Remote host management method, management device and remote host system

Abstract

The embodiment of the invention provides a remote host management method and device and a remote host system, and relates to the field of safety communication of remote hosts, and the remote host comprises a client side and a server side. The host management method comprises the following steps: embedding a communication instruction of a server into a first webpage element, hiding the communication instruction, generating a first instruction, and sending the first instruction to a client based on a WebSocket communication protocol; the first webpage element is any one randomly selected webpage element in a local storage of the server; and sending an execution result of the client to a server in a manner of forming a query character by a character string, wherein the execution result is generated by extracting the communication instruction from the first instruction by the client and executing the communication instruction. The communication instruction of the server is embedded into the webpage element, so that the communication instruction is not easy to identify, and the security of remote host management is improved.

Description

Technical Field

[0001] The present invention relates to the field of remote host security communication, and in particular to a remote host management method, a management device and a remote host system. Background Art

[0002] With the advent of the digital age, remote host management has become one of the ways for enterprises to work remotely and transmit data. In the process of realizing the present invention, the applicant found that there are at least the following problems in the prior art: remote host management realizes data transmission through the Internet network, but the current management method of the remote host is prone to expose services, which brings about data transmission security problems and user privacy leakage problems. Therefore, the management of remote hosts needs to strengthen security management to improve the security of remote host systems, so as to protect the security of transmitted data and user privacy, and maintain the competitive advantage and commercial interests of enterprises. Summary of the invention

[0003] The embodiments of the present invention provide a remote host management method, a management device and a remote host system, which can solve the technical problems in the prior art: remote host management realizes data transmission through the Internet network, but the current remote host management method is prone to expose services, resulting in data transmission security and user privacy exposure problems.

[0004] To achieve the above-mentioned object, in a first aspect, an embodiment of the present invention provides a remote host management method, wherein the remote host includes a client and a server, and the method includes:

[0005] Embed the communication instruction of the server into a first webpage element to hide the communication instruction, generate a first instruction, and send the first instruction to the client based on the WebSocket communication protocol; the first webpage element is any webpage element randomly selected from the local storage of the server;

[0006] The execution result of the client is sent to the server in the form of a character string forming a query character, and the execution result is generated by the client extracting the communication instruction from the first instruction and executing the communication instruction.

[0007] In a second aspect, an embodiment of the present invention provides a management device for a remote host, wherein the remote host includes a client and a server, and the management device for the remote host includes:

[0008] The server management unit is used to embed the communication instruction of the server into a first webpage element to hide the communication instruction, generate a first instruction, and send the first instruction to the client based on the WebSocket communication protocol; the first webpage element is any webpage element randomly selected from the local storage of the server;

[0009] The client service unit is used to send the execution result of the client to the server in the form of a character string forming a query character, and the execution result is generated by the client extracting the communication instruction from the first instruction and executing the communication instruction.

[0010] In a third aspect, an embodiment of the present invention provides a remote host system, including:

[0011] The server is used to generate communication instructions;

[0012] The server management unit is used to embed the communication instruction of the server into a first webpage element to hide the communication instruction, generate a first instruction, and send the first instruction to the client based on the WebSocket communication protocol; the first webpage element is any webpage element randomly selected from the local storage of the server;

[0013] The client extracts the communication instruction from the first instruction, and executes the communication instruction to obtain an execution result;

[0014] The client service unit is used to send the execution result to the server in the form of a character string forming a query character.

[0015] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and when the one or more programs are executed by a computer device, the computer device executes the aforementioned remote host management method.

[0016] In a fifth aspect, an embodiment of the present invention provides a computer device, including:

[0017] A processor; and a memory arranged to store computer executable instructions, which, when executed, cause the processor to perform the aforementioned remote host management method.

[0018] The above technical solution has the following beneficial effects: before the server sends the communication instruction to the client, the communication instruction is embedded in the first webpage element to hide the communication instruction, a first instruction is generated, and the first instruction is sent to the client based on the WebSocket communication protocol; the communication instruction is hidden so that the communication instruction is not easy to be identified, thereby improving the security of remote host management. After the client extracts the communication instruction from the first instruction and executes the communication instruction to obtain the execution result, the execution result is sent to the server in the form of a string forming a query character, and the execution result is formed in the form of a string forming a query character so that the execution result is not easy to be identified, thereby improving the security of remote host management. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 is a flow chart of a remote host management method according to an embodiment of the present invention;

[0021] Figure 2 is a structural diagram of an operation device of a remote host according to an embodiment of the present invention;

[0022] Figure 3 is a logical structure diagram of a remote host system according to an embodiment of the present invention;

[0024] Figure 4 is a logical structure diagram of a computer device according to an embodiment of the present invention;

[0025] Figure 5 is a flow chart of another remote host management method according to an embodiment of the present invention;

[0026] Figure 6 is a flow chart of a third remote host management method according to an embodiment of the present invention;

[0027] Figure 7 It is a structural diagram of another remote host operation device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] The technical terms and abbreviations involved in the embodiments of the present invention are defined as follows:

[0030] WebSocket: WebSocket is a communication protocol for full-duplex communication between client and server. Unlike the traditional HTTP request-response mode, WebSocket allows the server to actively push data to the client, achieving better real-time two-way communication.

[0031] HTML (HyperText Markup Language) is a markup language used to create the structure and content of web pages. It consists of a series of tags and elements, which are used to describe various elements on a web page, such as titles, paragraphs, images, links, etc.

[0032] AES (Advanced Encryption Standard) is a symmetric block encryption algorithm that is widely used in the fields of data confidentiality and encrypted communication. It is one of the most commonly used encryption algorithms.

[0033] Base64 is an encoding method that uses 64 characters (AZ, az, 0-9 and + / ) to represent binary data. Its main purpose is to convert binary data into printable characters, which is convenient for transmission in text protocols or display in text environments. It can also be used for simple data encryption.

[0034] Cookie is a commonly used network technology used to transfer data between a client (usually a web browser) and a server. It is implemented by storing small text files in the browser.

[0035] X-Forwarded-For (XFF) is an HTTP request header field that is often used by proxy servers or load balancers to pass the original client's IP address to the backend server.

[0036] like Figure 1 As shown, in combination with an embodiment of the present invention, a remote host management method is provided, wherein the remote host includes a client and a server, and the remote host management method includes:

[0037] S101: embedding the communication instruction of the server into a first webpage element to hide the communication instruction, generating a first instruction, and sending the first instruction to the client based on the WebSocket communication protocol; the first webpage element is any webpage element randomly selected from the local storage of the server;

[0038] S102: Sending the execution result of the client to the server in the form of a character string forming a query character, wherein the execution result is generated by the client extracting the communication instruction from the first instruction and executing the communication instruction.

[0039] The communication instructions of the server are embedded into the first web page element that looks normal to hide the communication instructions, so that when the WebSocket connection is used for transmission, it looks like a normal web page is transmitted, so that the communication between the server and the client can be disguised as ordinary Web traffic, which may make WebSocket communication more difficult to detect in network monitoring because they look like ordinary browser behavior. It can confuse and make it difficult to be detected, thereby realizing hidden communication services. It avoids data transmission and user privacy leakage, improves the security of the remote host, and thus protects the security of the transmitted data and user privacy, and maintains the competitive advantage and commercial interests of the enterprise.

[0040] Preferably, it also includes:

[0041] S103: embedding initialization code for communicating using the WebSocket communication protocol in the first instruction;

[0042] The first instruction contains JavaScript code that can initialize the WebSocket connection and perform communication with the server and communication with the client.

[0043] S104: Writing the generated first instruction into the third webpage element to store the first instruction, thereby preventing leakage of data transmission and user privacy caused by leakage of communication instructions.

[0044] In S101, sending the first instruction to the client based on the WebSocket communication protocol includes:

[0045] The generated first instruction is written into the second web page element to generate a first message; the first instruction is sent to the client in the form of a first message based on the WebSocket communication protocol; the communication instructions are protected by multiple layers to further avoid data transmission and user privacy leakage, thereby improving the security of the remote host.

[0046] Preferably, S105: the method for obtaining the web page element is as follows:

[0047] Periodically clear all web page elements in the local storage of the server;

[0048] After clearing all the web page elements, sending HTTP requests to different designated websites respectively, and judging whether the request to the corresponding designated website is successful according to the response status code of the HTTP request;

[0049] When it is determined that the request to the corresponding designated website is successful, check whether the webpage content responded by the corresponding designated website is valid. If the webpage content is valid, obtain the hypertext markup language HTML corresponding to the webpage content, save the HTML corresponding to the webpage content as a webpage element, and update the webpage elements in the local storage of the server. By periodically clearing all the webpage elements in the local storage of the server to update the webpage elements in the local storage of the server, the security of data transmission is further improved, the leakage of data and user privacy is avoided, and the security of the remote host is improved.

[0050] Preferably, the remote host management method further includes:

[0051] S106: Generate a random time interval using a random number generation method, wherein the random time interval is used to control the transmission frequency of communication data between the client and the server, wherein the communication data between the client and the server includes: the first instruction, the execution result, and a heartbeat packet sent by the client to the server. The transmission frequency of communication data between the client and the server is controlled by a random time interval, so that the data transmission between the client and the server is in a stable state, thereby avoiding system and network crashes.

[0052] Preferably, the remote host management method further includes:

[0053] S107: When establishing a communication connection between the client and the server, the host name of the client and the host name of the server are encrypted using a symmetric encryption algorithm respectively;

[0054] In S101, sending the first instruction to the client based on the WebSocket communication protocol includes:

[0055] Encrypt the first instruction using a symmetric encryption algorithm to obtain an encrypted first instruction, and send the encrypted first instruction to the client based on the WebSocket communication protocol;

[0056] Encryption is still to further improve the security of data transmission, avoid data and user privacy leakage, and enhance the security of remote hosts.

[0057] In S102, the execution result of the client is sent to the server in the form of a character string forming a query character, including:

[0058] The execution result in the form of a string returned by the client based on the first instruction is obtained, the execution result is encrypted by a symmetric encryption algorithm to obtain an encrypted execution result, and the encrypted execution result is sent to the server in the form of a query string as the value of the query parameter. At this time, the query parameter looks like a normal web page, and the execution result is hidden, thereby avoiding the exposure of the execution result, avoiding the leakage of data and user privacy, and improving the security of the remote host.

[0059] like Figure 2 As shown, in combination with an embodiment of the present invention, a management device for a remote host is provided, wherein the remote host includes a client and a server, and the management device for the remote host includes:

[0060] The server management unit 31 is used to embed the communication instruction of the server into a first webpage element to hide the communication instruction, generate a first instruction, and send the first instruction to the client based on the WebSocket communication protocol; the first webpage element is any webpage element randomly selected from the local storage of the server;

[0061] The client service unit 32 is used to send the execution result of the client to the server in the form of a character string forming a query character, and the execution result is generated by the client extracting the communication instruction from the first instruction and executing the communication instruction.

[0062] The communication instructions of the server are embedded into the first web page element that looks normal to hide the communication instructions, so that when the WebSocket connection is used for transmission, it looks like a normal web page is transmitted, so that the communication between the server and the client can be disguised as ordinary Web traffic, which may make WebSocket communication more difficult to detect in network monitoring because they look like ordinary browser behavior. It can confuse and make it difficult to be detected, thereby realizing hidden communication services. It avoids data transmission and user privacy leakage, improves the security of the remote host, and thus protects the security of the transmitted data and user privacy, and maintains the competitive advantage and commercial interests of the enterprise.

[0063] Preferably, the server management unit 31 includes a request processing module, wherein:

[0064] The request processing module is used to embed initialization code for communicating using the WebSocket communication protocol in the first instruction; the first instruction contains JavaScript code, which can initialize the WebSocket connection and execute communication with the server and the client.

[0065] And / or, the generated first instruction is written into a third web page element to store the first instruction, thereby avoiding leakage of data transmission and user privacy caused by leakage of communication instructions.

[0066] The request processing module is further used to write the generated first instruction into the second webpage element to generate a first message; and send the first instruction to the client in the form of a first message based on the WebSocket communication protocol. The communication instructions are protected at multiple levels to further avoid data transmission and user privacy leakage, thereby improving the security of the remote host.

[0067] Preferably, the server management unit 31 further includes a service creation module, and the service creation module is used to:

[0068] Periodically clear all web page elements in the local storage of the server;

[0069] After clearing all the web page elements, sending HTTP requests to different designated websites respectively, and judging whether the request to the corresponding designated website is successful according to the response status code of the HTTP request;

[0070] When it is determined that the request to the corresponding designated website is successful, check whether the web page content responded by the corresponding designated website is valid. If the web page content is valid, obtain the hypertext markup language HTML corresponding to the web page content, save the HTML corresponding to the web page content as a web page element, so as to update the web page element in the local storage of the server.

[0071] By periodically clearing all web page elements in the local storage of the server, the web page elements in the local storage of the server are updated, thereby further improving data transmission security, avoiding data and user privacy leakage, and improving the security of the remote host.

[0072] Preferably, the client service unit 32 includes a communication module, and the communication module is used to:

[0073] A random time interval is generated by a random number generation method, and the random time interval is used to control the transmission frequency of communication data between the client and the server, and the communication data between the client and the server includes: the first instruction, the execution result, and a heartbeat packet sent by the client to the server. The transmission frequency of communication data between the client and the server is controlled by a random time interval, so that the data transmission between the client and the server is in a stable state, avoiding system and network crashes.

[0074] Preferably, the device further comprises an encryption and decryption service unit provided in the server management unit 31 and the client service unit 32, wherein the encryption and decryption service unit is used to:

[0075] When establishing a communication connection between the client and the server, the client's host name and the server's host name are encrypted using a symmetric encryption algorithm;

[0076] Encrypt the first instruction using a symmetric encryption algorithm to obtain an encrypted first instruction, and send the encrypted first instruction to the client based on the WebSocket communication protocol;

[0077] Encryption is still to further improve the security of data transmission, avoid data and user privacy leakage, and enhance the security of remote hosts.

[0078] The execution result in the form of a string returned by the client based on the first instruction is obtained, the execution result is encrypted by a symmetric encryption algorithm to obtain an encrypted execution result, and the encrypted execution result is sent to the server in the form of a query string as the value of the query parameter. At this time, the query parameter looks like a normal web page, and the execution result is hidden, thereby avoiding the exposure of the execution result, avoiding the leakage of data and user privacy, and improving the security of the remote host.

[0079] like Figure 3 As shown, in combination with an embodiment of the present invention, a remote host system is provided, including:

[0080] The server 41 is used to generate communication instructions;

[0081] The server management unit 31 is used to embed the communication instruction of the server into a first webpage element to hide the communication instruction, generate a first instruction, and send the first instruction to the client based on the WebSocket communication protocol; the first webpage element is any webpage element randomly selected from the local storage of the server;

[0082] The client 42 is used to extract the communication instruction from the first instruction and execute the execution instruction to obtain an execution result;

[0083] The client service unit 32 is used to send the execution result to the server in the form of a character string forming a query character.

[0084] In conjunction with an embodiment of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores one or more programs, and when the one or more programs are executed by a computer device, the computer device executes any of the aforementioned remote host management methods.

[0085] like Figure 4 As shown, in combination with an embodiment of the present invention, a computer device is provided, including:

[0086] A processor; and a memory arranged to store computer executable instructions, wherein when the executable instructions are executed, the processor executes any of the aforementioned remote host management methods.

[0087] The beneficial technical effects achieved by the embodiments of the present invention are as follows:

[0088] Before the server sends the communication instruction to the client, the communication instruction is embedded in the first web page element to hide the communication instruction, a first instruction is generated, and the first instruction is sent to the client based on the WebSocket communication protocol; the communication instruction is hidden and is not easily identified, thereby improving the security of remote host management.

[0089] After the client extracts the communication instruction from the first instruction and executes the communication instruction to obtain the execution result, the execution result is sent to the server as a query character with the query parameter embedded in the character string, so that the execution result is a normal web page, which is not easy to be identified, thereby improving the security of remote host management.

[0090] In addition, the first instruction and the execution result are encrypted using an encryption algorithm, which further improves the security of remote host management, reduces security risks, and prevents data from being accessed and stolen.

[0091] The above technical solution of the embodiment of the present invention is described in detail below in conjunction with specific application examples. For technical details not introduced during the implementation process, please refer to the relevant description in the previous text.

[0092] A remote host management method of an example of the present invention, the remote host includes a client and a server that controls the client; the server is the control end, the client is the controlled machine, and the architecture of the application scenario is a C / S architecture, similar to an ordinary user opening a website, and controlling the user end through the website server. The remote host management method of the present invention is an embodiment that can manage the remote host, embed the communication instructions of the server into the web page elements, and can also perform encrypted communication, realize hidden communication services, and improve the security of remote host management. Figure 5 and Figure 6 is a flowchart of two other remote host management methods; the device structure corresponding to the remote host management method is as follows Figure 7 shown.

[0093] 1. Server management unit, used to manage the server

[0094] A request processing module is used to embed the communication instruction of the server into the first web page element to hide the communication instruction, generate a first instruction, embed the initialization code for communicating with the WebSocket communication protocol in the first instruction, and send the first instruction to the client based on the WebSocket communication protocol; the first web page element is any web page element randomly selected from the local storage of the server. The generated first instruction is written into the second web page element to generate a first message; the first instruction is sent to the client in the form of a first message based on the WebSocket communication protocol. Bidirectional communication is achieved using WebSocket. Specifically, a message such as a communication instruction is received from the server, and the message is written into the first web page element such as element, <script>标签中，生成第一指令，第一指令包含JavaScript代码，这些代码可以初始化WebSocket连接，处理消息事件，以及执行与服务器的通信、以及与客户端的通信。将WebSocket连接嵌入到看似正常的网页中，服务端与客户端的通信可以伪装成普通的Web流量。这可能使得WebSocket通信在网络监控中更难被发现，因为它们看起来像是普通的浏览器行为。可以起到混淆不易被发现，从而实现隐藏的通信服务。通信基于WebSocket协议，是一种基于TCP的全双工通信协议，允许客户端和服务端之间进行持久的连接，双方都可以主动发送消息。消息包括通信指令、心跳和主动发送的数据。

[0095] 将生成的第一指令写入第三网页元素中，以对所述第一指令进行存储，避免通信指令泄露造成数据传输和用户隐私的泄露。

[0096] 服务端管理单元还包括服务创建模块，不定期的将所述服务端本地存储中的全部网页元素进行清空；在将所述全部网页元素清空之后，向不同的指定网站分别发送HTTP请求，根据HTTP请求的响应状态码判断向对应的指定网站的请求是否成功；在判定向对应的指定网站的请求成功的情况下，检查对应的指定网站所响应的网页内容是否有效，在所述网页内容有效的情况下，获取所述网页内容对应的超文本标记语言HTML，将所述网页内容对应的HTML作为网页元素进行保存，以对所述服务端本地存储中的网页元素进行更新。

[0097] 具体地，提前复制指定的网站资源，比如复制百度首页等知名网站，伪装知名网站服务，复制的内容就是通过网站爬取获取知名网站页面元素，通过下载指定URL的网站并保存在本地。具体实现步骤总结如下，首先检查并清除旧的克隆网站文件。创建存放克隆网站的目录。发送HTTP请求，获取指定URL的网页内容。分别检查HTTP请求的响应状态码、HTTP请求获取知名网站响应的网页内容是否有效。将网页内容写入指定文件中。如果发生连接错误，创建一个默认的克隆网站文件，网站文件来自爬取复制的知名网站的内容，到底是哪个知名网站可以根据实际需求确定，可以任意指定。检查克隆网站文件是否成功创建。打印克隆网站的成功信息，将网页内容对应的HTML作为网页元素进行保存。并且不定期的将所述服务端本地存储中的全部网页元素进行清空，以对所述服务端本地存储中的网页元素进行更新，进一步提高数据传输和用户隐私泄露，提升远程主机的安全性。

[0098] 示例如下：

[0099] 首先，判断是否存在名为"clone_site / "的目录。

[0100] 如果存在，则遍历该目录下的所有文件和文件夹，并进行删除操作，以清空旧的克隆网站。

[0101] 如果"clone_site / "目录不存在，则创建该目录。并发送HTTP请求，获取指定URL的网页内容。

[0102] 请求中的http请求代理User-Agent使用传入(代码实现传入，简单的函数传参数)的指定设置的域名。判断网页请求的响应状态码是否为200，并检查返回的网页内容是否为空。如果响应状态码是200则请求成功，否则没有成功则不用检查内容是否有效。如果响应状态码不为200或请求知名网站的网页内容为空，则打印错误信息，并终止程序执行。如果请求成功，将网页内容存储在名为"index.html"的文件中。如果网络连接发生错误(如无网络连接)，则打印相应错误信息，并创建一个默认的"index.html"文件。最后，查是否成功生成名为"index.html"的文件，并日志打印成功克隆网站的信息。

[0103] 请求处理模块，还用于对客户端的请求进行响应，作为第一信息。客户端的请求包括：定时发送心跳包、定期报告状态或者在特定条件下主动发送数据。

[0104] 具体地，对客户端的请求例如http请求进行响应，由于客户端的请求涉及多种方式，所以需要对不同场景进行处理，并对客户端的请求进行响应。请求包括未知页面请求、第一种特定的请求类型以及第二种特定的请求类型。所述的第一种特定请求是指远程请求处理(客户端发起请求，客户端将数据回传给服务端)的GET请求，用于提供客户端IP地址并关闭连接。请求数据中包含一些参数或特定的URL路径，用于标识客户端的IP地址。关闭客户端与服务端的连接，这通常是通过发送一个特定的HTTP头部字段(如Connection:close)来指示的，或者简单地关闭底层的TCP连接；GET请求是http方法的一种。

[0105] 所述的第二种特定的请求类型是指远程响应处理器的GET请求，用于处理了特定的查询字符串，并对其进行解析和处理。具体地，用于客户端传递特定的信息或指令给服务端，以便服务端能够根据这些信息执行相应的操作。处理完成后，会将结果(如查询到的数据、操作结果等)封装在HTTP响应中返回给客户端。

[0106] (一)三种具体处理方法的作用如下：

[0107] 1、用于处理未知页面的请求。在http的请求中，针对GET方法，首先获取请求头中的"X-Forwarded-For"字段作为客户端IP地址，并对其进行清洗处理。然后记录日志，表示收到了来自该客户端IP地址的无效页面请求。设置响应头的"Server"字段为"IIS"。根据配置文件中的网站重定向参数判断是否需要重定向至指定URL，若需要则返回一个包含重定向信息的HTML页面，否则返回本地文件"index.html"的内容。PUT和POST方法与GET方法类似，分别处理无效的PUT请求和POST请求，记录日志，并设置响应头的"Server"字段为"IIS"。

[0108] 2、用于处理指定请求类型的请求。在GET方法中，同样获取请求头中的"X-Forwarded-For"字段作为客户端IP地址，并对其进行清洗处理。记录日志，表示收到了来自该IP地址的C2请求处理器的请求。设置响应头的"Server"字段为"IIS"。根据配置文件中的重定向参数和COOKIE的值来判断是否需要重定向至指定URL。若需要重定向且COOKIE的值为0，即没有COOKIE，则返回一个包含重定向信息的HTML页面；否则，读取文件"index.html"的内容，并根据配置文件中的COOKIE的值来在<body>标签前添加一段注释和指令。PUT和POST方法与GET方法类似。

[0109] 3、用于处理另一种指定请求类型的请求。在GET方法中，同样获取请求头中的"X-Forwarded-For"字段作为客户端IP地址，并对其进行清洗处理。记录日志，表示收到了来自该IP地址的C2响应处理器的请求。设置响应头的"Server"字段为"IIS"。

[0110] (二)并启动一个监听服务端的监听服务(可以是一个服务器)，创建了相应的请求处理类，绑定了不同的URL模式和请求处理类，根据配置的SSL选项启动相应的监听端口，并通过I / O循环来处理请求。

[0111] 服务端的多线程通信管理，通过创建不同线程之间通信的队列对象，用于满足多个客户端同时连接的需求，具体地，第一队列对象用于从WebServerSocket线程到主线程的通信，第二队列对象用于从主线程到命令会话线程的通信，第三队列对象用于从命令会话线程到主线程的通信。

[0112] 创建一个空字典变量客户端列表，用于存储连接的客户端信息。

[0113] 通过主线程从第一队列对象中获取消息，如果消息类型是打开类型，表示发送消息的客户端请求连接到服务端，将新的客户端的信息加入客户端列表，如果消息类型是关闭类型，表示发送消息的客户端请求与服务端断开连接，则从客户端列表中移除该客户端的信息，如果消息类型是响应类型，表示发送消息的客户端响应了之前的服务端发送的通信指令，将消息转发至命令会话线程；其中，客户端列表是空字典变量，用于存储与服务端连接的客户端的信息；

[0114] 通过主线程从第三队列对象中获取消息，如果消息类型是退出，表示发送消息的客户端请求退出于服务端对客户端管理操作的界面或命令行程序，服务端则执行退出操作；

[0115] 如果消息类型是代理切换，表示服务端请求切换客户端，在客户端列表将所请求的更换的客户端的信息为新的客户端的信息进行。

[0116] 如果消息类型是请求类型，表示服务端请求向服务端发送通信指令，则将通信指令发送给客户端。

[0117] 一、客户端服务单元，用于对客户端的管理

[0118] 客户端服务单元是客户端程序，将所述客户端的执行结果以字符串形成查询字符的方式发送给服务端，所述执行结果由所述客户端自所述第一指令中提取出所述通信指令并执行所述通信指令所生成。

[0119] 具体地，通信模块，用于与服务端数据通信。客户端与服务端通信，能够执行来自服务端的通信指令，并将指令执行的执行结果作为第二信息。客户端服务单元将执行结果以字符串形成查询字符的方式发送给服务端，所述执行结果由所述客户端自所述第一指令中提取出所述通信指令并执行所述通信指令所生成。

[0120] 通信模块，通过使用AES加密算法来保护通信的安全性，采用随机数生成方式生成随机时间间隔，所述随机时间间隔用于控制客户端与服务端之间通信数据的传输频率，所述客户端与服务端之间的通信数据包括：所述第一指令、所述执行结果、客户端向服务端发送的心跳包。

[0121] 客户端执行来自服务端指令，客户端指令执行的模式包括：命令执行、从客户端到服务端传输文件和从服务端到客户端传输文件，如ipconfig查看IP信息。

[0122] 三、客户端的主要执行流程如下：

[0123] 使用AES加密算法用于加密和解密操作。

[0124] 随机数生成用于生成随机时间间隔，控制客户端与服务器之间的通信频率。

[0125] 与服务器建立连接。包括将主机名加密，并通过HTTP请求发送给服务端。如果无法连接，则尝试重新连接，并输出异常信息。

[0126] 进入主循环，不断与服务端进行通信。其中，包括向服务端发送http请求后，获取服务器返回的HTML响应。在HTML响应中提取特定的命令，并使用用户名、解密后的命令作为参数执行子进程。获取子进程的标准输出结果，并将其加密后发送给服务器。在指定的随机时间间隔后，再次执行通信操作。

[0127] 指令执行模块，具体是指客户端的指令执行模式，包括命令执行、从客户端到服务器传输文件和从服务器到客户端传输文件模式。具体地：

[0128] 命令执行模式，包括解码输入数据中的命令内容，并使用命令执行方法执行命令。休眠500毫秒以确保子进程执行完毕，并将输出结果转换为Base64字符串。具体地，所述的命令执行方法通过在生成的子进程中运行命令。子进程为在显式退出之前保持活动状态。允许上下文命令和持久性命令之间的环境。通过创建一个子进程来执行命令。并将待执行命令写入子进程的标准输入流。

[0129] 从客户端到服务端传输文件的具体步骤，包括解析输入数据中的文件名，并将文件内容转换为Base64字符串。

[0130] 从服务端到客户端传输文件的具体步骤，包括解析输入数据中的文件内容、目标路径和文件名，并将文件内容写入目标路径下的文件，并将结果转换为Base64字符串。

[0131] 通过客户端把嵌入在第一网页元素例如HTML的源代码中的通信指令端解码并执行，执行完通信指令后，使用查询字符串形成，即将执行结果转化成字符串作为查询参数的值，此时的字符串称为查询字符串，将查询参数回传客户端，例如通常会被编码成字符串附加在URL的末尾，回传给服务端。例如，http: / / example.com / results？data＝encoded_data。其中，encoded_data是客户端解码并执行操作后的执行结果，也可通过Base64编码或使用其他编码方案来实现编码混淆。

[0132] 四、通信加密解密服务单元，在客户端与服务端之间建立通信连接时，将客户端的主机名和服务端的主机名分别采用对称加密算法进行加密；使用对称加密算法将第一指令进行加密，得到加密的第一指令，基于WebSocket通信协议将加密的第一指令发送给客户端；取客户端基于所述第一指令返回的字符串形式的执行结果，通过对称加密算法将所述执行结果进行加密，得到加密的执行结果，将加密的执行结果以字符串作为查询参数的值形成查询字符发送给服务端。

[0133] 具体地，采用通信加密解密服务，对第一信息和第二信息进行加密，即对传输的数据的加密，通过加密算法对数据进行加密。传输数据包括服务端的通信指令和客户端的请求。具体地，通过使用AES加密算法来保护通信的安全性，传输数据是服务端的通信指令和指令执行的结果，传输的数据包括通信指令、定时发送心跳包、定期报告状态或者在特定条件下主动发送数据；指令执行的结果就是客户端按照服务端的需求进行命令执行，如查看网络信息、传输文件、关机等。

[0134] AES加密算法包括了填充和解除填充的处理逻辑。通过调用AES加密方法可以对原始数据进行加密，调用解密方法可以对密文进行解密。

[0135] 首先，在初始化时，通过使用SHA-256算法对传入的秘钥进行处理，得到一个固定长度的秘钥。接下来，将传入的数据转换为字节流的形式。如果数据已经是字节流，直接返回；否则，将其转换成UTF-8编码的字节流。

[0136] 然后，对输入数据进行填充以适配AES加密算法的块大小。通过计算需要填充的字节数，使用字符方法生成填充字符，然后将填充字符复制到数据末尾以实现填充。

[0137] 示例性地，对传入的原始数据进行加密。首先，对原始数据进行填充，并生成一个随机的初始向。然后，使用AES算法以CBC模式进行加密，并将加密结果与初始向量拼接在一起。最后，对结果进行Base64编码，并以UTF-8形式返回加密后的数据。

[0138] 解密方法实现了对传入的密文进行解密。首先，对密文进行Base64解码，并提取初始向量。然后，使用AES算法以CBC模式进行解密，并移除填充。最后，将解密后的数据以UTF-8形式返回。

[0139] 示例性地，假设传入的明文为明文数据。

[0140] 首先，对明文数据进行填充，以适应AES加密算法的块大小。填充后的数据记为填充数据。

[0141] 接下来，生成一个随机的初始向量，使用AES算法以CBC模式和生成的初始向量进行加密。将加密结果与初始向量拼接在一起，记为加密数据。对拼接后的加密数据进行Base64编码，得到加密后的密文。

[0142] 示例性地，假设传入的密文为密文数据。首先，对密文数据进行Base64解码，得到经过Base64编码的数据。提取密文中的初始向量，其长度与AES块大小相同，作为初始向量。然后使用AES算法以CBC模式和提取的初始向量进行解密，解密得到的数据记为解密数据。然后，将解密后的解密数据中的填充字符移除，得到最终的明文数据。将解密后的明文数据以UTF-8编码的形式返回。通过这个流程，可以将传入的密文解密回原始的明文数据。

[0143] 针对本发明实施例的方法示例如下：

[0144] 首先，生成超文本标记语言html文件用于嵌入到服务端的程序中，服务端的程序开始执行时，具体地，生成html文件，包括如果通过克隆方式，则尝试复制下载指定URL的网站，并将获取的HTML内容。如果通过模板获取方式(前面"复制指定的网站资源，通过下载指定URL的网站并保存在本地。”就是详细的获取过程)，则会使用本地的index.html模板。所述的index.html模板是包括基本html页面属性参数的文件，示例性地，包括超文本语言标签例如<！DOCTYPE html><html><body>< / body>< / html>属性。

[0145] 然后，采用websockets协议进行的加密通信方式，生成WebSocket嵌入代码，实现通过WebSocket实现双向通信。在接收来自服务器的消息后，将消息写入元素中。针对消息存储，设置一个隐藏的元素，用于接收来自WebSocket的消息(消息传输数据用的，包括指令，心跳等)。通过设置网页元素的底层模版元素：innerText属性，将收到的消息内容存储在这个元素中，实现隐藏内容，不会直接显示在页面上。并设置另一个隐藏的元素，用于存储要发送给WebSocket的消息。

[0146] 消息发送实现部分，创建一个WebSocket对象，通过获取服务器的URL作为WebSocket服务器的URL来进行连接。当从WebSocket接收到消息时，将消息的内容存储在元素中。当需要使用WebSocket发送消息时从元素中获取文本内容，然后通过WebSocket发送该内容。

[0147] 本发明实施例所取得的有益技术效果如下：

[0148] 在服务端将通信指令发送给客户端之前，将通信指令嵌入到第一网页元素中对通信指令进行隐藏，生成第一指令，基于WebSocket通信协议将第一指令发送给客户端；对通信指令进行隐藏，通信指令不易被识别，因此提高了远程主机管理的安全性。

[0149] 在客户端自第一指令中提取出所述通信指令并执行所述通信指令得到执行结果后，将所述执行结果以字符串嵌入查询参数作为查询字符发送给服务端，使得执行结果就是个正常的网页，从而不易被识别，因此提高了远程主机管理的安全性。

[0150] 还有，对第一指令和执行结果均采用加密算法进行加密，进一步提升远程主机管理的安全性，降低安全风险，防止数据被访问和窃取。

[0151] 应该明白，公开的过程中的步骤的特定顺序或层次是示例性方法的实例。基于设计偏好，应该理解，过程中的步骤的特定顺序或层次可以在不脱离本公开的保护范围的情况下得到重新安排。所附的方法权利要求以示例性的顺序给出了各种步骤的要素，并且不是要限于所述的特定顺序或层次。

[0152] 在上述的详细描述中，各种特征一起组合在单个的实施方案中，以简化本公开。不应该将这种公开方法解释为反映了这样的意图，即，所要求保护的主题的实施方案需要比清楚地在每个权利要求中所陈述的特征更多的特征。相反，如所附的权利要求书所反映的那样，本发明处于比所公开的单个实施方案的全部特征少的状态。因此，所附的权利要求书特此清楚地被并入详细描述中，其中每项权利要求独自作为本发明单独的优选实施方案。

[0153] 为使本领域内的任何技术人员能够实现或者使用本发明，上面对所公开实施例进行了描述。对于本领域技术人员来说；这些实施例的各种修改方式都是显而易见的，并且本文定义的一般原理也可以在不脱离本公开的精神和保护范围的基础上适用于其它实施例。因此，本公开并不限于本文给出的实施例，而是与本申请公开的原理和新颖性特征的最广范围相一致。

[0154] 上文的描述包括一个或多个实施例的举例。当然，为了描述上述实施例而描述部件或方法的所有可能的结合是不可能的，但是本领域普通技术人员应该认识到，各个实施例可以做进一步的组合和排列。因此，本文中描述的实施例旨在涵盖落入所附权利要求书的保护范围内的所有这样的改变、修改和变型。此外，就说明书或权利要求书中使用的术语"包含”，该词的涵盖方式类似于术语"包括”，就如同"包括，”在权利要求中用作衔接词所解释的那样。此外，使用在权利要求书的说明书中的任何一个术语"或者”是要表示"非排它性的或者”。

[0155] 本领域技术人员还可以了解到本发明实施例列出的各种说明性逻辑块(illustrative logical block)，单元，和步骤可以通过电子硬件、电脑软件，或两者的结合进行实现。为清楚展示硬件和软件的可替换性(interchangeability)，上述的各种说明性部件(illustrative components)，单元和步骤已经通用地描述了它们的功能。这样的功能是通过硬件还是软件来实现取决于特定的应用和整个系统的设计要求。本领域技术人员可以对于每种特定的应用，可以使用各种方法实现所述的功能，但这种实现不应被理解为超出本发明实施例保护的范围。

[0156] 本发明实施例中所描述的各种说明性的逻辑块，或单元都可以通过通用处理器，数字信号处理器，专用集成电路(ASIC)，现场可编程门阵列或其它可编程逻辑装置，离散门或晶体管逻辑，离散硬件部件，或上述任何组合的设计来实现或操作所描述的功能。通用处理器可以为微处理器，可选地，该通用处理器也可以为任何传统的处理器、控制器、微控制器或状态机。处理器也可以通过计算装置的组合来实现，例如数字信号处理器和微处理器，多个微处理器，一个或多个微处理器联合一个数字信号处理器核，或任何其它类似的配置来实现。

[0157] 本发明实施例中所描述的方法或算法的步骤可以直接嵌入硬件、处理器执行的软件模块、或者这两者的结合。软件模块可以存储于RAM存储器、闪存、ROM存储器、EPROM存储器、EEPROM存储器、寄存器、硬盘、可移动磁盘、CD-ROM或本领域中其它任意形式的存储媒介中。示例性地，存储媒介可以与处理器连接，以使得处理器可以从存储媒介中读取信息，并可以向存储媒介存写信息。可选地，存储媒介还可以集成到处理器中。处理器和存储媒介可以设置于ASIC中，ASIC可以设置于用户终端中。可选地，处理器和存储媒介也可以设置于用户终端中的不同的部件中。

[0158] 在一个或多个示例性的设计中，本发明实施例所描述的上述功能可以在硬件、软件、固件或这三者的任意组合来实现。如果在软件中实现，这些功能可以存储与电脑可读的媒介上，或以一个或多个指令或代码形式传输于电脑可读的媒介上。电脑可读媒介包括电脑存储媒介和便于使得让电脑程序从一个地方转移到其它地方的通信媒介。存储媒介可以是任何通用或特殊电脑可以接入访问的可用媒体。例如，这样的电脑可读媒体可以包括但不限于RAM、ROM、EEPROM、CD-ROM或其它光盘存储、磁盘存储或其它磁性存储装置，或其它任何可以用于承载或存储以指令或数据结构和其它可被通用或特殊电脑、或通用或特殊处理器读取形式的程序代码的媒介。此外，任何连接都可以被适当地定义为电脑可读媒介，例如，如果软件是从一个网站站点、服务器或其它远程资源通过一个同轴电缆、光纤电缆、双绞线、数字用户线(DSL)或以例如红外、无线和微波等无线方式传输的也被包含在所定义的电脑可读媒介中。所述的碟片(disk)和磁盘(disc)包括压缩磁盘、镭射盘、光盘、DVD、软盘和蓝光光盘，磁盘通常以磁性复制数据，而碟片通常以激光进行光学复制数据。上述的组合也可以包含在电脑可读媒介中。

[0159] 以上所述的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施方式而已，并不用于限定本发明的保护范围，凡在本发明的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。< / script>

Claims

1. A remote host management method, characterized in that: The remote host includes a client and a server, and the method includes: Embed the communication instruction of the server into a first webpage element to hide the communication instruction, generate a first instruction, and send the first instruction to the client based on the WebSocket communication protocol; the first webpage element is any webpage element randomly selected from the local storage of the server; The execution result of the client is sent to the server in the form of a character string forming a query character, and the execution result is generated by the client extracting the communication instruction from the first instruction and executing the communication instruction.

2. The remote host management method according to claim 1, characterized in that: The method further comprises: embedding initialization code for communicating using the WebSocket communication protocol in the first instruction; and / or, Writing the generated first instruction into the third webpage element to store the first instruction; The sending the first instruction to the client based on the WebSocket communication protocol includes: Writing the generated first instruction into the second webpage element to generate a first message; The first instruction is sent to the client in the form of a first message based on the WebSocket communication protocol.

3. The remote host management method according to claim 1, characterized in that: The method further comprises: Periodically clear all web page elements in the local storage of the server; After clearing all the web page elements, sending HTTP requests to different designated websites respectively, and judging whether the request to the corresponding designated website is successful according to the response status code of the HTTP request; When it is determined that the request to the corresponding designated website is successful, check whether the web page content responded by the corresponding designated website is valid. If the web page content is valid, obtain the hypertext markup language HTML corresponding to the web page content, save the HTML corresponding to the web page content as a web page element, so as to update the web page element in the local storage of the server.

4. The remote host management method according to claim 1, characterized in that: The method further comprises: A random time interval is generated by a random number generation method, and the random time interval is used to control the transmission frequency of communication data between the client and the server. The communication data between the client and the server includes: the first instruction, the execution result, and the heartbeat packet sent by the client to the server.

5. The remote host management method according to claim 1, characterized in that: The method further comprises: When establishing a communication connection between the client and the server, the client's host name and the server's host name are encrypted using a symmetric encryption algorithm; The sending the first instruction to the client based on the WebSocket communication protocol includes: Encrypt the first instruction using a symmetric encryption algorithm to obtain an encrypted first instruction, and send the encrypted first instruction to the client based on the WebSocket communication protocol; The step of sending the execution result of the client to the server in the form of a character string forming a query character comprises: Obtain the execution result in string form returned by the client based on the first instruction, encrypt the execution result through a symmetric encryption algorithm to obtain an encrypted execution result, and send the encrypted execution result as a query parameter value to the server in the form of a query character.

6. A remote host management device, characterized in that: The remote host includes a client and a server, and the management device of the remote host includes: The server management unit is used to embed the communication instruction of the server into a first webpage element to hide the communication instruction, generate a first instruction, and send the first instruction to the client based on the WebSocket communication protocol; the first webpage element is any webpage element randomly selected from the local storage of the server; The client service unit is used to send the execution result of the client to the server in the form of a character string forming a query character, and the execution result is generated by the client extracting the communication instruction from the first instruction and executing the communication instruction.

7. The remote host management device according to claim 6, characterized in that: The server management unit includes a request processing module, wherein: The request processing module is used to embed the initialization code for communicating using the WebSocket communication protocol in the first instruction; and / or write the generated first instruction into the third web page element to store the first instruction; The request processing module is further used to write the generated first instruction into the second web page element to generate a first message; and send the first instruction to the client in the form of a first message based on the WebSocket communication protocol.

8. A remote host system, characterized in that: include: The server is used to generate communication instructions; The server management unit is used to embed the communication instruction of the server into a first webpage element to hide the communication instruction, generate a first instruction, and send the first instruction to the client based on the WebSocket communication protocol; the first webpage element is any webpage element randomly selected from the local storage of the server; The client is used to extract the communication instruction from the first instruction, and execute the communication instruction to obtain an execution result; The client service unit is used to send the execution result to the server in the form of a character string forming a query character.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and when the one or more programs are executed by a computer device, the computer device executes the remote host management method according to any one of claims 1 to 5.

10. A computer device, characterized in that: include: processor; And, a memory arranged to store computer executable instructions, which, when executed, cause the processor to execute the remote host management method as described in any one of claims 1-5.

Images