CN116319166A - Cross-public-network multi-machine-room intranet communication method, device, equipment and storage medium - Google Patents

Abstract

The application relates to a cross-public network multi-machine-room intranet communication method, device, equipment and storage medium, and relates to the technical field of cross-network communication, which is applied to a central machine room, and when the central machine room receives request data corresponding to a target machine room, the request data is verified based on a preset machine room information set; if verification is successful, a secure file transfer protocol (SSH) network tunnel is created, and a mapping relation between a socket of the target machine room and a socket of a target proxy server corresponding to the central machine room is built, so that other servers in the central machine room can realize communication with the target machine room through the SSH network tunnel based on the mapping relation and the socket of the target proxy server. The method and the device effectively improve the safety of communication among multiple machine rooms, and effectively reduce the difficulty and cost of communication among multiple machine rooms crossing a public network.

Description

Intranet communication method, device, equipment and storage medium for multiple computer rooms across public network

technical field

The present application relates to the technical field of cross-network communication, and in particular to a method, device, equipment and storage medium for cross-public network multi-room intranet communication.

Background technique

At present, when realizing the intranet communication of multiple computer rooms across the public network, it is generally used to build a dedicated line or purchase a VPN (Virtual Private Network, virtual private network) service, and based on the HTTP (HyperTextTransferProtocol, hypertext transfer protocol) protocol and complete multiple data transfers through the public network. Business program communication between computer rooms. Although the above-mentioned methods can realize multi-computer room intranet communication across the public network, the private line construction method has the problems of high development difficulty and high cost, and the public network communication through the HTTP protocol has higher security requirements for the business system, and To a certain extent, it increases the development and maintenance costs.

It can be seen that how to effectively realize intranet communication of multiple computer rooms across the public network to reduce development difficulty and cost is an urgent problem to be solved at present.

Contents of the invention

The present application provides a method, device, device and storage medium for multi-room intranet communication across a public network, so as to solve the problem in related technologies that the low-difficulty and low-cost multi-room intranet communication across a public network cannot be effectively realized.

In the first aspect, a method for intranet communication of multiple computer rooms across a public network is provided, the method is applied to a central computer room, and the method includes the following steps:

When receiving the corresponding request data sent by the target computer room, verifying the request data based on the preset computer room information set;

If the verification is successful, create a secure file transfer protocol SSH network tunnel, and build a mapping relationship between the socket of the target computer room and the socket of the target proxy server corresponding to the central computer room, so that other servers in the central computer room can The above mapping relationship and the socket of the target proxy server are used to communicate with the target computer room through the SSH network tunnel.

In some embodiments, the request data includes basic computer room information of the target computer room, an ID number, and a computer room authority policy for realizing zero-trust communication.

In some embodiments, the verification of the request data based on the preset computer room information set includes:

Selecting target computer room information corresponding to the ID number of the target computer room from the preset computer room information set;

Comparing the basic computer room information and the computer room authority strategy in the target computer room information with the basic computer room information and the computer room authority strategy in the request data respectively, to obtain a comparison result;

If the comparison results are consistent, it is determined that the verification is successful;

If the comparison result is inconsistent, it is determined that the verification fails.

In some embodiments, the basic computer room information includes the site name of the computer room, the name of the computer room, the name of the server corresponding to the computer room, the IP address of the computer room, the port number of the computer room, the SSH user name and SSH password corresponding to the computer room, and the server running on the server corresponding to the computer room Business system name on .

In some embodiments, before the step of verifying the request data based on the preset computer room information set when receiving the corresponding request data sent by the target computer room, it further includes:

Based on SSH receiving the registration information sent by the target computer room, the registration information includes the basic computer room information of the target computer room, the computer room ID number and the computer room authority strategy for realizing zero-trust communication;

The target computer room is registered based on the registration information, and the registration information is stored in a preset computer room information set.

In some embodiments, after the step of if the verification is successful, it also includes:

Sending a proxy server address list to the target computer room, so that the target computer room can filter out other computer rooms as the new central computer room based on the proxy server address list;

The step of receiving the registration information sent by the target computer room based on SSH is performed based on the new central computer room.

In some embodiments, after the step of verifying the request data based on the preset computer room information set, the method further includes:

If authentication fails, the connection is refused.

In the second aspect, a multi-computer room intranet communication device across a public network is provided, the device includes a central computer room, which is used for:

When receiving the corresponding request data sent by the target computer room, verifying the request data based on the preset computer room information set;

If the verification is successful, create a secure file transfer protocol SSH network tunnel, and build a mapping relationship between the socket of the target computer room and the socket of the target proxy server corresponding to the central computer room, so that other servers in the central computer room can The above mapping relationship and the socket of the target proxy server are used to communicate with the target computer room through the SSH network tunnel.

In a third aspect, a multi-computer room intranet communication device across a public network is provided, including: a memory and a processor, at least one instruction is stored in the memory, and the at least one instruction is loaded and executed by the processor, In order to realize the aforementioned multi-room intranet communication method across the public network.

In a fourth aspect, a computer-readable storage medium is provided, the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the aforementioned multi-room intranet communication across the public network is realized method.

This application provides a cross-public network communication method, device, device, and storage medium for a multi-computer room intranet, which is applied to a central computer room. When the central computer room receives the corresponding request data sent by the target computer room, the The computer room information set verifies the request data; if the verification is successful, create a secure file transfer protocol SSH network tunnel, and build a mapping relationship between the socket of the target computer room and the socket of the target proxy server corresponding to the central computer room , for other servers in the central computer room to communicate with the target computer room through the SSH network tunnel based on the mapping relationship and the socket of the target proxy server. This application verifies the request data of the target computer room, and builds the SSH network tunnel after the verification is passed, so as to improve the security of communication between multiple computer rooms; at the same time, build the IP address, port number of the target computer room and the target agent of the central computer room The mapping relationship between the IP address and port number of the server, and based on the mapping relationship, complete the communication with the target computer room in the SSH network tunnel through the IP address and port number of the target proxy server, without the need for dedicated line construction or through HPPT Protocol for public network communication, which effectively reduces the difficulty and cost of multi-computer room intranet communication across the public network.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings that need to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application. For those skilled in the art, other drawings can also be obtained based on these drawings without creative effort.

FIG. 1 is a schematic flow diagram of a multi-computer room intranet communication method across a public network provided by an embodiment of the present application;

2 is a schematic diagram of the communication principle between the target computer room and the central computer room provided by the embodiment of the present application;

FIG. 3 is a schematic structural diagram of a multi-room intranet communication device across a public network provided by an embodiment of the present application.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments It is a part of the embodiments of this application, but not all of them. Based on the embodiments in the present application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present application.

The embodiment of the present application provides a cross-public network multi-room intranet communication method, device, equipment, and storage medium, which can solve the problem that the low-difficulty and low-cost cross-public network multi-room intranet communication cannot be effectively realized in related technologies The problem.

Referring to Figure 1 and Figure 2, the embodiment of the present application provides a multi-computer room intranet communication method across the public network, the method is applied to the central computer room, including the following steps:

Step S10: When receiving the corresponding request data sent by the target computer room, verify the request data based on the preset computer room information set; wherein, the request data includes the basic computer room information, ID number and user ID of the target computer room. The basic computer room information includes the computer room site name, the computer room name, the server name corresponding to the computer room, the computer room IP address, the computer room port number, the SSH user name and SSH password corresponding to the computer room, and the Name of the business system on the server corresponding to the computer room.

Exemplary, it can be understood that before realizing the communication between the central computer room and the target computer room, the pre-work for realizing the communication will be processed. It should be noted that the number of target computer rooms can be determined according to the number of computer rooms that need to communicate with the central computer room. For example, if there are 5 computer rooms that need to communicate with the central computer room, then these 5 computer rooms can all be used as the target computer rooms in this embodiment. The central computer room can support multiple target computer rooms at the same time, and the configuration and communication principles are consistent. Therefore, for the sake of simplicity of description, the following embodiments will illustrate the communication principle between one of the target computer rooms and the central computer room.

Specifically, in this embodiment, you can first enter the relevant computer room information of the target computer room in the resource management, such as the site name, computer room name, server name, IP address, port number, SSH user name, SSH password, and server name of the computer room. The name of the running business system, etc., and then import the above information into the distributed cloud management platform. At the same time, enter the computer room information of the target computer room on the client information page of the distributed cloud management platform, and generate a corresponding ID number for the target computer room based on the computer room information. It is understandable that the above operations can be completed through the visual console, and the visual operation of the whole process will be more convenient and efficient.

In addition, the central computer room will also generate a key corresponding to the target computer room based on the information of the computer room, through which the deployment of the target computer room can be verified. For example, when deploying the target computer room, you can first query the computer room information of the target computer room from the stored computer room information on the distributed cloud management platform; There is a key to verify the information of the queried computer room; if the verification is not passed, the deployment of the target computer room is stopped; and if the verification is passed, the target installation file is downloaded from the Linux server in the central computer room; the computer room ID in the target installation file Change it to the ID number of the target computer room, then install and start the program of the target computer room to ensure that the running log is normal. It can be understood that when deploying the target computer room, the whitelist authorization of the central computer room will be completed, and after the connection with the central computer room, authentication and matching will be configured on the server side of the central computer room to complete the unique identity authentication. It should be understood that when the target computer room is deployed for the first time, authentication matching with the central computer room needs to be completed to ensure the security and stability of subsequent communication and avoid illegal access due to key leakage of the target computer room.

It should be noted that this embodiment provides the SSH open source ApacheSSHD program of the central computer room, and uses the SSHD program carried by the Linux system as a forwarding connector, and uses the open source JSCH (JSCH is a pure Java implementation of SSH2, allowing the target object to connect to an sshd server, and use port forwarding, X11 forwarding and file transfer, etc.) as the client, and also carried out secondary development of the functions of the above open source programs.

Therefore, when the target computer room needs to communicate with the central computer room, the bridge service of the target computer room (that is, the client developed based on JSCH) will send SSH to the central controller of the central computer room (the central controller is based on ApacheSSH transformation) through the SSH protocol. The port sends request data carrying its own basic computer room information, ID number, and permission policy for realizing zero-trust communication. It should be noted that complete permission control can provide security capabilities, and permission policies can include access permissions, rate-limiting policies, and traffic-limiting policies. Included content is set. Among them, the central computer room will provide unified user management, authority management and policy management, etc., and at the same time encapsulate complex background operations and provide a convenient operation platform.

When the central controller receives the request data, it will check the request data with the pre-stored information of the relevant computer room of the target computer room, so as to determine whether it is necessary to create an SSH protocol network tunnel to realize the connection with the target computer room. It can be seen that all cross-public network computer rooms need to go through authorization and communication policy restrictions before intranet communication, so as to meet the technical and security requirements of zero trust.

Further, before the step of verifying the request data based on the preset computer room information set when receiving the corresponding request data sent by the target computer room, it also includes:

Based on SSH receiving the registration information sent by the target computer room, the registration information includes the basic computer room information of the target computer room, the computer room ID number and the computer room authority strategy for realizing zero-trust communication;

The target computer room is registered based on the registration information, and the registration information is stored in a preset computer room information set.

Exemplary, in this embodiment, before the target computer room communicates with the central computer room, the bridge service of the target computer room will also send the SSH port of the central controller of the central computer room through the SSH protocol, carrying its own basic computer room information, ID number and The registration information of the authority policy; when the central controller receives the registration information, it will register the target computer room and store the registration information in the configuration center of the central controller, that is, store the registration information of all target computer rooms in the configuration center , to form a computer room information collection in the configuration center.

Further, the verification of the request data based on the preset computer room information set includes:

Selecting target computer room information corresponding to the ID number of the target computer room from the preset computer room information set;

Comparing the basic computer room information and the computer room authority strategy in the target computer room information with the basic computer room information and the computer room authority strategy in the request data respectively, to obtain a comparison result;

If the comparison results are consistent, it is determined that the verification is successful;

If the comparison result is inconsistent, it is determined that the verification fails.

Exemplarily, in this embodiment, after the central controller of the central computer room receives the request data packet sent by the bridge service of the target computer room, it will process the request data based on the relevant computer room information of the target computer room stored in the configuration center. Check the information such as the computer room ID, computer room IP, computer room random port and key, and zero-trust permission policy in the computer room. After confirming that all data are consistent and valid, the verification is judged to be successful; otherwise, the verification is judged to have failed.

Step S20: If the verification is successful, create a secure file transfer protocol SSH network tunnel, and build a mapping relationship between the socket of the target computer room and the socket of the target proxy server corresponding to the central computer room, for other users in the central computer room The server realizes the communication with the target computer room through the SSH network tunnel based on the mapping relationship and the socket of the target proxy server.

Exemplarily, in this embodiment, after the request data is verified successfully, an SSH protocol network tunnel will be created. It can be understood that all computer rooms connected to the distributed cloud can complete the connection between any computer room through the unified page of the central computer room. To establish a tunnel between any computer rooms to realize internet program communication between any computer rooms across the public network; at the same time, construct the socket of the target computer room (that is, the IP address and port number) and the socket of the target proxy server corresponding to the central computer room The mapping relationship between words is to bind the IP address and port number specified by the bridge service of the target computer room with the random port (the range of which is 1024-65000) of the proxy server of the network controller of the central computer room, and through the central controller Store the IP address and port number specified by the target computer room and the IP address and port number of the proxy server corresponding to the network controller to the configuration center of the central controller, that is, store the above mapping relationship to the configuration center, so that other servers in the central computer room can pass The proxy server IP address and port number of the network controller complete the communication with the server IP address and port number of the target computer room.

For example, when the central controller of the central computer room receives the request data, it will search for the ID number of the target computer room on the running status page of the server node of the central computer room on the distributed cloud management platform, and check the request data sent by the target computer room. After confirming that it is correct, activate the connection; and after the activation is successful, the network tunnel between the target computer room and the central computer room is opened; at this time, you can click to obtain the proxy server address on the server page of the central computer room to trigger the generation and network controller The address of the random port of the corresponding proxy server, so that other servers in the central computer room can complete the server communication with the target computer room in the SSH network tunnel through the proxy server address. It should be noted that when the central computer room needs to establish a new proxy address, it can be realized by triggering the response mode and through the operation of the visual console.

Specifically, assuming that the IP address of the proxy server in the central computer room is X1 and the port number is Y1, the configuration center stores the mapping relationship between X1, Y1 and X2, Y2, where X2 is the IP address of the target computer room, and Y2 is the target computer room port number; when other servers in the central computer room need to communicate with the target computer room, the other servers will send the request data to the proxy server with IP address X1 and port number Y1, and then send the request data through the proxy server to the target computer room with IP address X2 and port number Y2, so as to realize the communication between the other server and the target computer room. It can be seen that, on the server side of the central computer room, the tunnel agent address (which can be a fixed IP address+ Random port number), and then complete the cross-computer room communication through the tunnel proxy address.

Further, after the step of verifying the request data based on the preset computer room information set, it further includes:

If authentication fails, the connection is refused.

Exemplarily, in this embodiment, after the central controller of the central computer room receives the request data packet sent by the bridge service of the target computer room, based on the relevant computer room information of the target computer room stored in the configuration center, the Information such as computer room ID, computer room IP, computer room random port and key, and zero-trust authority policy are checked. After confirming that the data is inconsistent, it is determined that the verification has failed. At this time, the central computer room will directly reject the connection. The target computer room can confirm that it has not completed the connection with the central computer room by recording "connection refused" in the error log.

Further, after the step if the verification is successful, it also includes:

Sending a proxy server address list to the target computer room, so that the target computer room can filter out other computer rooms as the new central computer room based on the proxy server address list;

The step of receiving the registration information sent by the target computer room based on SSH is performed based on the new central computer room.

Exemplarily, in this embodiment, after the central computer room checks the request data sent by the target computer room based on the relevant computer room information of the target computer room stored in the configuration center and confirms that the verification is successful, it will not only create a link between the target computer room and the central computer room At the same time, the proxy server address list will be sent to the target computer room; it can be understood that each IP address in the proxy server address list represents the IP address of the corresponding proxy server in other computer rooms. In addition, the network bridge service of each target computer room in this embodiment has the ability of network controller to provide the mapping of proxy server IP address + port number for the servers in other computer rooms, so as to realize the communication from the target computer room to other computer rooms; at the same time, the target The network bridge service in the computer room will initialize all proxy channels when it starts, and provide scheduled tasks to ensure disconnection reconnection and security verification.

Therefore, when the target computer room needs to communicate with the computer room corresponding to the IP address in the proxy server address list, then for the target computer room, the computer room corresponding to the IP address in the proxy server address list will become its new central computer room. The communication flow and principle between Shixin's central computer room and the target computer room are the same as those mentioned above, and will not be repeated here for the sake of brevity.

For example, assuming that the proxy server address list includes IP address X3, IP address X4, and IP address X5, when the target computer room needs to communicate with the computer room corresponding to IP address X3, then the computer room corresponding to IP address X3 will become the target computer room. new central computer room. It can be seen that the central computer room provides a tunnel proxy between the target computer room and multiple other computer rooms, and generates proxy addresses between the target computer room and other computer rooms, so that the cross-computer room intranet program to other computer rooms can be completed in the target computer room communication.

To sum up, this embodiment implements the proprietary authentication and matching between the client (i.e., the target computer room) and the server (ie, the central computer room) through the secondary development of ApacheSSHD and encapsulation based on JSCH, and based on the LinuxSSHD service The SSH protocol tunnel realizes the intranet communication of programs in multiple cross-public network computer rooms, provides complete policy control while ensuring secure communication, and provides a convenient and safe operating environment for applications, operation and maintenance, management, and research and development in distributed clouds. , which effectively reduces the difficulty and cost of multi-computer room intranet communication across the public network.

The embodiment of the present application also provides a multi-computer room intranet communication device across the public network, the device includes a central computer room, which is used for:

When receiving the corresponding request data sent by the target computer room, verifying the request data based on the preset computer room information set;

If the verification is successful, create a secure file transfer protocol SSH network tunnel, and build a mapping relationship between the socket of the target computer room and the socket of the target proxy server corresponding to the central computer room, so that other servers in the central computer room can The above mapping relationship and the socket of the target proxy server are used to communicate with the target computer room through the SSH network tunnel.

Further, the request data includes basic computer room information of the target computer room, an ID number, and a computer room authority policy for realizing zero-trust communication.

Further, the central computer room is specifically used for:

Selecting target computer room information corresponding to the ID number of the target computer room from the preset computer room information set;

Comparing the basic computer room information and the computer room authority strategy in the target computer room information with the basic computer room information and the computer room authority strategy in the request data respectively, to obtain a comparison result;

If the comparison results are consistent, it is determined that the verification is successful;

If the comparison result is inconsistent, it is determined that the verification fails.

Further, the basic computer room information includes the site name of the computer room, the name of the computer room, the server name corresponding to the computer room, the IP address of the computer room, the port number of the computer room, the SSH user name and SSH password corresponding to the computer room, and the server running on the server corresponding to the computer room. Business system name.

Further, the central computer room is also used for:

Based on SSH receiving the registration information sent by the target computer room, the registration information includes the basic computer room information of the target computer room, the computer room ID number and the computer room authority strategy for realizing zero-trust communication;

The target computer room is registered based on the registration information, and the registration information is stored in a preset computer room information set.

Further, the central computer room is also used for:

Sending a proxy server address list to the target computer room, so that the target computer room can filter out other computer rooms as the new central computer room based on the proxy server address list;

The step of receiving the registration information sent by the target computer room based on SSH is performed based on the new central computer room.

Further, the central computer room is also used for: rejecting the connection if the verification fails.

It should be noted that those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described device and each unit can be implemented by referring to the aforementioned multi-computer room intranet communication method across the public network The corresponding process in the example will not be repeated here.

The apparatus provided by the above embodiments can be implemented in the form of a computer program, and the computer program can run on the multi-room intranet communication device across the public network as shown in FIG. 3 .

The embodiment of the present application also provides a multi-computer room intranet communication device across the public network, including: a memory connected through a system bus, a processor, and a network interface, at least one instruction is stored in the memory, and at least one instruction is loaded by the processor and execute to realize all or part of the steps of the aforementioned multi-computer room intranet communication method across the public network.

Wherein, the network interface is used for network communication, such as sending assigned tasks and the like. Those skilled in the art can understand that the structure shown in Figure 3 is only a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation to the computer equipment on which the solution of the application is applied. The specific computer equipment can be More or fewer components than shown in the figures may be included, or some components may be combined, or have a different arrangement of components.

The processor can be a CPU, or other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), field programmable logic gate arrays (Field Programmable Gate Array, FPGA) or other programmable logic device, discrete gate or transistor logic device discrete hardware components, etc. The general-purpose processor can be a microprocessor, or the processor can also be any conventional processor, etc. The processor is the control center of the computer device, and uses various interfaces and lines to connect various parts of the entire computer device.

The memory can be used to store computer programs and/or modules, and the processor implements various functions of the computer device by running or executing the computer programs and/or modules stored in the memory and calling data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application program required by a function (such as a video playback function, an image playback function, etc.); The data created by the use (such as video data, image data, etc.) and the like. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, internal memory, plug-in hard disk, smart memory card (SmartMediaCard, SMC), secure digital (Securedigital, SD) card, flash memory card (FlashCard), at least one magnetic disk storage device, flash memory device, or other volatile solid-state storage device.

The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, all or part of the steps of the above-mentioned multi-computer room intranet communication method across a public network are realized.

The embodiment of the present application realizes all or part of the aforementioned processes, and it can also be completed by instructing related hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by a processor, it can realize steps in each of the above methods. Wherein, the computer program includes computer program code, and the computer program code may be in the form of source code, object code, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying computer program code, recording medium, U disk, removable hard disk, magnetic disk, optical disk, computer memory, read-only memory (Read-Only memory, ROM), random access memory (RandomAccessmemory, RAM), electrical carrier signals, telecommunication signals, and software distribution media. It should be noted that the content contained in computer readable media may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer readable media does not include Electrical carrier signals and telecommunication signals.

Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, servers or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowcharts and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the present application. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

It should be noted that, as used herein, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article or system comprising a set of elements includes not only those elements, It also includes other elements not expressly listed, or elements inherent in the process, method, article, or system. Without further limitations, an element defined by the phrase "comprising a..." does not preclude the presence of additional identical elements in the process, method, article or system comprising that element.

The above descriptions are only specific implementation manners of the present application, so that those skilled in the art can understand or implement the present application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the application. Therefore, the present application will not be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims (10)

1. The method is characterized by being applied to a central machine room, and comprises the following steps:

when receiving request data corresponding to a target machine room, verifying the request data based on a preset machine room information set;

if verification is successful, a secure file transfer protocol (SSH) network tunnel is created, and a mapping relation between a socket of the target machine room and a socket of a target proxy server corresponding to the central machine room is built, so that other servers in the central machine room can realize communication with the target machine room through the SSH network tunnel based on the mapping relation and the socket of the target proxy server.

2. The method for multi-machine-room intranet communication across a public network according to claim 1, wherein: the request data comprises basic machine room information of the target machine room, an ID number and a machine room authority policy for realizing zero-trust communication.

3. The method for multi-machine-room intranet communication across public networks according to claim 2, wherein the verifying the request data based on the preset machine room information set comprises:

screening target machine room information corresponding to the ID number of the target machine room from the preset machine room information set;

comparing the basic machine room information and the machine room authority policy in the target machine room information with the basic machine room information and the machine room authority policy in the request data respectively to obtain a comparison result;

if the comparison results are consistent, judging that the verification is successful;

if the comparison result is inconsistent, judging that verification fails.

4. The method for multi-machine-room intranet communication across a public network according to claim 2, wherein: the basic machine room information comprises a machine room site name, a machine room name, a server name corresponding to the machine room, a machine room IP address, a machine room port number, an SSH user name and an SSH password corresponding to the machine room and a service system name running on a server corresponding to the machine room.

5. The method for multi-machine-room intranet communication across public networks according to claim 1, wherein before the step of verifying the request data based on a preset machine room information set when receiving the request data corresponding to the request data sent by the target machine room, the method further comprises:

receiving registration information sent by a target machine room based on SSH, wherein the registration information comprises basic machine room information of the target machine room, machine room ID number and machine room authority policy for realizing zero-trust communication;

and carrying out registration processing on the target machine room based on the registration information, and storing the registration information into a preset machine room information set.

6. The method for multi-machine-room intranet communication across a public network of claim 5, further comprising, after said step of verifying:

sending a proxy server address list to the target machine room so that the target machine room screens out other machine rooms as new central machine rooms based on the proxy server address list;

and executing the step of receiving the registration information sent by the target machine room based on the SSH based on the new central machine room.

7. The method for multi-machine-room intranet communication across public networks according to claim 1, further comprising, after the step of verifying the request data based on the preset machine room information set:

if the verification fails, the connection is refused.

8. The utility model provides a stride many rooms intranet communication device of public network which characterized in that, the device includes central computer lab, it is used for:

when receiving request data corresponding to a target machine room, verifying the request data based on a preset machine room information set;

if verification is successful, a secure file transfer protocol (SSH) network tunnel is created, and a mapping relation between a socket of the target machine room and a socket of a target proxy server corresponding to the central machine room is built, so that other servers in the central machine room can realize communication with the target machine room through the SSH network tunnel based on the mapping relation and the socket of the target proxy server.

9. A cross-public-network multi-machine-room intranet communication device, comprising: a memory and a processor, the memory storing at least one instruction that is loaded and executed by the processor to implement the cross-public-network multi-machine-room intranet communication method of any one of claims 1-7.

10. A computer-readable storage medium, characterized by: the computer readable storage medium stores a computer program which, when executed by a processor, implements the multi-machine-room intranet communication method of any one of claims 1 to 7 across a public network.

Images