Methods and devices for accessing servers, servers, systems and storage media

Abstract

The present specification provides a method and device for accessing a service, a server, a system and a storage medium, the method comprising: receiving an access request sent by a client; after establishing a session with the client based on the access request, sending first information to the client; receiving an acquisition request sent by a proxy server after establishing a secure connection with the client; wherein the acquisition request is used to request to acquire second information; wherein the second information at least includes target authentication data, and the target authentication data is data required to be authenticated when a target server provides a target service; and based on the acquisition request, sending the second information to the proxy server. In the present specification, the client can access the target server through the proxy server to obtain the target service, and in this process, the target authentication data is invisible to the client, thereby avoiding the risk of authentication data leakage and improving the security of user access management, and the availability is high.

Description

Technical Field

[0001] This specification relates to the field of authentication service technology, and in particular to a method and apparatus, server, system and storage medium for accessing services. Background Technology

[0002] Currently, various authentication methods exist across different systems and platforms within enterprises. In these technologies, information such as account details, passwords, certificates, and / or credentials on the target service's device is visible to the user, posing a risk of leakage. Summary of the Invention

[0003] In view of the above, one or more embodiments of this specification provide the following technical solutions:

[0004] According to a first aspect of one or more embodiments of this specification, a method for accessing a service is provided, the method being performed by a control management server, comprising:

[0005] Receive an access request sent by a client; wherein the access request includes the target service that the user wishes to access;

[0006] After establishing a session with the client based on the access request, first information is sent to the client; wherein, the first information is used for the client to establish a secure connection with the proxy server.

[0007] The system receives an acquisition request sent by the proxy server after establishing a secure connection with the client; wherein the acquisition request is used to request second information; wherein the second information includes at least target authentication data, which is data that the target server needs to authenticate when providing the target service;

[0008] Based on the acquisition request, the second information is sent to the proxy server.

[0009] According to a second aspect of one or more embodiments of this specification, a method for accessing a service is provided, the method being performed by a proxy server, the method comprising:

[0010] The system receives a connection establishment request sent by a client based on first information; wherein the first information is used by the client to establish a secure connection with the proxy server.

[0011] After establishing a secure connection with the client based on the first information, a connection is established with the target server based on the second information obtained from the control and management server; wherein, the second information includes at least target authentication data, which is the data that the target server needs to authenticate when providing the target service;

[0012] Upon receiving the data packet sent by the client for accessing the target service, the target authentication data is added to the data packet;

[0013] A data packet containing the target authentication data is sent to the target server so that the target server can authenticate the target authentication data and then provide the target service to the client.

[0014] According to a third aspect of one or more embodiments of this specification, a method for accessing a service is provided, the method being performed by a client, the method comprising:

[0015] Send an access request to the control and management server; wherein the access request includes the target service that the user wishes to access;

[0016] The system receives first information sent by the control management server after establishing a session with the client; wherein the first information is used by the client to establish a secure connection with the proxy server.

[0017] Initiate a connection establishment request to the proxy server, and establish a secure connection with the proxy server based on the first information;

[0018] Through the secure connection, a data packet for accessing the target service is sent to the proxy server.

[0019] According to a fourth aspect of one or more embodiments of this specification, an apparatus for accessing a service is provided, the apparatus comprising:

[0020] The first receiving module is used to receive access requests sent by the client; wherein the access request includes the target service that the user wishes to access;

[0021] The first sending module is configured to send first information to the client after establishing a session with the client based on the access request; wherein the first information is used by the client to establish a secure connection with the proxy server;

[0022] The second receiving module is configured to receive an acquisition request sent by the proxy server after establishing a secure connection with the client; wherein the acquisition request is used to request acquisition of second information; wherein the second information includes at least target authentication data, the target authentication data being the data that the target server needs to authenticate when providing the target service;

[0023] The second sending module is used to send the second information to the proxy server based on the acquisition request.

[0024] According to a fifth aspect of one or more embodiments of this specification, an apparatus for accessing a service is provided, the apparatus comprising:

[0025] The third receiving module is used to receive a connection establishment request sent by the client based on the first information; wherein the first information is used by the client to establish a secure connection with the proxy server;

[0026] The first connection establishment module is used to establish a secure connection with the client based on the first information, and then establish a connection with the target server based on the second information obtained from the control management server; wherein, the second information includes at least target authentication data, which is the data that the target server needs to authenticate when providing the target service;

[0027] The fourth receiving module is used to add the target authentication data to the data packet after receiving the data packet sent by the client for accessing the target service;

[0028] The third sending module is used to send a data packet containing the target authentication data to the target server, so that the target server can provide the target service to the client after authenticating the target authentication data.

[0029] According to a sixth aspect of one or more embodiments of this specification, an apparatus for accessing a service is provided, the apparatus comprising:

[0030] The fourth sending module is used to send an access request to the control and management server; wherein the access request includes the target service that the user wishes to access;

[0031] The fifth receiving module is used to receive first information sent by the control management server after establishing a session with the client; wherein, the first information is used for the client to establish a secure connection with the proxy server;

[0032] The second connection establishment module is used to initiate a connection establishment request to the proxy server and establish a secure connection with the proxy server based on the first information.

[0033] The fifth sending module is used to send data packets for accessing the target service to the proxy server through the secure connection.

[0034] According to a seventh aspect of one or more embodiments of this specification, a server is provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor performs the executable instructions to implement the steps of the method as described in any one of the first, second, or third aspects.

[0035] According to an eighth aspect of one or more embodiments of this specification, a system for accessing services is provided, the system comprising:

[0036] A control management server for performing the steps of the method as described in any of the first aspects;

[0037] A proxy server for performing the steps of the method as described in any of the second aspects;

[0038] A client for performing the steps of the method as described in any of the third aspects;

[0039] The target server is used to provide the target service.

[0040] According to a ninth aspect of one or more embodiments of this specification, a computer-readable storage medium is provided that stores computer instructions thereon, which, when executed by a processor, implement the steps of the method as described in any one of the first, second, or third aspects.

[0041] According to a tenth aspect of one or more embodiments of this specification, a computer program product is provided, comprising a computer program / instructions that, when executed by a processor, implement the steps of the method as described in any one of the first, second, or third aspects.

[0042] As can be seen from the above embodiments, in this specification, the client can access the target server through the proxy server to obtain the target service. During this process, the target authentication data is not visible to the client, avoiding the risk of authentication data leakage, improving the security of user access management, and ensuring high availability.

[0043] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this specification. Attached Figure Description

[0044] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this specification and, together with the description, serve to explain the principles of this specification.

[0045] Figure 1 This is a schematic diagram of the architecture of an access service system provided in an exemplary embodiment.

[0046] Figure 2 This is one of the flowcharts illustrating a method for accessing a service, provided in an exemplary embodiment.

[0047] Figure 3 This is a second flowchart illustrating a method for accessing a service, provided in an exemplary embodiment.

[0048] Figure 4 This is a flowchart illustrating a method for accessing a service, provided in an exemplary embodiment.

[0049] Figure 5This is a flowchart illustrating a method for accessing a service, provided in an exemplary embodiment.

[0050] Figure 6 This is an interactive schematic diagram of a method for accessing a service provided in an exemplary embodiment.

[0051] Figure 7 This is a schematic diagram of the structure of a server provided in an exemplary embodiment.

[0052] Figure 8 This is one of the schematic diagrams of an access service provided in an exemplary embodiment.

[0053] Figure 9 This is a second schematic diagram of an access service apparatus provided in an exemplary embodiment.

[0054] Figure 10 This is a third schematic diagram of an apparatus for providing an access service, as provided in an exemplary embodiment. Detailed Implementation

[0055] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this specification as detailed in the appended claims.

[0056] The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of this specification. The singular forms “a,” “the,” and “the” as used in this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

[0057] It should be understood that although the terms first, second, third, etc., may be used in this specification to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this specification, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0058] Before introducing the technical solutions in this manual, let's first introduce the terms used in this manual.

[0059] Business target system: Various development infrastructure systems within the enterprise, including physical machines, cluster services, internal and external SaaS services, etc.

[0060] Target system types: business host access, database service, desktop access service, cluster service.

[0061] Business objective access control: trusted access to various services within the enterprise, secure encryption of the entire data link, and access control for different resources and different personnel.

[0062] With the increasing prevalence of remote work, traditional access control methods based on Internet Protocol (IP) addresses, such as Secure Shell (SSH) keys, system passwords, and permission settings, lack the management and maintenance capabilities required for large-scale and complex access scenarios. Meanwhile, solutions like Virtual Private Networks (VPNs) and jump servers grant users access to the target network, resulting in a large attack surface and making access control lists (ACLs) difficult to manage.

[0063] In cloud-native scenarios, target resources such as IP addresses and ports are volatile, making it difficult for IP-based firewalls and operational rules to adapt. Furthermore, the authentication data or information of the target facility is visible to users, posing a risk of leakage.

[0064] To prevent authentication data leakage and improve the security of user access management, this manual provides the following methods, devices, servers, systems, and storage media for access services.

[0065] Figure 1 This is a schematic diagram of the architecture of a system providing an access service, as illustrated in an exemplary embodiment. Figure 1 As shown, the system may include, but is not limited to, at least one of the following:

[0066] Control and management server 101;

[0067] Proxy server 102;

[0068] Client 103;

[0069] Target server 104.

[0070] In some embodiments, the system may further include at least one of the following:

[0071] Access control module 105; storage module 106.

[0072] In some embodiments, the control management server 101 may be used to perform at least one of the following: authenticating user permissions; providing first information to the client 103; and providing second information to the proxy server 102.

[0073] In one example, the control management server 101 authenticates a user's permissions to determine if the user has access to at least one service.

[0074] In one example, the control management server 101 can support multiple user authentication methods, such as username and password authentication, one-time token authentication, etc.

[0075] In one example, the control management server 101 can connect to the permission management module 105 to authenticate user permissions.

[0076] In one example, the control management server 101 can establish a session with client 103 based on an access request initiated by client 103, and provide client 103 with initial information. This access request includes the target service that the user wishes to access, such as the name or identifier of the target service.

[0077] The first piece of information can be used by client 103 to establish a secure connection with proxy server 102.

[0078] The first piece of information may include, but is not limited to, at least one of the following:

[0079] The address of the proxy server 102;

[0080] Session identifier;

[0081] Session credentials.

[0082] The address of the proxy server 102 includes, but is not limited to, IP address and physical address.

[0083] Among them, session credentials can refer to session certificates.

[0084] The control and management server 101 improves the security of user access management by providing independent session credentials for each session, preventing session credential leakage.

[0085] In one example, the control management server 101 may provide second information to the proxy server 102 based on the acquisition request initiated by the proxy server 102. The second information includes at least target authentication data, which is the data that the target server needs to authenticate when providing the target service.

[0086] For example, the target authentication data may include, but is not limited to, certificates used to access the target service client, and / or authentication data based on different protocols. Authentication data based on different protocols includes, but is not limited to, Application Programming Interface (API) keys based on Hypertext Transfer Protocol (HTTP), usernames and passwords based on the HTTP protocol, and third-party access key (AK) and secret key (SK) information.

[0087] For example, the second information may also include the address and / or port of the target server 104, so that the proxy server 102 can establish a connection with the target server 104.

[0088] In one example, the control management server 101 can be connected to the storage module 106, which stores authentication data corresponding to different services. The control management server 101 can obtain the target authentication data corresponding to the target service from the control module 106 and provide the second information including the target authentication data to the proxy server 102.

[0089] In one example, to implement a lightweight version of the system, the aforementioned permission management module 105 and / or storage module 106 can be deployed on the control management server 101.

[0090] In some embodiments, the proxy server 102 can be used to establish connections with both the client 103 and the target server 104. If the client 103 needs to access the target service, it can do so through the proxy server 102. Additionally, the proxy server 102 can obtain target authentication data from the control and management server 101, add the target authentication data to the data packets sent by the client 103, and then send them to the target server 104, thus achieving the goal of making the target authentication data invisible to the client 103.

[0091] In one example, after receiving a connection establishment request initiated by client 103, proxy server 102 can establish a connection with client 103 based on the session credentials in the first information, such as establishing a secure connection based on Transport Layer Security (TLS).

[0092] Furthermore, through this connection, the proxy server 102 can obtain the session identifier from the first information provided by the client 103. Based on the session identifier, the proxy server 102 can obtain the second information corresponding to the session identifier from the control management server 101. The second information includes at least the target authentication data, and may also include the address and / or port of the target server 104.

[0093] Proxy server 102 can establish a connection with target server 104 based on the address and / or port of target server 104. At this time, proxy server 102 establishes a connection with both client 103 and target server 104, so that client 103 can access target server 104 through proxy server 102.

[0094] Proxy server 102 can receive data packets sent by clients, which are used to access the target service. Proxy server 102 can add target authentication data to the data packet and then send the target authentication data to target server 104. Target server 104 can authenticate the target authentication data through the connected authentication server or authentication module. If the authentication is successful, the target service is provided to client 103.

[0095] This data packet can be a Transmission Control Protocol (TCP) data packet.

[0096] In some embodiments, client 103 may be used to obtain first information from control management server 101, establish a secure connection with proxy server 102 based on the first information, and send data packets for accessing target services to proxy server 102 through the secure connection.

[0097] In one example, client 103 can first perform user permission authentication. Specifically, client 103 can send an authentication request to control management server 101, wherein the authentication request is used to request authentication of the user's permissions. After the control management server 101 authenticates the user's permissions, it can provide a resource list to client 103, which includes at least one service that the user has access to.

[0098] Client 103 can output this resource list, allowing the user to select a service from the list as the target service they wish to access.

[0099] Furthermore, client 103 can send an access request to control management server 101, which includes the target service that the user wishes to access. For example, the access request may include the name or identifier of the target service.

[0100] For example, if the target service is a service in the resource list, after the control management server 101 establishes a session with the client 103 based on the access request, the client 103 can receive the first information sent by the control management server 101, including the address of the proxy server 102; session credentials; session identifier, etc. The session credentials may refer to a session certificate.

[0101] For example, if the target service is not a service in the resource list, client 103 will receive an access denied message.

[0102] Client 103 can initiate a connection establishment request to proxy server 102 based on the address of proxy server 102, and establish a connection with proxy server 102 using session credentials, such as a TLS-based secure connection.

[0103] Furthermore, the client 103 provides the session identifier to the proxy server 102 through the connection, so that the proxy server 102 can obtain the second information corresponding to the session identifier from the control management server 101.

[0104] In some embodiments, the target server 104 is a server that can provide the target service.

[0105] In one example, the target server 104 receives a data packet containing target authentication data sent by the proxy server 102. It can authenticate the target authentication data through the connected authentication server. If the authentication is successful, it provides the target service to the client 103.

[0106] In some embodiments, the number of control management servers 101 described above can be one or more.

[0107] In some embodiments, the number of the above-mentioned proxy servers 102 can be one or more.

[0108] In some embodiments, the number of control management servers 101 is less than the number of proxy servers 102, and this disclosure does not limit this.

[0109] In some embodiments, the proxy server 102 can be deployed on the control and management server 101 to further reduce system weight and facilitate deployment and maintenance.

[0110] In some embodiments, the control management server 101, the proxy server 102, and the client 103 support one-way or two-way TLS authentication between each other.

[0111] In the above embodiments, the client can access the target server through the proxy server to obtain the target service. During this process, the target authentication data is not visible to the client, avoiding the risk of authentication data leakage, improving the security of user access management, and ensuring high availability.

[0112] Figure 2 This is a flowchart illustrating a method for accessing a service, provided in an exemplary embodiment. Figure 2 As shown, this method can be executed by the control management server 101 in the above system, and the method may include the following steps:

[0113] Step 201: Receive the access request sent by client 103.

[0114] In some embodiments, the access request includes the target service that the user wishes to access. Specifically, the access request may include the name or identifier of the target service.

[0115] Step 202: After establishing a session with the client 103 based on the access request, send first information to the client 103. In some embodiments, the control management server 101 may establish a session with the client 103 based on the access request.

[0116] In some embodiments, the first information includes at least one of the following: the address of the proxy server 102; a session identifier; and a session credential. The session credential may be a session certificate.

[0117] In some embodiments, the control management server 101 may create session credentials separately for each session.

[0118] Step 203: Receive the acquisition request sent by the proxy server 102 after establishing a secure connection with the client 103.

[0119] In some embodiments, client 103 may establish a secure connection with proxy server 102 based on first information. After receiving a connection establishment request, proxy server 102 may confirm with control management server 101 whether the session is legitimate and whether it includes second information of the target service. After control management server 101 confirms that the session is legitimate and includes the second information of the target service, it may accept the acquisition request.

[0120] In some embodiments, the request is used to request second information; wherein the second information includes at least target authentication data, which is the data that the target server 104 needs to authenticate when providing the target service.

[0121] In one example, the target authentication data may include, but is not limited to, at least one of the following: an HTTP-based API key, an HTTP-based username and password, third-party AK and SK information, etc.

[0122] In one example, the second information may also include the address and / or port of the target server 104, wherein the address of the target server 104 may be, for example, the IP address, physical address, etc. of the target server 104.

[0123] Step 204: Based on the acquisition request, send the second information to the proxy server 102.

[0124] In some embodiments, the request includes a session identifier. The control management server 101 can obtain second information corresponding to the session identifier from the storage module 106 and send it to the proxy server 102.

[0125] In the above embodiments, the control management server can provide the first information and the second information to the client and the proxy server respectively, ensuring that the target authentication data is not visible to the client, avoiding the risk of authentication data leakage, improving the security of user access management, and ensuring high availability.

[0126] Figure 3 Based on Figure 2 The illustrated embodiment provides a flowchart of a method for accessing a service. Figure 3 As shown, this method can be executed by the aforementioned control management server 101. Before executing step 101, the method may further include the following steps:

[0127] Step 200-1: Receive the authentication request sent by the client 103.

[0128] In some embodiments, the authentication request is used to request authentication of the user's permissions.

[0129] In some embodiments, the control management server 101 can authenticate the user's permissions through the permission management module.

[0130] Step 200-2: After authenticating the user's permissions, obtain the resource list.

[0131] In some embodiments, the resource list includes at least one service that the user has access to.

[0132] In some embodiments, the control management server 101 may also perform a query based on the query request sent by the client 103 to obtain query results on whether the user has access rights to one or more specified services.

[0133] Step 200-3: Send the resource list to the client 103.

[0134] In some embodiments, client 103 may determine the target service to be accessed from the resource list.

[0135] After performing step 200-3 above, step 201 can be performed.

[0136] In some embodiments, if the target service that client 103 expects to access is not a service in the resource list, an access denial message may be sent to client 103.

[0137] In some embodiments, if the target service that client 103 expects to access is a service in the resource list, then step 202 can be performed.

[0138] In the above embodiments, the control management server can verify user permissions and reject access requests initiated by the client when the user does not have permission to access the target service, thereby improving the security and availability of user access management.

[0139] Figure 4 This is a flowchart illustrating a method for accessing a service, provided in an exemplary embodiment. Figure 4 As shown, this method can be executed by the aforementioned proxy server 102, and the method may include the following steps:

[0140] Step 401: Receive a connection establishment request sent by client 103.

[0141] In some embodiments, client 103 sends a connection establishment request to proxy server 102 based on first information provided by control management server 101.

[0142] In some embodiments, the first information includes at least one of the following: the address of the proxy server 102, session credentials, and session identifier.

[0143] Step 402: After establishing a secure connection with the client 103 based on the connection establishment request, establish a connection with the target server 104 based on the second information obtained from the control management server 101.

[0144] In some embodiments, the proxy server 102 may establish a secure connection with the client 103 based on the session credentials in the first information, and send an acquisition request to the control management server 101 to obtain the second information. The acquisition request may include the session identifier in the first information.

[0145] In some embodiments, the proxy server 102 may receive second information corresponding to a session identifier sent by the control management server 101. The second information includes at least target authentication data, and may also include at least one of the address and port of the target server 104. In this case, the proxy server 102 may establish a connection with the target server 104 based on the address and / or port of the target server 104.

[0146] Step 403: After receiving the data packet sent by the client 103 for accessing the target service, add the target authentication data to the data packet.

[0147] In some embodiments, when the proxy server 102 receives the data packet sent by the client 103, such as a TCP data packet, it can add target authentication data to the data packet.

[0148] Step 404: Send a data packet containing the target authentication data to the target server, so that the target server can provide the target service to the client after authenticating the target authentication data.

[0149] In some embodiments, the proxy server 102 can send a data packet containing target authentication data to the target server 104, which then authenticates the target authentication data through the connected authentication server. If the authentication is successful, the target service can be provided to the client 103.

[0150] Understandably, proxy server 102 can add target authentication data to each subsequent data packet. Alternatively, proxy server 102 can add target authentication data to a specific subsequent data packet, which could be a data packet involving authentication.

[0151] In the above embodiments, the proxy server can obtain the target authentication data and add it to the data packet sent by the client, thereby achieving the purpose of making the target authentication data invisible to the client and ensuring the reliability of the target server's authentication process.

[0152] Figure 5 This is a flowchart illustrating a method for accessing a service, provided in an exemplary embodiment. Figure 5 As shown, this method can be executed by the aforementioned client 103, and the method may include the following steps:

[0153] Step 501: Send an access request to the control and management server 101.

[0154] In some embodiments, the access request includes the target service that the user wishes to access. Specifically, the access request may include the name or identifier of the target service.

[0155] Step 502: Receive the first information sent by the control management server 101 after establishing a session with the client 103.

[0156] In some embodiments, the first information may include, but is not limited to, at least one of the following: the address of the proxy server 102; session credentials; session identifier.

[0157] Step 503: Based on the first information, initiate a connection establishment request to the proxy server 102 and establish a secure connection with the proxy server 102.

[0158] In some embodiments, client 103 can locate proxy server 102 based on its address and establish a secure connection with proxy server 102 based on session credentials. Proxy server 102 can obtain the session identifier.

[0159] Step 504: Send a data packet for accessing the target service to the proxy server 102 through the secure connection.

[0160] In some embodiments, client 103 cannot obtain the target authentication data, which is added to the data packet by proxy server 102.

[0161] In some embodiments, if the target server 104 authenticates the target authentication data, it can provide the target service to the client 103.

[0162] In the above embodiments, the client does not obtain the target authentication data during the process of accessing the target server, avoiding the risk of authentication data leakage, improving the security of user access management, and ensuring high availability.

[0163] The above process is further illustrated with examples below.

[0164] Figure 6 This is an interactive schematic diagram illustrating a method for accessing a service, provided in an exemplary embodiment. For example... Figure 6 As shown, the method may include the following steps:

[0165] In step S601, the user first authenticates through the client 103. The authentication process is implemented through the control management server 101, which provides multiple user authentication methods, such as password and one-time token. The control management server 101 is connected to the permission management module.

[0166] Step 602: After the control management server 101 completes the authentication of the client 103, if the name or identifier of the target service that the client 103 wants to access has been managed by the control management server 101, then the target resource can be accessed through this scheme.

[0167] In step 603, client 103 can also use the query function to query services that have access permissions.

[0168] Step 603 is an optional step. Client 103 can also select the target service to be accessed based on the resource list provided by the control management server 101.

[0169] In step 604, after client 103 determines the target service to access, control management server 101 executes the client command. At this time, client 103 will create a session with controller management server 101. Controller management server 101 returns the first information, which includes the address of proxy server 102, as well as the current target, the current user, and the available session tokens and credentials at the current time. Of course, before returning the session information, controller management server 101 will perform an authorization check to ensure that the user can truly access the target.

[0170] In step 605, client 103 obtains the session token and session credential and can connect to proxy server 102. The TLS secure connection is established using the session credential, ensuring that each connection uses an independent credential and preventing the session credential from being leaked and allowing access to the target.

[0171] Step 606: After the proxy server 102 obtains the session token, it can directly obtain the address and target authentication data of the target server 104 from the control and management server 101. Based on this information, the proxy server 102 can establish a connection with the target server 104. The proxy server 102 needs to add the target authentication data to the TCP data stream from the client before it can access the target server 104.

[0172] Step 607: When the data packet containing the target authentication data arrives at the target server 104, the target server 104 will authenticate the received target authentication data according to its own authentication system to ensure that the request is from an authorized source.

[0173] The target authentication data includes two categories: one is the TLS client certificate used to access the target, and the other is layer 7 authentication data based on different protocols, such as HTTP API keys, usernames and passwords, and AK / SK information of third-party services.

[0174] The aforementioned permission system (or permission management module) and confidentiality service (or storage module) can be built into the control management server 101, enabling a lightweight version that is easy to deploy and maintain. The control management server manages the target service through a unified web or command-line interface (CLI) for static data entry, and also supports the access of third-party data. The system supports multiple types of authentication data, as different types of authentication data have different authorization scopes within the system. Users can select and apply for access as needed. This manual monitors and controls each step, enabling flow control or the disconnection and management of abnormal sessions and personnel. Through unified management and user access management by the control management server, authentication data is stored on the server side, avoiding the risk of leakage caused by client-side management and providing good security. Permission management is also implemented for the aforementioned authentication data; only authorized users can use specific authentication data to access the target service.

[0175] Example 1: Developers need to access the internal database to perform data query and update operations.

[0176] The implementation steps include:

[0177] Step 1, Developer Login to Client: Developers authenticate their identity through the client and can log in using various methods such as password or QR code scanning.

[0178] Step 2, Select the target database (i.e., the target server): Developers select the internal database they need to access, such as a MySQL database.

[0179] Step 3, the client sends a request: the client sends the name of the target database and developer information to the control management server.

[0180] Step 4: The control management server performs a permission check: The control management server checks whether the developer has permission to access the database.

[0181] Step 5: Control the management server to obtain database authentication data: If the developer has the necessary permissions, the control management server will retrieve the database authentication data from confidential storage, such as username, password, and Secure Socket Layer (SSL) data stream.

[0182] Step 9, Perform data operations: After the target server has verified the target data, the developer can perform data query and update operations through the client.

[0183] Step 10, Disconnect: After completing the certificate and other operations.

[0184] Step 6, the client establishes a connection with the proxy server: the client uses session credentials to establish a TLS secure connection with the proxy server.

[0185] Step 7, Connect to the target database: The proxy server establishes a connection with the target database.

[0186] Step 8, Proxy server adds authentication data: The proxy server adds the obtained authentication data to the TCP data stream sent by the client.

[0187] Step 9, Perform data operations: After the target server has verified the target data, the developer can perform data query and update operations through the client.

[0188] Step 10, Disconnect: After the operation is completed, the client disconnects from the proxy server.

[0189] In the above embodiments, developers do not need to store database authentication data locally, which reduces the risk of authentication data leakage and improves the convenience of accessing the target server.

[0190] Example 2: Maintenance personnel need to remotely log in to the internal server to perform system maintenance operations.

[0191] The implementation steps include:

[0192] Step 1, Operations and maintenance personnel log in to the client: Operations and maintenance personnel authenticate their identity through the client and can log in using multiple methods such as password or fingerprint recognition.

[0193] Step 2, Select the target server: The operations and maintenance personnel select the internal server that needs to be logged into, such as a Linux server.

[0194] Step 3, the client sends a request: the client sends the target server's IP address and maintenance personnel information to the control and management server.

[0195] Step 4: Control and management server performs permission checks: The control and management server checks whether the operation and maintenance personnel have permission to log in to the server.

[0196] Step 5, control management server obtains SSH key: If the operations and maintenance personnel have the necessary permissions, the control management server obtains the SSH key for the server from confidential storage.

[0197] Step 6, the client establishes a connection with the proxy server: the client uses session credentials to establish a TLS secure connection with the proxy server.

[0198] Step 7, Connect to the target server: The proxy server establishes a connection with the target server.

[0199] Step 8, Add SSH key: The proxy server adds the obtained SSH key to the TCP data stream sent by the client.

[0200] Step 9, perform system maintenance operations: Operation and maintenance personnel can perform system maintenance operations through the client, such as viewing system logs, installing software packages, etc.

[0201] Step 10, Disconnect: After the operation is completed, the client disconnects from the proxy server.

[0202] In the above embodiments, maintenance personnel do not need to store SSH keys locally, which reduces the risk of key leakage and improves the convenience of accessing the target server. System administrators can easily manage user permissions and server SSH keys to achieve fine-grained access control.

[0203] Figure 7 This is a schematic structural diagram of a server provided in an exemplary embodiment. Please refer to it. Figure 7 At the hardware level, the device includes a processor 702, an internal bus 704, a network interface 706, memory 708, and non-volatile memory 710, and may also include other hardware required for its functions. One or more embodiments of this specification can be implemented in software, for example, the processor 702 reads the corresponding computer program from the non-volatile memory 710 into memory 708 and then runs it. Of course, in addition to software implementation, one or more embodiments of this specification do not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0204] Please refer to Figure 8 The device for accessing services can be applied to, for example Figure 7 The device shown is used to implement the technical solution of this specification. The means for providing the access service may include:

[0205] The first receiving module 801 is used to receive an access request sent by the client; wherein the access request includes the target service that the user wishes to access;

[0206] The first sending module 802 is used to send first information to the client after establishing a session with the client based on the access request; wherein, the first information is used for the client to establish a secure connection with the proxy server;

[0207] The second receiving module 803 is used to receive an acquisition request sent by the proxy server after establishing a secure connection with the client; wherein the acquisition request is used to request acquisition of second information; wherein the second information includes at least target authentication data, the target authentication data being the data that the target server needs to authenticate when providing the target service;

[0208] The second sending module 804 is used to send the second information to the proxy server based on the acquisition request.

[0209] Please refer to Figure 9 The device for accessing services can be applied to, for example Figure 7 The device shown is used to implement the technical solution of this specification. The means for providing the access service may include:

[0210] The third receiving module 901 is used to receive connection establishment requests sent by the client;

[0211] The first connection establishment module 902 is used to establish a secure connection with the client based on the connection establishment request, and then establish a connection with the target server based on the second information obtained from the control management server; wherein, the second information includes at least target authentication data, which is the data that the target server needs to authenticate when providing the target service;

[0212] The fourth receiving module 903 is used to add the target authentication data to the data packet after receiving the data packet sent by the client for accessing the target service;

[0213] The third sending module 904 is used to send a data packet containing the target authentication data to the target server, so that the target server can provide the target service to the client after authenticating the target authentication data.

[0214] Please refer to Figure 10 The device for accessing services can be applied to, for example Figure 7 The device shown is used to implement the technical solution of this specification. The means for providing the access service may include:

[0215] The fourth sending module 1001 is used to send an access request to the control and management server; wherein the access request includes the target service that the user wishes to access;

[0216] The fifth receiving module 1002 is used to receive first information sent by the control management server after establishing a session with the client; wherein, the first information is used for the client to establish a secure connection with the proxy server;

[0217] The second connection establishment module 1003 is used to initiate a connection establishment request to the proxy server based on the first information and establish a secure connection with the proxy server.

[0218] The fifth sending module 1004 is used to send a data packet for accessing the target service to the proxy server through the secure connection.

[0219] Based on the same concept as the methods described above, this specification also provides a computer-readable storage medium having computer instructions stored thereon that, when executed by a processor, implement the steps of the methods as described in any of the above embodiments.

[0220] Based on the same concept as the methods described above, this specification also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the methods as described in any of the above embodiments.

[0221] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0222] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of one or more embodiments of this specification. The singular forms “a,” “described,” and “the” used in one or more embodiments of this specification and in the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0223] It should be understood that although the terms target, second, third, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, target information may also be referred to as second information without departing from the scope of one or more embodiments of this specification, and similarly, second information may also be referred to as target information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0224] The above description is merely a preferred embodiment of one or more embodiments of this specification and is not intended to limit the scope of one or more embodiments of this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of one or more embodiments of this specification should be included within the protection scope of one or more embodiments of this specification.

Claims

1. A method of accessing a service, characterized by, The method is executed by a control management server, and comprises: receiving an access request sent by a client; wherein the access request comprises a target service expected to be accessed by a user; after a session is established between the access request and the client, sending first information to the client; wherein the first information is used for the client to establish a secure connection with a proxy server; receiving an acquisition request sent by the proxy server after the secure connection is established between the proxy server and the client; wherein the acquisition request is used to request to acquire second information; wherein the second information at least comprises target authentication data, and the target authentication data is data required to be authenticated when a target server provides a target service; based on the acquisition request, sending the second information to the proxy server, so that the proxy server adds the target authentication data in a data packet sent by the client and used to access the target service, and sends the data packet added with the target authentication data to the target server, so that the target server provides the target service for the client after the target authentication data is authenticated.

2. The method of claim 1, wherein, Before receiving the access request sent by the client, the method further comprises: receiving an authentication request sent by the client; wherein the authentication request is used to request to authenticate the rights of the user; after the rights of the user are authenticated, acquiring a resource list; wherein the resource list comprises at least one service with which the user has access rights; sending the resource list to the client.

3. The method of claim 2, wherein, After the session is established between the access request and the client, the first information is sent to the client, comprising: if the target service is included in the resource list, after the session is established between the access request and the client, the first information is sent to the client.

4. The method of claim 2, wherein, The method further comprises: if the target service is not included in the resource list, a refusal access message is sent to the client.

5. The method of claim 1, wherein, The first information comprises at least one of the following: an address of the proxy server; a session identifier; a session credential.

6. The method of claim 5, wherein, Based on the acquisition request, the second information is sent to the proxy server, comprising: based on a session identifier included in the acquisition request, corresponding second information is sent to the proxy server.

7. The method according to any one of claims 1 to 6, characterized in that, The second information further comprises an address of the target server and / or a port of the target server.

8. A method of accessing a service, characterized by, The method is executed by a proxy server, and the method comprises: receiving a connection establishment request sent by a client based on first information; wherein the first information is used for the client to establish a secure connection with a proxy server; wherein the first information is information sent by a control management server to the client after a session is established between the access request and the client; wherein the access request comprises a target service expected to be accessed by a user; establish a connection with the target server based on second information obtained from the control management server after establishing the secure connection with the client based on the first information; wherein the second information at least includes target authentication data, and the target authentication data is data required for authentication when the target server provides the target service; add the target authentication data in the data packet sent by the client for accessing the target service; send the data packet with the target authentication data to the target server, so that the target server provides the target service for the client after passing the authentication of the target authentication data.

9. The method of claim 8, wherein, The first information includes at least one of the following: An address of the proxy server; A session identifier; A session credential.

10. The method of claim 9, wherein, The method further includes: sending an acquisition request to the control management server; wherein the acquisition request is used to request to acquire the second information, and the second information is information for establishing a connection with a target server; wherein the session identifier is included in the acquisition request; receiving the second information corresponding to the session identifier sent by the control management server.

11. The method according to any one of claims 8-10, characterized in that, The second information further includes an address of the target server and / or a port of the target server.

12. A method of accessing a service, characterized by, The method is performed by a client, and the method includes: sending an access request to a control management server; wherein the access request includes a target service expected to be accessed by a user; receiving first information sent by the control management server after establishing a session with the client; wherein the first information is used for the client to establish a secure connection with a proxy server; initiating a connection establishment request to the proxy server, and establishing a secure connection with the proxy server based on the first information; sending a data packet for accessing the target service to the proxy server through the secure connection, so that the proxy server adds target authentication data in the data packet, and sends the data packet with the target authentication data to a target server, so that the target server provides the target service for the client after passing the authentication of the target authentication data; wherein the proxy server establishes a connection with the target server based on second information obtained from the control management server after establishing the secure connection with the client based on the first information; wherein the second information at least includes the target authentication data, and the target authentication data is data required for authentication when the target server provides the target service.

13. The method of claim 12, wherein, Before sending an access request to the control management server, the method further includes: sending an authentication request to the control management server; wherein the authentication request is used to request to authenticate the rights of the user; receiving a resource list sent by the control management server; wherein the resource list includes at least one service with which the user has access rights.

14. The method of claim 13, wherein, The method further includes any one of the following: If the target service is included in the resource list, the step of receiving the first information sent by the control management server after establishing a session with the client is performed; If the target service is not included in the resource list, a denial of access message sent by the control management server is received.

15. The method according to any one of claims 12-14, characterized in that, The first information includes at least one of the following: An address of the proxy server; A session identifier; A session credential.

16. An apparatus for accessing a service, the apparatus comprising: The apparatus includes: A first receiving module configured to receive an access request sent by a client; wherein the access request includes a target service expected to be accessed by a user; A first sending module configured to send first information to the client after a session is established between the client and the client based on the access request; wherein the first information is used to establish a secure connection between the client and a proxy server; A second receiving module configured to receive an acquisition request sent by the proxy server after a secure connection is established between the proxy server and the client; wherein the acquisition request is used to request acquisition of second information; wherein the second information includes at least target authentication data, and the target authentication data is data required to be authenticated when a target server provides a target service; A second sending module configured to send the second information to the proxy server based on the acquisition request, so that the proxy server adds the target authentication data in a data packet sent by the client to access the target service, and sends the data packet with the target authentication data to the target server, so that the target server provides the target service for the client after the target authentication data is authenticated.

17. An apparatus for accessing a service, the apparatus comprising: The apparatus includes: A third receiving module configured to receive a connection establishment request sent by a client based on first information; wherein the first information is used to establish a secure connection between the client and a proxy server; wherein the first information is sent to the client by a control management server after a session is established between the client and the client based on an access request sent by the client; wherein the access request includes a target service expected to be accessed by a user; A first connection establishment module configured to establish a connection with a target server based on second information acquired from a control management server after a secure connection is established with the client based on the first information; wherein the second information includes at least target authentication data, and the target authentication data is data required to be authenticated when the target server provides a target service; A fourth receiving module configured to add the target authentication data in a data packet sent by the client to access the target service after the data packet is received; A third sending module configured to send the data packet with the target authentication data to the target server, so that the target server provides the target service for the client after the target authentication data is authenticated.

18. An apparatus for accessing a service, the apparatus comprising: The apparatus includes: A fourth sending module configured to send an access request to a control management server; wherein the access request includes a target service expected to be accessed by a user; A fifth receiving module configured to receive first information sent by the control management server after a session is established between the control management server and a client; wherein the first information is used to establish a secure connection between the client and a proxy server; The second connection establishment module is configured to initiate a connection establishment request to the proxy server and establish a secure connection with the proxy server based on the first information. The fifth sending module is configured to send a data packet for accessing the target service to the proxy server through the secure connection, so that the proxy server adds target authentication data in the data packet and sends the data packet with the target authentication data to the target server, so that the target server provides the target service for the client after authenticating the target authentication data successfully. The proxy server establishes a connection with the target server based on second information obtained from the control management server after establishing a secure connection with the client based on the first information. The second information includes at least the target authentication data, and the target authentication data is data required to be authenticated when the target server provides the target service.

19. A server, comprising: The system comprises: A processor; A memory for storing processor-executable instructions; wherein the processor implements the steps of the method of any one of claims 1-7, 8-11 or 12-15 by running the executable instructions.

20. A system for accessing a service, characterized by The system comprises: A control management server configured to implement the steps of the method of any one of claims 1-7; A proxy server configured to implement the steps of the method of any one of claims 8-11; A client configured to implement the steps of the method of any one of claims 12-15; A target server configured to provide a target service.

21. The system of claim 20, wherein, The system further comprises at least one of: An authority management module connected to the control management server and configured to manage the authority of a user; A storage module connected to the control management server and configured to store target authentication data; wherein the target authentication data is data required to be authenticated when the target server provides a target service.

22. A computer-readable storage medium, characterized in that, A computer program / instruction is stored thereon, and the program / instruction is executed by a processor to implement the steps of the method of any one of claims 1-7, 8-11 or 12-15.

23. A computer program product, characterised in that, A computer program / instruction is stored thereon, and the program / instruction is executed by a processor to implement the steps of the method of any one of claims 1-7, 8-11 or 12-15.

Images