CN103179104B - A kind of access method of remote service, system and equipment thereof - Google Patents

Abstract

The invention discloses a remote service access method, system and equipment thereof. The method includes: a first-level control device in the first network receives a remote service request sent by a client, and notifies the remote service request to the outside system, wherein the external system utilizes the remote service request to determine an intranet server for the client; the second-level control device in the second network receives the information of the intranet server sent by the external system, and passes The information of the intranet server establishes a connection with the intranet server; the second-level control device uses the connection to obtain remote services from the intranet server, and returns the remote services to the first level A control device; the first-level control device returns the remote service to the client. The invention improves the security of remote service access.

Description

A remote service access method, system and device thereof

technical field

The present invention relates to the field of communication technology, in particular to a remote service access method, system and equipment thereof.

Background technique

In practical applications, one or more other devices need to be remotely accessed or controlled to get work done. In the prior art, under the Windows operating system, VNC (Virtual Network Computing, virtual network computer) or remote desktop mode can be used to realize remote access or control; under the Unix operating system, SSH (SecureShell, safe shell) or VNC mode can be used to realize remote access or control .

(1) SSH mode, as shown in Figure 1, is a schematic diagram of the workflow between the remote SSH server and the local SSH client, including: the SSH client requests to connect to the SSH server; the SSH server checks whether the SSH client passes the security verification; if After security verification, the SSH server sends the key to the SSH client; the local remote server daemon process of the SSH client sends the key back to the SSH server.

(2) VNC mode, a, screen control principle: VNC makes the screen of the controlled terminal into an image, and transmits it to the control terminal after compression; and after transmitting the control information (such as mouse information) of the control terminal to the controlled terminal, enter the message Queue; the above control process is based on the TCP (Transmission Control Protocol, Transmission Control Protocol)/IP protocol. b. Screen capture method: Use the hook to automatically report the area that needs to be screened or poll a certain area (such as the foreground window); use a certain compression algorithm to compress the screen and send it. c. Transmission mode: it includes RFB protocol (Remote Frame Buffer, remote frame buffer) transmission or X Window System protocol (X protocol) transmission.

(3) Remote desktop mode, when the remote desktop connection function is enabled on a certain device, the device can be controlled at the other end of the network, and the device can be operated in real time through the remote desktop function; for example, through the remote desktop function, network management Employees can control the unit's equipment from the safety of their homes.

In the process of realizing the present invention, the inventor finds that there are at least the following problems in the prior art:

In the VNC mode and the remote desktop mode, based on the TCP/IP protocol, it is necessary to establish a mapping between the external network and the internal network entity, and provide the user with the user name and password of the accessed device (transmitted in clear text on the network), which is cumbersome It is not safe, which brings troubles to users and service providers. In the SSH mode, SSH cannot provide complete online protection for remote access, and cannot block all vulnerabilities on all other ports (including NFS (NetworkFileSystem, network file system) attacks, etc.).

Contents of the invention

Embodiments of the present invention provide a remote service access method, system and equipment thereof, so as to improve the security of remote service access.

In order to achieve the above purpose, an embodiment of the present invention provides a remote service access method, including:

The first-level control device in the first network receives the remote service request sent by the client, and notifies the external system of the remote service request, and the external system uses the remote service request to determine the intranet for the client server;

The second-level control device in the second network receives the information of the internal network server sent by the external system, and establishes a connection with the internal network server through the information of the internal network server;

The second-level control device obtains remote services from the intranet server by using the connection, and returns the remote services to the first-level control device;

The first-level control device returns the remote service to the client.

An embodiment of the present invention provides a remote service access system, including: a first-level control device in the first network and a second-level control device in the second network; wherein:

The first-level control device is configured to receive a remote service request sent by a client, and notify an external system of the remote service request, and the external system uses the remote service request to determine an intranet for the client. server;

and returning the remote service from the second-level control device to the client;

The second-level control device is configured to receive the information of the intranet server sent by the external system, and establish a connection with the intranet server through the information of the intranet server;

And using the connection to obtain remote services from the intranet server, and return the remote services to the first-level control device.

An embodiment of the present invention provides a remote service access device, the device is a first-level control device located in the first network, and the device includes:

The first receiving module is configured to receive the remote service request sent by the client;

The first sending module is configured to notify an external system of the remote service request, and the external system uses the remote service request to determine an intranet server for the client.

The second receiving module is used to receive the remote service obtained from the intranet server returned by the second-level control device in the second network;

The second sending module is configured to return the remote service to the client.

An embodiment of the present invention provides a remote service access device, the device is a second-level control device located in the second network, and the device includes:

The receiving module is used to receive the information of the intranet server sent by the external system;

A processing module, configured to establish a connection with the intranet server through the information of the intranet server, and use the connection to obtain remote services from the intranet server;

A sending module, configured to return the remote service to the first-level control device in the first network.

Compared with the prior art, the embodiment of the present invention has at least the following advantages: by using a two-level control mechanism to protect the intranet server that provides remote services, the client is separated from the intranet server that actually provides services, thereby improving remote access. Security of Service Access.

Description of drawings

In order to illustrate the technical solution of the present invention more clearly, the accompanying drawings that need to be used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. Ordinary technicians can also obtain other drawings based on these drawings on the premise of not paying creative work.

Fig. 1 is a schematic diagram of the workflow between a remote SSH server and a local SSH client in the prior art;

FIG. 2 is a schematic diagram of an application scenario of a remote service access method provided in Embodiment 1 of the present invention;

FIG. 3 is a schematic flowchart of a remote service access method provided in Embodiment 1 of the present invention;

FIG. 4 and FIG. 5 are respectively a schematic diagram of functional modules of the first-level control device and a schematic diagram of functional modules of the second-level control device provided by Embodiment 1 of the present invention;

FIG. 6 is a schematic structural diagram of a remote service access device provided by Embodiment 3 of the present invention;

FIG. 7 is a schematic structural diagram of a remote service access device provided by Embodiment 4 of the present invention.

detailed description

The following will clearly and completely describe the technical solution of the present invention in conjunction with the accompanying drawings of the present invention. Obviously, the described embodiments are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Embodiment one

Embodiment 1 of the present invention provides a method for accessing remote services. Figure 2 is a schematic diagram of the application scenario of the embodiment of the present invention. In the system of the first-level control device in the first network and the second-level control device in the second network of the isolated network; there will be multiple first-level control devices in the resource pool in the first network, and There will be multiple second-level control devices in the resource pool in the second network.

Based on the above application scenario, as shown in Figure 3, the method for accessing the remote service includes the following steps:

In step 301, the client sends a remote service request on the public network, and the remote service request is a service request based on remote control (such as a request for applying for a desktop service).

The content carried in the remote service request includes, but is not limited to: client information (such as the client's IP address, port, etc.), the session (session) identifier corresponding to the remote service request, and description information of resources required by the remote service (such as The configuration required by the intranet server that provides resources), etc.

In the embodiment of the present invention, based on different remote control methods, the client can send remote service requests based on different methods; for example, send remote service requests based on SSH; or send remote service requests based on VNC; or, send remote service requests based on RDP ( RemoteDesktopProtocol, Remote Desktop Protocol) to send remote service requests.

Step 302, the first-level control device in the first network receives the remote service request sent by the client. There may be multiple first-level control devices in the resource pool in the first network, and for a remote service request from a client, a certain first-level control device may receive the remote service request.

It should be noted that before the first-level control device receives the remote service request from the client, the client first needs to send the remote service request to the service receiving system; for example, the remote service request of the client needs to go to the WEB authentication system for authentication, etc. When processing, the client needs to send the remote service request to the WEB authentication system, and the WEB authentication system will authenticate the remote service request of the client (such as judging whether the received remote service request is sent by the intranet client), if If the authentication is passed, it is determined that the remote service request can be sent to the first-level control device; otherwise, it is determined that the remote service request cannot be sent to the first-level control device.

If the remote service request can be sent to the first-level control device, the service receiving system can directly send the remote service request to the first-level control device, or notify the client to send the remote service request to the first-level control device (such as , the WEB authentication system redirects the client's remote service request to the first-level control device).

In the embodiment of the present invention, since the remote service request carries the client information and the session identifier, after receiving the remote service request sent by the client, the first-level control device can directly use the information carried in the remote service request to establish a mapping A relationship table, the mapping relationship table is used to record the corresponding relationship between the session identifier carried in the remote service request and the client information.

Step 303, the first-level control device notifies the external system of the remote service request, and the external system uses the remote service request to determine an intranet server for the client. The functions that can be realized by the external system (that is, various existing information management systems or portals, etc.) include but are not limited to: authentication function, service application process management function, server account password application function, etc.

In the embodiment of the present invention, since the remote service request carries the description information of the resources required by the remote service (such as the configuration required by the intranet server providing the resource), the external system can use the service application process management function to determine the Intranet server. For example, when the configuration required by the intranet server providing resources is memory configuration requirements and CPU configuration requirements, the external system can select a content server that meets the memory configuration and CPU configuration requirements from the intranet servers. Specifically, there will be multiple intranet servers in the intranet to provide related services for the client, and the external system can determine an intranet server for the client through the configuration required by the intranet server that provides resources.

In the embodiment of the present invention, before the first-level control device notifies the remote service request to the external system, the first-level control device may also notify the authentication information of the client and/or the authentication information of the first-level control device to External system; therefore, the external system can authenticate the client and/or the first-level control device through the authentication function and use the authentication information of the client and/or the authentication information of the first-level control device; Afterwards, the external system can notify the first-level control device of the information of passing the authentication, and the first-level control device will notify the external system of the remote service request; after the authentication fails, the external system can notify the The information is notified to the first-level control equipment, and the first-level control equipment discards the remote service request.

In the embodiment of the present invention, when the first-level control device notifies the remote service request to the external system, the first-level control device may also notify the external system of its own description information together with the remote service request. The description information of the level control device includes but not limited to the address information of the first level control device and the link information corresponding to the remote service request.

The processing of the first-level control device will be further described below with reference to the functional module schematic diagram of the first-level control device shown in FIG. 4 . The first-level control device includes: a user session management module, a service management module, a link management and forwarding module; the user session management module is used to maintain the state of the client's remote service request, authentication information and various communication contents and management; the service management module is used to classify and manage all client services, and maintain the correspondence between session identifiers and client information; the link management and forwarding module is used to forward remote service requests.

Specifically, after receiving the remote service request from the client, the user session management module may send the authentication information of the client (carried in the remote service request) and/or the authentication information of the first-level control device (obtainable by itself) Notify the external system; and after the client and/or the first-level control device pass the authentication, the user session management module sends the remote service request to the service management module.

After receiving the remote service request from the user session management module, the service management module uses the information carried in the remote service request to establish a mapping relationship table, and the mapping relationship table is used to record the relationship between the session identifier carried in the remote service request and the client information. The corresponding relationship among them; after the mapping relationship table is established, the service management module sends the remote service request to the link management and forwarding module.

After the link management and forwarding module receives the remote service request from the service management module, it sends the remote service request to the external system, and the external system uses the service application process management function to execute the service application process (ie, determine the intranet server); and The description information of the first-level control device is notified to the external system together with the remote service request, the description information of the first-level control device includes but not limited to the address information of the first-level control device and the link information corresponding to the remote service request.

Step 304, the second-level control device in the second network receives the information of the intranet server (such as the IP address and port of the intranet server, CA certificate information (such as account password, etc.)) sent by the external system. Specifically, after the external system determines the intranet server for the client, it can obtain the information of the intranet server, and send the information of the intranet server to the second-level control device; wherein, in the resource pool in the second network There may be multiple second-level control devices. According to the actual situation, the external system can arbitrarily select a second-level control device to notify the selected second-level control device of the information of the intranet server.

In the embodiment of the present invention, after the external system receives the description information from the first-level control device, the external system also needs to notify the second-level control device of the description information of the first-level control device; based on this, the second-level The control device can receive the information of the intranet server and the description information of the first-level control device sent by the external system. The description information of the first-level control device includes but not limited to the address information of the first-level control device and the corresponding remote service request link information.

Step 305, the second-level control device establishes a connection with the intranet server through the information of the intranet server. Because the information of the intranet server includes the IP address and port of the intranet server, the second-level control device can directly establish a connection with the intranet server through the IP address and port of the intranet server.

Specifically, based on different remote control methods, the second-level control device can establish SSH or VNC or RDP-based connections with the intranet server according to requirements, and maintain these established connections, so that these established connections can be used from the intranet server. Get remote services. Among them, when the client sends a remote service request based on SSH, the second-level control device can establish an SSH connection with the intranet server; when the client sends a remote service request based on VNC, the second-level control device can communicate with the intranet server. The server establishes a VNC connection; when the client sends a remote service request based on RDP, the second-level control device can establish an RDP connection with the intranet server.

It should be noted that, during the process of establishing a connection between the second-level control device and the intranet server, the intranet server may also require the second-level control device to perform authentication. Specifically, before the second-level control device establishes a connection with the intranet server, it can apply to the external system for information such as the account password of the intranet server; Information such as passwords are stored on a certain server of the external network system, so that information such as account passwords can be provided to the second-level control equipment), so the external system can return information such as account passwords corresponding to the internal network server to the second-level control equipment. The second-level control device uses the account password and other information to establish a connection with the intranet server.

The processing of the second-level control device will be further described below with reference to the functional module schematic diagram of the second-level control device shown in FIG. 5 . The second-level control equipment includes: a link service interface module, an authentication module, and a service physical link management module; the link service interface module is used to access, monitor and manage all links; the authentication module uses The account password for dynamically applying for server resources according to the link interface service; the service physical link management module is used to establish a connection with the intranet server.

Specifically, after receiving the information from the intranet server of the external system and the description information of the first-level control device, the link service interface module sends a confirmation request to the service application process management of the external system, and after confirming that the current application is valid After the service application, a request to obtain remote services from the intranet server is sent to the authentication module.

After receiving the request from the link service interface module, the authentication module obtains available resources from the server account password application mechanism of the external system; Obtain a remote service request from an intranet server.

After receiving the request from the authentication and authentication module, the service physical link management module establishes a connection based on SSH or VNC or RDP with the intranet server of the entity as required, and maintains these established connections, so that these established connections can be used Obtain remote services from intranet servers.

It should be noted that the second-level control device shields the information of the intranet server. By default, each intranet server is completely disconnected, and the user only knows that this intranet server can be used, but the specific The details are not known; and after closing the service connection, the client may not necessarily provide services from the previous intranet server when requesting a connection again. If the client needs to continue to access the previous intranet server Session ID to explain who it is, so that the second-level control device can be assigned to the client.

In step 306, the second-level control device uses the established connection to obtain remote services (such as desktop services, etc.) from the intranet server.

In step 307, the second-level control device returns the remote service to the first-level control device.

Specifically, since the second-level control device has previously received the description information of the first-level control device, and the description information of the first-level control device includes but is not limited to the address information of the first-level control device and the link corresponding to the remote service request Therefore, after the second-level control device obtains the remote service, it can directly use the link information corresponding to the remote service request to determine that the remote service needs to be returned to the first-level control device, and further pass the address information of the first-level control device Return the remote service to the first level control device.

Step 308, the first-level control device returns the remote service to the client.

Specifically, since the first-level control device has previously established a mapping relationship table for recording the correspondence between the session identifier carried in the remote service request and the client information, after the first-level control device obtains the remote service, it can Obtain the session identifier corresponding to the remote service (the remote service sent by the second-level control device to the first-level control device may carry the session identifier, which is the same as the session identifier carried in the remote service request), and use the session identifier Query the corresponding relationship recorded in the mapping relationship table to obtain the client information, and return the remote service to the client through the client information.

In summary, the embodiment of the present invention provides a two-level control mechanism (respectively by the first-level control device and the second-level control device to achieve related processing), and the two-level control mechanism can be set and operated independently in a cluster mode; The two-level control mechanism refers to the control mechanism from the external network to the internal network (that is, the processing process between the client and the first-level control device) and the control mechanism for the interconnection of devices between the internal network (that is, the second-level control The processing process between the device and the intranet server); among them, the control mechanism from the external network to the internal network is to map the address of the external network to the internal network address, which is the access channel to enter the internal network; the interconnection of devices between the internal network The control mechanism is to store the account and password of the intranet server that provides the service on a certain server, and the intranet server that provides the service can be directly accessed through the control mechanism of device interconnection between the intranets.

Compared with the prior art, the embodiment of the present invention has at least the following advantages: a two-level protection mechanism is added on the basis of the SSH mode, VNC mode or remote desktop mode; the first level protection mechanism is the control from the external network to the internal network Mechanism, through the first-level protection mechanism, the external network address access request obtains the license to enter the internal network, and can initiate the operation of requesting services to the internal network server in the internal network, so as to verify the reliability of external network visitors and prevent Trojans, hackers and other malicious network attacks; the second-level protection mechanism is the control mechanism for the interconnection of devices between intranets, which can safely protect the intranet servers that provide services, and can increase the speed of access to the intranet servers that provide services. In a busy large system, multiple second-level protection mechanisms can be established in parallel to improve service efficiency.

Further, in the embodiment of the present invention, the remote desktop control is converted into a service and provided to the client (that is, remote access and control are provided to the client as a service), which is convenient and quick; and the user does not need to record the user name and password during the access process and other information, simple and convenient; and a two-level control mechanism is used to protect the intranet servers that provide remote services, shielding the underlying information of these intranet servers (such as real IP addresses, etc.), without informing the client of the underlying information of the intranet server, The intranet server that provides the service is protected to improve security; and the joint processing of the two-level control mechanism can improve efficiency.

Embodiment two

Based on the same inventive concept as the above method, Embodiment 2 of the present invention provides a remote service access system, the system includes a first-level control device in the first network and a second-level control device in the second network; wherein:

The first-level control device is configured to receive a remote service request sent by a client, and notify an external system of the remote service request, and the external system uses the remote service request to determine an intranet for the client. server; and returning the remote service from the second-level control device to the client;

The second-level control device is configured to receive the information of the internal network server sent by the external system, and establish a connection with the internal network server through the information of the internal network server; and use the connection to obtain information from the internal network server The intranet server obtains the remote service, and returns the remote service to the first-level control device.

In the embodiment of the present invention, the first-level control device is further configured to, after receiving the remote service request sent by the client, establish a correspondence between the session identifier carried in the remote service request and the client information relationship; and further used to obtain the session identifier corresponding to the remote service, use the session identifier to query the corresponding relationship to obtain client information, and return the remote service to the client through the client information.

In the embodiment of the present invention, the first-level control device is further configured to notify the external system of the authentication information of the client and/or the authentication information of the first-level control device, and the external system The system uses the authentication information of the client and/or the authentication information of the first-level control device to authenticate the client and/or the first-level control device; The remote service request is notified to the external system.

In the embodiment of the present invention, the first-level control device is further configured to notify the external system of the remote service request and its own description information;

The second-level control device is further configured to receive the information of the intranet server and the description information of the first-level control device sent by the external system.

In the embodiment of the present invention, the description information of the first-level control device includes the address information of the first-level control device and the link information corresponding to the remote service request; the second-level control device is further used to Determining that the remote service needs to be returned to the first-level control device by using the link information corresponding to the remote service request, and returning the remote service to the second-level control device through the address information of the first-level control device Level 1 control equipment.

Embodiment three

Based on the same inventive concept as the above method, Embodiment 3 of the present invention also provides a remote service access device, which is a first-level control device located in the first network, as shown in Figure 6, the first-level Control equipment includes:

The first receiving module 11 is configured to receive a remote service request sent by a client;

The first sending module 12 is configured to notify an external system of the remote service request, and the external system uses the remote service request to determine an intranet server for the client;

The second receiving module 13 is used to receive the remote service obtained from the intranet server returned by the second-level control device in the second network;

The second sending module 14 is configured to return the remote service to the client.

The second sending module 14 is specifically configured to, after receiving the remote service request sent by the client, establish a correspondence between the session identifier carried in the remote service request and client information; and obtain the The session identifier corresponding to the remote service, the session identifier queries the corresponding relationship to obtain client information, and returns the remote service to the client through the client information.

The first sending module 12 is specifically configured to notify the external system of the authentication information of the client and/or the authentication information of the first-level control device, and the external system utilizes the authentication information of the client information and/or the authentication information of the first-level control device to authenticate the client and/or the first-level control device; and after passing the authentication, notify the external system of the remote service request.

The first sending module 12 is specifically configured to notify the external system of the remote service request and its own description information; the description information of the first-level control device includes address information of the first-level control device And the link information corresponding to the remote service request.

Wherein, each module of the device of the present invention can be integrated into one body, or can be deployed separately. The above modules can be combined into one module, or can be further split into multiple sub-modules.

Embodiment four

Based on the same inventive concept as the above method, Embodiment 4 of the present invention provides a remote service access device, which is a second-level control device located in the second network, as shown in Figure 7, the second-level control Equipment includes:

The receiving module 21 is used to receive the information of the intranet server sent by the external system;

A processing module 22, configured to establish a connection with the intranet server through the information of the intranet server, and use the connection to obtain remote services from the intranet server;

The sending module 23 is configured to return the remote service to the first-level control device in the first network.

The receiving module 21 is specifically configured to receive the information of the intranet server and the description information of the first-level control device sent by the external system.

The description information of the first-level control device includes the address information of the first-level control device and the link information corresponding to the remote service request; the sending module 23 is specifically configured to use the link information corresponding to the remote service request The link information determines that the remote service needs to be returned to the first-level control device, and the remote service is returned to the first-level control device through the address information of the first-level control device.

Wherein, each module of the device of the present invention can be integrated into one body, or can be deployed separately. The above modules can be combined into one module, or can be further split into multiple sub-modules.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by means of software plus a necessary general-purpose hardware platform, and of course also by hardware, but in many cases the former is a better implementation Way. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions to make a A computer device (which may be a personal computer, a server, or a network device, etc.) executes the methods described in various embodiments of the present invention.

Those skilled in the art can understand that the drawing is only a schematic diagram of a preferred embodiment, and the modules or processes in the drawing are not necessarily necessary for implementing the present invention.

Those skilled in the art can understand that the modules in the device in the embodiment can be distributed in the device in the embodiment according to the description in the embodiment, or can be located in one or more devices different from the embodiment according to corresponding changes. The modules in the above embodiments can be combined into one module, and can also be further split into multiple sub-modules.

The serial numbers of the above embodiments of the present invention are for description only, and do not represent the advantages and disadvantages of the embodiments.

The above disclosures are only a few specific embodiments of the present invention, however, the present invention is not limited thereto, and any changes conceivable by those skilled in the art shall fall within the protection scope of the present invention.

Claims (17)

1. A method for accessing remote services, comprising: The first-level control device in the first network receives the remote service request sent by the client, and notifies the external system of the remote service request, and the external system uses the remote service request to determine the intranet for the client server; The second-level control device in the second network receives the information of the internal network server sent by the external system, and establishes a connection with the internal network server through the information of the internal network server; The second-level control device obtains remote services from the intranet server by using the connection, and returns the remote services to the first-level control device; The first-level control device returns the remote service to the client. 2. The method according to claim 1, characterized in that, after receiving the remote service request sent by the client, the first-level control device establishes the session identifier carried in the remote service request with the client Correspondence between information; The first-level control device returns the remote service to the client, including: the first-level control device obtains a session identifier corresponding to the remote service, uses the session identifier to query the corresponding relationship to obtain the client end information, and return the remote service to the client through the client information. 3. The method according to claim 1, wherein the first-level control device notifies the remote service request to an external system, comprising: The first-level control device notifies the external system of the authentication information of the client and/or the authentication information of the first-level control device, and the external system utilizes the authentication information of the client and /or the authentication information of the first-level control device authenticates the client and/or the first-level control device; and after passing the authentication, the first-level control device sends the remote The service request is notified to the external system. 4. The method according to claim 1, wherein the first-level control device notifies the remote service request to an external system, comprising: the first-level control device notifies the remote service request and its own The description information of the notification is notified to the external system; The second-level control device receiving the information of the intranet server sent by the external system includes: the second-level control device receiving the information of the intranet server sent by the external system and the first Description information of level control equipment. 5. The method according to claim 4, wherein the description information of the first-level control device includes address information of the first-level control device and link information corresponding to the remote service request; The second-level control device returning the remote service to the first-level control device includes: The second-level control device uses the link information corresponding to the remote service request to determine that the remote service needs to be returned to the first-level control device, and sends the remote service to the first-level control device through the address information of the first-level control device. Remote service is returned to the first level control device. 6. An access system for remote services, comprising: a first-level control device in the first network and a second-level control device in the second network; wherein: The first-level control device is configured to receive a remote service request sent by a client, and notify an external system of the remote service request, and the external system uses the remote service request to determine an intranet for the client. server; and returning the remote service from the second-level control device to the client; The second-level control device is configured to receive the information of the intranet server sent by the external system, and establish a connection with the intranet server through the information of the intranet server; And using the connection to obtain remote services from the intranet server, and return the remote services to the first-level control device. 7. The system of claim 6, wherein: The first-level control device is further configured to, after receiving the remote service request sent by the client, establish a correspondence between the session identifier carried in the remote service request and the client information; It is further used to obtain a session identifier corresponding to the remote service, use the session identifier to query the corresponding relationship to obtain client information, and return the remote service to the client through the client information. 8. The system of claim 6, wherein: The first-level control device is further configured to notify the external system of the authentication information of the client and/or the authentication information of the first-level control device, and the external system uses the client's authentication information and/or authentication information of the first-level control device to authenticate the client and/or the first-level control device; and after the authentication is passed, notify the remote service request to the external system. 9. The system of claim 6, wherein: The first-level control device is further configured to notify the external system of the remote service request and its own description information; The second-level control device is further configured to receive the information of the intranet server and the description information of the first-level control device sent by the external system. 10. The system according to claim 9, wherein the description information of the first-level control device includes address information of the first-level control device and link information corresponding to the remote service request; The second-level control device is further configured to use the link information corresponding to the remote service request to determine that the remote service needs to be returned to the first-level control device, and pass the address of the first-level control device A message returns the remote service to the first level control device. 11. An access device for remote services, characterized in that the device is a first-level control device located in the first network, and the device includes: The first receiving module is configured to receive the remote service request sent by the client; A first sending module, configured to notify an external system of the remote service request, and the external system uses the remote service request to determine an intranet server for the client; The second receiving module is used to receive the remote service obtained from the intranet server returned by the second-level control device in the second network; The second sending module is configured to return the remote service to the client. 12. The apparatus of claim 11 wherein, The second sending module is specifically configured to, after receiving the remote service request sent by the client, establish a correspondence between the session identifier carried in the remote service request and the client information; And obtain the session identifier corresponding to the remote service, query the corresponding relationship with the session identifier to obtain client information, and return the remote service to the client through the client information. 13. The apparatus of claim 11 wherein, The first sending module is specifically configured to notify the external system of the authentication information of the client and/or the authentication information of the first-level control device, and the external system uses the authentication information of the client and/or the authentication information of the first-level control device to authenticate the client and/or the first-level control device; and after passing the authentication, notify the external system of the remote service request. 14. The apparatus of claim 11, wherein The first sending module is specifically configured to notify the external system of the remote service request and its own description information; the description information of the first-level control device includes address information of the first-level control device and Link information corresponding to the remote service request. 15. An access device for remote services, characterized in that the device is a second-level control device located in the second network, and the device includes: The receiving module is used to receive the information of the intranet server sent by the external system; A processing module, configured to establish a connection with the intranet server through the information of the intranet server, and use the connection to obtain remote services from the intranet server; A sending module, configured to return the remote service to the first-level control device in the first network. 16. The apparatus of claim 15, wherein The receiving module is specifically configured to receive the information of the intranet server and the description information of the first-level control device sent by the external system. 17. The device according to claim 16, wherein the description information of the first-level control device includes address information of the first-level control device and link information corresponding to the remote service request; The sending module is specifically configured to use the link information corresponding to the remote service request to determine that the remote service needs to be returned to the first-level control device, and use the address information of the first-level control device to send the The remote service is returned to the first-level control device.