Methods and systems for users to access web applications

Abstract

A method and system for accessing a web application (1201) accessible through a web interface includes: a user device (136) requesting access to the web application (1201) and granting the user device (136) access to the web application (1201); a bastion host orchestrator (160) creating an HTTPS bastion host (1031) based on a request from an infrastructure system (150); the user device (136) sending a request to an application router (102); the application router (102) routing the request to the HTTPS bastion host; the HTTPS bastion host rewriting the request into a rewritten request and sending the rewritten request to the web application (1201); the HTTPS bastion host (1031) receiving a response from the web application (1201); the HTTPS bastion host rewriting the response into a rewritten response and sending the rewritten response to the application router (102), and the application router (102) routing the rewritten response to the user device (136).

Description

Cross-reference to related applications

[0001] This patent application claims priority to European Patent Application No. 24307249.3, filed on 20 December 2024, the entire disclosure of which is incorporated herein by reference. Technical Field

[0002] This technology relates to information technology infrastructure, and more specifically to methods and systems for enabling user devices to access web applications. Background Technology

[0003] In the infrastructure systems hosting applications (such as those provided by an infrastructure provider), access to production applications is achieved through a web interface. The problem with web interfaces is that all services are exposed via official HTTPS certificates issued by a Certificate Authority (CA). To limit the exposure of these web interfaces, access must be restricted. Typically, infrastructure providers offer dedicated machines specifically for opening web browsers to access these web interfaces to achieve this. For example, infrastructure administrators can use such dedicated machines to access hosted production applications. In this case, SSL certificates are required to ensure that administrators can correctly connect to the target web interface.

[0004] In infrastructure systems, traceability of access to production applications by infrastructure administrators is required for auditing and security purposes, or for administrator training needs. However, this traceability is difficult to achieve when infrastructure administrators use dedicated machines, especially when it is impossible to verify the correlation between interface actions and infrastructure behavior.

[0005] Therefore, while the aforementioned developments may offer benefits, improvements are still expected.

[0006] The topics discussed in the Background section should not be assumed to be prior art simply because they are mentioned there. Similarly, any issues mentioned in the Background section or related to the topics in the Background section should not be assumed to be problems previously recognized in the prior art. The topics in the Background section merely represent different research methods. Summary of the Invention

[0007] The following description of the invention is for illustrative purposes only and is not intended to limit or restrict the specific embodiments. The various aspects described are presented in a simplified form as a prelude to the detailed description provided below.

[0008] The implementation of this technology is at least in part based on the developer's understanding of the shortcomings associated with existing technologies. The developers of this technology typically design a method and system for enabling user devices to access web applications.

[0009] More specifically, in one aspect of this technology, a method is provided for accessing a web application accessible through a web interface, the method being: - The user device requests access to the web application from the infrastructure system; - Granting access to web applications through infrastructure systems; - An HTTPS bastion host is created by the bastion host orchestrator based on a request from the infrastructure system, which includes the type of web application. - The HTTPS bastion host retrieves the library corresponding to the type of the web application from the library database; - The user device sends a request to the application router, and the application router routes the request to the HTTPS bastion host; - The HTTPS bastion host, based on the obtained library, rewrites the request into a rewritten request and sends the rewritten request to the web application; - The HTTPS bastion host receives responses from the web application; and - The HTTPS bastion host, based on the obtained library, rewrites the response into a rewritten response, sends the rewritten response to the application router, and the application router routes the rewritten response to the user device.

[0010] In one embodiment, the method further includes: - Obfuscate the message details in the rewritten request and / or rewritten response; and - The HTTPS bastion host sends obfuscated copies of the rewritten requests and / or responses to the logging system.

[0011] In one embodiment, the method further includes: - The bastion host orchestrator sends a list of authorized user devices to the HTTPS bastion host; and - The HTTPS bastion host checks the request headers to see if the user's device is in the list. If the user's device is not in the list, the request is rejected.

[0012] In one embodiment, the method further includes: - Authenticate users of user devices via SSO; - The SSO sends the HTTP header of the authenticated user to the application router; - The application router sends HTTP headers to the HTTPS bastion host; - The HTTPS bastion host checks whether a user has been authenticated by comparing the request headers with the received HTTP headers. If the user is not authenticated, the request is rejected.

[0013] In this method implementation, the obfuscated message details include the login name and password of the authenticated user.

[0014] In an implementation of this method, the web application is one of at least two web applications, which is one of a first web application and a second web application, and the method further includes: - The user device requests access to the second web application from the infrastructure system; - Access to the second web application is granted by the infrastructure system; - A second HTTPS bastion host is created by the bastion host orchestrator based on a request from the infrastructure system, which includes the type of the second web application. - The second HTTPS bastion host retrieves the library corresponding to the type of the second web application from the library database; - The user equipment sends a second request to the application router, and the application router routes the second request to the second HTTPS bastion host; - The second HTTPS bastion host, based on the library obtained that corresponds to the type of the second web application, rewrites the second request into a second rewritten request and sends the second rewritten request to the second web application; - The second response is received from the second web application by the second HTTPS bastion host; and - The second HTTPS bastion host, based on the library obtained that corresponds to the type of the second web application, rewrites the second response into a second rewritten response, sends the second rewritten response to the application router, and the application router routes the second rewritten response to the user device.

[0015] In another aspect of this technology, a system is provided for accessing a web application accessible via a web interface, the system comprising: - Bastion host orchestrator; - Application Router; - Library-type databases; and - HTTPS bastion host; - An HTTPS bastion host is created by the bastion host orchestrator based on a request from the infrastructure system after a user device requests access to a web application from the infrastructure system and the infrastructure system grants that access. The request from the infrastructure system includes the type of web application. - The application router is configured to receive requests from user devices and route those requests to the HTTPS bastion host, receive rewritten responses from the HTTPS bastion host, and route the rewritten responses to the user devices; and - The HTTPS bastion host is configured as follows: - Retrieve the library corresponding to the type of the web application from the library database; - Based on the acquired library, the request received from the application router is rewritten into a rewritten request, and the rewritten request is sent to the web application; - Receive responses from web applications; and - Based on the acquired library, the response is rewritten into a rewritten response, and the rewritten response is sent to the application router.

[0016] In this implementation of the system, the HTTPS bastion host is also configured to: - Obfuscate the message details in the rewritten request and the rewritten response; - Send obfuscated copies of the rewritten requests and / or responses to the logging system.

[0017] In the implementation of this system: - The bastion host orchestrator is also configured to send a list of authorized user devices to the HTTPS bastion host; - The HTTPS bastion host is also configured to check whether the user device is in the list by examining the request header, and if the user device is not in the list, then reject the request.

[0018] In the implementation of this system: - The application router is also configured to receive an HTTP header from SSO corresponding to the user of the user device authenticated by SSO, and send the HTTP header to the HTTPS bastion host; - HTTPS bastion hosts are also configured to compare the request headers with the received HTTP headers to check if the user has been authenticated, and if the user has not been authenticated, to reject the request.

[0019] In this implementation of the system, the HTTPS bastion host is also configured to obfuscate message details, which include the login name and password of an authenticated user.

[0020] In the implementation of the system, the HTTPS bastion host is a Kubernetes job.

[0021] In one implementation, the system also includes a second HTTPS bastion host, which is created by the bastion host orchestrator based on a request from the infrastructure system after the user device requests access to the second web application from the infrastructure system and the infrastructure system grants the access. The request from the infrastructure system contains the type of the second web application. - The second HTTPS bastion host is configured as follows: - Retrieve the library corresponding to the type of the second web application from the library database; - Based on the acquired library, the request received from the application router is rewritten into a rewritten request, and the rewritten request is sent to the second web application; - Receive responses from a second web application; and - Based on the acquired library, the second response is rewritten into a rewritten response, and the rewritten response is sent to the application router.

[0022] In another aspect of the invention, a computer-readable medium is provided, the computer-readable medium containing instructions that, when executed by a processing unit, cause the processing unit to perform the method described in any of the above aspects.

[0023] In the context of this specification, "server" means a computer program that runs on suitable hardware and is capable of receiving and executing, or causing to be executed, requests over a network (e.g., from an administrator's device). The hardware may be a physical computer or a physical computer system, but neither must be necessary for the purposes of this art. In this context, the use of the term "server" is not intended to imply that every task (e.g., a received instruction or request) or any particular task will be received, executed, or caused to be executed by the same server (i.e., the same software and / or hardware); it is intended to indicate that any number of software elements or hardware devices may be involved in receiving / sending, executing, or causing to be executed any task or request, or the consequences thereof; and all such software and hardware may be one server or multiple servers.

[0024] In the context of this specification, "user equipment" means any computer hardware capable of running software appropriate for the currently relevant task. Therefore, some (non-limiting) examples of user equipment include personal computers (desktops, laptops, notebooks, etc.), smartphones, and tablets. It should be noted that the use of the term "user equipment" in the context of this specification does not exclude its function as a server for other user equipment. The use of the term "user equipment" does not preclude the use of multiple user equipment to receive / send, perform, or cause to perform any task or request, or the consequences of any task or request, or the steps of any method described herein.

[0025] In the context of this specification, "database" means any structured collection of data, regardless of its specific structure, database management software, or computer hardware used to store, implement, or otherwise make the data available thereon. A database may reside on the same hardware as the processes that store or utilize the information stored in the database, or it may reside on separate hardware, such as a dedicated server or multiple servers.

[0026] In the context of this specification, the term "component" is intended to include the software (suitable for the specific hardware environment) necessary and sufficient to implement the particular function mentioned.

[0027] In the context of this specification, unless expressly stated otherwise, the terms "computer-readable medium" and "memory," unless more specifically defined elsewhere in the specification, are intended to include media of any nature and kind, with non-limiting examples including RAM, ROM, disks (CD-ROM, DVD, floppy disk, hard disk, etc.), USB keys, flash memory cards, solid-state drives, and / or tape drives, etc. Also in the context of this specification, "a" computer-readable medium and "the" computer-readable medium should not be construed as the same computer-readable medium. Rather, where appropriate, "a" computer-readable medium and "the" computer-readable medium may also be construed as a first computer-readable medium and a second computer-readable medium.

[0028] In the context of this specification, "network" is intended to include the configuration of devices and software that communicate with each other and exchange information (including data and instructions). Such communication can be achieved through a direct physical connection between devices (i.e., wired communication) and / or indirectly through electromagnetic or other non-physical connections (i.e., wireless communication) using any existing protocol between the two devices. A network can contain any number and type of devices, systems, and applications, which, in some exemplary, illustrative, and non-limiting embodiments, operate according to established strategies. In some networks, the networked devices, systems, and applications included in the network may change over time, as their configurations, locations, and other parameters may change as networked devices intentionally or unintentionally connect to or disconnect from the network.

[0029] Networking devices can be devices such as switches, routers, and gateways, which are designed to provide communication services between user equipment or other networked devices.

[0030] In the context of this specification, unless otherwise expressly stated, an "instruction" for an information element can be the information element itself or a pointer, reference, link, or other indirect mechanism that enables the recipient of the instruction to locate a retrievable location of the information element in a network, memory, database, or other computer-readable medium. For example, an instruction for a document may include the document itself (i.e., its content), or it may be a unique document descriptor identifying a data object on a particular object storage device, or some other method that guides the recipient of the instruction to access a network location, memory address, database table, or other accessible data object location. Those skilled in the art will understand that the required precision of such an instruction depends on the degree of prior understanding between the sender and receiver of the information exchanged. For example, if it is understood before communication between the sender and receiver that the instruction for the information element will be entered as a database key into a specific table in a predetermined database containing the information element, then sending the database key is all that is necessary to effectively transmit the information element to the receiver, even if the information element itself is not transmitted between the sender and receiver of the instruction.

[0031] In the context of this specification, the words “first,” “second,” “third,” etc., are used as adjectives solely for the purpose of distinguishing the nouns they modify from one another, and not for the purpose of describing any particular relationship between these nouns. Therefore, for example, it should be understood that the use of the terms “first server” and “third server” is not intended to imply, for example, any particular order, type, chronological order, hierarchy, or ranking of servers / servers, nor is its use (in itself) intended to imply that any “second server” necessarily exists in any given situation. Furthermore, as stated in other contexts herein, references to the elements “first” and “second” do not preclude the two elements from being the same actual real-world element. Thus, for example, in some cases, a “first” server and a “second” server may be the same software and / or hardware, while in other cases they may be different software and / or hardware.

[0032] Various implementations of this technology possess at least one of the aforementioned objectives and / or aspects, but not necessarily all of them. It should be understood that certain aspects of this technology developed in an attempt to achieve the aforementioned objectives may not achieve those objectives, and / or may achieve other objectives not specifically stated herein.

[0033] Additional and / or alternative features, aspects and advantages of the implementation of this technology will become apparent from the following description, the accompanying drawings and the appended claims. Attached Figure Description

[0034] These and other features, aspects, and advantages of this disclosure will be better understood in conjunction with the following description, claims, and accompanying drawings. This disclosure is illustrated by, but not limited to, the accompanying drawings, wherein like numerals denote like elements: Figure 1 This is a schematic diagram of a system based on the implementation method of this technology; Figures 2a to 2c This is a flowchart of messages exchanged between system elements for creating / destroying temporary jobs according to the implementation of this technology; Figure 3 It is a flowchart of messages exchanged between system elements according to the implementation of this technology for users to access web applications and trace certain such messages; Figure 4 This is a flowchart illustrating the steps of the method for implementing this technology; Figure 5 This refers to a computing system that can be used as part of this technology.

[0035] It should also be noted that, unless otherwise expressly stated herein, the accompanying figures may not be drawn to scale. Detailed Implementation

[0036] The examples and conditional language provided herein are intended primarily to help the reader understand the principles of this technology, rather than to limit its scope to these specific examples and conditions. It should be understood that those skilled in the art can devise various arrangements that, while not explicitly described or shown herein, still embody the principles of this technology.

[0037] Furthermore, to aid understanding, the following description may depict a relatively simplified implementation of this technology. Those skilled in the art will understand that various implementations of this technology may involve greater complexity.

[0038] In some cases, useful examples that are considered modifications to the present technology may also be illustrated. This is done merely to aid understanding and, again, is not intended to limit the scope of the present technology or to define its boundaries. These modifications are not an exhaustive list, and other modifications can be made by those skilled in the art, while such other modifications remain within the scope of the present technology. Furthermore, the absence of examples illustrating modifications should not be construed as impossibility of modification and / or as the only way to implement that element of the present technology.

[0039] Furthermore, all statements herein that illustrate the principles, aspects, and implementations of the present technology, and specific examples thereof, are intended to cover their structural and functional equivalents, whether they are currently known or will be developed in the future. Therefore, for example, those skilled in the art will understand that any block diagram herein represents a conceptual view of an illustrative circuit embodying the principles of the present technology. Similarly, it should be understood that any flowchart, diagram, state transition diagram, pseudocode, etc., represents various processes that can be substantially represented in a computer-readable medium and executed by a computer or processor, whether or not such a computer or processor is explicitly shown.

[0040] The functions of the various components shown in the diagram, including any functional modules labeled "processor," "processing unit," "computer," or "computing system," can be implemented using dedicated hardware and hardware capable of executing software in association with appropriate software. When provided by a processor, these functions can be provided by a single dedicated processor, a single shared processor, or multiple independent processors (some of which may share resources). In some implementations of this technology, the processor can be a general-purpose processor, such as a central processing unit (CPU), or it can be a processor dedicated to a specific purpose, such as a digital signal processor (DSP). Furthermore, the explicit use of the term "processor" should not be construed as exclusively referring to hardware capable of executing software, and may implicitly include, but is not limited to, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), flash memory, read-only memory (ROM) for storing software, random access memory (RAM), and non-volatile memory. Other conventional and / or custom hardware may also be included.

[0041] A software module, or simply a module implied as software, may be represented herein as any combination of flowchart elements or other elements indicating the execution of process steps and / or textual descriptions. Such a module may be executed by hardware, whether explicitly or implicitly indicated. Furthermore, it should be understood that a module may include (e.g., but not limited to) computer program logic, computer program instructions, software, protocol stacks, firmware, hardware circuitry, or combinations thereof, capable of providing the required functionality.

[0042] It must be clearly understood that the accompanying drawings only depict illustrative implementations of the present technology. Therefore, the following description is intended only to describe illustrative examples of the present technology. In some cases, useful examples that are considered modifications to the present technology may also be illustrated. This is done solely to aid understanding and, again, is not intended to limit the scope of the present technology or define its boundaries. These modifications are not an exhaustive list, and those skilled in the art will understand that other modifications may be possible. Furthermore, the absence of such a provision (i.e., no example of modification illustrated) should not be construed as impossibility of modification and / or as the only way to implement that element of the present technology. Those skilled in the art should understand that this is unlikely. Additionally, it should be understood that this disclosure may provide simplified implementations of the present technology in certain circumstances, in which case these solutions are presented in this manner to aid understanding. Those skilled in the art should understand that various implementations of the present technology may involve greater complexity.

[0043] With this foundational knowledge in mind, we will now consider some non-restrictive examples to illustrate various implementations of different aspects of this technology.

[0044] Reference Figure 1This diagram illustrates an example of a system suitable for implementing this technology in a non-limiting manner. As those skilled in the art will know, a Kubernetes cluster 100 includes a control plane and a set of worker machines (called nodes) running containerized applications. Worker nodes host Pods, which are components of the application workload. The control plane manages the worker nodes and Pods in the cluster. The control plane contains control plane components that run controller processes, such as: a node controller, which is responsible for detecting node failures and responding; a job controller, which is responsible for monitoring job objects representing one-off tasks and then creating Pods to execute these tasks until completion, and so on.

[0045] The control plane also includes an API server that exposes the Kubernetes API, such as... Figure 1 As shown by reference numeral 101 in the attached diagram. The API server exposes an HTTP API, enabling different parts of the Kubernetes cluster 100 and external components to communicate with each other. The Kubernetes API 101 allows querying and manipulating the state of API objects in the Kubernetes cluster 100. Operations can be performed via a command-line interface or other command-line tools, or via REST calls.

[0046] In this embodiment of the technology, the application router 102, which is a persistent container in the Kubernetes cluster 100, can typically route user devices 136 used by user 135 to the corresponding HTTPS bastion host. i 103 i The messages exchanged between them. User 135 could be, for example, the administrator of infrastructure system 150.

[0047] In implementation, HTTPS bastion host i 103 i It can be implemented as a job in a Kubernetes cluster 100 to enable communication between user device 136 and target web application 120. i Messages are exchanged between them. As described below, portions of certain messages received from user device 136 are sent to target web application 120. i Previously, it might have been blocked by an HTTPS bastion host. i 103 i Rewriting depends specifically on the type of web application the message is used in. Similarly, from web application 120... i Parts of some received responses may also be blocked by the HTTPS bastion host before being sent back to the user device 136. i 103 i Rewrite. For example, Figure 1 Two web applications, 1201 and 1202, are shown, each associated with an HTTPS bastion host, 1031 and 1032, respectively. (HTTPS bastion host) i 103 i Messages between web applications 1201 and 1202 are transmitted via the Egress function 104 of the Kubernetes cluster 100.

[0048] Messages between user equipment 136 and target web applications 1201 and 1202 may be transmitted over a public network 110 (e.g., but not limited to the Internet). For security reasons, firewalls may be implemented, such as firewall 130 between user equipment 136 and application router 102, and firewalls 115 and 116 between public network 110 and web applications 1201 and 1202, respectively. Optionally, single sign-on (SSO) functionality may be added to firewall 130 and integrated via OpenIDConnect (OIDC), Security Assertion Markup Language (SAML), or other mechanisms.

[0049] A library database 145 can be provided, which HTTPS bastion hosts 1031 and 1032 can query to obtain libraries corresponding to the types of target web applications 1201 and 1202, respectively. Then, HTTPS bastion hosts 1031 and 1032 can use the libraries to rewrite portions of certain messages and responses exchanged between web applications 1201 and 1202 and user device 136, respectively.

[0050] In this implementation, the library database 145 does not connect to HTTPS bastion hosts 1031 and 1032, but instead ( Figure 1 (Not shown in the text) Connect to bastion host orchestrator 160: Once the latter bastion host orchestrator 160 learns from the infrastructure system the respective types of web applications 1201 and 1202, it can pass the corresponding libraries to HTTPS bastion hosts 1031 and 1032, enabling them to rewrite parts of certain requests and responses.

[0051] Log system 125 (e.g., but not limited to a Security Information and Event Management System (SIEM)) may be optionally implemented to allow user 140 to access selected messages and activities from HTTPS bastion hosts 1031 and / or 1032, respectively. As illustrated below, HTTPS bastion hosts 1031 and / or 1032 may obfuscate certain information in the selected messages and activities. Log system 125 may collect logs from multiple sources (operating system, applications, etc.) and archive them in a single centralized location. Security log management, event management, and / or information management may be implemented as part of log system 125. Thus, user 140 can monitor login and other event activities, particularly activities initiated by user 135, perform log correlations, and more broadly conduct security analysis and investigation of activities between user 135 and web applications 1201 and / or 1202. Log system 125 may constitute a management layer above the system and security controls of infrastructure system 150. It connects and unifies the contained information, analyzes it, and enables correlation through a single interface.

[0052] Those skilled in the art will understand that the Kubernetes cluster 100 is also equipped with Figure 1 The Ingress function, not shown in the text, is used for communication between the bastion host orchestrator 160, firewall, logging system 125, and library database 145 and elements of the Kubernetes cluster 100 (whether jobs or containers).

[0053] Functionally, user 135 can request administrative access and support for web applications 1201 and / or 1202 from infrastructure system 150 via user device 136. Infrastructure system 150 controls the authentication of user 135's access to web applications 1201 and / or 1202. If access is granted: Infrastructure system 150 can instruct bastion host orchestrator 160 to create corresponding jobs in Kubernetes cluster 100, including HTTPS bastion hosts 1031 and / or 1032 accordingly. For example, bastion host orchestrator 160 can do this via Kubernetes API 101; - Once the Kubernetes job is created: User device 136 can send requests to web applications 1201 and / or 1202 through firewall 130, application router 102, corresponding HTTPS bastion hosts 1031 and / or 1032, and corresponding firewalls 115 and / or 116, and receive responses from them; - The logging system 125 can collect and archive traffic logs via HTTPS bastion hosts 1031 and / or 1032 respectively.

[0054] Bastion host orchestrator 160 may also disrupt operations in Kubernetes cluster 100 upon timeout or upon request. Therefore, HTTPS bastion hosts 1031 and / or 1032 are essentially temporary operations. Optionally, bastion host orchestrator 160 can be implemented as a container in Kubernetes cluster 100.

[0055] HTTPS bastion hosts 1031 and / or 1032 run as Pods on the Kubernetes cluster 100. These jobs can initially set up dedicated configurations for the connection between user device 136 and the corresponding web applications 1201 and / or 1202, including configuring SSO authentication as needed, a list of elements to be anonymized / masked using the logging system 125 (where all request tracking information will be sent), and a rewrite list necessary to ensure user 135 receives a native browsing experience. Therefore, the management web interface of web applications 1201 and / or 1202 is no longer directly accessible; all traffic must pass through the corresponding HTTPS bastion hosts 1031 and / or 1032. The URLs and SSL certificates seen by user 135 in their browser are no longer those of the web interface of web applications 1201 and / or 1202, but rather those of the corresponding HTTPS bastion hosts 1031 and / or 1032. However, the application rendering can be adjusted to display the correct URLs or SSL certificates without requiring corresponding modifications to web applications 1201 and / or 1202. 2。

[0056] Once the job is deployed, a context can be created that allows user 135 to connect to web applications 1201 and / or 1202 via user device 136: - The IP addresses of HTTPS bastion hosts 1031 and / or 1032 must first be trusted by web applications 1201 and / or 1202 respectively; this can be achieved by the owners of web applications 1201 and / or 1202 prior to trusting the IP address of the Egress function 104; - User 135 can receive the URL of HTTPS bastion host 1031 and / or 1032 through user device 136 and open the URL in a browser: this may redirect user 135 to a pre-configured SSO for authentication; in other words, application router 102 is configured to redirect unauthenticated users to SSO. - Once user 135 is authenticated via SSO, their requests will be redirected to HTTPS bastion hosts 1031 and / or 1032. These bastion hosts can then determine, respectively, whether the connection to web applications 1201 and / or 1202 was initiated by the authenticated user, and reject the connection if necessary. This can be achieved by application router 102 receiving a header from SSO informing it which user has been authenticated. This HTTP header is then passed to HTTPS bastion hosts 1031 and / or 1032, which can check if this HTTP header matches an authorized header. HTTPS bastion hosts 1031 and / or 1032, which can act as bastion host orchestrators 160, can provide a list of authorized personnel during initialization. Once user 135 is trusted by HTTPS bastion hosts 1031 and / or 1032, the latter HTTPS bastion hosts 1031 and / or 1032 can accordingly open streams to web applications 1201 and / or 1202, receive requests from user device 136, perform various necessary rewrite operations before sending requests (e.g., but not limited to POST, GET, etc.) to web applications 1201 and / or 1202, receive responses from them, perform various necessary rewrite operations before forwarding the response to user 135's browser, and, as appropriate, forward user 135's requests and corresponding responses to logging system 125.

[0057] Forwarding to the logging system 125 may involve obfuscating information. For example, depending on the configuration of web applications 1201 and / or 1202, a user 135 who logs in via SSO may or may not be authenticated in web applications 1201 and / or 1202. In the case of unauthentication, for obvious security requirements, the login name and password associated with authentication should not be forwarded to the logging system 125 (via session, cookie, etc.).

[0058] Depending on the SSO configuration, for example, an inactivity timeout (e.g., 15 minutes) occurring in the bastion host orchestrator 160 may force the Kubernetes job to be deleted, i.e., delete the instances of HTTPS bastion hosts 1031 and / or 1032. In any case, the instantiation time of HTTPS bastion hosts 1031 and / or 1032 will not exceed the time required for user 135 to perform operations on web applications 1201 and / or 1202.

[0059] Figures 2a to 2c This is a flowchart illustrating the exchange of messages between system elements for creating / destroying temporary jobs, based on the implementation of this technology.

[0060] like Figure 2aAs shown, for example, user 135 wants to access web application 1201. In this case, the message types between elements might be as follows:

[0061] like Figure 2b As shown, for example, user 135 wants to stop accessing web application 1201. In this case, the message types between elements might be as follows:

[0062] like Figure 2c As shown, for example, due to a timeout, access to the web application 1201 will stop regardless of whether user 135 has issued a corresponding request. In this case, the message types between elements might be as follows:

[0063] Figure 3 It is a flowchart of the exchange of messages between system elements for user access to web applications and the tracking of certain such messages according to the implementation of this technology.

[0064] The following provides three scenario / situation examples, along with possible HTTP message content, from which those skilled in the art can deduce other potential scenarios / situations that this technology can successfully address. In the following examples, a portion of the message received by an element is rewritten before being sent to the next element; this portion of the message is indicated by "<------" next to the corresponding message line.

[0065] Login call: In this scenario, user 135 requests to log in to, for example, web application 1201. The actual content of the messages between elements in this case might look like this:

[0066] Table 1 For ease of reading, the following explanation is provided for Table 1 above: - Mark 302: Except for the first GET command, the rest of the message is the same as mark 301; - Markers 304 and 307: In this description, obfuscated message details are limited to the following message elements: (i) User 140 does not need these message elements to perform log correlation, and more broadly, does not need these message elements to perform security analysis and investigation of the activities between User 135 and Web Application 1201; and / or (ii) these message elements raise security concerns, particularly for Web Application 1201, exceeding the thresholds established by Infrastructure System 150, such as webClientSessionId (see messages marked 301-303 in the table below) being consistently obfuscated; and / or (iii) their size is designed such that their processing may overload Log System 125: for example, if a file is uploaded via an HTTP call, the HTTP body size of that call will include the file itself (if not obfuscated), which could result in an excessively large request size.

[0067] Accessing the virtual machine console: In this scenario, user 135 requests to open the virtual machine console, for example, through web application 1201. The actual content of the messages between elements in this case might be as follows:

[0068] Table 2 For ease of reading, the following explanation is provided for Table 2 above: - Mark 302: Except for the first POST command, the rest of the message is the same as mark 301; - For 304 and 307: see the comments on the corresponding messages in Table 1.

[0069] Launch the virtual machine console: In this scenario, user 135 requests to launch the virtual machine console, for example, via web application 1201. The actual content of the messages between elements in this case might be as follows:

[0070] Table 3 For ease of reading, the following explanation is provided for Table 3 above: - Mark 302: Except for the first POST command, the rest of the message is the same as mark 301; - For 304 and 307: see the comments on the corresponding messages in Table 1.

[0071] - Marker 306: The message body is the same as the body of marker 305.

[0072] Regarding the three tables above: - Changes to the HTTP address following GET / POST commands (302, 303) are not rewrites in the sense described in this article: they are merely changes to allow correct communication. Therefore, when a user logs in to the above activities, the user device 136 transmits the HTTP address (301) to the application router 102 through the infrastructure system 150. When the HTTPS bastion host creates the above activities, the application router 102 transmits the HTTP address (302) to the HTTPS bastion host 1031 through the bastion host orchestrator 160. ○ The HTTPS bastion host 1031 transmits an HTTP address (303) to the web application 1201 via regular HTTP communication over the public network 110; for example, the owner of the web application 1201 will have access to the IP address of the Egress function 104 of the Kubernetes cluster 100.

[0073] Furthermore, regarding all three tables and the examples provided above, rewriting operations may affect the headers and / or body of HTTP messages, depending on the reason for the rewriting and the expected outcome: For example, the following rewrite of the header can achieve the following result: ○ Table 3, marked 303: ■ Host: webapp01.tld: Used for interacting with and using web applications; ■ User-Agent: SupportAgent / 1.0: Allows traceability and auditability; ■ VMID: vm-28: Allows tracking of various objects executed by a user identified by the SESSIONID during a session, thereby enabling traceability and auditability; ■ Origin: https: / / webapp01.tld: Used for interacting with and using web applications; ■ Referer: https: / / webapp01.tld / ui / app / vm;nav=v / urn: vmomi:VirtualMachine:vm-1234-4321 / summary: Used for interacting with and using web applications; ○ Table 1, marked 306: ■location: https: / / webapp01.bastion.tld / websso / SAML2 / SSO / vsphere.local?SAMLRequest=HXGSGSXHD: Used for interacting with and using web applications; - For example, the following rewriting of the main text can achieve the following result: ○ Table 2, marked 306: ■ "serverInfo":{"name":"webapp01.bastion.tld", : Used for interacting with and using web applications; ■ "serviceUrl":"https: / / webapp01.bastion.tld:443 / sdk", : Used for interacting with and using web applications; ■ "serviceGuid":"XXX-XXX-XXX-XXX-XXXXX", "thumbprint":"BA:ST:IO:NT:HU:MB:PR:IN:TT:00:00:00:00:00:00:00:00:00:00:00","version":"7.0.3"}}: Used for interacting with and using web applications; More specifically, such as Figure 4 As shown, according to this technology, the method involves the following steps (related to the example above): - In step 401: User equipment 136 requests access to web application 1201 from infrastructure system 150; - In step 402: Access to the web application 1201 is granted by the infrastructure system 150, and the user device 136 sends a request to the HTTPS bastion host 1031; - In step 403: The bastion host orchestrator 160 creates an HTTPS bastion host 1031 based on a request from the infrastructure system 150, the request containing the type of the web application 1201; - In step 404: The HTTPS bastion host 1031 retrieves the library corresponding to the type of the web application 1201 from the library database 145; - In step 405: User equipment 136 sends a request to application router 102, and application router 102 routes the request to HTTPS bastion host 1031; - In step 406: The HTTPS bastion host 1031, based on the obtained library, rewrites the request into a rewritten request and sends the rewritten request to the web application 1201; - In step 407: The HTTPS bastion host 1031 receives a response from the web application 1201; and - In step 408: The HTTPS bastion host 1031, based on the acquired library, rewrites the response into a rewritten response and sends the rewritten response to the application router 102, which then routes the rewritten response to the user device 136.

[0074] This technology enables user devices to centrally access multiple web applications on an infrastructure system. The security of this access is ensured, including through the temporary nature of HTTPS bastion hosts. This technology also enables centralized traceability and auditability of this centralized access.

[0075] Figure 5 A computing system that can be used in this technology is shown, for example, it can be used in... Figure 1 The elements, a subset of elements, or all elements in the system, particularly the bastion host orchestrator 160, the Kubernetes cluster 100, and the library database 145. Those skilled in the art will understand that the computing system can be implemented using any other suitable hardware, software, and / or firmware, or a combination thereof, and can be a single physical entity or multiple independent physical entities with distributed functionality.

[0076] In some aspects of this technology, the computing system 5100 may include various hardware components, such as one or more single-core or multi-core processors (collectively referred to as processors 5101), memory 5103, and input / output interfaces 5104. In this case, processors 5101 may or may not be included in an FPGA. In some other aspects, the computing system 5100 may be an off-the-shelf general-purpose computing system. In some aspects, the computing system 5100 may also be distributed across multiple systems. The computing system 5100 may also be specifically designed to implement this technology. As will be understood by those skilled in the art, various implementations of the computing system 5100 can be conceived without departing from the scope of this technology.

[0077] Communication between the various components of the computing system 5100 can be achieved through one or more internal and / or external buses 5105 (such as PCI bus, Universal Serial Bus, IEEE 1394 FireWire bus, SCSI bus, Serial ATA bus, ARINC bus, etc.), and various hardware components are electronically connected to these buses.

[0078] The input / output interface 5104 can implement networking functions such as wired or wireless access. For example, the input / output interface 5104 may include a networking interface, such as, but not limited to, a network port, a network socket, a network interface controller, etc. Various implementations of the networking interface will be apparent to those skilled in the art.

[0079] Memory 5103 may store code instructions 5108, such as instructions from libraries, applications, etc., which are suitable for loading into memory 5103 and being executed by processor 5101 to implement the methods and process steps according to the present technology. Memory 5103 may also store a database 5109. Those skilled in the art will understand that any of the database 5109, code instructions 5108, and generally memory 5103 may also be physically located outside the computing system 5100, but are still within the scope of the present technology.

[0080] Input / output interface 5104 allows computing system 5100 to communicate with other processors via connection 5110. While the above implementation is described and illustrated with reference to specific steps performed in a particular order, it should be understood that these steps can be combined, subdivided, or reordered without departing from the teachings of this art. At least some of the steps can be performed in parallel or serially. Therefore, the order and grouping of steps are not limitations of this art.

[0081] Modifications and improvements to the above-described implementation of this technology may become apparent to those skilled in the art. The foregoing description is intended to be illustrative and not restrictive. Therefore, the scope of this technology is limited only by the scope of the appended claims.

Claims

1. A method for accessing a web application (1201) accessible via a web interface, the method comprising: - The user equipment (136) requests (401, 201) access to the web application (1201) from the infrastructure system (150); - Access to the Web application (1201) is granted (402) through the infrastructure system (150); - A bastion host orchestrator (160) creates (403, 202, 203) HTTPS bastion host (1031) based on a request from the infrastructure system (150), the request containing the type of the web application (1201); - The HTTPS bastion host (1031) obtains (404) a library corresponding to the type of the web application (1201) from the library database (145); - The user equipment (136) sends (405, 301, 302) requests to the application router (102), and the application router (102) routes the requests to the HTTPS bastion host (1031). - The HTTPS bastion host (1031) rewrites (406) the request into a rewritten request based on the acquired library, and sends (303) the rewritten request to the web application (1201). - The response received (407, 305) from the web application (1201) by the HTTPS bastion host (1031); and - The HTTPS bastion host (1031) rewrites (408) the response into a rewritten response based on the acquired library, sends (306, 308) the rewritten response to the application router (102), and the application router (102) routes the rewritten response to the user equipment (136).

2. The method according to claim 1, further comprising: - Obfuscate the message details in the rewritten request and the rewritten response; - The HTTPS bastion host (1031) sends (304) an obfuscated copy of the rewritten request and / or the rewritten response to the logging system (125).

3. The method according to claim 1 or 2, further comprising: - The bastion host orchestrator sends a list of authorized user devices to the HTTPS bastion host; as well as - The HTTPS bastion host checks whether the user device is in the list by examining the request header. If the user device is not in the list, the request is rejected.

4. The method according to any one of claims 1 to 3, further comprising: - Authenticate the user of the user equipment via SSO (130); - The SSO sends an HTTP header for the authenticated user to the application router; - The application router sends the HTTP header to the HTTPS bastion host; - The HTTPS bastion host checks whether the user has been authenticated by comparing the request header with the received HTTP header. If the user has not been authenticated, the request is rejected.

5. The method according to any one of claims 2 to 4, wherein, The obfuscated message details include the login name and password of the authenticated user.

6. The method according to claim 1, wherein, The web application is one of at least two web applications, wherein the at least two web applications are a first web application and a second web application, and the method further includes: - The user equipment (136) requests (201) access to the second web application (1202) from the infrastructure system (150); - Access to the second web application (1202) is granted by the infrastructure system (150); - The bastion host orchestrator (160) creates (202, 203) a second HTTPS bastion host (1032) based on a request from the infrastructure system (150), the request containing the type of the second web application (1202); - The second HTTPS bastion host (1032) retrieves the library corresponding to the type of the second web application (1202) from the library database (145); - The user equipment (136) sends a second request (301, 302) to the application router (102), and the application router (102) routes the second request to the second HTTPS bastion host (1032). - The second HTTPS bastion host (1032) rewrites the second request into a second rewritten request based on the library obtained that corresponds to the type of the second web application (1202), and sends the second rewritten request (303) to the second web application (1202). - The second response from the second web application (1202) is received by the second HTTPS bastion host (1032); and - The second HTTPS bastion host (1032) rewrites the second response into a second rewritten response based on the library obtained that corresponds to the type of the second web application (1202), sends the second rewritten response (306, 308) to the application router (102), and the application router (102) routes the second rewritten response to the user equipment (136).

7. A system for accessing a web application (1201) accessible via a web interface, the system comprising: - Bastion Host Orchestrator (160); - Application Router (102); - Library-type database; as well as - HTTPS bastion host (1031); - The HTTPS bastion host (1031) is created by the bastion host orchestrator (160) based on a request from the infrastructure system (150) after the user device (136) requests access to the web application (1201) from the infrastructure system (150) and the infrastructure system (150) grants the access, the request from the infrastructure system (150) containing the type of the web application (1201); - The application router (102) is configured to receive requests from the user equipment (136) and route the requests to the HTTPS bastion host (1031), receive rewritten responses from the HTTPS bastion host (1031) and route the rewritten responses to the user equipment (136); and - The HTTPS bastion host (1031) is configured to: - Obtain (404) the library corresponding to the type of the Web application (1201) from the library database (145); - Based on the acquired library, the request received from the application router (102) is rewritten (406) into a rewritten request, and the rewritten request is sent (303) to the web application (1201). - Receive (407, 305) responses from the web application (1201); and - Based on the acquired library, the response is rewritten (408) into a rewritten response, and the rewritten response is sent (306, 308) to the application router (102).

8. The system according to claim 7, wherein, The HTTPS bastion host is also configured to: - Obfuscate the message details in the rewritten request and the rewritten response; - Send (304) an obfuscated copy of the rewritten request and / or the rewritten response to the log system (125).

9. The system according to any one of claims 7 or 8, wherein: - The bastion host orchestrator is also configured to send a list of authorized user devices to the HTTPS bastion host; - The HTTPS bastion host is also configured to check whether the user device is in the list by examining the request header, and to reject the request if the user device is not in the list.

10. The system according to any one of claims 7 to 9, wherein: - The application router is also configured to: receive an HTTP header from the SSO (130) corresponding to a user of the user device authenticated by the SSO, and send the HTTP header to the HTTPS bastion host; as well as - The HTTPS bastion host is also configured to compare the request headers with the received HTTP headers to check whether the user has been authenticated, and if the user has not been authenticated, to reject the request.

11. The system according to any one of claims 8 to 10, wherein, The HTTPS bastion host is also configured to obfuscate message details, including the login name and password of an authenticated user.

12. The system according to any one of claims 7 to 11, wherein, The HTTPS bastion host is a Kubernetes job.

13. The system of claim 7, wherein the system includes a second HTTPS bastion host (1032), the second HTTPS bastion host (1032) being created by the bastion host orchestrator (160) based on a request from the infrastructure system (150) after the user equipment (136) requests access to the second web application (1201) from the infrastructure system (150) and the infrastructure system (150) grants the access, the request from the infrastructure system (150) containing the type of the second web application (1201); - The second HTTPS bastion host (1032) is configured as follows: - Obtain (404) the library corresponding to the type of the second web application (1202) from the library database (145); - Based on the acquired library, the request received from the application router (102) is rewritten (406) into a rewritten request, and the rewritten request is sent (303) to the second web application (1201). - Receive (407, 305) responses from the second web application (1201); and - Based on the acquired library, the second response is rewritten (408) into a rewritten response, and the rewritten response is sent (306, 308) to the application router (102).

14. A computer-readable medium comprising instructions that, when executed by a processing unit, cause the processing unit to perform the method according to any one of claims 1 to 6.

Images