Method, system, terminal and server for web-based remote access to a container

Abstract

The application discloses a kind of Web end remote access container method, system, terminal and server, the method includes: Web terminal receives the remote login container request of user;When the user identity is verified by back-end server, obtain user role and the right of operating container;When confirming user role and authority, feedback login success notice;When terminal receives notification, container information and connection request are sent to back-end server;Server establishes connection with terminal;According to container information, target container is inquired;Terminal receives user operation target container command and sends to server;When the role of current user has the operation authority of the command according to the relationship of role and operation command authority detection, the command is sent to the container, so that container executes the command and feedback execution result to server.The application can flexibly and safely control the access authority of user to command operation in container according to the role of user, improve system flexibility and security.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of cloud native technology, and in particular to a method and system for remotely accessing a container via a web terminal, a terminal and a server. BACKGROUND

[0002] This section is intended to provide background or context to the embodiments of the application recited in the claims. The description herein does not constitute admission that the prior art is prior art nor, that anything in this section is "prior art" with respect to the application.

[0003] Container technology is a virtualization technology widely used in application deployment and management. It allows developers to package an application and all its dependencies into a portable container, which can then be run in different environments, ensuring consistency and reliability of the application on different platforms. This technology is very popular in various large companies.

[0004] Generally speaking, a user needs to log in to the host where the container is located first, then find the container identification ID through the docker exec or kubectl exec command, enter the container, and then execute the relevant debugging command inside the container. This method is very cumbersome and has great security risks.

[0005] The prior art method for remotely accessing a container allows a user to remotely access an application in a container via a web interface, and proposes a dangerous command warning and email notification of a container cloud platform user and administrator. This method can simplify the container login process to some extent and intercept dangerous commands, but this interception method is very simple. Any command listed in the dangerous command table will be intercepted and notified. There is no division of dangerous command permissions. For ordinary users, these are indeed dangerous commands, but for operation and maintenance personnel, these commands are sometimes essential commands in production and operation. When a safety production accident occurs, operation and maintenance personnel need to use these "dangerous commands" to handle the accident, which will be intercepted, further expanding the loss of the safety accident. Therefore, the method for remotely accessing a container via a web terminal is not safe and flexible. SUMMARY

[0006] The present application provides a method for remotely accessing a container via a web terminal, which flexibly and safely controls the access permission of a user to a command operation in a container according to the role of the user. The method is applied to a system and includes the following steps:

[0007] The web terminal receives a request for remotely logging into a container via a web terminal from a user, and sends the request to a backend server.

[0008] The backend server obtains role information and permission information of operating the target container pre-configured for the current user from the database when the user identity is verified to be valid according to the web terminal remote login container request, and feeds back a login success notification to the web terminal when the role of the current user and the current role are confirmed to have the permission of operating the target container.

[0009] The web terminal sends target container information and a websocket connection request to the backend server when the login success notification is received.

[0010] The backend server establishes a websocket connection with the web terminal according to the websocket connection request, and queries the target container of the physical machine according to the target container information and establishes a websocket connection with the target container.

[0011] The web terminal receives a current command of the user operating the target container and sends the current command of the user operating the target container to the backend server.

[0012] The backend server sends the current command to the target container when the role of the current user is detected to have the operation permission of the current command according to the pre-configured relationship between different user roles and operation command permissions, so that the target container executes the current command and feeds back an execution result to the backend server, and the execution result is fed back to the web terminal.

[0013] The embodiment of the application also provides a web terminal remote access container method, which is applied to a web terminal and is used for flexibly and safely controlling the access permission of a user to a command operation in a container according to the role of the user, and the method comprises the following steps:

[0014] A web terminal remote login container request of a user is received and the request is sent to a backend server, the backend server is used for obtaining role information and permission information of operating a target container pre-configured for the current user from a database when the user identity is verified to be valid according to the web terminal remote login container request, and feeding back a login success notification to the web terminal when the role of the current user and the current role are confirmed to have the permission of operating the target container.

[0015] Target container information and a websocket connection request are sent to the backend server when the login success notification is received, and the backend server is also used for establishing a websocket connection with the web terminal according to the websocket connection request, and querying the target container of the physical machine according to the target container information and establishing a websocket connection with the target container.

[0016] The current command of the target container operated by the user is received, and the current command of the target container operated by the user is sent to the backend server; the backend server is further configured to send the current command to the target container when it is detected according to a pre-configured relationship between different user roles and operation command permissions that the role of the current user has operation permission of the current command, so that the target container executes the current command and feeds back an execution result to the backend server; and the execution result is fed back to the Web terminal.

[0017] The embodiment of the application further provides a method for remotely accessing a container by a Web terminal, which is applied to a backend server and used for flexibly and safely controlling access permission of a user to command operation in a container according to a role of the user, and the method comprises the following steps of:

[0018] When it is verified that the user identity is correct according to the Web terminal remote login container request, role information pre-configured for the current user and permission information of operating the target container are obtained from a database; when it is confirmed that the role of the current user and the current role have permission of operating the target container, a login success notification is fed back to the Web terminal; the Web terminal remote login container request is sent by the Web terminal, and the Web terminal is used for receiving the Web terminal remote login container request of the user; when the login success notification is received, target container information and a Websocket connection request are sent to the backend server;

[0019] According to the Websocket connection request, a Websocket connection with the Web terminal is established; the target container of the physical machine is queried according to the target container information, and a Websocket connection with the target container is established; the Web terminal is further configured to receive a current command of the target container operated by the user, and send the current command of the target container operated by the user to the backend server;

[0020] When it is detected according to a pre-configured relationship between different user roles and operation command permissions that the role of the current user has operation permission of the current command, the current command is sent to the target container, so that the target container executes the current command and feeds back an execution result to the backend server; and the execution result is fed back to the Web terminal.

[0021] The embodiment of the application further provides a system for remotely accessing a container by a Web terminal, which is used for flexibly and safely controlling access permission of a user to command operation in a container according to a role of the user, and the system comprises the following steps of:

[0022] The Web terminal is used for receiving a Web terminal remote login container request of the user, sending the request to the backend server, sending target container information and a Websocket connection request to the backend server when a login success notification is received, and receiving a current command of the target container operated by the user, and sending the current command of the target container operated by the user to the backend server;

[0023] The backend server is configured to: obtain role information and permission information of operating the target container pre-configured for the current user from a database when the user identity is verified to be valid according to the Web terminal remote login container request; feed back a login success notification to the Web terminal when the role of the current user and the current role are confirmed to have the permission of operating the target container; establish a Websocket connection with the Web terminal according to a Websocket connection request; query the target container of the physical machine according to the target container information, and establish a Websocket connection with the target container; send the current command to the target container when the role of the current user is detected to have the operation permission of the current command according to a pre-configured relationship between different user roles and operation command permissions, so that the target container executes the current command and feeds back an execution result to the backend server; and feed back the execution result to the Web terminal.

[0024] The embodiment of the application also provides a Web terminal for remotely accessing a container, which is used for flexibly and safely controlling access permission of a user to command operation in a container according to a role of the user, and the Web terminal comprises:

[0025] The first receiving unit is configured to receive a Web terminal remote login container request of a user, and the request is sent to a backend server; and receive a current command of the user operating a target container, and the current command of the user operating the target container is sent to the backend server; the backend server is configured to: obtain role information and permission information of operating the target container pre-configured for the current user from a database when the user identity is verified to be valid according to the Web terminal remote login container request; feed back a login success notification to the Web terminal when the role of the current user and the current role are confirmed to have the permission of operating the target container; and send the current command to the target container when the role of the current user is detected to have the operation permission of the current command according to a pre-configured relationship between different user roles and operation command permissions, so that the target container executes the current command and feeds back an execution result to the backend server; and feed back the execution result to the Web terminal.

[0026] The first sending unit is configured to send target container information and a Websocket connection request to the backend server when the login success notification is received; and the backend server is further configured to: establish a Websocket connection with the Web terminal according to the Websocket connection request; and query the target container of the physical machine according to the target container information, and establish a Websocket connection with the target container.

[0027] The embodiment of the application also provides a backend server for remotely accessing a container, which is used for flexibly and safely controlling access permission of a user to command operation in a container according to a role of the user, and the backend server comprises:

[0028] The login unit is used to obtain role information and permission information of operating the target container pre-configured for the current user from the database when the user identity is verified to be correct according to the Web terminal remote login container request; when the role of the current user and the current role are confirmed to have the permission of operating the target container, a login success notification is fed back to the Web terminal; the Web terminal is used to receive the Web terminal remote login container request of the user; when the login success notification is received, the target container information and a Websocket connection request are sent to the backend server;

[0029] The connection unit is used to establish a Websocket connection with the Web terminal according to the Websocket connection request; the target container of the physical machine is queried according to the target container information, and a Websocket connection is established with the target container; the Web terminal is also used to receive the current command of the user operating the target container, and send the current command of the user operating the target container to the backend server.

[0030] The access unit is used to send the current command to the target container when it is detected that the role of the current user has the operation permission of the current command according to the pre-configured relationship between different user roles and operation command permissions, so that the target container executes the current command and feeds back an execution result to the backend server; the execution result is fed back to the Web terminal.

[0031] The embodiment of the application further provides a computer device, including a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the method for remotely accessing the container on the Web terminal when executing the computer program.

[0032] The embodiment of the application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method for remotely accessing the container on the Web terminal.

[0033] The embodiment of the application further provides a computer program product, which includes a computer program, and the computer program is executed by a processor to implement the method for remotely accessing the container on the Web terminal.

[0034] Compared with the prior art, the method for remotely accessing the container on the Web terminal has the advantages of high security and flexibility.

[0035] Firstly, the embodiment of the present application preconfigures role information and permission information of operating a target container for a current user, and feeds back a login success notification to a Web terminal when confirming the role of the current user and the current role having the permission of operating the target container, thereby realizing flexible definition of user roles according to actual requirements, assigning the permission of operating the target container for users of different roles, and improving the flexibility of the system.

[0036] Secondly, the embodiment of the present application preconfigures the relationship between different user roles and operation command permissions, and the backend server sends a current command to a target container when detecting that the role of the current user has the operation permission of the current command according to the preconfigured relationship between different user roles and operation command permissions, so that the target container executes the current command and feeds back an execution result to the backend server, and the execution result is fed back to the Web terminal, thereby realizing access to commands in the container according to the role of different users, accurately controlling the permission of user operation commands, and improving the security of the system.

[0037] In summary, the embodiment of the present application realizes flexible and safe control of the access permission of users to command operation in the container according to the role of the user, and improves the flexibility and security of the system. BRIEF DESCRIPTION OF DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort under the premise of the drawings. In the drawings:

[0039] Figure 1 The flowchart of the method for the Web terminal of the system to remotely access the container in the embodiment of the present application;

[0040] Figure 2 The system architecture diagram of the Web terminal to remotely access the container in the embodiment of the present application;

[0041] Figure 3 The configuration diagram of the permission management module in the embodiment of the present application;

[0042] Figure 4 The principle diagram of the Web terminal to remotely access the container in the embodiment of the present application;

[0043] Figure 5 The flowchart of the method for the Web terminal of the system to remotely access the container in the embodiment of the present application;

[0044] Figure 6A flowchart of a method for remotely accessing a container via a web terminal in an embodiment of the present application;

[0045] Figure 7 A structural diagram of a system for remotely accessing a container via a web terminal in an embodiment of the present application;

[0046] Figure 8 A structural diagram of a web terminal for remotely accessing a container via a web terminal in an embodiment of the present application;

[0047] Figure 9 A structural diagram of a backend server for remotely accessing a container via a web terminal in an embodiment of the present application. DETAILED DESCRIPTION

[0048] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, further detailed descriptions of the embodiments of the present application are given below with reference to the drawings. Here, the illustrative embodiments of the present application and their descriptions are used to explain the present application but are not limiting to the present application.

[0049] In the technical solutions of the present application, the acquisition, storage, use, processing, and the like of data comply with relevant provisions of laws and regulations.

[0050] The inventors found that the existing remote login container solutions have the following technical problems:

[0051] 1. Lack of fine-grained control of user permission management:

[0052] All users can access all commands and operations in the container, and cannot be accurately controlled. This situation has certain security risks because users can misoperate or access functions that should not be accessed.

[0053] 2. Lack of permission allocation for different user roles:

[0054] It is impossible to define user roles or allocate specific permissions for users with different roles according to actual needs, resulting in rigidity and limitation of permission management.

[0055] 3. Insufficient security:

[0056] Due to the lack of fine-grained permission control and allocation, the existing technology is slightly insufficient in security. Users can misoperate or abuse commands in the container, resulting in data leakage, system crashes, or other security risks.

[0057] In view of the deficiencies of the prior art in security and manageability, the embodiment of the present application proposes a scheme for Web-side remote access to a container. The scheme is a more flexible and secure Web-side container remote scheme by introducing an RBAC mechanism, provides more refined user permission management, enhances security, and enables an administrator to more flexibly manage and control user access permissions to commands and operations in the container according to the roles and needs of the user. The security, manageability and flexibility of the system are greatly improved. The scheme for Web-side remote access to a container is described in detail below.

[0058] Figure 1 A flowchart of the method for Web-side remote access to a container applied to the system in the embodiment of the present application is shown in Figure 1 The method includes the following steps:

[0059] Step 101: The Web terminal receives a Web-side remote login container request of a user, and sends the request to a backend server.

[0060] Step 102: When the backend server verifies the identity of the user according to the Web-side remote login container request and passes the verification, the backend server obtains role information and permission information for operating a target container pre-configured for the current user from a database. When the role of the current user and the current role are confirmed to have the permission to operate the target container, the backend server feeds back a login success notification to the Web terminal.

[0061] Step 103: When the Web terminal receives the login success notification, the Web terminal sends target container information and a Websocket connection request to the backend server.

[0062] Step 104: The backend server establishes a Websocket connection with the Web terminal according to the Websocket connection request, and queries the target container of a physical machine according to the target container information, and establishes a Websocket connection with the target container.

[0063] Step 105: The Web terminal receives a current command of the user operating the target container, and sends the current command of the user operating the target container to the backend server.

[0064] Step 106: When the backend server detects that the role of the current user has the operation permission of the current command according to the pre-configured relationship between different user roles and operation command permissions, the backend server sends the current command to the target container, so that the target container executes the current command and feeds back an execution result to the backend server, and feeds back the execution result to the Web terminal.

[0065] The method for remotely accessing a container on a Web terminal provided by the embodiment of the application has the beneficial technical effects that, compared with the method for remotely accessing a container on a Web terminal in the prior art, the security and flexibility of the method for remotely accessing a container on a Web terminal provided by the embodiment of the application are improved.

[0066] Compared with the method for remotely accessing a container on a Web terminal in the prior art, the security and flexibility of the method for remotely accessing a container on a Web terminal provided by the embodiment of the application are improved.

[0067] First, the embodiment of the application preconfigures role information and permission information for operating a target container for a current user, and feeds back login success notification to the Web terminal when it is confirmed that the role of the current user and the current role have the permission for operating the target container, thereby realizing flexible definition of user roles according to actual requirements, assigning the permission for operating the target container to users with different roles, and improving the flexibility of the system.

[0068] Second, the embodiment of the application preconfigures the relationship between different user roles and operation command permissions, and the backend server sends a current command to the target container when it is detected that the role of the current user has the operation permission of the current command according to the preconfigured relationship between different user roles and operation command permissions, so that the target container executes the current command and feeds back the execution result to the backend server, and the execution result is fed back to the Web terminal, thereby realizing access to commands in the container according to the role of different users, accurately controlling the permission of user operation commands, and improving the security of the system.

[0069] In summary, the embodiment of the application realizes flexible and secure control of the access permission of users for command operation in a container according to the role of the user, and improves the flexibility and security of the system.

[0070] The method of remotely accessing the Web-side container is described in detail below.

[0071] In the embodiment of the application, first, the RBAC (Role-Based Access Control) mechanism is introduced, and through fine division of roles and permissions, more flexible management of users is realized. Second, in the Web-side container remote login system, an RBAC-based permission control module is established, and the operation permissions of the user are adjusted in real time according to the role of the user. Details are described below.

[0072] 1. Overall design

[0073] The overall system architecture provided by the embodiment of the application Figure 2 As shown, it includes the following contents:

[0074] Web side:

[0075] The Web side is the interface for user interaction with the system, and Xterm.js can be used to realize terminal command line input and output. In an embodiment, the Web terminal can be an Xterm-based Web terminal, and the Web terminal uses Xterm.js to realize terminal command line input and output.

[0076] The user establishes a connection with the backend server through the Web side, sends a command request, and receives the execution result.

[0077] Backend service:

[0078] The backend service is the core component of the system, responsible for processing user requests, identity verification, permission management, user management, role management, and permission operation records. Among them,

[0079] Identity verification: Verify the identity of the user to ensure that only authorized users can access the system.

[0080] User management: Manage user information, including the basic information and permissions of the user. The system can automatically detect operations or receive updates to the basic information or permissions from the operation and maintenance personnel, such as updating role information and permission information for operating target containers, or the relationship between different user roles and operation command permissions.

[0081] Permission management: Manage various permissions in the system, including dangerous command operation permissions, i.e., permissions for operating dangerous commands.

[0082] Role management: Define different roles and assign permissions to different roles to simplify permission management.

[0083] Permission operation record: Record the user's operations for auditing and tracking user activities.

[0084] Database (MySQL):

[0085] The database is used to store user information, role information, permission information, and operation records, etc.

[0086] The backend service realizes user management, permission management, and persistent storage of operation records through interaction with the database.

[0087] Physical machine (container 1, 2, 3):

[0088] The physical machine represents the actual server or host running the container.

[0089] One or more containers run on each physical machine.

[0090] Containers provide an isolated execution environment to ensure that command execution between users does not interfere with each other. In one embodiment, multiple containers run on a physical machine, which represents the actual server or host running the container, and each container provides an isolated execution environment to ensure that command execution between users does not interfere with each other.

[0091] 2. RBAC permission management module

[0092] To implement RBAC, a permission management module is introduced, which includes the following key components:

[0093] (1) User management, which includes the following functions:

[0094] User role assignment: Each user is assigned one or more roles, and each role defines a set of permissions. For example: a system may have a department administrator role, as shown in user 3, who needs both system administrator permissions (such as managing department users) and ordinary user permissions (such as using the system for his own business work). In this case, the user needs both the system administrator role and the ordinary user role. Figure 3

[0095] Fine-grained user permission management: Each user's permissions can be further subdivided to allow administrators to individually limit user permissions and ensure the principle of least privilege.

[0096] For example: create a role table (as shown in Table 1 below) and a permission table (as shown in Table 2 below), and through a role-permission mapping table (as shown in Table 3 below), to individually limit permissions.

[0097] Table 1: Role Table

[0098] Role ID Role Name 1 Super User 2 Administrator 3 Normal User

[0099] Table 2: Permission Table​

[0100] Permission ID Permission Name 1 Permission 1 2 Permission 2 3 Permission 3 4 Permission 4

[0101] Table 3: Role-Permission Mapping Table

[0102] Role ID Permission ID 1 1 1 2 2 2 2 3 3 3 3 4

[0103] For example, assume there are multiple users and multiple folders in the system, each user can have different folder access permissions, and the administrator can manage the folder access permissions of each user in a fine-grained manner to ensure that users can only access the folders they need, as shown in the following Table 4.

[0104] Table 4: Example of Relationship Between User Role and Operation Command Permission

[0105] User ID Folder ID Read Permission Write Permission 1 1 Yes No 1 2 No Yes 2 1 No No 2 2 Yes Yes

[0106] (2) Role Management

[0107] Role Classification: Mainly divided into super user, system administrator and ordinary user.

[0108] Role permission adjustment: The administrator can adjust the permissions of the role in real time, which is reflected in the user's operation.

[0109] (3) Permission Management

[0110] Permission classification: Different commands are divided into different levels, which are high risk, medium risk and low risk. And different user roles are given different permissions to ensure that users can only perform the operations they need, as shown in the following Table 5.

[0111] Table 5: Relationship Between Different User Roles and Operation Command Permissions

[0112]

[0113] The embodiment of the application can realize the automatic configuration of the relationship between different user roles and operation command permissions through a recurrent neural network (RNN):

[0114] 1) Data preparation: Prepare a large number of labeled data sets similar to the table, the command column as the input sequence, and the risk level column as the output label, to construct the training data set and the validation data set.

[0115] 2) Model building: Build an RNN model and initialize the parameters and configurations of the model, convert the command text into word embedding vectors as the input of the RNN, and the output layer is a softmax classifier, which outputs the probability distribution of each risk level.

[0116] 3) Model training: Then use the labeled data set to train the model, set the loss function as cross entropy loss function, use adam optimizer, and iterate the model parameters.

[0117] 4) Model evaluation: Use the validation set to evaluate the trained model, and adjust the structure and parameters of the model according to the accuracy, precision, recall and other indicators.

[0118] 5) Use the model to make predictions: Deploy the trained model to the backend service, and receive the command text input by the front-end user to output the risk level.

[0119] The risk level of the command operation in the embodiment of the application can include:

[0120] High risk: commands that cause serious damage to the system or data loss, such as deleting files and directories, writing to the hard disk from zero, etc.

[0121] Medium risk: commands that affect system stability or service availability, such as stopping Docker containers, modifying file or directory owners, etc.

[0122] Low risk: usually some query or configuration commands, such as viewing system processes, changing user passwords, etc.

[0123] From the above, in an embodiment, the method of remotely accessing the container on the Web side can further include pre-configuring the relationship between different user roles and operation command permissions as follows:

[0124] Obtain the to-be-configured command;

[0125] Convert the to-be-configured command into a to-be-configured command feature vector;

[0126] Input the to-be-configured command feature vector into the operation command risk level identification model to obtain the risk level of the operation to-be-configured command; the operation command risk level identification model is generated by pre-training according to multiple command and corresponding operation command risk level relationship sample data;

[0127] According to the risk level of the operation to-be-configured command, configure the operation command permissions for different user roles to obtain the relationship between different user roles and operation command permissions.

[0128] In specific implementation, the above-mentioned implementation of pre-configuring the relationship between different user roles and operation command permissions can improve the accuracy and efficiency of configuring the relationship between different user roles and operation command permissions.

[0129] In specific implementation, the above-mentioned step of pre-configuring the relationship between different user roles and operation command permissions can be implemented on the server, and can also be implemented on the Web side or other modules.

[0130] According to the above, in one embodiment, the method for remotely accessing the container on the Web side further comprises:

[0131] The operation command risk level identification model is pre-trained according to the following method:

[0132] Different historical commands and risk level sample data sets corresponding to different historical commands are obtained, and the sample data sets are divided into a training data set and a verification data set;

[0133] A recurrent neural network (RNN) model is constructed, wherein the word embedding vector converted from the historical command text is used as the input layer of the RNN model, and a softmax classifier is used as the output layer of the RNN model, and the output layer is used to output the probability distribution of the risk level corresponding to each historical command;

[0134] The RNN model is trained using the training data set, a cross-entropy loss function is set as the loss function, an adam optimizer is used, and the model parameters are iteratively optimized until a trained operation command risk level identification model is obtained;

[0135] The trained operation command risk level identification model is evaluated using the verification data set, the structure and parameters of the model are adjusted according to the accuracy, precision and recall rate indicators, and a verified operation command risk level identification model is obtained as the pre-trained operation command risk level identification model, which is deployed in the backend server.

[0136] In specific implementation, the implementation of the method for training and generating the operation command risk level identification model can improve the efficiency and accuracy of the generated operation command risk level identification model, and further improve the accuracy and efficiency of configuring the relationship between different user roles and operation command permissions.

[0137] Permission audit: record the use of permissions for the convenience of audit and tracking by operation and maintenance personnel. In one embodiment, the method for remotely accessing the container on the Web side provided by the embodiments of the present application further comprises: the backend server records the operation of the user on the current command of the target container in the database for subsequent audit and tracking of user activities. In one embodiment, the method for remotely accessing the container on the Web side provided by the embodiments of the present application further comprises: the backend server records the operation of the user on the current command of the target container in the blockchain for subsequent audit and tracking of user activities, ensuring that the record cannot be tampered with, and further improving the security of the command record.

[0138] Real-time permission adjustment: Administrators can adjust user roles and permissions in real time to ensure that the system responds to changes in a timely manner and maintains the latest security state. Both superusers and system administrators can make real-time permission adjustments. Specifically, anomaly detection can be performed using a Gaussian Mixture Model or Isolation Forest, and real-time adjustments can be made.

[0139] As described above, in one embodiment, the method of remotely accessing the container on the Web side can further include:

[0140] The backend server adjusts the user role and operation command permission in real time to ensure that the system responds to changes in user role and operation command permission in a timely manner and maintains the latest security state.

[0141] As described above, in one embodiment, the method of remotely accessing the container on the Web side can further include:

[0142] The backend server adjusts the user role and operation command permission in real time, including: the backend server performs anomaly detection using a Gaussian Mixture Model or Isolation Forest to adjust the user role and operation command permission in real time.

[0143] 3. Web Xterm terminal module

[0144] Step to build Web Xterm terminal:

[0145] First, install xterm and xterm-addon-attach, the former is the core component of Xterm, and the latter is an additional component of xterm.js, used to attach to Web Socket.

[0146] Initialize the Xterm component and websocket connection.

[0147] Step to build Web Xterm terminal:

[0148] 1) Use npm to install xterm and xterm-addon-attach packages.

[0149] 2) Import xterm.js and xterm-addon-attach.js in the page, and initialize the Xterm component and websocket connection.

[0150] 3) Start a WebSocket server on the backend and listen for WebSocket connections established with the frontend.

[0151] 4) Open the page in the browser, and you can see an Xterm-based Web terminal, then you can communicate with the backend service through the terminal.

[0152] 4. The implementation steps are as shown in Figure 4

[0153] (1) User login

[0154] The user logs in to the system through the Web end.

[0155] The backend service verifies the user's identity and obtains their role information.

[0156] (2) RBAC permission check

[0157] The backend service checks the user's operation permissions in real time according to the user's role, i.e., the permissions to operate the target container.

[0158] If the permissions are passed, the user is allowed to enter the terminal interface.

[0159] (3) Container remote operation

[0160] The Web end initiates a WebSocket connection to the backend service through Xterm.js's AttachAddon.

[0161] After the connection is successful, the user inputs operation commands in the terminal interface.

[0162] The backend service stores the user's command operation records.

[0163] The backend service verifies whether the user has the permission to execute the command through the RBAC permission management module (as shown in Figure 3 ), i.e., the operation command permission, i.e., the dangerous operation command permission.

[0164] (4) Operation result return

[0165] The backend service establishes a connection with the target container through WebSocket and executes the command.

[0166] The execution result is returned to the Web end and is displayed to the user through the Xterm.js terminal.

[0167] In summary, the method for the Web end to remotely access the container provided by the embodiments of the present application realizes:

[0168] Fine-grained permission control: The present application introduces the RBAC mechanism to provide more flexible and fine-grained permission control, allowing administrators to authorize users more accurately according to actual needs.

[0169] High security: The RBAC mechanism introduced by the present application effectively improves the security of the system and reduces potential security risks.

[0170] ​Real-time permission adjustment: administrators can adjust user roles and permissions in real time to ensure that the system responds to changes in a timely manner and maintains the latest security state. Both superusers and system administrators can make real-time permission adjustments. Specifically, anomaly detection can be performed using a Gaussian mixture model or an isolation forest to make real-time adjustments.

[0171] Audit function: the application can record every operation of the user, providing strong support for security audits.

[0172] In summary, the application has the advantages of fine-grained control of user permissions and real-time adjustment of system permissions through the RBAC mechanism, providing a more secure and efficient management method for container remote operation.

[0173] User access to system resources.

[0174] The application also provides a method for remotely accessing a container applied to a Web terminal in the embodiments of the application, as described in the following embodiments. Since the principle of solving the problem of the method is similar to that of the method for remotely accessing a container applied to a Web terminal of a system, the implementation of the method can be referred to the implementation of the method for remotely accessing a container applied to a Web terminal of a system, and the repeated parts will not be described again.

[0175] Figure 5 The flowchart of the method for remotely accessing a container applied to a Web terminal of a Web terminal in the embodiments of the application is shown in FIG. 2, which includes the following steps: Figure 5

[0176] Step 201: receiving a Web terminal remote login container request of a user, and sending the request to a backend server; the backend server is configured to obtain role information and permission information for operating a target container pre-configured for the current user from a database when the user identity is verified to be passed according to the Web terminal remote login container request; and feeding back a login success notification to the Web terminal when it is confirmed that the role of the current user and the current role have the permission to operate the target container;

[0177] Step 202: sending target container information and a Websocket connection request to the backend server when receiving the login success notification; the backend server is further configured to establish a Websocket connection with the Web terminal according to the Websocket connection request; and querying the target container of the physical machine according to the target container information and establishing a Websocket connection with the target container;

[0178] ​Step 203: receiving a current command of a user operating a target container, and sending the current command of the user operating the target container to a backend server; the backend server is further configured to send the current command to the target container when it is detected that a role of the current user has an operation permission of the current command according to a pre-configured relationship between different user roles and operation command permissions, so that the target container executes the current command and feeds back an execution result to the backend server; and feeding back the execution result to the Web terminal.

[0179] In one embodiment, the method for remotely accessing the container by the Web terminal further comprises pre-configuring the relationship between the different user roles and the operation command permissions in the following manner:

[0180] Obtaining a to-be-configured command;

[0181] Converting the to-be-configured command into a to-be-configured command feature vector;

[0182] Inputting the to-be-configured command feature vector into an operation command risk level identification model to obtain a risk level of operating the to-be-configured command; the operation command risk level identification model is pre-trained according to a plurality of command and corresponding operation command risk level sample data;

[0183] According to the risk level of operating the to-be-configured command, configuring operation command permissions for different user roles to obtain the relationship between the different user roles and the operation command permissions.

[0184] In one embodiment, the method for remotely accessing the container by the Web terminal further comprises pre-training the operation command risk level identification model in the following manner:

[0185] Obtaining different historical commands and a risk level sample data set corresponding to operating the different historical commands, and dividing the sample data set into a training data set and a verification data set;

[0186] Building a recurrent neural network (RNN) model, wherein a word embedding vector converted from a historical command text is used as an input layer of the RNN model, a softmax classifier is used as an output layer of the RNN model, and the output layer is used to output a probability distribution of a risk level corresponding to each historical command;

[0187] Training the RNN model by using the training data set, setting a loss function as a cross-entropy loss function, using an adam optimizer, and iteratively optimizing model parameters until a trained operation command risk level identification model is obtained;

[0188] The trained operation command risk level identification model is evaluated by using a verification data set, and according to the accuracy, precision and recall rate indexes, the structure and parameters of the model are adjusted to obtain a verified operation command risk level identification model as the pre-trained operation command risk level identification model, which is deployed in the backend server.

[0189] In one embodiment, the backend server is further configured to adjust the user role and operation command authority in real time, so as to ensure that the changes of the user role and operation command authority are responded in time and the latest security state is maintained.

[0190] In one embodiment, the backend server is further configured to perform anomaly detection by using a Gaussian mixture model or an isolated forest, and to adjust the user role and operation command authority in real time.

[0191] In one embodiment, the Web terminal is an Xterm-based Web terminal, and the Web terminal uses Xterm.js to realize the input and output of terminal command lines.

[0192] In one embodiment, the backend server is further configured to record the operation of the user on the current command of the target container in a database, so as to audit and track the user activity subsequently.

[0193] In one embodiment, the backend server is further configured to record the operation of the user on the current command of the target container in a blockchain, so as to audit and track the user activity subsequently.

[0194] In one embodiment, a plurality of containers run on a physical machine, and the physical machine represents an actual server or host running the containers, and each container provides an isolated execution environment to ensure that the command execution of users does not interfere with each other.

[0195] The embodiment of the present application also provides a method for remotely accessing a container applied to a backend server, as described in the following embodiment. Since the principle of solving the problem of the method is similar to that of the method for remotely accessing a container applied to the Web terminal of the system, the implementation of the method can be referred to the implementation of the method for remotely accessing a container applied to the Web terminal of the system, and the repeated parts will not be described herein.

[0196] Figure 6 The flowchart of the method for remotely accessing a container applied to the Web terminal of the backend server in the embodiment of the present application is shown in FIG. 8, and the method comprises the following steps: Figure 6

[0197] ​Step 301: When the user identity is verified according to the Web terminal remote login container request, the role information and the permission information of the operation target container pre-configured for the current user are obtained from the database; when the role of the current user and the current role are confirmed to have the permission of operating the target container, a login success notification is fed back to the Web terminal; the Web terminal receives the Web terminal remote login container request of the user; when the login success notification is received, the target container information and the Websocket connection request are sent to the backend server;

[0198] Step 302: According to the Websocket connection request, the Websocket connection with the Web terminal is established; the target container of the physical machine is queried according to the target container information, and the Websocket connection with the target container is established; the Web terminal also receives the current command of the user operating the target container, and sends the current command of the user operating the target container to the backend server;

[0199] Step 303: When the role of the current user is detected to have the operation permission of the current command according to the pre-configured relationship between different user roles and operation command permissions, the current command is sent to the target container, so that the target container executes the current command and feeds back the execution result to the backend server; the execution result is fed back to the Web terminal.

[0200] In one embodiment, the above-mentioned method for the Web terminal to remotely access the container further comprises: pre-configuring the relationship between different user roles and operation command permissions in the following manner:

[0201] Obtaining a to-be-configured command;

[0202] Converting the to-be-configured command into a to-be-configured command feature vector;

[0203] Inputting the to-be-configured command feature vector into an operation command risk level identification model to obtain the risk level of operating the to-be-configured command; the operation command risk level identification model is pre-trained according to a plurality of command and corresponding operation command risk level relationship sample data to generate;

[0204] According to the risk level of operating the to-be-configured command, the operation command permissions for different user roles are configured to obtain the relationship between different user roles and operation command permissions.

[0205] In one embodiment, the above-mentioned method for the Web terminal to remotely access the container further comprises: pre-training the operation command risk level identification model in the following manner:

[0206] Obtaining different historical commands and a risk level sample data set corresponding to operating different historical commands, and dividing the sample data set into a training data set and a verification data set;

[0207] A recurrent neural network (RNN) model is constructed, in which a word embedding vector converted from the historical command text is taken as an input layer of the RNN model, and a softmax classifier is taken as an output layer of the RNN model, and the output layer is used to output a probability distribution of a risk level corresponding to each historical command;

[0208] The RNN model is trained by using the training data set, a cross-entropy loss function is set as a loss function, an adam optimizer is used, and model parameters are iteratively optimized until a trained operation command risk level identification model is obtained.

[0209] The trained operation command risk level identification model is evaluated by using a verification data set, the structure and parameters of the model are adjusted according to accuracy, precision and recall indicators, a verified operation command risk level identification model is obtained as the pre-trained operation command risk level identification model, and the model is deployed into a backend server.

[0210] In an embodiment, the method of remotely accessing the container on the Web side further includes that the backend server adjusts the user role and the operation command authority in real time to ensure that changes in the user role and the operation command authority are responded to in time and the latest security state is maintained.

[0211] In an embodiment, the backend server adjusts the user role and the operation command authority in real time, including that the backend server performs abnormality detection by using a Gaussian mixture model or an isolation forest to adjust the user role and the operation command authority in real time.

[0212] In an embodiment, the Web terminal is an Xterm-based Web terminal, and the Web terminal uses Xterm.js to realize input and output of a terminal command line.

[0213] In an embodiment, the method of remotely accessing the container on the Web side further includes that the backend server records operation of the user on a current command of a target container into a database to facilitate subsequent auditing and tracking of user activities.

[0214] In an embodiment, the method of remotely accessing the container on the Web side further includes that the backend server records operation of the user on a current command of a target container into a blockchain to facilitate subsequent auditing and tracking of user activities.

[0215] In an embodiment, a plurality of containers are run on a physical machine, the physical machine represents an actual server or host running the containers, and each container provides an isolated execution environment to ensure that command execution of users does not interfere with each other.

[0216] The embodiment of the present application also provides a system for remotely accessing a container by a Web terminal, as described in the following embodiment. Since the principle of solving the problem of the system is similar to the method for remotely accessing a container by a Web terminal applied to the system, the implementation of the system can refer to the implementation of the method for remotely accessing a container by a Web terminal applied to the system, and the repeated parts will not be described herein.

[0217] Figure 7 A structural schematic diagram of the system for remotely accessing a container by a Web terminal in the embodiment of the present application is shown in FIG. 1, and the system comprises: Figure 7

[0218] a Web terminal 01, configured to receive a request for remotely logging into a container by a Web terminal of a user, send the request to a backend server, send target container information and a Websocket connection request to the backend server upon receiving a login success notification, and send a current command for operating a target container of the user to the backend server;

[0219] a backend server 02, configured to obtain role information and permission information for operating a target container of a current user from a database upon verifying that the user identity is valid according to the request for remotely logging into a container by a Web terminal, feed back a login success notification to the Web terminal upon confirming that the role of the current user and the current role have the permission to operate the target container, establish a Websocket connection with the Web terminal according to the Websocket connection request, query the target container of a physical machine according to the target container information, and establish a Websocket connection with the target container, send a current command to the target container upon detecting that the role of the current user has the operation permission of the current command according to a preconfigured relationship between different user roles and operation command permissions, so that the target container executes the current command and feeds back an execution result to the backend server, and feed back the execution result to the Web terminal.

[0220] In one embodiment, the backend server is further configured to preconfigure the relationship between different user roles and operation command permissions according to the following method:

[0221] obtaining a to-be-configured command;

[0222] converting the to-be-configured command into a to-be-configured command feature vector;

[0223] inputting the to-be-configured command feature vector into an operation command risk level identification model to obtain a risk level of operating the to-be-configured command, wherein the operation command risk level identification model is generated by pretraining according to relationship sample data of a plurality of commands and corresponding operation command risk levels;

[0224] ​According to the risk level of the operation to be configured command, the operation command permission is configured for different user roles, and the relationship between the different user roles and the operation command permission is obtained.

[0225] In one embodiment, the backend server is further configured to pre-train the operation command risk level identification model by the following method:

[0226] Obtain different historical commands and risk level sample data sets corresponding to the operation of different historical commands, and divide the sample data sets into training data sets and validation data sets;

[0227] A recurrent neural network (RNN) model is constructed, wherein the word embedding vector converted from the historical command text is used as the input layer of the RNN model, and the softmax classifier is used as the output layer of the RNN model, and the output layer is used to output the probability distribution of the risk level corresponding to each historical command;

[0228] The RNN model is trained using the training data set, the loss function is set as a cross-entropy loss function, the adam optimizer is used, the model parameters are iteratively optimized, and the trained operation command risk level identification model is obtained;

[0229] The trained operation command risk level identification model is evaluated using the validation data set, the structure and parameters of the model are adjusted according to the accuracy, precision and recall rate indicators, and the validated operation command risk level identification model is obtained as the pre-trained operation command risk level identification model, which is deployed to the backend server.

[0230] In one embodiment, the backend server is further configured to adjust the user role and the operation command permission in real time to ensure timely response to changes in the user role and the operation command permission and maintain the latest security state.

[0231] In one embodiment, the backend server is specifically configured to perform anomaly detection by using a Gaussian mixture model or an isolated forest to adjust the user role and the operation command permission in real time.

[0232] In one embodiment, the Web terminal is an Xterm-based Web terminal, and the Web terminal uses Xterm.js to realize the input and output of terminal command lines.

[0233] In one embodiment, the backend server is further configured to record the operation of the user on the target container current command in the database for subsequent auditing and tracking of user activities.

[0234] In one embodiment, the backend server is further configured to record the operation of the user on the target container current command in the blockchain for subsequent auditing and tracking of user activities.

[0235] In one embodiment, multiple containers run on a physical machine, which represents an actual server or host running the containers, and each container provides an isolated execution environment to ensure that the command execution of users does not interfere with each other.

[0236] The embodiment of the present application also provides a Web terminal for remotely accessing the container, as described in the following embodiment. Since the principle of solving the problem of the Web terminal is similar to the method for remotely accessing the container on the Web side of the system, the implementation of the Web terminal can refer to the implementation of the method for remotely accessing the container on the Web side of the system, and the repeated parts will not be described herein.

[0237] Figure 8 A structure diagram of the Web terminal for remotely accessing the container on the Web side of the embodiment of the present application is shown in FIG. 1, and the Web terminal comprises: Figure 8

[0238] The first receiving unit 011 is configured to receive a Web-side remote login container request of a user, and the request is sent to a backend server; receive a current command of the user for operating a target container, and the current command of the user for operating the target container is sent to the backend server; the backend server is configured to, when the user identity is verified to be passed according to the Web-side remote login container request, obtain role information and permission information for operating the target container, which are preconfigured for the current user from a database; when it is confirmed that the role of the current user and the current role have the permission for operating the target container, feedback a login success notification to the Web terminal; when it is detected that the role of the current user has the operation permission of the current command according to the preconfigured relationship between different user roles and operation command permissions, send the current command to the target container, so that the target container executes the current command and feeds back an execution result to the backend server; and feed back the execution result to the Web terminal.

[0239] The first sending unit 012 is configured to, when receiving the login success notification, send target container information and a Websocket connection request to the backend server; and the backend server is further configured to establish a Websocket connection with the Web terminal according to the Websocket connection request, and query the target container of the physical machine according to the target container information, and establish a Websocket connection with the target container.

[0240] In one embodiment, the Web side or the backend server is further configured to preconfigure the relationship between different user roles and operation command permissions according to the following method:

[0241] Obtain a to-be-configured command;

[0242] Convert the to-be-configured command into a to-be-configured command feature vector;

[0243] ​inputting the to-be-configured command feature vector into an operation command risk level identification model to obtain a risk level of the to-be-configured operation command; the operation command risk level identification model is generated in advance according to a plurality of command and corresponding operation command risk level relationship sample data;

[0244] configuring operation command permissions for different user roles according to the risk level of the to-be-configured operation command to obtain a relationship between different user roles and operation command permissions.

[0245] In one embodiment, the web terminal or the backend server is further configured to generate the operation command risk level identification model in advance by using the following method:

[0246] obtaining a sample data set of different historical commands and corresponding risk levels of the different historical commands, and dividing the sample data set into a training data set and a verification data set;

[0247] constructing a recurrent neural network (RNN) model, wherein a word embedding vector converted from a historical command text is used as an input layer of the RNN model, a softmax classifier is used as an output layer of the RNN model, and the output layer is used to output a probability distribution of a risk level corresponding to each historical command;

[0248] training the RNN model by using the training data set, setting a loss function as a cross-entropy loss function, using an adam optimizer, and iteratively optimizing model parameters until a trained operation command risk level identification model is obtained;

[0249] evaluating the trained operation command risk level identification model by using the verification data set, adjusting the structure and parameters of the model according to accuracy, precision, and recall indicators, and obtaining a verified operation command risk level identification model as the operation command risk level identification model generated in advance, which is deployed to the backend server.

[0250] In one embodiment, the backend server is further configured to adjust the user roles and the operation command permissions in real time to ensure that changes in the user roles and the operation command permissions are responded to in a timely manner and the latest security state is maintained.

[0251] In one embodiment, the backend server is specifically configured to perform anomaly detection by using a Gaussian mixture model or an isolation forest to adjust the user roles and the operation command permissions in real time.

[0252] In one embodiment, the web terminal is an Xterm-based web terminal, and the web terminal uses Xterm.js to implement input and output of terminal command lines.

[0253] In one embodiment, the backend server is further configured to record the operation of the user on the current command of the target container into a database for subsequent auditing and tracking of user activities.

[0254] In one embodiment, the backend server is further configured to record the operation of the user on the current command of the target container into a blockchain for subsequent auditing and tracking of user activities.

[0255] In one embodiment, a plurality of containers are running on a physical machine, which represents an actual server or host running the containers, and each container provides an isolated execution environment to ensure that the command execution of users does not interfere with each other.

[0256] The embodiment of the present application also provides a backend server for remotely accessing containers on the Web side, as described in the following embodiment. Since the principle of solving the problem of the backend server is similar to the method of remotely accessing containers on the Web side of the system, the implementation of the backend server can refer to the implementation of the method of remotely accessing containers on the Web side of the system, and the repeated parts will not be described again.

[0257] Figure 9 The structure of the backend server for remotely accessing containers on the Web side in the embodiment of the present application is shown in FIG. 1, which includes: Figure 9

[0258] The login unit 021 is configured to obtain role information and permission information for operating the target container pre-configured for the current user from the database when the user identity is verified to be passed according to the Web-side remote login container request; and feed back a login success notification to the Web terminal when it is confirmed that the role of the current user and the current role have the permission to operate the target container; the Web-side remote login container request is sent from the Web terminal, the Web terminal is configured to receive the Web-side remote login container request of the user; and send the target container information and a Websocket connection request to the backend server when the login success notification is received.

[0259] The connection unit 022 is configured to establish a Websocket connection with the Web terminal according to the Websocket connection request; query the target container of the physical machine according to the target container information, and establish a Websocket connection with the target container; the Web terminal is further configured to receive the current command of the user operating the target container, and send the current command of the user operating the target container to the backend server.

[0260] ​The access unit 023 is configured to send the current command to the target container to make the target container execute the current command and feed back an execution result to the backend server when it is detected that the role of the current user has the operation permission of the current command according to the preconfigured relationship between different user roles and operation command permissions; and feed back the execution result to the web terminal.

[0261] In one embodiment, the backend server of the web terminal remotely accessing the container further comprises a configuration unit configured to preconfigure the relationship between different user roles and operation command permissions according to the following method:

[0262] Obtain a to-be-configured command;

[0263] Convert the to-be-configured command into a to-be-configured command feature vector;

[0264] Input the to-be-configured command feature vector into an operation command risk level identification model to obtain a risk level of operating the to-be-configured command; the operation command risk level identification model is pre-trained according to a plurality of command and corresponding operation command risk level relationship sample data;

[0265] Configure operation command permissions for different user roles according to the risk level of operating the to-be-configured command to obtain the relationship between different user roles and operation command permissions.

[0266] In one embodiment, the configuration unit is further configured to pre-train the operation command risk level identification model according to the following method:

[0267] Obtain different historical commands and a risk level sample data set corresponding to operating the different historical commands, and divide the sample data set into a training data set and a verification data set;

[0268] Build a recurrent neural network (RNN) model, wherein a word embedding vector converted from a historical command text is used as an input layer of the RNN model, and a softmax classifier is used as an output layer of the RNN model, and the output layer is configured to output a probability distribution of a risk level corresponding to each historical command;

[0269] Train the RNN model using the training data set, set a loss function as a cross-entropy loss function, use an adam optimizer, and iteratively optimize model parameters until a trained operation command risk level identification model is obtained;

[0270] Evaluate the trained operation command risk level identification model using the verification data set, adjust the structure and parameters of the model according to accuracy, precision, and recall indicators, and obtain a verified operation command risk level identification model as the pre-trained operation command risk level identification model, which is deployed to the backend server.

[0271] In an embodiment, the backend server of the web terminal for remotely accessing the container further comprises an adjusting unit for adjusting the user role and the operation command authority in real time, so as to ensure that the change of the user role and the operation command authority is responded in time and the latest security state is maintained.

[0272] In an embodiment, the adjusting unit is specifically configured to perform abnormality detection by using a Gaussian mixture model or an isolated forest, and to adjust the user role and the operation command authority in real time.

[0273] In an embodiment, the web terminal is an Xterm-based web terminal, and the web terminal uses Xterm.js to realize input and output of a terminal command line.

[0274] In an embodiment, the backend server of the web terminal for remotely accessing the container further comprises a first recording unit for recording the operation of the user on the current command of the target container into a database, so as to audit and trace the user activity subsequently.

[0275] In an embodiment, the backend server of the web terminal for remotely accessing the container further comprises a second recording unit for recording the operation of the user on the current command of the target container into a blockchain, so as to audit and trace the user activity subsequently.

[0276] In an embodiment, the plurality of containers are run on a physical machine, and the physical machine represents an actual server or host running the container, and each container provides an isolated execution environment to ensure that the command execution of the users does not interfere with each other.

[0277] An embodiment of the present application further provides a computer device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the method for remotely accessing the container by the web terminal when executing the computer program.

[0278] An embodiment of the present application further provides a computer readable storage medium, which stores a computer program, and the computer program is executable on a processor to implement the method for remotely accessing the container by the web terminal.

[0279] An embodiment of the present application further provides a computer program product, which comprises a computer program, and the computer program is executable on a processor to implement the method for remotely accessing the container by the web terminal.

[0280] Compared with the prior art, the method for remotely accessing the container by the web terminal has the beneficial technical effects that:

[0281] Firstly, the embodiment of the present application pre-configures role information and permission information of operating the target container for the current user, and feeds back login success notification to the Web terminal when confirming the role of the current user and the current role has the permission of operating the target container, thereby realizing flexible definition of user role according to actual demand, allocating the permission of operating the target container for users of different roles, and improving the flexibility of the system.

[0282] Secondly, the embodiment of the present application pre-configures the relationship between different user roles and operation command permissions, and the backend server sends the current command to the target container when detecting that the role of the current user has the operation permission of the current command according to the pre-configured relationship between different user roles and operation command permissions, so that the target container executes the current command and feeds back the execution result to the backend server; the execution result is fed back to the Web terminal, thereby realizing access to the command in the container according to the role of different users, realizing accurate control of the permission of user operation command, and improving the security of the system.

[0283] In summary, the embodiment of the present application realizes flexible and safe control of the access permission of the user to the command operation in the container according to the role of the user, and improves the flexibility and security of the system.

[0284] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can adopt a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program codes.

[0285] The present application is described with reference to flowcharts and / or block diagrams of the method, device (system), and computer program product according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The function specified in one flow or multiple flows and / or blocks Figure 1 The device that realizes the function specified in one block or multiple blocks.

[0286] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the flow Figure 1 The functions of a flow or multiple flows and / or a block or multiple blocks in conjunction with the disclosed aspects can be implemented on practitioners' computers in an interactive mode or in a batch mode. Figure 1

[0287] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flow Figure 1 The functions of a flow or multiple flows and / or a block or multiple blocks in conjunction with the disclosed aspects can be implemented on practitioners' computers in an interactive mode or in a batch mode. Figure 1

[0288] The above detailed description merely describes specific embodiments of the application, and the purpose of the above detailed description is to further illustrate the principles of the application, technical solutions and beneficial effects. It should be understood that the above detailed description is only a specific embodiment of the application and is not intended to limit the protection scope of the application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the application should be included in the protection scope of the application.​​

Claims

1. A method for remotely accessing a container from a web terminal, characterized in that, The method is applied to a system comprising a Web terminal and a backend server, and the method comprises: The Web terminal receives a Web terminal remote login container request of a user, and sends the request to the backend server; When the backend server verifies the identity of the user according to the Web terminal remote login container request and the verification is passed, the backend server obtains role information and permission information for operating a target container that is previously configured for the current user from a database; when the role of the current user and the current role are confirmed to have the permission for operating the target container, the backend server feeds back a login success notification to the Web terminal; When the Web terminal receives the login success notification, the Web terminal sends target container information and a Websocket connection request to the backend server; The backend server establishes a Websocket connection with the Web terminal according to the Websocket connection request; and queries the target container of a physical machine according to the target container information, and establishes a Websocket connection with the target container; The Web terminal receives a current command of the user for operating the target container, and sends the current command of the user for operating the target container to the backend server; When the backend server detects that the role of the current user has the operation permission of the current command according to a preconfigured relationship between different user roles and operation command permissions, the backend server sends the current command to the target container, so that the target container executes the current command and feeds back an execution result to the backend server; and the backend server feeds back the execution result to the Web terminal.

2. The method of claim 1, wherein, Further comprising: preconfiguring the relationship between different user roles and operation command permissions by the following method: Obtaining a to-be-configured command; Converting the to-be-configured command into a to-be-configured command feature vector; Inputting the to-be-configured command feature vector into an operation command risk level identification model to obtain a risk level of operating the to-be-configured command; the operation command risk level identification model is generated by pretraining according to a plurality of command and corresponding operation command risk level relationship sample data; According to the risk level of operating the to-be-configured command, configuring operation command permissions for different user roles to obtain the relationship between different user roles and operation command permissions.

3. The method of claim 2, wherein, Further comprising: pretraining the operation command risk level identification model by the following method: Obtaining different historical commands and a risk level sample data set corresponding to operating different historical commands, and dividing the sample data set into a training data set and a verification data set; Building a recurrent neural network (RNN) model, wherein a word embedding vector converted from a historical command text is used as an input layer of the RNN model, and a softmax classifier is used as an output layer of the RNN model, and the output layer is used to output a probability distribution of a risk level corresponding to each historical command; Training the RNN model using the training data set, setting a loss function as a cross-entropy loss function, using an adam optimizer, and iteratively optimizing model parameters until a trained operation command risk level identification model is obtained. The trained operation command risk level identification model is evaluated by using a verification data set, and the structure and parameters of the model are adjusted according to the accuracy, precision and recall rate indexes, so as to obtain a verified operation command risk level identification model as the pre-trained operation command risk level identification model, which is deployed in the backend server.

4. The method of claim 1, wherein, Also includes: The backend server adjusts the user role and operation command permission in real time to ensure timely response to changes in user role and operation command permission and maintain the latest security state.

5. The method of claim 4, wherein, The backend server adjusts the user role and operation command permission in real time, including: the backend server performs anomaly detection by Gaussian Mixture Model or Isolation Forest to adjust the user role and operation command permission in real time.

6. The method of claim 1, wherein, The Web terminal is an Xterm-based Web terminal, and the Web terminal uses Xterm.js to realize the input and output of terminal command lines.

7. The method of claim 1, wherein, Also includes: The backend server records the user's operation of the current command of the target container in the database for subsequent auditing and tracking of user activities.

8. The method of claim 1, wherein, Also includes: The backend server records the user's operation of the current command of the target container in the blockchain for subsequent auditing and tracking of user activities.

9. The method of claim 1, wherein, Multiple containers run on a physical machine, which represents an actual server or host running containers, and each container provides an isolated execution environment to ensure that command execution between users does not interfere with each other.

10. A method for remotely accessing a container from a web terminal, characterized in that, The method is applied to a Web terminal, and the method comprises: Receiving a Web terminal remote login container request of a user, and sending the request to a backend server; the backend server is configured to obtain role information pre-configured for the current user and permission information for operating a target container from a database when the user identity is verified to be valid according to the Web terminal remote login container request; and feeding back a login success notification to the Web terminal when it is confirmed that the role of the current user and the current role have the permission to operate the target container; When receiving the login success notification, sending target container information and a Websocket connection request to the backend server; the backend server is further configured to establish a Websocket connection with the Web terminal according to the Websocket connection request; and querying the target container of the physical machine according to the target container information, and establishing a Websocket connection with the target container; Receiving a current command of the user operating the target container, and sending the current command of the user operating the target container to the backend server; the backend server is further configured to send the current command to the target container when it is detected that the role of the current user has the operation permission of the current command according to the pre-configured relationship between different user roles and operation command permissions, so that the target container executes the current command and feeds back the execution result to the backend server; and feeding back the execution result to the Web terminal.

11. The method of claim 10, wherein, Also includes: pre-configuring the relationship between different user roles and operation command permissions in the following method: Obtaining a to-be-configured command; Converting the to-be-configured command into a to-be-configured command feature vector; The operation command risk level identification model is generated in advance according to a plurality of commands and corresponding operation command risk level relationship sample data; According to the risk level of the operation to-be-configured command, operation command permissions are configured for different user roles to obtain a relationship between different user roles and operation command permissions.

12. A method for remotely accessing a container from a web terminal, characterized in that, The method is applied to a backend server, and the method comprises: When the user identity is verified to be passed according to the Web terminal remote login container request, role information pre-configured for the current user and permission information of the operation target container are obtained from a database; when the role of the current user and the current role are confirmed to have the permission of the operation target container, a login success notification is fed back to the Web terminal; the Web terminal is used for receiving the Web terminal remote login container request of the user; when the login success notification is received, target container information and a Websocket connection request are sent to the backend server; According to the Websocket connection request, a Websocket connection with the Web terminal is established; the target container of the physical machine is queried according to the target container information, and a Websocket connection with the target container is established; the Web terminal is also used for receiving the current command of the user operation target container, and the current command of the user operation target container is sent to the backend server; When the role of the current user is detected to have the operation permission of the current command according to the pre-configured relationship between different user roles and operation command permissions, the current command is sent to the target container, so that the target container executes the current command and feeds back an execution result to the backend server; the execution result is fed back to the Web terminal.

13. The method of claim 12, wherein, Further comprising: pre-configuring the relationship between different user roles and operation command permissions by the following method: Obtaining a to-be-configured command; Converting the to-be-configured command into a to-be-configured command feature vector; The operation command risk level identification model is generated in advance according to a plurality of commands and corresponding operation command risk level relationship sample data; According to the risk level of the operation to-be-configured command, operation command permissions are configured for different user roles to obtain a relationship between different user roles and operation command permissions.

14. A system for web-based remote access to containers, the system comprising: Comprise: The Web terminal is used for receiving the Web terminal remote login container request of the user, and sending the request to the backend server; When the login success notification is received, target container information and a Websocket connection request are sent to the backend server; the current command of the user operation target container is received, and the current command of the user operation target container is sent to the backend server; The backend server is used for obtaining role information pre-configured for the current user and permission information of the operation target container from a database when the user identity is verified to be passed according to the Web terminal remote login container request; When it is confirmed that the role of the current user and the current role have the permission to operate the target container, a login success notification is fed back to the web terminal; a websocket connection with the web terminal is established according to a websocket connection request; the target container of the physical machine is queried according to the target container information, and a websocket connection with the target container is established; when it is detected that the role of the current user has the operation permission of the current command according to the relationship between the different user roles and the operation command permissions, the current command is sent to the target container, so that the target container executes the current command and feeds back the execution result to the backend server; the execution result is fed back to the web terminal.

15. A Web terminal for remotely accessing a container from a Web terminal, comprising: Comprise: The first receiving unit is used for receiving the web terminal remote login container request of the user, and the request is sent to the backend server; the current command of the user operating the target container is received, and the current command of the user operating the target container is sent to the backend server; the backend server is used for obtaining the role information and the permission information of operating the target container pre-configured for the current user from the database when the user identity is verified to be passed according to the web terminal remote login container request; When it is confirmed that the role of the current user and the current role have the permission to operate the target container, a login success notification is fed back to the web terminal; when it is detected that the role of the current user has the operation permission of the current command according to the relationship between the different user roles and the operation command permissions, the current command is sent to the target container, so that the target container executes the current command and feeds back the execution result to the backend server; the execution result is fed back to the web terminal; The first sending unit is used for sending the target container information and the websocket connection request to the backend server when the login success notification is received; the backend server is also used for establishing the websocket connection with the web terminal according to the websocket connection request; the target container of the physical machine is queried according to the target container information, and the websocket connection with the target container is established.

16. A back-end server of a web-enabled remote access container, characterized in that, Comprise: The login unit is used for obtaining the role information and the permission information of operating the target container pre-configured for the current user from the database when the user identity is verified to be passed according to the web terminal remote login container request; When it is confirmed that the role of the current user and the current role have the permission to operate the target container, a login success notification is fed back to the web terminal; the web terminal remote login container request is sent from the web terminal, and the web terminal is used for receiving the web terminal remote login container request of the user; the target container information and the websocket connection request are sent to the backend server when the login success notification is received; The connection unit is used for establishing the websocket connection with the web terminal according to the websocket connection request; the target container of the physical machine is queried according to the target container information, and the websocket connection with the target container is established; the web terminal is also used for receiving the current command of the user operating the target container, and sending the current command of the user operating the target container to the backend server; The access unit is configured to send the current command to the target container to make the target container execute the current command and feed back an execution result to the backend server when it is detected that the role of the current user has the operation permission of the current command according to the preconfigured relationship between different user roles and operation command permissions; and feed back the execution result to the web terminal.

17. The back-end server of claim 16, wherein, The configuration unit is further configured to preconfigure the relationship between different user roles and operation command permissions according to the following method: Obtain a to-be-configured command; Convert the to-be-configured command into a to-be-configured command feature vector; Input the to-be-configured command feature vector into an operation command risk level identification model to obtain a risk level of the operation to-be-configured command; the operation command risk level identification model is generated by pretraining according to multiple command and corresponding operation command risk level relationship sample data; Configure operation command permissions for different user roles according to the risk level of the operation to-be-configured command to obtain the relationship between different user roles and operation command permissions.

18. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein, The processor executes the computer program to implement the method in any one of claims 1 to 13.

19. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the method in any one of claims 1 to 13.

20. A computer program product, characterised in that, The computer program product comprises a computer program, and the computer program is executed by the processor to implement the method in any one of claims 1 to 13.

Images