CN115811432A - Terminal remote access method, device and medium based on TCP message agent - Google Patents

Abstract

The invention provides a terminal remote access method based on a TCP message agent, which comprises the following steps: configuring the remote access authority of the terminal equipment; establishing long connection and reporting equipment information; after receiving the equipment information, the cloud server initiates an access information acquisition request to a remote configuration server; after receiving the access information, the remote configuration server generates and sends the access information; the cloud server transmits the access information and the remote access instruction to the terminal equipment; after receiving the access information, the terminal equipment executes a command for starting a TCP proxy function according to the access information and establishes a TCP channel between the terminal equipment and the sshd server; the cloud server accesses the proxy port opened by the sshd server, and proxies the message to the web port of the terminal device through the TCP channel, so that the cloud server indirectly and remotely accesses the web port of the terminal device. The invention also provides the electronic equipment and a computer storage medium, which are convenient for maintenance personnel to remotely maintain the web of the terminal equipment.

Description

Terminal remote access method, device and medium based on TCP message agent

technical field

The invention relates to the technical field of the Internet of Things, in particular to a terminal remote access method, device and medium based on a TCP message agent.

Background technique

The terminal devices of the Internet of Things are generally deployed on the intranet, and directly access the terminal device WEB through the intranet network to configure product functions. This method is suitable for simple configuration. When doing some more complex configurations, professional technicians are needed to guide the configuration. At this time, the technicians either go to the site to configure, which consumes more human resources; or the technicians perform remote configuration, that is, first use The remote desktop is connected to the terminal user's computer desktop, and then connected to the terminal device WEB for configuration. Under this solution, the terminal user needs to build a remote desktop environment to proceed, which is relatively complicated and also exposes the terminal user's computer information.

There are currently two common solutions for configuring the WEB of the internal network terminal device remotely accessed from the external network:

1. The first method is directly through port mapping: in this way, a fixed external network IP is required for stable external network access, which is generally not available for normal users.

2. The second method is to use the tcp message proxy method: most of this method needs to be realized by the manufacturer through self-development.

①The entire self-developed solution has a long development cycle, high implementation costs, and is not universal. Self-developed solutions For some companies with relatively weak R&D technology, there is no way to quickly realize the function of this remote device WEB, and there is no way to implement this remote device WEB solution in the form of tcp proxy into the product, thus degrading to directly through a fixed external device. The implementation of network mapping ports leads to increased maintenance costs and poor user experience.

②Most of this self-developed method does not take into account the security issues of transmission when the terminal device and the cloud platform perform remote access, which leads to the risk of data interception when performing remote access to the terminal device for maintenance.

③ Most of the solutions implement the tcp proxy server through self-development, and also implement account authentication for the tcp proxy client, but they do not consider the security of the tcp proxy server well, and directly use a fixed account password for verification. If the account password is leaked on the device side, the tcp proxy server will be at risk.

Therefore, a terminal remote WEB access method is needed, which not only needs to realize the tcp proxy function, but also needs to realize the function of tcp proxy service authentication for safety.

Contents of the invention

In order to solve the above problems, the present invention provides a terminal remote access method based on TCP message proxy, which only requires the terminal user to authorize on the device, and the maintenance personnel can directly enter the terminal device WEB for maintenance. The pain points of network IP.

The present invention is realized through the following technical solutions: the present invention provides a terminal remote access method based on a TCP message agent, and the method includes the following steps:

Step 1. Configure the remote access authority of the terminal device;

Step 2, establishing a long connection between the terminal device and the cloud server, and reporting the device information to the cloud server;

Step 3. After receiving the device information, the cloud server initiates an access information acquisition request to the remote configuration server;

Step 4. After the remote configuration server receives the access information acquisition request, it generates the required access information and sends it to the cloud server;

Step 5, the cloud server sends the access information and the remote access instruction to the terminal device;

Step 6, after the terminal device receives the remote access instruction, execute the command to start the TCP proxy function according to the access information, set up the TCP channel between the terminal device and the sshd service end and open the proxy port of the sshd service end;

Step 7, the cloud server accesses the open proxy port of the sshd server, and the proxy port of the sshd server proxies the message to the web port of the terminal device through the TCP channel, so that the cloud server remotely accesses the web port of the terminal device indirectly.

Further, the step 2 is specifically:

The terminal device establishes a persistent connection with the cloud server through the TCP persistent connection server, and reports the device information to the cloud server through the TCP persistent connection server.

Further, the step 4 specifically includes:

Step 41, after the remote configuration server receives the access information acquisition request, it randomly generates the account number, password and proxy port information required to establish a TCP message proxy, and records them in the database;

Step 42, described remote configuration server generates url information according to agent port information and configured sshd address when remote configuration server starts;

Step 43, the remote configuration server returns the account number, password, agent port information, sshd address and url information to the cloud server.

Further, the step 5 specifically includes:

Step 51, after the cloud server receives it, forward the account number, password, proxy port information and sshd address to the TCP persistent connection server;

Step 52: After receiving the TCP persistent connection server, send the account number, password, agent port information, sshd address and remote access command to the terminal device.

Further, the step 6 specifically includes:

Step 61. After receiving the remote access instruction, the terminal device initiates a command to start the TCP proxy function;

Step 62, the sshd server finds the corresponding sshd server according to the sshd address;

Step 63. The sshd server verifies whether the account number and password sent by the terminal device are legal by comparing the account number and password recorded in the database with the account number and password sent by the terminal device. If the verification passes, it means that the terminal device The account and password sent are legal, complete the establishment of the TCP channel between the ssh client of the terminal device and the sshd port of the sshd server, and proceed to step 64; if the verification fails, it means that the account and password sent by the terminal device is illegal;

Step 64, the sshd server opens the message proxy function of the corresponding proxy port according to the proxy port information;

Step 65: Mark the corresponding account number, password and proxy port information in the database as used, and then do not allow verification through the account number, password and proxy port information.

Further, the step 7 specifically includes:

Step 71, the cloud server accesses the proxy port of the sshd service end through the url information;

Step 72, the cloud server sends a maintenance message to the proxy port of the sshd server;

Step 73, after the agent port of the sshd server receives the maintenance message, it transmits to the sshd port of the sshd server, and sends it to the established TCP channel by the sshd port of the sshd server, and then sends it to Corresponding to the ssh client of the terminal device, the ssh client of the terminal device is then transmitted to the web port of the terminal device, so that the cloud server can indirectly access and maintain the web port of the terminal device.

Further, the remote configuration server regularly clears the information of the account number, password and proxy port identified as used in the database.

Further, the device information includes a MAC address.

The present invention also provides an electronic device, including a memory, a processor, and a computer program stored on the memory and operable on the processor. When the processor executes the program, the terminal based on the TCP message agent as described above is realized Remote access method.

The present invention also provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the above-mentioned terminal remote access method based on a TCP message agent is realized.

The beneficial effects of the present invention are:

① The present invention is based on the tcp proxy method to realize the remote access of the cloud server to the web port of the terminal device, without going to the site for maintenance, which is convenient for the operation and maintenance personnel to maintain remotely, with low maintenance cost and good user experience.

②The TCP persistent connection server is used to establish a persistent connection between the terminal device and the cloud server. The data transmission process also needs to be carried out through the TCP persistent connection server. The deployed TCP persistent connection server can realize the control of the cloud server on the web port of the remote access terminal device. Ensure the security of transmission during remote access and avoid the risk of data being intercepted.

③When establishing a TCP message proxy, use a randomly generated account password for verification. After the verification is successful, directly mark the corresponding account and password as used to ensure the security of the TCP message proxy and avoid the risk of the TCP message proxy service.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present invention more clearly, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention, and therefore do not It should be regarded as a limitation on the scope, and those skilled in the art can also obtain other related drawings based on these drawings without creative work.

FIG. 1 is a flow chart of a method for remotely accessing a terminal based on a TCP message agent provided by an embodiment of the present invention.

Fig. 2 is a schematic diagram of establishing a TCP channel between a terminal device and a shhd server according to an embodiment of the present invention.

Fig. 3 is a schematic diagram of an electronic device provided by an embodiment of the present invention.

Fig. 4 is a schematic diagram of a computer-readable storage medium provided by an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments It is some embodiments of the present invention, but not all of them. Based on the implementation manners in the present invention, all other implementation manners obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention. Accordingly, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the invention. Based on the implementation manners in the present invention, all other implementation manners obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

As shown in Figure 1, the embodiment of the present invention provides a terminal remote access method based on a TCP message agent, and the method includes the following steps:

Step 1. Configure the remote access authority of the terminal device;

In this embodiment, the terminal user logs in the web page of the terminal device, configures the remote access authority of the terminal device, and allows the operation and maintenance personnel to remotely access the web port of the terminal device.

Step 2, establishing a long connection between the terminal device and the cloud server, and reporting the device information to the cloud server;

In this embodiment, the step 2 is specifically:

The terminal device establishes a persistent connection with the cloud server through the TCP persistent connection server, and reports the device information to the cloud server through the TCP persistent connection server. The device information includes a MAC address, which is literally translated as a media access control address, also called a LAN address (LAN Address), which is a unique network identifier of a terminal device in a network. The TCP persistent connection server is used to establish a persistent connection between the terminal device and the cloud server, and the data transmission process also needs to be carried out through the TCP persistent connection server. The deployed TCP persistent connection server can realize the control of the cloud server on the web port of the remote access terminal device, ensuring Transmission security issues during remote access to avoid the risk of data being intercepted.

Step 3. After the cloud server receives the device information, it finds the corresponding device according to the device information. The operation and maintenance personnel initiates a remote configuration request to the cloud server according to the device information on the webpage of the cloud server. The remote configuration server initiates an access information acquisition request; in this embodiment, the operation and maintenance personnel log in to the webpage of the cloud server, find the corresponding terminal device according to the MAC address, and initiate an access information acquisition request.

Step 4, after the remote configuration server receives the access information acquisition request, it generates the access information required for the web port of the remote access terminal device and sends it to the cloud server;

In this embodiment, step 4 specifically includes:

Step 41, after the remote configuration server receives the access information acquisition request, it randomly generates the account number, password and agent port information required to establish a TCP message agent, and records them in the database, so as to facilitate the account number and password later. Verification, and can ensure that the generated account, password and proxy port information are unused;

Step 42, described remote configuration server generates url information according to agent port information and configured sshd address when remote configuration server starts;

Step 43, the remote configuration server returns the account number, password, agent port information, sshd address and url information to the cloud server. in:

1) Account and password: used for authentication information when the terminal device initiates the TCP message proxy function to the sshd server;

2) Proxy port information: It is used to facilitate the sshd server to open the corresponding proxy port, which is used to proxy the message to the intranet web port of the terminal device after the TCP message proxy is established successfully;

3) sshd address: configured when the remote configuration server is started, it is the address of the sshd server that provides the TCP message proxy service function, which sshd server to use for TCP message proxy;

4) ur l information: when the TCP message agent is established, it is used to indirectly access the address of the web port of the terminal device. The format is: http://sshd address: proxy port address

Step 5, the cloud server sends the access information and the remote access instruction to the terminal device;

In this embodiment, step 5 specifically includes:

Step 51, after the cloud server receives it, forward the account number, password, proxy port information and sshd address to the TCP persistent connection server;

Step 52: After receiving the TCP persistent connection server, the account number, password, proxy port information and sshd address are encapsulated, and then issued to the terminal device together with the remote access command.

At this time, the cloud server has obtained the url information, opens a new browser page according to the url information, waits for the TCP message agent to be successfully established by polling, and performs remote access and maintenance of the web port of the terminal device.

Step 6, after the terminal device receives the remote access instruction, execute the command to start the TCP proxy function according to the access information, set up the TCP channel between the terminal device and the sshd service end and open the proxy port of the sshd service end, that is, complete the TCP message proxy Establish;

In this embodiment, step 6 specifically includes:

Step 61. After receiving the remote access instruction, the terminal device initiates a command to start the TCP proxy function;

Step 62, the sshd server finds the corresponding sshd server according to the sshd address;

Step 63. The sshd server verifies whether the account number and password sent by the terminal device are legal by comparing the account number and password recorded in the database with the account number and password sent by the terminal device. If the verification passes, it means that the terminal device The account and password sent are legal, complete the establishment of the TCP channel between the ssh client of the terminal device and the sshd port of the sshd server, and proceed to step 64; if the verification fails, it means that the account and password sent by the terminal device is illegal;

Step 64, the sshd server opens the message proxy function of the corresponding proxy port according to the proxy port information;

Step 65: Mark the corresponding account number, password and proxy port information in the database as used, and then do not allow verification through the account number, password and proxy port information. The account and password are randomly generated and can only be used once to prevent the account and password from leaking, causing the TCP message proxy service on the sshd server to provide TCP message proxy services for functional services that do not belong to us.

The remote configuration server regularly clears the used account number, password and proxy port information in the database.

Generally, when the ssh client connects to the sshd port, there are two methods for authentication: one is based on the account and password interaction method, which requires manual input of the account and password. The other is the key method. The client generates a pair of keys, and copies the public key to the server, and then directly uses the key for authentication. Obviously, the first method requires interactive input of account passwords, which cannot meet actual needs. The second method also has problems in engineering practice. There are as many certificates as there are terminal devices on the server side, and this long-term effective authentication method has hidden dangers to the security of the server. The present invention optimizes the first method, adding a new command line parameter -z carrying a password to remove the interactive mode. The command to execute the TCP proxy function is as follows:

ssh-v-z$Password-fCNR$ProxyPort:l oca l host:$Loca lWebPort$Account@$Sshd I P

in:

$Password is the password for sshd verification issued by the TCP long-connection server

$ProxyPort is the sshd proxy port information issued by the TCP long-connection server

$Loca lWebPort is the web port of the terminal device

$Account is the account verified by sshd issued by the TCP long-connection server

$Sshd IP is the sshd address issued by the TCP long-connection server

Step 7, the cloud server accesses the open proxy port of the sshd server, and the proxy port of the sshd server proxies the message to the web port of the terminal device through the TCP channel, so that the cloud server remotely accesses the web port of the terminal device indirectly.

In this embodiment, step 7 specifically includes:

Step 71, the cloud server accesses the proxy port of the sshd service end through the url information;

Step 72, the cloud server sends a maintenance message to the proxy port of the sshd server;

Step 73, after the agent port of the sshd server receives the maintenance message, it transmits to the sshd port of the sshd server, and sends it to the established TCP channel by the sshd port of the sshd server, and then sends it to Corresponding to the ssh client of the terminal device, the ssh client of the terminal device is then transmitted to the web port of the terminal device, so that the cloud server can indirectly access and maintain the web port of the terminal device.

As shown in Figure 2, when the ssh client connects to the sshd port, a TCP channel will be established to support two-way communication. On the sshd server: When the ssh client connects to the sshd port, let the sshd server open a proxy port, proxy the message sent to the proxy port to the established TCP channel, and then transmit it to the terminal device; on the terminal device: When the ssh client connects to the sshd port, let itself proxy messages received from the TCP channel to the web port. The same is true in the reverse direction. The web port of the terminal device will return data, and it will also return to the proxy port through the TCP channel.

The IoT cloud platform terminal device based on ssh tcp message agent remotely accesses the WEB by: cloud server, TCP long connection server, RemoteConf i g (remote configuration) server, sshd server, terminal device integrated with ssh client. The working principle of each component is as follows:

1. Cloud server: As the operation entrance of the operation and maintenance personnel, it is connected with the RemoteConfig server and the TCP persistent connection server. Receive the service request for remote access to the web of the specified terminal device from the operation and maintenance personnel, and open a new browser page to remotely access the web of the terminal device according to the url information returned by the remote configuration server.

2. RemoteConfig server: connect with the cloud server. When it is necessary to remotely access the web port of the terminal device, it receives the request from the cloud server, and randomly generates the account number, password, proxy port information, sshd address of the non-repeated tcp proxy, and the url information of the later indirect access to the web port of the terminal device and return to the cloud server. And be responsible for regularly cleaning up the used account, password and proxy port information.

3. TCP persistent connection service: connect with cloud server and terminal equipment, receive requests from cloud server, and control terminal equipment to connect to sshd server for TCP message proxy function. Receive the sshd address, account number, password, and proxy port information required for remote access to the web of the terminal device, and then encapsulate these information and send remote access instructions to the terminal device. After receiving the remote access web instruction, the terminal device uses the ssh client to connect to the sshd port and open it TCP message broker function.

4. The sshd server: The open-source sshd has been modified, and the ssh client request of the terminal device is used for TCP message proxy, so as to realize the function of the TCP message proxy of the sshd server.

5. Terminal device: The terminal device uses the ssh client to connect to the sshd port according to the instructions of the TCP persistent connection server to enable the TCP message proxy function for the terminal device. In actual use, the terminal device interacts with the TCP persistent connection server to respond to the remote access web control operation of the operation and maintenance. The modified open source sshd server is used to receive control signaling from the TCP long-connection server, and connect to sshd to realize the TCP proxy function.

As shown in FIG. 3, an embodiment of the present invention also provides an electronic device, including a memory, a processor, and a computer program stored on the memory and operable on the processor. When the processor executes the program, the above-mentioned A terminal remote access method based on a TCP message agent.

As shown in FIG. 4 , an embodiment of the present invention also provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the above-mentioned terminal remote access method based on a TCP message agent is implemented.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (10)

1. based on the terminal remote access method of TCP message agent, it is characterized in that, described method comprises the steps: Step 1. Configure the remote access authority of the terminal device; Step 2, establishing a long connection between the terminal device and the cloud server, and reporting the device information to the cloud server; Step 3. After receiving the device information, the cloud server initiates an access information acquisition request to the remote configuration server; Step 4. After the remote configuration server receives the access information acquisition request, it generates the required access information and sends it to the cloud server; Step 5, the cloud server sends the access information and the remote access instruction to the terminal device; Step 6, after the terminal device receives the remote access instruction, execute the command to start the TCP proxy function according to the access information, set up the TCP channel between the terminal device and the sshd service end and open the proxy port of the sshd service end; Step 7, the cloud server accesses the open proxy port of the sshd server, and the proxy port of the sshd server proxies the message to the web port of the terminal device through the TCP channel, so that the cloud server remotely accesses the web port of the terminal device indirectly. 2. the terminal remote access method based on TCP message agent according to claim 1, is characterized in that, described step 2 is specifically: The terminal device establishes a persistent connection with the cloud server through the TCP persistent connection server, and reports the device information to the cloud server through the TCP persistent connection server. 3. the terminal remote access method based on TCP message agent according to claim 2, is characterized in that, described step 4 specifically comprises: Step 41, after the remote configuration server receives the access information acquisition request, it randomly generates the account number, password and proxy port information required to establish a TCP message proxy, and records them in the database; Step 42, the remote configuration server generates url information according to the agent port information and the configured sshd address when the remote configuration server starts; Step 43, the remote configuration server returns the account number, password, agent port information, sshd address and url information to the cloud server. 4. the terminal remote access method based on TCP message agent according to claim 3, is characterized in that, described step 5 specifically comprises: Step 51, after the cloud server receives it, forward the account number, password, proxy port information and sshd address to the TCP persistent connection server; Step 52: After receiving the TCP persistent connection server, send the account number, password, agent port information, sshd address and remote access command to the terminal device. 5. the terminal remote access method based on TCP message agent according to claim 4, is characterized in that, described step 6 specifically comprises: Step 61. After receiving the remote access instruction, the terminal device initiates a command to start the TCP proxy function; Step 62, the sshd server finds the corresponding sshd server according to the sshd address; Step 63. The sshd server verifies whether the account number and password sent by the terminal device are legal by comparing the account number and password recorded in the database with the account number and password sent by the terminal device. If the verification passes, it means that the terminal device The account and password sent are legal, complete the establishment of the TCP channel between the ssh client of the terminal device and the sshd port of the sshd server, and proceed to step 64; if the verification fails, it means that the account and password sent by the terminal device is illegal; Step 64, the sshd server opens the message proxy function of the corresponding proxy port according to the proxy port information; Step 65: Mark the corresponding account number, password and proxy port information in the database as used, and then do not allow verification through the account number, password and proxy port information. 6. the terminal remote access method based on TCP message agent according to claim 5, is characterized in that, described step 7 specifically comprises: Step 71, the cloud server accesses the proxy port of the sshd server through the url information; Step 72, the cloud server sends a maintenance message to the proxy port of the sshd server; Step 73, after the agent port of the sshd server receives the maintenance message, it transmits to the sshd port of the sshd server, and sends it to the established TCP channel by the sshd port of the sshd server, and then sends it to Corresponding to the ssh client of the terminal device, the ssh client of the terminal device is then transmitted to the web port of the terminal device, so that the cloud server can indirectly access and maintain the web port of the terminal device. 7. The terminal remote access method based on TCP message proxy according to claim 1, wherein the remote configuration server regularly cleans up the used account number, password and proxy port information in the database. 8. The terminal remote access method based on TCP message agent according to claim 1, characterized in that the device information includes a MAC address. 9. An electronic device comprising a memory, a processor, and a computer program stored on the memory and operable on the processor, wherein the processor implements any of claims 1 to 8 when executing the program. The terminal remote access method based on TCP message agent described in item. 10. A computer-readable storage medium, on which a computer program is stored, characterized in that, when the program is executed by a processor, the method for remotely accessing a terminal based on a TCP message agent according to any one of claims 1 to 8 is realized .

Images