Data processing method, electronic device, storage medium and computer program product

Abstract

The invention provides a data processing method, electronic equipment, a storage medium and a computer program product, and the method comprises the steps: judging whether a CPU performance value is greater than or equal to a first preset threshold value or not when a client and a server complete symmetric key authentication; and when the CPU performance numerical value is greater than or equal to the first preset threshold value, generating a processing thread, performing transparent transmission on target ciphertext data in an operation and maintenance process based on the processing thread, storing the target ciphertext data, and decrypting the target ciphertext data after operation and maintenance based on the processing thread. According to the invention, the data can be processed, and the operation fluency of the bastion host is improved.

Description

Technical Field

[0001] The present application relates to the field of security services, and in particular, to a data processing method, an electronic device, a storage medium, and a computer program product. Background Art

[0002] In today's era of rapid digital development, the information system architecture of enterprises is becoming increasingly complex, including numerous servers, network devices and various application systems. These key information assets need to be effectively managed and protected, and the bastion host plays an important role in this process. However, the existing bastion host faces challenges in terms of fluency in actual applications. With the expansion of enterprise business and the increase in the number of users, a large number of access requests are simultaneously pouring into the bastion host. When dealing with high-concurrency access, the traditional bastion host processing architecture often has corresponding delays, freezes and even service interruptions. This not only affects the work efficiency of operation and maintenance personnel and related authorized users, but may also cause delays in key business operations, bringing potential economic losses to the enterprise. At the same time, when processing complex access control policies and audit log records, the bastion host will also consume a lot of system resources, further increasing its operating burden. During the data transmission process, due to the encryption and decryption operations of the data and the limitation of network bandwidth, the speed and stability of data transmission are also affected to a certain extent, resulting in users experiencing obvious delays during the operation. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a data processing method, an electronic device, a storage medium and a computer program product for processing data and improving the running smoothness of the bastion host.

[0004] In a first aspect, the present invention provides a data processing method, which is applied to a bastion host, and the method includes:

[0005] When symmetric key authentication is completed with the client and the server, determining whether the CPU performance value is greater than or equal to a first predetermined threshold;

[0006] When the CPU performance value is greater than or equal to the first predetermined threshold, a processing thread is generated, and based on the processing thread, the target ciphertext data is transparently transmitted and saved during the operation and maintenance process, and based on the processing thread, the target ciphertext data is decrypted after the operation and maintenance is completed.

[0007] The method of the first aspect of the present application can determine whether the CPU performance value is greater than or equal to a first predetermined threshold when completing symmetric key authentication with the client and the server, and then generate a processing thread when the CPU performance value is greater than or equal to the first predetermined threshold, and based on the processing thread, transparently transmit the target ciphertext data and save the target ciphertext data during the operation and maintenance process, and decrypt the target ciphertext data after the operation and maintenance is completed based on the processing thread. Compared with the prior art, the present application can perform the decryption of the target ciphertext data after the operation and maintenance is completed in high concurrency situations such as when the CPU performance value of the bastion host is greater than or equal to the first predetermined threshold, thereby avoiding the decryption of the target ciphertext data from occupying the limited computing resources of the bastion host during the operation and maintenance process, thereby reducing the performance consumption of the bastion host during the operation and maintenance process and improving the fluency of the bastion host.

[0008] In an optional embodiment, the method further comprises:

[0009] When the CPU performance value is less than the first predetermined threshold, two processing threads are generated, and based on one of the processing threads, the target ciphertext data is transparently transmitted and saved during the operation and maintenance process, and based on the other processing thread, the target ciphertext data is decrypted during the operation and maintenance process.

[0010] This optional implementation can generate two processing threads when the CPU performance value is less than the first predetermined threshold, and based on one of the processing threads, transparently transmit and save the target ciphertext data during the operation and maintenance process, and decrypt the target ciphertext data based on the other processing thread during the operation and maintenance process. In this way, when the CPU performance of the bastion machine is sufficient, the target ciphertext can be decoded during the operation and maintenance process, thereby making full use of the computing resources of the bastion machine.

[0011] In an optional embodiment, the method further comprises:

[0012] Determine whether the CPU performance value is greater than or equal to a second predetermined threshold or determine whether the memory performance value is greater than or equal to a target threshold, wherein the second predetermined threshold is greater than the first predetermined threshold;

[0013] When the CPU performance value is greater than or equal to the second predetermined threshold, or the memory performance data is greater than or equal to the target threshold, operation and maintenance prompt information and alarm information are generated, wherein the operation and maintenance prompt is used to prompt that the operation and maintenance concurrency of the bastion host has reached the maximum value.

[0014] This optional implementation can determine whether the CPU performance value is greater than or equal to a second predetermined threshold or determine whether the memory performance value is greater than or equal to a target threshold, wherein the second predetermined threshold is greater than the first predetermined threshold, and thus can generate operation and maintenance prompt information and alarm information when the CPU performance value is greater than or equal to the second predetermined threshold, or the memory performance data is greater than or equal to the target threshold, wherein the operation and maintenance prompt is used to prompt that the operation and maintenance concurrency of the bastion host has reached the maximum value, and finally issue an alarm prompt in time.

[0015] In an optional embodiment, the method comprises:

[0016] Performing asymmetric key authentication with the client, and after the asymmetric key authentication passes, receiving client data sent by the client based on the first asymmetric key;

[0017] Perform asymmetric key authentication with the server, and after the asymmetric key authentication passes, send the client data to the server based on a second asymmetric key, so that the server sends the server data to the bastion host based on the second asymmetric key.

[0018] This optional implementation can perform asymmetric key authentication with the client, and after the asymmetric key authentication is passed, receive the client data sent by the client based on the first asymmetric key. On the other hand, it can perform asymmetric key authentication with the server, and after the asymmetric key authentication is passed, send the client data to the server based on the second asymmetric key, so that the server sends the server data to the bastion machine based on the second asymmetric key.

[0019] In an optional embodiment, the method comprises:

[0020] The server data is received and sent to the client based on the first asymmetric key, wherein the server data and the client data are used to generate a pairwise key required to complete symmetric key authentication.

[0021] This optional implementation is capable of receiving the server data and sending the server data to the client based on the first asymmetric key, wherein the server data and the client data are used to generate a pairwise key required to complete symmetric key authentication.

[0022] In an optional embodiment, the method further comprises:

[0023] A decryption result of the target ciphertext data is obtained based on the processing thread, and an audit of the target ciphertext data is completed through the decryption result.

[0024] This optional implementation can obtain the decryption result of the target ciphertext data based on the processing thread, and complete the audit of the target ciphertext data through the decryption result.

[0025] In an optional embodiment, the method further comprises:

[0026] A playback video is generated based on the processing thread.

[0027] This optional implementation can generate a playback video based on the processing thread.

[0028] In a second aspect, the present invention provides a data processing device, which is applied to a bastion host, and the device includes:

[0029] A judgment module, used to judge whether the CPU performance value is greater than or equal to a first predetermined threshold when completing symmetric key authentication with the client and the server;

[0030] A generation module is used to generate a processing thread when the CPU performance value is greater than or equal to the first predetermined threshold, and based on the processing thread, transparently transmit and save the target ciphertext data during the operation and maintenance process, and decrypt the target ciphertext data based on the processing thread after the operation and maintenance is completed.

[0031] The device of the present application can determine whether the CPU performance value is greater than or equal to a first predetermined threshold value when completing symmetric key authentication with the client and the server by executing the data processing method, and then generate a processing thread when the CPU performance value is greater than or equal to the first predetermined threshold value, and based on the processing thread, the target ciphertext data is transparently transmitted and saved during the operation and maintenance process, and the target ciphertext data is decrypted after the operation and maintenance is completed based on the processing thread. Compared with the prior art, the present application can perform the decryption of the target ciphertext data after the operation and maintenance is completed in high concurrency situations such as when the CPU performance value of the bastion machine is greater than or equal to the first predetermined threshold value, thereby avoiding the decryption of the target ciphertext data from occupying the limited computing resources of the bastion machine during the operation and maintenance process, thereby reducing the performance consumption of the bastion machine during the operation and maintenance process and improving the fluency of the bastion machine.

[0032] In a third aspect, the present invention provides an electronic device, comprising:

[0033] Processor; and

[0034] A memory configured to store machine-readable instructions, which, when executed by the processor, execute the method described in any one of the aforementioned embodiments.

[0035] The electronic device of the present application can determine whether the CPU performance value is greater than or equal to a first predetermined threshold value when completing symmetric key authentication with a client and a server by executing a data processing method, and then generate a processing thread when the CPU performance value is greater than or equal to the first predetermined threshold value, and based on the processing thread, the target ciphertext data is transparently transmitted and saved during the operation and maintenance process, and the target ciphertext data is decrypted after the operation and maintenance is completed based on the processing thread. Compared with the prior art, the present application can perform the decryption of the target ciphertext data after the operation and maintenance is completed in high concurrency situations such as when the CPU performance value of the bastion machine is greater than or equal to the first predetermined threshold value, thereby avoiding the decryption of the target ciphertext data from occupying the limited computing resources of the bastion machine during the operation and maintenance process, thereby reducing the performance consumption of the bastion machine during the operation and maintenance process and improving the fluency of the bastion machine.

[0036] In a fourth aspect, the present invention provides a storage medium storing a computer program, wherein the computer program is executed by a processor as described in any one of the aforementioned embodiments.

[0037] The storage medium of the present application can determine whether the CPU performance value is greater than or equal to a first predetermined threshold value when completing symmetric key authentication with the client and the server by executing the data processing method, and then generate a processing thread when the CPU performance value is greater than or equal to the first predetermined threshold value, and based on the processing thread, the target ciphertext data is transparently transmitted and saved during the operation and maintenance process, and the target ciphertext data is decrypted after the operation and maintenance is completed based on the processing thread. Compared with the prior art, the present application can perform the decryption of the target ciphertext data after the operation and maintenance is completed in high concurrency situations such as when the CPU performance value of the bastion machine is greater than or equal to the first predetermined threshold value, thereby avoiding the decryption of the target ciphertext data from occupying the limited computing resources of the bastion machine during the operation and maintenance process, thereby reducing the performance consumption of the bastion machine during the operation and maintenance process and improving the fluency of the bastion machine.

[0038] In a fifth aspect, the present invention provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the method described in any one of the aforementioned embodiments.

[0039] The computer program product of the present application can determine whether the CPU performance value is greater than or equal to a first predetermined threshold value when completing symmetric key authentication with the client and the server by executing the data processing method, and then generate a processing thread when the CPU performance value is greater than or equal to the first predetermined threshold value, and based on the processing thread, the target ciphertext data is transparently transmitted and saved during the operation and maintenance process, and the target ciphertext data is decrypted after the operation and maintenance is completed based on the processing thread. Compared with the prior art, the present application can perform the decryption of the target ciphertext data after the operation and maintenance is completed in high concurrency situations such as when the CPU performance value of the bastion machine is greater than or equal to the first predetermined threshold value, thereby avoiding the decryption of the target ciphertext data from occupying the limited computing resources of the bastion machine during the operation and maintenance process, thereby reducing the performance consumption of the bastion machine during the operation and maintenance process and improving the fluency of the bastion machine. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0041] Figure 1 It is a flowchart of a data processing method disclosed in an embodiment of the present application;

[0042] Figure 2 It is a flowchart of another data processing method disclosed in an embodiment of the present application;

[0043] Figure 3 It is a structural schematic diagram of an electronic device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0044] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0045] Embodiment 1

[0046] See also Figure 1 , Figure 1 is a flow chart of a data processing method disclosed in an embodiment of the present application, wherein the method is applied to a bastion host. Figure 1 As shown, the method of the embodiment of the present application includes the following steps:

[0047] 101. When symmetric key authentication is completed with the client and the server, determine whether the CPU performance value is greater than or equal to a first predetermined threshold;

[0048] 102. When the CPU performance value is greater than or equal to a first predetermined threshold, a processing thread is generated, and based on the processing thread, the target ciphertext data is transparently transmitted and saved during the operation and maintenance process, and based on the processing thread, the target ciphertext data is decrypted after the operation and maintenance is completed.

[0049] The method of the embodiment of the present application can determine whether the CPU performance value is greater than or equal to the first predetermined threshold when completing symmetric key authentication with the client and the server, and then generate a processing thread when the CPU performance value is greater than or equal to the first predetermined threshold, and based on the processing thread, the target ciphertext data is transparently transmitted and saved during the operation and maintenance process, and the target ciphertext data is decrypted after the operation and maintenance is completed based on the processing thread. Compared with the prior art, the present application can perform the decryption of the target ciphertext data after the operation and maintenance is completed in high concurrency situations such as when the CPU performance value of the bastion host is greater than or equal to the first predetermined threshold, thereby avoiding the decryption of the target ciphertext data from occupying the limited computing resources of the bastion host during the operation and maintenance process, thereby reducing the performance consumption of the bastion host during the operation and maintenance process and improving the fluency of the bastion host.

[0050] In the embodiments of the present application, the bastion host is a network security device or system, which is usually used to provide secure remote access and management functions. It acts as a barrier between the enterprise and the external network, ensuring that only authorized users can access internal network resources. The bastion host can also record all access behaviors for auditing and tracking, and is an important part of the enterprise network boundary security.

[0051] In the embodiment of the present application, the server may be an enterprise server storing resources that need to be protected, and the client may refer to a device that needs to access the protected resources.

[0052] In the embodiment of the present application, symmetric key negotiation is an authentication mechanism that uses the same key (i.e., symmetric key) to complete the data encryption and decryption process. Under this mechanism, both parties in communication must share the same key in advance and ensure the security of the key to prevent it from being obtained by a third party.

[0053] In an embodiment of the present application, completing symmetric key authentication with the client and the server may refer to the bastion host completing symmetric key authentication with the client, the server completing symmetric key authentication with the bastion host, and the client completing symmetric key authentication with the server, that is, the bastion host saves the symmetric key required for communication with the client, the client saves the symmetric key required for communication with the bastion host, the bastion host saves the symmetric key required for communication with the server, the server saves the symmetric key required for communication with the bastion host, the server saves the symmetric key required for communication with the client, and the client saves the symmetric key required for communication with the server.

[0054] In an embodiment of the present application, the client can send a connection request to the bastion host, and after the connection is successful, the target data is encrypted using a symmetric key, and then the target ciphertext data is obtained and sent to the bastion host. After receiving the target ciphertext data, the bastion host may not decrypt the target ciphertext data based on the symmetric key, but instead transparently transmit the target ciphertext data.

[0055] In the embodiment of the present application, transparent transmission means that during the process of data transmission from one endpoint to another, the intermediate node does not process or modify the data content, but directly transmits the data "transparently". In the present application, through transparent transmission, the bastion host does not decrypt the target ciphertext data.

[0056] In the embodiment of the present application, the bastion host completes symmetric key authentication with the client and the server, indicating that the three parties already have a preliminary security mechanism. At this time, the possibility of the target ciphertext data carrying attack behaviors is greatly reduced. Therefore, after the bastion host completes symmetric key authentication with the client and the server, the bastion host can decrypt and audit the target ciphertext data in real time without considering data security, thereby avoiding decryption, auditing and other operations occupying the computing resources of the bastion host, reducing the computing resource consumption of the bastion host and improving the fluency of the bastion host. In comparison, the existing technology requires real-time decryption and auditing of ciphertext data during the operation and maintenance process. Such operations will occupy a large amount of computing resources of the bastion host, reducing the fluency of the bastion host.

[0057] In the embodiment of the present application, the CPU performance value refers to the CPU performance value of the bastion host, wherein the CPU performance value may be the CPU usage rate of the bastion host. In the embodiment of the present application, the first predetermined threshold may be 70%, or 80%.

[0058] In the embodiment of the present application, as an optional implementation, the method of the embodiment of the present application further includes the following steps:

[0059] When the CPU performance value is less than the first predetermined threshold, two processing threads are generated, and based on one of the processing threads, the target ciphertext data is transparently transmitted and saved during the operation and maintenance process, and based on the other processing thread, the target ciphertext data is decrypted during the operation and maintenance process.

[0060] This optional implementation can generate two processing threads when the CPU performance value is less than the first predetermined threshold, and based on one of the processing threads, the target ciphertext data is transparently transmitted and saved during the operation and maintenance process, and the target ciphertext data is decrypted during the operation and maintenance process based on the other processing thread. In this way, when the CPU performance of the bastion machine is sufficient, the target ciphertext can be decoded in real time during the operation and maintenance process, thereby making full use of the computing resources of the bastion machine.

[0061] In the embodiment of the present application, as an optional implementation, the method of the embodiment of the present application further includes the following steps:

[0062] Determine whether the CPU performance value is greater than or equal to a second predetermined threshold or determine whether the memory performance value is greater than or equal to a target threshold, wherein the second predetermined threshold is greater than the first predetermined threshold;

[0063] When the CPU performance value is greater than or equal to the second predetermined threshold, or the memory performance data is greater than or equal to the target threshold, operation and maintenance prompt information and alarm information are generated, wherein the operation and maintenance prompt is used to prompt that the operation and maintenance concurrency of the bastion host has reached the maximum value.

[0064] This optional implementation method can determine whether the CPU performance value is greater than or equal to a second predetermined threshold or whether the memory performance value is greater than or equal to a target threshold, wherein the second predetermined threshold is greater than the first predetermined threshold, and then when the CPU performance value is greater than or equal to the second predetermined threshold, or the memory performance data is greater than or equal to the target threshold, operation and maintenance prompt information and alarm information can be generated, wherein the operation and maintenance prompt is used to prompt that the operation and maintenance concurrency of the bastion host has reached the maximum value, and finally an alarm prompt is issued in time.

[0065] In this optional implementation, the second predetermined threshold may be a CPU usage rate of 94%.

[0066] In the embodiment of the present application, as an optional implementation, the method of the embodiment of the present application includes the following steps:

[0067] Performing asymmetric key authentication with the client, and after the asymmetric key authentication passes, receiving client data sent by the client based on the first asymmetric key;

[0068] Perform asymmetric key authentication with the server, and after the asymmetric key authentication passes, send client data to the server based on the second asymmetric key, so that the server sends the server data to the bastion host based on the second asymmetric key.

[0069] This optional implementation can perform asymmetric key authentication with the client, and after the asymmetric key authentication is passed, receive the client data sent by the client based on the first asymmetric key. On the other hand, it can perform asymmetric key authentication with the server, and after the asymmetric key authentication is passed, send the client data to the server based on the second asymmetric key, so that the server sends the server data to the bastion host based on the second asymmetric key.

[0070] For this optional implementation, after the asymmetric key authentication is passed, the client data and the server data are transmitted, which can improve the data security of the client data and the server data, that is, reduce the possibility of leakage of the client data and the server data.

[0071] In the embodiment of the present application, as an optional implementation, the method of the embodiment of the present application includes the following steps:

[0072] Server data is received and sent to the client based on the first asymmetric key, wherein the server data and the client data are used to generate a pairwise key required to complete symmetric key authentication.

[0073] This optional implementation is capable of receiving server data and sending the server data to the client based on the first asymmetric key, wherein the server data and the client data are used to generate a pairwise key required to complete symmetric key authentication.

[0074] In the embodiment of the present application, as an optional implementation, the method of the embodiment of the present application further includes the following steps:

[0075] The decryption result of the target ciphertext data is obtained based on the processing thread, and the audit of the target ciphertext data is completed through the decryption result.

[0076] This optional implementation can obtain the decryption result of the target ciphertext data based on the processing thread, and complete the audit of the target ciphertext data through the decryption result.

[0077] In the embodiment of the present application, as an optional implementation, the method of the embodiment of the present application further includes the following steps:

[0078] Generate playback video based on processing thread.

[0079] This optional implementation can generate playback video based on the processing thread.

[0080] For the embodiments of this application, as an example, please refer to Figure 2 , Figure 2 It is a flowchart of another data processing method disclosed in the embodiment of this application. Figure 2 As shown, the specific process of the data processing method can be:

[0081] The client performs asymmetric key authentication with the bastion host, and the client then uses the asymmetric key to obtain the client data required to generate the symmetric key.

[0082] The bastion host and the server perform asymmetric key authentication, and the bastion host then sends the client data to the server using the asymmetric key.

[0083] After receiving the client data, the server sends the server data required to generate the symmetric key to the bastion host through the asymmetric key.

[0084] The bastion host sends the server data to the client through an asymmetric key. At this point, the server, bastion host, and client all use the client data and server data to generate a symmetric key.

[0085] When client operation and maintenance begins, the main process generates two threads as the first data processing module and the second data processing module. The first data processing module transparently transmits the ciphertext data and saves each ciphertext data into a specified file at time intervals; the second data module decrypts the ciphertext data, completes the audit, and generates a playback video.

[0086] When there are more client operations and maintenance, causing the CPU to reach the first predetermined threshold, the main process no longer generates the first data processing module and the second data processing module. The main process first determines whether the memory has reached the predetermined threshold. If it has not reached it, a thread is generated as the first data processing module to transparently transmit the ciphertext data and save each ciphertext data to the specified file at time intervals; after the operation and maintenance is completed, the thread is converted to the second data processing module to decrypt the saved ciphertext data, complete the audit and generate the playback video.

[0087] When the client operation and maintenance continues to increase and the CPU reaches the second predetermined threshold or the memory reaches the threshold, the user is prompted that the operation and maintenance concurrency has reached the maximum value and an alarm is issued.

[0088] Embodiment 2

[0089] The embodiment of the present application discloses a data processing device, wherein the device is applied to a bastion server. The device of the embodiment of the present application includes the following functional modules:

[0090] A judgment module, used to judge whether the CPU performance value is greater than or equal to a first predetermined threshold when completing symmetric key authentication with the client and the server;

[0091] The generation module is used to generate a processing thread when the CPU performance value is greater than or equal to a first predetermined threshold value, and based on the processing thread, transparently transmit and save the target ciphertext data during the operation and maintenance process, and decrypt the target ciphertext data based on the processing thread after the operation and maintenance is completed.

[0092] The device of the embodiment of the present application can determine whether the CPU performance value is greater than or equal to the first predetermined threshold value when completing symmetric key authentication with the client and the server by executing the data processing method, and then generate a processing thread when the CPU performance value is greater than or equal to the first predetermined threshold value, and transmit and save the target ciphertext data based on the processing thread during the operation and maintenance process, and decrypt the target ciphertext data based on the processing thread after the operation and maintenance is completed. Compared with the prior art, the present application can perform the decryption of the target ciphertext data after the operation and maintenance is completed in high concurrency situations such as when the CPU performance value of the bastion machine is greater than or equal to the first predetermined threshold value, thereby avoiding the decryption of the target ciphertext data from occupying the limited computing resources of the bastion machine during the operation and maintenance process, thereby reducing the performance consumption of the bastion machine during the operation and maintenance process and improving the fluency of the bastion machine.

[0093] Embodiment 3

[0094] See also Figure 3 , Figure 3 is a schematic diagram of the structure of an electronic device disclosed in an embodiment of the present application, such as Figure 3 As shown, the electronic device of the embodiment of the present application includes:

[0095] Processor 301; and

[0096] The memory 302 is configured to store machine-readable instructions, which, when executed by the processor 301 , executes a method as described in any of the aforementioned implementations.

[0097] The electronic device of the embodiment of the present application can judge whether the CPU performance value is greater than or equal to the first predetermined threshold value when completing symmetric key authentication with the client and the server by executing the data processing method, and then generate a processing thread when the CPU performance value is greater than or equal to the first predetermined threshold value, and transmit and save the target ciphertext data based on the processing thread during the operation and maintenance process, and decrypt the target ciphertext data based on the processing thread after the operation and maintenance is completed. Compared with the prior art, the present application can perform the decryption of the target ciphertext data after the operation and maintenance is completed in high concurrency situations such as when the CPU performance value of the bastion machine is greater than or equal to the first predetermined threshold value, thereby avoiding the decryption of the target ciphertext data from occupying the limited computing resources of the bastion machine during the operation and maintenance process, thereby reducing the performance consumption of the bastion machine during the operation and maintenance process and improving the fluency of the bastion machine.

[0098] Embodiment 4

[0099] An embodiment of the present application provides a storage medium, wherein the storage medium stores a computer program, and the computer program is executed by a processor as in any of the methods described in the foregoing implementations.

[0100] The storage medium of the embodiment of the present application can determine whether the CPU performance value is greater than or equal to the first predetermined threshold value when completing symmetric key authentication with the client and the server by executing the data processing method, and then generate a processing thread when the CPU performance value is greater than or equal to the first predetermined threshold value, and transmit and save the target ciphertext data based on the processing thread during the operation and maintenance process, and decrypt the target ciphertext data based on the processing thread after the operation and maintenance is completed. Compared with the prior art, the present application can perform the decryption of the target ciphertext data after the operation and maintenance is completed in high concurrency situations such as when the CPU performance value of the bastion host is greater than or equal to the first predetermined threshold value, thereby avoiding the decryption of the target ciphertext data from occupying the limited computing resources of the bastion host during the operation and maintenance process, thereby reducing the performance consumption of the bastion host during the operation and maintenance process and improving the fluency of the bastion host.

[0101] Embodiment 5

[0102] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the method of any one of the aforementioned embodiments is implemented.

[0103] The computer program product of the embodiment of the present application can determine whether the CPU performance value is greater than or equal to the first predetermined threshold value when completing symmetric key authentication with the client and the server by executing the data processing method, and then generate a processing thread when the CPU performance value is greater than or equal to the first predetermined threshold value, and transmit and save the target ciphertext data based on the processing thread during the operation and maintenance process, and decrypt the target ciphertext data based on the processing thread after the operation and maintenance is completed. Compared with the prior art, the present application can perform the decryption of the target ciphertext data after the operation and maintenance is completed in high concurrency situations such as the CPU performance value of the bastion machine is greater than or equal to the first predetermined threshold value, thereby avoiding the decryption of the target ciphertext data from occupying the limited computing resources of the bastion machine during the operation and maintenance process, thereby reducing the performance consumption of the bastion machine during the operation and maintenance process and improving the fluency of the bastion machine.

[0104] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0105] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0106] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0107] It should be noted that if the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk.

[0108] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0109] The above are only embodiments of the present application and are not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of protection of the present application.

Claims

1. A data processing method, characterized in that: The method is applied to a bastion host, and the method includes: When symmetric key authentication is completed with the client and the server, determining whether the CPU performance value is greater than or equal to a first predetermined threshold; When the CPU performance value is greater than or equal to the first predetermined threshold, a processing thread is generated, and based on the processing thread, the target ciphertext data is transparently transmitted and saved during the operation and maintenance process, and based on the processing thread, the target ciphertext data is decrypted after the operation and maintenance is completed.

2. The method according to claim 1, characterized in that The method further comprises: When the CPU performance value is less than the first predetermined threshold, two processing threads are generated, and based on one of the processing threads, the target ciphertext data is transparently transmitted and saved during the operation and maintenance process, and based on the other processing thread, the target ciphertext data is decrypted during the operation and maintenance process.

3. The method according to claim 1, characterized in that The method further comprises: Determine whether the CPU performance value is greater than or equal to a second predetermined threshold or determine whether the memory performance value is greater than or equal to a target threshold, wherein the second predetermined threshold is greater than the first predetermined threshold; When the CPU performance value is greater than or equal to the second predetermined threshold, or the memory performance data is greater than or equal to the target threshold, operation and maintenance prompt information and alarm information are generated, wherein the operation and maintenance prompt is used to prompt that the operation and maintenance concurrency of the bastion host has reached the maximum value.

4. The method according to claim 1, characterized in that The method comprises: Performing asymmetric key authentication with the client, and after the asymmetric key authentication passes, receiving client data sent by the client based on the first asymmetric key; Perform asymmetric key authentication with the server, and after the asymmetric key authentication passes, send the client data to the server based on a second asymmetric key, so that the server sends the server data to the bastion host based on the second asymmetric key.

5. The method according to claim 4, characterized in that The method comprises: The server data is received and sent to the client based on the first asymmetric key, wherein the server data and the client data are used to generate a pairwise key required to complete symmetric key authentication.

6. The method according to claim 1, characterized in that The method further comprises: A decryption result of the target ciphertext data is obtained based on the processing thread, and an audit of the target ciphertext data is completed through the decryption result.

7. The method according to claim 1, characterized in that The method further comprises: A playback video is generated based on the processing thread.

8. An electronic device, characterized in that: include: processor; as well as A memory configured to store machine-readable instructions, wherein when the instructions are executed by the processor, the method according to any one of claims 1 to 7 is performed.

9. A storage medium, characterized in that: The storage medium stores a computer program, and the computer program is executed by a processor to perform the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images