Session aggregation method and system of operation and maintenance auditing system based on single port

Abstract

The invention discloses a session aggregation method and system of an operation and maintenance auditing system based on a single port. A client initiates tcp connection A to a single sign-on device according to target information; and the single sign-on device forwarding module receives the connection and takes out corresponding session id and protocol information from the memory as request data, and the single sign-on device forwarding module initiates tcp connection B to the engine monitoring module and sends the request data. The engine monitoring module receives the tcp connection B and analyzes the request data, if analysis fails, the engine monitoring module sends rejection information to the single sign-on device, and the session ends; if the analysis is successful, the engine monitoring module sends confirmation information to the single sign-on device, whether a corresponding data processing process exists or not is searched in a system cache based on the session id, if yes, session forwarding socket is aggregated, and if not, a new data processing process is started, and a session control channel is established to forward the socket. According to the invention, only one operation and maintenance port needs to be opened, the use is simple, the session aggregation can be carried out at low cost, and the practicability is better.

Description

Technical Field

[0001] The present invention belongs to the technical field of operation and maintenance auditing, and in particular relates to a session aggregation method and system of an operation and maintenance auditing system based on a single port. Background Art

[0002] The operation and maintenance audit system is an operation and maintenance system applied between the client and the service, which can control and audit the behavior of the operation and maintenance personnel; TCP (transmission control protocol) is a connection-oriented, reliable, byte stream-based transport layer communication protocol. In the operation and maintenance audit, multiple application protocols such as ssh, rdp, mysql, and postgresql are usually supported. In the prior art, in order to distinguish different protocols for processing in the engine, the common practice is to listen to different ports for different protocols to connect different handlers. However, as more and more protocols are supported, more and more ports are occupied, and the risk of being attacked also increases. Secondly, applications such as databases often initiate multiple TCP connections in one session. Some operation and maintenance audit systems do not aggregate each TCP into one session. Although the data is fully audited, it is not conducive to the integrity display of a session; there are also some operation and maintenance audit systems that aggregate multiple TCPs into one session through process or thread communication, but this method will increase the complexity of implementation and consume more system resources.

[0003] In summary, there are two common problems in the existing operation and maintenance audit system. First, different ports are opened for different operation and maintenance protocols, resulting in too many ports being opened, increasing the risk of being attacked. Second, if there are multiple TCP connections in a session, the data of each connection is not aggregated into one session or a complex and system resource-consuming method is used to aggregate the session. Therefore, in order to solve the above problems, the present invention provides a method for aggregating sessions that only needs to open one operation and maintenance port, monitors only one port, and is simple to use and does not consume system resources. It is simple to use and low-cost. Summary of the invention

[0004] The purpose of the present invention is to provide a session aggregation method and system for an operation and maintenance audit system based on a single port, aiming to solve the above-mentioned problems.

[0005] The present invention is mainly achieved through the following technical solutions: A session aggregation method for an operation and maintenance audit system based on a single port, comprising the following steps: Step S1: Log in to the operation and maintenance audit system and configure information for operation and maintenance; Step S2: The browser calls the single sign-on device and transmits the session ID and protocol information as parameters to the single sign-on device; Step S3: The single sign-on device generates a random port, binds the session ID and protocol information to the port, and saves them in memory; the single sign-on device uses the local IP and port as the target information of the client to call the client; Step S4: The client initiates a TCP connection A to the single sign-on device according to the target information; the single sign-on device forwarding module receives the connection and monitors to obtain the information of the local IP and port P, then takes out the corresponding session ID and protocol information from the memory as the request data, and the single sign-on device forwarding module initiates a TCP connection B to the engine monitoring module and sends the request data through TCP connection B; Step S5: The engine monitoring module receives TCP connection B and parses the request data. If the parsing fails, the engine monitoring module sends a rejection message to the single sign-on device, and the session ends. If the parsing succeeds, the engine monitoring module sends a confirmation message to the single sign-on device, and the process proceeds to step S6. Step S6: Take out the session ID in the parsed data, and search the system cache to see whether the corresponding data processing process exists. If it exists, aggregate the session forwarding socket. Otherwise, enable a new data processing process, associate the session ID with the data processing process, store it in the system cache, and establish a session control channel forwarding socket.

[0006] In order to better implement the present invention, further, in step S5, if the single sign-on device receives a rejection message, the TCP connection A and the TCP connection B are closed, and the monitoring of the current session is closed.

[0007] In order to better implement the present invention, further, in step S5, if the single sign-on device receives the confirmation information, it enters the data forwarding stage and converts the data of TCP connection A and TCP connection B.

[0008] In order to better implement the present invention, further, in the step S3, the single sign-on forwarding module randomly generates an available port, and uses the port to create a new TCP socket to monitor the TCP connection from the session ID.

[0009] In order to better implement the present invention, further, in step S6, if it exists, the socket handle of this connection is forwarded to the data processing process through the session control channel; otherwise, the engine monitoring module forwards the socket and protocol information of this connection to the new data processing process through the newly created session control channel.

[0010] In order to better realize the present invention, further, A session aggregation system of an operation and maintenance audit system based on a single port is based on the above method and includes a single sign-on device, a browser is connected to the single sign-on device and the operation and maintenance audit system respectively, and the single sign-on device is connected to a client; the single sign-on device includes a single sign-on device forwarding module, and the operation and maintenance audit system includes an engine monitoring module, the single sign-on device forwarding module is connected to the engine monitoring module, and the engine monitoring module is used to monitor the port of the single sign-on device forwarding module and merge or create a new session data processing process.

[0011] The beneficial effects of the present invention are as follows: The present invention uses cache and TCP forwarding technology to enable the operation and maintenance audit system to only listen to one port, thereby reducing the risk of being attacked; the present invention only listens to one port externally regardless of how many application protocols the operation and maintenance audit system supports, thereby achieving the purpose of port aggregation. The present invention adds access request data before real operation and maintenance data, adds custom request data before application protocol data, and uses a single process to process multiple connections in the same session, aggregating multiple TCP connections into one session processing process, thereby ensuring the integrity display of the session, and the implementation method is simple and the resource consumption is small. In summary, the present invention only needs to open one operation and maintenance port, is simple to use, can perform session aggregation at a low cost, and has good practicality. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is an operation flow chart of a session aggregation method of an operation and maintenance audit system based on an operation and maintenance port; Figure 2 The diagram is a structural diagram of the session aggregation system of the operation and maintenance audit system based on the operation and maintenance port. DETAILED DESCRIPTION

[0013] Embodiment 1: A session aggregation system for an operation and maintenance audit system based on a single port, such as Figure 2 As shown, it includes a browser, a single sign-on, a third-party client, an operation and maintenance audit system, and a server. The single sign-on includes a single sign-on main module and a single sign-on forwarding module. The operation and maintenance audit system includes a configuration module and an engine monitoring module.

[0014] The system operation mainly includes the following steps: 1) Log in to the operation and maintenance audit system, the engine module listening port, and configure the server IP and account information; 2) The browser calls up the single sign-on tool; 3) The single sign-on device calls up the client; 4) The client accesses the single sign-on forwarding module; 5) The single sign-on forwarding module accesses the engine monitoring module; 6) The engine monitoring module receives the access request and parses the request data; 7) The engine monitors the parsed data and determines whether the session needs to be aggregated, thereby enabling or reusing the data processing program to process the data.

[0015] Specifically, the browser calls up the single sign-on module: the browser passes the session ID and the server's protocol and engine monitoring information to the single sign-on module.

[0016] Specifically, the single sign-on device calls the client: a. The single sign-on forwarding module randomly generates an available port (binds information and caches it) and creates a new TCP socket with the port to listen for connections from the session ID; b. The single sign-on device calls the client and uses the port and local IP in step a as the client's target information.

[0017] Specifically, the main process of the single sign-on device forwarding data is as follows: a. The client initiates a TCP connection A based on the target information; b. After receiving TCP connection A, the single sign-on forwarding module assembles the engine access data according to the current socket port; c. The single sign-on forwarding module initiates a TCP connection B to the engine according to the engine monitoring information in step 1); d. The single sign-on forwarding module sends a request to the engine monitoring module; e. If the single sign-on forwarding module receives a rejection message, it closes TCP connection A and the current session monitor, and the session ends; f. If the single sign-on forwarding module receives the confirmation information, it forwards the data from the client and engine monitoring modules to forward the data from TCP connection A to TCP connection B, and the data from TCP connection B to TCP connection A.

[0018] Specifically, the main process of the engine monitoring module parsing request data is: a. The engine monitoring module receives the connection request information from the single sign-on device to parse out the protocol and session information; b. If the resolution fails, access is denied, a rejection message is sent to the single sign-on server, and the connection is disconnected; c. If the resolution is successful, a confirmation message is sent to the single sign-on server.

[0019] Specifically, the main process of the engine monitoring module processing connection is: a. The engine monitoring module takes out the session id according to the information in step 6; b. If the session ID already exists in the cache, it means that the data of this connection belongs to an existing session. It is necessary to aggregate the sessions and reuse the data processing process associated with the session ID. The specific operation is to forward the socket handle of this connection to the data processing process through the session control channel; c. If the session ID does not exist in the cache, it means that the data of this connection comes from a new session. A new data processing process needs to be enabled and the session ID needs to be associated with the process. The data processing process will establish a session control channel, and the engine monitoring module will forward the socket and protocol information of this connection to the process through the session control channel; d. After socket forwarding, the connection between the single sign-on device and the engine listener becomes the connection between the single sign-on device and the data processing program.

[0020] Embodiment 2: A session aggregation method for an operation and maintenance audit system based on a single port, such as Figure 1 As shown, the following steps are included: 1) Log in to the system and configure information, click on operation and maintenance: The operator first logs in to the client system, uses the configuration module to configure relevant information, and selects the server for operation and maintenance on the operation and maintenance page.

[0021] 2) The browser calls the single sign-on device and passes parameters: The browser obtains the session ID from the system backend and calls the single sign-on device with the session ID and protocol information as parameters.

[0022] 3) The single sign-on device starts local monitoring: The single sign-on device generates a random port P, performs local monitoring, binds the session ID and protocol information to port P, and saves them in memory.

[0023] 4) The single sign-on device calls up the third-party client: The single sign-on device uses the local IP and port P as the target information of the client and starts the client.

[0024] 5) The client initiates a TCP connection A to the single sign-on device: The client initiates a TCP connection A to the local IP and port P.

[0025] 6) The single sign-on forwarding module receives TCP connection A, obtains monitoring information from connection A, finds that it is the local IP and port P, and retrieves the corresponding session ID and protocol information from the memory.

[0026] 7) The single sign-on forwarding module initiates TCP connection B to the engine monitoring module, and then sends the session ID and protocol information retrieved in step 6) as request data through TCP connection B.

[0027] 8) The engine monitoring module receives the connection B from the single sign-on device and starts to parse the data. If the parsing fails, a rejection message is sent. At this time, the single sign-on device receives the rejection message, closes the TCP connections A and B, and closes the monitoring of the current session, then closes the connection, and the session ends. If the parsing is successful, a confirmation message is sent. At this time, the single sign-on device receives the confirmation message and enters the data forwarding stage, that is, the data of A and B are converted to each other, and then enters step 9).

[0028] 9) The engine takes out the session ID from the parsed data and searches the system cache to see if the corresponding data processing process exists. If it does, it goes to step 10). If it does not exist, it means that this TCP connection is the first TCP of a new session. It uses the session ID and protocol information as parameters to start a new data processing process. This process will establish a session control channel with the engine monitoring module. The engine monitoring module forwards the socket of this connection to the data processing process through this channel. The engine monitoring program will associate the session ID with the data processing process and store it in the system cache, and go to step 11).

[0029] 10) The data processing process corresponding to the session id already exists in the system cache, which means that this connection is automatically initiated by the client and forwarded by the single sign-on device. It belongs to an existing session and the current TCP needs to be aggregated into the existing session data processing process. The socket corresponding to the TCP can be forwarded to the corresponding data processing process.

[0030] 11) Forwarding the socket corresponding to TCP to the data processing process means that the data processing process takes over the TCP connection, so that the interaction between the single sign-on forwarding module and the engine listening module becomes the interaction between the single sign-on forwarding module and the engine data processing process.

[0031] 12) If the operator wants to operate a new session at the same time, the above steps will be repeated.

[0032] 13) After the operation and maintenance is completed, the operator closes the client, each module closes the corresponding TCP connection, and the session ends.

[0033] The present invention uses cache and TCP forwarding technology to enable the operation and maintenance audit system to monitor only one port, thereby reducing the risk of being attacked; the present invention only monitors one port externally regardless of how many application protocols the operation and maintenance audit system supports, thereby achieving the purpose of port aggregation. The present invention adds access request data before real operation and maintenance data, adds custom request data before application protocol data, and uses a single process to process multiple connections in the same session, thereby aggregating multiple TCP connections into one session processing process, thereby ensuring the integrity display of the session, and having a simple implementation method and low resource consumption.

[0034] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any simple modification or equivalent change made to the above embodiment based on the technical essence of the present invention shall fall within the protection scope of the present invention.

Claims

1. A session aggregation method for an operation and maintenance audit system based on a single port, characterized in that: The following steps are involved: Step S1: Log in to the operation and maintenance audit system and configure information for operation and maintenance; Step S2: The browser calls the single sign-on device and transmits the session ID and protocol information as parameters to the single sign-on device; Step S3: The single sign-on device generates a random port, binds the session ID and protocol information to the port, and saves them in memory; The single sign-on device uses the local IP and port as the client's target information to call the client; Step S4: The client initiates a TCP connection A to the single sign-on device according to the target information; the single sign-on device forwarding module receives the connection and monitors to obtain the information of the local IP and port P, then takes out the corresponding session ID and protocol information from the memory as the request data, and the single sign-on device forwarding module initiates a TCP connection B to the engine monitoring module and sends the request data through TCP connection B; Step S5: The engine monitoring module receives TCP connection B and parses the request data. If the parsing fails, the engine monitoring module sends a rejection message to the single sign-on device, and the session ends. If the parsing succeeds, the engine monitoring module sends a confirmation message to the single sign-on device, and the process proceeds to step S6. Step S6: Take out the session ID in the parsed data, and search the system cache to see whether the corresponding data processing process exists. If it exists, aggregate the session forwarding socket. Otherwise, enable a new data processing process, associate the session ID with the data processing process, store it in the system cache, and establish a session control channel forwarding socket.

2. According to claim 1, a session aggregation method for an operation and maintenance audit system based on a single port is characterized in that: In step S5, if the single sign-on device receives the rejection information, the TCP connection A and the TCP connection B are closed, and the monitoring of the current session is closed.

3. According to claim 2, a session aggregation method for an operation and maintenance audit system based on a single port is characterized in that: In step S5, if the single sign-on device receives the confirmation information, it enters the data forwarding phase and converts the data of TCP connection A and TCP connection B.

4. According to claim 1, a session aggregation method for an operation and maintenance audit system based on a single port is characterized in that: In step S3, the single sign-on forwarding module randomly generates an available port and creates a new TCP socket using the port to monitor the TCP connection from the session ID.

5. According to claim 1, a session aggregation method for an operation and maintenance audit system based on a single port is characterized in that: In step S6, if it exists, the socket handle of this connection is forwarded to the data processing process through the session control channel; otherwise, the engine monitoring module forwards the socket and protocol information of this connection to the new data processing process through the newly created session control channel.

6. A session aggregation system for an operation and maintenance audit system based on a single port, based on the method described in any one of claims 1 to 5, characterized in that: It includes a single sign-on device, a browser is connected to the single sign-on device and an operation and maintenance audit system respectively, and the single sign-on device is connected to a client; the single sign-on device includes a single sign-on device forwarding module, and the operation and maintenance audit system includes an engine monitoring module. The single sign-on device forwarding module is connected to the engine monitoring module, and the engine monitoring module is used to monitor the port of the single sign-on device forwarding module and merge or create a new session data processing process.

Images