CN108616490B - Network access control method, device and system - Google Patents

Abstract

An embodiment of the present invention provides a network access control system, including: a client, a network control device, a proxy server, and a service server, wherein the client sends a network access request to the network control device, and the network control device determines whether the target address information belongs to If it belongs to the first white list, the network control device sends the network access request to the proxy server corresponding to the target address information. The proxy server determines whether the address information of the service server to be accessed belongs to the second white list, and if so, the proxy server sends a network access request to the service server to be accessed. It can be seen that the network access method provided by the present invention only needs to set the address information and port of the proxy server used at the network control device, and then set the address information and port of the service server that allows access at the proxy server, which simplifies the enterprise network management personnel. Configuration of network control devices.

Description

A network access control method, device and system

technical field

The present invention relates to the technical field of data processing, in particular to a network access control method, device and system.

Background technique

With the continuous development of science and technology, users' access needs to the network are becoming more and more common. However, enterprises need to control access to the corporate network for some purposes.

For example, corporate employees are prohibited from reading news, online shopping, playing games, etc. online during working hours, thereby improving the work efficiency of corporate employees; another example, corporate employees are prohibited from using the Internet to leak the company's core confidential documents, internal company documents, etc., or prevent External malicious users invade the company's internal network and steal company secrets.

Therefore, as shown in FIG. 1 , the enterprise network administrator A usually controls the access to the enterprise network by setting a black and white list on the network control device 1 (such as a switch, router, firewall, etc.) at the exit of the enterprise network.

The inventor found that the control of enterprise external network access is concentrated at the exit device of the enterprise network. However, the black and white list usually includes various information such as user IP, domain name, and website address. The server is frequently changed due to upgrade or maintenance. Once the network management personnel of the enterprise are not notified in time to reset the parameters of the network control device at the network exit of the enterprise, or the parameters are set incorrectly, the enterprise network cannot be accessed normally. It can be seen that the existing enterprise network control method is relatively troublesome, and requires higher skills for enterprise network administrators.

Therefore, how to provide a network access control method, device and system, which can not only realize the network control of enterprise employees, but also simplify the setting of the enterprise network exit has become a problem to be considered by those skilled in the art.

SUMMARY OF THE INVENTION

In view of this, the embodiments of the present invention provide a network access control method, device and system, which can not only realize network control of enterprise employees, but also simplify the settings at the enterprise network exit.

To achieve the above purpose, the embodiments of the present invention provide the following technical solutions:

A network access control system includes: a client, a network control device, a proxy server and a service server,

The client sends a network access request to the network control device, where the network access request includes: address information of the service server to be accessed and target address information, where the target address information is the address information of the pre-configured proxy server;

The network control device determines whether the target address information belongs to the first whitelist, and if so, the network control device sends the network access request to the proxy server corresponding to the target address information, and the first whitelist The list includes a list of address information of proxy servers that are allowed to be accessed;

The proxy server determines whether the address information of the service server to be accessed belongs to the second white list, and if so, the proxy server sends the network access request to the service server to be accessed, and the second white list The list includes a list of address information of business servers that are allowed to be accessed.

A network access control method, comprising:

receiving a network access request sent by a network control device, where the network access request includes: address information of a service server to be accessed and target address information, where the target address information is the address information of a preconfigured proxy server;

Moreover, the network access request is an access request in which the target address information belongs to a first whitelist, and the first whitelist includes a list of address information of proxy servers that are allowed to be accessed;

Determine whether the address information of the service server to be accessed belongs to the second whitelist, and if so, send the network access request to the service server to be accessed, and the second whitelist includes the service server's address information that is allowed to be accessed. A list of address information.

A network access control device, comprising:

The first receiving module is configured to receive a network access request sent by a network control device, where the network access request includes: address information of a service server to be accessed and target address information, where the target address information is the address of a preconfigured proxy server information;

Moreover, the network access request is an access request in which the target address information belongs to a first whitelist, and the first whitelist includes a list of address information of proxy servers that are allowed to be accessed;

The judgment module is used for judging whether the address information of the service server to be accessed belongs to a second whitelist, and if so, sending the network access request to the service server to be accessed, and the second whitelist includes allowing A list of address information for accessed business servers.

It can be seen that the network access control system provided in this embodiment only needs to set the address information and port of the proxy server used at the network control device, and then set the address information and port of the service server that is allowed to be accessed at the proxy server, which simplifies the enterprise The configuration of network control equipment by network administrators.

Description of drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only It is an embodiment of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to the provided drawings without creative work.

1 is a schematic diagram of an application interface in the prior art;

2 is a structural block diagram of a network access control system provided by an embodiment of the present invention;

3 is a signaling flowchart of a network access control system provided by an embodiment of the present invention;

4 is a signaling flowchart of another network access control system provided by an embodiment of the present invention;

5 is a schematic structural diagram of an apparatus for network access control provided by an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of another network access control apparatus provided by an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of another network access control apparatus provided by an embodiment of the present invention;

FIG. 8 is a schematic structural diagram of another network access control apparatus provided by an embodiment of the present invention;

FIG. 9 is a schematic structural diagram of another network access control apparatus provided by an embodiment of the present invention;

FIG. 10 is a block diagram of a hardware structure of a network access control apparatus according to an embodiment of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

An embodiment of the present invention provides a network access control system, including: a client, a network control device, a proxy server, and a service server, wherein the client sends a network access request to the network control device, and the network control device determines whether the target address information belongs to If it belongs to the first white list, the network control device sends the network access request to the proxy server corresponding to the target address information. The proxy server determines whether the address information of the service server to be accessed belongs to the second white list, and if so, the proxy server sends a network access request to the service server to be accessed. It can be seen that the network access method provided by the present invention only needs to set the address information and port of the proxy server used at the network control device, and then set the address information and port of the service server that allows access at the proxy server, which simplifies the enterprise network management personnel. Configuration of network control devices.

Please refer to FIG. 2. FIG. 2 is a structural block diagram of a network access control system provided by an embodiment of the present invention. The network access control method provided by the embodiment of the present invention can be implemented based on the system shown in FIG. 2. Referring to FIG. 2, the present invention is implemented The network access control system provided by the example may include: a client 2 , a network control device 1 , a proxy server 3 and a service server 4 .

Wherein, the client 2 can be at least one client device used by the enterprise employee B to send service requests, such as laptops, desktops, tablet computers, mobile phones and other devices that can be used by enterprise employees to access the Internet, and the network control device 1 can be located on the enterprise network. Devices at the egress, such as switches, routers, firewall devices, etc. The proxy server may be another server between the network control device 1 and the service server 4 .

Usually, when an enterprise employee browses a web page, the client will access the service server as needed, and then the service server will transmit the information of the destination site to the client after receiving the web page access request for the user to browse.

However, after using a proxy server, when an enterprise employee wants to access some site resources, the client first sends a web page access request to the proxy server, and then the proxy server obtains the information to be accessed and returns it to the client . It should be noted that, on the proxy server side, the user identity can be authenticated and network access control can be implemented.

The business server 4 can be a single server, a server group composed of multiple servers, or a cloud computing service center. The business server 4 is used to download network data resources, such as acquiring game data, software application data (QQ, WeChat, etc.).

Specifically, based on the system shown in FIG. 2 , FIG. 3 shows a signaling flow chart of a network access control system provided by an embodiment of the present invention. The network access control system includes: a client 2 , a network control device 1 , and a proxy server 3 And the service server 4, the signaling interaction process may include:

Step S100, the client sends a network access request to the network control device.

The network access request may include address information of the client, address information of the service server to be accessed, data content to be transmitted, and target address information, where the target address information is the address information of the proxy server. It should be noted that, in this embodiment, when the employee of the enterprise uses the client to access the network, the information of the proxy server to be used needs to be pre-configured. In this way, when the client sends a network access request, the client will preprocess the original network access request, that is, the address information of the client, the address information of the service server to be accessed, and the content of the data to be transmitted contained in the original access request. On the basis, the relevant information of the proxy server is added to the original access request, for example, the address information of the proxy server is added.

Step S101: The network control device determines whether the target address information satisfies a first preset condition, and if so, the network control device sends the network access request to a proxy server corresponding to the target address information.

It should be noted that before the network control device is used, it needs to be configured with a whitelist by the enterprise network administrator. However, the whitelist in this solution is different from the whitelist in the prior art. The whitelist in this solution Just a list of address information for allowed proxy servers. However, the whitelist in the prior art needs to be data such as address information and port information of all service servers that are allowed to be accessed. According to different types of services, there are multiple whitelists that need to be configured on network control devices in the prior art. For example, if an enterprise allows clients to access Tencent Video, QQ, and WeChat, then the whitelists in the prior art It is necessary to record at least the address information and port information of the service server corresponding to Tencent Video, the address information and port information of the service server corresponding to QQ, and the address information and port information of the service server corresponding to WeChat.

Of course, if the enterprise allows more network access services, its network administrator needs to configure the address information of the accessible service servers into the whitelist of the current network control device. Due to the variety of services, enterprise network administrators need to manage and maintain more whitelist data. From the perspective of business service providers, in order to provide better business services, their business servers will be updated and upgraded at any time, and the address information and ports of the corresponding business servers may change. This requires enterprise network managers to control network equipment. Change the address information and port information of the corresponding service server in the whitelist of the server, otherwise the service server cannot be accessed normally.

However, in this embodiment, the network administrator of the enterprise only needs to configure the address information of the proxy server in the whitelist, and then the network control device determines whether the target address information sent by the client is the permission recorded in the whitelist of the network control device. The address information of the accessed proxy server. If yes, the network control device will release the network access request, that is, send the network access request to the proxy server corresponding to the target address information. If the target address information sent by the client does not belong to the address information of the proxy server that is recorded in the whitelist of the network control device, the network control device can directly ignore the network access request, or return a message indicating an access error. response information to the client. Of course, other preset actions can also be performed, and here, settings can be made according to the actual needs of the enterprise.

It is worth mentioning that in this step, when the network control device determines that the target address information sent by the client belongs to the address information of the proxy server that is allowed to be accessed and recorded in the whitelist of the network control device, the network access request needs to be Send to the proxy server corresponding to the target address information. At this time, since the enterprise client sends the network access request to the outside of the enterprise, the address information and port information of the client can be replaced with the address information and port information of the network control device, that is, the IP addresses in the local area network are unified into the enterprise external For example, the IP address of client 2a is "10.168.23.100", the port is "1000", the IP address of client 2b is "10.168.23.99", and the port is "1000", whether it is client 2a or The client 2b, when the target address information in the network access request belongs to the white list, converts the IP address information of the network access request into the IP address information of the network control device. At the same time, a piece of tracking information is recorded for recording the mapping relationship between the client address information and the address information of the network control device.

Step S102: The proxy server determines whether the address information of the service server to be accessed satisfies a second preset condition, and if so, the proxy server sends the network access request to the service server to be accessed.

The proxy server parses the network access request after receiving the network access request. As described above, the network access request on the client side may include: address information of the client, address information of the service server to be accessed, and address information of the service server to be accessed. The transmitted data content and target address information, wherein the target address information is the address information of the proxy server. However, after the network access request has passed through the network control device of the enterprise, the address information of its own client has been converted into the address information of the network control device, that is, the network access request at this time includes: the address information of the network control device, the address information to be The address information of the accessed service server and the data content to be transmitted.

Then, when the proxy server determines that the address information of the service server to be accessed belongs to the address information of the access-allowed service server recorded in the whitelist of the proxy server, it needs to send the network access request to the service server to be accessed. The service server corresponding to the address information.

If the proxy server determines that the address information of the service server to be accessed does not belong to the address information of the access-allowed service server recorded in the proxy server's whitelist, the proxy server can directly ignore the network access request, or return a Response information representing the access error is sent to the network control device, and then the network control device sends the response information to the client.

To sum up, it can be seen that the network access control system provided by this embodiment only needs to set the address information and port of the proxy server used at the network control device, and then set the address information and port of the service server that allows access at the proxy server, It simplifies the configuration of network control equipment by enterprise network managers. The proxy server is configured with a whitelist of address information of the service servers that are allowed to be accessed. When the service server of the SAAS service provider is upgraded and maintained, it is only necessary for the professionals of the SAAS service provider to update and replace the whitelist of the proxy server, ensuring that The timeliness and accuracy of whitelist updates without any action by the enterprise network administrator. When the network control devices of multiple enterprises use the same proxy server, when the address information of a service server changes, it is only necessary to unify the address information corresponding to the service server in the whitelists of different enterprises in the proxy server. Change. For example, the proxy server corresponding to the network control device of enterprise A is proxy server A, and the proxy server corresponding to the network control device of enterprise B is also proxy server A. The whitelist that enterprise A needs to maintain includes QQ and WeChat, and the whitelist that enterprise B needs to maintain The whitelist includes QQ and Tencent Video, then when the service server corresponding to QQ is upgraded to replace the address information, the proxy server can change the address of the service server corresponding to QQ without any operation by the enterprise network administrator. If there is technology, the network administrator of enterprise A needs to replace the address information of the QQ service server in the whitelist of the network control device. It is more complicated to replace the address information of the service server.

In another embodiment of the present application, a data feedback process of the network access system is introduced. Referring to Figure 4, the signaling interaction process includes:

Step S103: The service server to be accessed generates feedback data based on the content of the data to be transmitted, and sends the feedback data to the proxy server.

Step S104, the proxy server searches the address information of the network control device corresponding to the address information of the proxy server according to the second mapping table; and sends the feedback data to the network control device that has been found. The address information corresponding to the network control device.

Step S105, the network control device searches the address information of the client corresponding to the address information of the network control device according to the first mapping table; and sends the feedback data to the found address corresponding to the client Information corresponding to the client.

It should be noted that in the process of data feedback, it can be understood as returning along the original path. In the process of network access, the network control device and the proxy server have whitelisted the received address information. Therefore, when the data is returned, it is no longer necessary to repeatedly compare whether the current address information is in the whitelist. address information. Finally send the feedback data to the client.

Specifically, this embodiment provides an example of using the network access control system provided by the present invention for detailed introduction. For example, if the network control device is a switch, it is assumed that:

a. The address of the client in the internal network of the enterprise is "10.168.23.100", the port: 1000;

b. The egress network address of the enterprise network is "183.61.38.179" and port 1001;

c. The network address of the SAAS service proxy server is: 180.149.32.47, the port is: 8080; SOCKSV5 is supported, and account verification is not required;

d. The network address of SAAS service server 1 is: 140.205.94.189, and the port is: 443;

The domain name of e.SAAS service server 2 is: b.qq.com, and the port is: 80

Based on the above address information, the network access process is as follows:

1. The whitelist of network access configured by SAAS service providers on the proxy server is similar to the following:

Target server whitelist:

ip: 140.205.94.189, port: 443;

Domain name: b.qq.com, port: 80;

The specific form can be based on the configuration standard of the actual proxy server. The meaning of the above configuration is that when the destination address of the data packet is one of the whitelists, it is a legal data packet.

2. The enterprise administrator enters the management page of the enterprise's enterprise switch and configures the whitelist as follows:

Target server whitelist:

ip: 180.149.132.47, port: 8080;

3. The company employees set up the proxy server on the SAAS application client, and configure the proxy server, similar to the following:

Network settings:

Type: SOCKS V5 Address: 180.149.32.47 Port 8080.

4. The client needs to send the content "Hello" to the SAAS service server 1 (140.205.94.189:443). The original data packet will contain the following information (source address 10.168.23.100, port 1000, destination address 140.205.94.189, port 443, and the content of the packet "Hello"). Because the configuration of the proxy service is used, all data packets on the client will be encapsulated on the original data packets, plus the relevant information of the proxy server (including the target address 180.149.32.47, port: 8080, proxy protocol version information Wait). New packets are instead sent to the proxy server's network address (180.149.32.47:8080).

5. The switch judges the destination address of the above new data packet, because the destination network address is (180.149.32.47:8080), which has been configured in the whitelist, so the data packet is considered to be a legitimate data packet and is allowed to pass. Because the data is sent from the inside of the enterprise network to the outside, the NAT address translation process is required: the source port number (1000) and the source private IP address (10.168.23.100) in the data packet are converted into the switch's own port number ( 1001) and the IP address of the public network (183.61.38.179), then send the data packet to the destination host of the external network (180.149.32.47:8080), and record a trace information in the address translation mapping table (10.168.23.100:1000 --183.61.38.179:1001). Among them, the new source address is legal and unique on the Internet, and can be located correctly.

6. After the proxy server receives the data request, it will parse out the real packet body data in the packet, including (replaced new source address 183.61.38.179, new port 1001, destination address 140.205.94.189, port 443, and packet text) content "Hello"). Because the destination address and port combination (140.205.94.189:443) is in the whitelist, it will be judged as a legitimate data packet and can be forwarded to the destination address normally. The proxy server will replace the source address in the packet with 180.149.32.47, the port with 1002, and record the mapping relationship (183.61.38.179:1001--180.149.32.47:1002). In the new data packet, the sender information of the packet is completely replaced by the proxy server.

7. When the business server of the SAAS service processes the above data, it needs to return the data "Reply" to the client, and will organize the relevant data packets, including the following content (source address 140.205.94.189, port 443, destination address is the proxy server address 180.149. 32.47, port 8080, and the package text "Reply").

8. After the proxy server receives the above data returned by the business server, it will find the actual target network address according to the mapping relationship maintained internally, and replace the target address (ie the proxy server address) in the data packet with the actual target address information, i.e. use (183.61.38.179:1001). Then perform a layer of encapsulation on the data returned by the server, add the information of the proxy server, including (source address: 180.149.32.47, port 8080, proxy protocol version information, etc.) and send the data to the target network address, that is, the enterprise's network address. Outgoing ip address.

9. The above-mentioned data packets returned by the proxy server will pass through the switch, and the switch will determine the source address of the data packets. Because the source address is the proxy server address, it will be released. Similarly, this step also requires NAT address translation. According to the records in the mapping table, the port number (1001) and public IP address (183.61.38.179) of the received data packet are converted into the port number (1000) of the target host. ) and the private IP address (10.168.23.100) of the target host in the internal network, and forward to the target host.

10. After the client receives the data packet, it will parse out the real data packet content, mainly including (source address 140.205.94.189, port 443, and the content of the packet text "Reply"), thereby receiving the data returned by SAAS service server 1 .

The above describes the situation where the client accesses the allowed network address information. Now, combined with specific examples, a case where the client is accessing the non-allowed network address information is introduced, as follows:

It is assumed that the whitelist configuration of steps 1 and 2 in case 1 has been completed.

1. Company employees set up a proxy server on a disabled client such as Sina Weibo, and configure a proxy server, similar to the following:

Type: SOCKS V5 Address: 180.149.32.47 Port 8080.

2. The client needs to send the content "Hello" to Sina Weibo service server 1 (100.100.10.10:443). The original data packet will contain the following information (source address 10.168.23.100, port 8000, destination address 100.100.10.10, port 443, and the content of the packet "Hello"). Because the configuration of the proxy service is used, all data packets on the client will be encapsulated on the original data packets, plus the relevant information of the proxy server (including the target address 180.149.32.47, port: 8080, proxy protocol version information Wait). New packets are instead sent to the proxy server's network address (180.149.32.47:8080).

3. Similar to case 1, the switch will consider the request destination address to be legal and will forward it normally.

4. After the proxy server receives the data request, it will resolve the actual target address 100.100.10.10 and port 443. Because the destination address and port combination (100.100.10.10:443) is not in the whitelist, the packet is judged as an illegal packet and will be discarded directly.

5. The client cannot receive the reply packets from Sina Weibo normally, so the network application is successfully restricted.

Another example:

It is assumed that the whitelist configuration of steps 1 and 2 in case 1 has been completed.

1. Company employees want to use a disabled client such as a browser, but no proxy server is set.

2. Employees use a browser to access http://www.taobao.com.

3. The switch determines that the destination address (www.taobao.com) has not been configured in the whitelist, and determines that the requested destination address is illegal, and will directly discard it.

4. The client cannot receive Taobao's return packets normally, so the network application is successfully restricted.

The following describes the network access control apparatus provided by the embodiments of the present invention. The network access control apparatus described below may refer to the network access control system described above in correspondence with each other.

FIG. 5 is a structural block diagram of an apparatus for network access control provided by an embodiment of the present invention. Referring to FIG. 5, the apparatus may include:

The first receiving module 100 is configured to receive a network access request sent by a network control device, where the network access request includes: address information of a service server to be accessed and target address information, where the target address information is the information of a preconfigured proxy server. Address information;

Moreover, the network access request is an access request in which the target address information belongs to a first whitelist, and the first whitelist includes a list of address information of proxy servers that are allowed to be accessed;

The judgment module 200 is used for judging whether the address information of the service server to be accessed belongs to a second whitelist, and if so, sending the network access request to the service server to be accessed, and the second whitelist includes A list of address information for business servers that are allowed to be accessed.

Optionally, as shown in Figure 6, it also includes:

The processing module 300 is configured to replace the address information of the network control device with the target address information, and generate a second mapping table between the address information of the network control device and the target address information.

Optionally, as shown in Figure 7, it also includes:

The sending module 400 is configured to send the data content to be transmitted to the service server to be accessed.

Optionally, as shown in Figure 8, it also includes:

The second receiving module 500 is configured to receive feedback data generated by the service server to be accessed based on the content of the data to be transmitted.

Optionally, as shown in Figure 9, it also includes:

A search module 600, configured to search for the address information of the network control device corresponding to the address information of the proxy server according to the second mapping table;

and sending the feedback data to the found network control device corresponding to the address information of the network control device.

An embodiment of the present invention further provides a network access control device, and the network access control device may include the network access control apparatus described above.

Optionally, FIG. 10 shows a block diagram of the hardware structure of the network access control device. Referring to FIG. 10 , the network access control device may include: a processor 1, a communication interface 2, a memory 3 and a communication bus 4;

The processor 1, the communication interface 2, and the memory 3 complete the communication with each other through the communication bus 4;

Optionally, the communication interface 2 can be an interface of a communication module, such as an interface of a GSM module;

processor 1 for executing programs;

The memory 3 is used to store the program;

A program may include program code including computer operating instructions.

The processor 1 may be a central processing unit CPU, or a specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present invention.

The memory 3 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk memory.

Among them, the program can be specifically used for:

receiving a network access request sent by a network control device, where the network access request includes: address information of a service server to be accessed and target address information, where the target address information is the address information of a preconfigured proxy server;

Moreover, the network access request is an access request in which the target address information belongs to a first whitelist, and the first whitelist includes a list of address information of proxy servers that are allowed to be accessed;

Determine whether the address information of the service server to be accessed belongs to the second whitelist, and if so, send the network access request to the service server to be accessed, and the second whitelist includes the service server's address information that is allowed to be accessed. A list of address information.

To sum up, an embodiment of the present invention provides a network access control system, including: a client, a network control device, a proxy server, and a service server, wherein the client sends a network access request to the network control device, and the network control device determines Whether the target address information belongs to the first whitelist, if so, the network control device sends the network access request to the proxy server corresponding to the target address information. The proxy server determines whether the address information of the service server to be accessed belongs to the second white list, and if so, the proxy server sends a network access request to the service server to be accessed. It can be seen that the network access method provided by the present invention only needs to set the address information and port of the proxy server used at the network control device, and then set the address information and port of the service server that allows access at the proxy server, which simplifies the enterprise network management personnel. Configuration of network control devices.

The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same and similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant part can be referred to the description of the method.

Professionals may further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two, in order to clearly illustrate the possibilities of hardware and software. Interchangeability, the above description has generally described the components and steps of each example in terms of function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of the present invention.

The steps of a method or algorithm described in conjunction with the embodiments disclosed herein may be directly implemented in hardware, a software module executed by a processor, or a combination of the two. A software module can be placed in random access memory (RAM), internal memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other in the technical field. in any other known form of storage medium.

The above description of the disclosed embodiments enables any person skilled in the art to make or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Thus, the present invention is not intended to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims (18)

1. a network access control system is characterized in that, comprising: client, network control device, proxy server and service server, The client is used to send a network access request to the network control device, where the network access request includes: address information of the service server to be accessed and target address information, where the target address information is the address information of the pre-configured proxy server ; The network control device is used to determine whether the target address information belongs to the first whitelist, and if so, the network control device converts the IP address information of the network access request into the IP address information of the network control device, and converts the target address information into the IP address information of the network control device. The network access request converted from the IP address information is sent to the proxy server corresponding to the target address information, and the first whitelist includes a list of address information of the proxy servers that are allowed to access; The proxy server is used to determine whether the address information of the service server to be accessed belongs to the second whitelist, and if so, the proxy server sends the network access request to the service server to be accessed, and the proxy server sends the network access request to the service server to be accessed. The second whitelist includes a list of address information of service servers that are allowed to be accessed. 2. The network access control system according to claim 1, wherein the network access request further comprises: address information of the client, After judging that the target address information belongs to the first white list, the network control device is further configured to: replace the address information of the client with the address information of the network control device, and generate the address information of the client and the address information of the client. A first mapping table of address information of the network control device. 3. The network access control system according to claim 2, wherein after judging that the address information of the service server to be accessed belongs to the second white list, the proxy server is also used for: The address information of the network control device is replaced with the target address information, and a second mapping table between the address information of the network control device and the target address information is generated. 4. The network access control system according to claim 3, wherein the network access request further comprises: data content to be transmitted, Correspondingly, the proxy server sends the network access request to the service server to be accessed, including: The proxy server sends the data content to be transmitted to the service server to be accessed. 5 . The network access control system according to claim 4 , wherein the service server to be accessed generates feedback data based on the content of the data to be transmitted, and sends the feedback data to the agent. 6 . server. 6. The network access control system according to claim 5, wherein the proxy server searches the address information of the network control device corresponding to the address information of the proxy server according to the second mapping table; and sending the feedback data to the found network control device corresponding to the address information of the network control device. 7. The network access control system according to claim 6, wherein the network control device searches the address information of the client corresponding to the address information of the network control device according to the first mapping table; and sending the feedback data to the found client that corresponds to the address information of the client. 8. A network access control method, comprising: After the network control device converts the IP address information of the network access request into the IP address information of the network control device, the network access request after the IP address information conversion sent by the network control device is received, and the network access request includes: the service server to be accessed. address information and target address information, where the target address information is the address information of a preconfigured proxy server; Moreover, the network access request is an access request in which the target address information belongs to a first whitelist, and the first whitelist includes a list of address information of proxy servers that are allowed to be accessed; Determine whether the address information of the service server to be accessed belongs to the second whitelist, and if so, send the network access request to the service server to be accessed, and the second whitelist includes the service server's address information that is allowed to be accessed. A list of address information. 9. The network access control method according to claim 8, wherein after judging that the address information of the service server to be accessed belongs to the second white list, the method further comprises: The address information of the network control device is replaced with the target address information, and a second mapping table between the address information of the network control device and the target address information is generated. 10. The network access control method according to claim 9, wherein the network access request further comprises: data content to be transmitted, Correspondingly, the sending the network access request to the service server to be accessed includes: Send the data content to be transmitted to the service server to be accessed. 11. The network access control method according to claim 10, further comprising: Feedback data generated by the service server to be accessed based on the content of the data to be transmitted is received. 12. The network access control method according to claim 11, further comprising: According to the second mapping table, look up the address information of the network control device corresponding to the address information of the proxy server; and sending the feedback data to the found network control device corresponding to the address information of the network control device. 13. A network access control device, comprising: The first receiving module is configured to receive the network access request after the IP address information converted by the network control device after the IP address information of the network access request is converted into the IP address information of the network control device, and the network access request includes : address information and target address information of the service server to be accessed, where the target address information is the address information of the preconfigured proxy server; Moreover, the network access request is an access request in which the target address information belongs to a first whitelist, and the first whitelist includes a list of address information of proxy servers that are allowed to be accessed; The judgment module is used for judging whether the address information of the service server to be accessed belongs to a second whitelist, and if so, sending the network access request to the service server to be accessed, and the second whitelist includes allowing A list of address information for accessed business servers. 14. The network access control device according to claim 13, further comprising: The processing module is configured to replace the address information of the network control device with the target address information, and generate a second mapping table between the address information of the network control device and the target address information. 15. The network access control device according to claim 14, further comprising: The sending module is configured to send the data content to be transmitted to the service server to be accessed. 16. The network access control device according to claim 15, further comprising: The second receiving module is configured to receive feedback data generated by the service server to be accessed based on the content of the data to be transmitted. 17. The network access control device according to claim 16, further comprising: a search module, configured to search for the address information of the network control device corresponding to the address information of the proxy server according to the second mapping table; and sending the feedback data to the found network control device corresponding to the address information of the network control device. 18. A computer-readable storage medium, characterized in that, a computer-executable program is stored in the computer-readable storage medium, and when the computer-executable program is loaded and executed by a processor, any one of claims 8-12 is realized. A network access control method as described.

Images