Method, system, equipment and medium for dynamically expanding encryption change performance of bastion host

Abstract

The invention relates to the technical field of cloud desktop management, in particular to a method, a system, equipment and a medium for dynamically expanding the password change performance of a bastion host. The invention relates to the technical field of account password management, in particular to a method, a system, equipment and a medium for dynamically expanding the password change performance of a bastion host. According to the method, the part of the original bastion host for password change calculation is configured to the outside, calculation of password generation, password modification and password verification corresponding to each account in batch password change operation is carried out by flexibly calling a calculation unit, and then the bastion host executes password change on the corresponding account according to a calculation result. Therefore, the encryption modification service and the encryption modification calculation function of the bastion host are separated, occupation of resources of the bastion host during encryption modification is reduced, and dynamic capacity expansion is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of account password management, and in particular to a method, system, device and medium for dynamically expanding the capacity of a bastion server and improving the encryption performance. Background Art

[0002] As the number of servers continues to increase, the number of accounts and passwords for operation and maintenance management also increases. For security reasons, the passwords of relevant accounts need to be updated regularly. The bastion host itself has the function of changing passwords, but changing the passwords of a large number of accounts often takes a long time. For example, changing the passwords of 20,000+ accounts may take more than a few hours, and changing the passwords of 100,000+ accounts may take more than a day. This process will cause the bastion host to have insufficient operating performance and cause security risks. Therefore, when the existing bastion host encounters the need to change the passwords of a large number of accounts, it usually adopts the method of stopping the server to expand capacity or adding a bastion host cluster to solve the problem.

[0003] On the one hand, for the operation and maintenance audit system, long-term downtime to replace high-performance machines or modify configurations for capacity expansion poses extremely high security risks. On the other hand, adding a bastion host cluster is costly and cannot be expanded dynamically, and is redundant except for dealing with peak encryption changes.

[0004] Therefore, the present invention seeks to find a solution for expanding the encryption computing performance of a bastion host, which separates the encryption business from the encryption computing function, does not require downtime, is low-cost, and can be dynamically expanded. Summary of the invention

[0005] The present invention aims at the insufficiency of the prior art in which the shutdown expansion or the addition of a bastion host cluster is adopted to meet the needs of a large number of account password changes, and provides a method, system, device and medium for dynamically expanding the password change performance of a bastion host. The method configures the part of the original bastion host that performs password change calculation to the outside, and flexibly calls the calculation unit to perform the calculation of the corresponding generated password, modified password and verified password of each account in the batch password change operation, and then the bastion host performs the password change on the corresponding account according to the calculation result, so that the password change business of the bastion host is separated from the password change calculation function, which not only reduces the occupation of the bastion host resources during the password change period, but also realizes dynamic expansion.

[0006] The specific implementation contents of the present invention are as follows: A method for dynamically expanding the encryption performance of a bastion host, retaining a functional module for managing account passwords, defining encryption policies, and distributing encryption tasks in the bastion host, and configuring multiple computing units for executing encryption computing tasks on computing devices outside the bastion host; the bastion host is interconnected with each computing unit network through a central node, and manages each computing unit including registration, configuration of performance parameters, calling, and deregistration; When executing a batch encryption plan, the bastion host first configures the encryption policy for each account and generates encryption task information. After receiving a request from an external computing unit to the bastion host, it sends the encryption task information to the computing unit to dynamically expand the encryption performance of the bastion host. After the computing unit completes the encryption calculation task, it recovers the calculation results of the encryption calculation until the current round of batch encryption plan is completed.

[0007] Furthermore, in order to better realize the present invention, when executing a batch encryption plan, a part of the registered computing units are first enabled for encryption calculation; if no computing unit sends a request to the bastion host before the execution of this round of batch encryption plan is completed, the bastion host immediately selects a part of the registered but unenabled computing units for initialization and enables new computing units, and after receiving the request from the new computing unit to the bastion host, sends encryption task information to the computing unit, dynamically expands the encryption performance of the bastion host, and after the computing unit completes the encryption calculation of generating passwords, modifying passwords, and verifying passwords, recovers the calculation results of the encryption calculation until the execution of this round of batch encryption plan is completed.

[0008] Furthermore, in order to better implement the present invention, the configuration method of the computing unit refers to: downloading a binary program to a computing device, and the computing device runs the binary program to generate multiple computing units.

[0009] Furthermore, in order to better implement the present invention, the configuration method of the computing unit refers to: the bastion host generates a configuration script and remotely logs in to the computing device through the central node to run the configuration script to generate multiple computing units.

[0010] Furthermore, in order to better implement the present invention, the bastion host can generate a registration token for each of the computing units and can view the working status of the successfully registered computing units; the bastion host can also mark the deregistration status for each of the computing units.

[0011] Furthermore, in order to better implement the present invention, the bastion host can configure a limiting strategy for performance parameters for each of the computing units; the performance parameters include any one or more of the number of tasks running simultaneously, CPU, and memory; when the current value of the computing unit performance parameter meets the limiting strategy, the computing unit will no longer send a request to the bastion host, nor will it receive the decryption task information sent by the bastion host.

[0012] Furthermore, in order to better implement the present invention, the bastion host sets a matching strategy when configuring performance parameters for the computing unit; after receiving a request from an external computing unit to the bastion host, the bastion host selects account information that meets the matching strategy and sends the encryption task information corresponding to the account information to the computing unit, recovers the calculation results sent by the computing unit and sends them to the corresponding account for encryption.

[0013] Furthermore, in order to better implement the present invention, the registration status of the computing unit is divided into two types: "registered" and "deregistered"; and the computing unit in the "registered" state is further divided into three types: "available", "occupied" and "disabled" according to the working status; The "available" state means that the computing unit is currently idle but can be called by the bastion host for encryption calculation and can perform encryption calculation tasks; The "occupied" state means that the computing unit is currently executing a cryptographic calculation task but can still be called by the bastion host to add a new cryptographic calculation task; The "disabled" state means that the computing unit cannot be called by the bastion host for encryption calculations and cannot execute new encryption calculation tasks; The computing unit periodically reports its own status to the bastion host.

[0014] Furthermore, in order to better implement the present invention, after the computing unit in the "occupied" state completes the encryption calculation, the working state jumps to "available" or "disabled".

[0015] The present invention also provides a system for dynamically expanding the capacity of a bastion host and improving encryption performance, which is used to implement the above method.

[0016] The system includes a bastion host and a computing device; The computing device comprises a computing unit and a communication module, and the computing unit is interconnected with the central node network through the communication module; The computing unit is used to run the encryption calculation program to perform the encryption calculation task; The bastion host includes an account and password management module, a password change policy definition module, a password change task distribution module, a central node, and a management computing unit module; The management account and password module is used to input, update and store multiple groups of accounts and passwords; The password change policy definition module is used to configure a password change policy for each account; The distribution and re-encryption task module is used to generate re-encryption task information according to the account number and password currently stored in the management account and password module and the re-encryption policy configured for the account by the definition and re-encryption policy module, and is also used to extract the new password from the calculation result of the calculation unit and send it to the corresponding account for re-encryption; The central node is used for network interconnection between the computing unit in the computing device and the management computing unit module in the bastion host; The management computing unit module is used to manage each computing unit including registration, configuration of performance parameters, calling, and deregistration. When executing a batch decryption plan, the computing unit is dynamically called according to the matching degree between the decryption task and each computing unit, and the decryption task information is sent through the central node to the computing unit that can be called for calculation, and the recovered calculation results are then fed back to the distribution decryption task module.

[0017] The present invention has the following beneficial effects.

[0018] (1) The method for dynamically expanding the encryption performance of the bastion host described in the present invention configures the part of the original bastion host that performs encryption calculations to the outside, and flexibly calls the computing unit to perform the calculations of generating passwords, changing passwords, and verifying passwords corresponding to each account in the batch encryption operation. The bastion host then executes the encryption to the corresponding account based on the calculation results, thereby separating the encryption business of the bastion host from the encryption calculation function, thereby reducing the occupation of the bastion host resources during the encryption period.

[0019] (2) The method for dynamically expanding the capacity of the bastion host to improve the encryption performance described in the present invention calls a computing unit that matches the encryption task requirements to achieve dynamic expansion.

[0020] (3) In the method for dynamically expanding the encryption performance of the bastion host described in the present invention, the computing device mainly has the function of running the encryption calculation program and the function of being able to interconnect with the bastion host through the central node. It can provide the bastion host with multiple computing units for dynamic expansion outside the bastion host. Compared with expanding the performance of a single bastion host or a cluster, the cost of adding computing equipment is very low, and there is no need to shut down for equipment replacement, thereby ensuring the normal operation of the operation and maintenance audit system. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 The figure is a schematic diagram of the process of a computing unit performing a decryption computing task in Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. It should be understood that the described embodiments are only part of the embodiments of the present invention, not all of the embodiments, and therefore should not be regarded as limiting the scope of protection. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technical personnel in this field without making creative work are within the scope of protection of the present invention.

[0023] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "disposed", "connected" and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be an indirect connection through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0024] Embodiment 1: This embodiment proposes a method for dynamically expanding the encryption performance of a bastion host, retaining a functional module for managing account passwords, defining encryption policies, and distributing encryption tasks in the bastion host, and configuring multiple computing units for performing encryption computing tasks on computing devices outside the bastion host; the bastion host is interconnected with each computing unit network through a central node, and manages each computing unit including registration, configuration of performance parameters, calling, and deregistration; When executing a batch encryption plan, the bastion host first configures the encryption policy for each account and generates encryption task information. After receiving a request from an external computing unit to the bastion host, it sends the encryption task information to the computing unit to dynamically expand the encryption performance of the bastion host. After the computing unit completes the encryption calculation task, it recovers the calculation results of the encryption calculation until the current round of batch encryption plan is completed.

[0025] This embodiment also proposes a system for dynamically expanding the capacity of a bastion host to improve encryption performance, which is used to implement the above method. The system includes a bastion host, and a computing device is arranged outside the bastion host and is interconnected with the bastion host network through a central node.

[0026] The computing device is used to configure a computing unit capable of performing specific calculations in a decryption operation.

[0027] The bastion host is used to manage account passwords, define decryption policies, distribute decryption tasks, network connections, and manage computing units; the management computing unit means that the bastion host is interconnected with the various computing units through a central node, and manages each computing unit including registration, configuration, calling, and deregistration according to the batch decryption plan, and realizes dynamic capacity expansion by dynamically calling the computing unit to execute the decryption computing task.

[0028] The method provided in this embodiment, the definition, distribution and other functions are still completed in the bastion host, which does not affect the business management and data management of the existing bastion host. It just puts the unit that actually executes the operation on other devices, and the bastion host provides information for it and receives the results. The method described in this embodiment can be simply understood as making the decryption business program inside the traditional bastion host independent, extracting the part related to calculation as a more flexible computing unit for dynamic expansion, which is not restricted by the platform. As long as the computing device has the conditions for program running and network connection, it is a smaller, more flexible and lower-cost expansion method. The method described in this implementation can improve the performance of the decryption computing unit of the bastion host in a batch decryption scenario by dynamic expansion in a short time without shutting down the machine.

[0029] In the system provided in this embodiment, the computing device only needs to be connected to the bastion host through the central node to facilitate data interaction. The computing unit can be installed locally by downloading the program or configured to the computing device by remote installation script. The connection structure and setting method are very easy to operate, and there is no need to expand the bastion host stand-alone or cluster, which greatly solves the cost of performance expansion.

[0030] This embodiment takes the dynamic calling of computing units to execute encryption calculation tasks as the main technical concept, extracts the computing part that occupies the most resources in the batch encryption plan from the bastion host, ensures the normal operation of the bastion host, and realizes dynamic capacity expansion by calling the computing units that realize the computing functions on demand. Moreover, this dynamic capacity expansion method has high feasibility both in economic and technical aspects.

[0031] Embodiment 2: This embodiment is described in detail based on the above-mentioned embodiment 1.

[0032] The existing bastion hosts have the function of changing the encryption key, but most of them are deployed in a single bastion host mode, which is not convenient for expansion. The deployment mode of multiple bastion hosts is convenient for expansion, but users often do not need to expand functions other than the encryption key change function, resulting in a waste of resources. At this time, the cost of adjusting the deployment or purchasing a license is relatively high.

[0033] The method for dynamically expanding the capacity of a bastion host to improve encryption performance provided in this embodiment configures N computing units outside the bastion host, where N is a positive integer.

[0034] Furthermore, the N computing units may be configured on the same computing device or on multiple computing devices.

[0035] Furthermore, one computing unit or multiple computing units may be configured on one computing device.

[0036] The computing unit is installed and deployed by local download or remote login. The local download method refers to: downloading the binary program of the corresponding platform to the computing device to divide it into multiple computing units; then applying for registration with the bastion host, and the bastion host generates a registration token for each computing unit. The remote login method refers to: the bastion host generates a configuration script, remotely logs in to the computing device through SSH and other methods, and runs the configuration script to generate multiple computing units; then each computing unit applies to the bastion host for registration, and the bastion host generates a registration token for it. Use the token to run a program that can perform password modification and verification calculations on the computing device and specify the registered bastion host address. After success, the status of each registered computing unit can be seen in the bastion host.

[0037] The computing unit is deployed outside the bastion host through a computing device. When implementing batch password changes, the bastion host maintains business-related content, such as: managing account passwords, defining password change policies, distributing password change tasks, managing computing unit modules, etc.; and the computing device can be regarded as an edge device that implements the password change function, and the calculation from the old password to the new password is performed according to the password change policy through the computing unit; at the same time, the computing unit has the function of authentication and interaction with the bastion host, and can receive password change task information including the original password of the account and the password change policy, and can also send calculation results including the new password of the account. The core of the computing unit is to provide computing functions related to password changes, namely, the calculation of preparing passwords, modifying passwords, and verifying passwords. Therefore, the development cost and deployment cost of the computing unit are very low.

[0038] First, the computing unit can be registered or deregistered; a registered computing unit can be called or removed. Therefore, the registration status of the computing unit is divided into two types: "registered" and "deregistered". The two states of "registered" and "deregistered" are usually set through the computing unit management module in the bastion host.

[0039] When the bastion host allocates the encryption calculation task, it can only select the appropriate computing unit from the registered computing units that send the execution request. Usually, the computing unit itself only executes the encryption calculation program and does not store related content, including the account, the original password of the account, the encryption policy and other data are requested to the bastion host through the pull mode, and the calculation results are sent back to the bastion host after the corresponding calculation is completed.

[0040] If the deregistered computing unit is currently executing a password-changing computing task, it will automatically stop after completing the current round of tasks. If it is not executing a password-changing computing task, it will not be assigned a new password-changing computing task. The operation and maintenance personnel can reclaim the deregistered computing unit based on the actual situation. Only the registered computing unit can be called to execute the password-changing computing task.

[0041] In another specific embodiment, a method for registering or deregistering a computing unit is provided. The method is to design a computing unit management page for human-computer interaction, on which function keys of "register" and "deregister" are provided. After selecting an unregistered computing unit, clicking the "register" function key can complete the registration of the computing unit in the background, and the bastion host marks the computing unit as registered; after selecting a registered computing unit, clicking the "deregister" function key can complete the deregistration of the computing unit in the background, and the bastion host marks the computing unit as deregistered.

[0042] Furthermore, for the convenience of labeling and management, multiple computing units are usually numbered, and the corresponding computing unit can be selected by inputting the number. This is a conventional technical means in the art and is not an improvement of this embodiment, so it will not be described in detail.

[0043] Secondly, the computing units in the "registered" state are divided into three types according to their working status: "available", "occupied" and "disabled": The "available" state means that the computing unit is currently idle but can be called by the bastion host for encryption calculation and can perform encryption calculation tasks; The "occupied" state means that the computing unit is currently executing a cryptographic calculation task but can still be called by the bastion host to add a new cryptographic calculation task; The "disabled" state means that the computing unit cannot be called by the bastion host for encryption calculations and cannot execute new encryption calculation tasks; It should be noted that when a computing unit is removed, it is equivalent to being in the "disabled" state, which cannot be called by the bastion host and is no longer allowed to obtain the decryption task information. The three states of "available", "occupied" and "disabled" usually change dynamically based on whether they match the decryption calculation requirements. For example: after the computing unit in the "occupied" state completes the decryption calculation, the working state jumps to "available" or "disabled".

[0044] Furthermore, the computing unit regularly reports its working status to the bastion host so that it can obtain new encryption computing tasks in time when idle resources are freed up. This process can be understood as when a computing unit can be called, it will be added to the "available list"; and when the computing unit cannot be called, it will be kicked out of the "available list".

[0045] The other parts of this embodiment are the same as those of the above-mentioned embodiment 1, and thus will not be described in detail.

[0046] Embodiment 3: This embodiment, based on the above-mentioned embodiment 1 or embodiment 2, uses the "limitation strategy" as a matching encryption calculation requirement to provide a detailed description.

[0047] The bastion host described in this embodiment configures a limiting strategy for performance parameters for each computing unit. Any indicator that can be monitored by the computing device can be used as a performance parameter, such as the number of tasks running simultaneously, CPU, memory, etc. When the current value of the computing unit performance parameter meets the limiting strategy, the computing unit will no longer send requests to the bastion host, nor will it receive the decryption task information sent by the bastion host.

[0048] The restriction strategy uses each specific performance parameter as a restriction sub-strategy, and multiple restriction sub-strategies have an "And" or "Or" logical relationship. Therefore, when the restriction strategy contains multiple restriction sub-strategies, the bastion host needs to determine the logical relationship between the restriction sub-strategies when distributing the encryption calculation task.

[0049] For example, the restriction strategy corresponding to computing unit A# defines three restriction sub-strategies: "number of tasks running simultaneously", "CPU" and "memory", and defines the logical relationship between the three as "OR", that is, "upper limit of number of tasks running simultaneously = 2" OR "upper limit of CPU = 0.8" OR "upper limit of memory = 800MB"; if any of the three restriction sub-strategies is met, no request will be sent, and the bastion host will no longer send new decryption task information to computing unit A#.

[0050] Take the example of defining only the "number of concurrently running tasks" as a limiting sub-strategy in the limiting strategy as follows: The restriction policy corresponding to computing unit B# only involves the restriction sub-policy "upper limit of concurrently running tasks = 2". After initialization, the current number of running tasks of computing unit B# is 0, and the initial working state is "available". Computing unit B# sends a request to the bastion host, and is selected and distributed with a decryption computing task T1 by the bastion host. At this time, computing unit B# is executing the decryption computing task, but the "number of concurrently running tasks" has not reached the upper limit, and the working state changes to "occupied"; then, before the first decryption computing task T1 is completed, the bastion host calls and adds a new decryption computing task T2. At this time, computing unit B# has two decryption computing tasks running simultaneously, that is: the current number of concurrently running tasks = 2, reaching the upper limit of the number of concurrently running tasks, and the working state of computing unit B# changes to "disabled", and no new decryption computing tasks are accepted; but the decryption computing tasks that have been executed continue to execute. Assume that after a period of time t1, the encryption calculation task T2 in computing unit B# is completed and the calculation result is sent to the bastion host. At this time, the number of currently running tasks is restored to 1, and the working state of computing unit B# jumps back to "occupied", and it can be called to perform new encryption calculation tasks. Assume that computing unit B# does not perform new encryption calculation tasks, and after a period of time t2, the encryption calculation task T1 is completed and the calculation result is sent to the bastion host. At this time, the number of currently running tasks in computing unit B# becomes 0, and it can be called by the bastion host again, so the working state of computing unit B# jumps back to "available". Furthermore, computing unit B# regularly reports its working status to the bastion host.

[0051] When a single restricted sub-strategy corresponding to "CPU", "memory" or other specific performance parameters is defined in the restricted strategy, the processing logic of the bastion host distributing the encryption calculation task is the same as the processing logic when the single specific performance parameter of "number of tasks running simultaneously" is defined. In other words, according to the definition of the previously restricted strategy, the situation that triggers the computing unit to stop receiving new encryption calculation tasks is not limited to the current value of "number of tasks running simultaneously" reaching the upper limit of tasks running simultaneously, but may also be the current value of "CPU" reaching the CPU upper limit, or the current value of "memory" reaching the memory upper limit.

[0052] The specific content of the limiting strategy can be adjusted according to actual needs. The processing logic of the bastion host distributing the encryption calculation task is basically the same, so it will not be repeated here.

[0053] In another specific embodiment, based on the above scheme, Figure 1 As shown, taking the computing unit numbered N# as an example, the process of a computing unit performing a decryption computing task is described from the perspective of the computing unit, including the following steps: Step S1, computing unit N# completes registration on the bastion host and is configured with a limited strategy for performance parameters by the bastion host, and then waits for the bastion host to be activated; Step S2, computing unit N# initially sends its working status as "available" and regularly reports its working status to the bastion host, and continuously sends requests to the bastion host; Step S3: After the computing unit N# is selected by the bastion host, it sends a request to the bastion host to "pull account information", and waits for the bastion host to feedback the "encryption task information", and the number of currently running tasks increases by 1; the encryption task information includes the account information that needs to be encrypted, the encryption strategy, etc. Step S4: After receiving the password change task information, the computing unit N# extracts the account number, the original password, the password change strategy and other information, executes the password change calculation program according to the password change strategy, and generates a new password to change the original password of the corresponding account number. After the password is changed, the new password is also verified. Step S5: The generated new password, the modification result, and the verification result are all fed back to the bastion host as the calculation results of the calculation unit N#, completing this round of password modification calculation task.

[0054] It should be noted that: if it is analyzed in step S3 that the current performance parameters of the current computing unit N# have not reached the upper limit, the request can be sent repeatedly and the newly assigned decryption task information can be obtained; if the current performance parameters of the computing unit N# have reached the upper limit, no request will be sent and the newly assigned decryption task information will not be obtained.

[0055] This embodiment is optimized on the basis of Embodiment 1 or Embodiment 2.

[0056] Embodiment 4: This embodiment is optimized on the basis of any one of Embodiments 1 to 3, and the "matching strategy" is described in detail as a matching encryption calculation requirement.

[0057] In this embodiment, the bastion host not only configures the limiting strategy of performance parameters for the computing units, but also configures the matching strategy for the computing units. Specifically, when the bastion host has a decryption computing task to be assigned and receives a request from an external computing unit, the bastion host sends the decryption task information that meets the requirements to the computing units that have not met the limiting strategy according to the matching strategy of each computing unit, and after the computing unit runs the decryption computing program and outputs the result, it collects the result and sends it to the corresponding account for decryption.

[0058] "Matching strategy" refers to a certain query condition when obtaining the password change task information of an account, such as: the account's protocol type, the last password change time, custom attributes, and other attribute tags of the account itself.

[0059] The matching strategy uses each specific item as a matching sub-strategy, and multiple matching sub-strategies have a logical relationship of "And" or "Or".

[0060] Take the matching policy that only defines the matching sub-policy "protocol type" as an example for explanation: Currently, there are three computing units, computing unit O#, computing unit P#, and computing unit Q#, which have been registered and are in the "available" working state. Among them, the protocol type is set to SSH in the matching strategy of computing unit O#; the protocol type is set to Telnet in the matching strategy of computing unit P# and computing unit Q#. If the protocol type corresponding to the account of the current encryption calculation task to be distributed is SSH, after judgment, the bastion host sends the encryption task information of the account to computing unit O#; if the protocol type corresponding to the account of the current encryption calculation task to be distributed is Telnet, after judgment, the bastion host sends the encryption task information of the account to one of computing unit P# and computing unit Q#; if the protocol type corresponding to the account of the current encryption calculation task to be distributed is Rdp, after judgment, there is no computing unit that meets the matching strategy, and the bastion host will periodically refresh the computing units that can be called until a computing unit with the protocol type of Rdp is matched, and then the encryption task information of the account will be distributed.

[0061] When the "last encryption time", "custom attribute" or other single matching sub-strategies are defined in the matching strategy, the processing logic of the bastion host distributing the encryption calculation task is the same as the processing logic when defining the above-mentioned "protocol type" single item, and will not be repeated here.

[0062] Furthermore, when the matching strategy contains multiple matching sub-strategies, the bastion host needs to determine the logical relationship between the matching sub-strategies when distributing the encryption calculation task. For example, the matching strategy corresponding to the computing unit R# defines two matching sub-strategies, "protocol type" and "last encryption time", and defines the logical relationship between the two as "AND". Only the encryption task information corresponding to the account that meets the two matching sub-strategies of "protocol type" and "last encryption time" will be distributed to the computing unit R# by the bastion host. The specific content of the matching strategy can be adjusted according to actual needs. The processing logic of the bastion host distributing encryption calculation tasks is basically the same, so it will not be repeated.

[0063] The other parts of this embodiment are the same as any one of the above-mentioned embodiments 1 to 3, so they will not be repeated here.

[0064] Embodiment 5: This embodiment is optimized based on any one of Embodiments 1 to 4.

[0065] In this embodiment, the user first designs a computing unit that meets the resource requirements and selects a suitable computing device according to the scenario in which the operation and maintenance audit system needs to perform batch encryption. The main consideration here is the demand for resources such as CPU and memory. Therefore, when configuring the performance parameters of each computing unit, there is no need to repeatedly consider the CPU upper limit and memory upper limit issues.

[0066] Based on the above optimization, the selected computing device is connected to the network environment where the central node is located, multiple computing units are configured in the computing device, and registration and performance parameter configuration are performed for each computing unit; among them, when configuring performance parameters, only the upper limit of the specific parameter "number of tasks running simultaneously" is set, while the upper limits of CPU and memory are ignored; then, all registered computing units in the "available" state are added to the available list and sorted in sequence.

[0067] When executing a batch password change plan, the bastion host prepares a password change policy for each account whose password is to be changed. The account, the original password corresponding to the account, the password change policy corresponding to the account, and other information will be packaged into a password change computing task for distribution. During the actual distribution, the bastion host distributes the password change computing tasks to the registered computing units in sequence according to the available list. Whenever a computing unit reaches the upper limit of the number of tasks running simultaneously, it will try to enable a new computing unit until this round of batch password change plan is completed.

[0068] The method of selecting any computing unit from all the callable computing units to distribute the encryption calculation tasks can be called "random distribution"; in contrast, the method provided in this embodiment of selecting computing units in sequence from all the callable computing units to distribute the encryption calculation tasks can be called "one-by-one orderly distribution". "One-by-one orderly distribution" is more conducive to resource management and efficient configuration than "random distribution".

[0069] Furthermore, when the bastion host is configured with multiple computing devices, the available list not only numbers and sorts the available computing units, but also the computing devices. Therefore, when the computing units that have been registered and are in the "available" state are added to the available list, they are first centrally classified according to the computing devices to which they belong, and then sorted under the major categories of each computing device; that is, the computing devices in the available list are first sorted as a whole to form multiple major categories in order, and the computing units belonging to the same computing device in each major category are then sorted. Therefore, when the bastion host distributes the encryption and decryption computing tasks to the registered computing units in sequence according to the available list, the computing units belonging to the same computing device will be concentratedly used, and then the computing units in the new computing devices will be enabled. This optimization method is more detailed than the "orderly distribution one by one" method, and further improves the effect of orderly resource configuration and management.

[0070] Furthermore, as a compromise between the two methods of "orderly distribution one by one" and "random distribution", a "random distribution in batches" method is proposed. When this method is used to execute the batch encryption plan, a part of the registered computing units with the status of "available" is first enabled as the first batch of computing units that can be used for encryption calculation; when the bastion host distributes the encryption calculation task, it first randomly selects from the first batch of computing units; when the current round of batch encryption plan is not completed and the first batch of computing units cannot be called, the bastion host immediately selects a part of the registered but unenabled computing units for initialization and enables a new batch of computing units to dynamically expand the encryption performance; this is repeated until the current round of batch encryption plan is completed.

[0071] Furthermore, in order to ensure the stability of the data interaction channel between each computing unit and the bastion host, the computing units that have been registered and are in the "available" or "occupied" state will send requests to the bastion host if they can still receive new encryption computing tasks. The bastion host will select appropriate computing units from the computing units that sent the request to send the encryption task information and distribute the encryption computing tasks.

[0072] All the solutions in this embodiment are based on the same technical concept as the solution described in Example 1, and further refine the dynamic expansion method to have stronger scalability.

[0073] The other parts of this embodiment are the same as any one of the above-mentioned embodiments 1 to 4, so they are not repeated here.

[0074] Embodiment 6: In any of the above-mentioned embodiments 1 to 5, when the batch encryption plan is not completed but there are temporarily no computing units that can be called, a patrol program can be embedded in the bastion host to allow the bastion host to patrol several registered computing units, and distribute encryption computing tasks when computing units that can be called are found, until this round of batch encryption plan is completed. Furthermore, the patrol parameters can be set to limit the conditions of the patrol, the time interval between each patrol, and / or the maximum number of patrols; the feedback method of the patrol results can also be set. This part is implemented using existing technology, and it will not be repeated as long as the bastion host can actively obtain the working status of several computing units.

[0075] This embodiment is optimized on the basis of any one of the above-mentioned embodiments 1 to 5. In view of the situation where the batch encryption plan is not completed but there is temporarily no suitable computing unit available for calling, inspired by the "batch distribution" technical idea in embodiment 5, a method for enabling registered computing units in batches is proposed to achieve dynamic capacity expansion.

[0076] Specifically, after the computing unit completes registration on the bastion host, it needs to be enabled by the bastion host before it can enter the working state; and each time a batch encryption task is executed, the bastion host will not enable all registered computing units, but will enable them in batches. The enabled computing unit reports its own working status to the bastion host regularly, and may be called by the bastion host only when the conditions are met. This process is similar to the heartbeat mechanism. However, the unenabled computing unit can be detected by the bastion host based on the registered connection information, and enabled through the initialization program when it needs to be enabled. The initialization process is the process of configuring the limiting strategy and / or matching strategy of the parameter performance for the computing unit.

[0077] As a preferred solution, the installation script for configuring the computing unit, the initialization program for initialization, and the encryption calculation program for performing specific encryption calculations are packaged together and loaded into the computing device by local download or remote login during deployment. This is a conventional technical means in the field, so it will not be repeated here.

[0078] The other parts of this embodiment are the same as any one of Embodiments 1 to 5, and thus will not be described in detail.

[0079] Embodiment 7: Based on any one of the above-mentioned embodiments 1 to 6, this embodiment provides a system for dynamically expanding the capacity of a bastion host and improving the encryption performance, which is used to implement the above-mentioned method for dynamically expanding the capacity of a bastion host and improving the encryption performance.

[0080] The system includes a bastion host and a computing device; The computing device comprises a computing unit and a communication module, and the computing unit is interconnected with the central node network through the communication module; The computing unit is used to run the encryption calculation program to perform the encryption calculation task; The bastion host includes an account and password management module, a password change policy definition module, a password change task distribution module, a central node, and a management computing unit module; The management account and password module is used to input, update and store multiple groups of accounts and passwords; The password change policy definition module is used to configure a password change policy for each account; The distribution and re-encryption task module is used to generate re-encryption task information according to the account number and password currently stored in the management account and password module and the re-encryption policy configured for the account by the definition and re-encryption policy module, and is also used to extract the new password from the calculation result of the calculation unit and send it to the corresponding account for re-encryption; The central node is used for network interconnection between the computing unit in the computing device and the management computing unit module in the bastion host; The computing unit management module is used to manage each computing unit, including registration, configuration of performance parameters, calling, and deregistration; When executing a batch encryption plan, after the bastion host receives a request from an external computing unit, it sends the encryption task information to the computing unit to dynamically expand the encryption performance of the bastion host. After the computing unit completes the encryption calculation task, it recovers the calculation results of the encryption calculation until the current round of batch encryption plan is completed.

[0081] This embodiment also proposes an electronic device, including a memory and a processor. The memory is used to store a computer program; when the computer program is executed on the processor, the above-mentioned method of dynamically expanding the capacity of the bastion host to improve the encryption performance is implemented.

[0082] This embodiment also proposes a computer-readable storage medium. The computer-readable storage medium stores computer instructions; when the computer instructions are executed on the above-mentioned electronic device, the above-mentioned method of dynamically expanding the capacity of the bastion host and improving the encryption performance is implemented.

[0083] The other parts of this embodiment are the same as any one of the above-mentioned embodiments 1 to 6, so they will not be repeated here.

[0084] Through the description of the above implementation methods, technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0085] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0086] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for dynamically expanding the capacity of a bastion host to improve encryption performance, characterized in that: The bastion host retains the functional modules for managing account passwords, defining password change policies, and distributing password change tasks, and configures multiple computing units for performing password change computing tasks on computing devices outside the bastion host; the bastion host is interconnected with each computing unit network through the central node, and manages each computing unit including registration, configuration of performance parameters, calling, and deregistration; When executing a batch encryption plan, the bastion host first configures the encryption policy for each account and generates encryption task information. After receiving a request from an external computing unit to the bastion host, it sends the encryption task information to the computing unit to dynamically expand the encryption performance of the bastion host. After the computing unit completes the encryption calculation task, it recovers the calculation results of the encryption calculation until the current round of batch encryption plan is completed.

2. According to claim 1, a method for dynamically expanding the capacity of a bastion host to improve encryption performance is characterized in that: When executing a batch encryption plan, first enable some of the registered computing units for encryption calculations; if no computing unit sends a request to the bastion host before the execution of this round of batch encryption plan is completed, the bastion host immediately selects some of the registered but unactivated computing units for initialization and enables new computing units. After receiving the request from the new computing unit to the bastion host, it sends the encryption task information to the computing unit to dynamically expand the encryption performance of the bastion host. After the computing unit completes the encryption calculations of generating passwords, modifying passwords, and verifying passwords, it recovers the calculation results of its encryption calculations until the execution of this round of batch encryption plan is completed.

3. According to claim 1, a method for dynamically expanding the capacity of a bastion host to improve encryption performance is characterized in that: The configuration method of the computing unit refers to: downloading a binary program to a computing device, and the computing device runs the binary program to generate multiple computing units.

4. According to claim 1, a method for dynamically expanding the capacity of a bastion host to improve encryption performance is characterized in that: The configuration method of the computing unit refers to: the bastion host generates a configuration script and remotely logs in to the computing device through the central node to run the configuration script to generate multiple computing units.

5. According to claim 1, a method for dynamically expanding the capacity of a bastion host to improve encryption performance is characterized in that: The bastion host can generate a registration token for each of the computing units and can view the working status of the successfully registered computing units; the bastion host can also mark the deregistration status for each of the computing units.

6. A method for dynamically expanding the capacity of a bastion host to improve encryption performance according to claim 1, characterized in that: The bastion host can configure a limiting strategy for performance parameters for each of the computing units; the performance parameters include any one or more of the number of tasks running simultaneously, CPU, and memory; when the current value of the computing unit performance parameter meets the limiting strategy, the computing unit will no longer send a request to the bastion host, nor will it receive the decryption task information sent by the bastion host.

7. A method for dynamically expanding the capacity of a bastion host to improve encryption performance according to claim 1, characterized in that: The bastion host sets a matching strategy when configuring performance parameters for the computing unit; after receiving a request from an external computing unit to the bastion host, the bastion host selects account information that meets the matching strategy and sends the encryption task information corresponding to the account information to the computing unit, recovers the calculation results sent by the computing unit and sends them to the corresponding account for encryption.

8. A system for dynamically expanding the capacity of a bastion host and improving encryption performance, used to implement the method according to claim 1; characterized in that: The system includes a bastion host and a computing device; The computing device comprises a computing unit and a communication module, and the computing unit is interconnected with the central node network through the communication module; The computing unit is used to run the encryption calculation program to perform the encryption calculation task; The bastion host includes an account and password management module, a password change policy definition module, a password change task distribution module, a central node, and a computing unit management module; The management account and password module is used to input, update and store multiple groups of accounts and passwords; The password change policy definition module is used to configure a password change policy for each account; The distribution and re-encryption task module is used to generate re-encryption task information according to the account number and password currently stored in the management account and password module and the re-encryption policy configured for the account by the definition and re-encryption policy module, and is also used to extract the new password from the calculation result of the calculation unit and send it to the corresponding account for re-encryption; The central node is used for network interconnection between the computing unit in the computing device and the management computing unit module in the bastion host; The computing unit management module is used to manage each computing unit, including registration, configuration of performance parameters, calling, and deregistration; When executing a batch encryption plan, after the bastion host receives a request from an external computing unit, it sends the encryption task information to the computing unit to dynamically expand the encryption performance of the bastion host. After the computing unit completes the encryption calculation task, it recovers the calculation results of the encryption calculation until the current round of batch encryption plan is completed.

9. An electronic device, characterized in that: It includes a memory and a processor; the memory is used to store a computer program; when the computer program is executed on the processor, the method for dynamically expanding the capacity of the bastion host and improving the encryption performance as described in any one of claims 1-7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions; when the computer instructions are executed on the electronic device as described in claim 9, the method for dynamically expanding the capacity of the bastion host and improving the encryption performance as described in any one of claims 1-7 is implemented.

Images