Deployment method and device of bastion host, electronic equipment and storage medium

Abstract

The invention provides a bastion host deployment method which can be applied to the technical field of information security and the technical field of finance. The method is applied to a deployment platform, and comprises the following steps: in response to a deployment request of a bastion host, obtaining a target configuration template under the condition of determining that a target configuration template corresponding to a deployment type contained in the deployment request exists in a configuration template library; under the condition that it is determined that the user operation data corresponding to the deployment type exists in the database, the user operation data are obtained, and the user operation data represent operation behavior data of a user corresponding to the deployment type; generating a target configuration file according to the target configuration template and the user operation data; and in response to a confirmation operation for the target configuration file, creating the bastion host for the user corresponding to the deployment type by using the target configuration file. The invention further provides a bastion host deployment device, equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the fields of information security technology and financial technology, and specifically to a deployment method, device, equipment, medium and program product of a bastion host. Background Art

[0002] With the development of information technology, the information systems within enterprises have become more and more complex, and network security management has become an important issue. As an intermediate proxy device, the bastion server (Jump Server) is widely used in the security management of enterprise internal systems. Its main function is to centrally manage the access rights of various systems within the enterprise and ensure access security through a unified identity authentication and authorization mechanism. However, in related technologies, it is generally necessary to manually design the configuration template of the bastion server and manually fill in the configuration data, which makes the deployment and configuration process of the bastion server complicated, time-consuming and labor-intensive, resulting in low deployment efficiency. Summary of the invention

[0003] In view of the above problems, the present disclosure provides a bastion host deployment method, apparatus, device, medium and program product that improve the efficiency of bastion host deployment.

[0004] According to a first aspect of the present disclosure, a bastion host deployment method is provided, which is applied to a deployment platform, and the method includes: in response to a deployment request of the bastion host, when it is determined that a target configuration template corresponding to a deployment type included in the deployment request exists in a configuration template library, obtaining the target configuration template; when it is determined that user operation data corresponding to the deployment type exists in a database, obtaining the user operation data, wherein the user operation data represents operation behavior data of a user corresponding to the deployment type; generating a target configuration file according to the target configuration template and the user operation data; and in response to a confirmation operation on the target configuration file, creating a bastion host for the user corresponding to the deployment type using the target configuration file.

[0005] According to an embodiment of the present disclosure, generating a target configuration file according to the target configuration template and the user operation data includes: inputting the target configuration template and the user operation data into a pre-trained configuration file generation model, and outputting the target configuration file.

[0006] According to an embodiment of the present disclosure, the target configuration template includes at least one field to be configured; the target configuration template and the user operation data are input into a pre-trained configuration file generation model, and outputting the target configuration file includes: for each of the fields to be configured, determining the data to be configured corresponding to the field to be configured according to the user operation data; and filling the target configuration template with the data to be configured to obtain the target configuration file.

[0007] According to an embodiment of the present disclosure, the method further includes: in response to a modification operation on the target configuration file, recording modification information corresponding to the target configuration file; and adjusting network parameters of the configuration file generation model using the modification information and the target configuration file.

[0008] According to an embodiment of the present disclosure, the above method also includes, when it is determined that there is a security machine limit policy, optimizing the above target configuration file using the above security machine limit policy to obtain a first optimization configuration file; the above response to the confirmation operation on the above target configuration file, using the above target configuration file, creating a bastion host for the user corresponding to the above deployment type includes: responding to the confirmation operation on the above first optimization configuration file, using the above first optimization configuration file to create a bastion host for the user corresponding to the above deployment type.

[0009] According to an embodiment of the present disclosure, the above method also includes: according to a preset access control policy, determining a target authentication method corresponding to the above deployment type from at least one preset authentication method; optimizing the above target configuration file using the above target authentication method to obtain a second optimized configuration file; the above response to the confirmation operation on the above target configuration file, using the above target configuration file, creating a bastion host for the user corresponding to the above deployment type includes: in response to the confirmation operation on the above second optimized configuration file, using the above second optimized configuration file, creating a bastion host for the user corresponding to the above deployment type.

[0010] According to an embodiment of the present disclosure, the above method also includes: when it is determined that the target configuration template corresponding to the above deployment type does not exist in the above configuration template library, displaying a first configuration page for generating a configuration template; in response to the first configuration information input on the above first configuration page, generating a configuration template corresponding to the above deployment type to obtain the above target configuration template; adding the configuration template corresponding to the above deployment type to the above configuration template library.

[0011] According to an embodiment of the present disclosure, the above method also includes: when it is determined that there is no user operation data corresponding to the above deployment type in the above database, displaying a second configuration page for generating a configuration file; in response to the second configuration information input in the above second configuration page, generating a configuration file corresponding to the above deployment type to obtain the above target configuration file.

[0012] A second aspect of the present disclosure provides a deployment device for a bastion host, which is applied to a deployment platform, and the device includes: a first acquisition module, which is used to respond to a deployment request of the bastion host, and obtain the above-mentioned target configuration template when it is determined that there is a target configuration template corresponding to the deployment type included in the above-mentioned deployment request in the configuration template library; a second acquisition module, which is used to obtain the above-mentioned user operation data when it is determined that there is user operation data corresponding to the above-mentioned deployment type in the database, wherein the above-mentioned user operation data represents the operation behavior data of the user corresponding to the above-mentioned deployment type; a first generation module, which is used to generate a target configuration file according to the above-mentioned target configuration template and the above-mentioned user operation data; and a creation module, which is used to create a bastion host for the user corresponding to the above-mentioned deployment type by using the above-mentioned target configuration file in response to a confirmation operation on the above-mentioned target configuration file.

[0013] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0014] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the above computer program or instructions are executed by a processor.

[0015] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor.

[0016] According to the embodiments of the present disclosure, by responding to the deployment request of the bastion host, the target configuration template corresponding to the deployment type is obtained from the configuration template library, and the user operation data corresponding to the deployment type is obtained from the database; then, the target configuration file is generated according to the target configuration template and the user operation data; thereafter, in response to the confirmation operation for the target configuration file, the bastion host is created for the user corresponding to the deployment type using the target configuration file. At least the technical problem of low deployment efficiency caused by the need for manual configuration templates in the related technology is solved, and the technical effect of automatically deploying the bastion host and improving deployment efficiency and accuracy is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0018] Figure 1 The application scenario diagram of the deployment method, apparatus, device, medium and program product of the bastion host according to the embodiment of the present disclosure is schematically shown;

[0019] Figure 2 A flowchart of a method for deploying a bastion host according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 3 A flowchart of a method for deploying a bastion host according to another embodiment of the present disclosure is schematically shown;

[0021] Figure 4 A flowchart of a configuration file generation method according to an embodiment of the present disclosure is schematically shown;

[0022] Figure 5 The schematic diagram schematically shows the principle of the method for deploying a bastion host according to an embodiment of the present disclosure;

[0023] Figure 6 The structure block diagram of the deployment device of the bastion host according to the embodiment of the present disclosure is schematically shown;

[0024] Figure 7 A structural block diagram schematically shows a deployment device of a bastion host according to another embodiment of the present disclosure; and

[0025] Figure 8 A block diagram of an electronic device suitable for implementing a bastion host deployment method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0026] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0027] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0028] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0029] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0030] It should be noted that the deployment method and device of the bastion host of the embodiments of the present disclosure can be used in the fields of information security technology and financial technology, and can also be used in any field other than the fields of information security technology and financial technology. The application field of the deployment method and device of the bastion host of the embodiments of the present disclosure is not limited.

[0031] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0032] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0033] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0034] A Jump Server is a server that uses various technical means to monitor and record the operations of servers, network devices, security devices, databases and other devices within the network in a specific network environment in order to protect the network and data from intrusion and damage from external and internal users, so as to centrally issue alarms, handle them in a timely manner, and audit and determine responsibilities.

[0035] With the development of information technology, the information systems within enterprises have become more and more complex. As an intermediate proxy device, bastion hosts are widely used in the security management of enterprise internal systems. However, in related technologies, it is generally necessary to manually design the configuration template of the bastion host and manually fill in the configuration data, which makes the deployment and configuration process of the bastion host complicated, time-consuming and labor-intensive, and requires professional operation and maintenance personnel to operate, resulting in low deployment efficiency.

[0036] In order to solve the above technical problems, an embodiment of the present disclosure provides a bastion host deployment method, which is applied to a deployment platform, and the method includes: in response to a deployment request of the bastion host, when it is determined that a target configuration template corresponding to a deployment type included in the deployment request exists in a configuration template library, obtaining a target configuration template; when it is determined that user operation data corresponding to the deployment type exists in a database, obtaining user operation data, wherein the user operation data represents operation behavior data of a user corresponding to the deployment type; generating a target configuration file according to the target configuration template and the user operation data; and in response to a confirmation operation on the target configuration file, using the target configuration file to create a bastion host for the user corresponding to the deployment type.

[0037] Figure 1 The application scenario diagram of the deployment method, apparatus, device, medium and program product of the bastion host according to the embodiment of the present disclosure is schematically shown.

[0038] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0039] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0040] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0041] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0042] It should be noted that the deployment method of the bastion host provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the deployment device of the bastion host provided in the embodiment of the present disclosure can generally be set in the server 105. The deployment method of the bastion host provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Correspondingly, the deployment device of the bastion host provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0043] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to the implementation requirements.

[0044] The following will be based on Figure 1 The scene described by Figure 2~Figure 8 The deployment method, apparatus, device, medium and program product of the bastion host of the disclosed embodiment are described in detail.

[0045] Figure 2 A flowchart of a bastion host deployment method according to an embodiment of the present disclosure is schematically shown.

[0046] The deployment method of the bastion host according to the embodiment of the present disclosure can be applied to the deployment platform.

[0047] like Figure 2 As shown, the bastion host deployment method of this embodiment includes operations S210 to S240, and the bastion host deployment method can be executed by a server.

[0048] In operation S210, in response to a deployment request from a bastion host, if it is determined that a target configuration template corresponding to the deployment type included in the deployment request exists in a configuration template library, the target configuration template is acquired.

[0049] According to an embodiment of the present disclosure, a deployment request may be generated after a user inputs a deployment type in a deployment interface. The deployment type may include a user type of the user to be deployed and a user level of the user to be deployed. The user type may be a job type, such as a business person, a research and development person, etc. The user type may also be a department type, such as a business department, a research and development department, etc. The user level may be a user's position level, such as an ordinary employee, a team leader, a manager, etc.

[0050] According to an embodiment of the present disclosure, at least one configuration template is stored in the configuration template library. The configuration template may be a manually designed configuration template or may be generated based on the user's system configuration data, user behavior data, and historical operation logs.

[0051] In one of the embodiments, a probe can be installed on an electronic device used by a user to collect system configuration data, user behavior data, and historical operation logs of the electronic device. After analyzing the system configuration data, user behavior data, and historical operation logs of the electronic device, a configuration template corresponding to the user type is generated and added to a configuration template library.

[0052] In an embodiment of the present disclosure, before installing a probe on a user's electronic device and collecting system configuration data, user behavior data, and historical operation logs of the electronic device, the user's consent or authorization may be obtained. For example, before operation S210, a request to install a probe to facilitate collecting system configuration data, user behavior data, and historical operation logs of the electronic device may be issued to the user. With the user's consent or authorization, the operation S210 is performed.

[0053] According to an embodiment of the present disclosure, the target configuration template may include at least one field to be configured, and the field to be configured may include hard disk, CPU, system type, software type, etc. Specifically, the target configuration template may be in the form of key: value, where value is a null value.

[0054] According to the embodiments of the present disclosure, different user types can use different systems and involve different access rights. Different user levels also involve different access rights. Therefore, it is necessary to configure the user type and user level so as to obtain the target configuration template corresponding to the deployment type.

[0055] In operation S220, if it is determined that the database contains user operation data corresponding to the deployment type, the user operation data is acquired, wherein the user operation data represents operation behavior data of the user corresponding to the deployment type.

[0056] According to an embodiment of the present disclosure, system configuration data, user behavior data, and historical operation logs of electronic devices used by users are regularly collected and stored in a database. When configuring a bastion host, user operation data corresponding to the deployment type, such as user behavior data and historical operation logs, are obtained from the database to fill in the value in the target configuration template based on the data.

[0057] According to an embodiment of the present disclosure, when it is determined that there is no user operation data corresponding to the above deployment type in the database, it is necessary to manually fill in the value in the target configuration template.

[0058] In operation S230, a target configuration file is generated according to the target configuration template and the user operation data.

[0059] According to an embodiment of the present disclosure, the target configuration file may include at least one field to be configured and data corresponding to each field to be configured. Specifically, the target configuration file may be in the form of key:value, where value is a non-null value.

[0060] According to an embodiment of the present disclosure, generating a target configuration file according to the target configuration template and the user operation data may include: using the user operation data to fill in data corresponding to the field to be configured in the target configuration template. Specifically, extracting the value corresponding to the key from the user operation data for filling.

[0061] In operation S240 , in response to a confirmation operation on the target configuration file, a bastion host is created for a user corresponding to the deployment type using the target configuration file.

[0062] According to an embodiment of the present disclosure, after the configuration file is generated, the configuration file can be displayed so that the user can confirm whether the configuration file is reasonable. If it is reasonable, click the confirmation operation and create the bastion host with one click.

[0063] According to an embodiment of the present disclosure, the target configuration file may further include a configuration method, such as creating a bastion host for each user or creating a bastion host for every M users, where M≥2.

[0064] In some embodiments, creating a bastion host for a user corresponding to the above deployment type may include: creating a bastion host for each user corresponding to the deployment type. For example, if the users corresponding to the deployment type include user A, user B, and user C, then a bastion host is created for user A, a bastion host is created for user B, and a bastion host is created for user C.

[0065] In other embodiments, creating a bastion host for users corresponding to the above deployment type may include: creating a bastion host for at least two users among the users corresponding to the deployment type. For example, if the users corresponding to the deployment type include user A, user B, user C, user D, and user E, then a bastion host is created for user A and user B, and a bastion host is created for user C, user D, and user E, that is, user A and user B share one bastion host, and user C, user D, and user E share one bastion host.

[0066] According to the embodiments of the present disclosure, by responding to the deployment request of the bastion host, the target configuration template corresponding to the deployment type is obtained from the configuration template library, and the user operation data corresponding to the deployment type is obtained from the database; then, the target configuration file is generated according to the target configuration template and the user operation data; thereafter, in response to the confirmation operation for the target configuration file, the bastion host is created for the user corresponding to the deployment type using the target configuration file. At least the technical problem of low deployment efficiency caused by the need for manual configuration templates in the related technology is solved, and the technical effect of automatically deploying the bastion host and improving deployment efficiency and accuracy is achieved.

[0067] According to an embodiment of the present disclosure, the above method also includes: when it is determined that the target configuration template corresponding to the above deployment type does not exist in the above configuration template library, displaying a first configuration page for generating a configuration template; in response to the first configuration information input on the above first configuration page, generating a configuration template corresponding to the above deployment type to obtain the above target configuration template; adding the configuration template corresponding to the above deployment type to the above configuration template library.

[0068] According to an embodiment of the present disclosure, the first configuration information may be at least one field to be configured.

[0069] According to an embodiment of the present disclosure, when there is no configuration template corresponding to the deployment type in the configuration template library, it is necessary to manually configure the template. The user can determine at least one field to be configured based on the deployment type analysis, and then configure the field to be configured on the first configuration page to generate a target configuration template.

[0070] In some of the embodiments, when it is determined that there is no target configuration template corresponding to the above-mentioned deployment type in the above-mentioned configuration template library, the user can select a configuration template from the configuration template library and display the configuration template on the first configuration page, so that the user can modify and adjust the selected configuration template to improve configuration efficiency.

[0071] According to an embodiment of the present disclosure, the above method also includes: when it is determined that there is no user operation data corresponding to the above deployment type in the above database, displaying a second configuration page for generating a configuration file; in response to the second configuration information input in the above second configuration page, generating a configuration file corresponding to the above deployment type to obtain the above target configuration file.

[0072] According to an embodiment of the present disclosure, the second configuration information may be data to be configured corresponding to the field to be configured. When there is no user operation data corresponding to the deployment type in the database, the data to be configured needs to be manually configured. The user can determine the data to be configured corresponding to at least one field to be configured based on the deployment type analysis. For example, if the field to be configured is CPU, if the deployment type is business personnel, a smaller CPU can be configured, and if the deployment type is R&D personnel, a larger CPU can be configured; then configure the data to be configured on the second configuration page to generate a target configuration file.

[0073] Figure 3 A flowchart of a method for deploying a bastion host according to another embodiment of the present disclosure is schematically shown.

[0074] like Figure 3 As shown, the deployment method of the bastion host of this embodiment includes operations S301 to S311.

[0075] In operation S301, in response to a deployment request from a bastion host, a deployment type included in the deployment request is obtained, wherein the deployment type includes a user type and a user level.

[0076] In operation S302, it is determined whether there is a target configuration template corresponding to the deployment type in the configuration template library. If so, operation S303 is executed; if not, operations S304 to S305 are executed.

[0077] In operation S303, a target configuration template is acquired, and then operation S306 is performed.

[0078] In operation S304, a first configuration page for generating a configuration template is displayed.

[0079] In operation S305 , in response to the first configuration information input on the first configuration page, a configuration template corresponding to the deployment type is generated, a target configuration template is obtained, and then operation S306 is performed.

[0080] In operation S306, it is determined whether there is user operation data corresponding to the deployment type in the database. If not, operations S307 to S308 are executed; if so, operations S309 to S310 are executed.

[0081] In operation S307 , a second configuration page for generating a configuration file is displayed, and the second configuration page displays a target configuration template.

[0082] In operation S308 , in response to the second configuration information input on the second configuration page, a target configuration file corresponding to the deployment type is generated, and then operation S311 is performed.

[0083] In operation S309, user operation data is acquired.

[0084] In operation S310, a target configuration file is generated according to a target configuration template and user operation data, and then operation S311 is performed.

[0085] In operation S311 , in response to a confirmation operation on the target configuration file, a bastion host is created for a user corresponding to the deployment type using the target configuration file.

[0086] According to an embodiment of the present disclosure, generating a target configuration file according to the target configuration template and the user operation data includes: inputting the target configuration template and the user operation data into a pre-trained configuration file generation model, and outputting the target configuration file.

[0087] According to an embodiment of the present disclosure, the configuration file generation model may include a neural network, a decision tree, etc. The present application does not limit the specific type of the configuration file generation model.

[0088] According to the embodiments of the present disclosure, the configuration file generation model can be trained using methods commonly used in related technologies, and the present application does not limit the training method of the configuration file generation model.

[0089] According to the embodiments of the present disclosure, the target configuration file is automatically generated by using the configuration file generation model, thereby improving the intelligence level of the deployment platform.

[0090] Figure 4 The flowchart of the configuration file generation method according to the embodiment of the present disclosure is schematically shown.

[0091] like Figure 4 As shown, the configuration file generating method of this embodiment includes operations S410 to S450.

[0092] In operation S410, the target configuration template and user operation data are input into a pre-trained configuration file generation model.

[0093] According to an embodiment of the present disclosure, the target configuration template includes at least one field to be configured, for example, the target configuration template includes field to be configured 1 such as CPU, field to be configured 2 such as memory and field to be configured 3 such as system type.

[0094] According to an embodiment of the present disclosure, the user operation data may include all operations performed by the user on the electronic device. For example, the user operation data includes system type information of the user operation, CPU usage information during the user operation, and the like.

[0095] In operation S420, for each field to be configured, to-be-configured data corresponding to the field to be configured is determined according to user operation data.

[0096] According to an embodiment of the present disclosure, for example, the field to be configured is CPU. Since the user operation data includes CPU usage information, for example, 1G, the value corresponding to the CPU in the target configuration template can be determined according to the CPU usage information, for example, 2G.

[0097] In operation S430, a target configuration template is filled with the data to be configured to obtain a target configuration file.

[0098] In operation S440 , in response to the modification operation on the target configuration file, modification information corresponding to the target configuration file is recorded.

[0099] According to an embodiment of the present disclosure, after the target configuration file is generated, the user is required to verify the target configuration file, for example, to verify whether the target configuration file contains all the required fields to be configured; for example, to verify whether the data to be configured corresponding to each field to be configured is reasonable. After the user confirms the target configuration file, the bastion host is created using the target configuration file. When the user modifies part of the information in the target configuration file, the modification information is recorded. The modification information may include the content before the modification, the content after the modification, and the time of the modification, etc.

[0100] In operation S450, network parameters of the profile generation model are adjusted using the modification information and the target profile.

[0101] According to an embodiment of the present disclosure, the configuration file generation model is iterated using the modification information and the target configuration file, so that the configuration file generation model is more intelligent.

[0102] According to an embodiment of the present disclosure, the above method also includes, when it is determined that there is a security machine limit policy, optimizing the above target configuration file using the above security machine limit policy to obtain a first optimization configuration file; the above response to the confirmation operation on the above target configuration file, using the above target configuration file, creating a bastion host for the user corresponding to the above deployment type includes: responding to the confirmation operation on the above first optimization configuration file, using the above first optimization configuration file to create a bastion host for the user corresponding to the above deployment type.

[0103] According to an embodiment of the present disclosure, the security machine limit policy may be a security policy based on the operating system. The security machine limit policy may be configured according to actual needs. For industries with relatively high security requirements, such as financial institutions and medical institutions, a security machine limit policy may be configured. When a security machine limit policy is configured, the security machine limit policy may be added to the target configuration file.

[0104] According to an embodiment of the present disclosure, the above method also includes: according to a preset access control policy, determining a target authentication method corresponding to the above deployment type from at least one preset authentication method; optimizing the above target configuration file using the above target authentication method to obtain a second optimized configuration file; the above response to the confirmation operation on the above target configuration file, using the above target configuration file, creating a bastion host for the user corresponding to the above deployment type includes: in response to the confirmation operation on the above second optimized configuration file, using the above second optimized configuration file, creating a bastion host for the user corresponding to the above deployment type.

[0105] According to an embodiment of the present disclosure, at least one authentication method may include password authentication, fingerprint authentication, face recognition authentication, etc.

[0106] According to an embodiment of the present disclosure, the deployment type includes a user type, and an authentication method corresponding to the user type is determined according to the user type. If the user type has a higher access right, multiple authentication methods can be selected for authentication, and if the user type has a normal access right, one authentication method can be selected for authentication.

[0107] According to an embodiment of the present disclosure, the preset access control policy may include at least one access level and an authentication method corresponding to each access level. The access level may be a user level.

[0108] In some of the implementations, the preset access control policy includes access level 1, access level 2 and access level 3, the authentication methods corresponding to access level 1 include method a, method b and method c, the authentication methods corresponding to access level 2 include method a and method b, and the authentication methods corresponding to access level 3 include method a.

[0109] According to an embodiment of the present disclosure, according to a preset access control policy, determining a target authentication method corresponding to the above deployment type from at least one preset authentication method may include: determining a target access level corresponding to a user type included in the deployment type according to the preset access control policy; determining a target authentication method corresponding to the target access level. For example, if the access level corresponding to user type A is access level 1, the target authentication methods include method a, method b, and method c; for another example, if the access level corresponding to user type B is access level 2, the target authentication methods include method a and method b.

[0110] According to the embodiments of the present disclosure, by integrating multiple authentication methods and dynamic access control strategies, the flexibility and security of the system are enhanced to meet the needs of different application scenarios.

[0111] Figure 5 The schematic diagram schematically shows the principle of the deployment method of the bastion host according to an embodiment of the present disclosure.

[0112] like Figure 5 As shown, in this embodiment, before deploying the bastion host, user operation data 501 can be collected and stored in a database 502, and a configuration template 503 can be generated based on the collected user operation data 501, and the configuration template 503 can be stored in a configuration template library 505. At the same time, a configuration template 504 can be manually preset and stored in the configuration template library 505. Then, in response to a deployment request 506, a deployment type 507 included in the deployment request 506 is obtained, and then, according to the deployment type 507, the corresponding target user operation data 508 is obtained from the database 502, and according to the deployment type 507, the corresponding target configuration template 509 is obtained from the configuration template library 505; then, a target configuration file 510 is generated based on the target configuration template 509 and the target user operation data 508; then, whether the target configuration file 510 needs to be modified 511 is determined, and if it does not need to be modified, a bastion host 512 is created based on the target configuration file 510; if it needs to be modified, a modified configuration file 513 is generated after modification, and a bastion host 512 is created based on the modified configuration file 513.

[0113] Based on the above-mentioned bastion host deployment method, the present disclosure also provides a bastion host deployment device. Figure 6 The device is described in detail.

[0114] Figure 6 The structural block diagram of the deployment device of the bastion host according to an embodiment of the present disclosure is schematically shown.

[0115] like Figure 6As shown, the deployment device 600 of the bastion host of this embodiment can be applied to the deployment platform, and the device includes a first acquisition module 610, a second acquisition module 620, a first generation module 630 and a creation module 640.

[0116] The first acquisition module 610 is used to respond to the deployment request of the bastion host, and when it is determined that there is a target configuration template corresponding to the deployment type included in the above deployment request in the configuration template library, obtain the above target configuration template. In one embodiment, the first acquisition module 610 can be used to perform the operation S210 described above, which will not be repeated here.

[0117] The second acquisition module 620 is used to acquire the user operation data corresponding to the above deployment type when it is determined that the database contains the user operation data corresponding to the above deployment type, wherein the user operation data represents the operation behavior data of the user corresponding to the above deployment type. In one embodiment, the second acquisition module 620 can be used to perform the operation S220 described above, which will not be repeated here.

[0118] The first generating module 630 is used to generate a target configuration file according to the target configuration template and the user operation data. In one embodiment, the first generating module 630 can be used to perform the operation S230 described above, which will not be described in detail here.

[0119] The creation module 640 is used to create a bastion host for a user corresponding to the above deployment type using the above target configuration file in response to the confirmation operation for the above target configuration file. In one embodiment, the creation module 640 can be used to perform the operation S240 described above, which will not be repeated here.

[0120] According to an embodiment of the present disclosure, the above-mentioned first generation module includes: a generation submodule.

[0121] The generation submodule is used to input the target configuration template and the user operation data into a pre-trained configuration file generation model, and output the target configuration file.

[0122] According to an embodiment of the present disclosure, the target configuration template includes at least one field to be configured.

[0123] According to an embodiment of the present disclosure, the above-mentioned generating submodule includes: a determining submodule and a filling submodule.

[0124] The determination submodule is used to determine, for each of the fields to be configured, data to be configured corresponding to the field to be configured according to the user operation data.

[0125] The filling submodule is used to fill the target configuration template with the data to be configured to obtain the target configuration file.

[0126] According to an embodiment of the present disclosure, the above-mentioned device also includes: a recording module and an adjustment module.

[0127] The recording module is used to record the modification information corresponding to the target configuration file in response to the modification operation on the target configuration file.

[0128] The adjustment module is used to adjust the network parameters of the model generated by the configuration file using the modification information and the target configuration file.

[0129] According to an embodiment of the present disclosure, the above-mentioned device also includes: a first optimization module.

[0130] The first optimization module is used to optimize the target configuration file by using the safety machine limit strategy to obtain a first optimized configuration file when it is determined that there is a safety machine limit strategy.

[0131] According to an embodiment of the present disclosure, the creation module is also used to create a bastion host for a user corresponding to the deployment type using the first optimization profile in response to a confirmation operation on the first optimization profile.

[0132] According to an embodiment of the present disclosure, the above-mentioned device also includes: a determination module and a second optimization module.

[0133] The determination module is used to determine a target authentication method corresponding to the above deployment type from at least one preset authentication method according to a preset access control policy.

[0134] The second optimization module is used to optimize the target configuration file by using the target authentication method to obtain a second optimized configuration file.

[0135] According to an embodiment of the present disclosure, the creation module is also used to respond to a confirmation operation on the above-mentioned second optimization profile, and use the above-mentioned second optimization profile to create a bastion host for a user corresponding to the above-mentioned deployment type.

[0136] According to an embodiment of the present disclosure, the above-mentioned device also includes: a first display module, a second generation module and an adding module.

[0137] The first display module is used to display a first configuration page for generating a configuration template when it is determined that the target configuration template corresponding to the deployment type does not exist in the configuration template library.

[0138] The second generating module is used to generate a configuration template corresponding to the above deployment type in response to the first configuration information input on the above first configuration page, and obtain the above target configuration template.

[0139] An adding module is used to add the configuration template corresponding to the above deployment type to the above configuration template library.

[0140] According to an embodiment of the present disclosure, the above-mentioned device also includes: a second display module and a third generation module.

[0141] The second display module is used to display a second configuration page for generating a configuration file when it is determined that the user operation data corresponding to the deployment type does not exist in the database.

[0142] The third generating module is used to generate a configuration file corresponding to the above deployment type in response to the second configuration information input on the above second configuration page, and obtain the above target configuration file.

[0143] According to an embodiment of the present disclosure, any multiple modules of the first acquisition module 610, the second acquisition module 620, the first generation module 630, and the creation module 640 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the first acquisition module 610, the second acquisition module 620, the first generation module 630, and the creation module 640 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, at least one of the first acquisition module 610 , the second acquisition module 620 , the first generation module 630 , and the creation module 640 may be at least partially implemented as a computer program module, and when the computer program module is executed, a corresponding function may be performed.

[0144] Figure 7 The structural block diagram of a deployment device of a bastion host according to another embodiment of the present disclosure is schematically shown.

[0145] like Figure 7 As shown, the deployment device 600 ′ of the bastion host of this embodiment can be applied to the deployment platform, and the device includes a data collection module 710 , a template management module 720 , an automatic configuration module 730 , a machine learning module 740 and an access control module 750 .

[0146] The data collection module 710 is used to collect and store system configuration data, user behavior data and historical operation logs to provide data support for automated configuration.

[0147] According to an embodiment of the present disclosure, in different application scenarios, the data collection module 710 may adopt different data collection methods, such as log analysis, network traffic monitoring, etc.

[0148] The template management module 720 is used to preset a variety of configuration templates to adapt to different types of enterprise application scenarios and select a suitable template for configuration according to actual needs. The template management module 720 may correspond to the first generation module 620 described above.

[0149] The automatic configuration module 730 is used to automatically generate a configuration file and perform system deployment based on the selected template and collected data, so as to create a bastion host with one click. The automatic configuration module 730 may correspond to the first generation module 630 described above.

[0150] The machine learning module 740 is used to analyze historical data and user behavior, automatically adjust configuration parameters, and optimize system performance and security. The machine learning module 740 may correspond to the above-mentioned recording module and adjustment module.

[0151] According to an embodiment of the present disclosure, the machine learning module 740 may adopt different algorithms, such as neural networks, decision trees, etc., to improve the intelligence level of the deployment platform.

[0152] The access control module 750 is used to integrate multiple authentication methods and dynamic access control strategies, flexibly manage user access rights, and ensure system security. The access control module 750 may correspond to the above-mentioned determination module and the second optimization module.

[0153] According to an embodiment of the present disclosure, the data collection module 710 regularly collects configuration data of the user operating system, user behavior data and historical operation logs; the bastion host configuration administrator selects an applicable configuration template through the deployment platform interface; then the automated configuration module 730 automatically generates a configuration file based on the selected template and the collected data, and automatically deploys the bastion host to complete one-click creation; then the machine learning module 740 performs real-time analysis of the system operation data, automatically adjusts the configuration parameters, and optimizes the system performance; then the access control module 750 manages user access rights according to the preset access policy to ensure system security.

[0154] Figure 8 A block diagram of an electronic device suitable for implementing a bastion host deployment method according to an embodiment of the present disclosure is schematically shown.

[0155] like Figure 8As shown, the electronic device 800 according to an embodiment of the present disclosure includes a processor 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage part 808 to a random access memory (RAM) 803. The processor 801 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 801 may also include an onboard memory for caching purposes. The processor 801 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0156] In RAM 803, various programs and data required for the operation of electronic device 800 are stored. Processor 801, ROM 802 and RAM 803 are connected to each other via bus 804. Processor 801 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 802 and / or RAM 803. It should be noted that the program can also be stored in one or more memories other than ROM 802 and RAM 803. Processor 801 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0157] According to an embodiment of the present disclosure, the electronic device 800 may further include an input / output (I / O) interface 805, which is also connected to the bus 804. The electronic device 800 may further include one or more of the following components connected to the input / output (I / O) interface 805: an input portion 806 including a keyboard, a mouse, etc.; an output portion 807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 808 including a hard disk, etc.; and a communication portion 809 including a network interface card such as a LAN card, a modem, etc. The communication portion 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the input / output (I / O) interface 805 as needed. A removable medium 811, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 810 as needed, so that the computer program read therefrom is installed into the storage portion 808 as needed.

[0158] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0159] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 802 and / or RAM 803 described above and / or one or more memories other than ROM 802 and RAM 803.

[0160] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program includes a program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the bastion host deployment method provided by the embodiment of the present disclosure.

[0161] The above functions defined in the system / device of the embodiment of the present disclosure are executed when the computer program is executed by the processor 801. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0162] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 809, and / or installed from a removable medium 811. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0163] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 809, and / or installed from the removable medium 811. When the computer program is executed by the processor 801, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0164] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0165] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0166] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0167] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for deploying a bastion host, characterized in that: Applied to a deployment platform, the method comprises: In response to a deployment request from a bastion host, if it is determined that a target configuration template corresponding to a deployment type included in the deployment request exists in a configuration template library, obtaining the target configuration template; In the case of determining that user operation data corresponding to the deployment type exists in the database, acquiring the user operation data, wherein the user operation data represents operation behavior data of the user corresponding to the deployment type; Generate a target configuration file according to the target configuration template and the user operation data; and In response to a confirmation operation on the target configuration file, a bastion host is created for a user corresponding to the deployment type using the target configuration file.

2. The method according to claim 1, characterized in that Generating a target configuration file according to the target configuration template and the user operation data comprises: The target configuration template and the user operation data are input into a pre-trained configuration file generation model, and the target configuration file is output.

3. The method according to claim 2, characterized in that The target configuration template includes at least one field to be configured; The step of inputting the target configuration template and the user operation data into a pre-trained configuration file generation model and outputting the target configuration file comprises: For each of the fields to be configured, determining the data to be configured corresponding to the field to be configured according to the user operation data; The target configuration template is filled with the data to be configured to obtain the target configuration file.

4. The method according to claim 2, characterized in that: The method further comprises: In response to a modification operation on the target configuration file, recording modification information corresponding to the target configuration file; The network parameters of the configuration file generation model are adjusted using the modification information and the target configuration file.

5. The method according to claim 1, characterized in that The method further includes, when it is determined that there is a safety machine limit strategy, optimizing the target configuration file using the safety machine limit strategy to obtain a first optimized configuration file; In response to the confirmation operation on the target configuration file, creating a bastion host for a user corresponding to the deployment type by using the target configuration file includes: In response to a confirmation operation on the first optimization profile, a bastion host is created for a user corresponding to the deployment type using the first optimization profile.

6. The method according to claim 1, characterized in that The method further comprises: According to a preset access control policy, determining a target authentication method corresponding to the deployment type from at least one preset authentication method; Optimizing the target configuration file using the target authentication method to obtain a second optimized configuration file; In response to the confirmation operation on the target configuration file, creating a bastion host for a user corresponding to the deployment type by using the target configuration file includes: In response to a confirmation operation on the second optimization profile, a bastion host is created for a user corresponding to the deployment type using the second optimization profile.

7. The method according to claim 1, characterized in that The method further comprises: In the case where it is determined that the target configuration template corresponding to the deployment type does not exist in the configuration template library, displaying a first configuration page for generating a configuration template; In response to the first configuration information input on the first configuration page, generating a configuration template corresponding to the deployment type to obtain the target configuration template; Adding a configuration template corresponding to the deployment type to the configuration template library.

8. The method according to claim 1, characterized in that: The method further comprises: In the case where it is determined that the database does not contain user operation data corresponding to the deployment type, displaying a second configuration page for generating a configuration file; In response to the second configuration information input on the second configuration page, a configuration file corresponding to the deployment type is generated to obtain the target configuration file.

9. A bastion host deployment device, characterized in that: Applied to a deployment platform, the device comprises: A first acquisition module is used to respond to a deployment request of the bastion host, and when it is determined that a target configuration template corresponding to the deployment type included in the deployment request exists in the configuration template library, acquire the target configuration template; A second acquisition module is used to acquire the user operation data corresponding to the deployment type when it is determined that the user operation data corresponding to the deployment type exists in the database, wherein the user operation data represents the operation behavior data of the user corresponding to the deployment type; A first generating module, configured to generate a target configuration file according to the target configuration template and the user operation data; and A creation module is used to create a bastion host for a user corresponding to the deployment type using the target configuration file in response to a confirmation operation on the target configuration file.

10. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images