A server system startup method based on Chinese cryptographic algorithms and SSH protocol

Abstract

This invention specifically relates to a server system startup method based on Chinese national cryptographic algorithms and the SSH protocol. This method deploys a pseudo-server tool on the server system to listen on the server's SSH port. Special users requesting SSH login cannot directly access the server; access is only permitted via SSH requests. The pseudo-server tool verifies the SSH request information. After successful verification of the dedicated SSH login account, the system switches to the corresponding root user, verifies the root user information, and establishes an SSH tunnel between the client and the server, enabling SSH connectivity. Both the dedicated SSH login account information and the root user information are encrypted using Chinese national cryptographic algorithms. This server system startup method based on Chinese national cryptographic algorithms and the SSH protocol improves the security and reliability of server operation, reduces the risk and harm of system account leakage, and better protects system operation and maintains network security.

Description

Technical Field

[0001] This invention relates to the field of information technology, and in particular to a server system startup method based on Chinese cryptographic algorithms and the SSH protocol. Background Technology

[0002] With the development of network technology, various cloud computing platforms have emerged, and more and more people are enjoying the convenience brought by the cloud. As a result, people are paying more and more attention to network security and data security, and have more demands. One important issue is how to ensure that server passwords and keys in cloud platforms are not leaked, and even if passwords and keys are leaked, how to prevent large-scale server breaches and penetration.

[0003] To address the technical problem of insufficient security in remote login servers, this invention proposes a server system startup method based on national cryptographic algorithms and the SSH protocol. Summary of the Invention

[0004] To overcome the shortcomings of existing technologies, this invention provides a simple and efficient server system startup method based on Chinese cryptographic algorithms and the SSH protocol.

[0005] This invention is achieved through the following technical solution:

[0006] A server system startup method based on Chinese cryptographic algorithms and the SSH protocol, characterized in that: a pseudo-server tool is deployed on the server system to listen on the server's SSH port, and special users who apply for SSH login cannot directly access the server, but are only allowed to access it through SSH requests;

[0007] The pseudo-server tool verifies the SSH request information. After the SSH login account is verified, it switches to the corresponding root user, verifies the root user information, establishes an SSH tunnel between the client and the server, and realizes SSH connection.

[0008] The SSH login account information and root user information are encrypted using Chinese cryptographic algorithms.

[0009] Includes the following steps:

[0010] Step S1: Deploy a pseudo-server tool on the server system; use a unique password for each machine, configuring different user passwords for each server in the server system;

[0011] When the server system starts, it generates SM2 encryption key pairs for the SSH login account and the root user, and encrypts the generated SM2 encryption key pair information with the national cryptographic algorithm SM4, and hides it on the local server in the form of a file.

[0012] Step S2: The server system prohibits special users who request SSH login from logging in directly as the root user, and prohibits users from logging in with passwords;

[0013] The pseudo-server tool starts automatically on boot and listens on the server's SSH port, allowing only special users who request SSH login to access it via SSH requests;

[0014] Special users requesting SSH login submit access requests via SSH requests. Once the verification information is approved, the user is switched to the corresponding root user.

[0015] Step S3: Verify the root user information. After successful verification, the server builds an SSH tunnel and transfers the connection to the client, thereby enabling the client to log in to the server using a dedicated SSH login account.

[0016] In step S1, a dedicated SSH login account is customized for the server. The username and corresponding key are randomly generated, and the key is encrypted using the national cryptographic algorithm SM2. The key information is encrypted using the national cryptographic algorithm SM4 to ensure that the SSH login user of each server is different and to ensure information security.

[0017] Each time the server starts, it automatically creates or updates the password and key information for the dedicated SSH login account and the root user.

[0018] In step S2, when a special user applying for SSH login logs into the server system, they apply for a dedicated SSH login account to log into the server system, verify and return the SM4 encrypted information of the dedicated SSH login account, decrypt the SM4 encrypted information using a decryption tool, obtain the SM2 encryption key pair of the dedicated SSH login account, and verify the dedicated SSH login account.

[0019] After the verification information is passed, the SSH login account retrieves the root user's SM4 encrypted information from a specific directory on the server, and uses a decryption tool to decrypt the SM4 encrypted information to obtain the root user's SM2 encryption key pair, and then switches to the corresponding root user.

[0020] In step S3, the SM2 encryption key pair of the root user is verified. After the verification information is passed, an SSH tunnel is established to realize the SSH connection between the client and the server and to operate the server.

[0021] The SSH login account has no permissions within the server and can only read exclusive files in its own directory. It is only used as a transitional account for root user login.

[0022] An apparatus, characterized in that it includes a memory and a processor; the memory is used to store a computer program, and the processor is used to execute the computer program to implement the above-described method steps.

[0023] A readable storage medium, characterized in that: a computer program is stored on the readable storage medium, and the computer program, when executed by a processor, implements the above-described method steps.

[0024] The beneficial effects of this invention are: the server system startup method based on national cryptographic algorithms and SSH protocol improves the security and reliability of server operation, reduces the risk and harm of system account leakage, and can better protect system operation and maintain network security. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Appendix Figure 1 This is a schematic diagram of the server system startup process of the present invention.

[0027] Appendix Figure 2 This is a schematic diagram of the operation process of the pseudo-server tool of the present invention. Detailed Implementation

[0028] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions in the embodiments of this invention will be clearly and completely described below in conjunction with the embodiments of this invention. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0029] SSH, short for Secure Shell, is a security protocol developed by the IETF's Network Working Group. It's an application-layer security protocol specifically designed to provide security for remote login sessions and other network services.

[0030] This server system startup method, based on national cryptographic algorithms and the SSH protocol, deploys a pseudo-server tool on the server system to listen on the server's SSH port. Special users who apply for SSH login cannot directly access the server; they are only allowed to access it via SSH requests.

[0031] The pseudo-server tool verifies the SSH request information. After the SSH login account is verified, it switches to the corresponding root user, verifies the root user information, establishes an SSH tunnel between the client and the server, and realizes SSH connection.

[0032] The SSH login account information and root user information are encrypted using Chinese cryptographic algorithms.

[0033] Includes the following steps:

[0034] Step S1: Deploy a pseudo-server tool on the server system; use a unique password for each machine, configuring different user passwords for each server in the server system;

[0035] When the server system starts, it generates SM2 (elliptic curve public key cryptography algorithm issued by the State Cryptography Administration) encryption key pairs for the SSH login dedicated account and the root user respectively, and encrypts the generated SM2 encryption key pair information with the national cryptographic algorithm SM4 (block cipher algorithm issued by the State Cryptography Administration) and hides it on the local server in the form of a file;

[0036] Step S2: The server system prohibits special users who request SSH login from logging in directly as the root user, and prohibits users from logging in with passwords;

[0037] The pseudo-server tool starts automatically on boot and listens on the server's SSH port, allowing only special users who request SSH login to access it via SSH requests;

[0038] Special users requesting SSH login submit access requests via SSH requests. Once the verification information is approved, the user is switched to the corresponding root user.

[0039] Step S3: Verify the root user information. After successful verification, the server builds an SSH tunnel and transfers the connection to the client, thereby enabling the client to log in to the server using a dedicated SSH login account.

[0040] Currently, there are no client-side or server-side tools on the market that support the SM2 algorithm key. This pseudo-server tool provides a method for generating SM2 algorithm keys and supports key encryption, decryption, and signature verification. The SM2 key pairs offer higher security and efficiency than currently used encryption methods such as RSA, and have greater complexity, effectively improving server security and key complexity.

[0041] Meanwhile, the pseudo-server tool also provides encryption and decryption functions for SM4 algorithm key information. It encrypts easily leaked plaintext passwords and key information using SM4, ensuring that the encrypted information cannot be cracked even after leakage. The SM4 algorithm uses unique string pairs as the basis for encryption and decryption, and this is built into the tool, further ensuring the security and reliability of information and improving the overall security level of the system.

[0042] In step S1, a dedicated SSH login account is customized for the server. The username and corresponding key are randomly generated, and the key is encrypted using the national cryptographic algorithm SM2. The key information is encrypted using the national cryptographic algorithm SM4 to ensure that the SSH login user of each server is different and to ensure information security.

[0043] Each time the server starts, it automatically creates or updates the password key information for the dedicated SSH login account and the root user, thereby achieving a one-machine-one-key design.

[0044] In step S2, when a special user applying for SSH login logs into the server system, they apply for a dedicated SSH login account to log into the server system, verify and return the SM4 encrypted information of the dedicated SSH login account, decrypt the SM4 encrypted information using a decryption tool, obtain the SM2 encryption key pair of the dedicated SSH login account, and verify the dedicated SSH login account.

[0045] After the verification information is passed, the SSH login account retrieves the root user's SM4 encrypted information from a specific directory on the server, and uses a decryption tool to decrypt the SM4 encrypted information to obtain the root user's SM2 encryption key pair, and then switches to the corresponding root user.

[0046] In step S3, the SM2 encryption key pair of the root user is verified. After the verification information is passed, an SSH tunnel is established to realize the SSH connection between the client and the server and to operate the server.

[0047] The SSH login account has no permissions within the server and can only read exclusive files in its own directory. It is only used as a transitional account for root user login.

[0048] The device includes a memory and a processor; the memory is used to store a computer program, and the processor is used to execute the computer program to implement the above-described method steps.

[0049] The readable storage medium stores a computer program that, when executed by a processor, implements the above-described method steps.

[0050] This server system startup method, based on national cryptographic algorithms and the SSH protocol, maximizes the security of account information and establishes a comprehensive protection system for the server login portal. This protection system comprises three lines of defense:

[0051] The first line of defense is for special users who apply for SSH login, but they cannot actually access the server; they can only be verified through a pseudo-server program.

[0052] The second line of defense: SSH login users have no permissions inside the server and can only read exclusive files in their own directories. They are only used as a transitional tool for root user login.

[0053] The third line of defense: The root user is the official user of the server. Only after obtaining encrypted information using a dedicated SSH login user and successfully decrypting it can one switch to the root user. Furthermore, the SSH tunnel connection between the client and server will only be established after successful root user authentication.

[0054] The aforementioned protection system greatly improves the server's security level, effectively preventing account data leakage during login and usage, and ensuring the server's security and reliability.

[0055] Furthermore, the keys and encryption methods based on the national cryptographic algorithm are better adapted to the future domestic market. Even if the password or key of a certain server is leaked, it will not harm other machines on the same platform and in the same environment. This effectively prevents the risks brought about by the cracking of the original server login method and indirectly improves the data security of the upper layer of the architecture running on the server.

[0056] Furthermore, pseudo-server tools are flexible and portable, applicable to various architectures and operating system versions, and can be used immediately upon connection, making them more convenient.

[0057] The embodiments described above are merely one specific implementation of the present invention. Ordinary changes and substitutions made by those skilled in the art within the scope of the technical solution of the present invention should be included within the protection scope of the present invention.

Claims

1. A server system startup method based on Chinese cryptographic algorithms and the SSH protocol, characterized in that: A pseudo-server tool is deployed on the server system to listen on the server's SSH port. Special users who request SSH login cannot directly access the server; they are only allowed to access it via SSH requests. The pseudo-server tool verifies the SSH request information. After the SSH login account is verified, it switches to the corresponding root user, verifies the root user information, establishes an SSH tunnel between the client and the server, and realizes SSH connection. The SSH login account information and root user information are encrypted using Chinese cryptographic algorithms. Includes the following steps: Step S1: Deploy a pseudo-server tool on the server system; use a unique password for each machine, configuring different user passwords for each server in the server system; When the server system starts, it generates SM2 encryption key pairs for the SSH login account and the root user, and encrypts the generated SM2 encryption key pair information with the national cryptographic algorithm SM4, and hides it on the local server in the form of a file. Step S2: The server system prohibits special users who request SSH login from logging in directly as the root user, and prohibits users from logging in with passwords; The pseudo-server tool starts automatically on boot and listens on the server's SSH port, allowing only special users who request SSH login to access it via SSH requests; Special users requesting SSH login submit access requests via SSH requests. Once the verification information is approved, the user is switched to the corresponding root user. Step S3: Verify the root user information. After successful verification, the server builds an SSH tunnel and transfers the connection to the client, thereby enabling the client to log in to the server using a dedicated SSH login account.

2. The server system startup method based on national cryptographic algorithms and SSH protocol according to claim 1, characterized in that: In step S1, a dedicated SSH login account is customized for the server. The username and corresponding key are randomly generated, and the key is encrypted using the national cryptographic algorithm SM2. The key information is encrypted using the national cryptographic algorithm SM4 to ensure that the SSH login user of each server is different and to ensure information security. Each time the server starts, it automatically creates or updates the password and key information for the dedicated SSH login account and the root user.

3. The server system startup method based on national cryptographic algorithms and SSH protocol according to claim 2, characterized in that: In step S2, when a special user applying for SSH login logs into the server system, they apply for a dedicated SSH login account to log into the server system, verify and return the SM4 encrypted information of the dedicated SSH login account, decrypt the SM4 encrypted information using a decryption tool, obtain the SM2 encryption key pair of the dedicated SSH login account, and verify the dedicated SSH login account. After the verification information is passed, the SSH login account retrieves the root user's SM4 encrypted information from a specific directory on the server, and uses a decryption tool to decrypt the SM4 encrypted information to obtain the root user's SM2 encryption key pair, and then switches to the corresponding root user.

4. The server system startup method based on national cryptographic algorithms and SSH protocol according to claim 3, characterized in that: In step S3, the SM2 encryption key pair of the root user is verified. After the verification information is passed, an SSH tunnel is established to realize the SSH connection between the client and the server and to operate the server.

5. The server system startup method based on the national cryptographic algorithm and SSH protocol according to any one of claims 1 to 3, characterized in that: The SSH login account has no permissions within the server and can only read exclusive files in its own directory. It is only used as a transitional account for root user login.

6. A device, characterized in that: It includes a memory and a processor; the memory is used to store a computer program, and the processor is used to execute the computer program to implement the steps of the method as described in any one of claims 1 to 5.

7. A readable storage medium, characterized in that: The readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method as described in any one of claims 1 to 5.

Images