A method and system for connecting cloud platform and bastion host user

Abstract

The present invention relates to a method and system for connecting a cloud platform with a bastion host user, which realizes the access of users between an existing cloud platform and a bastion host. By setting a user status manager, recording the usage status of cloud platform users in a user pool, and recording the number of cloud platform users whose usage status is unused in the user status manager through a user counter, the connection between the cloud platform and the bastion host user is reasonably and efficiently realized. It avoids multiple users using the same cloud platform user at the same time, and based on the restrictions of the cloud platform, it can still ensure that the use of each user does not affect each other, and the number of users opened by the cloud platform is reduced to the greatest extent.

Description

Technical Field

[0001] The present invention relates to the field of user management technology in the information technology industry, and in particular to a method and system for connecting a cloud platform to a bastion host user. Background Art

[0002] The bastion host is an operation and maintenance security audit system, which is widely used in banking systems. The bastion host can be used to implement identity authentication and authorization control of operation and maintenance personnel. All operation and maintenance personnel who need to access the server must first log in to the access server by logging in to the bastion host. The bastion host can record the operations of all management users. The existing bastion host access method does not manage which user to log in to the access system. It only provides a selection interface for users to choose which user to log in.

[0003] Due to the security restrictions of the cloud platform, only one user is allowed to log in to the cloud platform at the same time. When the second person logs in, the system will automatically log out the first person to avoid two people using the same user to log in at the same time. The existing solution is to create a cloud platform user for each person and connect to the bastion host, requiring each person to use only their own cloud platform user to ensure that everyone has one user and each user uses their own cloud platform user when logging in. The existing solution has the following problems: the users of the cloud platform are strongly associated with individuals. When a user joins or leaves the company, the cloud platform must also be manually added and deleted at the same time, which loses the advantage of bastion host access; each enterprise has a large number of employees, and it will be a huge workload to create a cloud platform user for each person. The cost of user management and maintenance is high, and when idle, it also causes a waste of resources. Summary of the invention

[0004] In order to solve the deficiencies of the prior art, the present invention proposes a method and system for connecting users of a cloud platform and a bastion host. The user access between the existing cloud platform and the bastion host is realized, and the use status of the cloud platform users in the user pool is recorded by setting a user status manager, and the number of cloud platform users whose use status is unused in the user status manager is recorded by a user counter, so as to reasonably and efficiently realize the connection between the cloud platform and the bastion host users.

[0005] To achieve the above objectives, a method and system technical solution for connecting a cloud platform with a bastion host user adopted by the present invention includes:

[0006] A method for connecting a cloud platform to a bastion host user, characterized in that it comprises the following steps:

[0007] S1. Create several cloud platform users on the cloud platform and form a user pool with the several cloud platform users;

[0008] S2. Establish a user status manager to record the usage status of cloud platform users in the user pool;

[0009] S3. Establish a user counter to record the number of cloud platform users whose usage status is unused in the user status manager;

[0010] S4. Connect the newly created cloud platform users to the bastion host;

[0011] S5. The user logs in to the bastion host;

[0012] S6. Call the user counter to determine whether there is an available cloud user in the user pool;

[0013] S7. If there is an unused cloud platform user in the user pool, any unused cloud platform user is allocated to the user;

[0014] S8. If there is no unused cloud platform user in the user pool, create a new cloud platform user, add the new cloud platform to the user pool, connect the new cloud platform user to the bastion host, increase the number of unused cloud platform users in the user counter by one, and allocate the new cloud platform user to the user;

[0015] S9, setting the status of the corresponding cloud platform user in the user status manager to used, and reducing the number of unused cloud platform users in the user counter by one;

[0016] S10. After the user exits the bastion host, the status of the corresponding cloud platform user is changed to unused, and the number of the user counter is increased by one.

[0017] Furthermore, the user status manager records the usage status of the cloud platform users in the user pool, marks unused cloud platform users as 0, and marks used cloud platform users as 1.

[0018] Furthermore, the user status manager, when a cloud platform user is assigned to a user, the usage status of the corresponding cloud platform user changes from 0 to 1; when the user exits the bastion host, the usage status of the corresponding cloud platform user changes from 1 to 0.

[0019] Furthermore, the initial value of the user counter is the same as the number of connected cloud platform users.

[0020] Furthermore, when the number of the user counter is greater than or equal to 1, there are available cloud platform users in the user pool.

[0021] The present invention also relates to a cloud platform and bastion host user docking system, which is characterized by comprising:

[0022] Cloud platform user creation module, used to create cloud platform users;

[0023] The user status manager module is used to record the usage status of cloud platform users in the user pool;

[0024] A user counter module is used to record the number of cloud platform users whose usage status is unused in the user status manager;

[0025] User access module, used to allocate cloud platform users to users;

[0026] The user exit module is used to log the user out of the bastion host.

[0027] The present invention also relates to a computer-readable storage medium, characterized in that a computer program is stored on the storage medium, and when the computer program is executed by a processor, the above-mentioned method for connecting a cloud platform with a bastion host user is implemented.

[0028] The present invention also relates to an electronic device, characterized in that it comprises a processor and a memory;

[0029] The memory is used to store the usage status of the cloud platform users in the user pool and the number of cloud platform users whose usage status is unused in the user status manager;

[0030] The processor is used to execute a method for connecting a cloud platform and a bastion host user according to any one of claims 1 to 5 by calling the usage status of cloud platform users in a user pool and data on the number of cloud platform users whose usage status is unused in a user status manager.

[0031] The beneficial effects of the present invention are:

[0032] The method and system for connecting users of the cloud platform and the bastion host of the present invention realizes the access of users between the existing cloud platform and the bastion host. By setting a user status manager, the use status of cloud platform users in the user pool is recorded, and the number of cloud platform users whose use status is unused in the user status manager is recorded through a user counter, so that the connection between the cloud platform and the bastion host users is reasonably and efficiently realized. It avoids multiple users using the same cloud platform user at the same time. Based on the restrictions of the cloud platform, it can still ensure that the use of each user does not affect each other, and the number of users opened by the cloud platform is reduced to the greatest extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 The present invention is a flowchart of a method for connecting a cloud platform to a bastion host user.

[0034] Figure 2 This is a schematic diagram of the structure of a cloud platform and bastion host user docking system of the present invention. DETAILED DESCRIPTION

[0035] In order to more clearly understand the content of the present invention, it will be described in detail with reference to the drawings and embodiments.

[0036] The first aspect of the present invention relates to a process of steps as follows Figure 1 A method for connecting a cloud platform to a bastion host user is shown, including:

[0037] Create several cloud platform users on the cloud platform and form a user pool with the users;

[0038] Taking the full-stack cloud platform as an example, in the initial state, the full-stack cloud opens 10 query users, namely appmon1-appmon10. These 10 users form a user pool.

[0039] Establish a user status manager to record the usage status of cloud platform users in the user pool;

[0040] The user status manager records the usage status of the cloud platform users in the user pool, marks unused cloud platform users as 0, and marks used cloud platform users as 1.

[0041] When a cloud platform user is assigned to a user, the corresponding cloud platform user usage status changes from 0 to 1; when a user exits the bastion host, the corresponding cloud platform user usage status changes from 1 to 0.

[0042] Initially, the usage status of all 10 users is 0.

[0043] A user counter is established to record the number of cloud platform users whose usage status is unused in the user status manager. Initially, the number count of the user counter is 10.

[0044] When the first user usr1 logs in, the user access submodule assigns appmon1 to usr1, and modifies the usage state of appmon1 to 1, and the number count of the user counter is 10-1=9.

[0045] When the second user usr2 logs in, the user access submodule assigns appmon2 to usr2, and modifies the usage state of appmon2 to 1, and the number count of the user counter is 9-1=8.

[0046] …

[0047] When the tenth user usr10 logs in, the user access submodule allocates appmon10 to usr10, and modifies the usage state of appmon10 to 1, and the number count of the user counter is 1-1=0.

[0048] Connect the newly created 10 cloud platform users to the bastion host;

[0049] The user logs in to the bastion host;

[0050] Call the user counter to determine whether there are available cloud platform users in the user pool;

[0051] When the number of the user counter is greater than or equal to 1, there are available cloud platform users in the user pool.

[0052] If there are unused cloud platform users in the user pool, any unused cloud platform user will be allocated to the user;

[0053] If there is no unused cloud platform user in the user pool, a new cloud platform user is created, the new cloud platform is added to the user pool, the new cloud platform user is connected to the bastion host, the number of unused cloud platform users in the user counter is increased by one, and the new cloud platform user is allocated to the user;

[0054] When the eleventh user usr11 logs in, the digital count of the user counter is 0. The user access submodule calls the cloud platform user creation module to create the cloud platform user appmon11, add appmon11 to the bastion host, and add it to the user pool. At this time, the usage status of appmon11 is 0, and the digital count of the user counter is 0+1=1. The user access submodule determines that the digital count of the user counter is 1 again, and the cloud platform user appmon11 is allocated to the user usr11. After the allocation is completed, the usage status of appmon11 is changed to 1, and the digital count of the user counter is 1-1=0.

[0055] When the first user usr1 exits the bastion host, the user exit submodule sets the usage status of usr1 to 0, and the number count of the user counter is 0+1=1.

[0056] By establishing an automatic user scheduling mechanism in the above manner and running it continuously for a period of time, the number of users in the user pool will remain at a stable level and no new users will be added.

[0057] Another aspect of the present invention also relates to a cloud platform and bastion host user docking system, the structure of which is as follows: Figure 2 As shown, including:

[0058] Cloud platform user creation module, used to create cloud platform users;

[0059] The user status manager module is used to record the usage status of cloud platform users in the user pool;

[0060] A user counter module is used to record the number of cloud platform users whose usage status is unused in the user status manager;

[0061] User access module, used to allocate cloud platform users to users;

[0062] The user exit module is used to log the user out of the bastion host.

[0063] By using this system, the above-mentioned operation processing method can be executed and the corresponding technical effects can be achieved.

[0064] An embodiment of the present invention also provides a computer-readable storage medium capable of implementing all the steps in the method in the above embodiment, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, all the steps in the method in the above embodiment are implemented.

[0065] An embodiment of the present invention also provides an electronic device for executing the above-mentioned method, as an implementation device of the method for connecting a cloud platform with a bastion host user. The electronic device has at least a processor and a memory, and in particular, the memory stores data and related computer programs required for executing the method, such as, etc., and the processor calls the data and programs in the memory to execute all the steps of the implementation method, and obtains the corresponding technical effect.

[0066] Preferably, the electronic device may include a bus architecture, the bus may include any number of interconnected buses and bridges, and the bus will include various circuits linked together by one or more processors and memories. The bus may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are all well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the receiver and transmitter. The receiver and transmitter may be the same component, i.e., a transceiver, providing a unit for communicating with various other systems over a transmission medium. The processor is responsible for managing the bus and general processing, while the memory may be used to store data used by the processor when performing operations.

[0067] In addition, the electronic device may further include components such as a communication module, an input unit, an audio processor, a display, and a power supply. The processor (or controller, operation control) used may include a microprocessor or other processor device and / or a logic device, which receives input and controls the operation of various components of the electronic device; the memory may be one or more of a cache, a flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory, or other suitable devices, which may store the above-mentioned related data information, and may also store a program for executing related information, and the processor may execute the program stored in the memory to realize information storage or processing, etc.; the input unit is used to provide input to the processor, for example, it may be a key or a touch input device; the power supply is used to provide power to the electronic device; the display is used to display display objects such as images and text, for example, it may be an LCD display. The communication module is a transmitter / receiver that sends and receives signals via an antenna. The communication module (transmitter / receiver) is coupled to the processor to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal. Based on different communication technologies, multiple communication modules may be provided in the same electronic device, such as a cellular network module, a Bluetooth module and / or a wireless local area network module, etc. The communication module (transmitter / receiver) is also coupled to a speaker and a microphone via an audio processor to provide an audio output via the speaker and receive an audio input from the microphone, thereby realizing a common telecommunication function. The audio processor may include any suitable buffer, decoder, amplifier, etc. In addition, the audio processor is also coupled to a central processor, so that recording can be performed on the machine through the microphone, and the sound stored on the machine can be played through the speaker.

[0068] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0069] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or multiple boxes.

[0070] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction system, which is implemented in the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0071] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps of the functions specified in a box or multiple boxes. Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they know the basic creative concept. Therefore, the attached claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0072] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for connecting a cloud platform to a bastion host user, characterized in that: The steps include: S1. Create several cloud platform users on the cloud platform and form a user pool with the several cloud platform users; S2. Establish a user status manager to record the usage status of cloud platform users in the user pool; S3. Establish a user counter to record the number of cloud platform users whose usage status is unused in the user status manager; S4. Connect the newly created cloud platform users to the bastion host; S5. The user logs in to the bastion host; S6. Call the user counter to determine whether there are available cloud platform users in the user pool; S7. If there is an unused cloud platform user in the user pool, any unused cloud platform user is allocated to the user; S8. If there is no unused cloud platform user in the user pool, create a new cloud platform user, add the new cloud platform to the user pool, connect the new cloud platform user to the bastion host, increase the number of unused cloud platform users in the user counter by one, and allocate the new cloud platform user to the user; S9. After the cloud platform user is assigned to the user, the status of the corresponding cloud platform user in the user status manager is set to used, and the number of unused cloud platform users in the user counter is reduced by one; S10. After the user exits the bastion host, the status of the corresponding cloud platform user is changed to unused, and the number of user counters is increased by one.

2. The method according to claim 1, characterized in that The recording of the usage status of the cloud platform users in the user pool includes marking unused cloud platform users as 0 and marking used cloud platform users as 1.

3. The method according to claim 2, characterized in that When a cloud platform user is assigned to a user, the corresponding cloud platform user usage status changes from 0 to 1; when a user exits the bastion host, the corresponding cloud platform user usage status changes from 1 to 0.

4. The method according to claim 1, characterized in that The initial value of the user counter is the same as the number of connected cloud platform users.

5. The method according to claim 1, characterized in that When the number of the user counter is greater than or equal to 1, there are available cloud platform users in the user pool.

6. A cloud platform and bastion host user docking system, used to execute the method according to any one of claims 1 to 5, characterized in that: include: Cloud platform user creation module, used to create cloud platform users; The user status manager module is used to record the usage status of cloud platform users in the user pool; A user counter module is used to record the number of cloud platform users whose usage status is unused in the user status manager; User access module, used to allocate cloud platform users to users; The user exit module is used to log the user out of the bastion host.

7. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements a method for connecting a cloud platform and a bastion host user according to any one of claims 1 to 5.

8. An electronic device, characterized in that: including a processor and a memory; The memory is used to store the usage status of the cloud platform users in the user pool and the number of cloud platform users whose usage status is unused in the user status manager; The processor is used to execute a method for connecting a cloud platform and a bastion host user according to any one of claims 1 to 5 by calling the usage status of cloud platform users in a user pool and data on the number of cloud platform users whose usage status is unused in a user status manager.

Images