B (zh) * 2011-11-18 2014-07-23 运软网络科技(上海)有限公司 基于身份和会话的资源访问系统和方法
CN112769835B (zh) * 2021-01-13 2023-04-18 网宿科技股份有限公司 一种访问请求的发起方法及终端设备
CN113204730A (zh) * 2021-05-19 2021-08-03 网宿科技股份有限公司 资源获取方法、webvpn代理服务器、系统及服务器

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150150114A1 (en) * 2012-01-30 2015-05-28 Martello Technologies Corporation Method and System for Providing Secure Remote External Client Access to Device or Service on a Remote Network
CN109417536A (zh) * 2016-04-15 2019-03-01 高通股份有限公司 用于管理内容递送网络中的安全内容传输的技术
CN108064443A (zh) * 2017-09-30 2018-05-22 深圳前海达闼云端智能科技有限公司 一种代理转发方法和装置、代理服务器和多级代理网络
CN110166432A (zh) * 2019-04-17 2019-08-23 平安科技（深圳）有限公司 对内网目标服务的访问方法、提供内网目标服务的方法
CN113341798A (zh) * 2021-05-28 2021-09-03 上海云盾信息技术有限公司 远程访问应用的方法、系统、装置、设备及存储介质
CN113872933A (zh) * 2021-08-20 2021-12-31 上海云盾信息技术有限公司 隐藏源站的方法、系统、装置、设备及存储介质

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117914935A (zh) * 2024-03-05 2024-04-19 北京长亭科技有限公司 一种基于重路由技术的隐蔽通信方法及系统

Also Published As

Publication number Publication date
CN113872933B (zh) 2023-05-26
CN113872933A (zh) 2021-12-31

Similar Documents

Publication Publication Date Title
US9954902B1 (en) Secure proxy
US20240007493A1 (en) Rule-Based Network-Threat Detection For Encrypted Communications
US11190493B2 (en) Concealing internal applications that are accessed over a network
US20210336934A1 (en) Cloud-based web application and API protection
US11063909B1 (en) Methods and systems for efficient cyber protections of mobile devices
US8892766B1 (en) Application-based network traffic redirection for cloud security service
WO2022247751A1 (fr) Procédé, système et appareil pour accéder à distance à une application, dispositif, et support de stockage
WO2023020606A1 (fr) Procédé, système et appareil pour masquer une station source, et dispositif et support de stockage
US20170034174A1 (en) Method for providing access to a web server
US20210314301A1 (en) Private service edge nodes in a cloud-based system for private application access
US20190215308A1 (en) Selectively securing a premises network
WO2008147475A2 (fr) Fournir une passerelle générique pour accéder à des ressources protégées
EP4022876B1 (fr) Suppression d'un protocole réseau dans un canal crypté et l'application correspondante
US9100369B1 (en) Secure reverse connectivity to private network servers
US20160219035A1 (en) Methods for providing secure access to network resources and devices thereof
US10348687B2 (en) Method and apparatus for using software defined networking and network function virtualization to secure residential networks
US11949661B2 (en) Systems and methods for selecting application connectors through a cloud-based system for private application access
US11936623B2 (en) Systems and methods for utilizing sub-clouds in a cloud-based system for private application access
US20210377223A1 (en) Client to Client and Server to Client communication for private application access through a cloud-based system
US20230019448A1 (en) Predefined signatures for inspecting private application access
US11784993B2 (en) Cross site request forgery (CSRF) protection for web browsers
US20230015603A1 (en) Maintaining dependencies in a set of rules for security scanning
US20230231884A1 (en) Browser fingerprinting and control for session protection and private application protection

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22857915

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE