Command verification method and device for bastion host, equipment and medium

Abstract

The disclosure provides a command verification method for a bastion host, which can be applied to the field of network security technology. The method comprises the following steps: receiving login messages sent by at least one bastion host, wherein each login message comprises login user information and login system information; for each of the at least one bastion host, if it is determined that there is no trusted command library corresponding to the login user, extracting a trusted command corresponding to the login system according to a system image of the login system to obtain a trusted command library; calling a command analysis method corresponding to the bastion host to analyze operation data generated by the bastion host, and obtaining an operation command contained in the operation data, wherein the operation data is generated by the bastion host according to an operation process performed by the login user in the login system; and performing command verification on the operation command by using the trusted command library to generate a command verification result, so that the bastion host controls the execution of the operation command in the login system according to the command verification result.

Description

Technical Field

[0001] This disclosure relates to the field of network security technology, and more specifically to a command verification method, apparatus, electronic device, storage medium, and program product for bastion hosts. Background Technology

[0002] Bastion hosts are an important system in the field of network security. Their main purpose is to enhance the security audit and control of remote server management by operations and maintenance personnel.

[0003] In related technologies, bastion hosts typically record and audit all commands executed by operations and maintenance personnel on the target server, and prevent operations and maintenance personnel from performing malicious or high-risk operations by matching and analyzing them with a preset command list.

[0004] However, with the continuous upgrading of attack methods, the above-mentioned method of relying on recording commands is no longer sufficient to meet security requirements. For example, dangerous operations can be performed on the target server by executing scripts, or special characters can be used to circumvent the precise matching of commands, thereby evading the monitoring of the bastion host. This makes it difficult to cover the security risks of all commands. In addition, the relevant technologies require manual configuration and maintenance of whitelists one by one, which increases the workload. Summary of the Invention

[0005] In view of the above problems, this disclosure provides a command verification method, apparatus, device and medium for bastion hosts.

[0006] According to a first aspect of this disclosure, a command verification method for a bastion host is provided, applied to a command verification platform. The method includes: receiving login messages sent by at least one bastion host, wherein each login message includes login user information and login system information; for each of the at least one bastion hosts, if it is determined that no trusted command library corresponds to the login user, extracting trusted commands corresponding to the login system based on the system image of the login system to obtain a trusted command library; invoking a command analysis method corresponding to the bastion host to analyze operation data generated by the bastion host to obtain operation commands contained in the operation data, wherein the operation data is generated by the bastion host based on the operation process performed by the login user in the login system; and performing command verification on the operation commands using the trusted command library to generate a command verification result, so that the bastion host controls the execution of the operation commands in the login system based on the command verification result.

[0007] According to embodiments of this disclosure, the method further includes: receiving a script to be verified sent by a bastion host, and extracting the commands to be verified contained in the script to be verified, wherein the script to be verified is a script customized by the logged-in user; verifying the commands to be verified according to the permission scope of the executable commands corresponding to the logged-in user; and adding the commands to be verified to the trusted command library if the commands to be verified are within the permission scope.

[0008] According to embodiments of this disclosure, the method further includes: when it is determined that a command blacklist is configured, optimizing the trusted command library using the command blacklist to obtain an optimized trusted command library; wherein, performing command verification on the operation command using the trusted command library and generating a command verification result includes: performing command verification on the operation command using the optimized trusted command library and generating a command verification result.

[0009] According to embodiments of this disclosure, invoking a command analysis method corresponding to the bastion host to analyze operation data generated by the bastion host includes: invoking the command analysis method corresponding to the bastion host and allocating preset computing resources to the command analysis method; and using the preset computing resources to execute the command analysis method to analyze the operation data generated by the bastion host.

[0010] According to embodiments of this disclosure, the method further includes: in response to the preset computing resource utilization rate meeting preset expansion conditions, expanding the preset computing resource according to a preset expansion strategy to obtain the expanded computing resource; wherein, using the preset computing resource to execute a command analysis method to analyze the operation data generated by the bastion host includes: using the expanded computing resource to execute a command analysis method to analyze the operation data generated by the bastion host.

[0011] According to embodiments of this disclosure, the method further includes: in response to a timeout message sent by the bastion host, releasing preset computing resources allocated to the command analysis method, wherein the timeout message indicates that the logged-in user has not operated the bastion host for more than a first preset time.

[0012] According to embodiments of this disclosure, the method further includes: in response to the number of login messages received within a second preset time period being greater than or equal to a first preset threshold, automatically expanding the computing resources of the command verification platform based on the number of login messages to obtain expanded resources; and in response to the number of login messages received within a second preset time period being less than a second preset threshold, canceling the expanded resources, wherein the second preset threshold is less than the first preset threshold.

[0013] According to embodiments of this disclosure, when the operation data generated by the bastion host is a screen recording, the command analysis method corresponding to the bastion host includes a screen recording recognition method.

[0014] The second aspect of this disclosure provides a command verification device for a bastion host, applied to a command verification platform. The device includes: a first receiving module for receiving login messages sent by at least one bastion host, wherein each login message includes login user information and login system information; an extraction module for extracting trusted commands corresponding to the login system based on the system image of the login system for each of the at least one bastion host, in the case that no trusted command library corresponding to the login user exists, to obtain a trusted command library; an analysis module for calling a command analysis method corresponding to the bastion host to analyze the operation data generated by the bastion host to obtain the operation commands contained in the operation data, wherein the operation data is generated by the bastion host based on the operation process performed by the login user in the login system; and a generation module for performing command verification on the operation commands using the trusted command library to generate a command verification result, so that the bastion host controls the execution of the operation commands in the login system based on the command verification result.

[0015] A third aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0016] A fourth aspect of this disclosure also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0017] The fifth aspect of this disclosure also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0018] According to embodiments of this disclosure, login user information and login system information sent by at least one bastion host are received. If it is determined that no trusted command library corresponds to the login user, trusted commands corresponding to the login system are extracted based on the system image of the login system to obtain a trusted command library. Operation commands are generated based on the operation process performed by the login user in the login system, and the trusted command library is used to verify the operation commands, generating a command verification result. By constructing a trusted command library using login user information and login system information, and verifying operation commands using this trusted command library, the technical means of avoiding the waste of human resources and the potential for omissions caused by manually configuring and maintaining whitelists one by one, are avoided. This achieves the technical effect of covering the security risks of commands without the need for manual configuration and maintenance. Furthermore, by analyzing operation data to obtain operation commands, the technical problem in related technologies where relying on recording commands makes it difficult to cover the security risks of all commands is solved, thus improving the security of system use. Attached Figure Description

[0019] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0020] Figure 1 The illustration schematically depicts an application scenario of a command verification method, apparatus, device, medium, and program product for a bastion host according to embodiments of the present disclosure;

[0021] Figure 2 A flowchart illustrating a command verification method for a bastion host according to an embodiment of the present disclosure is shown schematically.

[0022] Figure 3 This illustration schematically depicts a diagram illustrating the construction of a trusted command library according to embodiments of the present disclosure;

[0023] Figure 4 A schematic diagram illustrating a command verification method for a bastion host according to an embodiment of the present disclosure is shown.

[0024] Figure 5 A schematic block diagram of a command verification device for a bastion host according to an embodiment of the present disclosure is shown; and

[0025] Figure 6 A block diagram schematically illustrates an electronic device suitable for implementing a command verification method for a bastion host according to an embodiment of the present disclosure. Detailed Implementation

[0026] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0027] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0028] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0029] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0030] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0031] In the technical solution disclosed herein, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse.

[0032] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this disclosure all offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0033] Embodiments of this disclosure provide a command verification method for a bastion host, comprising: receiving login messages sent by at least one bastion host, wherein each login message includes login user information and login system information; for each of the at least one bastion host, if it is determined that there is no trusted command library corresponding to the login user, extracting trusted commands corresponding to the login system based on the system image of the login system to obtain a trusted command library; invoking a command analysis method corresponding to the bastion host to analyze the operation data generated by the bastion host to obtain the operation commands contained in the operation data, wherein the operation data is generated by the bastion host based on the operation process performed by the login user in the login system; and using the trusted command library to perform command verification on the operation commands to generate a command verification result, so that the bastion host controls the execution of the operation commands in the login system based on the command verification result.

[0034] Figure 1 The illustration schematically depicts an application scenario of a command verification method, apparatus, device, medium, and program product for a bastion host according to embodiments of the present disclosure.

[0035] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first bastion host 101, a second bastion host 102, a third bastion host 103, a network 104, and a command verification platform 105. The network 104 serves as a medium for providing a communication link between the first bastion host 101, the second bastion host 102, the third bastion host 103, and the command verification platform 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0036] Users can use the first bastion host 101, the second bastion host 102, and the third bastion host 103 to interact with the command verification platform 105 via network 104 to receive or send messages, etc. The first bastion host 101, the second bastion host 102, and the third bastion host 103 are network security control nodes, mainly used to isolate access between a highly secure internal network and a less secure external network.

[0037] The first bastion host 101, the second bastion host 102, and the third bastion host 103 can use various technical means to monitor and record the operation behavior of logged-in users on servers, network devices, security devices, databases, and other devices within the network, so as to enable centralized alarms, timely handling, and auditing and accountability.

[0038] The command verification platform 105 can be a server platform that provides various services, such as a backend management server that supports commands sent by users using the first bastion host 101, the second bastion host 102, and the third bastion host 103 (this is just an example). The command verification platform can analyze and process received login messages and other data, and generate command verification results (such as web pages, information, or data obtained or generated according to user requests) and feed them back to the bastion host.

[0039] It should be noted that the command verification method for bastion hosts provided in this embodiment can generally be executed by the command verification platform 105. Correspondingly, the command verification device for bastion hosts provided in this embodiment can generally be located within the command verification platform 105. The command verification method for bastion hosts provided in this embodiment can also be executed by a command verification platform or command verification platform cluster that is different from the command verification platform 105 and capable of communicating with the first bastion host 101, the second bastion host 102, the third bastion host 103, and / or the command verification platform 105. Correspondingly, the command verification device for bastion hosts provided in this embodiment can also be located in a command verification platform or command verification platform cluster that is different from the command verification platform 105 and capable of communicating with the first bastion host 101, the second bastion host 102, the third bastion host 103, and / or the command verification platform 105.

[0040] It should be understood that Figure 1 The number of bastion hosts, network, and command verification platforms shown is merely illustrative. Any number of bastion hosts, network, and command verification platforms can be used depending on implementation needs.

[0041] The following will be based on Figure 1 The described scene, through Figures 2-4 The command verification method for bastion hosts according to the disclosed embodiments is described in detail.

[0042] Figure 2 A flowchart illustrating a command verification method for a bastion host according to an embodiment of the present disclosure is shown schematically.

[0043] According to embodiments of this disclosure, the command verification method for a bastion host is applied to a command verification platform, which can be a server or a client.

[0044] like Figure 2 As shown, the command verification method for the bastion host in this embodiment includes operations S210 to S240.

[0045] In operation S210, a login message is received from at least one bastion host, wherein each login message includes login user information and login system information.

[0046] According to embodiments of this disclosure, a bastion host can, in a specific network environment, use various technical means to monitor and record the operational behavior of logged-in users on servers, network devices, security devices, databases, and other devices within the network to protect the network and data from intrusion and damage from external and internal users, so as to enable centralized alarms, timely processing, and auditing and accountability.

[0047] According to embodiments of this disclosure, the login user information may be the user's account or username, etc.

[0048] According to embodiments of this disclosure, the login system can be a system that users log into through a bastion host, for example, a user logging into system A within a company through a bastion host. The login system information can be the system's identification information, such as name, ID, etc.

[0049] According to embodiments of this disclosure, when a user logs in through a bastion host, the bastion host obtains the login message and sends the login message to the command verification platform.

[0050] In operation S220, for each of the at least one bastion host, if it is determined that there is no trusted command library corresponding to the logged-in user, trusted commands corresponding to the logged-in system are extracted based on the system image of the logged-in system to obtain the trusted command library.

[0051] According to embodiments of this disclosure, a trusted command library is used to identify spoofed commands that match a command whitelist. The trusted commands included in this trusted command library differ for different logged-in users and login systems.

[0052] According to embodiments of this disclosure, the system image of the login system can be a complete backup containing the login system and its related applications, configurations, and data files, enabling rapid recovery or reinstallation of the system and ensuring the security and stability of data and the system.

[0053] According to embodiments of this disclosure, trusted commands corresponding to the login system are extracted from the system image to construct a trusted command library corresponding to the login user and the login system.

[0054] According to embodiments of this disclosure, the trusted commands extracted through the system image are commands that come with the login system, and trusted commands can also be uploaded to the trusted command library manually.

[0055] According to embodiments of this disclosure, trusted commands are extracted from the system image of the login system through automated means to generate a trusted command library, which does not require manual configuration and maintenance and can cover all common operating system environments.

[0056] In operation S230, the command analysis method corresponding to the bastion host is invoked to analyze the operation data generated by the bastion host and obtain the operation commands contained in the operation data. The operation data is generated by the bastion host based on the operation process performed by the logged-in user in the login system.

[0057] According to embodiments of this disclosure, the operation data may be the operation process performed by the logged-in user in the login system. For example, the operation data may be the mouse movement trajectory of the logged-in user, or it may be screen recording data of the operation interface.

[0058] According to embodiments of this disclosure, the command analysis method corresponding to the bastion host can be an analysis method of operation data to extract operation commands from the operation data. For example, the information input according to the user's mouse movement trajectory can be extracted to obtain the operation commands contained in the operation data.

[0059] When operating S240, the trusted command library is used to verify the operation commands and generate command verification results, so that the bastion host can control the execution of the operation commands in the login system based on the command verification results.

[0060] According to embodiments of this disclosure, the operation command is matched against a trusted command library, and the matching result is used as the command verification result. If the command verification result is a match, the operation command is allowed to be executed in the login system; if it does not match, the operation command is prohibited from being executed in the login system.

[0061] According to embodiments of this disclosure, login user information and login system information sent by at least one bastion host are received. If it is determined that no trusted command library corresponds to the login user, trusted commands corresponding to the login system are extracted based on the system image of the login system to obtain a trusted command library. Operation commands are generated based on the operation process performed by the login user in the login system, and the trusted command library is used to verify the operation commands, generating a command verification result. By constructing a trusted command library using login user information and login system information, and verifying operation commands using this trusted command library, the technical means of avoiding the waste of human resources and the potential for omissions caused by manually configuring and maintaining whitelists one by one, are avoided. This achieves the technical effect of covering the security risks of commands without the need for manual configuration and maintenance. Furthermore, by analyzing operation data to obtain operation commands, the technical problem in related technologies where relying on recording commands makes it difficult to cover the security risks of all commands is solved, thus improving the security of system use.

[0062] According to embodiments of this disclosure, the method further includes: receiving a script to be verified sent by a bastion host, and extracting the commands to be verified contained in the script to be verified, wherein the script to be verified is a script customized by the logged-in user; verifying the commands to be verified according to the permission scope of the executable commands corresponding to the logged-in user; and adding the commands to be verified to the trusted command library if the commands to be verified are within the permission scope.

[0063] According to embodiments of this disclosure, the script to be verified is a program that automates the execution of tasks and contains multiple commands to be verified.

[0064] According to embodiments of this disclosure, logged-in users have different permission levels, and different executable command permission ranges are determined based on different permission levels. For example, logged-in user 1 has a permission level of A1, and its corresponding executable command permission range is a1~a5. Login user 2 has a permission level of A2, which is lower than that of logged-in user 1, and the executable command permission range of logged-in user 2 is a1~a3.

[0065] According to embodiments of this disclosure, when it is determined that the trusted command library does not include the command to be verified, the related static code is used to perform a security audit on the command to be verified to determine whether it is within the scope of permissions. For the script to be verified that fails the audit or has risks, the script to be verified will be manually reviewed to determine whether it is approved to be added to the trusted command library. Different login users have different scopes of permissions.

[0066] According to embodiments of this disclosure, approved commands to be verified are merged and added to a trusted command library. In subsequent operations, these commands to be verified will be treated as trusted commands.

[0067] According to embodiments of this disclosure, each update to the trusted command library will be recorded and traceable to the specific reason for the update and the approver, in order to meet auditing requirements.

[0068] According to embodiments of this disclosure, the method further includes: when it is determined that a command blacklist is configured, optimizing the trusted command library using the command blacklist to obtain an optimized trusted command library; wherein, performing command verification on the operation command using the trusted command library and generating a command verification result includes: performing command verification on the operation command using the optimized trusted command library and generating a command verification result.

[0069] According to embodiments of this disclosure, a corresponding command blacklist is determined based on different login users and login systems.

[0070] According to embodiments of this disclosure, a command blacklist is used to optimize the trusted command library, providing accurate identification of commands by the trusted command library, resulting in an optimized trusted command library that can audit any command executed by a logged-in user on the server, covering all potential risk scenarios.

[0071] Figure 3 A schematic diagram illustrating the construction of a trusted command library according to an embodiment of this disclosure is shown.

[0072] like Figure 3 As shown, the method for constructing a trusted command library in this embodiment includes: obtaining a system image 301 of the login system and extracting trusted commands 302 from it; constructing a trusted command library 303 based on the trusted commands 302; obtaining a script 304 to be verified input by the logged-in user; analyzing the script 304 to be verified to obtain a command 305 to be verified; determining in operation 306 whether the command 305 to be verified meets the permission scope; if it does, merging the command 305 to be verified into the trusted command library 303; if it does not, performing operation 307, reviewing the command 305 to be verified; and merging the approved command 305 into the trusted command library 303; obtaining a command blacklist 308; optimizing the trusted command library 303 according to the command blacklist 308 to obtain an optimized trusted command library 309, thus completing the construction of the trusted command library.

[0073] According to embodiments of this disclosure, invoking a command analysis method corresponding to the bastion host to analyze operation data generated by the bastion host includes: invoking the command analysis method corresponding to the bastion host and allocating preset computing resources to the command analysis method; and using the preset computing resources to execute the command analysis method to analyze the operation data generated by the bastion host.

[0074] According to embodiments of this disclosure, the preset computing resources may be determined based on the number of logged-in users corresponding to the current bastion host.

[0075] According to embodiments of this disclosure, a command analysis method is executed using preset computing resources until the bastion host confirms that the user has logged out, at which point the analysis of the operation data is stopped.

[0076] According to embodiments of this disclosure, the method further includes: in response to the preset computing resource utilization rate meeting preset expansion conditions, expanding the preset computing resource according to a preset expansion strategy to obtain the expanded computing resource; wherein, using the preset computing resource to execute a command analysis method to analyze the operation data generated by the bastion host includes: using the expanded computing resource to execute a command analysis method to analyze the operation data generated by the bastion host.

[0077] According to embodiments of this disclosure, the preset expansion condition may be a load rate threshold. When the resource utilization rate of the preset computing resources reaches the load rate threshold, the preset expansion condition is met, and the preset computing resources are expanded.

[0078] According to embodiments of this disclosure, a preset expansion strategy may involve expanding only computing resources that meet preset expansion conditions, so that the resource utilization of the expanded computing resources is less than a load rate threshold. For example, if there are currently computing resources A, B, and C, and computing resource C meets the preset expansion conditions, then computing resource C is expanded, while computing resources A and B remain unchanged.

[0079] According to embodiments of this disclosure, the command verification platform dynamically allocates computing resources according to actual needs, which means it does not occupy bastion host resources or require long-term idle standby resources, thereby improving resource utilization efficiency.

[0080] According to embodiments of this disclosure, the method further includes: in response to a timeout message sent by the bastion host, releasing preset computing resources allocated to the command analysis method, wherein the timeout message indicates that the logged-in user has not operated the bastion host for more than a first preset time.

[0081] According to the embodiments of this disclosure, if no operation is performed on the bastion host within a first preset time period, it can be considered that the user has logged out of the login system. At this time, it is determined that the operation data analysis and processing has stopped, and preset computing resources are released to reduce the occupation of system resources.

[0082] According to embodiments of this disclosure, the first preset duration can be set according to actual needs, and is not limited herein.

[0083] According to embodiments of this disclosure, the method further includes: in response to the number of login messages received within a second preset time period being greater than or equal to a first preset threshold, automatically expanding the computing resources of the command verification platform based on the number of login messages to obtain expanded resources; and in response to the number of login messages received within a second preset time period being less than a second preset threshold, canceling the expanded resources, wherein the second preset threshold is less than the first preset threshold.

[0084] According to an embodiment of this disclosure, within a second preset time period, if there are multiple login users who can establish a relationship with the bastion host, and if the number of login users exceeds a first preset threshold, it indicates that the current number of login users has reached the upper limit of computing resource load, and horizontal scaling of computing resources is required.

[0085] According to embodiments of this disclosure, when the number of logged-in users is less than a second preset threshold, it indicates that there are currently idle resources and the expanded resources need to be cancelled.

[0086] According to embodiments of this disclosure, the second preset duration, the first preset threshold, and the second preset threshold can be set according to actual needs, and are not limited herein.

[0087] According to embodiments of this disclosure, the computing resources of the command verification platform are automatically adjusted based on the number of login messages, thereby improving the elastic scalability and performance of the command verification platform without consuming bastion host resources.

[0088] According to embodiments of this disclosure, when the operation data generated by the bastion host is a screen recording, the command analysis method corresponding to the bastion host includes a screen recording recognition method.

[0089] According to embodiments of this disclosure, the screen recording recognition method can determine the location of the user's input command line by detecting the cursor or fixed string in the screen recording video, and then convert the user's input command into text using OCR technology to obtain the operation command. OCR (Optical Character Recognition) technology is a technique that converts text information in an image into an editable and searchable text format. It automatically identifies and extracts characters from images or documents by simulating the human ability to read text and recognize patterns.

[0090] According to embodiments of this disclosure, screen recording analysis technology is introduced. By analyzing the screen recordings made by the bastion host, regardless of the specific representation of the commands, it can comprehensively capture all operations performed by the logged-in user on the command verification platform, including the script to be verified. This prevents attackers from circumventing the matching detection of individual commands by executing pre-written scripts on the target server and including dangerous commands in the scripts. It also prevents attackers from using special characters such as spaces and comments to construct command variants that are different from but essentially the same as the whitelisted commands, thereby evading the problem of precise matching detection.

[0091] Figure 4 A schematic diagram of a command verification method for a bastion host according to an embodiment of the present disclosure is shown.

[0092] like Figure 4 As shown, the command verification method for the bastion host in this embodiment includes operations S401 to S407.

[0093] When operating S401, based on the system image of the login system, the trusted commands corresponding to the login system are extracted to obtain the trusted command library.

[0094] In operation S402, commands to be verified that are within the scope of permissions are added to the trusted command library.

[0095] When operating S403, the trusted command library is optimized using a command blacklist to obtain an optimized trusted command library.

[0096] When operating S404, the command analysis method is executed using preset computing resources to analyze the operation data generated by the bastion host and obtain the analysis results.

[0097] When operating S405, extract the operation commands based on the analysis results.

[0098] In operation S406, the operation commands are verified using a trusted command library, and the verification results are obtained.

[0099] Based on the above-described command verification method for bastion hosts, this disclosure also provides a command verification device for bastion hosts. The following will be combined with... Figure 5 The device is described in detail.

[0100] Figure 5 A schematic block diagram of a command verification device for a bastion host according to an embodiment of the present disclosure is shown.

[0101] like Figure 5 As shown, the command verification device 500 for the bastion host in this embodiment includes a first receiving module 510, an extraction module 520, an analysis module 530, and a generation module 540.

[0102] The first receiving module 510 is configured to receive login messages sent by at least one bastion host, wherein each login message includes login user information and login system information. In one embodiment, the first receiving module 510 may be used to perform the operation S210 described above, which will not be repeated here.

[0103] Extraction module 520 is configured to, for each of at least one bastion host, extract trusted commands corresponding to the login system based on the system image of the login system, in the case that no trusted command library corresponding to the logged-in user exists, to obtain a trusted command library. In one embodiment, extraction module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0104] The analysis module 530 is used to call the command analysis method corresponding to the bastion host to analyze the operation data generated by the bastion host and obtain the operation commands contained in the operation data. The operation data is generated by the bastion host based on the operation process performed by the logged-in user in the login system. In one embodiment, the analysis module 530 can be used to execute the operation S230 described above, which will not be repeated here.

[0105] The generation module 540 is used to perform command verification on the operation commands using a trusted command library and generate command verification results, so that the bastion host can control the execution of the operation commands in the login system based on the command verification results. In one embodiment, the generation module 540 can be used to perform the operation S240 described above, which will not be repeated here.

[0106] According to embodiments of this disclosure, login user information and login system information sent by at least one bastion host are received. If it is determined that no trusted command library corresponds to the login user, trusted commands corresponding to the login system are extracted based on the system image of the login system to obtain a trusted command library. Operation commands are generated based on the operation process performed by the login user in the login system, and the trusted command library is used to verify the operation commands, generating a command verification result. By constructing a trusted command library using login user information and login system information, and verifying operation commands using this trusted command library, the technical means of avoiding the waste of human resources and the potential for omissions caused by manually configuring and maintaining whitelists one by one, are avoided. This achieves the technical effect of covering the security risks of commands without the need for manual configuration and maintenance. Furthermore, by analyzing operation data to obtain operation commands, the technical problem in related technologies where relying on recording commands makes it difficult to cover the security risks of all commands is solved, thus improving the security of system use.

[0107] According to embodiments of this disclosure, the command verification device 500 for the bastion host further includes a second extraction module, a verification module, and an addition module.

[0108] The second extraction module is used to receive the script to be verified sent by the bastion host and extract the commands to be verified contained in the script to be verified. The script to be verified is a script defined by the logged-in user.

[0109] The verification module is used to verify the command to be verified based on the permission scope of the executable commands corresponding to the logged-in user.

[0110] The module adds commands to the trusted command library if the command to be verified is within the authorized scope.

[0111] According to embodiments of this disclosure, the command verification device 500 for the bastion host further includes an optimization module.

[0112] The optimization module is used to optimize the trusted command library by utilizing the command blacklist when it is known that a command blacklist is configured, so as to obtain an optimized trusted command library.

[0113] The generation module 540 includes a generation submodule.

[0114] The generation submodule is used to perform command verification on operation commands using the optimized trusted command library and generate command verification results.

[0115] According to embodiments of this disclosure, the analysis module 530 includes a calling submodule and an analysis submodule.

[0116] The calling submodule is used to invoke the command analysis method corresponding to the bastion host and allocate preset computing resources to the command analysis method.

[0117] The analysis submodule is used to execute command analysis methods using preset computing resources to analyze the operation data generated by the bastion host.

[0118] According to embodiments of this disclosure, the analysis module 530 further includes a first extended submodule.

[0119] The first extension submodule is used to extend the preset computing resources according to the preset extension strategy to obtain the extended computing resources when the resource utilization rate of the preset computing resources meets the preset extension conditions.

[0120] The analysis submodule includes analysis units.

[0121] The analysis unit is used to execute command analysis methods using expanded computing resources to analyze the operational data generated by the bastion host.

[0122] According to embodiments of this disclosure, the analysis module 530 further includes a release submodule.

[0123] The release submodule is used to release the preset computing resources allocated to the command analysis method in response to a timeout message sent by the bastion host. The timeout message indicates that the logged-in user has not operated the bastion host for more than a first preset time.

[0124] According to embodiments of this disclosure, the analysis module 530 further includes a second extension submodule and a cancellation submodule.

[0125] The second extension submodule is used to automatically extend the computing resources of the command verification platform according to the number of login messages received within a second preset time period, in response to the situation where the number of login messages received is greater than or equal to the first preset threshold, so as to obtain extended resources.

[0126] The cancellation submodule is used to cancel extended resources in response to the fact that the number of login messages received within a second preset time period is less than a second preset threshold, wherein the second preset threshold is less than a first preset threshold.

[0127] According to embodiments of this disclosure, when the operation data generated by the bastion host is a screen recording, the command analysis method corresponding to the bastion host includes a screen recording recognition method.

[0128] According to embodiments of this disclosure, any plurality of modules among the first receiving module 510, extraction module 520, analysis module 530, and generation module 540 may be combined into one module, or any one of these modules may be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules may be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the first receiving module 510, extraction module 520, analysis module 530, and generation module 540 may be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in any one of software, hardware, and firmware methods, or in a suitable combination of any of these methods. Alternatively, at least one of the first receiving module 510, the extraction module 520, the analysis module 530, and the generation module 540 may be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0129] It should be noted that the command verification device part in the embodiments of this disclosure corresponds to the command verification method part in the embodiments of this disclosure. For a detailed description of the command verification device part, please refer to the command verification method part, which will not be repeated here.

[0130] Figure 6 A block diagram schematically illustrates an electronic device suitable for implementing a command verification method for a bastion host according to an embodiment of the present disclosure.

[0131] like Figure 6 As shown, an electronic device 600 according to an embodiment of this disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage portion 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this disclosure.

[0132] RAM 603 stores various programs and data required for the operation of electronic device 600. Processor 601, ROM 602, and RAM 603 are interconnected via bus 604. Processor 601 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 602 and / or RAM 603. It should be noted that the programs may also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0133] According to embodiments of this disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to a bus 604. The electronic device 600 may also include one or more of the following components connected to the input / output (I / O) interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 610 as needed so that computer programs read from it can be installed into the storage section 608 as needed.

[0134] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0135] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 602 and / or RAM 603 and / or one or more memories other than ROM 602 and RAM 603 described above.

[0136] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement the command verification method for bastion hosts provided in embodiments of this disclosure.

[0137] When the computer program is executed by the processor 601, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0138] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 609, and / or installed from the removable medium 611. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0139] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0140] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on a user's computing device, partially on a user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0141] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0142] Those skilled in the art will understand that the features described in the various embodiments of this disclosure can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments of this disclosure can be combined and / or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0143] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A command verification method for a bastion machine, characterized by, The method is applied to a command verification platform, and the method comprises: receiving login messages sent by at least one bastion host, wherein each login message comprises login user information and login system information; for each of the at least one bastion host, if it is determined that there is no trusted command library corresponding to the login user, extracting a trusted command corresponding to the login system according to a system image of the login system to obtain a trusted command library; calling a command analysis method corresponding to the bastion host to analyze operation data generated by the bastion host to obtain an operation command contained in the operation data, wherein the operation data is generated by the bastion host according to an operation process performed by the login user in the login system; and verifying the operation command by using the trusted command library to generate a command verification result, so that the bastion host controls execution of the operation command in the login system according to the command verification result.

2. The method of claim 1, wherein, The method further comprises: receiving a script to be verified sent by the bastion host and extracting a command to be verified contained in the script to be verified, wherein the script to be verified is a script customized by the login user; verifying the command to be verified according to a permission range of an executable command corresponding to the login user; if the command to be verified is in the permission range, adding the command to be verified to the trusted command library.

3. The method of claim 2, wherein, The method further comprises: if it is determined that a command blacklist is configured, performing optimization processing on the trusted command library by using the command blacklist to obtain an optimized trusted command library; wherein the verifying the operation command by using the trusted command library to generate a command verification result comprises: verifying the operation command by using the optimized trusted command library to generate the command verification result.

4. The method of claim 1, wherein, The calling of the command analysis method corresponding to the bastion host to analyze the operation data generated by the bastion host comprises: calling the command analysis method corresponding to the bastion host and allocating a preset computing resource for the command analysis method; executing the command analysis method by using the preset computing resource to analyze the operation data generated by the bastion host.

5. The method of claim 4, wherein, Further comprising: in response to a situation that a resource utilization rate of the preset computing resource meets a preset expansion condition, expanding the preset computing resource according to a preset expansion strategy to obtain an expanded computing resource; wherein the executing the command analysis method by using the preset computing resource to analyze the operation data generated by the bastion host comprises: executing the command analysis method by using the expanded computing resource to analyze the operation data generated by the bastion host.

6. The method of claim 4, wherein, Further comprising: in response to a timeout message sent by the bastion host, releasing the preset computing resource allocated for the command analysis method, wherein the timeout message represents that a time length during which the login user does not operate the bastion host exceeds a first preset time length.

7. The method of claim 4, wherein, Further comprising: In response to a case where the number of the login messages received within the second preset time length is greater than or equal to a first preset threshold, automatically expanding computing resources of the command verification platform according to the number of the login messages to obtain expanded resources; In response to a case where the number of the login messages received within the second preset time length is less than a second preset threshold, canceling the expanded resources, wherein the second preset threshold is less than the first preset threshold.

8. The method of claim 1, wherein, In a case where the operation data generated by the bastion host is a screen recording, the command analysis method corresponding to the bastion host comprises a screen recording identification method.

9. An apparatus for command verification against a bastion machine, the apparatus comprising: a command verifier configured to verify a command against a bastion machine; and a command verifier interface configured to communicate with the command verifier. The device is applied to a command verification platform, and the device comprises: A first receiving module configured to receive login messages sent by at least one bastion host, wherein each of the login messages comprises login user information and login system information; An extracting module configured to, for each of the at least one bastion host, extract a trusted command corresponding to the login system according to a system image of the login system in a case where it is determined that there is no trusted command library corresponding to the login user; An analyzing module configured to call a command analysis method corresponding to the bastion host, analyze operation data generated by the bastion host, and obtain operation commands contained in the operation data, wherein the operation data is generated by the bastion host according to an operation process performed by the login user in the login system; and A generating module configured to perform command verification on the operation commands by using the trusted command library, generate a command verification result, and control the bastion host to execute the operation commands in the login system according to the command verification result. 10.An electronic device comprising: one or more processors; memory for storing one or more computer programs, characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1-8.

11. A computer readable storage medium having stored thereon a computer program or instructions, characterized in that, The computer program or instruction is executed by the processor to implement the steps of the method according to any one of claims 1-8.

12. A computer program product comprising computer programs or instructions, characterized in that, The computer program or instruction is executed by the processor to implement the steps of the method according to any one of claims 1-8. The computer program or instruction is executed by the processor to implement the steps of the method according to any one of claims 1-8.

Images