Secure identification method and device of Telnet protocol link, equipment and medium

Abstract

The invention provides a safety identification method and device for a Telnet protocol link, equipment and a medium, and relates to the technical field of computers. The method comprises the following steps: when monitoring that a terminal is connected with a remote server based on a Telnet protocol, judging whether the remote server belongs to a server allowed to be connected or not; if the remote server does not belong to the server which is allowed to be connected, blocking a Telnet protocol link between the terminal and the remote server; if the remote server belongs to a server which is allowed to be connected, establishing a Telnet protocol link between the terminal and the remote server, monitoring an operation instruction sent by the terminal based on the Telnet protocol link, judging whether the operation instruction sent by the terminal belongs to an allowed operation instruction or not, and if the operation instruction sent by the terminal belongs to the allowed operation instruction, sending the operation instruction to the terminal; and determining whether to block the sending of the operation instruction or not according to a judgment result. According to the invention, potential safety hazards possibly caused by a terminal through a Telnet protocol link can be avoided.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, equipment and medium for securely identifying a Telnet protocol link. Background Art

[0002] Telnet protocol is a member of the TCP / IP protocol family and is the standard protocol and main method for Internet remote login services. It provides users with the ability to complete remote host work on local computers. Use the telnet program on the terminal user's computer to connect to the server. The terminal user can enter commands in the telnet program, and these commands will run on the server, just like entering them directly on the server's console. The server can be controlled locally. To start a telnet session, you must enter a username and password to log in to the server. Telnet is a commonly used method for remotely controlling Web servers.

[0003] With the development of information-based office, Telnet allows us to sit in front of our own computer and log in to another remote computer through the Internet. This computer can be in the next room or on the other side of the earth. After logging in to the remote computer, the local computer is equivalent to a terminal of the remote computer. We can use our own computer to directly operate the remote computer and enjoy the same operating permissions as the local terminal of the remote computer. The main purpose of Telnet is to use the information resources owned by the remote computer that the local computer does not have.

[0004] However, in the current enterprise network security management, when employees operate remote servers through the Telnet protocol, there may be situations where the connection to the server and the operation commands are uncontrollable, which will pose a hidden danger to enterprise security. Summary of the invention

[0005] The purpose of the present application is to provide a Telnet protocol link security identification method, device, electronic device and storage medium, which can reduce the security risks based on Telnet protocol connection.

[0006] In a first aspect, an embodiment of the present application provides a method for securely identifying a Telnet protocol link, which is applied to a console and includes:

[0007] When monitoring that the terminal is connected to a remote server based on the Telnet protocol, determining whether the remote server is a server that is allowed to connect;

[0008] If the remote server does not belong to the servers allowed to connect, blocking the Telnet protocol link between the terminal and the remote server;

[0009] If the remote server is a server that is allowed to connect, a Telnet protocol link is established between the terminal and the remote server, and the operation instructions sent by the terminal based on the Telnet protocol link are monitored to determine whether the operation instructions sent by the terminal are allowed operation instructions, and determine whether to block the sending of the operation instructions based on the determination result.

[0010] In a possible implementation, determining whether to block the sending of the operation instruction according to the judgment result includes:

[0011] If the result of the determination is that the operation instruction sent by the terminal does not belong to the permitted operation instruction, blocking the sending of the operation instruction;

[0012] If the judgment result is that the operation instruction sent by the terminal is an allowed operation instruction, the operation instruction is sent.

[0013] In a possible implementation, the method further includes:

[0014] The identifier of the terminal, the identifier of the remote server, the sent operation instruction, and the sending time of the operation instruction are recorded.

[0015] In a possible implementation manner, after blocking the sending of the operation instruction, the method further includes: triggering a violation response.

[0016] In a possible implementation manner, after blocking the Telnet protocol link between the terminal and the remote server, the method further includes: triggering a violation response.

[0017] In a possible implementation, the violation response includes at least one of the following:

[0018] Terminal alarms, console alarms, screenshot operations, and screen recording operations.

[0019] In a second aspect, an embodiment of the present application provides a Telnet protocol link security identification device, which is applied to a console, including:

[0020] A monitoring module, used to monitor that when a terminal is connected to a remote server based on the Telnet protocol, determine whether the remote server is a server that is allowed to connect;

[0021] The security identification module is used to block the Telnet protocol link between the terminal and the remote server if the remote server does not belong to the servers allowed to connect; if the remote server belongs to the servers allowed to connect, establish a Telnet protocol link between the terminal and the remote server, and monitor the operation instructions sent by the terminal based on the Telnet protocol link, judge whether the operation instructions sent by the terminal belong to the allowed operation instructions, and determine whether to block the sending of the operation instructions according to the judgment result.

[0022] In a possible implementation, the security identification module is specifically used to:

[0023] If the result of the determination is that the operation instruction sent by the terminal does not belong to the permitted operation instruction, blocking the sending of the operation instruction;

[0024] If the judgment result is that the operation instruction sent by the terminal is an allowed operation instruction, the operation instruction is sent.

[0025] In a possible implementation, the security identification module is further used to:

[0026] The identifier of the terminal, the identifier of the remote server, the sent operation instruction, and the sending time of the operation instruction are recorded.

[0027] In a possible implementation, the security identification module is further used to:

[0028] After the sending of the operation instruction is blocked, a violation response is triggered.

[0029] In a possible implementation, the security identification module is further used to:

[0030] After the Telnet protocol link between the terminal and the remote server is blocked, a violation response is triggered.

[0031] In a possible implementation, the violation response includes at least one of the following:

[0032] Terminal alarms, console alarms, screenshot operations, and screen recording operations.

[0033] In a third aspect, the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in the first aspect.

[0034] In a fourth aspect, the present application provides a computer-readable storage medium having computer-readable instructions stored thereon, wherein the computer-readable instructions can be executed by a processor to implement the method described in the first aspect.

[0035] Compared with the prior art, the security identification method of the Telnet protocol link provided by the present application, when monitoring the terminal to connect to the remote server based on the Telnet protocol, determines whether the remote server belongs to a server that is allowed to connect; if the remote server does not belong to a server that is allowed to connect, the Telnet protocol link between the terminal and the remote server is blocked; if the remote server belongs to a server that is allowed to connect, a Telnet protocol link between the terminal and the remote server is established, and the operation instructions sent by the terminal based on the Telnet protocol link are monitored, and it is determined whether the operation instructions sent by the terminal belong to allowed operation instructions, and whether to block the sending of the operation instructions according to the judgment result. It can be seen that through this application, the connection of the terminal based on the Telnet protocol and the operation instructions sent can be monitored on the console, and when the Telnet protocol link or the operation instruction is not compliant, it can be blocked in time, thereby avoiding the potential safety hazards caused by the terminal through the Telnet protocol link. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0037] Figure 1 A flowchart of a Telnet protocol link security identification method provided by an embodiment of the present application is shown;

[0038] Figure 2 A schematic diagram of the structure of a security identification device for a Telnet protocol link provided in an embodiment of the present application is shown;

[0039] Figure 3 A schematic structural diagram of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0040] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0041] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by technicians in the field to which this application belongs.

[0042] In addition, the terms "first" and "second" etc. are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0043] Please refer to Figure 1 , Figure 1 1 is a flowchart of a Telnet protocol link security identification method provided in an embodiment of the present application, comprising the following steps S101 to S103:

[0044] S101, when monitoring that a terminal is connected to a remote server based on the Telnet protocol, determining whether the remote server is a server that is allowed to be connected;

[0045] The above method provided in the present application is applied to a console, which can monitor each terminal in the intranet.

[0046] The console monitors the connection of each terminal in the intranet to the remote server based on the Telnet protocol. The console stores the identification set of the remote servers that each terminal is allowed to connect to based on the Telnet protocol. The identification of the remote server can be the network address of the remote server. Monitor and intercept the action of a terminal connecting to the remote server based on the Telnet protocol, obtain the identification of the remote server to be connected, and determine whether the remote server is a server that the terminal is allowed to connect to based on the identification.

[0047] S102: If the remote server does not belong to the servers allowed to connect, blocking the Telnet protocol link between the terminal and the remote server.

[0048] Blocking terminals from connecting to unauthorized servers can prevent terminals from operating non-compliant remote servers based on Telnet protocol links, and can avoid potential security risks caused by terminals through Telnet protocol links.

[0049] In some embodiments, after the console blocks the terminal from connecting to the unauthorized server, it will also trigger a violation response, which includes at least one of the following: a terminal alarm, a console alarm, a screenshot operation, and a screen recording operation.

[0050] S103. If the remote server is a server that is allowed to connect, a Telnet protocol link is established between the terminal and the remote server, and operation instructions sent by the terminal based on the Telnet protocol link are monitored to determine whether the operation instructions sent by the terminal are allowed operation instructions, and determine whether to block the sending of the operation instructions based on the determination result.

[0051] After determining that the remote server is compliant, the terminal establishes a Telnet protocol link with the remote server. The terminal can send operation instructions to the remote server. When monitoring the terminal sending operation instructions to the remote server, the console intercepts the sending action of the operation instruction, obtains the operation instruction to be sent, and determines whether the operation instruction is an allowed operation instruction to obtain a judgment result.

[0052] Specifically, if the judgment result is that the operation instruction sent by the terminal is not an allowed operation instruction, the sending of the operation instruction is blocked; if the judgment result is that the operation instruction sent by the terminal is an allowed operation instruction, the operation instruction is sent.

[0053] The above blocking of the sending of unauthorized operation instructions can avoid the terminal's non-compliant operations on the remote server based on the Telnet protocol link. For example, a terminal non-compliantly modifies a parameter in the server. This can avoid security risks that may be caused by the terminal through the Telnet protocol link.

[0054] In some embodiments, after the console blocks the terminal from sending the unauthorized operation instruction, it will also trigger a violation response, which includes at least one of the following: terminal alarm, console alarm, screenshot operation and screen recording operation.

[0055] In some embodiments, in order to facilitate subsequent tracing, after the console allows the terminal to send an operation instruction, it can also record the terminal identification, the remote server identification, the sent operation instruction and the sending time of the operation instruction. The console administrator can view the terminal operation command details.

[0056] In this application, when the terminal connects to the server via Telnet, the console immediately takes over the Telnet link, identifies whether the Telnet server address is compliant, and triggers a violation response if it is not compliant; if it is compliant, identifies whether the operation instruction sent by the terminal is compliant, and triggers a violation response if it is not compliant. If it is compliant, the terminal is allowed to send the operation instruction and the sending process of the operation instruction is recorded. It can be seen that this application can control the Telnet protocol link during the Telnet protocol transmission process, which is impossible with the existing technology, and this application can identify the operation instructions of the specific use process of the Telnet protocol, and when the operation instruction is not compliant, the command operation can be blocked.

[0057] The Telnet protocol link security identification method provided in the embodiment of the present application has the following beneficial effects:

[0058] This application determines whether the remote server is a server that is allowed to connect when the terminal is connected to the remote server based on the Telnet protocol; if the remote server is not a server that is allowed to connect, the Telnet protocol link between the terminal and the remote server is blocked; if the remote server is a server that is allowed to connect, a Telnet protocol link is established between the terminal and the remote server, and the operation instructions sent by the terminal based on the Telnet protocol link are monitored to determine whether the operation instructions sent by the terminal are allowed operation instructions, and determine whether to block the sending of the operation instructions based on the judgment result. It can be seen that through this application, the connection of the terminal based on the Telnet protocol and the operation instructions sent can be monitored on the console, and the Telnet protocol link or the operation instruction can be blocked in time when it is not compliant, thereby avoiding the potential safety hazards caused by the terminal through the Telnet protocol link.

[0059] In the above-mentioned embodiment, a security identification method of a Telnet protocol link is provided, and correspondingly, the present application also provides a security identification device of a Telnet protocol link. The security identification device of the Telnet protocol link provided by the embodiment of the present application can implement the security identification method of the above-mentioned Telnet protocol link, and the security identification device of the Telnet protocol link can be implemented by software, hardware or a combination of software and hardware. For example, the security identification device of the Telnet protocol link may include an integrated or separate functional module or unit to perform the corresponding steps in the above-mentioned methods.

[0060] Please refer to Figure 2 As shown, the Telnet protocol link security identification device 10 provided by the present application includes:

[0061] The monitoring module 101 is used to monitor that when a terminal is connected to a remote server based on the Telnet protocol, determine whether the remote server is a server that is allowed to connect;

[0062] The security identification module 102 is used to block the Telnet protocol link between the terminal and the remote server if the remote server is not a server allowed to connect; if the remote server is a server allowed to connect, establish a Telnet protocol link between the terminal and the remote server, and monitor the operation instructions sent by the terminal based on the Telnet protocol link to determine whether the operation instructions sent by the terminal are allowed operation instructions, and determine whether to block the sending of the operation instructions based on the determination result.

[0063] In a possible implementation, the security identification module 102 is specifically configured to:

[0064] If the result of the determination is that the operation instruction sent by the terminal does not belong to the permitted operation instruction, blocking the sending of the operation instruction;

[0065] If the judgment result is that the operation instruction sent by the terminal is an allowed operation instruction, the operation instruction is sent.

[0066] In a possible implementation, the security identification module 102 is further configured to:

[0067] The identifier of the terminal, the identifier of the remote server, the sent operation instruction, and the sending time of the operation instruction are recorded.

[0068] In a possible implementation, the security identification module 102 is further configured to:

[0069] After the sending of the operation instruction is blocked, a violation response is triggered.

[0070] In a possible implementation, the security identification module 102 is further configured to:

[0071] After the Telnet protocol link between the terminal and the remote server is blocked, a violation response is triggered.

[0072] In a possible implementation, the violation response includes at least one of the following:

[0073] Terminal alarms, console alarms, screenshot operations, and screen recording operations.

[0074] The security identification device of the Telnet protocol link provided in the embodiment of the present application and the security identification method of the Telnet protocol link provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented therein.

[0075] An embodiment of the present application also provides an electronic device corresponding to the method provided in the aforementioned embodiment, and the electronic device may be an electronic device for a client, such as a mobile phone, a laptop computer, a tablet computer, a desktop computer, etc., to execute the above-mentioned Telnet protocol link security identification method.

[0076] Please refer to Figure 3 , which shows a schematic diagram of an electronic device provided by some embodiments of the present application. Figure 3 As shown, the electronic device 20 includes: a processor 200, a memory 201, a bus 202 and a communication interface 203, and the processor 200, the communication interface 203 and the memory 201 are connected via the bus 202; the memory 201 stores a computer program that can be run on the processor 200, and when the processor 200 runs the computer program, the security identification method of the Telnet protocol link provided in any of the aforementioned embodiments of the present application is executed.

[0077] The memory 201 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 203 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.

[0078] The bus 202 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory 201 is used to store a program, and the processor 200 executes the program after receiving an execution instruction. The security identification method of the Telnet protocol link disclosed in any implementation of the embodiment of the present application may be applied to the processor 200, or implemented by the processor 200.

[0079] The processor 200 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 200. The above processor 200 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a readily available programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor to be executed, or the hardware and software modules in the decoding processor can be executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 201, and the processor 200 reads the information in the memory 201 and completes the steps of the above method in combination with its hardware.

[0080] The electronic device provided in the embodiment of the present application and the method for secure identification of the Telnet protocol link provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented therein.

[0081] An embodiment of the present application also provides a computer-readable storage medium corresponding to the Telnet protocol link security identification method provided in the aforementioned embodiment, on which a computer program (i.e., a program product) is stored. When the computer program is executed by a processor, the Telnet protocol link security identification method provided in any of the aforementioned embodiments will be executed.

[0082] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0083] The computer-readable storage medium provided in the above-mentioned embodiment of the present application and the method for secure identification of Telnet protocol links provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the method adopted, run or implemented by the application program stored therein.

[0084] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application, and they should all be included in the scope of the claims and specification of the present application.

Claims

1. A Telnet protocol link security identification method, applied to a console, characterized in that: include: When monitoring that the terminal is connected to a remote server based on the Telnet protocol, determining whether the remote server is a server that is allowed to connect; If the remote server does not belong to the servers allowed to connect, blocking the Telnet protocol link between the terminal and the remote server; If the remote server is a server that is allowed to connect, a Telnet protocol link is established between the terminal and the remote server, and the operation instructions sent by the terminal based on the Telnet protocol link are monitored to determine whether the operation instructions sent by the terminal are allowed operation instructions, and determine whether to block the sending of the operation instructions based on the determination result.

2. The method according to claim 1, characterized in that The determining, according to the judgment result, whether to block the sending of the operation instruction comprises: If the result of the determination is that the operation instruction sent by the terminal does not belong to the permitted operation instruction, blocking the sending of the operation instruction; If the judgment result is that the operation instruction sent by the terminal is an allowed operation instruction, the operation instruction is sent.

3. The method according to claim 2, characterized in that The method further comprises: The identifier of the terminal, the identifier of the remote server, the sent operation instruction, and the sending time of the operation instruction are recorded.

4. The method according to claim 2, characterized in that: After blocking the sending of the operation instruction, the method further includes: triggering a violation response.

5. The method according to claim 1, characterized in that After blocking the Telnet protocol link between the terminal and the remote server, the method further includes: triggering a violation response.

6. The method according to claim 4 or 5, characterized in that: The violation response includes at least one of the following: Terminal alarms, console alarms, screenshot operations, and screen recording operations.

7. A Telnet protocol link security identification device, applied to a console, characterized in that: include: A monitoring module, used to monitor that when a terminal is connected to a remote server based on the Telnet protocol, determine whether the remote server is a server that is allowed to connect; A security identification module, used for blocking the Telnet protocol link between the terminal and the remote server if the remote server does not belong to the servers allowed to connect; If the remote server is a server that is allowed to connect, a Telnet protocol link is established between the terminal and the remote server, and the operation instructions sent by the terminal based on the Telnet protocol link are monitored to determine whether the operation instructions sent by the terminal are allowed operation instructions, and determine whether to block the sending of the operation instructions based on the determination result.

8. The device according to claim 7, characterized in that The security identification module is specifically used for: If the result of the determination is that the operation instruction sent by the terminal does not belong to the permitted operation instruction, blocking the sending of the operation instruction; If the judgment result is that the operation instruction sent by the terminal is an allowed operation instruction, the operation instruction is sent.

9. An electronic device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 6 when executing the computer program.

10. A computer-readable storage medium, characterized in that: Computer-readable instructions are stored thereon, and the computer-readable instructions can be executed by a processor to implement the method according to any one of claims 1 to 6.

Images