Non-contact identity authentication bastion host method and system

Abstract

The invention discloses a non-contact identity authentication bastion host method and system, and the method comprises the steps: selecting any intranet bastion host, and installing a non-contact extraction program; configuring connection information of devices such as servers and switches which need to be connected by a non-contact extraction program; executing a non-contact program extraction function, extracting a mirror image and configuration of the equipment to a local intranet computer, and generating a local compressed file; segmenting the compressed file to generate a plurality of two-dimensional code pictures, and displaying the two-dimensional code pictures in a screen; shooting the two-dimensional code picture, executing a data restoration function of a non-contact extraction program on another computer, and importing the two-dimensional code picture; and the data in the picture is extracted and then combined into a new file, so that the effect of non-contact file restoration is realized. The system comprises a selection module, a connection module, a data decompression module and the like. According to the invention, the problem of how to safely manage and extract the equipment data in the physically isolated intranet by the equipment with the built-in non-contact program is solved.

Description

Technical Field

[0001] The present invention belongs to the field of data security technology, and specifically relates to a contactless identity authentication bastion host method and system. Background Art

[0002] The identity authentication bastion host is a device that supports AAA authentication and is used to centrally manage how to remotely operate and maintain various servers, switches, and network security devices in the network. The device is located in the same network as the operation and maintenance equipment. By connecting all the equipment that needs to be operated and maintained to the bastion host, and then providing a unified human-computer interaction interface and operation recording function, the operation and maintenance personnel can only access each device through the bastion host for operation and maintenance, and monitor and control the operation and maintenance process, avoiding the network security risks caused by the operation and maintenance personnel accessing the operation and maintenance equipment one by one using serial cables, network cables, etc. or directly operating on the operation and maintenance equipment. However, the existing bastion host only allows data to be transmitted in the network where the bastion host and the operation and maintenance equipment are located. When there is a need to copy the files and data of the operation and maintenance equipment to a place outside the network for data backup, file analysis, system restoration, etc., it is powerless. If it is really necessary to copy, it must be copied from the bastion host by means of a USB flash drive, a mobile hard disk, a CD, etc., and there are still risks of introducing Trojans, virus attacks, backdoor software, data leakage, etc. Summary of the invention

[0003] In view of the above-mentioned problems existing in the prior art, the present invention provides a contactless identity authentication bastion host method and system, which realizes the effect of centralized management of operation and maintenance equipment and "remote" extraction of operation and maintenance data without direct physical contact with the operation and maintenance equipment, thereby solving the problems existing in the existing bastion hosts.

[0004] In order to achieve the above object, the present invention adopts the following technical solution: A contactless identity authentication bastion host method, comprising the following steps: Step 1, select any computer A in the intranet to install the contactless program; Step 2, configuring the connection information of each device to be connected in the contactless program; Step 3, after ensuring successful connection to each device, execute the extraction function of the contactless program, extract the device information to the local computer, and generate a compressed package file; Step 4, calculating the size of the generated compressed package file, dividing the compressed package file into N files of different sizes according to the maximum data storage capacity of 2953 bytes allowed by QCcode two-dimensional code encoding version Version 40, and then converting them into two-dimensional codes one by one, and then displaying the N two-dimensional codes one by one on the display of this computer; Step 5, using the client, aim at the QR code displayed on the monitor, take photos of each QR code one by one, and then save the N photos taken to another computer B installed with the contactless program; Step 6, run the data extraction function of the contactless program on computer B, import N QR code photos, the program extracts data from the QR code photos one by one, and merges them into a compressed package file in a specified format. After decompressing the compressed package file, the data file of the device connected to the intranet computer A is obtained.

[0005] A further improvement of the present invention is that in step 1, any computer A in the intranet refers to a bastion host deployed in the same network as the equipment that needs to be operated and maintained, and is not allowed to have a physical connection with the Internet or other networks. The contactless program is a general contactless operating program that has been made public and developed.

[0006] A further improvement of the present invention is that in step 2, the connection information of each device includes the IP address of the connected device, a user name with administrator privileges, and a password, wherein each device refers to a Windows server and desktop computer with PowerShell function enabled, a Linux server and desktop computer with SSH function enabled, and a switch with SSH or STelnet function enabled.

[0007] A further improvement of the present invention is that in step 3, the device information refers to various files or recovery images obtainable in the Windows system, various files or root directories obtainable in the Linux system, and a running configuration file or config file obtained in the switch; the compressed package file refers to a compressed package file in the format of zip, gzip, or tar.gz.

[0008] A further improvement of the present invention is that in step 4, the compressed file is segmented into files of N sizes, which are then converted into two-dimensional codes one by one, and then the N two-dimensional codes are displayed one by one on the display of the computer, including: Compressed package data encoding conversion: use binary stream format to read the compressed package file, and then convert the binary code of the compressed package into base64 encoding; Calculate the length of the compressed data encoding as M; Set the capacity and error correction rate of each QR code: Set the QR code version to Version 40, the error correction code to L, and the maximum capacity of each QR code is B bytes; Split compressed package data: Split the compressed package data M according to the maximum capacity of each QR code, B bytes, and store them into array A to form A1, A2, ... A n-1 Sequence, the end of the less than B bytes are stored separately in array An middle; Generate QR codes one by one: first take A1 from the array, generate a QR code, save it locally, then take A2, generate a QR code, save it locally, and so on, until the last A is processed. n , N QR codes are generated; Display QR code: Display the QR codes one by one on the computer screen.

[0009] A further improvement of the present invention is that in step 5, the client is a mobile phone or a camera.

[0010] A contactless identity authentication bastion host system, comprising: Select the module and choose any computer A in the intranet to install the contactless program; A connection module, which configures connection information of each device to be connected in the contactless program; The information extraction module, after ensuring successful connection to each device, executes the extraction function of the contactless program, extracts the device information to the local computer, and generates a compressed package file; The information processing module calculates the size of the generated compressed package file, divides the compressed package file into N files of different sizes according to the maximum data storage capacity of 2953 bytes allowed by the QCcode two-dimensional code encoding version Version 40, and then converts them into two-dimensional codes one by one, and then displays the N two-dimensional codes one by one on the display of this computer; The QR code transfer module uses the client to aim at the QR code displayed on the monitor, take photos of each QR code one by one, and then save the N photos taken to another computer B installed with a contactless program; The data decompression module runs the data extraction function of the contactless program on computer B, imports N QR code photos, and the program extracts data from the QR code photos one by one and merges them into a compressed package file in a specified format. After decompressing the compressed package file, the data file of the device connected to the intranet computer A is obtained.

[0011] A further improvement of the present invention is that in the selection module, any computer A in the intranet refers to a bastion host deployed in the same network as the equipment that needs to be operated and maintained, and is not allowed to have a physical connection with the Internet or other networks. The contactless program is a general contactless operating program that has been made public and developed.

[0012] A further improvement of the present invention is that in the connection module, the connection information of each device includes the IP address of the connected device, a user name with administrator privileges, and a password, wherein each device refers to a Windows server and desktop computer with PowerShell function enabled, a Linux server and desktop computer with SSH function enabled, and a switch with SSH or STelnet function enabled.

[0013] A further improvement of the present invention is that, in the information extraction module, the device information refers to various files or recovery images obtainable in the Windows system, various files or root directories obtainable in the Linux system, and running configuration files or config files obtained in the switch; the compressed package file refers to a compressed package file in the format of zip, gzip, or tar.gz.

[0014] Compared with the prior art, the present invention has at least the following beneficial technical effects: The present invention provides a contactless identity authentication bastion machine method and system. After application, operation and maintenance personnel can uniformly manage all servers, desktop computers, switches and other intranet devices that need operation and maintenance through only one computer in the intranet and transfer files and data of any device out of the intranet. During the whole process, there is no need to use USB flash drives, mobile hard drives, or optical disks, nor is there any need to connect network cables, serial ports or other cables to the intranet devices. The devices in the entire intranet are still physically isolated from the outside, and data is transmitted in one direction, which completely eliminates viruses, Trojan horse infections or backdoor program attacks that may be introduced by external contact. It provides conditions for ensuring permanent "physical isolation" for sites with strict physical isolation requirements for internal and external networks, especially production control systems, industrial control systems, power monitoring systems and other environments, and eliminates the occurrence of ferry attacks through USB flash drives.

[0015] The present invention realizes the problem of how to safely manage and extract device data of a device with a built-in contactless program in a physically isolated intranet, and provides a new solution to the security problem of mobile media such as USB flash drives and optical disks accessing the intranet. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a schematic diagram of a contactless identity authentication bastion host method in this embodiment.

[0017] Figure 2 This is a rendering of the QR code generation process during the implementation of a contactless identity authentication bastion host method in this embodiment.

[0018] Figure 3 This is a structural block diagram of a contactless identity authentication bastion host system in this embodiment. DETAILED DESCRIPTION

[0019] In the following, only some exemplary embodiments are briefly described. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the spirit or scope of the present invention. Therefore, the drawings and descriptions are considered to be exemplary and non-restrictive in nature.

[0020] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0021] It should also be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0022] It should be further understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0023] Various structural schematic diagrams of the embodiments disclosed in the present invention are shown in the accompanying drawings. These figures are not drawn to scale, and some details are magnified and some details may be omitted for the purpose of clear expression. The shapes of various regions and layers shown in the figures and the relative sizes and positional relationships therebetween are only exemplary, and may deviate in practice due to manufacturing tolerances or technical limitations, and those skilled in the art may additionally design regions / layers with different shapes, sizes, and relative positions according to actual needs.

[0024] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0025] Example 1 like Figure 1 As shown, this embodiment discloses a contactless identity authentication bastion host method, including: Step 1: Select any computer (i.e. bastion host) A in the intranet to install the contactless program; Step 2, configuring the connection information of each device to be connected in the contactless program; Step 3, after ensuring successful connection to each device, execute the extraction function of the contactless program, extract the device information to the local computer, and generate a compressed package file; Step 4, calculating the size of the generated compressed package file, dividing the compressed package file into N files of different sizes according to the maximum data storage capacity of 2953 bytes allowed by QCcode two-dimensional code encoding version Version 40, and then converting them into two-dimensional codes one by one, and then displaying the N two-dimensional codes one by one on the display of this computer; Step 5, using the client, aim at the QR code displayed on the monitor, take photos of each QR code one by one, and then save the N photos taken to another computer B installed with the contactless program; Step 6, run the data extraction function of the contactless program on computer B, import N QR code photos, the program extracts data from the QR code photos one by one, and merges them into a compressed package file in a specified format. After decompressing the compressed package file, the data file of the device connected to the intranet computer A is obtained.

[0026] Example 2 like Figure 1 As shown, this embodiment discloses a contactless identity authentication bastion host method, comprising the following steps: S1, select any computer A in the intranet to install the contactless program, wherein the intranet computer A refers to a computer deployed in a separate network and is not allowed to have a physical connection with the Internet or other networks, and the contactless program is a general contactless operating program that has been disclosed and developed by the present invention unit; In this embodiment, a local area network is built, in which a computer A with Windows 7 installed, a switch B of the H3C S5500 model, and a Linux server C with Centos installed are deployed. The three devices are connected through a network cable to achieve network intercommunication. At the same time, a computer B that is not connected to the network is prepared separately, and the contactless program described in this patent is installed on computer A and computer B.

[0027] S2, configuring the connection information of each device to be connected in the contactless program, including the IP address of the connected device, the user name with administrator privileges, and the password, wherein the devices are Windows servers and desktop computers with PowerShell enabled, Linux servers and desktop computers with SSH enabled, and switches with SSH or STelnet enabled; In this embodiment, the configuration function page of the contactless program installed on computer A is opened to set the IP address, administrator account and password connected to switch B and server C, and the privileged mode is entered on switch B through the system-view command to enable the SSH function. The SSH function is enabled on server C using the systemctl start sshd command.

[0028] S3, after ensuring that step 2 can successfully connect to each device, execute the extraction function of the contactless program, extract the device information to the local computer, and generate a compressed package file, wherein the device information refers to various files or recovery images available in the Windows system, various files or root directories available in the Linux system, and running configuration files or config files available in the switch; the compressed package file refers to a compressed package file in the format of zip, gzip, or tar.gz; In this embodiment, by opening the extraction function of the contactless program, selecting the switch B to be extracted, and then clicking the connectivity test and start extraction buttons respectively, the extraction program is started, and the running-config configuration information of the switch B is downloaded to a text file in a directory of the computer A, and then the file is compressed into a zip format compressed package using the built-in compact command of Windows; the server C to be extracted is selected, and then the connectivity test and start extraction buttons are clicked respectively. The program will execute the root directory compression command on the Linux server, and download the compressed tar.gz format compressed file formed after compression to a directory of the computer A.

[0029] S4, calculating the size of the compressed package file generated in step 3, dividing the compressed package file into N files of different sizes according to the maximum data storage capacity of 2953 bytes allowed by QRCcode two-dimensional code encoding version Version 40, and then converting them into two-dimensional codes one by one, and then displaying the N two-dimensional codes one by one on the display of the computer; This embodiment obtains the size of the compressed package file (in MB), and compares it with the QRcode two-dimensional code encoding specification table, uses the maximum data storage bytes of Version 40 with the largest storage capacity, calculates how many blocks the compressed package needs to be divided into, and finally divides the blocks that are less than the maximum data storage bytes into 1 block, and sets the blocks to be sorted from 1 to N. Then, the contactless program uses the QRCode encoding module to read the data of each block one by one starting from 1, generates a two-dimensional code image, and saves it in a folder; when all blocks have generated two-dimensional code images, the images are read one by one in the contactless program and displayed on the display screen of computer A.

[0030] S5, using a mobile phone or a camera, aiming at the QR code displayed on the display in step 4, taking photos of each QR code one by one, and then saving the N photos taken to another computer B installed with a contactless program; In this embodiment, a mobile phone with a camera, an independent camera or other device is used to shoot the QR code displayed on the display of computer A. The shot photo is copied to another computer B with a contactless program installed via a data cable, a memory card or wireless transmission.

[0031] S6, run the data extraction function of the contactless program on computer B, import N QR code photos, the program extracts data from the QR code photos one by one, and merges them into a compressed package file in a specified format. After decompressing the compressed package file, the data file of the device connected to the intranet computer A is obtained, thereby achieving the purpose of extracting device data without direct contact with the device.

[0032] Further, the compressed file is segmented into N files of different sizes, and then converted into two-dimensional codes one by one, and then the N two-dimensional codes are displayed one by one on the display of the computer. The specific steps include: A. Compressed package data encoding conversion: Use binary stream format to read the compressed package file, and then convert the binary code of the compressed package into base64 encoding; B. Calculate the length of the compressed data encoding as M; C. Set the capacity and error correction rate of each QR code: Set the QR code version to Version 40 and the error correction code to L, and the maximum capacity of each QR code is B bytes.

[0033] D. Split the compressed package data: Split the compressed package data M according to the maximum capacity of each QR code, B bytes, and store them in array A to form A1, A2, ...A n-1 Sequence, the end of the less than B bytes are stored separately in array A n middle.

[0034] E. Generate QR codes one by one: first take A1 from the array, generate a QR code, save it locally, then take A2, generate a QR code, save it locally, and so on, until the last A is processed. n , N QR codes are generated; F. Display QR code: Display the QR code one by one on the computer screen so that it can be captured and obtained by devices such as mobile phones or cameras.

[0035] In this embodiment, the data extraction function is started by opening the Extract File from QR Code button of the contactless program installed on computer B, and the folder storing the QR code images is found in the QR code folder selection interface. Then the program reads each image one by one and stores them in an array. When all the images are read, the data in the array is merged to form a base64 encoded data, and then the data is decoded into binary encoded data, and the data is stored in zip or tar.gz format according to the data source. If the source is a Linux server, it is stored as a tar.gz compressed package. If it is a switch, it is stored as a zip compressed package. Finally, the file decompressed from the compressed package is the original file.

[0036] Example 3 like Figure 3 As shown, a contactless identity authentication bastion host system provided in this embodiment includes: Select the module and choose any computer A in the intranet to install the contactless program; A connection module, which configures connection information of each device to be connected in the contactless program; The information extraction module, after ensuring successful connection to each device, executes the extraction function of the contactless program, extracts the device information to the local computer, and generates a compressed package file; The information processing module calculates the size of the generated compressed package file, divides the compressed package file into N files of different sizes according to the maximum data storage capacity of 2953 bytes allowed by the QCcode two-dimensional code encoding version Version 40, and then converts them into two-dimensional codes one by one, and then displays the N two-dimensional codes one by one on the display of this computer; The QR code transfer module uses the client to aim at the QR code displayed on the monitor, take photos of each QR code one by one, and then save the N photos taken to another computer B installed with a contactless program; The data decompression module runs the data extraction function of the contactless program on computer B, imports N QR code photos, and the program extracts data from the QR code photos one by one and merges them into a compressed package file in a specified format. After decompressing the compressed package file, the data file of the device connected to the intranet computer A is obtained.

[0037] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or basic features of the present invention. Therefore, no matter from which point of view, the embodiments should be regarded as exemplary and non-restrictive. The scope of the present invention is defined by the attached claims rather than the above description, and it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention. Any figure mark in the claims should not be regarded as limiting the claims involved.

[0038] In addition, it should be understood that although this specification is described in accordance with the implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation modes that can be understood by those skilled in the art. The above content is only to illustrate the technical idea of ​​the present invention, and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution according to the technical idea proposed by the present invention shall fall within the protection scope of the claims of the present invention.

Claims

1. A contactless identity authentication bastion host method, characterized in that: The following steps are involved: Step 1, select any computer A in the intranet to install the contactless program; Step 2, configuring the connection information of each device to be connected in the contactless program; Step 3, after ensuring successful connection to each device, execute the extraction function of the contactless program, extract the device information to the local computer, and generate a compressed package file; Step 4, calculating the size of the generated compressed package file, dividing the compressed package file into N files of different sizes according to the maximum data storage capacity of 2953 bytes allowed by QCcode two-dimensional code encoding version Version 40, and then converting them into two-dimensional codes one by one, and then displaying the N two-dimensional codes one by one on the display of this computer; Step 5, using the client, aim at the QR code displayed on the monitor, take photos of each QR code one by one, and then save the N photos taken to another computer B installed with the contactless program; Step 6, run the data extraction function of the contactless program on computer B, import N QR code photos, the program extracts data from the QR code photos one by one, and merges them into a compressed package file in a specified format. After decompressing the compressed package file, the data file of the device connected to the intranet computer A is obtained.

2. According to the non-contact identity authentication bastion host method of claim 1, it is characterized in that: In step 1, any computer A in the intranet refers to a bastion host deployed in the same network as the equipment that needs to be operated and maintained, and is not allowed to have a physical connection with the Internet or other networks. The contactless program is a general contactless operation program that has been made public and developed.

3. According to the non-contact identity authentication bastion host method of claim 1, it is characterized in that: In step 2, the connection information of each device includes the IP address of the connected device, the user name with administrator privileges, and the password, where each device refers to a Windows server and desktop computer with PowerShell enabled, a Linux server and desktop computer with SSH enabled, and a switch with SSH or STelnet enabled.

4. According to the non-contact identity authentication bastion host method of claim 1, it is characterized in that: In step 3, device information refers to various files or recovery images available in Windows, various files or root directories available in Linux, and running configuration files or config files obtained in the switch; compressed package files refer to compressed package files in zip, gzip, or tar.gz formats.

5. According to the contactless identity authentication bastion host method of claim 1, it is characterized in that: In step 4, the compressed file is divided into N files of different sizes, and then converted into two-dimensional codes one by one, and then the N two-dimensional codes are displayed one by one on the display of the computer, including: Compressed package data encoding conversion: use binary stream format to read the compressed package file, and then convert the binary code of the compressed package into base64 encoding; Calculate the length of the compressed data encoding as M; Set the capacity and error correction rate of each QR code: Set the QR code version to Version 40, the error correction code to L, and the maximum capacity of each QR code is B bytes; Split compressed package data: Split the compressed package data M according to the maximum capacity of each QR code, B bytes, and store them into array A to form A1, A2, ... A n-1 Sequence, the end of the less than B bytes are stored separately in array A n middle; Generate QR codes one by one: first take A1 from the array, generate a QR code, save it locally, then take A2, generate a QR code, save it locally, and so on, until the last A is processed. n , N QR codes are generated; Display QR code: Display the QR codes one by one on the computer screen.

6. A contactless identity authentication bastion host method according to claim 1, characterized in that: In step 5, the client is a mobile phone or a camera.

7. A contactless identity authentication bastion host system, characterized in that: include: Select the module and choose any computer A in the intranet to install the contactless program; A connection module, which configures connection information of each device to be connected in the contactless program; The information extraction module, after ensuring successful connection to each device, executes the extraction function of the contactless program, extracts the device information to the local computer, and generates a compressed package file; The information processing module calculates the size of the generated compressed package file, divides the compressed package file into N files of different sizes according to the maximum data storage capacity of 2953 bytes allowed by the QCcode two-dimensional code encoding version Version 40, and then converts them into two-dimensional codes one by one, and then displays the N two-dimensional codes one by one on the display of this computer; The QR code transfer module uses the client to aim at the QR code displayed on the monitor, take photos of each QR code one by one, and then save the N photos taken to another computer B installed with a contactless program; The data decompression module runs the data extraction function of the contactless program on computer B, imports N QR code photos, and the program extracts data from the QR code photos one by one and merges them into a compressed package file in a specified format. After decompressing the compressed package file, the data file of the device connected to the intranet computer A is obtained.

8. A contactless identity authentication bastion host system according to claim 7, characterized in that: In the selection module, any computer A in the intranet refers to a bastion host deployed in the same network as the equipment that needs to be operated and maintained, and is not allowed to have a physical connection with the Internet or other networks. The contactless program is a general contactless operating program that has been made public and developed by the unit.

9. A contactless identity authentication bastion host system according to claim 7, characterized in that: In the connection module, the connection information of each device includes the IP address of the connected device, the user name with administrator privileges, and the password. The devices refer to Windows servers and desktop computers with PowerShell enabled, Linux servers and desktop computers with SSH enabled, and switches with SSH or STelnet enabled.

10. A contactless identity authentication bastion host system according to claim 7, characterized in that: In the information extraction module, device information refers to various files or recovery images available in the Windows system, various files or root directories available in the Linux system, and running configuration files or config files obtained in the switch; compressed package files refer to compressed package files in the zip, gzip, or tar.gz formats.

Images