Terminal information acquisition method and device, computer equipment and storage medium

Abstract

The embodiment of the invention discloses a terminal information acquisition method and device, computer equipment and a storage medium. The method comprises the following steps: setting a target database IP port; acquiring a bastion host proxy IP port associated with the terminal IP address; binding the target database IP port with the bastion host agent IP port to obtain a binding relationship; a probe is arranged in the bastion host; capturing terminal operation and maintenance traffic by using the probe; analyzing the terminal operation and maintenance traffic to obtain access information; determining proxy object IP port information corresponding to the access information according to the binding relationship; and determining real terminal information according to the corresponding proxy object IP port information. By implementing the method provided by the embodiment of the invention, the real terminal information can be obtained, so that the database audit is more complete and detailed.

Description

Technical Field

[0001] The present invention relates to a data processing method, and more specifically to a terminal information acquisition method, device, computer equipment and storage medium. Background Art

[0002] Traditional database auditing can only obtain data information on operations on the target data source in the bastion host. After the operation and maintenance traffic connects to the database, it can only parse the operations on the target data source information, but cannot parse which specific client operates it. There are a series of problems such as incomplete information and missing terminal information. The terminal cannot be monitored, audited, and displayed. There are a series of problems such as single function and missing information.

[0003] In addition, there is another situation where multiple clients operate on the data source at the same time. Traditional database auditing can only audit the access information of multiple bastion hosts and cannot obtain specific terminal information.

[0004] Therefore, it is necessary to design a new method to obtain real terminal information so that the database audit can be more complete and detailed. Summary of the invention

[0005] The purpose of the present invention is to overcome the defects of the prior art and provide a method, device, computer equipment and storage medium for obtaining terminal information.

[0006] To achieve the above object, the present invention adopts the following technical solution: a terminal information acquisition method, comprising:

[0007] Set the target database IP port;

[0008] Get the bastion host proxy IP port associated with the terminal IP address;

[0009] Bind the target database IP port to the bastion host proxy IP port to obtain a binding relationship;

[0010] Installing the probe in the bastion host;

[0011] Using the probe to capture terminal operation and maintenance traffic;

[0012] Parsing the terminal operation and maintenance traffic to obtain access information;

[0013] Determine the proxy object IP port information corresponding to the access information according to the binding relationship;

[0014] Determine the real terminal information based on the corresponding proxy object IP port information.

[0015] Its further technical solution is: the setting of the target database IP port includes:

[0016] Use the Add Protection Object function to add the target database IP port that needs to be audited, and verify whether the target database is connected by testing the link.

[0017] A further technical solution is: binding the target database IP port with the bastion host proxy IP port to obtain a binding relationship, including:

[0018] Pull the proxy IP port information corresponding to the target database IP port;

[0019] Bind the proxy IP port information to the bastion host proxy IP port to form a configuration file, store it in the audit database, and store the configuration file in the audit protection object in a multi-node manner;

[0020] The configuration file is written into the internal configuration file information to obtain a binding relationship.

[0021] A further technical solution is: installing the probe in the bastion host includes:

[0022] Push the probe to the bastion host so that the bastion host automatically installs the probe;

[0023] Authenticate the bypass mode probe loaded on the bastion host.

[0024] A further technical solution is: parsing the terminal operation and maintenance traffic to obtain access information includes:

[0025] Read the configuration file in the audit protection object;

[0026] Filtering the flow data of the specified IP in the terminal operation and maintenance flow according to the configuration file to obtain a filtering result;

[0027] The specific information of the filtering result is processed to obtain access information.

[0028] A further technical solution is: determining the proxy object IP port information corresponding to the access information according to the binding relationship includes:

[0029] Filter out the target database information and the bastion host proxy information according to the access information, and determine the bastion host proxy IP port according to the binding relationship to obtain the proxy object IP port information;

[0030] Parsing source data information according to the message;

[0031] The source data information is converted into display fields and stored in a database.

[0032] The present invention also provides a terminal information acquisition device, comprising:

[0033] Setting unit, used to set the target database IP port;

[0034] An acquisition unit, used to acquire the bastion host proxy IP port associated with the terminal IP address;

[0035] A binding unit, used to bind the target database IP port to the bastion host proxy IP port to obtain a binding relationship;

[0036] An installation unit, used for installing the probe in the bastion host;

[0037] A capture unit, used to capture terminal operation and maintenance traffic using the probe;

[0038] A parsing unit, used for parsing the terminal operation and maintenance traffic to obtain access information;

[0039] A port determination unit, configured to determine the proxy object IP port information corresponding to the access information according to the binding relationship;

[0040] The information determining unit is used to determine the real terminal information according to the proxy object IP port information.

[0041] Its further technical solution is: the setting unit is used to add the target database IP port that needs to be audited through the new protection object function, and verify whether the target database is connected through the test link.

[0042] The present invention further provides a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor implements the above method when executing the computer program.

[0043] The present invention also provides a storage medium, wherein the storage medium stores a computer program, and the computer program implements the above method when executed by a processor.

[0044] Compared with the prior art, the beneficial effect of the present invention is as follows: the present invention binds the target database IP port, the bastion host proxy IP port, and the terminal IP address, uses a probe to capture the terminal operation and maintenance traffic, and parses it, and determines the proxy object IP port information in combination with the binding relationship. The proxy object IP port information can be the IP address of the real terminal, thereby determining the real terminal information, and obtaining the real terminal information, so that the database audit is more complete and detailed.

[0045] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying any creative work.

[0047] Figure 1 A schematic diagram of an application scenario of the terminal information acquisition method provided by an embodiment of the present invention;

[0048] Figure 2 A schematic diagram of a process for obtaining terminal information provided by an embodiment of the present invention;

[0049] Figure 3 A schematic diagram of a sub-process of a method for acquiring terminal information provided by an embodiment of the present invention;

[0050] Figure 4 A schematic diagram of a sub-process of a method for acquiring terminal information provided by an embodiment of the present invention;

[0051] Figure 5 A schematic diagram of a sub-process of a method for acquiring terminal information provided by an embodiment of the present invention;

[0052] Figure 6 A schematic diagram of a sub-process of a method for acquiring terminal information provided by an embodiment of the present invention;

[0053] Figure 7 A schematic diagram of adding a target database IP port provided by an embodiment of the present invention;

[0054] Figure 8 A schematic diagram of manually adding a bastion host proxy IP port provided in an embodiment of the present invention;

[0055] Fig. 9 A schematic diagram of automatically pushing a probe to a bastion host provided by an embodiment of the present invention;

[0056] Fig.10 A schematic block diagram of a terminal information acquisition device provided by an embodiment of the present invention;

[0057] Fig.11 A schematic block diagram of a binding unit of a terminal information acquisition device provided in an embodiment of the present invention;

[0058] Fig.12 A schematic block diagram of an installation unit of a terminal information acquisition device provided in an embodiment of the present invention;

[0059] Fig.13 A schematic block diagram of a parsing unit of a terminal information acquisition device provided in an embodiment of the present invention;

[0060] Fig.14 A schematic block diagram of a port determination unit of a terminal information acquisition device provided in an embodiment of the present invention;

[0061] Fig.15 A schematic block diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0062] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0064] It should also be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0065] It should be further understood that the term "and / or" used in the present description and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0066] See also Figure 1 and Figure 2 , Figure 1 A schematic diagram of an application scenario of the terminal information acquisition method provided in an embodiment of the present invention. Figure 2 A schematic flow chart of a terminal information acquisition method provided in an embodiment of the present invention. The terminal information acquisition method is applied in a server. The server is deployed with an audit system, which interacts with the bastion host for data, and interacts with different operation and maintenance clients, i.e., terminals, through switches, directly audits the real terminal information of the real client, as well as the operation of the target database, and can audit the proxy information of the bastion host and the operation of the target database. And the target database information can be matched with the bastion host proxy information and the client source information in a one-to-one relationship. Thus, a complete information link is displayed. The real terminal information can be tracked and displayed. .

[0067] Figure 2 FIG. 1 is a flow chart of a method for obtaining terminal information provided by an embodiment of the present invention. Figure 2 As shown, the method includes the following steps S110 to S180.

[0068] S110. Set the target database IP port.

[0069] In this embodiment, the target database IP port refers to the IP address of the target database that needs to be audited.

[0070] Specifically, Figure 7 As shown, add the target database IP port that needs to be audited through the new protection object function, and verify whether the target database is connected through the test link.

[0071] In this embodiment, in the audit system protection object module, through the new protection object function, the IP port and other detailed information of the target database to be audited are added. First, a test link is used to verify whether the audit system is connected to the target database. Only the target database that can be connected will be actually added to the audit system.

[0072] S120. Obtain the bastion host proxy IP port associated with the terminal IP address.

[0073] In this embodiment, the bastion host proxy IP port refers to the IP address corresponding to the bastion host, and the bastion host proxy IP port is bound to the terminal. That is, when the bastion host proxy IP port is known, the corresponding proxy object IP port, that is, the IP address of the terminal, can be obtained.

[0074] Specifically, use the scheduled task to pull the proxy object IP port of the bastion host. The proxy object IP port corresponds to the real terminal.

[0075] S130. Bind the target database IP port to the bastion host proxy IP port to obtain a binding relationship.

[0076] In this embodiment, the binding relationship refers to the correspondence between the target database IP port and the bastion host proxy IP port.

[0077] In one embodiment, see Figure 3 , the above-mentioned step S130 may include steps S131 to S133.

[0078] S131, pull the proxy IP port information corresponding to the target database IP port;

[0079] S132, binding the proxy IP port information to the bastion host proxy IP port to form a configuration file, and storing it in the audit database, and storing the configuration file in the audit protection object in a multi-node manner;

[0080] S133: Write the configuration file into the internal configuration file information to obtain a binding relationship.

[0081] In this embodiment, the proxy IP port information corresponding to the IP port of the target database is pulled, and bound to the bastion host proxy IP port, stored in the audit database, and stored in the audit protection object in a multi-node manner. The target database IP port information and the bastion host proxy IP port are written into the internal configuration file information together. The protocol module is used to read and parse the information of the specified IP.

[0082] Specifically, Figure 8 As shown, the target database IP port is linked to the bastion host, and the bastion host proxy IP port is synchronized to the audit system, or the bastion host proxy IP port is added to the audit system and bound to the protection object by manually adding multiple nodes, that is, associated and bound with the target database IP port.

[0083] S140: Install the probe in the bastion host.

[0084] In one embodiment, see Figure 4 , the above-mentioned step S140 may include steps S141 to S142.

[0085] S141, pushing the probe to the bastion host, so that the bastion host automatically installs the probe;

[0086] S142. Authenticate the bypass mode probe loaded on the bastion host.

[0087] Specifically, Fig. 9 As shown, if you want to use the bypass mode probe for data capture, you need to install the probe first. Click the Push Probe button, enter the bastion host account password and other login information, push the probe to the specified bastion host, and automatically install the bypass mode probe in the bastion host. After the bastion host is installed, click the Authentication button to authenticate the bypass mode probe loaded on the bastion host. After the bypass mode probe is authenticated by the audit system network probe module, it starts to work officially.

[0088] S150: Use the probe to capture terminal operation and maintenance traffic.

[0089] In this embodiment, the terminal operation and maintenance traffic refers to the data packets of the operations initiated by the terminal to the server.

[0090] Specifically, the bypass mode probe captures data packets, groups data flows, and forms terminal operation and maintenance traffic.

[0091] S160: Analyze the terminal operation and maintenance traffic to obtain access information.

[0092] In this embodiment, the access information refers to specific SQL statements, request information, response information, result sets and the like.

[0093] In one embodiment, see Figure 5 , the above-mentioned step S160 may include steps S161 to S163.

[0094] S161. Read the configuration file in the audit protection object.

[0095] In this embodiment, the configuration file written in the audit protection object is read to obtain the binding relationship between the proxy IP port information and the bastion machine proxy IP port and the relationship between the proxy IP port information and the target database IP port.

[0096] Use the file writing method to read the target database information and the proxy object information of the bastion host.

[0097] S162. Filter out the flow data of the designated IP in the terminal operation and maintenance flow according to the configuration file to obtain a filtering result.

[0098] In this embodiment, the filtering result refers to the data corresponding to the specified proxy IP port information.

[0099] S163: Process the specific information of the filtering result to obtain access information.

[0100] Specifically, according to the target database IP port and proxy IP port information, the traffic data of the specified IP in the traffic package is filtered out, and the specific information in the traffic data is processed - specific SQL statements, request information, response information, result set, and the parsed and processed message is sent through the message middleware Kafka.

[0101] S170. Determine the proxy object IP port information corresponding to the access information according to the binding relationship.

[0102] In one embodiment, see Figure 6 , the above-mentioned step S170 may include steps S171 to S173.

[0103] S171, filtering out messages of target database information and bastion host proxy information according to the access information, and determining the bastion host proxy IP port according to the binding relationship to obtain proxy object IP port information;

[0104] S172, parsing source data information according to the message;

[0105] S173: Convert the source data information into display fields and store them in a database.

[0106] In this embodiment, the message middleware information is accepted, and the messages of the set target database information and the bastion host proxy information are filtered out according to the messages sent from the message middleware. The proxy IP port information is determined based on this information, and the source data information is parsed, and the specific information is converted into display fields and stored in the database.

[0107] S180: Determine the real terminal information according to the corresponding proxy IP port information.

[0108] In this embodiment, the proxy IP port information, that is, the IP address of the terminal, combined with the content stored in the database, can directly audit the real terminal information and the operation on the target database.

[0109] The method of this embodiment can directly audit the real terminal information and its operation on the target database by auditing the IP port information of the bastion host and the operation on the target database, and can make a one-to-one correspondence between the target database IP port information, the bastion host IP port information, and the IP address of the terminal, thereby displaying a complete information link. The real terminal information can be tracked and displayed.

[0110] The above-mentioned terminal information acquisition method binds the target database IP port, the bastion host proxy IP port, and the terminal IP address, uses a probe to capture the terminal operation and maintenance traffic, and parses it, and determines the proxy object IP port information in combination with the binding relationship. The proxy object IP port information can be the IP address of the real terminal, thereby determining the real terminal information, and obtaining the real terminal information, so that the database audit is more complete and detailed.

[0111] Fig.10 FIG. 3 is a schematic block diagram of a terminal information acquisition device 300 provided in an embodiment of the present invention. Fig.10 As shown, corresponding to the above terminal information acquisition method, the present invention also provides a terminal information acquisition device 300. The terminal information acquisition device 300 includes a unit for executing the above terminal information acquisition method, and the device can be configured in a server. Fig.10 The terminal information acquisition device 300 includes a setting unit 301, an acquisition unit 302, a binding unit 303, an installation unit 304, a capture unit 305, a parsing unit 306, a port determination unit 307 and an information determination unit 308.

[0112] The setting unit 301 is used to set the target database IP port; the acquisition unit 302 is used to acquire the bastion host proxy IP port associated with the terminal IP address; the binding unit 303 is used to bind the target database IP port to the bastion host proxy IP port to obtain a binding relationship; the installation unit 304 is used to install the probe in the bastion host; the capture unit 305 is used to capture the terminal operation and maintenance traffic using the probe; the parsing unit 306 is used to parse the terminal operation and maintenance traffic to obtain access information; the port determination unit 307 is used to determine the proxy object IP port information corresponding to the access information according to the binding relationship; the information determination unit 308 is used to determine the real terminal information according to the proxy object IP port information.

[0113] In one embodiment, the setting unit 301 is used to add the target database IP port that needs to be audited through the function of adding a protection object, and verify whether the target database is connected through a test link.

[0114] In one embodiment, if Fig.11 As shown, the binding unit 303 includes a pulling subunit 3031 , a file generating subunit 3032 and a writing subunit 3033 .

[0115] The pulling subunit 3031 is used to pull the proxy IP port information corresponding to the target database IP port; the file generating subunit 3032 is used to bind the proxy IP port information with the bastion host proxy IP port to form a configuration file, and store it in the audit database, and store the configuration file in the audit protection object in a multi-node manner; the writing subunit 3033 is used to write the configuration file into the internal configuration file information to obtain a binding relationship.

[0116] In one embodiment, if Fig.12 As shown, the installation unit 304 includes a push subunit 3041 and an authentication subunit 3042 .

[0117] The push subunit 3041 is used to push the probe to the bastion host so that the bastion host automatically installs the probe; the authentication subunit 3042 is used to authenticate the bypass mode probe loaded on the bastion host.

[0118] In one embodiment, if Fig.13 As shown, the parsing unit 306 includes a reading subunit 3061 , a filtering subunit 3062 and a processing subunit 3063 .

[0119] The reading subunit 3061 is used to read the configuration file in the audit protection object; the filtering subunit 3062 is used to filter out the traffic data of the specified IP in the terminal operation and maintenance traffic according to the configuration file to obtain the filtering result; the processing subunit 3063 is used to process the specific information of the filtering result to obtain the access information.

[0120] In one embodiment, if Fig.12 As shown, the port determination unit 307 includes an information determination subunit 3071 , a source data parsing subunit 3072 and a conversion subunit 3073 .

[0121] The information determination subunit 3071 is used to filter out the messages of the target database information and the bastion host proxy information according to the access information, and determine the bastion host proxy IP port according to the binding relationship to obtain the proxy object IP port information; the source data parsing subunit 3072 is used to parse the source data information according to the message; the conversion subunit 3073 is used to convert the source data information into display fields and store them in the database.

[0122] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the above-mentioned terminal information acquisition device 300 and each unit can refer to the corresponding description in the aforementioned method embodiment, and for the convenience and brevity of description, it will not be repeated here.

[0123] The terminal information acquisition device 300 can be implemented in the form of a computer program. Fig.13 Runs on the computer device shown.

[0124] See also Fig.13 , Fig.13 5 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device 500 may be a server, wherein the server may be an independent server or a server cluster composed of multiple servers.

[0125] See also Fig.13 The computer device 500 includes a processor 502 , a memory and a network interface 505 connected via a system bus 501 , wherein the memory may include a non-volatile storage medium 503 and an internal memory 504 .

[0126] The non-volatile storage medium 503 can store an operating system 5031 and a computer program 5032. The computer program 5032 includes program instructions, and when the program instructions are executed, the processor 502 can execute a terminal information acquisition method.

[0127] The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500 .

[0128] The internal memory 504 provides an environment for the operation of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute a terminal information acquisition method.

[0129] The network interface 505 is used to communicate with other devices over the network. Fig.13 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the computer device 500 to which the solution of the present application is applied. The specific computer device 500 may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0130] The processor 502 is used to run the computer program 5032 stored in the memory to implement the following steps:

[0131] Set the target database IP port; obtain the bastion host proxy IP port associated with the terminal IP address; bind the target database IP port to the bastion host proxy IP port to obtain a binding relationship; install a probe in the bastion host; use the probe to capture terminal operation and maintenance traffic; parse the terminal operation and maintenance traffic to obtain access information; determine the proxy object IP port information corresponding to the access information based on the binding relationship; determine the real terminal information based on the corresponding proxy object IP port information.

[0132] In one embodiment, when the processor 502 implements the step of setting the target database IP port, it specifically implements the following steps:

[0133] Use the Add Protection Object function to add the target database IP port that needs to be audited, and verify whether the target database is connected by testing the link.

[0134] In one embodiment, when the processor 502 implements the step of binding the target database IP port with the bastion server proxy IP port to obtain a binding relationship, the processor 502 specifically implements the following steps:

[0135] Pull the proxy IP port information corresponding to the target database IP port; bind the proxy IP port information to the bastion host proxy IP port to form a configuration file, and store it in the audit database, and store the configuration file in the audit protection object in a multi-node manner; write the configuration file into the internal configuration file information to obtain the binding relationship.

[0136] In one embodiment, when implementing the step of installing the probe in the bastion server, the processor 502 specifically implements the following steps:

[0137] Push the probe to the bastion host so that the bastion host automatically installs the probe; authenticate the bypass mode probe loaded on the bastion host.

[0138] In one embodiment, when the processor 502 implements the step of parsing the terminal operation and maintenance traffic to obtain access information, the processor 502 specifically implements the following steps:

[0139] Read the configuration file in the audit protection object; filter out the flow data of the specified IP in the terminal operation and maintenance flow according to the configuration file to obtain the filtering result; process the specific information of the filtering result to obtain the access information.

[0140] In one embodiment, when the processor 502 implements the step of determining the proxy object IP port information corresponding to the access information according to the binding relationship, the processor 502 specifically implements the following steps:

[0141] Filter out messages of target database information and bastion host proxy information according to the access information, and determine the bastion host proxy IP port according to the binding relationship to obtain the proxy object IP port information; parse out source data information according to the message; convert the source data information into display fields and store them in the database.

[0142] It should be understood that in the embodiment of the present application, the processor 502 may be a central processing unit (CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0143] It can be understood by those skilled in the art that all or part of the processes in the method for implementing the above embodiment can be completed by instructing the relevant hardware through a computer program. The computer program includes program instructions, and the computer program can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the embodiment of the above method.

[0144] Therefore, the present invention also provides a storage medium. The storage medium may be a computer-readable storage medium. The storage medium stores a computer program, wherein when the computer program is executed by a processor, the processor executes the following steps:

[0145] Set the target database IP port;

[0146] Obtain the bastion host proxy IP port associated with the terminal IP address; bind the target database IP port to the bastion host proxy IP port to obtain a binding relationship; install a probe in the bastion host; use the probe to capture terminal operation and maintenance traffic; parse the terminal operation and maintenance traffic to obtain access information; determine the proxy object IP port information corresponding to the access information based on the binding relationship; determine the real terminal information based on the corresponding proxy object IP port information.

[0147] In one embodiment, when the processor executes the computer program to implement the step of setting the target database IP port, the processor specifically implements the following steps:

[0148] Use the Add Protection Object function to add the target database IP port that needs to be audited, and verify whether the target database is connected by testing the link.

[0149] In one embodiment, when the processor executes the computer program to implement the step of binding the target database IP port with the bastion server proxy IP port to obtain a binding relationship, the processor specifically implements the following steps:

[0150] Pull the proxy IP port information corresponding to the target database IP port; bind the proxy IP port information to the bastion host proxy IP port to form a configuration file, and store it in the audit database, and store the configuration file in the audit protection object in a multi-node manner; write the configuration file into the internal configuration file information to obtain the binding relationship.

[0151] In one embodiment, when the processor executes the computer program to implement the step of installing the probe in the bastion server, the processor specifically implements the following steps:

[0152] Push the probe to the bastion host so that the bastion host automatically installs the probe; authenticate the bypass mode probe loaded on the bastion host.

[0153] In one embodiment, when the processor executes the computer program to implement the step of parsing the terminal operation and maintenance traffic to obtain access information, the processor specifically implements the following steps:

[0154] Read the configuration file in the audit protection object; filter out the flow data of the specified IP in the terminal operation and maintenance flow according to the configuration file to obtain the filtering result; process the specific information of the filtering result to obtain the access information.

[0155] In one embodiment, when the processor executes the computer program to implement the step of determining the proxy object IP port information corresponding to the access information according to the binding relationship, the processor specifically implements the following steps:

[0156] Filter out messages of target database information and bastion host proxy information according to the access information, and determine the bastion host proxy IP port according to the binding relationship to obtain the proxy object IP port information; parse out source data information according to the message; convert the source data information into display fields and store them in the database.

[0157] The storage medium may be a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disk, etc., which are computer-readable storage media that can store program codes.

[0158] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0159] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of each unit is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0160] The steps in the method of the embodiment of the present invention can be adjusted in order, combined and deleted according to actual needs. The units in the device of the embodiment of the present invention can be combined, divided and deleted according to actual needs. In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0161] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, terminal, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention.

[0162] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A method for obtaining terminal information, characterized in that: include: Set the target database IP port; Get the bastion host proxy IP port associated with the terminal IP address; Bind the target database IP port to the bastion host proxy IP port to obtain a binding relationship; Installing the probe in the bastion host; Using the probe to capture terminal operation and maintenance traffic; Parsing the terminal operation and maintenance traffic to obtain access information; Determine the proxy object IP port information corresponding to the access information according to the binding relationship; Determine the real terminal information based on the corresponding proxy object IP port information.

2. The terminal information acquisition method according to claim 1, characterized in that: The setting of the target database IP port includes: Use the Add Protection Object function to add the target database IP port that needs to be audited, and verify whether the target database is connected by testing the link.

3. The terminal information acquisition method according to claim 1, characterized in that: Binding the target database IP port to the bastion host proxy IP port to obtain a binding relationship includes: Pull the proxy IP port information corresponding to the target database IP port; Bind the proxy IP port information to the bastion host proxy IP port to form a configuration file, store it in the audit database, and store the configuration file in the audit protection object in a multi-node manner; The configuration file is written into the internal configuration file information to obtain a binding relationship.

4. The terminal information acquisition method according to claim 1, characterized in that: The step of installing the probe in the bastion host includes: Push the probe to the bastion host so that the bastion host automatically installs the probe; Authenticate the bypass mode probe loaded on the bastion host.

5. The terminal information acquisition method according to claim 1, characterized in that: The parsing of the terminal operation and maintenance traffic to obtain access information includes: Read the configuration file in the audit protection object; Filtering the flow data of the specified IP in the terminal operation and maintenance flow according to the configuration file to obtain a filtering result; The specific information of the filtering result is processed to obtain access information.

6. The terminal information acquisition method according to claim 1, characterized in that: The determining, according to the binding relationship, the proxy object IP port information corresponding to the access information includes: Filter out the target database information and the bastion host proxy information according to the access information, and determine the bastion host proxy IP port according to the binding relationship to obtain the proxy object IP port information; Parsing source data information according to the message; The source data information is converted into display fields and stored in a database.

7. The terminal information acquisition device is characterized in that: include: Setting unit, used to set the target database IP port; An acquisition unit, used to acquire the bastion host proxy IP port associated with the terminal IP address; A binding unit, used to bind the target database IP port to the bastion host proxy IP port to obtain a binding relationship; An installation unit, used for installing the probe in the bastion host; A capture unit, used to capture terminal operation and maintenance traffic using the probe; A parsing unit, used for parsing the terminal operation and maintenance traffic to obtain access information; A port determination unit, configured to determine the proxy object IP port information corresponding to the access information according to the binding relationship; The information determining unit is used to determine the real terminal information according to the proxy object IP port information.

8. The terminal information acquisition device according to claim 7, characterized in that: The setting unit is used to add the IP port of the target database that needs to be audited through the function of adding a protection object, and to verify whether the target database is connected through a test link.

9. A computer device, characterized in that: The computer device comprises a memory and a processor, the memory stores a computer program, and the processor implements the method according to any one of claims 1 to 6 when executing the computer program.

10. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images