WO2023020606A1

WO2023020606A1 - Method, system and apparatus for hiding source station, and device and storage medium

Info

Publication number: WO2023020606A1
Application number: PCT/CN2022/113500
Authority: WO
Inventors: 胡金涌
Original assignee: 上海云盾信息技术有限公司
Priority date: 2021-08-20
Filing date: 2022-08-19
Publication date: 2023-02-23
Also published as: CN113872933B; CN113872933A

Abstract

Provided in the present application are a method, system and apparatus for hiding a source station, and a device and a storage medium. The method comprises: acquiring address information of at least one connector server side corresponding to a connector client; according to the acquired address information, the connector client establishing a session connection with the at least one connector server side, wherein the session connection is an outbound connection from the connector client to the at least one connector server side; and if the connector server side receives an access request for a target application that is forwarded by an edge node server, sending the access request to the connector client on the basis of the session connection with the connector client, and then the connector client forwarding the access request to the target application, and sending, via the connector server side and to the edge node server, received request response information that is fed back by the target application.

Description

A method, system, device, equipment and storage medium for hiding source sites

This disclosure is based on the Chinese patent application submitted to the China Patent Office on August 20, 2021, with the application number 202110962434. The priority of the patent application, the entire content of the Chinese patent application is hereby incorporated by reference into this disclosure.

technical field

The present disclosure relates to but is not limited to a method, system, device, equipment and storage medium for hiding a source site.

Background technique

The Internet is an open world, and we can access content on the Internet because it is exposed on the Internet. However, there are many security threats on the Internet (such as various scans and attacks from hackers), so it may not be safe to expose services and applications to the Internet. Because any application on the Internet may become a target of attacks, customers often try to hide the source server to which the application belongs to ensure the security of the source server.

At present, more and more Internet applications use various proxies (such as CDN, cloud WAF, or other types of four-layer or seven-layer security proxies). Customers access proxy nodes and cannot directly access the source site. degree of concealment. In order to prevent hackers from obtaining the source site address and then bypassing the proxy to attack, the proxy node IP list is generally set on the source site as a white list and access to other IPs is blocked. However, maintaining such a security policy requires maintaining a proxy IP list, which is cumbersome and inefficient.

Contents of the invention

The present disclosure proposes a method, system, device, device and storage medium for hiding a source server, so that all inbound connections only need to be blocked on the target source server without maintaining complex security policies. It can prevent other servers from actively sending information or establishing a connection to the target application, reducing the risk of malicious attacks and ensuring the security of the target application.

The embodiment of the first aspect of the present disclosure proposes a method for hiding a source site, which is applied to a connector client, and the connector client is associated with at least one target application, including:

Obtain address information of at least one connector server corresponding to the connector client, where the address information is address information of at least one connector server closest to the connector client;

Establish a session connection with the at least one connector server according to the address information of the at least one connector server, the session connection is an outgoing connection from the connector client to the at least one connector server station connection;

Based on the session connection, if an access request for the target application forwarded by the connector server is received, based on the first load balancing policy, the target source server is determined from the multiple source servers corresponding to the target application, and the sending the access request to the target application in the target source server;

Send the received request response information to the connector server, and the request response information is fed back by the target application in the target source server according to the access request.

The embodiment of the second aspect of the present disclosure provides a method for hiding the source site, which is applied to the connector server, including:

receiving a connection request sent by at least one connector client;

Establishing a session connection with the at least one connector client according to the connection request, where the session connection is an outbound connection from the at least one connector client to the connector server;

receiving an access request for the target application forwarded by the edge node server, and determining a target connector client corresponding to the target application from the at least one connector client based on a second load balancing strategy;

Forwarding the access request to the target connector client according to the session connection corresponding to the target connector client.

The embodiment of the third aspect of the present disclosure provides a method of hiding the source site, which is applied to the edge node server, including:

receiving an access request for a target application sent by a target terminal, where the access request includes an identifier of the target application, and the identifier of the target application includes at least one of a domain name, a protocol, an IP address, and a port;

Obtain configuration information of a connector client bound to the target application according to the identifier of the target application, where the configuration information includes at least address information of at least one connector server corresponding to the connector client;

Based on the third load balancing policy and the acquired configuration information of the connector client, determine the target connector server from each connector server corresponding to the target application;

forwarding the access request to the target connector server according to the address information of the target connector server.

The embodiment of the fourth aspect of the present disclosure provides a method of hiding the source site, which is applied to the management platform, including:

Generate configuration information corresponding to at least one connector client, where the configuration information includes at least identification information of the connector client and address information of a connector server corresponding to the connector client;

Generate application configuration information corresponding to the target application, where the application configuration information includes at least one of a domain name of the target application, a back-to-source address, and identification information of an associated connector client;

sending the configuration information of the connector client;

sending the application configuration information of the target application required by the edge node server and the configuration information of the connector client associated with the target application;

receiving and displaying the status information of the connector client periodically reported by the connector client via its corresponding connector server, the status information at least including at least one of heartbeat information and system resource usage.

The embodiment of the fifth aspect of the present disclosure provides a system for hiding the source site, including: a management platform, an edge node server, a connector server, and a connector client;

The management platform is used to generate the application configuration information of the target application, and generate the configuration information corresponding to the connector client; send the configuration information of the connector client; send the application configuration information of the target application required by the edge node server and configuration information of the connector client associated with the target application; receiving and displaying the status information of the connector client periodically reported by the connector client via its corresponding connector server, the status information being at least including at least one of heartbeat information and system resource usage;

The edge node server is configured to receive the access request for the target application sent by the target terminal; and send the access request to the corresponding connector server according to the identifier of the target application included in the access request;

The connector server is configured to receive the access request sent by the edge node server; forward the access request to the corresponding connector client according to the previously established session connection with the connector client;

The connector client is configured to receive the access request sent by the connector server, and forward the access request to a corresponding target application.

The embodiment of the sixth aspect of the present disclosure provides a device for hiding the source site, which is applied to the connector client, including:

A configuration acquisition module, configured to acquire address information of at least one connector server corresponding to the connector client, where the address information is address information of at least one connector server closest to the connector client;

Establishing a session module, configured to establish a session connection with the at least one connector server according to the address information of the at least one connector server, the session connection is from the connector client to the at least one an outbound connection from a connector server;

The source server determining module is configured to, based on the session connection, if the access request for the target application forwarded by the connector server is received, based on the first load balancing strategy, from the plurality of source servers corresponding to the target application Determine the target source server;

A first sending module, configured to send the access request to the target application in the target source server; send the received request response information to the connector server, and the request response information is determined by the The target application in the target source server performs feedback according to the access request.

The embodiment of the seventh aspect of the present disclosure provides a device for hiding the source site, which is applied to the connector server, including:

A receiving module, configured to receive a connection request sent by at least one connector client;

Establishing a session module, configured to establish a session connection with the at least one connector client according to the connection request, and the session connection is an outgoing connection from the at least one connector client to the connector server station connection;

The receiving module is also used to receive the access request for the target application forwarded by the edge node server;

A connector client determining module, configured to determine a target connector client corresponding to the target application from the at least one connector client based on a second load balancing strategy;

The second sending module is configured to forward the access request to the target connector client according to the session connection corresponding to the target connector client.

The embodiment of the eighth aspect of the present disclosure provides a device for hiding a source site, which is applied to an edge node server, including:

The receiving module is configured to receive an access request for a target application sent by a target terminal, the access request includes an identifier of the target application, and the identifier of the target application includes one of domain name, protocol, IP address and port or more;

A configuration acquiring module, configured to acquire configuration information of a connector client bound to the target application according to the identifier of the target application, the configuration information at least including at least one connector service corresponding to the connector client end address information;

A connector server determination module, configured to determine a target connector server from each connector server corresponding to the target application according to the configuration information and the third load balancing strategy;

The third sending module is configured to forward the access request to the target connector server according to the address information of the target connector server.

The embodiment of the ninth aspect of the present disclosure provides a device for hiding the source site, which is applied to the management platform, including:

A configuration generating module, configured to generate configuration information corresponding to at least one connector client, the configuration information at least including identification information of the connector client and address information of a connector server corresponding to the connector client; generating a target application Corresponding application configuration information, the application configuration information includes at least one of the domain name of the target application, the return address, and the identification information of the associated connector client;

A configuration sending module, configured to send the configuration information required by the connector client; send the application configuration information of the target application required by the edge node server and the connector client configuration information associated with the target application;

A status information receiving module, configured to receive and display the status information of the connector client periodically reported by the connector client via its corresponding connector server, the status information at least including heartbeat information and system resource usage at least one of the .

The embodiment of the tenth aspect of the present disclosure provides an electronic device, including a memory, a processor, and a computer program stored on the memory and operable on the processor, and the processor runs the computer program to Implement the method described in any one of the first to fourth aspects above.

The embodiment of the eleventh aspect of the present disclosure provides a computer-readable storage medium, on which a computer program is stored, and the program is executed by a processor to implement the method described in any one of the first to fourth aspects above.

The technical solutions provided in the embodiments of the present disclosure have at least the following technical effects or advantages:

In the embodiment of the present disclosure, the session connection between the connector client and the connector server is established through setting the connector client, and the session connection is an outbound connection between the connector client and the connector server. When the user accesses the target application, he first visits the edge node server, and the edge node server forwards the request to the connector client through the connector server, and the connector client forwards the request to the target application.

This method only needs to block all incoming connections on the target source server without maintaining complex security policies. It can prevent other servers from actively sending information or establishing a connection to the target application, reducing the risk of malicious attacks and ensuring the security of the target application.

Additional aspects and advantages of the disclosure will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the disclosure.

Description of drawings

The accompanying drawings constituting a part of the present disclosure are used to provide a further understanding of the present disclosure, and the schematic embodiments and descriptions of the present disclosure are used to explain the present disclosure, and do not constitute improper limitations to the present disclosure. In the attached picture:

FIG. 1 shows a schematic diagram of an exemplary system architecture to which the technical solutions of embodiments of the present disclosure can be applied;

FIG. 2 shows a signaling interaction diagram of a method for hiding a source station provided by an embodiment of the present disclosure;

Fig. 3 shows a schematic diagram of application configuration information of a target application and configuration information of a connector client provided by an embodiment of the present disclosure;

Fig. 4 shows a process of establishing a session connection between a connector client and a connector server provided by an embodiment of the present disclosure and a schematic diagram of the mapping relationship between the identification information of the connector client and the session;

Fig. 5 shows a schematic diagram of an edge node server selecting a connection server through load balancing and health checking and a connector server selecting a connector client through load balancing and health checking provided by an embodiment of the present disclosure;

Fig. 6 shows a schematic diagram of a connector client reporting status information to a management platform via a connector server provided by an embodiment of the present disclosure;

FIG. 7 shows a flowchart of a method for hiding an origin site provided by an embodiment of the present disclosure;

FIG. 8 shows a schematic diagram of a connector client corresponding to multiple source servers provided by an embodiment of the present disclosure;

FIG. 9 shows an operation flowchart of a connector client in a method for hiding an origin site provided by an embodiment of the present disclosure;

Fig. 10 shows a flow chart of the operation of the connector server in a method for hiding the origin site provided by an embodiment of the present disclosure;

Fig. 11 shows an operation flowchart of an edge node server in a method for hiding an origin site provided by an embodiment of the present disclosure;

Fig. 12 shows an operation flowchart of the management platform in a method for hiding the origin site provided by an embodiment of the present disclosure;

Fig. 13 shows a schematic structural diagram of a device applied to a connector client in a method for hiding an origin site provided by an embodiment of the present disclosure;

Fig. 14 shows a schematic structural diagram of a device applied to a connector server in a method for hiding an origin site provided by an embodiment of the present disclosure;

FIG. 15 shows a schematic structural diagram of a device applied to an edge node server in a method for hiding an origin site provided by an embodiment of the present disclosure;

Fig. 16 shows a schematic structural diagram of a device applied to a management platform in a method for hiding an origin site provided by an embodiment of the present disclosure;

Fig. 17 shows a schematic structural diagram of an electronic device provided by an embodiment of the present disclosure;

Fig. 18 shows a schematic diagram of a storage medium provided by an embodiment of the present disclosure.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments It is a part of the embodiments of the present disclosure, but not all of them. Based on the embodiments in the present disclosure, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present disclosure. It should be noted that, in the case of no conflict, the embodiments in the present disclosure and the features in the embodiments can be combined arbitrarily with each other.

It should be noted that, unless otherwise specified, the technical terms or scientific terms used in the present disclosure shall have the usual meanings understood by those skilled in the art to which the present disclosure belongs.

A method, system, device, device, and storage medium for hiding an origin site according to embodiments of the present disclosure will be described below with reference to the accompanying drawings.

The embodiment of the present disclosure provides a method of hiding the source site, see Figure 1, the network system architecture based on the method includes a connector server, a connector client, a source server, an edge node server, a management platform and a target terminal. Among them, the source server can adopt VPC (Virtual Private Cloud, proprietary network)/NAT (Network Address Translation, network address translation), the source server contains one or more target applications, and the target applications can be internal applications in the intranet. It can also be an application in the public network. The same target application can be deployed on multiple source servers.

The connector client can be a software program for network communication, and the connector client can be deployed in any network that can communicate with the target application. For example, the connector client can be deployed in the same network as the target application, or Can be deployed in any network capable of communicating with the target application. It should be noted that one or more connector clients may be deployed in a network, and the same connector client may communicate with multiple target applications, and the same target application may also communicate with multiple connector clients.

FIG. 1 only schematically shows a connector client, which communicates with a target application in the source server. A session connection can be established between the connector client and the connector server, and the session connection is an outbound connection between the connector client and the connector server, that is, an outbound communication connection. The session protocol type of the session connection is an encryption protocol, and the encryption protocol includes at least one of HTTPS, HTTP/2, HTTP/3, Websocket, and TLS_TCP. The session connection may also be established based on a tunnel protocol, and the tunnel protocol may be one of VPN, GRE, or IPsec. It should be understood that the session connection may also be established using other tunnel protocols, which is not specifically limited in the present disclosure.

The edge node server communicates with the connector server and the target terminal respectively, and the management platform communicates with the edge node server. The target terminal may include but not limited to one or more of smart phones, tablet computers, laptop computers or desktop computers. The transmission protocol between the target terminal and the edge node server may include at least one of HTTP, HTTPS, TCP or UDP. It should be understood that the number of target terminals, edge node servers, connector servers, connector clients, and source servers in FIG. 1 is only illustrative, and there may be any number of target terminals, edge node servers , Connector Server, Connector Client, and Origin Server. For example, the network architecture may include one or more edge node servers and one or more connector servers, and FIG. 1 only schematically shows one edge node server and one connector server.

It is worth noting that the edge node server and the connector server mentioned in the embodiments of the present disclosure are two logical concepts, which are proposed separately to help understanding. In practice, they can be deployed separately or on the same server device , which is not specifically limited in the present disclosure.

Based on the above network architecture, the target terminal's access request for the target application is sent to the connector server via the edge node server. The connector server determines the connector client associated with the target application, and sends the access request to the connector client through an outbound connection with the determined client. Finally, the connector client sends the access request to the corresponding target application. In this way, the target source server to which the target application belongs can block all incoming connections to achieve the purpose of hiding the source site, and the target source server does not need to maintain complex security policies. It can prevent other servers from actively sending information or establishing a connection to the target application, reducing the risk of malicious attacks on the source server and ensuring the security of the target application.

The implementation details of the technical solutions of the embodiments of the present disclosure are described in detail below:

Fig. 2 shows a signaling interaction diagram of a method for hiding a source station provided by an embodiment of the present disclosure. Referring to Figure 2, the method at least includes steps 101 to 114, which are described in detail as follows:

Step 101: The management platform generates configuration information corresponding to at least one connector client, the configuration information at least including identification information of the connector client and address information of a connector server corresponding to the connector client.

Wherein, the management platform may be a cloud computing platform, such as a private cloud or a public cloud. The configuration information corresponding to the connector client includes at least identification information of the connector client and address information of a connector server corresponding to the connector client. Among them, the identification information can be used to identify the connector client, and the identification information can be the IP address, MAC (Media Access Control Address, hardware address) address of the connector client, or an artificially set or automatically generated address that can identify the connector client. End character sequence, etc.

The connector client can be a software program for network communication, and the connector client is installed in the source server of groups such as enterprises, institutions or social organizations or in a network capable of communicating with the source server, so that it can be accessed through the connector client. A session connection is established with the connector server, and remote access to the source server is realized through the established session connection, for example, remote access to a target application included in the source server is realized.

The connector server may be a server capable of communicating with the connector client, and may establish a session connection with the connector client for transmitting information. It should be understood that the address information of the connector server may include a domain name and/or an IP address, and if it is a domain name, it can be resolved to one or more IP addresses of the connector server according to the domain name. It should be noted that one connector server can communicate with one or more connector clients, which is not specifically limited in this disclosure.

In an exemplary embodiment of the present disclosure, before the remote access is realized through the connector client, the configuration information corresponding to the connector client is first generated on the management platform, and the configuration information can be used as the startup parameter corresponding to the connector client, to enable the connector client after configuring the connector client according to the configuration information.

As an implementation, the customer can configure the configuration information corresponding to the connector client by itself. Specifically, the management platform can support the configuration operation of the customer and receive the configuration information corresponding to the connector client configured by the customer. It is also possible for the customer to provide the relevant configuration information of the connector client to the service provider, and then the service provider configures the corresponding configuration information of the client's connector client on the management platform.

As another implementation, the management platform can also automatically generate configuration information corresponding to the connector client. Specifically, the management platform can assign the connector client identification information for identifying the connector client, and according to the entire network system The configuration information of all connector servers included in the schema, assigns the connector server corresponding to the connector client. Wherein, the configuration information of the connector server may include but not limited to the address information of the connector server, the number of associated connector clients, the upper limit of the number of associated connector clients, and the like. After the management platform assigns the identification information and the associated connector server to the connector client, it determines the identification information and the address information of the connector server corresponding to the connector client as the corresponding configuration of the connector client. information.

In an exemplary embodiment of the present disclosure, the connector client may be created on the management platform, and the management platform may provide the service provider with an interface for creating the connector client. The connector client can run on a variety of platforms, such as VMware's virtual machine, Docker (application container engine), public cloud cloud host, etc. The service provider uses the interface provided by the management platform to create connector clients running on different platforms. After the connector client is created, the installation package and configuration information corresponding to the connector client are also generated. The configuration information includes the identification information of the connector client, the address information of the connector server corresponding to the connector client, etc. The address information of the connector server may include the domain name and/or IP address of the connector server.

It should be noted that one or more connector clients can be created on the management platform, and the configuration information corresponding to each connector client can include one or more address information of each connector server, so that after installing and starting the connector client in the source server or in a network capable of communicating with the source server, the connector client can communicate with one or more of the system architecture shown in Figure 1. A connector server establishes a session connection.

For example, Figure 3 shows the configuration information of a connector client, which includes the identification information of the connector client (taking id as an example): "connector client id: 12345", and the corresponding The domain name "companyA.connector.com" of the connector server.

In addition, in an exemplary embodiment, in order to achieve high access availability, the domain name included in the address information of the connector server will be resolved to at least two IP addresses of the connector server. As a result, the connector client can establish session connections with multiple connector servers based on the resolved IP addresses of the multiple connector servers, so that when a certain session connection fails or fails, it can be connected through other session connection for information transfer. It should be understood that the session connections established by the multiple connector servers may be session connections for transmitting the same information. In other words, some of the multiple session connections may be used as primary session connections, and others may be used as secondary session connections. When the main session connection fails, the information transmitted by the secondary session connection can be used for processing to ensure the stability of access.

Step 102: The management platform generates application configuration information corresponding to the target application, and the application configuration information includes at least one of the domain name of the target application, the return address, and the identification information of the associated connector client.

Among them, the target application can be the application in the intranet of groups such as enterprises, institutions or social organizations, such as OA system, Web (website), SSH (Secure Shell, secure shell protocol), VNC (Virtual Network Console, virtual network console) ), RDP (Remote Desktop Protocol, Remote Desktop Protocol), internal IAM (Identity and Access Management, identity identification and access management), etc. The target application can also be an application program in the public network.

In an exemplary embodiment of the present disclosure, before accessing the target application, the management platform generates application configuration information corresponding to the target application. Specifically, the management platform can support user configuration operations. Users determine the target applications that allow remote access according to their own needs, and then configure the application configuration information corresponding to these target applications on the management platform. The management platform can receive and store the applications configured by the user. configuration information, and associate the application configuration information with the corresponding target application.

In an exemplary embodiment, the application configuration information may include at least one of various information such as a return-to-source address, a domain name of a target application, and identification information of a connector client associated with the target application. Wherein, the back-to-source address may include the IP address of the device where the target application is located, the port number opened to the outside world by the device where the target application is located, and the like.

For example, the back-to-source address in the application configuration information corresponding to the target application shown in Figure 3 is 172.16.1.100:443, where 172.16.1.100 is the IP address of the device where the target application is located, that is, the IP address of the source server, and 443 indicates the target application The open port of the device is port 443 (that is, the encrypted web browsing port). The domain name of the target application included in the application configuration information in Figure 3 is "oa.companyA.com", the back-to-source load balancing policy is "polling", and the unique identifier of the connector client associated with the target application is "binding connection server client: 12345".

Through the operations of steps 101 and 102, the configuration information corresponding to the connector client and the application configuration information corresponding to the target application are generated on the management platform, and the target application is set by setting the identification information of the associated connector client in the application configuration information. Associated with the connector client.

It should be noted that the target application and the connector client can be in the same network, for example, both belong to the internal network, both belong to the public network, or belong to the same segment C network, etc. The target application and the connector client can also be in different networks, for example, one in The public network, the other in the internal network, etc., are not specifically limited in this disclosure, as long as the target application and the connector client can communicate.

Please continue to refer to FIG. 2, step 103: the management platform sends the configuration information required by the connector client.

In an exemplary embodiment of the present disclosure, the connector client may directly download the installation package of the connector client from the management platform, and install the connector client locally on the device that needs to install the connector client according to the downloaded installation package. Specifically, the device that needs to install the connector client sends an acquisition request to the management platform, and the management platform sends the installation package of the connector client to the device according to the received acquisition request. After the device downloads the installation package of the connector client from the management platform, it locally installs the connector client according to the installation package. Wherein, the device on which the connector client needs to be installed may be the source server, or other devices capable of communicating with the source server.

Or, the cloud host of the device that needs to install the connector client can have the connector client pre-installed. Or, it may also be that the device downloads a complete connector client image file from the management platform for installation, and so on. The embodiments of the present disclosure make no special limitation on how to install the connector client.

After the connector client is installed on the device, configuration information corresponding to the connector client can be requested from the management platform. The management platform responds to the request and sends configuration information corresponding to the adapter client to the device. After the device installs the connector client and obtains the configuration information corresponding to the connector client from the management platform, it uses the configuration information to start the connector client. In an example, the device sends a configuration information acquisition request to the management platform, and the configuration information acquisition request may include the identification information of the connector client, and the management platform may send the configuration information of the corresponding connector client to the management platform according to the identification information. The device performs feedback.

In an embodiment of the present disclosure, one or more connector clients may be deployed on the same device. In the application scenario where multiple connector clients are deployed, multiple connector clients can be associated with the same target application, and for the same target application, the associated multiple connector clients can be classified as active connections Connector client and backup connector client, so that when the active connector client fails, the backup connector client can be used for communication, improving network stability.

It should be noted that when multiple connector clients are deployed in a device, the identification information of the multiple connector clients can be used as the identification information of the device. For example, device A contains two connector clients, two connection If the identification information of the device client is 123456 and 234567 respectively, then the identification information of the device A may be two, that is, 123456 and 234567, and so on. Alternatively, when multiple connectors are deployed in one device, one identification information may be configured for the device, and the identification information of the device may have a mapping relationship with the identification information of multiple connector clients. Those skilled in the art may determine the corresponding implementation manner according to actual implementation requirements, which is not specifically limited in the present disclosure.

Step 104: The connector client acquires address information of at least one connector server corresponding to the connector client, where the address information is address information of at least one connector server closest to the connector client.

In an exemplary embodiment of the present disclosure, the connector client acquires address information of at least one connector server corresponding to the connector client from the management platform. Optionally, the connector client can directly obtain configuration information corresponding to the connector client from the management platform. Alternatively, the connector client can also indirectly obtain configuration information from the management platform through an intermediary, for example, the management platform sends the configuration information corresponding to the connector client to the configuration center, and the connector client then obtains the configuration information from the configuration center . After obtaining the configuration information, the connector client obtains address information of at least one connector server corresponding to the connector client from the configuration information. The address information includes the IP address and/or domain name of the connector server. The IP address and/or domain name of the connector server may be determined through anycast technology, intelligent resolution technology, and intelligent routing technology.

In the process of obtaining the address information of at least one connector server, it can be obtained according to the geographic location of the connector server and the geographic location of the connector client, specifically obtaining the address information of at least one connector server whose geographic location is closest to the connector client . Alternatively, the address information of the connector server may also be acquired according to the geographic location and in combination with at least one of factors such as network quality and network delay. For example, obtain at least one connector server with the best network quality from a certain number of connector servers closest to the connector client, or obtain from a certain number of connector servers closest to the connector client Obtain at least one connector server with the shortest network latency.

Step 105: The connector client establishes a session connection with at least one connector server according to the address information of at least one connector server, and the session connection is an outgoing connection from the connector client to the at least one connector server. station connection.

In an exemplary embodiment of the present disclosure, after the connector client is installed and the connector client is running normally, it is necessary to establish a session between at least one connector server corresponding to the connector client through the connector client connect. If the address information of the at least one connector server includes the IP address of the connector server, a session connection between the connector client and the at least one connector server is directly established according to the IP address of the at least one connector server.

If the address information of at least one connector server only includes the domain name of the connector server, the connector client sends the domain name resolution request of the at least one connector server to the domain name server. The domain name server performs domain name resolution for each domain name, obtains the IP address corresponding to each domain name, and then sends the IP address corresponding to each domain name to the connector client. The connector client receives the IP address corresponding to each domain name returned by the domain name server, and sends a connection request to the connector server corresponding to each IP address according to each IP address. The connection request includes the identification information of the connector client , to establish and uniquely identify a session connection between the connector client and at least one corresponding connector server.

The session connection between the connector client and the connector server can be an encrypted session connection. When establishing a session connection, the connector client sends authentication information to the at least one connector server according to the acquired address information of the at least one connector server. After the authentication information is authenticated by at least one connector server, an encrypted session connection with the at least one connector server is established.

The above authentication information may include at least one of the connector client's identification information, certificate, key, encryption token and other information. In addition to the listed information, the authentication information may also include other arbitrary forms to identify the connector client. Other authentication information of the terminal, which is not limited in this embodiment of the present disclosure.

In an exemplary embodiment, the authentication information sent by the connector client may include the identification information and the certificate of the connector client. The connector server is also pre-configured with the certificate used to authenticate the connector client. After receiving the authentication information, the connector server compares the certificate included in the authentication information with the certificate stored in itself. If the two certificates are consistent , the authentication passes, otherwise the authentication fails.

The encryption protocol adopted for establishing the encrypted session connection may be at least one of HTTPS, HTTP/2, HTTP/3, Websocket, and TLS_TCP.

The connector client can also establish a session connection with at least one connector server based on a tunnel protocol, and the adopted tunnel protocol can be one of VPN, GRE or IPsec.

In the embodiment of the present disclosure, the session connection is an outbound connection from the connector client to the at least one connector server, and these session connections are active outbound communication connections of the connector client. The connector client prohibits incoming connections. Specifically, you can configure the firewall of the device where the connector client is installed to prohibit incoming connection requests, so that all incoming requests except the session connections established above can be prohibited through the firewall. . In this way, it can be ensured that incoming information can only be received through the established session connection, and remote access to the target application program can be realized through the established session connection, while other incoming access can be avoided to ensure the security of the target application program. When the target application is an intranet application, the security of the intranet can be greatly improved.

Step 106: The connector server receives a connection request sent by at least one connector client, and establishes a session connection with the at least one connector client according to the connection request.

In step 105, before the session connection between the connector client and the connector server is established, a connection request is sent to the connector server, and the connection request includes the identification information of the connector client. Since a connector client can establish a session connection with at least one connector server, the connector server can receive a connection request sent by at least one connector client, and establish a connection with this connector according to the identification information included in the received connection request. A session connection between at least one connector client, further, the session connection may be a session connection between the connector server and a connector client installed in the source server.

In the embodiment of the present disclosure, the number of connection requests received by the connector server may be multiple, and the connection requests include the identification information of the corresponding connector client. The connector server respectively establishes a session connection with at least one connector client according to the multiple connection requests, and associates the identification information included in each connection request with the corresponding session connection. Specifically, the connector server stores the identification information included in the connection request and the corresponding session in the mapping relationship between the identification information of the connector client and the session.

As shown in FIG. 4 , the mapping relationship between the identification information of the connector client and the session is maintained on the connector server. In Figure 4, the connector server with the IP address "1.1.1.1" has established outbound session connections with the three connector clients respectively. Therefore, the mapping relationship maintained on the connector server includes connector client 12345: session 1, connector client 34567: session 2, and connector client 45678: session 3.

In the embodiment of the present disclosure, a connector client can establish a session connection with one or more connector servers, and a connector server can also connect with one or more connector clients, so that a certain connection can be avoided failure of a connector client or a connector server that interrupts remote access.

In the embodiment of the present disclosure, the session connection between the connector client and the connector server is established on port 443 (that is, the encrypted web browsing port), and the connection multiplexing of the application layer is realized on the session connection, and the The back-to-source request is implemented on the loop of the session connection. In order to achieve high availability of the connector client, the connector client can establish persistent session connections with multiple connector servers. For the source server, because the session connection corresponding to the connector client is outbound, the back-to-source access of the target application only depends on the session connection, and does not need to establish any inbound connection. Therefore, intranet firewalls or VPC (Virtual Private Cloud, virtual private cloud) security policy does not need to set a very complicated network policy, only need to open port 443 and block all incoming connections, so as to realize the hiding of the source server and ensure the security of the source server sex.

The connector client is created on the management platform and the application configuration information corresponding to the target application is set, and the connector client is installed on the source server and other devices that need to install the connector client, and the connector client and the connector server are established. session connection, and resolve the domain names of all target applications that allow remote access to the IP address of the edge node server, so that these target applications are directly published on the public network. Then the remote terminal can access the target application through the method provided by the embodiment of the present disclosure.

Step 107: The edge node server receives the access request for the target application sent by the target terminal, the access request includes the identifier of the target application, and the identifier of the target application includes at least one of domain name, protocol, IP address and port.

The edge node server provides functions such as DDoS (Distributed Denial of Service, distributed denial of service) cleaning, cache acceleration, WAF (Web Application Firewall, Web application protection system), load balancing, etc. In addition, the edge node server can also be used as an edge security The gateway provides functions such as identity authentication, rights management, and access control. When the target user accesses the target application, he first accesses the edge node server.

In a specific application scenario, when an employee working at home or on a business trip needs to access a target application in the company's intranet, he can view multiple target applications published by the company on the public network through the target terminal, and select the target application he needs to access. For example, Select by clicking. When the target terminal detects that a certain target application is clicked, it obtains the domain name of the clicked target application, and sends a resolution request for the domain name of the target application to the domain name server. The domain name server resolves the domain name of the target application. Since the domain names of all target applications published on the public network have been resolved to the IP address of the edge node server, the domain name server can obtain the corresponding domain name for the current target application. The IP address of the edge node server. The domain name server returns the IP address obtained through domain name analysis to the target terminal. According to the IP address, the target terminal sends an access request to the corresponding edge node server, and the access request includes the identification of the target application that the target user needs to access.

In some other embodiments of the present disclosure, the edge node server can also record the target user's access behavior log, which can include access time, access object, identity information, etc., and these information can facilitate the security management personnel of the enterprise to User behavior is audited and controlled.

Step 108: The edge node server obtains the configuration information of the connector client bound to the target application according to the identification of the target application.

In an exemplary embodiment of the present disclosure, the edge node server may obtain the application configuration information corresponding to each target application and the configuration information corresponding to the connector client bound to each target application from the management platform in advance. It should be noted that the edge node server may obtain the information directly from the management platform, or may obtain the information from an intermediary such as a configuration center, which is not specifically limited in this disclosure.

After the edge node server receives the access request for the target application, it can obtain the identification of the target application included in the access request, determine the corresponding application configuration information according to the identification of the target application, and then determine the corresponding application configuration information according to the application configuration information. Identification information for the connector client associated with this target application. Based on the determined identification information of the connector client, configuration information corresponding to the connector client is determined, where the configuration information at least includes address information of at least one connector server corresponding to the connector client.

In another exemplary embodiment of the present disclosure, the edge node server requests or accepts push from the management platform about the application configuration information of the target application. The management platform queries the application configuration information of the target application according to the query request sent by the edge node server and includes the identification of the target application, obtains the identification information of the connector client associated with the target application from the application configuration information, and then according to The identification information obtains the configuration information corresponding to the connector client, and sends the configuration information corresponding to the connector client to the edge node server.

Step 109: The edge node server determines the target connector server from each connector server corresponding to the target application based on the third load balancing policy and the acquired configuration information of the connector client.

The acquired configuration information of the connector client includes address information of at least one connector server corresponding to the connector client. In the embodiment of the present disclosure, the edge node server is pre-configured with the third load balancing strategy, and the edge node server determines the target connector service from at least one connector server corresponding to the connector client based on the third load balancing strategy end.

In an example, the third load balancing strategy may be at least one of hash based on connector server IP, weighted round robin, and active/standby round robin. The third load balancing strategy further needs to select a connector server satisfying a preset health condition from at least one connector server as a target connector server. The preset health condition may include at least one of the network status with the connector server (such as network delay, network connectivity, connection establishment time), the response delay of the connector server (such as the first packet time), and the like.

The edge node server can obtain its network status, response delay of the connector server, etc. from the connector server. Specifically, the address information of the connector server included in the configuration information corresponding to the above-mentioned connector client may include the domain name and/or IP address of the connector server. If the address information is a domain name, the edge node server may use the connector The domain name resolution request of the server is sent to the domain name server for resolution, so that the domain name server returns the IP address of the corresponding connector server.

It should be noted that the address information of the connector server can be one or more, for example, there are multiple IP addresses of the connector server, or one or more IP addresses corresponding to the domain name fed back by the domain name server, and so on. Some of the connector servers corresponding to multiple address information can be used as the main connector server, and others can be used as the backup connector servers.

After the edge node server obtains the IP address of each connector server corresponding to the target application, it establishes a communication connection with each connector server according to the obtained IP address, and obtains the IP address of each connector based on the communication connection. The network status of the server, the response delay of the connector server, etc. Then, according to the obtained information such as the network status and the response delay of the connector server, a connector server satisfying a preset health condition is selected from at least one connector server as the target connector server.

In another example, the preset health conditions may also include that the load is less than a preset threshold, and the network status, system status, and disk status are normal, and the preset health conditions may list some abnormalities in the network status, system status, and disk status Circumstances, such as network interruption, system resource usage exceeding the preset ratio, remaining disk storage space less than the preset value, etc.

Before determining the target connector server, the edge node server first needs to obtain the system status information of each connector server corresponding to the target application, the system status information includes the load of the connector server, CPU usage percentage, memory usage percentage , disk IO, and network IO at least one.

In some embodiments of the present disclosure, the edge node server can directly obtain its system status information from the connector server. Specifically, after obtaining the IP address of each connector server corresponding to the target application, the edge node server establishes a communication connection with each connector server according to the obtained IP address. Then obtain the system state information of each connector server from each connector server respectively.

In some other embodiments of the present disclosure, the edge node server may obtain the system state information of each connector server corresponding to the target application from the management platform.

Specifically, in the network architecture of the embodiment of the present disclosure, each connector server can periodically report its own system status information to the management platform. The management platform receives and stores the system status information of each connector server. The management platform can also display system status information for each connector server. Or the management platform can perform fault analysis and status analysis on each connector server according to the system status information of each connector server, and then display the system status information and analysis results of each connector server.

Thus, when the edge node server receives the access request for the target application sent by the target terminal, it obtains the current system status information of each connector server corresponding to the target application from the management platform.

After the edge node server obtains the system status information of each connector server corresponding to the target application through any of the above methods, based on the third load balancing strategy, determine the connections that meet the preset health conditions from each connector server server server as the target connector server corresponding to the current access request.

If the edge node server determines a plurality of connector servers satisfying the preset health conditions, it may select randomly or sequentially from them to determine a target connector server. As shown in Figure 5, assume that the edge node server determines the connector servers 1 and 2 corresponding to the target application, and then the edge node server performs load balancing and health checks on the connector servers 1 and 2 in the above-mentioned way, so that the connection Select a connector server that satisfies the preset health conditions from server servers 1 and 2 as the target connector server.

In another example, the edge node server can also determine at least two target connector servers, and send the access request to one of them. If the connector server fails and is unavailable, the access request is sent through another connector server This access request ensures the stability of access.

Step 110: The edge node server forwards the access request to the target connector server according to the address information of the target connector server.

In an exemplary embodiment of the present disclosure, if the address information of the target connector server includes the IP address of the target connector server, the edge node server directly forwards the access request to the target connector server according to the IP address. If the address information only includes the domain name of the target connector server, the edge node server sends the domain name resolution request of the target connector server to the domain name server. The domain name server performs domain name analysis on the domain name sent by the edge node server, obtains the IP address of each target connector server, forms an IP list for each IP address obtained, and returns the IP list to the edge node server. Contains the IP addresses of one or more target connector servers.

The edge node server receives the IP list returned by the domain name server, and selects an IP address from the IP list. Specifically, if the IP list includes only one IP address, the IP address is directly selected. If the IP list includes multiple IP addresses, an IP address of the active target connector server is selected from the multiple IP addresses. The edge node server establishes a communication connection between the target connector server corresponding to the selected IP address according to the selected IP address, and then sends the access request to the target connector server.

In some other embodiments of the present disclosure, before sending the access request to the target connector server, the edge node server may also perform two-way authentication with the target connector server to further ensure the security of the target application access. For example, the edge node server sends its own first certificate to the target connector server. The target connector server receives the first certificate of the edge node server, and verifies the first certificate, and verifies whether the first certificate is issued by a trusted CA center. The server returns a warning message, warning the edge node server that the first certificate is not trustworthy. After the verification is passed, the target connector server can compare the information in the certificate, such as the domain name and public key. If the domain name or public key conforms to the preset information transmission rules, the legal identity of the edge node server is recognized.

The edge node server can also ask the target connector server to send its own second certificate. After receiving the second certificate, the edge node server can verify the second certificate. If it fails to pass the verification, it will refuse the connection. If verified, information can be transmitted between the two.

In the embodiment of the present disclosure, the two-way authentication is carried out between the edge node server and the target connector server through the above method. As long as one of the first certificate and the second certificate fails to pass the authentication, the edge node server will not send the access request to For the target connector server, the security of intranet access is greatly improved. Furthermore, the edge node server may first encrypt the access request, and send the encrypted data to the target connector server, so as to improve the security of data transmission.

Step 111: The connector server receives the access request for the target application forwarded by the edge node server, and determines the target connector client corresponding to the target application from at least one connector client based on the second load balancing strategy.

In an exemplary embodiment of the present disclosure, the connector server is a transit medium, which can realize the connection between the edge node server and the target application. Further, when the target application is located in the intranet, it can realize the connection between the edge node server and the intranet application get through. After the connector server starts, it waits for the connection between the edge node server and the connector client and forwards the access request from the edge node server.

After receiving the access request from the target terminal to the target application forwarded by the edge node server, the connector server determines each connector client associated with the target application from at least one connector client establishing a session connection.

First the connector server determines all connector clients associated with the target application. Specifically, the identifier of the target application included in the access request is sent to the management platform. The management platform obtains the application configuration information of the target application according to the identification of the target application, and queries the identification information of the connector client associated with the target application from the application configuration information. The management platform sends the identification information of the connector client associated with the target application to the connector server. The connector server receives identification information of a connector client associated with the target application.

In other embodiments of the present disclosure, the edge node server may also obtain the application configuration information of the target application from the management platform, and the edge node server forwards the access request and the application configuration information to the connector server. In this way, the connector server can locally obtain the identification information of the connector client associated with the target application from the application configuration information.

After the connector server obtains the identification information of the connector client associated with the target application through any of the above methods, it establishes a session with the connector server according to the mapping relationship between the identification information of the connector client and the session stored locally. Each of the connected at least one connector client is determined to be associated with the target application.

In the embodiment of the present disclosure, the second load balancing strategy is pre-configured in the connector server. After the connector server obtains the identification information of the connector client The policy and the identification information of the connector client that has established the session connection and is associated with the target application determine the target connector client.

In an example, the second load balancing strategy may be at least one of hash based on connector client IP, weighted round robin, and active/standby round robin. The second load balancing strategy also needs to select a connector client satisfying a preset health condition from at least one connector client as a target connector client. The preset health condition may include at least one of the network status with the connector client (such as network delay, network connectivity, connection establishment time), the response delay of the connector client (such as the first packet time), and the like.

After the connector server obtains the identification information of the connector client that has established a session connection and is associated with the target application, it obtains the network status and response delay of each connector client through the session connection with each connector client and other information. Then select a connector client satisfying a preset health condition as a target connector client from at least one connector client according to the obtained network status, response delay and other information.

Before determining the target connector client, the connector server first needs to obtain the status information of each connector client associated with the target application, the status information includes the heartbeat information, load, CPU usage percentage, At least one of memory usage percentage, disk IO, and network IO.

In some embodiments of the present disclosure, the connector server can directly obtain its status information from the connector client. After the connector server obtains the identification information of the connector clients that have established the session connection and are associated with the target application, they obtain the status information of each connector client through the session connection with each connector client.

In some other embodiments of the present disclosure, each connector client may periodically report its own status information to the management platform via at least one connector server that establishes a session connection with itself. The management platform receives and displays the status information of each connector client, so as to facilitate intuitive understanding of various operating statuses of the connector client. Alternatively, the management platform can perform fault analysis and status analysis on each connector client based on the status information of each connector client. For example, based on the heartbeat information included in the status information of the connector client, it can be analyzed whether the connector client is normal. run. After the analysis results are obtained through analysis, the status information of each connector client and the corresponding analysis results are displayed. As shown in Figure 6, the connector client reports status information to the management platform via the connector server that establishes a session connection with it. The management platform performs data analysis based on the information reported by the connector client, and can display the connector in the form of a data report. The client's status information, analysis results, etc. can also be monitored and alarmed when it is determined that the connector client is abnormal.

In the process of reporting the status information of the connector client, the connector server may store the correspondence between the identification information of each connector client and the status information. After the connector server obtains the identification information of the connector client associated with the target application, it may directly obtain the state information of the connector client associated with the target application from the locally stored correspondence.

Alternatively, the connector server may not store the correspondence between the identification information of the connector client and the status information. Instead, after obtaining the identification information of the connector client associated with the target application, the state of the connector client associated with the target application is obtained from the management platform according to the identification information of the connector client associated with the target application information.

After the connector server obtains the status information of each connector client that has established a session connection and corresponds to the target application through any of the above methods, based on the second load balancing strategy, determine from each connector client that meets the predetermined requirements. Set the connector client with the health condition as the target connector client corresponding to the current access request.

It should be understood that the number of target connector clients determined by the connector server may be one or more.

If the number of target connector clients is multiple, that is, any number of two or more than two, one of the target connector clients can be used as the main target connector client, and the other ones are secondary The target connector client, so that when the primary target connector client fails or fails, the target application can be accessed through the secondary target connector client.

It should be understood that the target application associated with the primary target connector client and the secondary target connector client should be the same, or the target application associated with the primary target connector client is included in the secondary target connector client Among the associated target applications, or between the primary target connector client and the secondary target connector client, there are partly the same associated target applications, and so on.

As shown in FIG. 5 , connector clients 1 and 2 are deployed in the source server, and both connector clients 1 and 2 are associated with the same source server. The connector client 1 establishes session connections with the connector servers 1 and 2 respectively, and the session connections are established based on the tunneling protocol. The session connection between connector client 1 and connector server 1 is the primary tunnel 1, and the session connection between connector client 1 and connector server 2 is the backup tunnel 1. Similarly, the session connection between the connector client 2 and the connector server 1 is the primary tunnel 2, and the session connection between the connector client 2 and the connector server 2 is the backup tunnel 2. Assume that the edge node server selects connector server 1 as the target connector server through load balancing and health checks, and sends an access request for the target application to connector server 1. Then the connector server 1 performs load balancing and health checks on the connector clients 1 and 2 according to the above method, so as to select a connector client that meets the preset health conditions as the target connection among the connector clients 1 and 2 server client. Assuming that the connector server 1 selects the connector client 2 as the target connector client, the connector server 1 sends the access request to the connector client 2 through the standby tunnel 2 . Then the connector client 2 sends the access request to the corresponding target application in the source server.

Step 112: The connector server forwards the access request to the target connector client according to the session connection corresponding to the target connector client.

In an exemplary embodiment of the present disclosure, the connector server obtains the target connector client from the locally stored mapping relationship between the identifier information of the connector client and the session according to the determined identification information of the target connector client. The session connection corresponding to the end. The access request is forwarded to the target connector client through the session connection corresponding to the target connector client.

In some other embodiments of the present disclosure, the connector server may also forward the access request to the target connector client in a polling manner. Specifically, a preset polling rule is configured in the connector server, and the preset polling rule specifies the polling sequence of each target connector client associated with the target application. Select one target connector client per target connector client associated. According to the identification information of the selected target connector client, obtain the session connection corresponding to the selected target connector client from the mapping relationship between the identification information and the session, and forward the access request to the target connector client through the obtained session connection .

In order to facilitate the understanding of the process of sending the access request of the target terminal to the target connector client, it will be described below with reference to the accompanying drawings. As shown in FIG. 7 , the target terminal sends an access request to the edge node server, and the access request includes the domain name "oa.companyA.com" of the target application to be accessed. According to the domain name, the edge node server obtains the application configuration information corresponding to the domain name "oa.companyA.com" from the management platform. The identifier of the connector client bound in the application configuration information is "12345", and also obtains the connector from the management platform. Configuration information of client 12345. After the edge node server obtains the application configuration information and the configuration information corresponding to the connector client, it sends a resolution request for the domain name "companyA.connector.com" of the connector server included in the configuration information corresponding to the connector client to the domain name server, and receives The resolved IP address "1.1.1.1" of the connector server returned by the domain name server, the edge node server establishes a communication connection with the connector server based on the IP address "1.1.1.1", and sends the access request and application configuration The information is sent to the connector server. The connector server with the IP address "1.1.1.1" obtains the session connection corresponding to the connector client from the pre-stored mapping relationship according to the identifier "12345" of the connector client included in the application configuration information, and connects through the session The access request is sent to the connector client 12345 in Enterprise A's network.

Step 113: Based on the session connection between the connector client and the connector server, if the access request for the target application forwarded by the connector server is received, based on the first load balancing strategy, multiple Determine the target source server in the source server, and send the access request to the target application in the target source server.

In the embodiment of the present disclosure, the connector client may be configured with a mapping relationship between the domain name of each target application associated with it and the return-to-origin address. Alternatively, the management platform may send the back-to-source address or application configuration information of each target application to the connector client. Alternatively, the connector server obtains the application configuration information corresponding to the target application from the management platform or the edge node server, the application configuration information includes the return-to-source address corresponding to the target application, and the connector server forwards the access request to The application configuration information may also be sent to the connector client when connecting the connector client. If the connector client receives an access request for the target application sent by the connector server through the session connection between the two, the connector client will locally query the target application's domain name according to the domain name of the target application included in the access request. Back to source address. Each source-back address found in the query is the address of each source server corresponding to the target application.

In the embodiment of the present disclosure, the connector client is pre-configured with the first load balancing policy. After the connector client obtains the return-to-origin address of each source server corresponding to the target The origin-return address of the target source server is determined from the origin-return address of the source server.

In an example, the first load balancing strategy may be at least one of source server IP-based hashing, weighted round robin, and active/standby round robin. The first load balancing strategy also needs to select a source server satisfying a preset health condition from at least one source server as a target source server. The preset health condition may include at least one of network status with the source server (such as network delay, network connectivity, connection establishment time), response delay of the source server (such as first packet time), and the like.

The connector client establishes a communication connection with each source server according to the back-to-source address of each source server, and obtains information such as the network status and response delay of each source server based on the established communication connection. Afterwards, based on the first load balancing policy and information such as the network status and response delay of each source server, a source server satisfying a preset health condition is determined from each source server as a target source server. Then the connector client sends the access request to the target application in the target source server according to the back-source address of the target source server.

Before determining the target source server, the connector client first needs to obtain the system status information of each source server, the system status information includes the source server load, CPU usage percentage, memory usage percentage, disk IO, network IO one.

The connector client obtains the system status information of each source server from each source server respectively according to the return-to-source address of each source server. Then, based on the first load balancing policy and the system state information of each source server, determine the source server satisfying the preset health condition from each source server as the target source server. Then the connector client sends the access request to the target application in the target source server according to the back-source address of the target source server.

As shown in Figure 8, the connector client is associated with the source server 1, 2 and 3 respectively, assuming that the source server 1, 2 and 3 all include the target application corresponding to the current access request, then the connector client according to the first load Balance strategy, select a source server from source servers 1, 2 and 3 as the target source server, assuming that the selected target source server is source server 2, then send the access request to source server 2.

Step 114: The connector client sends the received request response information to the connector server, and the request response information is fed back by the target application in the target source server according to the access request.

In an exemplary embodiment of the present disclosure, the target application generates request response information according to the feedback of the access request, and sends the request response information to the connector client. The connector client sends the request response information to the connector server through the session connection between itself and the connector server. The connector server sends the request response information to the edge node server, and the edge node server sends the request response information to the target terminal.

In the embodiment of the present disclosure, the transmission protocol of the session connection between the connector client and the connector server may be an encrypted transmission protocol, and the data between the connector client and the connector server are all encrypted transmissions to ensure Data security during transmission.

In the embodiment of the present disclosure, multiple connector clients may be associated with the same target application, and for the same target application, the associated multiple connector clients may include the active connector client and the standby connection When the active connector client fails, it can receive the target terminal’s access request to the target application through the session connection corresponding to the standby connector client, or send the target application’s access request to the target application through the session connection corresponding to the standby connector client. Request response information generated in response to an access request. A source server can also include multiple connector clients, which are divided into primary connector clients and secondary connector clients. After the primary connector client fails or the load limit is reached, the secondary connector client performs data transmission. .

In addition, the source server can also send its own health status information to the management platform every preset time period (such as 2min, 0.5h or 1h, etc.), and the management platform can judge whether the source server is abnormal according to the health status information of the source server. If there is an abnormality, an alarm message will be sent to the management personnel in time.

The remote user sends an access request to the edge node server, and the access request includes the identification of the target application. The edge node server acquires the application configuration information of the target application to be accessed and the configuration information corresponding to the connector client associated with the target application from the management platform. The edge node server sends the domain name resolution request of the domain name of the connector server included in the configuration information corresponding to the connector client to the domain name server, and sends the access request and application configuration information to the link server according to the IP address of the connector server returned by the domain name server. in the server server.

As shown in Figure 7, the domain name "companyA.connector.com" corresponds to the connector server with the IP address "1.1.1.1". Assuming that the access request is an access to a target application in the network of enterprise A, the edge node server may send the access request and application configuration information to the connector server with the IP address "1.1.1.1". The connector server then sends the access request to the target application in enterprise A through the session connection with the connector client 12345 .

In the embodiment of the present disclosure, the session connection between the connector client and the connector server is established through setting the connector client, and the session connection is an outbound connection between the connector client and the connector server. When the user accesses the target application, he first visits the edge node server, and the edge node server forwards the request to the connector client through the connector server, and the connector client forwards the request to the target application. It is only necessary to block all incoming connections on the target source server without maintaining complex security policies. It can prevent other servers from actively sending information or establishing a connection to the target application, reducing the risk of malicious attacks and ensuring the security of the target application.

Some other embodiments of the present disclosure provide a method for hiding an origin site, and the method is applied to a connector client. Referring to Figure 9, the method specifically includes the following steps:

Step 201: The connector client acquires address information of at least one connector server corresponding to the connector client, where the address information is address information of at least one connector server closest to the connector client.

The connector client is deployed in any network that can communicate with the target application, and one or more connector clients are deployed in the network where the connector client is deployed.

In an exemplary embodiment of the present disclosure, the connector client receives configuration information corresponding to the connector client sent by the management platform. In one example, the connector client can obtain configuration information directly from the management platform. In another example, the connector client can also indirectly obtain configuration information from the management platform through an intermediary. For example, the management platform sends the configuration information corresponding to the Get that configuration information. After the connector client obtains the configuration information, it obtains address information of at least one connector server corresponding to the connector client from the configuration information. The address information includes the IP address and/or domain name of the connector server.

Step 202: The connector client establishes a session connection with at least one connector server according to the address information of the at least one connector server, and the session connection is an outbound connection from the connector client to the at least one connector server.

In an exemplary embodiment of the present disclosure, the address information of the connector server is a domain name and/or an IP address determined by anycast technology, intelligent resolution technology, and intelligent routing technology. If the address information of the connector server only includes an IP address, the connector client establishes a session connection with the at least one connector server according to the IP address of the at least one connector server. If the address information of the connector server only includes the domain name of the connector server, the connector client sends the at least one domain name of the connector server to the domain name server; receives the IP address corresponding to each domain name returned by the domain name server; according to each The IP addresses respectively send connection requests to one or more connector servers, and the connection requests include identification information of the connector clients, so as to establish session connections between the connector clients and one or more connector servers.

It is worth noting that the session connection is an outbound connection between the connector client and the connector server, which is an active outgoing communication connection of the connector client, and the connector client prohibits any incoming connection requests , so as to avoid malicious attacks from others and ensure the security of the target application. In an example, prohibiting incoming connection requests may be configured in the firewall corresponding to the connector client, so that all incoming requests except the session connection established above can be prohibited through the firewall.

In an example, the transmission protocol of the session connection is an encrypted transmission protocol, that is, the data transmitted through the session connection is encrypted and then transmitted in ciphertext, so as to improve the security of data transmission.

The connector client can also send authentication information to at least one connector server according to the address information of at least one connector server; after the authentication information is authenticated by at least one connector server, establish an Encrypted session connections between . The session protocol type of the encrypted session connection is an encryption protocol, and the encryption protocol includes at least one of HTTPS, HTTP/2, HTTP/3, Websocket, and TLS_TCP.

In other embodiments, the session connection may also be established based on a tunnel protocol, where the tunnel protocol is one of VPN, GRE, or IPsec.

Step 203: Based on the established session connection, if the connector client receives an access request for the target application forwarded by the connector server, it determines the target application from multiple source servers corresponding to the target application based on the first load balancing strategy. The source server sends the access request to the target application in the target source server.

Step 204: The connector client sends the received request response information to the connector server, and the request response information is fed back by the target application in the target source server according to the access request.

In the embodiment of the present disclosure, the connector clients may include a primary connector client and a secondary connector client, and the secondary connector client is used when the primary connector client fails. Multiple connector clients can be deployed on the source server. The multiple connector clients include the active connector client and the backup connector client. The active connector client and the backup connector client are the same as the target application Association; when the active connector client fails, the access request of the target terminal to the target application is received through the session connection corresponding to the backup connector client.

The connector client can also periodically report the status information of the connector client to the management platform via at least one connector server, and the status information includes at least one of heartbeat information and system status information.

In the embodiments of the present disclosure, for the specific operation details of the connector client, reference may be made to the operation of the connector client in any of the foregoing embodiments, which will not be repeated here.

In the embodiment of the present disclosure, the connector client establishes an outbound session connection with the connector server, and the access request for the target application is sent to the connector client through the session connection, and the connector client sends the The request is forwarded to the target application. It is only necessary to block all incoming connections on the target source server without maintaining complex security policies. It can prevent other servers from actively sending information or establishing a connection to the target application, reducing the risk of malicious attacks and ensuring the security of the target application.

Some embodiments of the present disclosure provide a method for hiding the origin site, which is applied to the connector server, see FIG. 10 , and the method specifically includes the following steps:

Step 301: The connector server receives a connection request sent by at least one connector client.

In an example, there may be multiple connection requests, and the connection requests include identification information of corresponding connector clients.

Step 302: The connector server establishes a session connection with at least one connector client according to the connection request, and the session connection is an outbound connection from the at least one connector client to the connector server.

In an example, the connector server respectively establishes a session connection with at least one connector client according to multiple connection requests, and associates the identification information of each connector client with the corresponding session connection.

Step 303: The connector server receives the access request for the target application forwarded by the edge node server, and determines the target connector client corresponding to the target application from at least one connector client based on the second load balancing strategy.

Step 304: The connector server forwards the access request to the target connector client according to the session connection corresponding to the target connector client.

In an example, there may be multiple target connector clients, and the connector server forwards the access request to each target connector client according to the session connection associated with the identification information of the multiple target connector clients.

Specifically, the connector server extracts the identification information of each connector client associated with the target application from the application configuration information; according to the identification information of each connector client, each connector client is obtained from the mapping relationship Corresponding session connection; Obtain the status information of each connector client through the corresponding session connection of each connector client or from the management platform; according to the status information of each connector server, based on the second load balancing strategy, from each Select a target connector client that satisfies the preset health conditions from the connector clients, and forward the access request to the target connector client through the session connection corresponding to the selected target connector client.

In other embodiments of the present disclosure, the connector server may also use a polling mechanism to forward the access request. Specifically, extract the identification information of each connector client associated with the target application from the application configuration information; select a target connector client from each connector client according to a preset polling rule; The identification information of the target connector client obtains the session connection corresponding to the selected target connector client from the mapping relationship; forwards the access request to the target connector client through the obtained session connection.

For the specific operation details of the connector server, reference may be made to the operation of the connector server in any of the above embodiments, which will not be repeated here.

In the embodiment of the present disclosure, the connector server establishes an outbound session connection with the connector client, and the connector server sends an access request for the target application to the connector client through the session connection, and the connection The server client forwards the request to the target application. It is only necessary to block all incoming connections on the target source server without maintaining complex security policies. It can prevent other servers from actively sending information or establishing a connection to the target application, reducing the risk of malicious attacks and ensuring the security of the target application.

Some embodiments of the present disclosure provide a method of hiding the origin site, which is applied to an edge node server, see FIG. 11 , and the method specifically includes the following steps:

Step 401: The edge node server receives an access request for a target application sent by a target terminal. The access request includes an identifier of the target application, and the identifier of the target application includes at least one of domain name, protocol, IP address and port.

Step 402: The edge node server acquires configuration information of a connector client bound to the target application according to the target application identifier, the configuration information at least including address information of at least one connector server corresponding to the connector client.

Step 403: The edge node server determines the target connector server from each connector server corresponding to the target application based on the third load balancing policy and the acquired configuration information of the connector client.

Step 404: The edge node server forwards the access request to the target connector server according to the address information of the target connector server.

For the specific operation details of the edge node server, reference may be made to the operation of the edge node server in any of the foregoing embodiments, which will not be repeated here.

In the embodiment of the present disclosure, the edge node server forwards the access request and application configuration information to the connector server, and the connector server forwards the access request to the connector client through an outbound session connection with the connector client end, the connector client forwards the request to the target application. It is only necessary to block all incoming connections on the target source server without maintaining complex security policies. It can prevent other servers from actively sending information or establishing a connection to the target application, reducing the risk of malicious attacks and ensuring the security of the target application.

Some embodiments of the present disclosure provide a method of hiding the origin site, which is applied to the management platform, see Figure 12, the method specifically includes the following steps:

Step 501: The management platform generates configuration information corresponding to the connector client, the configuration information at least including identification information of the connector client and address information of a connector server corresponding to the connector client.

Step 502: The management platform generates application configuration information corresponding to the target application. The application configuration information includes at least one of the domain name of the target application, the return address, and the identification information of the associated connector client.

Step 503: the management platform sends the configuration information required by the connector client.

Step 504: The management platform sends the application configuration information of the target application required by the edge node server and the configuration information of the connector client associated with the target application.

Step 505: The management platform receives and displays the status information of the connector client periodically reported by the connector client via its corresponding connector server. The status information includes at least one of heartbeat information and system resource usage.

For the specific operation details of the management platform, reference may be made to the operation of the management platform in any of the above embodiments, and details are not repeated here.

In the embodiment of the present disclosure, the configuration information of the connector client and the application configuration information of the target application are generated in the management platform, and the target application is associated with the connector client. And send the configuration information of the connector client to the connector client through the management platform. The application configuration information of the target application required by the edge node server and the configuration information of the connector client associated with the target application are sent. Receive and display the status information of the connector client, and realize the status monitoring and alarm of the connector client. Based on the configuration information of the connector client and the application configuration information of the target application generated by the management platform, remote terminals can access the target application, and only need to block all incoming connections on the target source server without maintaining complex security Strategy. It can prevent other servers from actively sending information to the target application or establishing a connection, reducing the risk of malicious attacks and ensuring the security of the target application.

An embodiment of the present disclosure provides a system for hiding source sites, as shown in FIG. 1 , the system includes: an edge node server, a connector server, a management platform, and a connector client;

The management platform is used to generate the application configuration information of the target application, and generate the configuration information corresponding to the connector client; send the configuration information of the connector client; send the application configuration information of the target application required by the edge node server and related to the target application The configuration information of the connected connector client; receive and display the status information of the connector client periodically reported by the connector client via its corresponding connector server, the status information includes at least one of heartbeat information and system resource usage one;

The edge node server is configured to receive the access request for the target application sent by the target terminal; and send the access request to the corresponding connector server according to the identification of the target application included in the access request;

The connector server is used to receive the access request sent by the edge node server; forward the access request to the corresponding connector client according to the previously established session connection with the connector client;

The connector client is used to receive the access request sent by the connector server, and forward the access request to the corresponding target application.

In an exemplary embodiment, a session connection is an outbound connection from a connector client to a connector server.

The system for hiding the source site provided by the above-mentioned embodiments of the present disclosure is based on the same inventive concept as the method for hiding the source site provided by the embodiments of the present disclosure, and has the same beneficial effect as the method adopted, run or implemented by its stored application program .

An embodiment of the present disclosure also provides an apparatus for hiding an origin site, which is configured to perform operations of a connector client in the method for hiding an origin site provided in any of the above embodiments. Referring to Figure 13, the device includes:

The configuration acquiring module 601 is configured to acquire address information of at least one connector server corresponding to the connector client, where the address information is the address information of at least one connector server closest to the connector client;

A session establishment module 602, configured to establish a session connection with at least one connector server according to the address information of at least one connector server, where the session connection is an outbound connection from a connector client to at least one connector server;

The source server determination module 603 is configured to determine the target source from multiple source servers corresponding to the target application based on the session connection, if the access request for the target application forwarded by the connector server is received, based on the first load balancing strategy server;

The first sending module 604 is configured to send the access request to the target application in the target source server; send the received request response information to the connector server, and the request response information is sent by the target application in the target source server according to the access request Give feedback.

The address information is a domain name and/or IP address determined by one of anycast technology, intelligent resolution technology, and intelligent routing technology, and establishes a session module 602, which is used to send at least one connector server to the domain name server if the address information is a domain name Domain name resolution request; receive the IP address corresponding to the domain name of at least one connector server sent by the domain name server; send a connection request to at least one connector server respectively according to each IP address, so as to establish a connector client and at least one connector Session connections between servers.

The configuration obtaining module 601 is configured to receive configuration information corresponding to the connector client sent by the management platform; obtain address information of at least one connector server corresponding to the connector client from the configuration information.

Establish a session module 602, configured to send authentication information to at least one connector server according to the address information of at least one connector server; after the authentication information is authenticated by at least one connector server, establish a connection with at least one connector server Encrypted session connections between .

The session protocol type of the session connection is an encryption protocol, and the encryption protocol includes at least one of HTTPS, HTTP/2, HTTP/3, Websocket, and TLS_TCP.

The session establishment module 602 is configured to establish a session connection based on a tunnel protocol, and the tunnel protocol is one of VPN, GRE or IPsec.

The device also includes: an information reporting module, configured to periodically report the status information of the connector client to the management platform via at least one connector server, where the status information includes at least one of heartbeat information and system status information.

The device for hiding the source site provided by the above-mentioned embodiments of the present disclosure is based on the same inventive concept as the method for hiding the source site provided by the embodiments of the present disclosure, and has the same beneficial effect as the method adopted, run or implemented by the stored application program .

An embodiment of the present disclosure also provides a device for hiding an origin site, which is used to perform the operations of the connector server in the method for hiding an origin site provided in any one of the above embodiments. Referring to Figure 14, the device includes:

A receiving module 701, configured to receive a connection request sent by at least one connector client;

Establishing a session module 702, configured to establish a session connection with at least one connector client according to the connection request, where the session connection is an outbound connection from at least one connector client to the connector server;

The receiving module 703 is also configured to receive the access request for the target application forwarded by the edge node server;

A connector client determining module 704, configured to determine a target connector client corresponding to the target application from at least one connector client based on a second load balancing strategy;

The second sending module 705 is configured to forward the access request to the target connector client according to the session connection corresponding to the target connector client.

The number of connection requests is multiple, and the connection request contains the identification information of the corresponding connector client;

The session establishment module 702 is configured to respectively establish a session connection with at least one connector client according to multiple connection requests, and store a mapping relationship between each identification information and a corresponding session connection.

A connector client determination module 704, configured to determine each connector client associated with the target application from at least one connector client establishing a session connection; based on the second load balancing strategy, each determined connection Determine the target connector client in Connector Client.

An embodiment of the present disclosure also provides an apparatus for hiding an origin station, which is configured to perform operations of the edge node server in the method for hiding an origin station provided in any one of the above embodiments. Referring to Figure 15, the device includes:

The receiving module 801 is configured to receive an access request for a target application sent by a target terminal, where the access request includes an identification of the target application, and the identification of the target application includes one or more of domain name, protocol, IP address, and port;

The configuration acquiring module 802 is configured to acquire configuration information of a connector client bound to the target application according to the identifier of the target application, where the configuration information includes at least address information of at least one connector server corresponding to the connector client;

The connector server determination module 803 is configured to determine the target connector server from each connector server corresponding to the target application according to the configuration information and the third load balancing strategy;

The third sending module 804 is configured to forward the access request to the target connector server according to the address information of the target connector server.

An embodiment of the present disclosure also provides an apparatus for hiding an origin site, which is used to perform the operations of the management platform in the method for hiding an origin site provided in any of the above embodiments. Referring to Figure 16, the device includes:

The configuration generation module 901 is configured to generate configuration information corresponding to at least one connector client, the configuration information at least includes the identification information of the connector client and the address information of the connector server corresponding to the connector client; generates an application corresponding to the target application Configuration information, the application configuration information includes at least one of the domain name of the target application, the back-to-source address, and the identification information of the associated connector client;

The configuration sending module 902 is configured to send the configuration information required by the connector client; send the application configuration information of the target application required by the edge node server and the connector client configuration information associated with the target application;

The status information receiving module 903 is configured to receive and display the status information of the connector client periodically reported by the connector client via its corresponding connector server, the status information at least includes at least one of heartbeat information and system resource usage .

Embodiments of the present disclosure also provide an electronic device to implement the above method for hiding an origin site. Please refer to FIG. 17 , which shows a schematic diagram of an electronic device provided by some embodiments of the present disclosure. As shown in Figure 17, the electronic device 10 includes: a processor 1000, a memory 1001, a bus 1002 and a communication interface 1003, the processor 1000, the communication interface 1003 and the memory 1001 are connected through the bus 1002; A computer program running on the processor 1000, when the processor 1000 runs the computer program, executes the method for hiding an origin site provided in any one of the foregoing implementations of the present disclosure.

Wherein, the memory 1001 may include a high-speed random access memory (RAM: Random Access Memory), and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 1003 (which may be wired or wireless), and Internet, wide area network, local network, metropolitan area network, etc. can be used.

The bus 1002 may be an ISA bus, a PCI bus or an EISA bus, etc. The bus can be divided into address bus, data bus, control bus and so on. Wherein, the memory 1001 is used to store a program, and the processor 1000 executes the program after receiving an execution instruction, and the method for hiding the source site disclosed in any implementation manner of the aforementioned embodiments of the present disclosure can be applied to the processor 1000 in, or implemented by the processor 1000.

The processor 1000 may be an integrated circuit chip with signal processing capability. In the implementation process, each step of the above method may be implemented by an integrated logic circuit of hardware in the processor 1000 or instructions in the form of software. The above-mentioned processor 1000 can be a general-purpose processor, including a central processing unit (Central Processing Unit, referred to as CPU), a network processor (Network Processor, referred to as NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), off-the-shelf programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. Various methods, steps and logic block diagrams disclosed in the embodiments of the present disclosure may be implemented or executed. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like. The steps of the methods disclosed in the embodiments of the present disclosure may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register. The storage medium is located in the memory 1001, and the processor 1000 reads the information in the memory 1001, and completes the steps of the above method in combination with its hardware.

The electronic device provided by the embodiment of the present disclosure is based on the same inventive concept as the method for hiding the source station provided by the embodiment of the present disclosure, and has the same beneficial effect as the method adopted, operated or realized.

The embodiment of the present disclosure also provides a computer-readable storage medium corresponding to the method for hiding the origin site provided in the foregoing embodiment. Please refer to FIG. A computer program (that is, a program product). When the computer program is run by a processor, it will execute the method for hiding the source site provided in any of the foregoing implementation manners.

It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random Access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other optical and magnetic storage media will not be repeated here.

The computer-readable storage medium provided by the above-mentioned embodiments of the present disclosure is based on the same inventive concept as the method for hiding the source site provided by the embodiments of the present disclosure, and has the same beneficial effects as the method adopted, run or implemented by the stored application program .

It should be noted:

In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the present disclosure may be practiced without these specific details. In some instances, well-known structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

Similarly, it should be appreciated that in the above description of example embodiments of the disclosure, in order to streamline the disclosure and to facilitate an understanding of one or more of the various inventive aspects, various features of the disclosure are sometimes grouped together into a single embodiment, figure, or its description. This method of disclosure, however, is not to be interpreted as reflecting a schematic representation that the claimed disclosure requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this disclosure.

In addition, those skilled in the art will understand that although some embodiments described herein include some features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the present disclosure. and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

The above is only a preferred specific implementation mode of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any person skilled in the art can easily think of changes or Any replacement should be covered within the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be determined by the protection scope of the claims.

Industrial Applicability

In this disclosure, the session connection between the connector client and the connector server is established through setting the connector client, the session connection is an outbound connection between the connector client and the connector server, and the user accesses the target application When accessing the edge node server first, the edge node server forwards the request to the connector client through the connector server, and the connector client forwards the request to the target application.

Claims

A method for hiding a source site, applied to a connector client, the connector client being associated with at least one target application, comprising:

Obtain address information of at least one connector server corresponding to the connector client, where the address information is address information of at least one connector server closest to the connector client;

Establish a session connection with the at least one connector server according to the address information of the at least one connector server, the session connection is an outgoing connection from the connector client to the at least one connector server station connection;

Based on the session connection, if an access request for the target application forwarded by the connector server is received, based on the first load balancing policy, the target source server is determined from the multiple source servers corresponding to the target application, and the sending the access request to the target application in the target source server;

Send the received request response information to the connector server, and the request response information is fed back by the target application in the target source server according to the access request.
The method according to claim 1, wherein the address information is a domain name and/or IP address determined by one of anycast technology, intelligent resolution technology, and intelligent routing technology, and the address information according to the at least one connector server Address information for establishing a session connection with the at least one connector server, including:

If the address information is a domain name, sending a domain name resolution request of the at least one connector server to a domain name server;

receiving the IP address corresponding to the domain name of the at least one connector server sent by the domain name server;

Send a connection request to the at least one connector server according to each of the IP addresses, so as to establish a session connection between the connector client and the at least one connector server.
The method according to claim 1, wherein said acquiring address information of at least one connector server corresponding to said connector client comprises:

receiving configuration information corresponding to the connector client sent by the management platform;

Obtain address information of at least one connector server corresponding to the connector client from the configuration information.
The method according to claim 1, wherein the establishing a session connection with the at least one connector server according to the address information of the at least one connector server includes:

sending authentication information to the at least one connector server according to the address information of the at least one connector server;

After the authentication information is authenticated by the at least one connector server, an encrypted session connection with the at least one connector server is established.
The method according to claim 4, wherein the session protocol type of the session connection is an encryption protocol, and the encryption protocol includes at least one of HTTPS, HTTP/2, HTTP/3, Websocket, and TLS_TCP.
The method according to claim 4, wherein the session connection is established based on a tunnel protocol, and the tunnel protocol is one of VPN, GRE or IPsec.
The method according to claim 1, wherein the connector client is deployed in any network that can communicate with the target application, and the network where the connector client is deployed has one or more of the Connector client.
The method according to claim 1, said method further comprising:

Periodically report the status information of the connector client to the management platform via the at least one connector server, where the status information at least includes at least one of heartbeat information and system status information.
A method of hiding the source site, applied to the connector server, including:

receiving a connection request sent by at least one connector client;

Establishing a session connection with the at least one connector client according to the connection request, where the session connection is an outbound connection from the at least one connector client to the connector server;

receiving an access request for the target application forwarded by the edge node server, and determining a target connector client corresponding to the target application from the at least one connector client based on a second load balancing strategy;

Forwarding the access request to the target connector client according to the session connection corresponding to the target connector client.
The method according to claim 9, wherein the number of the connection requests is multiple, and the connection requests include the identification information of the corresponding connector client;

According to the connection request, establishing a session connection with the at least one connector client includes:

Establish a session connection with the at least one connector client respectively according to the multiple connection requests, and store a mapping relationship between each piece of identification information and a corresponding session connection.
The method according to claim 9, wherein the determining the target connector client corresponding to the target application from the at least one connector client based on the second load balancing strategy comprises:

determining each connector client associated with the target application from the at least one connector client establishing a session connection;

Based on the second load balancing policy, determine a target connector client from each of the determined connector clients.
A method of hiding the source station, applied to the edge node server, including:

receiving an access request for a target application sent by a target terminal, where the access request includes an identifier of the target application, and the identifier of the target application includes at least one of a domain name, a protocol, an IP address, and a port;

Obtain configuration information of a connector client bound to the target application according to the identifier of the target application, where the configuration information includes at least address information of at least one connector server corresponding to the connector client;

Based on the third load balancing policy and the acquired configuration information of the connector client, determine the target connector server from each connector server corresponding to the target application;

forwarding the access request to the target connector server according to the address information of the target connector server.
A method of hiding the source site, applied to the management platform, including:

Generate configuration information corresponding to at least one connector client, where the configuration information includes at least identification information of the connector client and address information of a connector server corresponding to the connector client;

Generate application configuration information corresponding to the target application, where the application configuration information includes at least one of a domain name of the target application, a back-to-source address, and identification information of an associated connector client;

sending the configuration information of the connector client;

sending the application configuration information of the target application required by the edge node server and the configuration information of the connector client associated with the target application;

receiving and displaying the status information of the connector client periodically reported by the connector client via its corresponding connector server, the status information at least including at least one of heartbeat information and system resource usage.
A system for hiding source sites, including: a management platform, an edge node server, a connector server and a connector client;

The management platform is used to generate the application configuration information of the target application, and generate the configuration information corresponding to the connector client; send the configuration information of the connector client; send the application configuration information of the target application required by the edge node server and configuration information of the connector client associated with the target application; receiving and displaying the status information of the connector client periodically reported by the connector client via its corresponding connector server, the status information being at least including at least one of heartbeat information and system resource usage;

The edge node server is configured to receive the access request for the target application sent by the target terminal; and send the access request to the corresponding connector server according to the identifier of the target application included in the access request;

The connector server is configured to receive the access request sent by the edge node server; forward the access request to the corresponding connector client according to the previously established session connection with the connector client;

The connector client is configured to receive the access request sent by the connector server, and forward the access request to a corresponding target application.
The system of claim 14, wherein the session connection is an outbound connection from the connector client to the connector server.
A device for hiding the source station, applied to the connector client, including:

A configuration acquisition module, configured to acquire address information of at least one connector server corresponding to the connector client, where the address information is address information of at least one connector server closest to the connector client;

Establishing a session module, configured to establish a session connection with the at least one connector server according to the address information of the at least one connector server, the session connection is from the connector client to the at least one an outbound connection from a connector server;

The source server determining module is configured to, based on the session connection, if the access request for the target application forwarded by the connector server is received, based on the first load balancing strategy, from the plurality of source servers corresponding to the target application Determine the target source server;

A first sending module, configured to send the access request to the target application in the target source server; send the received request response information to the connector server, and the request response information is determined by the The target application in the target source server performs feedback according to the access request.
A device for hiding the source site, applied to the connector server, including:

A receiving module, configured to receive a connection request sent by at least one connector client;

Establishing a session module, configured to establish a session connection with the at least one connector client according to the connection request, and the session connection is an outgoing connection from the at least one connector client to the connector server station connection;

The receiving module is also used to receive the access request for the target application forwarded by the edge node server;

A connector client determining module, configured to determine a target connector client corresponding to the target application from the at least one connector client based on a second load balancing strategy;

The second sending module is configured to forward the access request to the target connector client according to the session connection corresponding to the target connector client.
A device for hiding source sites, applied to edge node servers, including:

The receiving module is configured to receive an access request for a target application sent by a target terminal, the access request includes an identifier of the target application, and the identifier of the target application includes one of domain name, protocol, IP address and port or more;

A configuration acquiring module, configured to acquire configuration information of a connector client bound to the target application according to the identifier of the target application, the configuration information at least including at least one connector service corresponding to the connector client end address information;

A connector server determination module, configured to determine a target connector server from each connector server corresponding to the target application according to the configuration information and the third load balancing strategy;

The third sending module is configured to forward the access request to the target connector server according to the address information of the target connector server.
A device for hiding the source station, applied to the management platform, including:

A configuration generating module, configured to generate configuration information corresponding to at least one connector client, the configuration information at least including identification information of the connector client and address information of a connector server corresponding to the connector client; generating a target application Corresponding application configuration information, the application configuration information includes at least one of the domain name of the target application, the return address, and the identification information of the associated connector client;

A configuration sending module, configured to send the configuration information required by the connector client; send the application configuration information of the target application required by the edge node server and the connector client configuration information associated with the target application;

A status information receiving module, configured to receive and display the status information of the connector client periodically reported by the connector client via its corresponding connector server, the status information at least including heartbeat information and system resource usage at least one of the .
An electronic device, comprising a memory, a processor, and a computer program stored on the memory and operable on the processor, the processor runs the computer program to achieve any one of claims 1-13 the method described.
A computer-readable storage medium, on which a computer program is stored, and the program is executed by a processor to implement the method according to any one of claims 1-13.