A session aggregation method and system based on a single-port operation and maintenance audit system

Abstract

The application discloses a session aggregation method and system of a single-port-based operation and maintenance audit system, wherein a client initiates a TCP connection A to a single sign-on device according to target information; a single sign-on device forwarding module receives the connection and takes out corresponding session ID and protocol information in the memory as request data, and initiates a TCP connection B to an engine listening module and sends the request data. The engine listening module receives the TCP connection B and analyzes the request data, if the analysis fails, the engine listening module sends rejection information to the single sign-on device, and the session ends; if the analysis succeeds, the engine listening module sends confirmation information to the single sign-on device, and checks whether corresponding data processing processes exist in the system cache based on the session ID, if the data processing processes exist, the session is aggregated and forwarded to a socket, otherwise, a new data processing process is started and a session control channel is established and forwarded to a socket. The application only needs to open one operation and maintenance port, is simple to use, can perform session aggregation at low cost, and has good practicability.

Description

Technical Field

[0001] The present invention belongs to the technical field of operation and maintenance auditing, and in particular relates to a session aggregation method and system for an operation and maintenance auditing system based on a single port. Background Art

[0002] An operations audit system is an operations system used between clients and services to control and audit operations personnel's behavior. TCP (Transmission Control Protocol) is a connection-oriented, reliable, byte-stream-based transport layer communication protocol. Operations audits typically support multiple application protocols, such as SSH, RDP, MySQL, and PostgreSQL. To distinguish and process different protocols within the engine, the common practice is to listen on different ports for each protocol, connecting to different handlers. However, as the number of supported protocols increases, so too does the number of ports occupied, increasing the risk of attack. Furthermore, applications such as databases often initiate multiple TCP connections within a single session. Some operations audit systems do not aggregate these connections into a single session. While this allows for complete audit data, it compromises the integrity of the session. Some operations audit systems aggregate multiple TCP connections into a single session through inter-process or inter-thread communication. However, this approach increases implementation complexity and consumes more system resources.

[0003] In summary, existing operation and maintenance audit systems commonly suffer from two problems: first, they open different ports for different operation and maintenance protocols, resulting in excessive port openings and increasing the risk of attacks; second, if a session contains multiple TCP connections, the data from each connection is not aggregated into a single session, or complex and resource-intensive methods are used to aggregate the sessions. Therefore, to address these issues, the present invention provides a method for aggregating sessions that only requires opening and monitoring a single operation and maintenance port, and is simple and resource-efficient. This method is simple to use and low-cost. Summary of the Invention

[0004] The purpose of the present invention is to provide a session aggregation method and system for an operation and maintenance audit system based on a single port, aiming to solve the above-mentioned problems.

[0005] The present invention is mainly achieved through the following technical solutions:

[0006] A session aggregation method for an operation and maintenance audit system based on a single port, comprising the following steps:

[0007] Step S1: Log in to the operation and maintenance audit system and configure information for operation and maintenance;

[0008] Step S2: The browser calls the single sign-on device and transmits the session ID and protocol information as parameters to the single sign-on device;

[0009] Step S3: The SSO generates a random port, binds the session ID and protocol information to the port, and saves them in memory; the SSO uses the local IP and port as the client's target information to call the client;

[0010] Step S4: The client initiates a TCP connection A to the SSO according to the target information; the SSO forwarding module receives the connection and listens to obtain the local IP and port P information, then retrieves the corresponding session ID and protocol information from the memory as the request data. The SSO forwarding module initiates a TCP connection B to the engine monitoring module and sends the request data through TCP connection B;

[0011] Step S5: The engine monitoring module receives TCP connection B and parses the request data. If the parsing fails, the engine monitoring module sends a rejection message to the single sign-on device, and the session ends. If the parsing succeeds, the engine monitoring module sends a confirmation message to the single sign-on device, and the process proceeds to step S6.

[0012] Step S6: Take out the session ID from the parsed data and search the system cache to see if the corresponding data processing process exists. If so, aggregate the session forwarding socket. Otherwise, enable a new data processing process, associate the session ID with the data processing process, store it in the system cache, and establish a session control channel forwarding socket.

[0013] In order to better implement the present invention, further, in step S5, if the single sign-on device receives a rejection message, the TCP connection A and the TCP connection B are closed, and the monitoring of the current session is closed.

[0014] In order to better implement the present invention, further, in step S5, if the single sign-on device receives the confirmation information, it enters the data forwarding stage and converts the data of TCP connection A and TCP connection B to each other.

[0015] In order to better implement the present invention, further, in step S3, the single sign-on forwarding module randomly generates an available port and uses the port to create a new TCP socket to monitor the TCP connection from the session ID.

[0016] In order to better implement the present invention, further, in step S6, if it exists, the socket handle of this connection is forwarded to the data processing process through the session control channel; otherwise, the engine monitoring module forwards the socket and protocol information of this connection to the new data processing process through the newly created session control channel.

[0017] In order to better realize the present invention, further,

[0018] A session aggregation system for an operation and maintenance audit system based on a single port is based on the above method and includes a single sign-on device, a browser is connected to the single sign-on device and the operation and maintenance audit system respectively, and the single sign-on device is connected to the client; the single sign-on device includes a single sign-on device forwarding module, and the operation and maintenance audit system includes an engine monitoring module, the single sign-on device forwarding module is connected to the engine monitoring module, and the engine monitoring module is used to monitor the port of the single sign-on device forwarding module and merge or create a new session data processing process.

[0019] The beneficial effects of the present invention are as follows:

[0020] The present invention uses caching and TCP forwarding technology to enable the operation and maintenance audit system to only monitor one port, thereby reducing the risk of being attacked. The present invention only monitors one port externally, regardless of the number of application protocols supported by the operation and maintenance audit system, thereby achieving the purpose of port aggregation. The present invention adds access request data before the real operation and maintenance data, adds custom request data before the application protocol data, and uses a single process to handle multiple connections in the same session, aggregating multiple TCP connections into a session processing process, thereby ensuring the integrity of the session display, and the implementation method is simple and resource consumption is low. In summary, the present invention only needs to open one operation and maintenance port, is simple to use, can perform session aggregation at a low cost, and has good practicality. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 This is an operation flow chart of a session aggregation method for an operation and maintenance audit system based on an operation and maintenance port;

[0022] Figure 2 This is a structural diagram of the session aggregation system of the operation and maintenance audit system based on the operation and maintenance port. DETAILED DESCRIPTION

[0023] Example 1:

[0024] A session aggregation system for an operation and maintenance audit system based on a single port, such as Figure 2 As shown, it includes a browser, a single sign-on, a third-party client, an operation and maintenance audit system, and a server. The single sign-on includes a single sign-on main module and a single sign-on forwarding module. The operation and maintenance audit system includes a configuration module and an engine monitoring module.

[0025] System operation mainly includes the following steps:

[0026] 1) Log in to the operation and maintenance audit system, the engine module monitoring port, and configure the server IP and account information;

[0027] 2) The browser calls the single sign-on device;

[0028] 3) The single sign-on device calls the client;

[0029] 4) The client accesses the single sign-on forwarding module;

[0030] 5) The single sign-on forwarding module accesses the engine monitoring module;

[0031] 6) The engine monitoring module receives the access request and parses the request data;

[0032] 7) The engine monitors the parsed data and determines whether an aggregated session is needed, thereby enabling or reusing the data processing program to process the data.

[0033] Specifically, the browser calls the single sign-on module: the browser passes the session ID and the server's protocol and engine monitoring information to the single sign-on module.

[0034] Specifically, the single sign-on server calls the client:

[0035] a. The SSO forwarding module randomly generates an available port (binds information and caches it) and creates a new TCP socket using that port to listen for connections from the session ID.

[0036] b. The single sign-on client calls the client and uses the port and local IP address from step a as the client's target information.

[0037] Specifically, the main process of the single sign-on device forwarding data is as follows:

[0038] a. The client initiates a TCP connection A based on the target information;

[0039] b. After receiving TCP connection A, the single sign-on forwarding module assembles the engine access data according to the current socket port;

[0040] c. The single sign-on forwarding module initiates a TCP connection B to the engine according to the engine monitoring information in step 1);

[0041] d. The single sign-on forwarding module sends a request to the engine monitoring module;

[0042] e. If the single sign-on forwarding module receives a rejection message, it closes TCP connection A and the current session monitor, and the session ends;

[0043] f. If the single sign-on forwarding module receives the confirmation information, it forwards data from the client and engine monitoring modules to forward data from TCP connection A to TCP connection B, and data from TCP connection B to TCP connection A.

[0044] Specifically, the main process of the engine monitoring module parsing request data is as follows:

[0045] a. The engine monitoring module receives the connection request information from the single sign-on device to parse the protocol and session information;

[0046] b. If the resolution fails, access is denied, a rejection message is sent to the single sign-on server, and the connection is disconnected;

[0047] c. If the resolution is successful, a confirmation message is sent to the single sign-on server.

[0048] Specifically, the main process of the engine monitoring module processing connections is:

[0049] a engine monitoring module according to step 6) information, remove the session id;

[0050] b. If the session ID already exists in the cache, the data for this connection belongs to an existing session. The session needs to be aggregated and the data processing process associated with the session ID needs to be reused. The specific operation is to forward the socket handle of this connection to the data processing process through the session control channel.

[0051] c. If the session ID does not exist in the cache, it means that the data for this connection comes from a new session. A new data processing process needs to be started and the session ID needs to be associated with this process. The data processing process will establish a session control channel, and the engine monitoring module will forward the socket and protocol information of this connection to the process through the session control channel.

[0052] After the socket is forwarded, the connection between the single sign-on device and the engine listener becomes a connection between the single sign-on device and the data processing program.

[0053] Example 2:

[0054] A session aggregation method for an operation and maintenance audit system based on a single port, such as Figure 1 As shown, the following steps are included:

[0055] 1) Log in to the system and configure information, then click Operation and Maintenance: The operator first logs in to the client system, configures relevant information using the configuration module, and selects a server for operation and maintenance on the Operation and Maintenance page.

[0056] 2) The browser calls the single sign-on (SSO) and passes parameters: The browser obtains the session ID from the system backend and calls the SSO with the session ID and protocol information as parameters.

[0057] 3) The single sign-on device starts local monitoring: The single sign-on device generates a random port P, performs local monitoring, binds the session ID and protocol information to port P, and saves them in memory.

[0058] 4) The single sign-on device calls the third-party client: The single sign-on device uses the local IP address and port P as the target information of the client and starts the client.

[0059] 5) The client initiates a TCP connection A to the single sign-on device: The client initiates a TCP connection A to the local IP and port P.

[0060] 6) The single sign-on forwarding module receives TCP connection A, obtains monitoring information from connection A, finds that it is the local IP address and port P, and retrieves the corresponding session ID and protocol information from the memory.

[0061] 7) The single sign-on forwarding module initiates TCP connection B to the engine monitoring module, and then sends the session ID and protocol information obtained in step 6) as request data through TCP connection B.

[0062] 8) The engine monitoring module receives the connection B from the single sign-on device and starts to parse the data. If the parsing fails, a rejection message is sent. At this time, the single sign-on device receives the rejection message, closes the TCP connections A and B, and turns off the monitoring of the current session, then closes the connection, and the session ends. If the parsing is successful, a confirmation message is sent. At this time, the single sign-on device receives the confirmation message and enters the data forwarding stage, that is, the data of A and B are converted to each other, and then enters step 9).

[0063] 9) The engine retrieves the session ID from the parsed data and searches the system cache for the corresponding data processing process. If so, it proceeds to step 10. If not, this indicates that this TCP connection is the first in a new session. A new data processing process is started, using the session ID and protocol information as parameters. This process establishes a session control channel with the engine monitoring module, which forwards the socket for this connection to the data processing process through this channel. The engine monitoring program associates the session ID with the data processing process and stores it in the system cache, proceeding to step 11.

[0064] 10) The data processing process corresponding to the session ID already exists in the system cache. This indicates that the connection was automatically initiated by the client and forwarded by the single sign-on server. Therefore, the current TCP needs to be aggregated into the existing session data processing process. The corresponding TCP socket is forwarded to the corresponding data processing process.

[0065] 11) Forwarding the TCP socket to the data processing process means that the data processing process takes over the TCP connection, so that the interaction between the single sign-on forwarding module and the engine monitoring module becomes the interaction between the single sign-on forwarding module and the engine data processing process.

[0066] 12) If the operator wants to operate a new session at the same time, the above steps will be repeated.

[0067] 13) After the operation and maintenance is completed, the operator closes the client, each module closes the corresponding TCP connection, and the session ends.

[0068] By utilizing caching and TCP forwarding technologies, the present invention enables the operation and maintenance audit system to monitor only one port, reducing the risk of attack. Regardless of the number of application protocols supported by the operation and maintenance audit system, the present invention monitors only one port, achieving the purpose of port aggregation. By adding access request data before actual operation and maintenance data, adding custom request data before application protocol data, and using a single process to handle multiple connections within the same session, the present invention aggregates multiple TCP connections into a single session processing process, ensuring the complete presentation of the session. Furthermore, the present invention is simple to implement and consumes minimal resources.

[0069] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any simple modification or equivalent change made to the above embodiment based on the technical essence of the present invention shall fall within the scope of protection of the present invention.

Claims

1. A session aggregation method for an operation and maintenance audit system based on a single port, characterized in that: The following steps are involved: Step S1: Log in to the operation and maintenance audit system and configure information for operation and maintenance; Step S2: The browser calls the single sign-on device and transmits the session ID and protocol information as parameters to the single sign-on device; Step S3: The single sign-on device generates a random port, binds the session ID and protocol information to the port, and saves them in memory; The single sign-on client uses the local IP address and port number as the client's target information to call the client. Step S4: The client initiates a TCP connection A to the SSO according to the target information; the SSO forwarding module receives the connection and listens to obtain the local IP and port P information, then retrieves the corresponding session ID and protocol information from the memory as the request data. The SSO forwarding module initiates a TCP connection B to the engine monitoring module and sends the request data through TCP connection B; Step S5: The engine monitoring module receives TCP connection B and parses the request data. If the parsing fails, the engine monitoring module sends a rejection message to the single sign-on device, and the session ends. If the parsing succeeds, the engine monitoring module sends a confirmation message to the single sign-on device, and the process proceeds to step S6. Step S6: Take out the session ID from the parsed data and search the system cache to see if the corresponding data processing process exists. If so, aggregate the session forwarding socket. Otherwise, enable a new data processing process, associate the session ID with the data processing process, store it in the system cache, and establish a session control channel forwarding socket.

2. The session aggregation method of the operation and maintenance audit system based on a single port according to claim 1, characterized in that: In step S5, if the single sign-on device receives a rejection message, it closes the TCP connection A and the TCP connection B, and closes the monitoring of the current session.

3. The session aggregation method of the operation and maintenance audit system based on a single port according to claim 2, characterized in that: In step S5, if the single sign-on device receives the confirmation information, it enters the data forwarding phase and transfers the data of TCP connection A and TCP connection B to each other.

4. The session aggregation method of the operation and maintenance audit system based on a single port according to claim 1, characterized in that: In step S3, the single sign-on forwarding module randomly generates an available port and creates a new TCP socket using the port to monitor the TCP connection from the session ID.

5. The session aggregation method of the operation and maintenance audit system based on a single port according to claim 1, characterized in that: In step S6, if it exists, the socket handle of this connection is forwarded to the data processing process through the session control channel; otherwise, the engine monitoring module forwards the socket and protocol information of this connection to the new data processing process through the newly created session control channel.

6. A session aggregation system for an operation and maintenance audit system based on a single port, based on the method according to any one of claims 1 to 5, characterized in that: It includes a single sign-on device, the browser is connected to the single sign-on device and the operation and maintenance audit system respectively, and the single sign-on device is connected to the client; the single sign-on device includes a single sign-on device forwarding module, and the operation and maintenance audit system includes an engine monitoring module. The single sign-on device forwarding module is connected to the engine monitoring module, and the engine monitoring module is used to monitor the port of the single sign-on device forwarding module and merge or create a new session data processing process.

Images