Fortress machine deployment method and device, electronic equipment and storage medium

Abstract

The disclosure provides a deployment method of a bastion host, which can be applied to the field of information security technology and the field of financial technology. The method is applied to a deployment platform, and includes: in response to a deployment request of a bastion host, obtaining a target configuration template in a case where it is determined that the target configuration template corresponding to a deployment type contained in the deployment request exists in a configuration template library; obtaining user operation data in a case where it is determined that the user operation data corresponding to the deployment type exists in a database, wherein the user operation data represents operation behavior data of a user corresponding to the deployment type; generating a target configuration file according to the target configuration template and the user operation data; and in response to a confirmation operation on the target configuration file, creating the bastion host for the user corresponding to the deployment type by using the target configuration file. The disclosure further provides a deployment device, equipment, storage medium and program product of a bastion host.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of information security and the technical field of finance, in particular to a deployment method, device, equipment, medium and program product of a bastion host. BACKGROUND

[0002] With the development of information technology, the information system in an enterprise becomes more and more complex, and network security management becomes an important issue. As an intermediate proxy device, a bastion host is widely used in the security management of an internal system of an enterprise. Its main function is to centrally manage the access permissions of various systems in the enterprise, and to ensure access security through a unified identity authentication and authorization mechanism. However, in the related art, the configuration template of the bastion host is generally designed manually, and the configuration data is filled in manually, which leads to a complex deployment and configuration process of the bastion host, time-consuming and laborious, and low deployment efficiency. SUMMARY

[0003] In view of the above problems, the present disclosure provides a deployment method, device, equipment, medium and program product of a bastion host for improving the deployment efficiency of the bastion host.

[0004] According to a first aspect of the present disclosure, a deployment method of a bastion host is provided, applied to a deployment platform, the method comprising: in response to a deployment request of a bastion host, acquiring a target configuration template corresponding to a deployment type contained in the deployment request in a case where it is determined that the target configuration template exists in a configuration template library; acquiring user operation data corresponding to the deployment type in a case where it is determined that the user operation data exists in a database, wherein the user operation data represents operation behavior data of a user corresponding to the deployment type; generating a target configuration file according to the target configuration template and the user operation data; and in response to a confirmation operation for the target configuration file, creating a bastion host for a user corresponding to the deployment type by using the target configuration file.

[0005] According to an embodiment of the present disclosure, the generating of the target configuration file according to the target configuration template and the user operation data comprises: inputting the target configuration template and the user operation data into a pre-trained configuration file generation model, and outputting the target configuration file.

[0006] According to an embodiment of the present disclosure, the target configuration template comprises at least one to-be-configured field; and the inputting of the target configuration template and the user operation data into the pre-trained configuration file generation model and the outputting of the target configuration file comprises: for each to-be-configured field, determining to-be-configured data corresponding to the to-be-configured field according to the user operation data; and filling the target configuration template with the to-be-configured data to obtain the target configuration file.

[0007] According to an embodiment of the present disclosure, the method further includes: in response to a modification operation on the target configuration file, recording modification information corresponding to the target configuration file; and adjusting the network parameters of the configuration file generation model by using the modification information and the target configuration file.

[0008] According to an embodiment of the present disclosure, the method further includes: in a case where it is determined that the security limiting policy exists, optimizing the target configuration file by using the security limiting policy to obtain a first optimized configuration file; and in response to the confirmation operation on the target configuration file, creating the bastion host for the user corresponding to the deployment type by using the target configuration file, including: in response to the confirmation operation on the first optimized configuration file, creating the bastion host for the user corresponding to the deployment type by using the first optimized configuration file.

[0009] According to an embodiment of the present disclosure, the method further includes: determining a target authentication mode corresponding to the deployment type from at least one preset authentication mode according to a preset access control policy; optimizing the target configuration file by using the target authentication mode to obtain a second optimized configuration file; and in response to the confirmation operation on the target configuration file, creating the bastion host for the user corresponding to the deployment type by using the target configuration file, including: in response to the confirmation operation on the second optimized configuration file, creating the bastion host for the user corresponding to the deployment type by using the second optimized configuration file.

[0010] According to an embodiment of the present disclosure, the method further includes: in a case where it is determined that the target configuration template corresponding to the deployment type does not exist in the configuration template library, displaying a first configuration page for generating a configuration template; generating the configuration template corresponding to the deployment type by using first configuration information input on the first configuration page to obtain the target configuration template; and adding the configuration template corresponding to the deployment type to the configuration template library.

[0011] According to an embodiment of the present disclosure, the method further includes: in a case where it is determined that the user operation data corresponding to the deployment type does not exist in the database, displaying a second configuration page for generating a configuration file; and generating the configuration file corresponding to the deployment type by using second configuration information input on the second configuration page to obtain the target configuration file.

[0012] The second aspect of the present disclosure provides a deployment device of a bastion host, applied to a deployment platform, the device comprising: a first obtaining module configured to, in response to a deployment request of a bastion host, obtain a target configuration template corresponding to a deployment type contained in the deployment request, in a case where it is determined that the target configuration template exists in a configuration template library; a second obtaining module configured to, in a case where it is determined that user operation data corresponding to the deployment type exists in a database, obtain the user operation data, wherein the user operation data represents operation behavior data of a user corresponding to the deployment type; a first generating module configured to generate a target configuration file according to the target configuration template and the user operation data; and a creating module configured to, in response to a confirmation operation for the target configuration file, create a bastion host for the user corresponding to the deployment type by using the target configuration file.

[0013] The third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method.

[0014] The fourth aspect of the present disclosure further provides a computer-readable storage medium having stored thereon a computer program or instructions, which, when executed by a processor, implement the steps of the method.

[0015] The fifth aspect of the present disclosure further provides a computer program product comprising a computer program or instructions, which, when executed by a processor, implement the steps of the method.

[0016] According to the embodiments of the present disclosure, in response to a deployment request of a bastion host, a target configuration template corresponding to a deployment type is obtained from a configuration template library, and user operation data corresponding to the deployment type is obtained from a database. Then, a target configuration file is generated according to the target configuration template and the user operation data. After that, in response to a confirmation operation for the target configuration file, a bastion host is created for a user corresponding to the deployment type by using the target configuration file. At least the technical problem that deployment efficiency is low due to manual configuration of templates in the related art is solved, and the technical effects of automatic deployment of a bastion host and improvement of deployment efficiency and accuracy are achieved. BRIEF DESCRIPTION OF DRAWINGS

[0017] The above and other objects, features and advantages of the present disclosure will become more apparent from the following description when taken in conjunction with the accompanying drawings, in which:

[0018] Figure 1 An application scenario diagram of a deployment method, device, equipment, medium and program product of a bastion host according to embodiments of the present disclosure is schematically shown;

[0019] Figure 2 A flowchart of a deployment method of a bastion according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 3 A flowchart of a deployment method of a bastion according to another embodiment of the present disclosure is schematically shown;

[0021] Figure 4 A flowchart of a configuration file generation method according to an embodiment of the present disclosure is schematically shown;

[0022] Figure 5 A principle schematic diagram of a deployment method of a bastion according to an embodiment of the present disclosure is schematically shown;

[0023] Figure 6 A structural block diagram of a deployment apparatus of a bastion according to an embodiment of the present disclosure is schematically shown;

[0024] Figure 7 A structural block diagram of a deployment apparatus of a bastion according to another embodiment of the present disclosure is schematically shown; and

[0025] Figure 8 A block diagram of an electronic device adapted to implement a deployment method of a bastion according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0026] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood, however, that the description which follows is merely exemplary and is not intended to limit the scope of the present disclosure. In the following detailed description of the embodiments of the present disclosure, numerous specific details are set forth in order to provide a thorough understanding of the present disclosure. However, it will be apparent to one skilled in the art that one or more embodiments of the present disclosure can be practiced without these specific details. In other instances, well-known structures and functions have not been described in detail in order to avoid obscuring aspects of the present disclosure.

[0027] The terms used herein are merely used to describe specific embodiments and are not intended to limit the present disclosure. The terms "include", "comprise", and the like used herein indicate the presence of the described features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0028] All terms used herein, including technical and scientific terms, have the same meanings as those generally understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having meanings consistent with the context of the present specification, and should not be interpreted in an idealized or excessively formal manner.

[0029] In the case of using expressions similar to "at least one of A, B, and C, etc.", in general, it should be interpreted according to the meaning that a person skilled in the art generally understands the expression (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, a system having B alone, a system having C alone, a system having both A and B, a system having both A and C, a system having both B and C, and / or a system having A, B, and C, etc.).

[0030] It should be noted that the deployment method and device of the bastion host of the embodiments of the present disclosure can be used in the field of information security technology and the field of financial technology, and can also be used in any field other than the field of information security technology and the field of financial technology. The application field of the deployment method and device of the bastion host of the embodiments of the present disclosure is not limited.

[0031] It should be noted that in the embodiments of the present application, some industry existing solutions, components, models, etc. may be mentioned, which should be considered as exemplary, and the purpose is only to illustrate the feasibility in the implementation of the technical solutions of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0032] In the technical solutions of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information such as location information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved are information and data authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data comply with relevant laws, regulations and standards, necessary security measures are taken, do not violate public order and good customs, and provide corresponding operation portal for user to choose authorization or refusal.

[0033] In the scenario of using personal information for automated decision-making, the method, device and system provided by the embodiments of the present disclosure all provide corresponding operation portal for the user to choose to agree or refuse the automated decision-making result; if the user chooses to refuse, the expert decision-making process is entered. The expression "automated decision-making" here refers to the activity of automatically analyzing, evaluating the behavior habits, interests and hobbies, or economic, health, credit status, etc. of an individual through a computer program, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by personnel who are engaged in a certain field of work, have specialized experience, knowledge and skills, and have reached a certain professional level.

[0034] The bastion host (Jump Server) is a network environment in which various technical means are used to monitor and record the operation behavior of operation and maintenance personnel on servers, network devices, security devices, databases, etc. in the network in order to protect the network and data from intrusion and damage from external and internal users, so as to centralized alarm, timely processing and audit responsibility.

[0035] With the development of information technology, the information system in an enterprise becomes more and more complex, and a bastion host as an intermediate proxy device is widely used in the security management of the internal system of the enterprise. However, in the prior art, the configuration template of the bastion host generally needs to be manually designed, and the configuration data needs to be manually filled in, which leads to a complex deployment and configuration process of the bastion host, time and labor consuming, and the operation needs to be performed by a professional operation and maintenance personnel, resulting in a low deployment efficiency.

[0036] To solve the above technical problems, embodiments of the present disclosure provide a deployment method of a bastion host, applied to a deployment platform, the method comprising: in response to a deployment request of a bastion host, in a case where it is determined that a target configuration template corresponding to a deployment type contained in the deployment request exists in a configuration template library, acquiring the target configuration template; in a case where it is determined that user operation data corresponding to the deployment type exists in a database, acquiring the user operation data, wherein the user operation data represents operation behavior data of a user corresponding to the deployment type; generating a target configuration file according to the target configuration template and the user operation data; and in response to a confirmation operation for the target configuration file, creating a bastion host for a user corresponding to the deployment type by using the target configuration file.

[0037] Figure 1 An application scenario diagram of the deployment method, apparatus, device, medium and program product of the bastion host according to the embodiments of the present disclosure is schematically shown.

[0038] As shown in Figure 1 The application scenario 100 according to the embodiments can include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104 and a server 105. The network 104 is a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103 and the server 105. The network 104 can include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0039] The user can use the first terminal device 101, the second terminal device 102 and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102 and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0040] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with a display screen and supporting web browsing, including but not limited to a smart phone, a tablet computer, a laptop computer, a desktop computer, and the like.

[0041] The server 105 can be a server providing various services, for example, a background management server supporting a website browsed by a user using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (only as an example). The background management server can perform analysis and the like on received user requests and the like, and feed back a processing result (for example, a webpage, information, or data, or the like, obtained or generated according to a user request) to a terminal device.

[0042] It should be noted that the deployment method of the bastion provided in the embodiments of the present disclosure can generally be executed by the server 105. Accordingly, the deployment apparatus of the bastion provided in the embodiments of the present disclosure can generally be arranged in the server 105. The deployment method of the bastion provided in the embodiments of the present disclosure can also be executed by a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105. Accordingly, the deployment apparatus of the bastion provided in the embodiments of the present disclosure can also be arranged in a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105.

[0043] It should be understood that Figure 1 The number of terminal devices, networks, and servers in

[0044] The deployment method, apparatus, device, medium, and program product of the bastion provided in the embodiments of the present disclosure will be described in detail below based on the scenario described in Figure 1 Figures 2-8 The deployment method, apparatus, device, medium, and program product of the bastion provided in the embodiments of the present disclosure will be described in detail below based on the scenario described in

[0045] Figure 2 A flowchart of the deployment method of the bastion according to the embodiments of the present disclosure is schematically shown.

[0046] The deployment method of the bastion according to the embodiments of the present disclosure can be applied to a deployment platform.

[0047] As shown in Figure 2 The deployment method of the bastion of this embodiment includes operations S210-S240, and the deployment method of the bastion can be executed by a server.

[0048] ​In operation S210, in response to the deployment request of the bastion host, the target configuration template corresponding to the deployment type contained in the deployment request is obtained in a case where it is determined that the target configuration template exists in the configuration template library.

[0049] According to an embodiment of the present disclosure, the deployment request can be generated by a user after inputting a deployment type in a deployment interface. The deployment type can include a user type of a user to be deployed and a user level of the user to be deployed. The user type can be a work type, such as a business staff, a research and development staff, and the like, and the user type can also be a department type, such as a business department, a research and development department, and the like. The user level can be a position level of the user, such as an ordinary employee, a team leader, a manager, and the like.

[0050] According to an embodiment of the present disclosure, the configuration template library stores at least one configuration template, which can be a configuration template designed manually or generated according to system configuration data, user behavior data, and historical operation logs of a user.

[0051] In one of the embodiments, a probe can be installed on an electronic device used by a user to collect system configuration data, user behavior data, and historical operation logs of the electronic device, and a configuration template corresponding to the user type is generated by analyzing the system configuration data, the user behavior data, and the historical operation logs of the electronic device and added to the configuration template library.

[0052] In an embodiment of the present disclosure, before the probe is installed on the electronic device of the user to collect the system configuration data, the user behavior data, and the historical operation logs of the electronic device, the consent or authorization of the user can be obtained. For example, before operation S210, a request for installing the probe to facilitate the collection of the system configuration data, the user behavior data, and the historical operation logs of the electronic device can be sent to the user. In a case where the user consents or authorizes, the operation S210 is performed.

[0053] According to an embodiment of the present disclosure, the target configuration template can include at least one to-be-configured field, and the to-be-configured field can include a hard disk, a CPU, a system type, a software type, and the like. Specifically, the target configuration template can be in the form of key:value, where the value is a null value.

[0054] According to an embodiment of the present disclosure, different users use different systems, and different access permissions are involved. Different user levels involve different access permissions, and therefore, the user type and the user level need to be configured, so that the target configuration template corresponding to the deployment type can be obtained.

[0055] In operation S220, in a case where it is determined that the user operation data corresponding to the deployment type exists in the database, the user operation data is acquired. The user operation data represents the operation behavior data of the user corresponding to the deployment type.

[0056] According to an embodiment of the present disclosure, system configuration data, user behavior data and historical operation logs of the electronic device used by the user are collected periodically and stored in the database. When the bastion host is configured, the user operation data corresponding to the deployment type, such as the user behavior data and the historical operation logs, is acquired from the database, so as to fill the value in the target configuration template according to the data.

[0057] According to an embodiment of the present disclosure, in a case where it is determined that the user operation data corresponding to the deployment type does not exist in the database, the value in the target configuration template needs to be filled manually.

[0058] In operation S230, the target configuration file is generated according to the target configuration template and the user operation data.

[0059] According to an embodiment of the present disclosure, the target configuration file can include at least one to-be-configured field and data corresponding to each to-be-configured field. Specifically, the target configuration file can be in the form of key:value, wherein the value is a non-empty value.

[0060] According to an embodiment of the present disclosure, generating the target configuration file according to the target configuration template and the user operation data can include filling the data corresponding to the to-be-configured field in the target configuration template with the user operation data. Specifically, the value corresponding to the key is extracted from the user operation data for filling.

[0061] In operation S240, in response to a confirmation operation for the target configuration file, the bastion host is created for the user corresponding to the deployment type by using the target configuration file.

[0062] According to an embodiment of the present disclosure, after the configuration file is generated, the configuration file can be displayed so as to allow the user to confirm whether the configuration file is reasonable. If the configuration file is reasonable, the user can click the confirmation operation and create the bastion host by one key.

[0063] According to an embodiment of the present disclosure, the target configuration file can further include a configuration manner, such as creating a bastion host for each user or creating one bastion host for every M users, M≥2.

[0064] In some embodiments, creating the bastion host for the user corresponding to the deployment type can include: creating a bastion host for each user corresponding to the deployment type respectively. For example, the users corresponding to the deployment type include user A, user B and user C, a bastion host is created for user A, a bastion host is created for user B, and a bastion host is created for user C.

[0065] In some embodiments, creating the bastion host for the user corresponding to the deployment type can include: creating a bastion host for each user corresponding to the deployment type respectively. For example, the users corresponding to the deployment type include user A, user B and user C, a bastion host is created for user A, a bastion host is created for user B, and a bastion host is created for user C.

[0066] According to an embodiment of the present disclosure, by responding to the deployment request of the bastion host, the target configuration template corresponding to the deployment type is obtained from the configuration template library, and the user operation data corresponding to the deployment type is obtained from the database; then, the target configuration file is generated according to the target configuration template and the user operation data; after that, in response to the confirmation operation for the target configuration file, the target configuration file is used to create a bastion host for the user corresponding to the deployment type. At least the technical problem that the deployment efficiency is low due to manual configuration of the template in the related art is solved, and the technical effects of automatic deployment of the bastion host, improvement of the deployment efficiency and accuracy are achieved.

[0067] According to an embodiment of the present disclosure, the method further includes: in a case where it is determined that the target configuration template corresponding to the deployment type does not exist in the configuration template library, a first configuration page for generating a configuration template is displayed; in response to first configuration information input in the first configuration page, a configuration template corresponding to the deployment type is generated, and the target configuration template is obtained; and the configuration template corresponding to the deployment type is added to the configuration template library.

[0068] According to an embodiment of the present disclosure, the first configuration information can be at least one to-be-configured field.

[0069] According to an embodiment of the present disclosure, when the configuration template corresponding to the deployment type does not exist in the configuration template library, the template needs to be manually configured by a person. The user can determine at least one to-be-configured field according to the deployment type analysis, and then configure the to-be-configured field in the first configuration page to generate the target configuration template.

[0070] In some embodiments, in a case where it is determined that the target configuration template corresponding to the deployment type does not exist in the configuration template library, a user can select a configuration template from the configuration template library, and the selected configuration template is displayed on the first configuration page, so that the user can make modifications on the selected configuration template, thereby improving the configuration efficiency.

[0071] According to an embodiment of the present disclosure, the method further includes: in a case where it is determined that the user operation data corresponding to the deployment type does not exist in the database, displaying a second configuration page for generating a configuration file; and generating the configuration file corresponding to the deployment type according to second configuration information input on the second configuration page, to obtain the target configuration file.

[0072] According to an embodiment of the present disclosure, the second configuration information can be to-be-configured data corresponding to a to-be-configured field. When the user operation data corresponding to the deployment type does not exist in the database, the to-be-configured data needs to be manually configured. The user can determine the to-be-configured data corresponding to at least one to-be-configured field according to the deployment type analysis, for example, the to-be-configured field is CPU, if the deployment type is a business personnel, a smaller CPU can be configured, and if the deployment type is a research and development personnel, a larger CPU can be configured; and the to-be-configured data is configured on the second configuration page to generate the target configuration file.

[0073] Figure 3 A flowchart of a deployment method of a bastion host according to another embodiment of the present disclosure is schematically shown.

[0074] As shown in Figure 3 The deployment method of the bastion host of this embodiment includes operations S301-S311.

[0075] In operation S301, in response to a deployment request of a bastion host, a deployment type included in the deployment request is obtained, wherein the deployment type includes a user type and a user level.

[0076] In operation S302, it is determined whether a target configuration template corresponding to the deployment type exists in a configuration template library. If yes, operation S303 is performed; if not, operations S304-S305 are performed.

[0077] In operation S303, the target configuration template is obtained, and then operation S306 is performed.

[0078] In operation S304, a first configuration page for generating a configuration template is displayed.

[0079] In operation S305, in response to first configuration information input on the first configuration page, a configuration template corresponding to the deployment type is generated, to obtain the target configuration template, and then operation S306 is performed.

[0080] In operation S306, it is determined whether the user operation data corresponding to the deployment type exists in the database. If not, operations S307-S308 are performed; if yes, operations S309-S310 are performed.

[0081] In operation S307, a second configuration page for generating the configuration file is displayed, and the second configuration page displays the target configuration template.

[0082] In operation S308, in response to the second configuration information input in the second configuration page, the target configuration file corresponding to the deployment type is generated, and then operation S311 is performed.

[0083] In operation S309, the user operation data is obtained.

[0084] In operation S310, the target configuration file is generated according to the target configuration template and the user operation data, and then operation S311 is performed.

[0085] In operation S311, in response to the confirmation operation for the target configuration file, the bastion host is created for the user corresponding to the deployment type by using the target configuration file.

[0086] According to the embodiments of the present disclosure, the above-mentioned generation of the target configuration file according to the above-mentioned target configuration template and the above-mentioned user operation data includes: inputting the above-mentioned target configuration template and the above-mentioned user operation data into a pre-trained configuration file generation model, and outputting the above-mentioned target configuration file.

[0087] According to the embodiments of the present disclosure, the configuration file generation model can include a neural network, a decision tree, etc., and the present application does not limit the specific type of the configuration file generation model.

[0088] According to the embodiments of the present disclosure, the configuration file generation model can be trained by using the method commonly used in related technologies, and the present application does not limit the training method of the configuration file generation model.

[0089] According to the embodiments of the present disclosure, by automatically generating the target configuration file by using the configuration file generation model, the intelligent level of the deployment platform is improved.

[0090] Figure 4 A flowchart of a configuration file generation method according to an embodiment of the present disclosure is schematically shown.

[0091] As shown in Figure 4 the configuration file generation method of this embodiment includes operations S410-S450.

[0092] In operation S410, the target configuration template and the user operation data are input into a pre-trained configuration file generation model.

[0093] According to an embodiment of the present disclosure, the target configuration template includes at least one to-be-configured field, for example, the target configuration template includes to-be-configured field 1 such as CPU, to-be-configured field 2 such as memory, and to-be-configured field 3 such as system type.

[0094] According to an embodiment of the present disclosure, the user operation data can include all operations of the user on the electronic device. For example, the user operation data includes system type information of the user operation, CPU usage rate information when the user operation, and the like.

[0095] In operation S420, for each to-be-configured field, to-be-configured data corresponding to the to-be-configured field is determined according to the user operation data.

[0096] According to an embodiment of the present disclosure, for example, the to-be-configured field is CPU, and since the CPU usage rate information such as 1G is included in the user operation data, the value corresponding to the CPU in the target configuration template can be determined according to the CPU usage rate information, for example, 2G.

[0097] In operation S430, the target configuration template is filled with the to-be-configured data to obtain a target configuration file.

[0098] In operation S440, in response to a modification operation on the target configuration file, modification information corresponding to the target configuration file is recorded.

[0099] According to an embodiment of the present disclosure, after the target configuration file is generated, the user needs to verify the target configuration file, for example, verify whether all to-be-configured fields required in the target configuration file are included; for another example, verify whether the to-be-configured data corresponding to each to-be-configured field is reasonable. When the user confirms the target configuration file, the target configuration file is used to create a bastion host. When the user modifies part of the information in the target configuration file, the modification information is recorded. The modification information can include the content before modification, the content after modification, and the time of modification, and the like.

[0100] In operation S450, the network parameters of the configuration file generation model are adjusted by using the modification information and the target configuration file.

[0101] According to an embodiment of the present disclosure, the configuration file generation model is iterated by using the modification information and the target configuration file, so that the configuration file generation model is more intelligent.

[0102] According to an embodiment of the present disclosure, the method further comprises, in a case where it is determined that the security limit policy exists, optimizing the target configuration file by using the security limit policy to obtain a first optimized configuration file; and the creating the bastion host for the user corresponding to the deployment type by using the target configuration file in response to the confirmation operation on the target configuration file comprises: creating the bastion host for the user corresponding to the deployment type by using the first optimized configuration file in response to the confirmation operation on the first optimized configuration file.

[0103] According to an embodiment of the present disclosure, the security limit policy can be an operating system-based security policy. The security limit policy can be configured according to actual needs. For industries with relatively high security requirements, such as financial institutions and medical institutions, the security limit policy can be configured. In a case where the security limit policy is configured, the security limit policy can be supplemented into the target configuration file.

[0104] According to an embodiment of the present disclosure, the method further comprises: determining a target authentication mode corresponding to the deployment type from at least one preset authentication mode according to a preset access control policy; and optimizing the target configuration file by using the target authentication mode to obtain a second optimized configuration file; and the creating the bastion host for the user corresponding to the deployment type by using the target configuration file in response to the confirmation operation on the target configuration file comprises: creating the bastion host for the user corresponding to the deployment type by using the second optimized configuration file in response to the confirmation operation on the second optimized configuration file.

[0105] According to an embodiment of the present disclosure, the at least one authentication mode can include password authentication, fingerprint authentication, face recognition authentication, and the like.

[0106] According to an embodiment of the present disclosure, the deployment type includes a user type, and the authentication mode corresponding to the user type is determined according to the user type. If the user type has a high access permission, multiple authentication modes can be selected for authentication, and if the user type has an ordinary access permission, one authentication mode can be selected for authentication.

[0107] According to an embodiment of the present disclosure, the preset access control policy can include at least one access level and an authentication mode corresponding to each access level. The access level can be a user level.

[0108] In some embodiments, the preset access control policy includes an access level 1, an access level 2, and an access level 3, the authentication mode corresponding to the access level 1 includes mode a, mode b, and mode c, the authentication mode corresponding to the access level 2 includes mode a and mode b, and the authentication mode corresponding to the access level 3 includes mode a.

[0109] According to embodiments of this disclosure, determining the target authentication method corresponding to the deployment type from at least one preset authentication method based on a preset access control policy may include: determining the target access level corresponding to the user type included in the deployment type according to the preset access control policy; and determining the target authentication method corresponding to the target access level. For example, if the access level corresponding to user type A is access level 1, then the target authentication methods include method a, method b, and method c; as another example, if the access level corresponding to user type B is access level 2, then the target authentication methods include method a and method b.

[0110] According to embodiments of this disclosure, by integrating multiple authentication methods and dynamic access control policies, the flexibility and security of the system are enhanced, adapting to the needs of different application scenarios.

[0111] Figure 5 The schematic diagram illustrates the principle of a bastion host deployment method according to an embodiment of the present disclosure.

[0112] like Figure 5 As shown, in this embodiment, before deploying the bastion host, user operation data 501 can be collected and stored in database 502, and a configuration template 503 can be generated based on the collected user operation data 501. The configuration template 503 is then stored in the configuration template library 505. Simultaneously, a configuration template 504 can be manually preset and stored in the configuration template library 505. Then, in response to deployment request 506, the deployment type 507 contained in the deployment request 506 is obtained. Then, based on the deployment type 507, the corresponding target user operation data 508 is obtained from database 502, and the corresponding target configuration template 509 is obtained from configuration template library 505. After that, a target configuration file 510 is generated based on the target configuration template 509 and the target user operation data 508. Then, it is determined whether the target configuration file 510 needs to be modified 511. If it does not need to be modified, the bastion host 512 is created based on the target configuration file 510. If it needs to be modified, a modified configuration file 513 is generated after modification, and the bastion host 512 is created based on the modified configuration file 513.

[0113] Based on the above-described bastion host deployment method, this disclosure also provides a bastion host deployment apparatus. The following will be combined with... Figure 6 The device is described in detail.

[0114] Figure 6 A schematic block diagram of a bastion host deployment apparatus according to an embodiment of the present disclosure is shown.

[0115] like Figure 6As shown, the deployment apparatus 600 of the bastion host of the embodiment can be applied to a deployment platform, and the apparatus comprises a first acquisition module 610, a second acquisition module 620, a first generation module 630, and a creation module 640.

[0116] The first acquisition module 610 is configured to, in response to a deployment request of a bastion host, acquire a target configuration template corresponding to a deployment type contained in the deployment request from a configuration template library in a case where it is determined that the target configuration template exists in the configuration template library.

[0117] The second acquisition module 620 is configured to acquire user operation data corresponding to the deployment type from a database in a case where it is determined that the user operation data exists in the database, wherein the user operation data represents operation behavior data of a user corresponding to the deployment type.

[0118] The first generation module 630 is configured to generate a target configuration file according to the target configuration template and the user operation data.

[0119] The creation module 640 is configured to create a bastion host for a user corresponding to the deployment type by using the target configuration file in response to a confirmation operation for the target configuration file.

[0120] According to an embodiment of the present disclosure, the first generation module comprises a generation sub-module.

[0121] The generation sub-module is configured to input the target configuration template and the user operation data into a pre-trained configuration file generation model, and output the target configuration file.

[0122] According to an embodiment of the present disclosure, the target configuration template comprises at least one to-be-configured field.

[0123] According to an embodiment of the present disclosure, the generation sub-module comprises a determination sub-module and a filling sub-module.

[0124] The determination sub-module is configured to determine, for each to-be-configured field, to-be-configured data corresponding to the to-be-configured field according to the user operation data.

[0125] The filling sub-module is configured to fill the target configuration template with the to-be-configured data to obtain the target configuration file.

[0126] According to an embodiment of the disclosure, the apparatus further includes a recording module and an adjusting module.

[0127] The recording module is configured to record modification information corresponding to the target configuration file in response to a modification operation on the target configuration file.

[0128] The adjusting module is configured to adjust network parameters of the configuration file generation model by using the modification information and the target configuration file.

[0129] According to an embodiment of the disclosure, the apparatus further includes a first optimization module.

[0130] The first optimization module is configured to optimize the target configuration file by using a security limit policy to obtain a first optimized configuration file, in a case where it is determined that the security limit policy exists.

[0131] According to an embodiment of the disclosure, the creating module is further configured to create a bastion host for a user corresponding to the deployment type by using the first optimized configuration file in response to a confirmation operation on the first optimized configuration file.

[0132] According to an embodiment of the disclosure, the apparatus further includes a determining module and a second optimization module.

[0133] The determining module is configured to determine a target authentication mode corresponding to the deployment type from at least one preset authentication mode according to a preset access control policy.

[0134] The second optimization module is configured to optimize the target configuration file by using the target authentication mode to obtain a second optimized configuration file.

[0135] According to an embodiment of the disclosure, the creating module is further configured to create a bastion host for a user corresponding to the deployment type by using the second optimized configuration file in response to a confirmation operation on the second optimized configuration file.

[0136] According to an embodiment of the disclosure, the apparatus further includes a first display module, a second generation module, and an adding module.

[0137] The first display module is configured to display a first configuration page for generating a configuration template in a case where it is determined that a target configuration template corresponding to the deployment type does not exist in the configuration template library.

[0138] The second generation module is configured to generate a configuration template corresponding to the deployment type by using first configuration information input on the first configuration page to obtain the target configuration template.

[0139] An adding module is configured to add a configuration template corresponding to the deployment type to the configuration template library.

[0140] According to an embodiment of the present disclosure, the apparatus further comprises a second presenting module and a third generating module.

[0141] The second presenting module is configured to present a second configuration page for generating a configuration file if it is determined that there is no user operation data corresponding to the deployment type in the database.

[0142] The third generating module is configured to generate a configuration file corresponding to the deployment type according to second configuration information input on the second configuration page, so as to obtain the target configuration file.

[0143] According to an embodiment of the present disclosure, any of the first obtaining module 610, the second obtaining module 620, the first generating module 630 and the creating module 640 can be combined in one module, or any of them can be split into multiple modules. Alternatively, at least part of the function of one or more of these modules can be combined with at least part of the function of other modules, and implemented in one module. According to an embodiment of the present disclosure, at least one of the first obtaining module 610, the second obtaining module 620, the first generating module 630 and the creating module 640 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on substrate, a system on package, an application specific integrated circuit (ASIC), or any other reasonable way of integrating or packaging a circuit, etc. hardware or firmware, or any one of software, hardware and firmware or any appropriate combination of several of them. Alternatively, at least one of the first obtaining module 610, the second obtaining module 620, the first generating module 630 and the creating module 640 can be at least partially implemented as a computer program module which can perform corresponding functions when it is run.

[0144] Figure 7 The structure block diagram of the deployment apparatus of the bastion host according to another embodiment of the present disclosure is schematically shown.

[0145] As Figure 7 shown, the deployment apparatus 600' of the bastion host of this embodiment can be applied to a deployment platform, and the apparatus comprises a data collection module 710, a template management module 720, an automated configuration module 730, a machine learning module 740 and an access control module 750.

[0146] The data collection module 710 is configured to collect and store system configuration data, user behavior data and historical operation logs, and provide data support for automated configuration.

[0147] According to embodiments of the present disclosure, in different application scenarios, the data collection module 710 can adopt different data collection methods, such as log analysis, network traffic monitoring, etc.

[0148] The template management module 720 is configured to preset a plurality of configuration templates to adapt to different types of enterprise application scenarios, and select a suitable template for configuration according to actual needs. The template management module 720 can correspond to the first generation module 620 described above.

[0149] The automatic configuration module 730 is configured to automatically generate a configuration file and perform system deployment according to the selected template and the collected data, and realize one-key creation of the bastion host. The automatic configuration module 730 can correspond to the first generation module 630 described above.

[0150] The machine learning module 740 is configured to analyze historical data and user behavior, automatically adjust configuration parameters, and optimize system performance and security. The machine learning module 740 can correspond to the recording module and the adjustment module described above.

[0151] According to embodiments of the present disclosure, the machine learning module 740 can adopt different algorithms, such as neural networks, decision trees, etc., to improve the intelligent level of the deployment platform.

[0152] The access control module 750 is configured to integrate a plurality of authentication methods and dynamic access control strategies, flexibly manage user access permissions, and ensure system security. The access control module 750 can correspond to the determination module and the second optimization module described above.

[0153] According to embodiments of the present disclosure, the data collection module 710 periodically collects configuration data of the user operating system, user behavior data, and historical operation logs; the bastion host configuration administrator selects a suitable configuration template through the deployment platform interface; then the automatic configuration module 730 automatically generates a configuration file according to the selected template and the collected data, and automatically deploys the bastion host to complete one-key creation; then the machine learning module 740 analyzes system running data in real time, automatically adjusts configuration parameters, and optimizes system performance; and then the access control module 750 manages user access permissions according to a preset access strategy to ensure system security.

[0154] Figure 8 The block diagram of the electronic device suitable for implementing the deployment method of the bastion host according to embodiments of the present disclosure is schematically shown.

[0155] As Figure 8As shown, the electronic device 800 according to an embodiment of the present disclosure includes a processor 801 which can perform various appropriate actions and processes according to a program stored in a read only memory (ROM) 802 or a program loaded from a storage section 808 into a random access memory (RAM) 803. The processor 801 can include, for example, a general purpose microprocessor (e.g., a CPU), an instruction set processor, and / or a related chipset, and / or a special purpose microprocessor (e.g., an application specific integrated circuit (ASIC)), and so on. The processor 801 can also include an on-board memory for cache use. The processor 801 can include a single processing unit or multiple processing units for executing different actions of the method processes according to embodiments of the present disclosure.

[0156] In the RAM 803, various programs and data required for the operation of the electronic device 800 are stored. The processor 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. The processor 801 performs various operations of the method processes according to embodiments of the present disclosure by executing the programs in the ROM 802 and / or the RAM 803. Note that the programs can also be stored in one or more memories other than the ROM 802 and the RAM 803. The processor 801 can also perform various operations of the method processes according to embodiments of the present disclosure by executing the programs stored in the one or more memories.

[0157] According to an embodiment of the present disclosure, the electronic device 800 can further include an input / output (I / O) interface 805 which is also connected to the bus 804. The electronic device 800 can further include one or more of the following components connected to the input / output (I / O) interface 805: an input section 806 including a keyboard, a mouse, etc.; an output section 807 including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN card, a modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the input / output (I / O) interface 805 as necessary. A removable medium 811 such as a magnetic disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 810 as necessary, so that a computer program read out therefrom is installed in the storage section 808 as necessary.

[0158] The present disclosure also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments, or can exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of the present disclosure.

[0159] According to embodiments of the present disclosure, the computer readable storage medium can be a non-volatile computer readable storage medium, which can include, but is not limited to, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any appropriate combination thereof. In the present disclosure, the computer readable storage medium can be any tangible medium that contains or stores a program, which can be used by or in connection with an instruction execution system, apparatus, or device. For example, according to embodiments of the present disclosure, the computer readable storage medium can include the ROM 802 and / or the RAM 803 described above, and / or one or more memories other than the ROM 802 and the RAM 803.

[0160] Embodiments of the present disclosure also include a computer program product, which includes a computer program containing program codes for executing the methods shown in the flowcharts. When the computer program product is run in a computer system, the program codes are used to make the computer system implement the deployment method of the bastion host provided by the embodiments of the present disclosure.

[0161] The above functions defined in the system / apparatus of the embodiments of the present disclosure are performed when the computer program is executed by the processor 801. According to embodiments of the present disclosure, the system, apparatus, module, unit, etc. described above can be implemented by computer program modules.

[0162] In one embodiment, the computer program can rely on a tangible storage medium such as an optical storage medium, a magnetic storage medium, etc. In another embodiment, the computer program can also be transmitted, distributed, and downloaded in the form of a signal via a network medium, and be downloaded and installed through the communication part 809 and / or installed from the detachable medium 811. The program codes contained in the computer program can be transmitted by any appropriate network medium, including but not limited to wireless, wired, etc., or any appropriate combination thereof.

[0163] In such embodiments, the computer program can be downloaded and installed from the network via the communication section 809, and / or installed from the removable media 811. When the computer program is executed by the processor 801, the above-described functions defined in the system of the embodiments of the present disclosure are executed. According to the embodiments of the present disclosure, the system, device, apparatus, module, unit, and the like described above can be implemented by the computer program modules.

[0164] According to the embodiments of the present disclosure, the program code for executing the computer program provided by the embodiments of the present disclosure can be written in any combination of one or more programming languages, and specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming language, and / or assembly / machine language. The programming language includes, but is not limited to, such as Java, C++, python, “C” language or similar programming language. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In the case involving a remote computing device, the remote computing device can be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, connected to the Internet through an Internet service provider).

[0165] The flowcharts and block diagrams in the drawings illustrate the possible implementation architectures, functions, and operations of the systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowcharts or block diagrams can represent a module, a program segment, or a portion of code that contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different orders than those noted in the drawings. For example, two blocks that are shown in succession can actually be executed substantially concurrently, or they can sometimes be executed in reverse order, depending on the involved functions. It should also be noted that each block in the block diagrams or flowcharts, and the combination of blocks in the block diagrams or flowcharts, can be implemented by a dedicated hardware-based system that performs the specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0166] Those skilled in the art can understand that the features described in various embodiments of the present disclosure can be combined and / or integrated in various combinations, even if such combinations are not explicitly described in the present disclosure. In particular, the features described in various embodiments of the present disclosure can be combined and / or integrated in various combinations without departing from the spirit and teachings of the present disclosure. All such combinations and / or integrations fall within the scope of the present disclosure.

[0167] The above describes embodiments of the present disclosure. However, these embodiments are merely for illustrative purposes, and are not intended to limit the scope of the present disclosure. Although each embodiment is described above separately, this does not mean that the measures in each embodiment cannot be used advantageously in combination. Those skilled in the art can make various substitutions and modifications without departing from the scope of the present disclosure, and these substitutions and modifications should all fall within the scope of the present disclosure.

Claims

1. A method of deploying a bastion, characterized by, The method applied to a deployment platform comprises: In response to a deployment request of a bastion host, if it is determined that a target configuration template corresponding to a deployment type contained in the deployment request exists in a configuration template library, the target configuration template is acquired; If it is determined that user operation data corresponding to the deployment type exists in a database, the user operation data is acquired, wherein the user operation data represents operation behavior data of a user corresponding to the deployment type; A target configuration file is generated according to the target configuration template and the user operation data; and In response to a confirmation operation for the target configuration file, the target configuration file is used to create a bastion host for a user corresponding to the deployment type; The method further comprises: In response to a modification operation for the target configuration file, modification information corresponding to the target configuration file is recorded; The network parameters of the configuration file generation model are adjusted by using the modification information and the target configuration file. The target configuration template comprises at least one to-be-configured field; The method further comprises:

2. The method of claim 1, wherein, If it is determined that a security machine limiting policy exists, the target configuration file is optimized by using the security machine limiting policy to obtain a first optimized configuration file; The method further comprises: A target authentication mode corresponding to the deployment type is determined from at least one preset authentication mode according to a preset access control policy; The target configuration file is optimized by using the target authentication mode to obtain a second optimized configuration file; 3. The method of claim 1, wherein, The method further comprises: If it is determined that the target configuration template corresponding to the deployment type does not exist in the configuration template library, a first configuration page for generating a configuration template is displayed. ​ 4. The method of claim 1, wherein, ​ ​ ​ ​ ​ 5. The method of claim 1, wherein, ​ ​ In response to first configuration information input in the first configuration page, a configuration template corresponding to the deployment type is generated to obtain the target configuration template; The configuration template corresponding to the deployment type is added to the configuration template library.

6. The method of claim 1, wherein, The method further comprises: In a case where it is determined that the database does not contain user operation data corresponding to the deployment type, a second configuration page for generating a configuration file is displayed; In response to second configuration information input in the second configuration page, a configuration file corresponding to the deployment type is generated to obtain the target configuration file.

7. A deployment device for a bastion host, characterized in that, The apparatus is applied to a deployment platform, and the apparatus comprises: A first obtaining module is configured to, in response to a deployment request of the bastion host, obtain a target configuration template corresponding to a deployment type contained in the deployment request from a configuration template library in a case where it is determined that the target configuration template exists in the configuration template library; A second obtaining module is configured to, in a case where it is determined that the database contains user operation data corresponding to the deployment type, obtain the user operation data, wherein the user operation data represents operation behavior data of a user corresponding to the deployment type; A first generating module is configured to generate a target configuration file according to the target configuration template and the user operation data; and A creating module is configured to, in response to a confirmation operation on the target configuration file, create a bastion host for a user corresponding to the deployment type by using the target configuration file; The first generating module comprises a generating submodule configured to input the target configuration template and the user operation data into a pre-trained configuration file generation model and output the target configuration file. The deployment apparatus further comprises: A recording module is configured to, in response to a modification operation on the target configuration file, record modification information corresponding to the target configuration file; An adjusting module is configured to adjust network parameters of the configuration file generation model by using the modification information and the target configuration file. 8.An electronic device comprising: one or more processors; memory for storing one or more computer programs, characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1-6.

9. A computer readable storage medium having stored thereon a computer program or instructions, characterized in that, The computer program or instructions implement the steps of the method according to any one of claims 1-6 when executed by a processor.

10. A computer program product comprising computer programs or instructions, characterized in that, The computer program or instructions implement the steps of the method according to any one of claims 1-6 when executed by a processor. The computer program or instructions implement the steps of the method according to any one of claims 1-6 when executed by a processor.

Images