Data transmission method and related apparatus

Abstract

The embodiment of the application provides a data transmission method and related device, which are applied to the field of communication. The method comprises the following steps: a first device logs in a bastion host through ssh; the first device receives and responds to a first operation for selecting a second device from a plurality of device identifiers, and establishes a communication connection with the second device through the bastion host. The first device receives a shortcut key command and sends the shortcut key command to a session management module of the bastion host. The bastion host converts the shortcut key command into a control command, and interacts with the second device according to the control command to obtain a service address of a server corresponding to the second device. The first device accesses the server according to the service address from the bastion host to download data in the second device or upload data to the second device through the server. In this way, the service address for file transmission is obtained on the bastion host through the shortcut key command, and file transmission is realized through the service address. This method is simple to operate, convenient for file transmission, small in resource occupation, and low in governance cost.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to data transmission methods and related apparatus. Background Technology

[0002] A bastion host is a device used in a specific network environment to monitor and record user actions on servers, network devices, security devices, and databases within the network, using various technical means to protect the network and data from intrusion and damage from external and internal users. This allows for centralized alarms, timely handling, and auditing to determine responsibility.

[0003] To ensure the security of the production network and data, there is network isolation between the office network and the production network. The office network needs to connect to the production network through a bastion host. When operations and maintenance personnel, as well as R&D personnel, remotely operate the equipment servers on the production network, they frequently need to use upload and download functions to obtain data such as logs, programs, and files from the equipment on the production network. Currently, the data upload and download functions are implemented using the Secure File Transfer Protocol (SFTP) based on the bastion host.

[0004] However, this method requires a service to support SFTP, which is complex to implement, cumbersome to operate, and costly to manage. Furthermore, when using the SFTP service, there are two secure shell (SSH) channels; the SFTP service requires a dedicated SSH channel, resulting in significant resource consumption. Summary of the Invention

[0005] This application proposes a data transmission method and related apparatus. A browser link is obtained on a bastion host via a shortcut key command, and files are uploaded and / or downloaded through this browser link. This method is simple to operate, making file uploading and / or downloading more convenient. It does not require a separate SSH channel, has low resource consumption, and low management costs.

[0006] In a first aspect, embodiments of this application provide a data transmission method, comprising: a first device logging into a bastion host via a secure shell SSH and displaying multiple device identifiers; the first device receiving a first operation for selecting a second device from the multiple device identifiers; in response to the first operation, the first device establishing a communication connection with the second device through the bastion host; the first device receiving a shortcut key command generated based on a user-triggered shortcut key; the first device sending the shortcut key command to the session management module of the bastion host, wherein the shortcut key command is used by the bastion host to convert the shortcut key command into a control command for the second device based on the session management module, and by the bastion host to interact with the second device according to the control command to obtain the service address of the server corresponding to the second device; the first device receiving the service address from the bastion host; and the first device accessing the server according to the service address to download data from the second device through the server, or to upload data to the second device through the server.

[0007] In this way, the service address for file transfer can be obtained on the bastion host via keyboard shortcuts, and file transfer can be achieved through the service address. This method is easy to implement, simple to operate, and facilitates file transfer. It does not require establishing an SSH channel for file transfer, has low resource consumption, and low management costs.

[0008] Optionally, the first device accesses the server based on the service address to download data from or upload data to the second device, including: the first device displays a page corresponding to the service address, the page including an upload control and multiple download links; when the first device receives a second operation on the upload control, the first device uploads data to the server; when the first device receives a third operation on any one of the multiple download links, the first device downloads the data corresponding to that download link from the server.

[0009] In this way, file transfer via upload controls and download links is simple and convenient.

[0010] Optionally, before the first device displays the page corresponding to the service address, the process further includes: the first device entering the service address in the browser, and entering the page corresponding to the server address based on the trigger.

[0011] Optional shortcut keys include: a single key on the keyboard, a combination of multiple keys on the keyboard, or a preset gesture operation.

[0012] In this way, keyboard shortcuts can improve operation speed and efficiency.

[0013] Secondly, embodiments of this application provide a data transmission method, including: a bastion host implementing login to a first device based on SSH; the bastion host's session management module receiving shortcut commands from the first device, the shortcut commands being generated based on shortcuts triggered by a user on the first device; the bastion host converting the shortcut commands into control commands for a second device based on the session management module; the bastion host interacting with the second device according to the control commands to obtain the service address of the server corresponding to the second device; the bastion host sending the service address to the first device; and the bastion host recording data downloaded by the first device from the second device through the server, or data uploaded by the first device to the second device through the server.

[0014] Optionally, the bastion host interacts with the second device according to control commands to obtain the service address of the server corresponding to the second device, including: the bastion host sending control commands to the second device, which the second device executes the control commands to obtain the service address.

[0015] Optionally, the control command is the curl command, which includes the server's domain name.

[0016] This makes it easier for the second device to connect to the server.

[0017] Optionally, when the first device downloads data from the second device via the server, or uploads data to the second device via the server, the server is also used to store the downloaded or uploaded data in the full-text search engine for auditing purposes.

[0018] This way, uploaded and downloaded data are recorded, and the content of file transfers is documented, making it easier for subsequent auditing.

[0019] Optionally, the server can also be used to reject the first device's download of data from the second device, or to upload data to the second device, based on the pre-set IP address or directory name of the second device.

[0020] This approach restricts the uploading and downloading of certain data, reducing management risks and improving security.

[0021] Thirdly, embodiments of this application provide a data transmission device applied to a first device, the data transmission device comprising: a processing unit and a display unit.

[0022] The processing unit is used to log in to the bastion host via SSH through a secure shell; the display unit is used to display multiple device identifiers; the processing unit is also used to receive a first operation for selecting a second device from the multiple device identifiers; the processing unit is also used to establish a communication connection between the bastion host and the second device in response to the first operation; the processing unit is also used to receive a shortcut key command generated based on a user-triggered shortcut key; the processing unit is also used to send the shortcut key command to the session management module of the bastion host, the shortcut key command is used by the bastion host to convert the shortcut key command into a control command for the second device based on the session management module, and is used by the bastion host to interact with the second device according to the control command to obtain the service address of the server corresponding to the second device; the processing unit is also used to receive the service address from the bastion host; the processing unit is also used to access the server according to the service address, so as to download data from the second device through the server, or upload data to the second device through the server.

[0023] Optionally, the display unit is specifically used to display the page corresponding to the service address, the page including: an upload control and multiple download links; the processing unit is also used to upload data to the server when a second operation is received for the upload control; the processing unit is also used to download the data corresponding to any one of the multiple download links from the server when a third operation is received for any one of the download links.

[0024] Optionally, the processing unit is also used to input the service address in the browser and, based on the trigger, enter the page corresponding to the server address.

[0025] Optionally, keyboard shortcuts include: a single key on the keyboard, a combination of multiple keys on the keyboard, or a pre-set gesture.

[0026] Fourthly, embodiments of this application provide a data transmission device applied to a bastion host. The data transmission device includes a processing unit and a session management module.

[0027] The processing unit is used to log in to the first device based on SSH; the session management module is used to receive shortcut commands from the first device, which are generated based on the shortcuts triggered by the user on the first device; the processing unit is used to convert the shortcut commands into control commands for the second device based on the session management module; the processing unit is also used to interact with the second device according to the control commands to obtain the service address of the server corresponding to the second device; the session management module is also used to send the service address to the first device; the processing unit is also used to record the data downloaded by the first device from the second device through the server, or the data uploaded by the first device to the second device through the server.

[0028] Optionally, the processing unit is also used to send control commands to the second device, so that the second device can execute the control commands to obtain the service address.

[0029] Optionally, the control command is the curl command, which includes the server's domain name.

[0030] Optionally, when the first device downloads data from the second device via the server, or uploads data to the second device via the server, the server is also used to store the downloaded or uploaded data in the full-text search engine for auditing purposes.

[0031] Optionally, the server can also be used to reject the first device's download of data from the second device, or to upload data to the second device, based on the pre-set IP address or directory name of the second device.

[0032] Fifthly, embodiments of this application provide an electronic device, including: a memory and a processor. The memory is used to store program instructions; the processor is used to call and execute the program instructions in the memory to perform the method described above.

[0033] Sixthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any of the above claims. Attached Figure Description

[0034] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of the embodiments of this application.

[0035] Figure 1 This is a schematic diagram of an application scenario provided by an embodiment of this application;

[0036] Figure 2 A flowchart illustrating module interaction during the establishment of a file transfer service, provided as an embodiment of this application;

[0037] Figure 3 A schematic diagram illustrating module interaction during file transfer, provided as an embodiment of this application;

[0038] Figure 4 A flowchart illustrating a data transmission method provided in an embodiment of this application;

[0039] Figure 5 This is a schematic diagram of the structure of a data transmission device provided in an embodiment of this application;

[0040] Figure 6 This is a schematic diagram of the structure of a data transmission device provided in an embodiment of this application;

[0041] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0042] The accompanying drawings have illustrated specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the embodiments of this application in any way, but rather to illustrate the concepts of the embodiments of this application to those skilled in the art through reference to specific examples. Detailed Implementation

[0043] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this application as detailed in the appended claims.

[0044] To facilitate a clear description of the technical solutions in the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish identical or similar items with essentially the same function and purpose. For example, the first user interface and the second user interface are used to distinguish different response interfaces, and their order is not limited. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and the terms "first" and "second" are not necessarily different.

[0045] It should be noted that, in this application, the terms "exemplary" or "for example" are used to indicate that something is being described as an example, illustration, or illustration. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0046] With the development of the internet, the security of information and data has become increasingly important. Against this backdrop, bastion host (also known as a bastion server) technology, capable of preventing and auditing internal personnel's access to and operation of terminals, has emerged. Bastion hosts can protect networks and data from intrusion and damage from both external and internal users.

[0047] For example, the office network is the office network of an industrial enterprise, used for daily work in a non-production environment. The production network is the network of the industrial enterprise's production environment, which has higher requirements for data security and environmental stability.

[0048] For security reasons, a secure isolation exists between the office network and the production network. The office and production networks are connected via a bastion host for data transmission. After a terminal on the office network connects to the bastion host, maintenance personnel, R&D personnel, and auditors can remotely operate devices on the production network through the office network devices. These personnel may frequently use upload and download functions to retrieve logs, programs, and files from the production network devices.

[0049] Currently, bastion hosts implement upload and download functions via the SFTP or Zmodem protocols.

[0050] The SFTP protocol allows for the uploading and downloading of logs, programs, and files, as well as the recording of these uploads and downloads. However, SFTP requires setting up a server that supports it, which is complex and costly to implement. Furthermore, using SFTP requires establishing a secure shell (SSH) channel for uploading and downloading, which is cumbersome and resource-intensive.

[0051] The Zmodem protocol enables fast upload and download speeds for transmitting logs, programs, and files via streaming. Specifically, maintenance personnel, developers, and auditors can upload and download using keyboard shortcuts (rz and sz, etc.). However, the Zmodem protocol requires the installation of the lrzsz package, which has limitations on the terminal, and it does not record the upload and download of logs, programs, and files, nor does it offer auditing functionality.

[0052] Based on this, embodiments of this application provide a data transmission method and related apparatus. The method involves obtaining the service address of a corresponding server on a bastion host via shortcut key commands, and then accessing the server through that service address to upload and / or download files. This approach is easy to implement and simple to operate, making file uploads and / or downloads more convenient. It does not require an SSH channel for file transfer, resulting in low resource consumption and low management costs. Furthermore, the server can record file uploads and / or downloads, enabling auditing functionality.

[0053] The methods and related apparatuses provided in this application can be applied to systems including a first network, a bastion host, and a second network. The first network and the second network are securely isolated. The first network includes one or more first devices, and the second network includes one or more second devices. The first and second devices are connected via a bastion host. Users can remotely upload files and logs, etc., to and / or download files and logs, etc., from the second device using the first device.

[0054] The first device can be a terminal device with input and display functions. A terminal device can also be called a terminal, user equipment (UE), mobile station (MS), mobile terminal (MT), etc. Terminal devices can be mobile phones, smart TVs, wearable devices, tablets, computers with wireless transceiver capabilities, virtual reality (VR) terminal devices, augmented reality (AR) terminal devices, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical surgery, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, etc. This application does not limit the specific technology or device form used in the first device.

[0055] The second device can be a terminal device, such as a mobile phone, smart TV, wearable device, tablet computer, computer with wireless transceiver capabilities, virtual reality (VR) terminal device, augmented reality (AR) terminal device, wireless terminal in industrial control, wireless terminal in self-driving, wireless terminal in remote medical surgery, wireless terminal in smart grid, wireless terminal in transportation safety, wireless terminal in smart city, wireless terminal in smart home, etc. This application does not limit the specific technology or form of the second device.

[0056] Figure 1 This is a schematic diagram illustrating an application scenario provided in an embodiment of this application. Figure 1 The system includes a first device 101, a bastion host 102, and a second device 103. Multiple first devices 101 form a first network, and multiple second devices 103 form a second network. The first network and the second network are isolated from each other and connected through the bastion host 102.

[0057] For example, the first network can be an office network, and the second network can be a production network. Users can remotely control devices on the production network from devices on the office network via a bastion host. Users can be testers, operations and maintenance personnel, developers, etc.

[0058] Users can connect to bastion host 102 via first device 101, thereby establishing a session connection with second device 103. Users log into the user interface on first device 101, which then connects to bastion host 102. When first device 101 receives a shortcut operation from the user indicating data transfer, bastion host 102 detects the shortcut operation instruction and replaces it with a data transfer control command, sending it to second device 103. Second device 103 executes the data transfer control command, invoking the file transfer (uploader) service. Bastion host 102 detects the result of the invocation from second device 103 and sends a browser link for data transfer to first device 101. First device 101 uses this browser link to perform data transfer, enabling data upload and / or download. The data may include files, logs, and programs, etc.

[0059] For example, the first network can be an office network, and the second network can be a production network. Users can upload data from computers or other devices on the office network to devices on the production network via a bastion host, or download data from devices on the production network via a bastion host.

[0060] The following example illustrates the process of establishing an upload service and uploading / downloading files, using the first network as an office network and the second network as a production network.

[0061] Figure 2 This is a flowchart illustrating the module interaction process during the establishment of a file transfer service, as provided in an embodiment of this application. Figure 2 As shown, it includes: office network equipment 201, bastion host 202, target device 203, server 204 and database 205.

[0062] Office network device 201 logs into the session processing module of bastion host 202 via SSH and displays multiple device identifiers. The device identifier can be the device's IP address or device name, etc., and is not limited here.

[0063] Office network device 201 receives and responds to the first operation, which is used to select the target device identifier. Office network device 201 establishes an SSH session connection with target device 203 through bastion host 202. It should be noted that the session processing module also includes a pseudo-terminal master and a pseudo-terminal slave. The pseudo-terminal master and pseudo-terminal slave can be a pair of character devices. For example, the master can be a file descriptor in memory, and the slave can be a file in the / dev / pts / directory. The session processing module accesses the corresponding file through the file descriptor.

[0064] Understandably, the pseudo-terminal is provided by a terminal emulator, which is an application running in user space. The master end is closer to hardware devices such as the monitor and keyboard, while the slave end is connected to a command-line interface (CLI) program running on the virtual terminal.

[0065] For example, the session processing module can forward data written by the master (e.g., keyboard, etc.) to the slave (program) for input, or the session processing module can forward data written by the slave (program) to the master (e.g., display driver, etc.) for reading.

[0066] The following describes the interactions between modules during the upload service setup process.

[0067] The session processing modules of S201 and bastion host 202 detect the input operation received by office network device 201. The input operation is used to instruct the start of file transfer service.

[0068] In this embodiment, the input operation can be a user's shortcut operation. Shortcut operations can include keyboard input, touch operation, drag-and-drop operation, gesture-triggered operation, and / or mouse click operation. Users can establish upload / download connections through any of the following operation instructions: keyboard input shortcut commands, specific gestures, and / or mouse click shortcut keys.

[0069] For example, a user's keyboard shortcut could be Ctrl+X. This shortcut is simple, reduces user input time, and improves efficiency.

[0070] It should be noted that the session processing module of the bastion host 202 can automatically detect user input operations when the user performs read and write operations through the master end of the pseudo terminal.

[0071] S202 and bastion host 202 replace input operations with control commands and forward them to target device 203. The control commands are used to instruct the initiation of file transfer service.

[0072] For example, when the bastion host 202 detects that the input operation received by the office network device 201 is Ctrl+X, it replaces Ctrl+X with the control command `curl -s up.bastion.jd.com / file / up|bash` and sends it to the command line of the target device 203. Here, up.bastion.jd.com is the domain name of the file transfer service (uploader service), and the target device 203 can access the service address of the server 204 through the domain name.

[0073] S203, the command line of the target device 203 executes control commands, calls the reverse proxy (Nignx) service through server 204, and matches the up processing module of server 204.

[0074] In this embodiment, server 204 is used to implement the uploader service. Server 204 includes Nignx service and upload processing module.

[0075] It should be noted that the Nignx service can match different content through different function bodies to implement different processing logic. One possible implementation is that the target device 203 executes a control command (e.g., a curl command) to call the Nignx service on server 204, and uses Nignx's location matching mechanism to match the up processing module corresponding to the target device 203.

[0076] For example, the up processing module of the target device 203 can be the up processing module under the file of the server 204.

[0077] The up processing module of S204 and server 204 calls the local location matching mechanism of the Nignx service to obtain the Internet Protocol address (IP address) and available port of the target device 203.

[0078] For example, if the initial available port value is 39123, the up processing module executes the Linux command `ss -nltp "(sport=39123)"|grep LISTEN`. When the command finds that port 39123 is occupied, the initial port value is incremented by 1 until an available port value is found.

[0079] S205: The Nginx service passes the IP address and available port of the target device 203 to a matching custom function, which generates a unique random value as a key.

[0080] S206, the up processing module of server 204 transmits the key to the file service module of target device 203.

[0081] Accordingly, the file service module of target device 203 starts the Hypertext Transfer Protocol (HTTP) service. The HTTP service can retrieve the list of files that can be browsed on target device 203 by calling the GET method, and can download and upload files to target device 203 by calling the POST method.

[0082] The up processing module of S207 and server 204 stores the key and the IP and available port of the target device 203 into the Redis database.

[0083] S208, the bastion host 202 detected the key received by the file service module of the target device 203.

[0084] In one possible implementation, the command line of target device 203 displays the service address carrying the key as a browser link on the display screen of target device 203. Bastion host 202 detects the display on target device 203 and transmits the browser link to office network device 201.

[0085] The display screen can show "Please open the following link in your browser: http: / / up.bastion.jd.com / x / 7082098f09b91677db / " where 7082098f09b91677db is the key value.

[0086] S209 and bastion host 202 transmit the service address carrying the key to office network device 201.

[0087] In one possible implementation, the bastion host 202 displays the service address carrying the key as a browser link on the display screen of the office network device 201.

[0088] Office network device 201 and target device 203 can upload and download data such as files and logs using a key.

[0089] Figure 3 This is a flowchart illustrating module interaction during file transfer, as provided in an embodiment of this application. Figure 3 As shown, it includes: office network equipment 301, target equipment 303, server 304, database 305, and full-text search engine.

[0090] The interaction between modules is explained below.

[0091] S301 and office network device 301 receive and respond to the second input operation, which instructs the browser to open a link. Adaptively, the browser accesses the Nignx service on server 204.

[0092] In one possible implementation, office network device 301 receives a user copying a browser link into their browser. Office network device 301 then establishes a file service connection with target device 303 via server 204.

[0093] The Nignx service on servers S302 and 304 passes the key value to the up processing module through the matching function in its location.

[0094] The S303 and up processing modules transmit the key to the Redis database.

[0095] S304, the Redis database outputs the IP address and available port of the corresponding target device 303.

[0096] The S305 up processing module triggers the file service of the target device 303 based on the IP address and available port of the target device 303.

[0097] Understandably, the up processing module can obtain the file list on the target device 303 by calling the get method, and can download and upload files to the target device 303 by calling the post method.

[0098] Adaptively, the up processing module of server 304 forwards the file list obtained from target device 303 to office network device 301. Server 304 can also forward data uploaded by office network device 301 to target device 203, thereby enabling office network device 301 to upload and download via a browser.

[0099] The S306 up processing module records user-uploaded and downloaded content and writes it into the full-text search engine (elaticsearch) in the form of logs.

[0100] Understandably, auditors and others can use full-text search engines to audit and query logs.

[0101] In summary, the above method establishes a connection between office network devices and production network devices through a bastion host and obtains a browser link for the upload service. R&D personnel and operations and maintenance personnel can control the uploading and downloading of data through this browser link, enabling frequently used upload and download operations. Furthermore, the upload and download process can be recorded during use, facilitating backtracking and problem identification by auditors. The method provided in this application not only improves convenience during use but also provides auditing functionality.

[0102] This method is simple to operate, making file uploading and / or downloading more convenient. It does not require a separate SSH channel, consumes few resources, and has low management costs.

[0103] In one possible implementation, the up-processing module in server 304 can also be configured to block access from office network device 301 based on the device's IP address and directory name. For example, when office network device 301 uploads data to the corresponding device or directory name via server 304, the data upload is blocked; or when office network device 301 downloads data from the corresponding device or directory name via server 304, the download is blocked. This prevents office network device 301 from accessing certain devices or files, thereby achieving the function of risk control.

[0104] The above Figure 2 and Figure 3 The interaction between the office network and the production network during data transmission is explained below. The data transmission method is described in detail below.

[0105] Figure 4 This is a flowchart illustrating a data transmission method provided for an embodiment of this application. Exemplarily, the data transmission method includes:

[0106] S401. The first device logs into the bastion host via SSH through a secure shell and displays multiple device identifiers.

[0107] In this embodiment of the application, the first device is used to upload or download data such as files and logs according to user operations.

[0108] In this embodiment, the device identifier is used to indicate a device. Each device corresponds to one device identifier. The device identifier can be the device's IP address or the device's name. This embodiment does not limit this.

[0109] S402, the first device receives and responds to the first operation, the first device establishes a communication connection with the second device through the bastion host, wherein the first operation is used to select the second device from a plurality of device identifiers.

[0110] In this embodiment of the application, the second device is used to receive data uploaded by the first device, or to provide data downloaded by the first device.

[0111] S403, The first device receives a shortcut key command generated based on the user-triggered shortcut key.

[0112] In this embodiment of the application, shortcut keys are used to improve operation speed. Shortcut keys can be one or a combination of keys on the keyboard, or they can be specific gesture operations.

[0113] In this embodiment, the shortcut key command is used to indicate data transmission.

[0114] In one possible implementation, the shortcut key is Ctrl+X. When the user inputs Ctrl+X via the keyboard, the first device receives the shortcut key command.

[0115] S404: The bastion host detects a shortcut key command and replaces it with a control command, forwarding it to the second device.

[0116] In one possible implementation, the bastion host uses the session management module to convert shortcut key commands into control commands for the second device and then sends the control commands to the second device.

[0117] In this embodiment, the control command is used to instruct the establishment of a file transfer service connection. The control command may include the address of the file transfer (uploader) server.

[0118] In one possible implementation, when the shortcut key is Ctrl+X, the bastion host replaces Ctrl+X with the command `curl -s up.bastion.jd.com / file / up|bash`. The second device then accesses the server used for file transfer (uploader) via the domain name up.bastion.jd.com.

[0119] S405. The second device executes a control command to obtain the service address of the server corresponding to the second device.

[0120] Understandably, the second device executes control commands to access the server used for file transfer and obtain the service address.

[0121] In this embodiment, the service address of the server corresponding to the second device is represented as a browser link.

[0122] Specifically, the uploader service generates a unique key value by calling the Nignx service and using its location matching mechanism, and then passes the key value as a browser link to the second device.

[0123] S406, the bastion host sends the service address back to the first device.

[0124] Adaptively, the first device receives the service address from the bastion host.

[0125] In one possible implementation, the bastion host provides feedback to the browser linking to the first device. For example, the browser link is displayed on the first device's screen.

[0126] S407. The first device accesses the server according to the service address to download data from the second device through the server, or to upload data to the second device through the server.

[0127] In one possible implementation, the first device receives and responds to the user's action of opening the service address through a browser. The first device's interface displays the page corresponding to the service address, which includes an upload control and multiple download links. When the first device receives a second action for the upload control, the first device uploads data to the server; the server forwards the uploaded data from the first device to the second device. When the first device receives a third action for any one of the multiple download links, the first device receives data from the server corresponding to that download link from the second device.

[0128] In summary, when the first device and the second device communicate through a bastion host, the bastion host can replace the shortcut key commands entered by the user on the first device and forward them to the second device to trigger an upload service command. The bastion host then sends the service address (browser link) obtained by the second device from executing this command back to the first device. The first device then accesses the server based on the service address (browser link) to upload and download data.

[0129] Optionally, the server can log the data transmission behavior. This facilitates subsequent querying and auditing.

[0130] For example, the server's up processing module records data uploaded from the first device to the second device or downloaded from the second device by the first device, and writes this data to a full-text search engine (elaticsearch) in the form of logs. This makes it convenient for auditors to audit and query the logs through the full-text search engine later.

[0131] Optionally, the server may restrict data transfer in the second device based on the identifier of the second device or the directory name of a file in the second device.

[0132] Data transmission includes uploading data to a second device or downloading data from a second device.

[0133] Understandably, browsers can restrict access to second devices by setting restrictions on IP addresses or directory names, thus blocking downloads. This way, during data transmission, access can be denied to users based on pre-defined IP addresses or directory names, thereby reducing security risks.

[0134] According to another aspect of the embodiments of this application, the embodiments of this application also provide a data transmission apparatus, applied to a first device, such as... Figure 5 As shown, the data transmission device includes a processing unit 11 and a display unit 21.

[0135] Processing unit 11 is used to log in to the bastion host via a secure shell SSH; display unit 21 is used to display multiple device identifiers; processing unit 11 is also used to receive a first operation for selecting a second device from the multiple device identifiers; processing unit 11 is also used to establish a communication connection with the second device through the bastion host in response to the first operation; processing unit 11 is also used to receive a shortcut key command generated based on a user-triggered shortcut key; processing unit 11 is also used to send the shortcut key command to the session management module of the bastion host, the shortcut key command is used by the bastion host to convert the shortcut key command into a control command for the second device based on the session management module, and is used by the bastion host to interact with the second device according to the control command to obtain the service address of the server corresponding to the second device; processing unit 11 is also used to receive the service address from the bastion host; processing unit 11 is also used to access the server according to the service address, so as to download data from the second device through the server, or upload data to the second device through the server.

[0136] Optionally, the display unit 21 is specifically used to display the page corresponding to the service address, the page including: an upload control and multiple download links; the processing unit 11 is also used to upload data to the server when a second operation is received for the upload control; the processing unit 11 is also used to download the data corresponding to any one of the multiple download links from the server when a third operation is received for any one of the download links.

[0137] Optionally, the processing unit 11 is also used to input the service address in the browser and to enter the page corresponding to the server address based on the trigger.

[0138] Optionally, keyboard shortcuts include: a single key on the keyboard, a combination of multiple keys on the keyboard, or a pre-set gesture.

[0139] According to another aspect of the embodiments of this application, the embodiments of this application also provide a data transmission device applied to a bastion host, such as... Figure 6 As shown, the data transmission device includes a processing unit 31 and a session management module 41.

[0140] Processing unit 31 is used to log in to the first device based on SSH; session management module 41 is used to receive shortcut commands from the first device, which are generated based on the shortcuts triggered by the user on the first device; processing unit 31 is used to convert the shortcut commands into control commands for the second device based on the session management module; processing unit 31 is also used to interact with the second device according to the control commands to obtain the service address of the server corresponding to the second device; session management module 41 is also used to send the service address to the first device; processing unit 31 is also used to record the data downloaded by the first device from the second device through the server, or the data uploaded by the first device to the second device through the server.

[0141] Optionally, the processing unit 31 is also configured to send a control command to the second device, so that the second device can execute the control command to obtain the service address.

[0142] Optionally, the control command is the curl command, which includes the server's domain name.

[0143] Optionally, when the first device downloads data from the second device via the server, or uploads data to the second device via the server, the server is also used to store the downloaded or uploaded data in the full-text search engine for auditing purposes.

[0144] Optionally, the server can also be used to reject the first device's download of data from the second device, or to upload data to the second device, based on the pre-set IP address or directory name of the second device.

[0145] The data transmission device of this embodiment can be used to execute the method of any of the above embodiments. Its implementation principle and technical effect are similar, and will not be described again here.

[0146] According to another aspect of the embodiments of this application, an electronic device is also provided, including: a memory and a processor;

[0147] Memory is used to store processor-executable instructions;

[0148] When executing instructions in memory, the processor is configured to implement the method as described in any of the above embodiments.

[0149] Please see Figure 7 , Figure 7 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application.

[0150] like Figure 7 As shown, the electronic device includes a processor 131 and a memory 132.

[0151] The processor 131 executes computer execution instructions stored in the memory, causing the processor 131 to perform the scheme in the above embodiments.

[0152] Processor 131 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by software instructions. The processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The steps of the method claimed in the embodiments of this application can be directly implemented by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0153] The memory 132 stores computer-executed instructions and may include random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Optionally, the device may also include a system bus 133, through which the memory 132 can be connected to the processor 131 and communicate with it, using the Internet, wide area network, local area network, metropolitan area network, etc.

[0154] System bus 133 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. System buses can be divided into address buses, data buses, control buses, etc. For ease of representation, only one thick line is used in the diagram, but this does not indicate that there is only one bus or one type of bus.

[0155] For example, the electronic device includes a terminal device, which can be referred to the description of the first device above, and will not be repeated here.

[0156] According to another aspect of the embodiments of this application, the embodiments of this application also provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods of any of the above embodiments.

[0157] Readers should understand that in the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0158] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the above-described apparatus and unit can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0159] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0160] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments of this application, depending on actual needs.

[0161] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0162] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned computer-readable medium may include RAM, ROM, compact disc read-only memory (CD-ROM) or other optical disc storage, disk storage or other magnetic storage devices, or any other medium targeted for storage or in the form of instructions or data structures, and may store the required program code and be accessible by a computer. Furthermore, any connection is appropriately referred to as a computer-readable medium. For example, if software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of media. As used herein, disks and optical discs include optical discs, laser discs, optical discs, digital versatile discs (DVDs), floppy disks, and Blu-ray discs, where disks typically reproduce data magnetically, while optical discs optically reproduce data using lasers. Combinations of the above should also be included within the scope of computer-readable media.

[0163] It should also be understood that, in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0164] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data transmission method, characterized in that, include: The first device logs into the bastion host via SSH through a secure shell and displays multiple device identifiers; The first device receives a first operation for selecting a second device from the plurality of device identifiers; In response to the first operation, the first device establishes a communication connection with the second device through the bastion host; The first device receives a shortcut key command generated based on the user-triggered shortcut key; The first device sends the shortcut key command to the session management module of the bastion host. The shortcut key command is used by the bastion host to convert the shortcut key command into a control command for the second device based on the session management module, and by the bastion host to interact with the second device according to the control command to obtain the service address of the server corresponding to the second device. The control command is used to instruct the establishment of a file transfer service connection. The service address is a browser link. The browser link is generated by the file transfer service by calling the Nignx service in the server corresponding to the second device and matching the local rules of the Nignx service. The first device receives the service address from the bastion host; The first device accesses the server based on the service address to download data from the second device or upload data to the second device through the server.

2. The method according to claim 1, characterized in that, The first device accesses the server based on the service address to download data from the second device or upload data to the second device, including: The first device displays a page corresponding to the service address, the page including: an upload control and multiple download links; When the first device receives a second operation on the upload control, the first device uploads data to the server; When the first device receives a third operation for any one of the multiple download links, the first device downloads the data corresponding to the any one download link from the server.

3. The method according to claim 2, characterized in that, Before the first device displays the page corresponding to the service address, it also includes: The first device enters the service address in the browser and is triggered to enter the page corresponding to the server address.

4. The method according to any one of claims 1-3, characterized in that, The shortcut keys include: a single key on the keyboard, a combination of multiple keys on the keyboard, or a pre-set gesture operation.

5. A data transmission method, characterized in that, include: The bastion host enables login for the first device via SSH; The bastion host's session management module receives shortcut key commands from the first device, which are generated based on shortcut keys triggered by the user on the first device; The bastion host converts the shortcut key commands into control commands for the second device based on the session management module. The bastion host interacts with the second device according to the control command to obtain the service address of the server corresponding to the second device. The control command is used to instruct the establishment of a file transfer service connection. The service address is a browser link. The browser link is generated by the file transfer service by calling the Nignx service in the server corresponding to the second device and matching the local rules of the Nignx service. The bastion host sends the service address to the first device; The bastion host records the data downloaded by the first device to the second device through the server, or the data uploaded to the second device through the server.

6. The method according to claim 5, characterized in that, The bastion host interacts with the second device according to the control commands to obtain the service address of the server corresponding to the second device, including: The bastion host sends the control command to the second device, which is used by the second device to execute the control command to obtain the service address.

7. The method according to claim 6, characterized in that, The control command is the curl command, and the control command includes the domain name of the server.

8. The method according to claim 6, characterized in that, When the first device downloads data from the second device through the server, or uploads data to the second device through the server, the server is also used to store the downloaded or uploaded data in a full-text search engine for auditing purposes.

9. The method according to claim 6, characterized in that, The server is also configured to, based on a pre-set IP address or directory name of the second device, reject the first device's download of data from the second device, or upload data to the second device.

10. A data transmission device, characterized in that, include: The processing unit is used to log in to the bastion host via SSH through a secure shell; The display unit is used to display multiple device identifiers; The processing unit is also configured to receive a first operation for selecting a second device from the plurality of device identifiers; The processing unit is also configured to, in response to the first operation, establish a communication connection with the second device through the bastion host; The processing unit is also configured to receive shortcut key commands generated based on user-triggered shortcut keys; The processing unit is further configured to send the shortcut key command to the session management module of the bastion host. The shortcut key command is used by the bastion host to convert the shortcut key command into a control command for the second device based on the session management module, and by the bastion host to interact with the second device according to the control command to obtain the service address of the server corresponding to the second device. The control command is used to instruct the establishment of a file transfer service connection. The service address is a browser link. The browser link is generated by the file transfer service through calling the Nignx service in the server corresponding to the second device and matching the Nignx service locally. The processing unit is also configured to receive the service address from the bastion host; The processing unit is also configured to access the server according to the service address, so as to download data from the second device through the server, or upload data to the second device through the server.

11. A data transmission device, characterized in that, include: The processing unit is used to enable login to the first device based on SSH. The session management module is used to receive shortcut key commands from the first device, the shortcut key commands being generated based on the user triggering shortcut keys in the first device; The session management module is also used to convert the shortcut key commands into control commands for the second device; The processing unit is further configured to interact with the second device according to the control command to obtain the service address of the server corresponding to the second device. The control command is used to instruct the establishment of a file transfer service connection. The service address is a browser link. The browser link is generated by the file transfer service by calling the Nignx service in the server corresponding to the second device and matching the local rules of the Nignx service. The processing unit is further configured to send the service address to the first device; The processing unit is also used to record the first device downloading data from the second device through the server, or uploading data to the second device through the server.

12. An electronic device, characterized in that, include: Memory, used to store program instructions; A processor for calling and executing program instructions in the memory to perform the method as described in any one of claims 1-4, or to perform the method as described in any one of claims 5-9.

13. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the method as described in any one of claims 1-4, or performs the method as described in any one of claims 5-9.

Images