Fortress machine distribution method and device, storage medium and electronic equipment

Abstract

The application discloses a distribution method and device of a bastion host, a storage medium and an electronic device. The method comprises the following steps: obtaining a service access request of a target client, wherein the service access request carries address information of a target server where service data to be accessed is located; in the case that sensitive level indication information matched with the address information of the target server is found, determining a target bastion host type matched with the sensitive level indication information; obtaining state parameters of each bastion host in a bastion host set corresponding to the target bastion host type; determining a target bastion host from the bastion hosts according to the state parameters; and distributing the target bastion host to the target client, so that the target client accesses the target server through the target bastion host. The application solves the technical problem that the manual selection of the bastion host is relatively complex.

Description

Technical Field

[0001] This application relates to the field of computers, and more specifically, to a method and apparatus for allocating bastion hosts, a storage medium, and electronic equipment. Background Technology

[0002] When performing operation and maintenance management on all server data, in order to protect network data from intrusion and damage from external or internal objects, bastion hosts are often configured on the servers to defend against network attacks.

[0003] Currently, a common application of bastion hosts is that users choose different bastion hosts to access servers based on their needs. For example, ordinary users typically choose a general-purpose bastion host to log in to non-sensitive business servers, while special users such as operations and maintenance personnel typically choose a sensitive bastion host to log in to sensitive business servers. However, when manually selecting different bastion hosts, users cannot always remember the corresponding bastion hosts for servers with different sensitivity levels. This can easily lead to incorrect selections and inability to access the server, forcing users to repeatedly perform the selection process to try and choose the correct bastion host.

[0004] In other words, the manual selection method for bastion hosts provided by the relevant technologies has the problem of being relatively complicated to operate.

[0005] There is currently no effective solution to the above problems. Summary of the Invention

[0006] This application provides a method and apparatus for allocating bastion hosts, a storage medium, and an electronic device, to at least solve the technical problem that the manual selection method for bastion hosts provided by related technologies is relatively complex to operate.

[0007] According to one aspect of the embodiments of this application, a method for allocating a bastion host is provided, comprising: obtaining a service access request from a target client, wherein the service access request carries address information of a target server where the service data to be accessed is located; determining a target bastion host type that matches the sensitivity level indication information if a sensitivity level indication information matching the address information of the target server is found; obtaining the status parameters of each bastion host in a set of bastion hosts corresponding to the target bastion host type; determining the target bastion host from the bastion hosts based on the status parameters; and allocating the target bastion host to the target client so that the target client can access the target server through the target bastion host.

[0008] According to another aspect of the embodiments of this application, a bastion host allocation device is also provided, comprising: a first acquisition unit, configured to acquire a service access request from a target client, wherein the service access request carries address information of a target server where the service data to be accessed is located; a first determination unit, configured to determine a target bastion host type matching the sensitivity level indication information if a sensitivity level indication information matching the address information of the target server is found; a second acquisition unit, configured to acquire the status parameters of each bastion host in a bastion host set corresponding to the target bastion host type; a second determination unit, configured to determine the target bastion host from the bastion hosts based on the status parameters; and an allocation unit, configured to allocate the target bastion host to the target client, so that the target client accesses the target server through the target bastion host.

[0009] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, wherein a computer program is stored in the computer program, and the computer program is configured to execute the above-described bastion host allocation method when running.

[0010] According to another aspect of the embodiments of this application, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the aforementioned bastion host allocation method.

[0011] According to another aspect of the embodiments of this application, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above-described bastion host allocation method through the computer program.

[0012] In this embodiment, the following steps are taken: A business access request from a target client is obtained; if a sensitivity level indication matching the address information of the target server is found, the target bastion host type matching the sensitivity level indication is determined; the status parameters of each bastion host in the bastion host set corresponding to the target bastion host type are obtained; the target bastion host is determined from the bastion hosts based on the status parameters; and the target bastion host is assigned to the target client, enabling the target client to access the target server through the target bastion host. In this method, by finding the sensitivity level indication matching the address information of the target server, the target bastion host type matching the sensitivity level indication is determined. This allows the target client to access the target server through the target bastion host belonging to the target bastion host type. Users no longer need to manually select different bastion hosts to access the corresponding servers, reducing the operational complexity of accessing different servers and improving the efficiency of server access. This solves the technical problem of the complex operation of manually selecting bastion hosts in related technologies. Attached Figure Description

[0013] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0014] Figure 1 This is a schematic diagram of an application environment for an optional bastion host allocation method according to an embodiment of this application;

[0015] Figure 2 This is a flowchart of an optional bastion host allocation method according to an embodiment of the present invention;

[0016] Figure 3 This is a flowchart of another optional bastion host allocation method according to an embodiment of the present invention;

[0017] Figure 4 This is a schematic diagram of an optional bastion host allocation method according to an embodiment of the present invention;

[0018] Figure 5 This is a flowchart of another optional bastion host allocation method according to an embodiment of the present invention;

[0019] Figure 6 This is a schematic diagram of another optional bastion host allocation method according to an embodiment of the present invention;

[0020] Figure 7 This is an architecture diagram of another optional bastion host allocation method according to an embodiment of the present invention;

[0021] Figure 8This is a schematic diagram of the structure of an optional bastion host distribution device according to an embodiment of this application;

[0022] Figure 9 This is a schematic diagram of the structure of an optional electronic device according to an embodiment of this application. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] First, some nouns or terms that appear in the description of the embodiments of this application shall be interpreted as follows:

[0026] CMDB (Configuration Management Database): A configuration management database used for configuring and querying all server data managed by operations and maintenance personnel, including server IP, MAC, operating system, and the business module to which the server belongs. CMDB stores various configuration information for managing devices in an enterprise's IT architecture. It is closely linked to all service support and service delivery processes, supporting the operation of these processes, realizing the value of configuration information, and relying on related processes to ensure data accuracy.

[0027] Bastion host: In a specific environment, in order to protect the network and data from intrusion and damage from external and internal users, it uses various technical means to monitor and record the operation behavior of maintenance personnel on servers, network devices, security devices, databases and other devices in the network, so as to centralize alarms, handle them in a timely manner and audit and assign responsibility.

[0028] Central processing unit (CPU): As the core of a computer system for computation and control, it is the final execution unit for information processing and program execution.

[0029] According to one aspect of the embodiments of this application, a method for allocating a bastion host is provided. Optionally, as an optional implementation, the above-described method for allocating a bastion host can be applied to, but is not limited to, [examples of other methods]. Figure 1 The bastion host allocation system in the environment shown.

[0030] The bastion host's allocation system may include, but is not limited to, terminal device 102, network 104, server 106, database 108, target bastion host 110, and target server 112. The terminal device 102 runs a target client. The terminal device 102 includes a human-machine interface screen, a processor, and a memory. The human-machine interface screen displays the target client's business access interface and login server interface; it also provides a human-machine interface to receive human-machine interaction operations. The processor generates interaction instructions in response to the human-machine interaction operations and sends these instructions to the server. The memory stores relevant data, such as the correspondence between the target server's address information and sensitivity level indication information, and the status parameters of each bastion host.

[0031] Furthermore, server 106 includes a processing engine for performing store or read operations on database 108. Specifically, the processing engine reads relevant data from database 108, determines the target bastion host type matching the sensitivity level indication information, and then returns the target bastion host identifier determined based on status parameters to terminal device 102. This enables the target client on terminal device 102 to obtain the target bastion host identifier and access the target server through the target bastion host. Then, server 106 also obtains the login result of the target server returned by the terminal device and stores it in database 108.

[0032] Optionally, in this embodiment, the terminal device can be a terminal device configured with a target client, which may include, but is not limited to, at least one of the following: mobile phone (such as Android phone, iOS phone, etc.), laptop computer, tablet computer, PDA, MID (Mobile Internet Devices), PAD, desktop computer, smart TV, etc. The target client may be a video client, instant messaging client, browser client, educational client, etc. The network may include, but is not limited to, wired network and wireless network, wherein the wired network includes: local area network, metropolitan area network and wide area network, and the wireless network includes: Bluetooth, WIFI and other networks that enable wireless communication. The server may be a single server, a server cluster composed of multiple servers, or a cloud server.

[0033] The specific process is as follows: As in step S102, the service access request is sent to server 106 via network 104. On server 106, steps S104 to S112 are executed: The service access request from the target client is obtained, wherein the service access request carries the address information of the target server where the service data to be accessed is located; if a sensitivity level indication information matching the address information of the target server is found, the target bastion host type matching the sensitivity level indication information is determined; the status parameters of each bastion host in the bastion host set corresponding to the target bastion host type are obtained; the target bastion host is determined from each bastion host based on the status parameters; the target bastion host is assigned to the target client so that the target client can access the target server through the target bastion host. Then, as in step S114, the target bastion host identifier assigned to the target client is sent to terminal device 102 via network 104. Further, terminal device 102 accesses target server 112 through the obtained identifier of target bastion host 110. The above is merely an example, and no limitations are made in this embodiment.

[0034] It should be noted that, in this embodiment, the process involves: obtaining the target client's service access request; determining the target bastion host type that matches the sensitivity level indication information after finding the address information of the target server; obtaining the status parameters of each bastion host in the bastion host set corresponding to the target bastion host type; determining the target bastion host from among the bastion hosts based on the status parameters; and assigning the target bastion host to the target client so that the target client can access the target server through the target bastion host. In this method, the target bastion host type is determined by finding the sensitivity level indication information that matches the address information of the target server. This allows the target client to access the target server through the target bastion host of the target bastion host type. Users no longer need to manually select different bastion hosts to access the corresponding servers, reducing the operational complexity of accessing different servers and improving the efficiency of server access. This solves the technical problem of the complex operation of manually selecting bastion hosts in related technologies.

[0035] Alternatively, as an optional implementation, such as Figure 2 As shown, the above-mentioned bastion host allocation method includes:

[0036] S202, Obtain the business access request from the target client, wherein the business access request carries the address information of the target server where the business data to be accessed is located;

[0037] Optionally, in this embodiment, multiple service modules or custom IP group information can be configured for various types of bastion hosts, and then the information of various types of bastion hosts can be entered into the bastion host type table. This achieves the purpose of defining different bastion host types according to the sensitivity of the server. The aforementioned service access requests may include, but are not limited to, requests for users to access servers containing sensitive services and requests for users to access servers containing non-sensitive services; the services involved in this embodiment may include, but are not limited to, IT services, financial services, education services, and medical services. The address information of the aforementioned target server may include, but is not limited to, the target server's IP address information, MAC address information, and serial number information.

[0038] S204, if a sensitivity level indication information matching the address information of the target server is found, determine the type of the target bastion host that matches the sensitivity level indication information;

[0039] Optionally, in this embodiment, the aforementioned sensitivity level indication information may include, but is not limited to, whether the business data to be accessed by the business access request is sensitive data or whether the business data to be accessed by the business access request is non-sensitive data. The process of finding sensitivity level indication information that matches the address information of the target server may include, but is not limited to, searching by the business module to which the target server's address information belongs, or searching by the address group to which the target server's address information belongs. The aforementioned target bastion host type may include, but is not limited to, the sensitive bastion host type of the IT department's operations and maintenance module, or the sensitive bastion host type of the financial department.

[0040] S206, Obtain the status parameters of each bastion host in the bastion host set corresponding to the target bastion host type;

[0041] Optionally, in the embodiments of this application, the above-mentioned status parameters may be, but are not limited to, the online status, load status, and memory status of each bastion host in the bastion host set corresponding to the target bastion host type.

[0042] S208, determine the target bastion host from each bastion host based on the status parameters;

[0043] Optionally, in the embodiments of this application, the process of determining the target bastion host from each bastion host based on the status parameters described above can be determined, but is not limited to, through the online status and load of each bastion host.

[0044] S210 assigns the target bastion host to the target client so that the target client can access the target server through the target bastion host.

[0045] Optionally, in this embodiment, the process of assigning the target bastion host to the target client can be implemented, but is not limited to, by sending the target bastion host's identification information, such as its IP address, MAC address, and serial number, to the target client. The target server can be, but is not limited to, a cloud server or a physical server. The process of accessing the target server can include, but is not limited to, logging into the target server and requesting data from the target server. The following embodiments use logging into the server as an example for illustration.

[0046] It should be noted that in this embodiment, the business data to be accessed by the target client is exemplified by IT business data, and the target server is exemplified by the server owned by the IT business department's operations and maintenance module. The IT business access request carries the IP address information of the target server where the data of the IT business department's operations and maintenance module resides. After obtaining the access request from the target client to access the IT business department's operations and maintenance module, the IP address information of the target server carried in the access request is determined. Based on the IP address information of the target server, the business module to which the target server belongs is located. Based on the sensitivity level indication information of the business module to which the target server belongs, the type of the target bastion host is determined. Then, based on the online status and load of each bastion host in the bastion host set corresponding to the target bastion host type, the target bastion host is determined. The service IP address of the target bastion host is then returned to the target client, enabling the target client to access the target server through the target bastion host.

[0047] Combination Figure 3The following describes the bastion host allocation method: Effective modules can be pre-configured for Type A and Type B bastion hosts in the bastion host type table. Specifically, the effective modules configured for Type A bastion hosts include the IT department's operations and maintenance modules. The effective modules configured for Type B bastion hosts are the financial department's IP address groups. After completing the module configuration, the target servers and target bastion host types are matched. For servers matching these business modules and IP groups, a bastion host of the corresponding business module and IP group type is allocated. When a target client needs to access the target server of the IT business department's operations and maintenance module, authentication is required. As shown in step S302, the target client sends a business access request carrying the target server's IP address to the authentication server. The authentication server is used to allocate a bastion host of the corresponding bastion host type to the target server. Then, as shown in step S304, the authentication server searches for the target server's business module based on the IP address information of the target server of the IT business department's operations and maintenance module. As shown in step S306-1, the authentication server determines the bastion host type of the target server based on the found IT business department's operations and maintenance module. As shown in steps S306-21, if the authentication server cannot find the business module to which the target server belongs, it will find the custom group to which the target server's IP address belongs based on the target server's IP address information. As shown in step S306-22, the authentication server will determine the bastion host type of the target server based on the custom group to which the target server's IP address belongs. Then, as shown in step S308, the authentication server will query each bastion host instance in the corresponding bastion host set based on the target bastion host type—IT business sensitive bastion host type. As shown in step S310, the authentication server will check the online status of each bastion host in the bastion host set. As shown in step S312, the authentication server will select an available bastion host based on the number of online users and load of each bastion host instance in the online bastion host set. As shown in step S314, the authentication server will send the IP address or MAC address of the available bastion host to the target client, so that the target client can access the target server of the IT business department's operation and maintenance module through this available bastion host.

[0048] The above Figure 3 As an optional example, this application embodiment does not impose any limitations on the sensitivity level indication information or the status parameters of each bastion host.

[0049] In this embodiment, the following steps are taken: A business access request from a target client is obtained; if a sensitivity level indication matching the address information of the target server is found, the target bastion host type matching the sensitivity level indication is determined; the status parameters of each bastion host in the bastion host set corresponding to the target bastion host type are obtained; the target bastion host is determined from the bastion hosts based on the status parameters; and the target bastion host is assigned to the target client, enabling the target client to access the target server through the target bastion host. In this method, by finding the sensitivity level indication matching the address information of the target server, the target bastion host type matching the sensitivity level indication is determined. This allows the target client to access the target server through the target bastion host belonging to the target bastion host type. Users no longer need to manually select different bastion hosts to access the corresponding servers, reducing the operational complexity of accessing different servers and improving the efficiency of server access. This solves the technical problem of the complex operation of manually selecting bastion hosts in related technologies.

[0050] As an optional approach, if sensitivity level indication information matching the target server's address information is found, the target bastion host type matching the sensitivity level indication information can be determined as follows:

[0051] S1, based on the address information of the target server, find the target business module to which the target server belongs;

[0052] S2, if the target business module is found, determine the sensitivity level information configured for the target business module;

[0053] S3, take the sensitivity level information of the target business module as the sensitivity level indication information, and determine the type of bastion host created for the sensitivity level information of the target business module as the target bastion host type that matches the sensitivity level indication information.

[0054] It should be noted that CMDB services can be used to synchronize information from all servers to a single data table. This server information includes: IP address information, MAC address information, and information about the business module to which the server belongs. The business module of a server can be determined based on its department and the different levels of business it handles (e.g., sensitive cloud services, non-sensitive on-premises services). The target business module can include, but is not limited to, the IT department's operations and maintenance module, the IT department's optimization strategy module, and all business modules of the medical department. (For example, the business data in the IT department's optimization strategy module is non-sensitive data.) The sensitivity level information can include, but is not limited to, indicating whether the business data in the target business module is sensitive or non-sensitive. The bastion host type can include, but is not limited to, sensitive bastion host types for the IT department's operations and maintenance module and sensitive bastion host types for the medical department.

[0055] For example, such as Figure 4 As shown, server information can be synchronized using the CMDB service (402 error). Specifically, based on the server's organizational structure (e.g., the IT department), sensitive groups (e.g., all business modules in the medical department are sensitive groups), and the different levels of business modules, it is determined that the server's business module is an on-premises module of the IT business department, not a cloud-based module of the IT business department. When a target client requests access to the on-premises module of the IT business department, based on the target server's IP address information carried in the target client's business access request, and according to the correspondence between the server's IP address information and the business module as indicated in the CMDB module information table, the target business module of the target server is determined to be an on-premises module of the IT business department. Assuming that the business data in the on-premises module of the IT business department is sensitive data, the sensitive bastion host type of the on-premises module under the IT department created for the sensitive data in the on-premises module is determined as the target bastion host type.

[0056] The embodiments provided in this application, when the target business module to which the target server belongs is located, use the sensitivity level information of the target business module as sensitivity level indication information, and determine the bastion host type created for the sensitivity level information of the target business module as the target bastion host type that matches the sensitivity level indication information. This achieves the determination of the bastion host type matched by the target server that matches a specific business module, improving the efficiency of determining the bastion host type matched by the target server. Furthermore, it solves the technical problem of selection errors caused by manually selecting the bastion host type in the prior art.

[0057] As an optional approach, after locating the target business module to which the target server belongs based on its address information, the following steps are also included:

[0058] S1, if the target business module is not found, find the target address group to which the target server's address belongs based on the target server's address information;

[0059] S2, take the sensitivity level information of the target address group as sensitivity level indication information, and determine the bastion host type created for the sensitivity level information of the target address group as the target bastion host type that matches the sensitivity level indication information.

[0060] It should be noted that custom IP address groups can be defined, and the grouping information for each IP address can be entered into a custom IP group table. The aforementioned target address groups can include, but are not limited to, groups of IP addresses or groups of IP address ranges. If there are many IP addresses belonging to the same IP range, the IP range can be directly specified. The sensitivity level information for the aforementioned target address groups can include, but is not limited to, indicating that the business data in the target address group is sensitive data or that the business data in the target address group is non-sensitive data. The aforementioned bastion host types include, but are not limited to, sensitive bastion host types for IT department operations and maintenance modules, sensitive bastion host types for medical departments, and sensitive bastion host types for IP group 1. For example: Server IP1, Server IP2, and Server IP3 are pre-assigned to IP group 1 in the custom IP group table. When a target client requests access to Server IP1, based on the IP address information of Server IP1 carried in the target client's business access request, and according to the correspondence between the server's IP address information and the IP group information indicated in the custom IP group table, the target address group to which the target server belongs is determined to be IP group 1. Assuming the business data in IP packet 1 is sensitive data, we will create a sensitive bastion host type for IP packet 1 and identify it as the target bastion host type.

[0061] The embodiments provided in this application, when the target service module is not found, determine the target address group to which the target server's address belongs based on the target server's address information; use the sensitivity level information of the target address group as sensitivity level indication information, and determine the bastion host type created for the sensitivity level information of the target address group as the target bastion host type that matches the sensitivity level indication information. This achieves the goal of determining the bastion host type matched by the target server that matches a specific target address group, thereby automatically allocating the appropriate type of bastion host to the target client based on the target server's address. This further expands the methods for determining the bastion host type matched by the target server and improves the efficiency of automatically matching the target bastion host type for the target client.

[0062] As an optional approach, determining the target bastion host from among the various bastion hosts based on status parameters includes:

[0063] S1, Based on the status parameters, obtain the candidate bastion hosts that are in an available state among each bastion host;

[0064] S2, determine the target bastion host from the candidate bastion hosts.

[0065] It should be noted that the aforementioned status parameters may include, but are not limited to, the current number of online users and the current load of each bastion host. The aforementioned availability status may include, but is not limited to, a combination of the following: the bastion host is online, the number of online users on the bastion host has not reached the upper limit, or both. The aforementioned methods for determining the target bastion host from the candidate bastion hosts may include, but are not limited to: 1) randomly selecting a bastion host from the candidate bastion hosts that are in an available state; 2) sending the list of candidate bastion hosts to the target client, allowing the target client to select a bastion host; 3) weighted summing of the scores of each status parameter of the candidate bastion hosts to obtain a score result for the status of each candidate bastion host, and then selecting a bastion host based on the score result.

[0066] For example, after obtaining the current number of online users and the current load of the target bastion host set corresponding to the target bastion host type, bastion hosts whose current number of online users and current load have not reached their maximum number of online users and maximum load are identified as candidate bastion hosts in an available state. Further, assume that the ratio of the current number of online users to the maximum number of online users for candidate bastion host a is 10%, and the ratio for candidate bastion host b is 90%. Also, the ratio of the current load to the maximum load for candidate bastion host a is equal to the ratio for candidate bastion host b. Therefore, there is a greater probability that candidate bastion host a will be selected as the target bastion host.

[0067] The embodiments provided in this application obtain candidate bastion hosts that are in an available state from among various bastion hosts based on status parameters; and determine the target bastion host from the candidate bastion hosts. This achieves the goal of filtering out candidate bastion hosts in an available state based on the status parameters of each bastion host, and then determining the target bastion host. This improves the flexibility and rationality of selecting the target bastion host, and increases the reliability of the target bastion host selection.

[0068] As an optional approach, candidate bastion hosts that are in an available state can be obtained from each bastion host based on their status parameters, including:

[0069] S1, Based on the online status parameters in the status parameters, determine the bastion host that is in an online state;

[0070] S2, based on the load status parameter in the status parameters, determine the current load and load limit of each bastion host that is online;

[0071] S3, the bastion host whose current load has not yet reached the load limit.

[0072] It should be noted that the above status parameters may include, but are not limited to, the online status of each bastion host, the maximum number of online users, the current number of online users, and load status parameters. The above load limit may be, but is not limited to, manually configured. The above current load may include, but is not limited to, the CPU load and memory usage of the bastion host; the following explanation uses CPU load as the current load. The above methods for determining candidate bastion hosts may include, but are not limited to: 1) the ratio of the current CPU load to the CPU load limit; 2) the ratio of the current number of online users to the maximum number of online users.

[0073] For example, after identifying the target bastion host type that matches the target server, when determining the target bastion host from the candidate bastion hosts, first determine whether each bastion host in the bastion host set is online, then determine the current load and load limit indicated by the load status parameters of each online bastion host. Furthermore, determine the current number of online users and the maximum number of online users for each online bastion host. Assuming that both bastion hosts a and b are online, and the ratio of the current CPU load to the CPU load limit for bastion host a is less than 100%, while the ratio for bastion host a has reached 100%, then bastion host a, whose current CPU load has not yet reached the CPU load limit, is identified as a candidate bastion host.

[0074] Another way to determine candidate bastion hosts is as follows: Assume that both bastion hosts a and b are online, and the ratio of the current number of online users to the maximum number of online users for bastion host a is less than 100%, while the ratio of the maximum number of online users to the maximum number of online users for bastion host a is 100%. Then, bastion host a, whose maximum number of online users has not yet reached the maximum number of online users, is identified as a candidate bastion host.

[0075] The embodiments provided in this application determine online bastion hosts based on online status parameters in the status parameters; they also determine the current load and load limit of each online bastion host based on load status parameters in the status parameters; and they identify bastion hosts whose current load has not yet reached the load limit as candidate bastion hosts. This achieves the identification of candidate bastion hosts based on the load status parameters indicated by the status parameters of the bastion hosts in the bastion host set. If the current load of a candidate bastion host has reached its load limit, that bastion host is not considered a candidate bastion host to avoid its crash. This improves the flexibility and rationality of candidate bastion host selection, and increases the reliability and operability of the selection process.

[0076] As an optional approach, before obtaining the target client's business access request, the following steps are also included:

[0077] S1, obtain server information of multiple servers to be managed, including the target server among the multiple servers, and the server information includes the server's address information;

[0078] S2, configure business module information for each server, including the sensitivity level information of the business module;

[0079] S3 creates a bastion host type that matches the sensitivity level for business modules that belong to the same sensitivity level as determined by the sensitivity level information.

[0080] It should be noted that services with different sensitivity levels require access through different bastion hosts. Therefore, different bastion host types need to be created for service modules with different sensitivity levels, and these bastion host types will take effect on the configured service modules. The server information of the multiple servers to be managed mentioned above may include, but is not limited to, IP address information, MAC address information, and information about the service module to which they belong. The address information of the servers mentioned above may include, but is not limited to, the IP address information and MAC address information of the target server. The service module information mentioned above may include, but is not limited to, the IT department's operation and maintenance service module, the IT department's optimization strategy module, and all service modules of the medical department. The sensitivity level information of the service modules mentioned above may include, but is not limited to, indicating that the business data in the service module is sensitive data or non-sensitive data. The sensitivity level mentioned above may include, but is not limited to, sensitive level and non-sensitive level. The bastion host type mentioned above may include, but is not limited to, IT service-specific bastion host type, IT service-specific sensitive bastion host type, and IT service-specific non-sensitive bastion host type.

[0081] For example, such as Figure 5As shown, server information, including IP address, MAC address, and business module information, can be pre-entered into the CMDB module information table using the CMDB service. Assume that server IP1 and server IP2 both belong to business module 1. In the business module information of each business module, the business data in business modules 1 and 2 is sensitive data, while the business data in business module 3 is non-sensitive data. For business modules 502 (including business modules 1 and 2) of the same sensitivity level determined by the sensitivity level information, an IT business-specific sensitive bastion host type is created. Business modules 1 and 2 are identified as business modules under the IT business-specific sensitive bastion host type. Furthermore, for business module 3, which belongs to the non-sensitive level determined by the sensitivity level information, an IT business-specific non-sensitive bastion host type is created. Business module 3 is identified as a business module under the IT business-specific non-sensitive bastion host type. When a target client needs to access server IP1, the bastion host under the IT business-specific sensitive bastion host type is automatically returned to the client during client authentication, allowing the client to automatically log in to server IP1 through the bastion host under the IT business-specific sensitive bastion host type.

[0082] The embodiments provided in this application obtain server information for multiple servers to be managed before acquiring a business access request from a target client. Among these servers is the target server, and the server information includes the server's address information. Business module information is configured for each server, including the sensitivity level information of the business module. For business modules belonging to the same sensitivity level as determined by the sensitivity level information, a bastion host type matching the sensitivity level is created. This achieves the configuration of business module information for each server and the creation of bastion host types matching the sensitivity level. Consequently, users do not need to manually select different bastion hosts to log in to the target server based on the business type, enhancing security and ease of use. It also improves the efficiency of user access to the target server. Furthermore, when a user logs in to the server on the target client, even if the server's sensitivity level changes or the number or type of bastion hosts changes, the user will not be aware of any changes; the user will be automatically assigned a target bastion host, enhancing maintainability.

[0083] As an optional solution, it also includes:

[0084] S1, when the configuration result for configuring business module information for the server indicates configuration failure, an address group is created based on the server's address information, wherein the address group is configured with sensitivity level information;

[0085] S2, for address groups belonging to the same sensitivity level as determined by the sensitivity level information, create a bastion host type that matches the sensitivity level.

[0086] It should be noted that if the server is not configured in the CMDB module information table or if the sensitivity level cannot be distinguished by the business module, an address group can be created for the IP addresses of servers with the same sensitivity level. Custom IP address groups can be defined, and the grouping information for each IP address can be entered into a custom IP group table. The aforementioned address groups can include, but are not limited to, groups of IP addresses or groups of IP address ranges. When there are many IP addresses belonging to the same IP range, the IP range can be specified directly. The sensitivity level information configured in the aforementioned address groups can include, but is not limited to, indicating that the business data in the target address group is sensitive data or that the business data in the target address group is non-sensitive data. The aforementioned bastion host type includes, but is not limited to, the sensitive bastion host type dedicated to the financial sector. The aforementioned sensitivity levels can include, but are not limited to, sensitive levels and non-sensitive levels.

[0087] For example: Figure 6 As shown, server information, including IP address, MAC address, and associated business module, can be pre-entered into the CMDB module information table. Server IP1 and Server IP2 are pre-assigned to IP group 1 (i.e., one group within address group 602) in the custom IP group table. IP group 1 is configured with the sensitivity level information for server IP1 and server IP2. This assumes that the business data of server IP1 and IP2 in IP group 1 are both sensitive data. For business modules 1 and 2, which are determined to be sensitive based on the sensitivity level information, a dedicated sensitive bastion host type for the financial sector is created. When a target client needs to access server IP1, the client authentication process will automatically return a bastion host under the dedicated sensitive bastion host type for the financial sector to the client, allowing the client to automatically log in to server IP1 through the bastion host of the dedicated sensitive bastion host type for the financial sector.

[0088] The embodiments provided in this application demonstrate that when the configuration result for configuring business module information on a server indicates configuration failure, address groups are created based on the server's address information. For address groups belonging to the same sensitivity level as determined by sensitivity level information, a bastion host type matching the sensitivity level is created. This allows address groups under the same sensitivity level to be configured under the created bastion host type matching the sensitivity level. Consequently, users no longer need to manually select different bastion hosts to log in to the target server based on the server's address information, enhancing security and ease of use. This improves the efficiency of users accessing the target server.

[0089] Combination Figure 7The following details the bastion host allocation process: The CMDB management interface is used to input the target server's IP address, MAC address, and other information, and to configure the server's business module information or address group information (the following example uses IP address groups for address grouping); the bastion host service web management interface is used to configure the relevant configuration information of the bastion host service, such as creating address groups or business modules. The data layer mainly consists of various data tables stored in the database. The functions of each data table are as follows: CMDB Module Information Table: Stores server information synchronized from the CMDB service, including: server IP, MAC, and business module information. Custom IP Group Table: Used for custom grouping; a group can contain multiple different IPs or IP ranges. Bastion Host Type Table: Supports defining different bastion host types based on the server's sensitivity. Each bastion host type can be configured with multiple business modules or custom IP group information. After configuration, servers matching these business modules and IP groups will select the bastion host of that type. Bastion Host Status Table: Each record represents an available bastion host server. Each bastion host server periodically reports its own status information, including server load and memory information. The client requests login to the target server. User authentication is performed to determine if the user has permission to log in. Then, based on the server's IP address, the server's business modules and custom IP groups containing that IP are obtained. These business modules and custom IP groups are then checked to see if they belong to a specific bastion host type. If so, an available bastion host of that type is returned to the client, allowing the client to log in to the server through that bastion host. Once the server returns the bastion host's service IP, the client then logs in to the target server through that bastion host.

[0090] The above Figure 7 For illustrative purposes only, no limitations are made in this embodiment.

[0091] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0092] According to another aspect of the embodiments of this application, a bastion host allocation device for implementing the above-described bastion host allocation method is also provided. For example... Figure 8 As shown, the device includes:

[0093] The first acquisition unit 802 is used to acquire the business access request of the target client, wherein the business access request carries the address information of the target server where the business data to be accessed is located.

[0094] The first determining unit 804 is used to determine the type of target bastion host that matches the sensitivity level indication information when the sensitivity level indication information that matches the address information of the target server is found.

[0095] The second acquisition unit 806 is used to acquire the status parameters of each bastion host in the bastion host set corresponding to the above-mentioned target bastion host type.

[0096] The second determining unit 808 is used to determine the target bastion host from the above-mentioned bastion hosts based on the above-mentioned state parameters.

[0097] The allocation unit 810 is used to allocate the target bastion host to the target client so that the target client can access the target server through the target bastion host.

[0098] Optionally, in this embodiment, the implementation of each of the above-mentioned unit modules can be referred to the above-mentioned method embodiments, which will not be repeated here.

[0099] According to another aspect of the embodiments of this application, an electronic device for implementing the above-described bastion host allocation method is also provided, the electronic device being... Figure 9 The terminal device or server shown. This embodiment uses this electronic device as an example of a server. Figure 9 As shown, the electronic device includes a memory 902 and a processor 904. The memory 902 stores a computer program, and the processor 904 is configured to execute the steps of any of the above method embodiments through the computer program.

[0100] Optionally, in this embodiment, the aforementioned electronic device may be located in at least one of a plurality of network devices in a computer network.

[0101] Optionally, in this embodiment, the processor can be configured to perform the following steps via a computer program:

[0102] S1, Obtain the business access request from the target client, wherein the business access request carries the address information of the target server where the business data to be accessed is located;

[0103] S2, if a sensitivity level indication information matching the address information of the target server is found, determine the target bastion host type matching the sensitivity level indication information.

[0104] S3, obtain the status parameters of each bastion host in the bastion host set corresponding to the above target bastion host type;

[0105] S4, determine the target bastion host from the above bastion hosts based on the above status parameters;

[0106] S5, assign the target bastion host to the target client so that the target client can access the target server through the target bastion host.

[0107] Alternatively, as those skilled in the art will understand, Figure 9 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones (such as Android phones, iOS phones, etc.), tablets, PDAs, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 9 This does not limit the structure of the aforementioned electronic devices. For example, the electronic device may also include components that are more... Figure 9 The more or fewer components shown (such as network interfaces, etc.), or having the same Figure 9 The different configurations shown.

[0108] The memory 902 can be used to store software programs and modules, such as the program instructions / modules corresponding to the bastion host allocation method and device in this embodiment. The processor 904 executes various functional applications and data processing by running the software programs and modules stored in the memory 902, thereby implementing the aforementioned bastion host allocation method. The memory 902 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 902 may further include memory remotely located relative to the processor 904, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. Specifically, the memory 902 may be used, but is not limited to, to store relevant attribute data, such as the correspondence between the address information of the target server and the sensitivity level indication information, and the status parameters of each bastion host. As an example, such as... Figure 9 As shown, the memory 902 may include, but is not limited to, the first acquisition unit 802, the first determination unit 804, the second acquisition unit 806, the second determination unit 808, and the allocation unit 810 of the bastion host's allocation device. Furthermore, it may include, but is not limited to, other module units in the bastion host's allocation device, which will not be elaborated upon in this example.

[0109] Optionally, the transmission device 906 described above is used to receive or send data via a network. Specific examples of the network described above may include wired networks and wireless networks. In one example, the transmission device 906 includes a Network Interface Controller (NIC), which can be connected to other network devices and routers via a network cable to communicate with the Internet or a local area network. In another example, the transmission device 906 is a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0110] In addition, the aforementioned electronic device also includes: a display 908 for displaying the business access interface and login server interface of the target client; and a connection bus 910 for connecting the various module components in the aforementioned electronic device.

[0111] In other embodiments, the aforementioned terminal device or server can be a node in a distributed system, wherein the distributed system can be a blockchain system, which is a distributed system formed by connecting multiple nodes through network communication. The nodes can form a peer-to-peer (P2P) network, and any form of computing device, such as a server, terminal, or other electronic device, can become a node in the blockchain system by joining this peer-to-peer network.

[0112] According to one aspect of this application, a computer program product is provided, comprising a computer program / instructions containing program code for performing the methods shown in the flowchart. In such embodiments, the computer program can be downloaded and installed from a network via a communication component, and / or installed from a removable medium. When the computer program is executed by a central processing unit, it performs various functions provided in embodiments of this application.

[0113] A computer system includes a Central Processing Unit (CPU), which performs various appropriate actions and processes based on programs stored in Read-Only Memory (ROM) or loaded from RAM. ROM also stores various programs and data required for system operation. The CPU, ROM, and RAM are interconnected via a bus. Input / output interfaces (I / O interfaces) are also connected to the bus.

[0114] The following components are connected to the input / output interface: input sections including keyboards, mice, etc.; output sections including cathode ray tubes (CRTs), liquid crystal displays (LCDs), and speakers; storage sections including hard drives; and communication sections including network interface cards such as LAN cards and modems. The communication section performs communication processing via a network such as the Internet. Drives are also connected to the input / output interface as needed. Removable media, such as disks, optical discs, magneto-optical discs, semiconductor memories, etc., are installed on the drive as needed so that computer programs read from them can be installed into the storage section as required.

[0115] Specifically, according to embodiments of this application, the processes described in the various method flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication component, and / or installed from a removable medium. When the computer program is executed by a central processing unit, it performs various functions defined in the system of this application.

[0116] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0117] According to one aspect of this application, a computer-readable storage medium is provided, from which a processor of a computer device reads computer instructions, and the processor executes the computer instructions, causing the computer device to perform the bastion host allocation system method provided in the various alternative implementations described above.

[0118] Optionally, in this embodiment, the computer-readable storage medium may be configured to store a computer program for performing the following steps:

[0119] S1, Obtain the business access request from the target client, wherein the business access request carries the address information of the target server where the business data to be accessed is located;

[0120] S2, if a sensitivity level indication information matching the address information of the target server is found, determine the target bastion host type matching the sensitivity level indication information.

[0121] S3, obtain the status parameters of each bastion host in the bastion host set corresponding to the above target bastion host type;

[0122] S4, determine the target bastion host from the above bastion hosts based on the above status parameters;

[0123] S5, assign the target bastion host to the target client so that the target client can access the target server through the target bastion host.

[0124] Optionally, in this embodiment, those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0125] If the integrated units in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in the aforementioned computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause one or more computer devices (which may be personal computers, servers, or network devices, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0126] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0127] In the several embodiments provided in this application, it should be understood that the disclosed client can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between units or modules, and may be electrical or other forms.

[0128] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0129] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0130] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for allocating bastion hosts, characterized in that, include: Obtain the business access request from the target client, wherein the business access request carries the address information of the target server where the business data to be accessed is located; If a sensitivity level indication is found that matches the address information of the target server, the target bastion host type that matches the sensitivity level indication is determined. Obtain the status parameters of each bastion host in the bastion host set corresponding to the target bastion host type; The target bastion host is determined from the various bastion hosts based on the status parameters. The target bastion host is assigned to the target client so that the target client can access the target server through the target bastion host.

2. The method according to claim 1, characterized in that, If a sensitivity level indication is found that matches the address information of the target server, the target bastion host type that matches the sensitivity level indication includes: Based on the address information of the target server, locate the target business module to which the target server belongs; If the target business module is located, the sensitivity level information configured for the target business module is determined; The sensitivity level information of the target business module is used as the sensitivity level indication information, and the type of bastion host created for the sensitivity level information of the target business module is determined as the target bastion host type that matches the sensitivity level indication information.

3. The method according to claim 2, characterized in that, After locating the target service module to which the target server belongs based on the address information of the target server, the process further includes: If the target service module is not found, the target address group to which the address of the target server belongs is found based on the address information of the target server; The sensitivity level information of the target address group is used as the sensitivity level indication information, and the bastion host type created for the sensitivity level information of the target address group is determined as the target bastion host type that matches the sensitivity level indication information.

4. The method according to claim 1, characterized in that, The step of determining the target bastion host from each bastion host based on the status parameters includes: Based on the status parameters, candidate bastion hosts that are in an available state are obtained from each bastion host; The target bastion host is determined from the candidate bastion hosts.

5. The method according to claim 4, characterized in that, The step of obtaining the candidate bastion hosts that are in an available state from among the various bastion hosts based on the state parameters includes: Based on the online status parameters in the status parameters, determine the bastion host that is in an online state; Based on the load status parameters in the status parameters, the current load and load limit of each of the online bastion hosts are determined. The bastion host whose current load has not yet reached the load limit is identified as the candidate bastion host.

6. The method according to any one of claims 1 to 5, characterized in that, Before obtaining the target client's business access request, the following is also included: Obtain server information of multiple servers to be managed, wherein the multiple servers include the target server, and the server information includes the server's address information; Configure business module information for each server, wherein the business module information includes the sensitivity level information of the business module; For business modules that belong to the same sensitivity level as determined by the sensitivity level information, create a bastion host type that matches the sensitivity level.

7. The method according to claim 6, characterized in that, Also includes: When the configuration result for configuring the business module information for the server indicates a configuration failure, an address group is created based on the address information of the server, wherein the address group is configured with sensitivity level information; For address groups belonging to the same sensitivity level as determined by the sensitivity level information, create a bastion host type that matches the sensitivity level.

8. A distribution device for a bastion host, characterized in that, include: The first acquisition unit is used to acquire the business access request of the target client, wherein the business access request carries the address information of the target server where the business data to be accessed is located; The first determining unit is used to determine the target bastion host type that matches the sensitivity level indication information when a sensitivity level indication information that matches the address information of the target server is found. The second acquisition unit is used to acquire the status parameters of each bastion host in the bastion host set corresponding to the target bastion host type. The second determining unit is used to determine the target bastion host from the various bastion hosts based on the state parameters; An allocation unit is used to allocate the target bastion host to the target client, so that the target client can access the target server through the target bastion host.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein the program is executed by a processor to perform the method described in any one of claims 1 to 7.

10. A computer program product, comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 7.

11. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to execute the method described in any one of claims 1 to 7 through the computer program.

Images