Dynamic routing and forwarding system and method for bastion resource access

Abstract

The application discloses a dynamic routing forwarding system and method for bastion machine resource access, belongs to the technical field of application software development, and aims to solve the technical problem of how to improve the operation and maintenance efficiency of the bastion machine.The system comprises a cluster deployment module, a dynamic routing forwarding module, a link object management module and a cluster monitoring module; the cluster deployment module is used for establishing a cluster among multiple bastion machines; the link object management module is used for managing the life cycle of a link object; the dynamic routing forwarding module is used for sending a link object acquisition request to the link object management module based on the analysis result of a resource link request; the link object management module is used for returning link object information to the dynamic routing forwarding module; the cluster monitoring module is used for returning link object information to the dynamic routing forwarding module based on the resource utilization rate of the bastion machine node based on a detection bastion machine resource utilization rate request; and the dynamic routing forwarding module is used for forwarding the resource link request to a specified bastion machine node.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of application software development, in particular to a dynamic routing forwarding system and method for resource access of a bastion host. BACKGROUND

[0002] With the rapid development of the Internet and digitization, data leakage incidents occur frequently, and enterprises face increasing information security risks. As a special security protection tool, the bastion host can effectively protect the core data and business systems of enterprises, prevent data leakage and illegal access.

[0003] The bastion host can centrally manage multiple servers and applications, simplify management processes, and reduce the management difficulty and maintenance cost of enterprises. At the same time, the bastion host can also record every operation of the user in detail, so that the administrator can comprehensively view the track of the user's operation, which is crucial for audit tracing, compliance checking and discovering potential security problems.

[0004] At present, the bastion host is widely used in the financial industry, government agencies, enterprises, multi-cloud environments and other scenarios. How to improve the operation and maintenance efficiency of the bastion host is a technical problem to be solved. SUMMARY

[0005] The technical task of the present application is to provide a dynamic routing forwarding system and method for resource access of a bastion host to solve the technical problem of how to improve the operation and maintenance efficiency of the bastion host.

[0006] In a first aspect, the present application provides a dynamic routing forwarding system for resource access of a bastion host, comprising a cluster deployment module, a dynamic routing forwarding module, a link object management module and a cluster monitoring module.

[0007] The cluster deployment module is used to establish a cluster among multiple bastion hosts, and the bastion host node, the dynamic routing forwarding module, the link object management module and the cluster monitoring module are deployed in the same network.

[0008] The link object management module is used to manage the life cycle of the link object and store the link object information in the local cache.

[0009] The cluster monitoring module is used to receive the performance information uploaded by the bastion host node and display the performance information through a visual interface, and return a cluster unique identifier to each bastion host.

[0010] The cluster monitoring module is used to receive the resource usage rate of the bastion host node, predict the resource usage rate of the bastion host node in the future time period according to the resource usage rate of the bastion host node, set the weight ratio of the bastion host node, and display the resource usage rate and the weight ratio of the bastion host node through a visual interface.

[0011] The cluster monitoring module is configured to periodically send a health check request to the bastion node, to determine the running state of the bastion node based on the response of the bastion node, and to send a link object deletion request to the link object management module for a bastion node in a down state.

[0012] The dynamic routing forwarding module is configured to receive and parse a resource link request uploaded by the bastion node, to send a link object acquisition request to the link object management module based on the parsing result of the resource link request, and to send a bastion resource usage rate detection request to the cluster monitoring module based on the resource link request.

[0013] Preferably, after receiving the link object acquisition request sent by the dynamic routing forwarding module, the link object management module checks whether the resource link object specified in the link object acquisition request exists in the local cache. If the corresponding resource link object exists in the link object management module, the dynamic routing forwarding module sends a bastion resource usage rate detection request to the cluster monitoring module, the cluster monitoring module filters based on the future scheduled period of bastion resource usage rate, and returns the final link object information to the dynamic routing forwarding module, and the dynamic routing forwarding module forwards the resource link request to the specified bastion node.

[0014] If the corresponding resource link object does not exist in the link object management module, the dynamic routing forwarding module sends a link object consultation request to the cluster monitoring module, the cluster monitoring module queries the currently available bastion node based on the link object consultation request, and returns the final link object information to the dynamic routing forwarding module, and the dynamic routing forwarding module forwards the resource link request to the specified bastion node.

[0015] The link object information includes the access address of the bastion node where the resource link object is located and the cluster unique identifier of the bastion node.

[0016] As preferred, for different resource link objects, the link object management module is configured to store the local cache with the resource IP, resource access port number and resource account number as key values, and to add the key to a resource link object key list, which is a list constructed based on a cluster unique identifier of a bastion machine where the resource link object is located;

[0017] After receiving the request for obtaining the resource link object, the link object management module is configured to find the corresponding resource link object from the local cache based on the resource IP, resource access port number and resource account number, parse the access address of the bastion machine where the resource link object is located and the cluster unique identifier of the bastion machine where the resource link object is located, and return the access address of the bastion machine where the resource link object is located and the cluster unique identifier of the bastion machine where the resource link object is located to the dynamic routing and forwarding module;

[0018] When the bastion machine node uses an existing resource link object to connect to a resource, the bastion machine node sends an update resource link object validity request to the link object management module, the resource link object validity request carrying the resource IP, resource access port number and resource account number, and the link object management module is configured to acquire the resource link object based on the resource IP, resource access port number and resource account number through a mutual exclusion lock, and extend the valid time length of the resource link object in the cache;

[0019] When the bastion machine node does not use an existing resource link object to connect to a resource, the bastion machine node sends an update resource link object validity request to the link object management module, the resource link object validity request carrying the resource IP, resource access port number, resource account number, resource link object and cluster unique identifier of the bastion machine where the resource link object is located, and the link object management module is configured to create or update the resource link object based on the resource IP, resource access port number and resource account number through a mutual exclusion lock;

[0020] Based on the link object deletion request sent by the cluster performance monitoring module, the link object management module is configured to parse the cluster unique identifier of the bastion machine where the resource link object is located based on the link object deletion request, acquire the resource link object key list from the local cache according to the cluster unique identifier, and delete the resource link object information corresponding to each key according to the resource link object key list.

[0021] As preferred, the cluster monitoring module is configured to periodically send a health check request to the bastion node, determine the running state of the bastion node according to the response of the bastion node, determine that the bastion node is in a normal running state if the bastion node responds within a predetermined time, determine that the bastion node is in a down state if the bastion node does not respond within the predetermined time and exceeds a set number of retries, set the weight ratio of the bastion node to zero, and send a link object deletion request to the link object management module, delete the corresponding resource link object based on the cluster unique identifier specified in the link object deletion request, and reset the weight ratio of the bastion node when the downed bastion node restarts and reports its resource usage.

[0022] As preferred, after receiving the detection bastion resource usage request sent by the dynamic routing forwarding module, the cluster monitoring module is configured to parse the cluster unique identifier of the bastion node specified in the detection bastion resource usage request, obtain the resource usage of the bastion node in a future predetermined time period according to the cluster unique identifier, return the cluster unique identifier of the bastion node to the dynamic routing forwarding module when the resource usage does not exceed a maximum threshold, select a bastion node with sufficient resources according to the resource usage and the weight ratio of other bastion nodes, and return the cluster unique identifier and access address of the bastion node when the resource usage exceeds the maximum threshold, and select a bastion node with sufficient resources according to whether the resource usage of the bastion node exceeds a threshold and the weight ratio of the bastion node, and return the cluster unique identifier and access address of the bastion node when the cluster unique identifier of the bastion node in the detection bastion resource usage request is not parsed.

[0023] In a second aspect, the present application discloses a dynamic routing forwarding method for bastion resource access, which is used to realize dynamic routing forwarding for bastion resource access through the dynamic routing forwarding system for bastion resource access according to any one of the first aspect, and the method comprises the following steps:

[0024] A cluster is established among a plurality of bastions, and the bastion node, the dynamic routing forwarding module, the link object management module, and the cluster monitoring module are deployed in the same network;

[0025] The link object management module is used to manage the life cycle of the link object and store the link object information in the local cache

[0026] The cluster monitoring module is used to receive performance information uploaded by the bastion node, display the performance information through a visual interface provided by the cluster monitoring module, and return a cluster unique identifier to each bastion through the cluster monitoring module;

[0027] The cluster monitoring module receives the self resource usage rate uploaded by the bastion node, predicts the resource usage rate of the bastion node in a future time period according to the self resource usage rate of the bastion node, sets a weight ratio of the bastion node, and displays the resource usage rate and the weight ratio of the bastion node through a visual interface;

[0028] The cluster monitoring module periodically sends a health check request to the bastion node, judges the running state of the bastion node based on the response of the bastion node, and sends a link object deletion request to the link object management module for the bastion node in a down state, and deletes the corresponding link object in the local cache based on the link object deletion request.

[0029] For the resource link request uploaded by the bastion node, the dynamic routing forwarding module analyzes the resource link request uploaded by the bastion node, sends a link object information request to the link object management module based on the analysis result of the resource link request, the link object management module searches the local for the corresponding link object and returns the link object information to the dynamic routing forwarding module, the dynamic routing forwarding module sends a bastion resource usage rate detection request to the cluster monitoring module, the cluster monitoring module returns the link object information to the dynamic routing forwarding module based on the bastion resource usage rate based on the bastion node, and the dynamic routing forwarding module forwards the resource link request to the specified bastion node.

[0030] As a preferred, after the link object management module receives the link object information request sent by the dynamic routing forwarding module, it searches the local cache to determine whether the resource link object specified in the link object information request exists, if the corresponding resource link object exists in the link object management module, the dynamic routing forwarding module sends a bastion resource usage rate detection request to the cluster monitoring module, the cluster monitoring module filters based on the future predetermined time period of the bastion resource usage rate, returns the final link object information to the dynamic routing forwarding module, and the dynamic routing forwarding module forwards the resource link request to the specified bastion node.

[0031] If the corresponding resource link object does not exist in the link object management module, the dynamic routing forwarding module sends a link object consultation request to the cluster monitoring module, the cluster monitoring module queries the currently available bastion node based on the link object consultation request, returns the final link object information to the dynamic routing forwarding module, and the dynamic routing forwarding module forwards the resource link request to the specified bastion node.

[0032] The link object information includes the access address of the bastion node where the resource link object is located and the cluster unique identifier of the bastion node.

[0033] As preferred, for different resource link objects, the link object management module stores the local cache with the resource IP, resource access port number and resource account as the key value, and adds the key to the resource link object key list, which is a list based on the cluster unique identifier of the bastion machine where the resource link object is located;

[0034] After receiving the resource link object acquisition request, the link object management module finds the corresponding resource link object from the local cache based on the resource IP, resource access port number and resource account, parses the access address of the bastion machine where the resource link object is located and the cluster unique identifier of the bastion machine where the resource link object is located, and returns the access address of the bastion machine where the resource link object is located and the cluster unique identifier of the bastion machine where the resource link object is located to the dynamic routing forwarding module;

[0035] When the bastion machine node uses the existing resource link object to connect the resource, the bastion machine node sends an update resource link object validity request to the link object management module, the resource link object validity request carries the resource IP, resource access port number and resource account, the link object management module obtains the resource link object based on the resource IP, resource access port number and resource account through the mutual exclusion lock, and prolongs the valid time of the resource link object in the cache;

[0036] When the bastion machine node does not use the existing resource link object to connect the resource, the bastion machine node sends an update resource link object validity request to the link object management module, the resource link object validity request carries the resource IP, resource access port number, resource account, resource link object, and cluster unique identifier of the bastion machine where the resource link object is located, the link object management module creates or updates the resource link object based on the resource IP, resource access port number and resource account through the mutual exclusion lock;

[0037] Based on the link object deletion request sent by the cluster performance monitoring module, the link object management module parses the cluster unique identifier of the bastion machine where the resource link object is located based on the link object deletion request, obtains the resource link object key list from the local cache according to the cluster unique identifier, and deletes the resource link object information corresponding to each key according to the resource link object key list.

[0038] As preferred, the cluster monitoring module periodically sends a health check request to the bastion node, judges the running state of the bastion node according to the response of the bastion node, if the bastion node responds within a predetermined time, determines that the bastion node is in a normal running state, if the bastion node does not respond within a predetermined time and exceeds the set retry number, determines that the bastion node is in a down state, sets the weight ratio of the bastion node to zero, and sends a link object deletion request to the link object management module, deletes the corresponding resource link object based on the cluster unique identifier specified in the link object deletion request, and resets the weight ratio of the bastion node when the downed bastion node restarts and reports its resource usage.

[0039] As preferred, after receiving the detection bastion resource usage request sent by the dynamic routing forwarding module, the cluster monitoring module parses the cluster unique identifier of the bastion node specified in the detection bastion resource usage request, obtains the resource usage of the bastion node in a future predetermined time period according to the cluster unique identifier, returns the cluster unique identifier of the bastion node to the dynamic routing forwarding module when the resource usage does not exceed the maximum threshold, selects a resource sufficient bastion node according to the resource usage and weight ratio of other bastion nodes and returns the cluster unique identifier and access address of the bastion node when the resource usage exceeds the maximum threshold, and selects a resource sufficient bastion node according to whether the resource usage of the bastion node exceeds the threshold and the weight ratio of the bastion node and returns the cluster unique identifier and access address of the bastion node when the cluster unique identifier of the bastion node in the detection bastion resource usage request is not parsed.

[0040] The dynamic routing forwarding system and method for accessing the bastion resource of the application have the following advantages:

[0041] 1. The resource link object is reusable, which greatly shortens the time consumption in the resource connection process and improves the resource connection efficiency;

[0042] 2. The cluster monitoring module receives the performance data of all bastion nodes, predicts the resource usage in a future time period according to the resource usage of the bastion node itself, which facilitates the subsequent allocation of resource link objects and improves the efficiency;

[0043] 3. The visual page of the cluster resource monitoring module can display the performance information of all bastion nodes in real time, which facilitates the administrator to understand the overall running state of the cluster and provides data support for the upgrade and expansion of the bastion node. BRIEF DESCRIPTION OF DRAWINGS

[0044] In order to make the technical solutions in the embodiments of the present application clearer, the accompanying drawings needed in the embodiments or prior art description will be briefly introduced. Obviously, the accompanying drawings in the following description only show some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort.

[0045] The present application will be further described below in conjunction with the accompanying drawings.

[0046] Figure 1 A working principle block diagram of the dynamic routing forwarding module, the link object management module and the cluster monitoring module in the dynamic routing forwarding system for resource access of a bastion host in Embodiment 1. DETAILED DESCRIPTION

[0047] The present application will be further described below in conjunction with the accompanying drawings and specific embodiments, so that those skilled in the art can better understand the present application and implement it. However, the embodiments are not intended to limit the present application, and the technical features in the embodiments and the embodiments can be combined with each other without conflict.

[0048] The embodiments of the present application provide a dynamic routing forwarding system and method for resource access of a bastion host, which are used to solve the technical problem of how to improve the operation and maintenance efficiency of the bastion host.

[0049] Embodiment 1:

[0050] The present application provides a dynamic routing forwarding system for resource access of a bastion host, which comprises a cluster deployment module, a dynamic routing forwarding module, a link object management module and a cluster monitoring module.

[0051] The cluster deployment module is used to establish a cluster among multiple bastion hosts, and the bastion host node, the dynamic routing forwarding module, the link object management module and the cluster monitoring module are deployed in the same network.

[0052] In this embodiment, the cluster deployment module mainly establishes a cluster among multiple bastion hosts to realize load balancing and fault tolerance. All the bastion host nodes, the resource access dynamic routing forwarding module, the resource link object management module and the cluster monitoring module should be deployed in the same internal network to ensure the efficiency and security of communication, and the communication among the modules should use an encryption protocol (such as TLS / SSL) to prevent data leakage and tampering.

[0053] The link object management module is used to manage the life cycle of the link object and store the link object information in the local cache.

[0054] In this embodiment, for different resource link objects, the link object management module is configured to store the local cache with the resource IP, resource access port number and resource account as key values, and to add the key to a resource link object key list, which is a list constructed based on a cluster unique identifier of the bastion server on which the resource link object is located.

[0055] The cluster monitoring module is configured to receive performance information uploaded by the bastion server nodes and display the performance information through a visual interface, and return a cluster unique identifier to each bastion server.

[0056] In this embodiment, each bastion server sends its performance information to the cluster monitoring module when it is deployed, including IP, CPU, memory, hard disk, bastion server access address and the like. After receiving the performance information, the cluster monitoring module sends a unique bastion server identifier in the cluster to the current bastion server as the cluster unique identifier, which serves to uniquely identify the bastion server. The cluster monitoring module stores the performance information of all bastion server nodes in real time and provides a visual page of performance data, so as to facilitate the administrator to understand the overall running state of the cluster.

[0057] The cluster monitoring module is configured to receive the resource usage rate of the bastion server nodes uploaded by the bastion server nodes, predict the resource usage rate of the bastion server nodes in a future time period according to the resource usage rate of the bastion server nodes, set the weight ratio of the bastion server nodes, and display the resource usage rate of the bastion server nodes and the weight ratio through a visual interface.

[0058] In this embodiment, all bastion server nodes in the cluster periodically and actively report their resource usage rates to the cluster monitoring module of the bastion server, including the usage rates of CPU, memory and disk. The cluster monitoring module predicts the resource usage rate of the bastion server after the past time period according to the resource usage of the bastion server, sets a threshold value of the resource usage rate of the bastion server, and performs time-dimension analysis on the collected resource usage rate of the bastion server to determine the resource usage rate of the bastion server in a future time period and set the weight ratio of the usage of the bastion server. The greater the weight ratio of the usage of the bastion server, the more sufficient the available resources of the bastion server, and the more effective the connection of the bastion server with the resources. Conversely, the fewer the resources that can be controlled by the bastion server, the lower the performance of the bastion server, and the less efficient the connection of the bastion server with the resources. The administrator manually sets the weight ratio of the usage of the bastion server in the performance data visualization page of the bastion server.

[0059] The cluster monitoring module is configured to periodically send a health check request to the bastion node, to determine the running state of the bastion node based on the response of the bastion node, and to send a link object deletion request to the link object management module for a bastion node in a down state.

[0060] In this embodiment, the cluster monitoring module periodically sends a health check request to the registered bastion, and when the bastion fails to respond within a specified timeout and exceeds the set number of retries, the cluster monitoring module considers the bastion to be unavailable, in a down state, sets the weight ratio of the bastion to 0, and notifies the bastion resource link object management module of the cluster unique identifier of the bastion to delete the resource link object associated with the bastion. When the downed bastion restarts and reports its resource usage, the cluster monitoring module resets the weight ratio of the bastion.

[0061] The dynamic routing forwarding module is configured to receive and parse a resource link request uploaded by a bastion node, to send a link object request to the link object management module based on the parsing result of the resource link request, to return link object information to the dynamic routing forwarding module from the local link object management module, to send a detection bastion resource usage request to the cluster monitoring module, to return link object information to the dynamic routing forwarding module based on the detection bastion resource usage request, and to forward the resource link request to the specified bastion node.

[0062] In this embodiment, the main function of the dynamic routing forwarding module is to obtain the optimal resource link object based on the resource connection request, and to forward the resource connection request to the specified bastion service to complete the resource connection operation.

[0063] After receiving the resource connection request, the dynamic routing forwarding module parses the resource IP, resource port, and resource account, and sends a resource link object request to the link object management module.

[0064] The link object management module receives the link object request sent by the dynamic routing forwarding module, and checks whether the resource link object specified in the link object request exists in the local cache. If the corresponding resource link object exists in the link object management module, the dynamic routing forwarding module is configured to send a resource usage detection request of the bastion host to the cluster monitoring module, the cluster monitoring module filters the resource usage rate of the bastion host in a future scheduled time period, and returns the final link object information to the dynamic routing forwarding module. The dynamic routing forwarding module is configured to forward the resource link request to the specified bastion host node.

[0065] If the corresponding resource link object does not exist in the link object management module, the dynamic routing forwarding module is configured to send a link object consultation request to the cluster monitoring module, the cluster monitoring module is configured to query the currently available bastion host node based on the link object consultation request, and return the final link object information to the dynamic routing forwarding module. The dynamic routing forwarding module is configured to forward the resource link request to the specified bastion host node.

[0066] The link object information includes the access address of the bastion host node where the resource link object is located and the cluster unique identifier of the bastion host node.

[0067] In this embodiment, the source link object management module is mainly used to manage the life cycle of the resource link object. The permission authentication in the resource connection process is very cumbersome and time-consuming, so the successfully authenticated resource link object is stored, which is beneficial to improve the efficiency of using the same authentication data for next access. In order to better distinguish different resource link objects, the resource IP, resource access port and resource account are used as keys to store the resource link object in the cache.

[0068] After receiving the resource link object request, the link object management module is configured to find the corresponding resource link object from the local cache based on the resource IP, resource access port number and resource account, parse the access address of the bastion host where the resource link object is located and the cluster unique identifier of the bastion host, and return the access address of the bastion host where the resource link object is located and the cluster unique identifier of the bastion host to the dynamic routing forwarding module.

[0069] When the bastion host node uses the existing resource link object to connect the resource, the bastion host node sends an update resource link object validity request to the link object management module. The resource link object validity request carries the resource IP, resource access port number and resource account. The link object management module is configured to acquire the resource link object based on the resource IP, resource access port number and resource account through the mutual exclusion lock, and prolong the valid time of the resource link object in the cache.

[0070] When the bastion node does not use the existing resource link object to connect resources, the bastion node sends an update resource link object time limit request to the link object management module, and the resource link object time limit request carries the resource IP, resource access port number, resource account, resource link object, and cluster unique identifier of the bastion machine where the resource link object is located. The link object management module is used to create or update the resource link object based on the resource IP, resource access port number, and resource account through the mutual exclusion lock. That is, when the resource link object is not found according to the key, the resource link object in the request is stored in the cache, and the key is added to the resource link object key list corresponding to the bastion cluster unique identifier; when the resource link object is found according to the key, the resource link object in the cache is directly replaced with the resource link object in the request, the bastion cluster unique identifier is parsed from the resource link object, the information about the key in the resource link object key list corresponding to the bastion cluster unique identifier is removed, the bastion cluster unique identifier in the new resource link object is parsed, and the key is added to the resource link object key list corresponding to the bastion cluster unique identifier.

[0071] Based on the link object deletion request sent by the cluster performance monitoring module, the link object management module is used to parse the cluster unique identifier of the bastion machine where the resource link object is located, obtain the resource link object key list from the local cache according to the cluster unique identifier, and delete the resource link object information corresponding to each key according to the resource link object key list.

[0072] The system of the embodiment can realize dynamic routing forwarding when the bastion machine accesses resources under the cooperation of the cluster deployment module, the dynamic routing forwarding module, the link object management module, and the cluster monitoring module.

[0073] Embodiment 2

[0074] The dynamic routing forwarding method for resource access of the bastion machine is realized by the system disclosed in embodiment 1, and the method comprises the following steps:

[0075] Step S100: Establishing a cluster among a plurality of bastion machines, and deploying the bastion node, the dynamic routing forwarding module, the link object management module, and the cluster monitoring module in the same network;

[0076] Step S200: Managing the life cycle of the link object through the link object management module, and storing the link object information in the local cache

[0077] Step S300 receives performance information uploaded by the bastion node through the cluster monitoring module, displays the performance information through the visual interface provided by the cluster monitoring module, and returns a cluster unique identifier to each bastion through the cluster monitoring module;

[0078] Step S400 receives self-resource usage rate uploaded by the bastion node through the cluster monitoring module, predicts the resource usage rate of the bastion node in the future time period according to the self-resource usage rate of the bastion node, sets the weight ratio of the bastion node, and displays the resource usage rate and the weight ratio of the bastion node through the visual interface;

[0079] Step S500 periodically sends a health check request to the bastion node through the cluster monitoring module, judges the running state of the bastion node based on the response of the bastion node, sends a link object deletion request to the link object management module for the bastion node in the down state, and deletes the corresponding link object in the local cache based on the link object deletion request and the link object management module;

[0080] Step S600, for the resource link request uploaded by the bastion node, analyzes the resource link request uploaded by the bastion node through the dynamic routing forwarding module, sends a link object request to the link object management module based on the analysis result of the resource link request, the link object management module finds the corresponding link object from the local and returns the link object information to the dynamic routing forwarding module, sends a detection bastion resource usage rate request to the cluster monitoring module through the dynamic routing forwarding module, returns the link object information to the dynamic routing forwarding module based on the detection bastion resource usage rate request and the cluster monitoring module based on the resource usage rate of the bastion node, and forwards the resource link request to the specified bastion node through the dynamic routing forwarding module.

[0081] Step S100 of the embodiment establishes a cluster among multiple bastions, realizes load balancing and fault tolerance. All bastion nodes, resource access dynamic routing forwarding modules, resource link object management modules, and cluster monitoring modules should be deployed in the same internal network to ensure efficient and secure communication. The communication between modules should use an encryption protocol (such as TLS / SSL) to prevent data leakage and tampering.

[0082] In step S200 of the embodiment, for different resource link objects, the link object management module stores the key values in the local cache based on the resource IP, resource access port number and resource account number, and adds the key to the resource link object key list. The resource link object key list is a list based on the cluster unique identifier of the bastion where the resource link object is located.

[0083] The performance information of each bastion machine deployed in step S300 of the embodiment is sent to the cluster monitoring module, including IP, CPU, memory, hard disk, bastion machine access address and other information. After receiving the performance information, the cluster monitoring module sends a unique bastion machine identifier in the cluster to the current bastion machine as a cluster unique identifier. The bastion machine identifier serves to uniquely identify the bastion machine. The cluster monitoring module stores the performance information of all bastion machine nodes in real time and provides a performance data visualization page to facilitate administrators to understand the overall running state of the cluster.

[0084] In step S400 of the embodiment, all bastion machine nodes in the cluster periodically actively report their resource usage to the bastion cluster monitoring module, including CPU, memory, and disk usage. The cluster monitoring module predicts the resource usage of the bastion machine in the future based on the resource usage of the bastion machine in the past time period, sets a threshold for the resource usage of the bastion machine, and performs time-dimension analysis on the collected resource usage of the bastion machine to determine the resource usage of the bastion machine in the future period and set the weight ratio of the usage of the bastion machine. The greater the weight ratio of the usage of the bastion machine, the more sufficient the available resources of the bastion machine, and the more effective the connection with the resources. Conversely, the fewer the resources available to the bastion machine, the lower the performance of the bastion machine, and the less efficient the connection with the resources. The administrator manually sets the weight ratio of the usage of the bastion machine in the performance data visualization page of the bastion machine.

[0085] In step S500 of the embodiment, the cluster monitoring module periodically sends a health check request to the registered bastion machine. When the bastion machine fails to respond within a specified timeout period and exceeds the set number of retries, the bastion cluster monitoring module considers the bastion machine to be unavailable, i.e., in a down state, sets the weight ratio of the usage of the bastion machine to 0, and notifies the bastion cluster monitoring module of the cluster unique identifier of the bastion machine to delete the resource link object associated with the bastion machine. When the downed bastion machine restarts and reports its resource usage, the bastion cluster monitoring module resets the weight ratio of the usage of the bastion machine.

[0086] In step S600 of the embodiment, the dynamic routing and forwarding module receives a resource connection request, parses the resource IP, resource port, and resource account, and sends a resource link object request to the link object management module.

[0087] The link object management module receives the link object request sent by the dynamic routing forwarding module, and checks whether the resource link object specified in the link object request exists in the local cache. If the corresponding resource link object exists in the link object management module, the dynamic routing forwarding module is configured to send a resource usage detection request of the bastion host to the cluster monitoring module, the cluster monitoring module filters the resource usage rate of the bastion host in a future scheduled time period, and returns the final link object information to the dynamic routing forwarding module, and the dynamic routing forwarding module is configured to forward the resource link request to the specified bastion host node.

[0088] If the corresponding resource link object does not exist in the link object management module, the dynamic routing forwarding module sends a link object consultation request to the cluster monitoring module, the cluster monitoring module queries the currently available bastion host node based on the link object consultation request, and returns the final link object information to the dynamic routing forwarding module, and the dynamic routing forwarding module forwards the resource link request to the specified bastion host node.

[0089] The link object information includes the access address of the bastion host node where the resource link object is located and the cluster unique identifier of the bastion host node.

[0090] In the embodiment, the source link object management module is mainly used to manage the life cycle of the resource link object. The permission authentication is very cumbersome and time-consuming in the process of resource connection, therefore, the successfully authenticated resource link object is stored, which is beneficial to improve the efficiency of next access using the same authentication data. In order to better distinguish different resource link objects, the resource IP, resource access port and resource account are used as keys to store the resource link object in the cache.

[0091] After receiving the resource link object request, the link object management module searches the corresponding resource link object from the local cache based on the resource IP, resource access port number and resource account, analyzes the access address of the bastion host where the resource link object is located and the cluster unique identifier of the bastion host, and returns the access address of the bastion host where the resource link object is located and the cluster unique identifier of the bastion host to the dynamic routing forwarding module.

[0092] When the bastion host node uses the existing resource link object to connect the resource, the bastion host node sends an update resource link object validity request to the link object management module, the resource link object validity request carries the resource IP, resource access port number and resource account, the link object management module acquires the resource link object based on the resource IP, resource access port number and resource account through the mutual exclusion lock, and prolongs the valid time of the resource link object in the cache.

[0093] When the bastion node does not use the existing resource link object to connect resources, the bastion node sends an update resource link object time limit request to the link object management module, and the resource link object time limit request carries the resource IP, resource access port number, resource account, resource link object, and cluster unique identifier of the bastion machine where the resource link object is located. The link object management module is used to create or update the resource link object based on the resource IP, resource access port number, and resource account through the mutual exclusion lock. That is, when the resource link object is not found according to the key, the resource link object in the request is stored in the cache, and the key is added to the resource link object key list corresponding to the bastion cluster unique identifier. When the resource link object is found according to the key, the resource link object in the cache is directly replaced with the resource link object in the request, the bastion cluster unique identifier is parsed from the resource link object, the information about the key in the resource link object key list corresponding to the bastion cluster unique identifier is removed, the bastion cluster unique identifier in the new resource link object is parsed, and the key is added to the resource link object key list corresponding to the bastion cluster unique identifier.

[0094] Based on the link object deletion request sent by the cluster performance monitoring module, the link object management module parses the cluster unique identifier of the bastion machine where the resource link object is located based on the link object deletion request, obtains the resource link object key list from the local cache according to the cluster unique identifier, and deletes the resource link object information corresponding to each key according to the resource link object key list.

[0095] The above has disclosed and explained the present application in detail through the drawings and preferred embodiments, but the present application is not limited to these disclosed embodiments. Based on the above embodiments, those skilled in the art can know that the means in the above different embodiments can be combined to obtain more embodiments of the present application, and these embodiments are also within the protection scope of the present application.

Claims

1. A dynamic routing and forwarding system for bastion host resource access, characterized in that: Includes cluster deployment module, dynamic routing forwarding module, link object management module and cluster monitoring module; The cluster deployment module is used to establish a cluster between multiple bastion hosts, and the bastion host nodes, dynamic routing forwarding module, link object management module and cluster monitoring module are deployed in the same network; The link object management module is used to manage the life cycle of the link object and store the link object information in the local cache; The cluster monitoring module is used to receive performance information uploaded by the bastion host node and display the performance information through a visual interface, and return a cluster unique identifier to each bastion host; The cluster monitoring module is used to receive the resource utilization rate of the bastion host node uploaded by the bastion host node, predict the resource utilization rate of the bastion host node in the future time period based on the resource utilization rate of the bastion host node, set the weight ratio of the bastion host node, and display the resource utilization rate and weight ratio of the bastion host node through a visual interface; The cluster monitoring module is used to periodically send health check requests to the bastion host node, determine the operating status of the bastion host node based on the response of the bastion host node, and for the bastion host node in the down state, send a link object deletion request to the link object management module; correspondingly, based on the link object deletion request, the link object management module is used to delete the corresponding link object in the local cache; The dynamic routing forwarding module is used to receive and parse the resource link request uploaded by the bastion host node, and send a link object acquisition request to the link object management module based on the parsing result of the resource link request. The link object management module is used to search for the corresponding link object locally and return the link object information to the dynamic routing forwarding module. The dynamic routing forwarding module is used to send a bastion host resource utilization detection request to the cluster monitoring module. Based on the bastion host resource utilization detection request, the cluster monitoring module is used to return the link object information to the dynamic routing forwarding module based on the resource utilization of the bastion host node. The dynamic routing forwarding module is used to forward the resource link request to the specified bastion host node.

2. The dynamic routing forwarding system for bastion host resource access according to claim 1 is characterized in that: After receiving the link object acquisition request sent by the dynamic routing forwarding module, the link object management module searches the local cache for the resource link object specified in the link object acquisition request. If the corresponding resource link object exists in the link object management module, the dynamic routing forwarding module is used to send a bastion host resource usage detection request to the cluster monitoring module. The cluster monitoring module screens the bastion host resource usage based on the future predetermined time period and returns the final link object information to the dynamic routing forwarding module. The dynamic routing forwarding module is used to forward the resource link request to the specified bastion host node. If the corresponding resource link object does not exist in the link object management module, the dynamic routing forwarding module is used to send a link object consultation request to the cluster monitoring module. The cluster monitoring module is used to query the currently available bastion host nodes based on the link object consultation request and return the final link object information to the dynamic routing forwarding module. The dynamic routing forwarding module is used to forward the resource link request to the specified bastion host node. The link object information includes the access address of the bastion host node where the resource link object is located and the cluster unique identifier of the bastion host node.

3. The dynamic routing forwarding system for bastion host resource access according to claim 1 is characterized in that: For different resource link objects, the link object management module is used to store the resource IP, resource access port number and resource account as key values ​​in the local cache, and to add the key to the resource link object key list. The resource link object key list is a list built based on the cluster unique identifier of the bastion host where the resource link object is located; After receiving the request to obtain the resource link object, the link object management module is used to search the corresponding resource link object from the local cache based on the resource IP, resource access port number and resource account, parse the access address of the bastion host where the resource link object is located and the cluster unique identifier of the bastion host where the resource link object is located, and return the access address of the bastion host where the resource link object is located and the cluster unique identifier of the bastion host where the resource link object is located to the dynamic routing forwarding module; When the bastion host node uses an existing resource link object for resource connection, the bastion host node sends a resource link object expiration request to the link object management module. The resource link object expiration request carries the resource IP, resource access port number, and resource account number. The link object management module is used to obtain the resource link object through a mutex lock based on the resource IP, resource access port number, and resource account number, and extend the effective time of the resource link object in the cache; When the bastion host node does not use the existing resource link object for resource connection, the bastion host node sends a resource link object aging request to the link object management module. The resource link object aging request carries the resource IP, resource access port number, resource account, resource link object, and the cluster unique identifier of the bastion host where the resource link object is located. The link object management module is used to create or update the resource link object based on the resource IP, resource access port number and resource account through a mutex lock; Based on the link object deletion request sent by the cluster performance monitoring module, the link object management module is used to parse the cluster unique identifier of the bastion host where the resource link object is located based on the link object deletion request, obtain the resource link object key list from the local cache according to the cluster unique identifier, and delete the resource link object information corresponding to each key one by one according to the resource link object key list.

4. The dynamic routing forwarding system for bastion host resource access according to claim 1, characterized in that: The cluster monitoring module is used to periodically send health check requests to the bastion host node, and judge the operating status of the bastion host node based on the response of the bastion host node. If the bastion host node responds within a predetermined time, the bastion host node is determined to be in a normal operating state. If the bastion host node does not respond within the specified time and exceeds the set number of retries, the bastion host node is determined to be in a down state, the weight ratio of the bastion host node is set to zero, and a link object deletion request is sent to the link object management module. The corresponding resource link object is deleted based on the cluster unique identifier specified in the link object deletion request. When the down bastion host node restarts and reports its own resource utilization rate, the weight ratio of the bastion host node is reset.

5. The dynamic routing forwarding system for bastion host resource access according to claim 1 is characterized in that: After receiving the bastion host resource utilization detection request sent by the dynamic routing forwarding module, the cluster monitoring module is used to parse the cluster unique identifier of the bastion host node specified in the bastion host resource utilization detection request, and obtain the resource utilization of the bastion host node in the future predetermined time period based on the cluster unique identifier. When the resource utilization does not exceed the maximum threshold, the cluster unique identifier of the bastion host node is returned to the dynamic routing forwarding module. When the resource utilization exceeds the maximum threshold, the bastion host node with sufficient resources is screened out based on the resource utilization and weight ratio of other bastion host nodes, and the cluster unique identifier and access address of the bastion host node are returned. When the cluster unique identifier of the bastion host node in the bastion host resource utilization detection request is not parsed, the bastion host node with sufficient resources is screened out based on whether the resource utilization of the bastion host node exceeds the threshold and the weight ratio of the bastion host node, and the cluster unique identifier and access address of the bastion host node are returned.

6. A dynamic routing forwarding method for bastion host resource access, characterized in that: The method for implementing dynamic routing forwarding of bastion host resource access by a dynamic routing forwarding system for bastion host resource access according to any one of claims 1 to 5 comprises the following steps: Establish a cluster between multiple bastion hosts and deploy the bastion host nodes, dynamic routing forwarding module, link object management module, and cluster monitoring module in the same network; The link object management module manages the life cycle of the link object and stores the link object information in the local cache. The cluster monitoring module receives performance information uploaded by the bastion host node, displays the performance information through the visual interface provided by the cluster monitoring module, and returns a cluster unique identifier to each bastion host through the cluster monitoring module. The cluster monitoring module receives the resource usage rate uploaded by the bastion host node, predicts the resource usage rate of the bastion host node in the future time period based on the bastion host node's own resource usage rate, sets the weight ratio of the bastion host node, and displays the resource usage rate and weight ratio of the bastion host node through a visual interface; The cluster monitoring module periodically sends health check requests to the bastion host node, and determines the operating status of the bastion host node based on the response of the bastion host node. For bastion host nodes that are in a down state, a link object deletion request is sent to the link object management module. Based on the link object deletion request, the link object management module deletes the corresponding link object in the local cache; For resource link requests uploaded by the bastion host node, the resource link requests uploaded by the bastion host node are parsed by the dynamic routing forwarding module, and a link object acquisition request is sent to the link object management module based on the parsed result of the resource link request. The link object management module searches for the corresponding link object locally and returns the link object information to the dynamic routing forwarding module. A bastion host resource utilization detection request is sent to the cluster monitoring module through the dynamic routing forwarding module. Based on the bastion host resource utilization detection request and the cluster monitoring module, the link object information is returned to the dynamic routing forwarding module based on the resource utilization of the bastion host node. The resource link request is forwarded to the specified bastion host node through the dynamic routing forwarding module.

7. The dynamic routing forwarding method for bastion host resource access according to claim 6 is characterized in that: After receiving the link object acquisition request sent by the dynamic routing forwarding module, the link object management module searches the local cache for the resource link object specified in the link object acquisition request. If the corresponding resource link object exists in the link object management module, the dynamic routing forwarding module sends a bastion host resource usage detection request to the cluster monitoring module. The cluster monitoring module screens the bastion host resource usage based on the future scheduled time period and returns the final link object information to the dynamic routing forwarding module. The dynamic routing forwarding module forwards the resource link request to the specified bastion host node. If the corresponding resource link object does not exist in the link object management module, the dynamic routing forwarding module sends a link object consultation request to the cluster monitoring module. The cluster monitoring module queries the currently available bastion host nodes based on the link object consultation request and returns the final link object information to the dynamic routing forwarding module. The dynamic routing forwarding module forwards the resource link request to the specified bastion host node. The link object information includes the access address of the bastion host node where the resource link object is located and the cluster unique identifier of the bastion host node.

8. The dynamic routing forwarding method for bastion host resource access according to claim 6 is characterized in that: For different resource link objects, the link object management module uses the resource IP, resource access port number, and resource account as key values ​​to store them in the local cache and adds the key to the resource link object key list. The resource link object key list is a list built based on the cluster unique identifier of the bastion host where the resource link object is located. After receiving the request to obtain the resource link object, the link object management module searches the local cache for the corresponding resource link object based on the resource IP, resource access port number, and resource account number, parses the access address of the bastion host where the resource link object is located and the cluster unique identifier of the bastion host where the resource link object is located, and returns the access address of the bastion host where the resource link object is located and the cluster unique identifier of the bastion host where the resource link object is located to the dynamic routing forwarding module; When the bastion host node uses an existing resource link object for resource connection, the bastion host node sends a resource link object expiration request to the link object management module. The resource link object expiration request carries the resource IP, resource access port number, and resource account number. The link object management module obtains the resource link object through a mutex lock based on the resource IP, resource access port number, and resource account number, and extends the effective time of the resource link object in the cache. When the bastion host node does not use the existing resource link object for resource connection, the bastion host node sends a resource link object aging request to the link object management module. The resource link object aging request carries the resource IP, resource access port number, resource account, resource link object, and the cluster unique identifier of the bastion host where the resource link object is located. The link object management module creates or updates the resource link object based on the resource IP, resource access port number, and resource account through a mutex lock. Based on the link object deletion request sent by the cluster performance monitoring module, the link object management module parses the cluster unique identifier of the bastion host where the resource link object is located based on the link object deletion request, obtains the resource link object key list from the local cache according to the cluster unique identifier, and deletes the resource link object information corresponding to each key one by one according to the resource link object key list.

9. The dynamic routing forwarding method for bastion host resource access according to claim 6, characterized in that: The cluster monitoring module periodically sends health check requests to the bastion host node, and determines the operating status of the bastion host node based on the response of the bastion host node. If the bastion host node responds within the predetermined time, the bastion host node is determined to be in a normal operating state. If the bastion host node does not respond within the specified time and exceeds the set number of retries, the bastion host node is determined to be in a down state, the weight ratio of the bastion host node is set to zero, and a link object deletion request is sent to the link object management module. The corresponding resource link object is deleted based on the cluster unique identifier specified in the link object deletion request. When the down bastion host node restarts and reports its own resource utilization rate, the weight ratio of the bastion host node is reset.

10. The dynamic routing forwarding method for bastion host resource access according to claim 6, characterized in that: After receiving the bastion host resource utilization detection request sent by the dynamic routing forwarding module, the cluster monitoring module parses the cluster unique identifier of the bastion host node specified in the bastion host resource utilization detection request, and obtains the resource utilization of the bastion host node in the future predetermined time period based on the cluster unique identifier. When the resource utilization does not exceed the maximum threshold, the cluster unique identifier of the bastion host node is returned to the dynamic routing forwarding module. When the resource utilization exceeds the maximum threshold, the bastion host node with sufficient resources is screened out based on the resource utilization and weight ratio of other bastion host nodes, and the cluster unique identifier and access address of the bastion host node are returned. When the cluster unique identifier of the bastion host node in the bastion host resource utilization detection request is not parsed, the bastion host node with sufficient resources is screened out based on whether the resource utilization of the bastion host node exceeds the threshold and the weight ratio of the bastion host node, and the cluster unique identifier and access address of the bastion host node are returned.

Images