A resource deployment method, device and equipment of a bastion cluster and a medium

Abstract

Embodiments of the present application provide a kind of fortress machine cluster resource deployment method, device, equipment and medium, related to network security technical field.The fortress machine cluster resource deployment method includes: at least one operation and maintenance protocol supported by fortress machine cluster is evaluated use index value;Wherein, the use index value of various operation and maintenance protocols in the at least one operation and maintenance protocol is used to indicate the use of the various operation and maintenance protocols by the fortress machine cluster;In the use index value of any one operation and maintenance protocol in the at least one operation and maintenance protocol exceeds first preset threshold, and there is no proxy program of the operation and maintenance protocol in the program library of the fortress machine cluster Condition, the proxy program of the operation and maintenance protocol is downloaded to the program library.The technical effect of the present application embodiment can realize the dynamic deployment of the proxy program of operation and maintenance protocol to fortress machine cluster, avoid too much occupy the storage resource of fortress machine cluster.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a method, apparatus, device, and medium for deploying resources in a bastion host cluster. Background Technology

[0002] A bastion host is a network security management tool that acts as an interface or gateway between external and internal networks. It mainly uses protocol proxying to take over access to various devices within the internal network from external operation and maintenance terminals. By monitoring and recording the operation behavior of operation and maintenance users on various devices within the internal network, it can achieve centralized alarms, timely handling, and auditing and accountability, thereby ensuring the security of the internal network.

[0003] Because there are many devices within the internal network, the maintenance and operation of these devices is typically handled by multiple bastion hosts in a bastion host cluster. However, to ensure that all bastion hosts in the cluster support all functionalities, it is necessary to deploy proxy programs for each of the various maintenance protocols, such as SSH (Secure Shell), RDP (Remote Desktop Protocol), and SQL (Structured Query Language). This results in excessive consumption of storage resources in the bastion host cluster, reducing the efficiency of its maintenance and operation. Summary of the Invention

[0004] The purpose of this application is to provide a resource deployment method, apparatus, device and medium for a bastion host cluster, so as to realize the technical effect of a proxy program for the dynamic deployment and maintenance protocol of the bastion host cluster and avoid occupying too much storage resources of the bastion host cluster.

[0005] In a first aspect, embodiments of this application provide a resource deployment method for a bastion host cluster, including:

[0006] Evaluate the usage index values ​​of at least one operation and maintenance protocol supported by the bastion host cluster; wherein, the usage index values ​​of various operation and maintenance protocols among the at least one operation and maintenance protocol are used to indicate the usage of the various operation and maintenance protocols by the bastion host cluster;

[0007] If the usage index value of any of the at least one operation and maintenance protocol is greater than a first preset threshold, and there is no proxy program for the operation and maintenance protocol in the program library of the bastion host cluster, the proxy program for the operation and maintenance protocol shall be downloaded to the program library.

[0008] In the above implementation process, by evaluating the usage index values ​​of various operation and maintenance protocols, and based on the comparison results of the usage index values ​​of various operation and maintenance protocols with the first preset threshold, as well as the judgment results of whether there are proxy programs for various operation and maintenance protocols in the program library of the bastion host cluster, it is determined whether to download the proxy programs for various operation and maintenance protocols to the program library of the bastion host cluster. This enables the deployment of proxy programs for commonly used operation and maintenance protocols in the bastion host cluster, thereby dynamically deploying proxy programs for operation and maintenance protocols in the bastion host cluster and avoiding excessive consumption of storage resources in the bastion host cluster.

[0009] Furthermore, the evaluation metrics for the usage of at least one operational protocol supported by the bastion host cluster include:

[0010] Based on the data packets of the various operation and maintenance protocols received by the bastion host cluster within a preset time period, determine the data packet statistics of the various operation and maintenance protocols;

[0011] Based on the operation and maintenance operations performed by the bastion host cluster using the various operation and maintenance protocols within the preset time period, determine the operation and maintenance operation statistics of the various operation and maintenance protocols;

[0012] Based on the data packet statistics and operation statistics of the various operation and maintenance protocols, evaluate the usage index values ​​of the various operation and maintenance protocols.

[0013] In the above implementation process, the usage index values ​​of various operation and maintenance protocols are evaluated by taking into account the statistical volume of data packets received by the bastion host cluster within a preset time period and the statistical volume of operation and maintenance operations performed by the bastion host cluster using various operation and maintenance protocols within the preset time period. This allows for a comprehensive evaluation of the usage index values ​​of various operation and maintenance protocols by considering both the data packets processed by the bastion host cluster and the operation and maintenance operations performed by the bastion host cluster, thus ensuring a reasonable and accurate evaluation of the usage index values ​​of various operation and maintenance protocols.

[0014] Furthermore, the evaluation of the usage index values ​​of the various operation and maintenance protocols based on the data packet statistics and operation and maintenance operation statistics of the various operation and maintenance protocols includes:

[0015] Based on the pre-set weights of data packet statistics and operation and maintenance statistics, the data packet statistics and operation and maintenance statistics of the various operation and maintenance protocols are weighted and calculated to obtain the usage index values ​​of the various operation and maintenance protocols.

[0016] In the above implementation process, the data packet statistics and operation and maintenance statistics of various operation and maintenance protocols are weighted and calculated according to the pre-set data packet statistics weight and operation and maintenance operation statistics weight to obtain the usage index values ​​of various operation and maintenance protocols. This allows for a comprehensive evaluation of the usage of various operation and maintenance protocols by considering both the data packets processed by the bastion host cluster and the operation and maintenance operations executed by the bastion host cluster, thus ensuring a more reasonable and accurate evaluation of the usage index values ​​of various operation and maintenance protocols.

[0017] Furthermore, the data packet statistics of the various operation and maintenance protocols include the number of data packets and / or the proportion of data packets of the various operation and maintenance protocols, and the operation and maintenance operation statistics of the various operation and maintenance protocols include the number of operation and maintenance operations and / or the operation and maintenance operation frequency of the various operation and maintenance protocols.

[0018] In the above implementation process, by evaluating the usage index values ​​of various operation and maintenance protocols based on the number and / or proportion of data packets of various operation and maintenance protocols, as well as the number and / or frequency of operation and maintenance operations of various operation and maintenance protocols, the usage index values ​​of various operation and maintenance protocols can be evaluated by comprehensively considering the data packets processed by the bastion host cluster and the operation and maintenance operations performed by the bastion host cluster. This ensures that the usage index values ​​of various operation and maintenance protocols can be evaluated quickly and accurately.

[0019] Furthermore, the method also includes:

[0020] When the bastion host cluster receives an operation and maintenance request sent by the operation and maintenance terminal, it controls the target bastion host in the bastion host cluster to respond to the operation and maintenance request and load the target agent program from the program library to execute the target operation and maintenance operation; wherein, the target agent program and the target operation and maintenance operation are determined according to the operation and maintenance request.

[0021] In the above implementation process, when the bastion host cluster receives an operation and maintenance request sent by the operation and maintenance terminal, it controls the target bastion host in the bastion host cluster to respond to the operation and maintenance request, load the target agent program from the program library and execute the target operation and maintenance operation. This enables the target bastion host to respond to the operation and maintenance request and directly load the target agent program from the program library to execute the target operation and maintenance operation, which is beneficial to improving the operation and maintenance efficiency of the bastion host cluster.

[0022] Furthermore, the method also includes:

[0023] When the preset period arrives, for each agent program in the program library, evaluate the usage index value of the operation and maintenance protocol corresponding to the current agent program;

[0024] If the usage index value of the operation and maintenance protocol corresponding to the current agent program is less than a second preset threshold, the current agent program is uninstalled from the program library; wherein, the second preset threshold is less than the first preset threshold.

[0025] In the above implementation process, by periodically determining whether to uninstall each agent program from the program library based on whether the usage index value of the operation and maintenance protocol corresponding to each agent program in the program library is less than the second preset threshold, it is possible to periodically clean up the agent programs of operation and maintenance protocols that are no longer frequently used in the bastion host cluster in the program library, and better avoid occupying too much storage resources of the bastion host cluster.

[0026] Further, the step of uninstalling the current agent program from the program library when the usage index value of the operation and maintenance protocol corresponding to the current agent program is less than a second preset threshold includes:

[0027] If the usage index value of the operation and maintenance protocol corresponding to the current agent program is less than the second preset threshold, the current agent program will be marked as a program to be uninstalled.

[0028] If the program to be uninstalled stops running, uninstall the program from the program library.

[0029] In the above implementation process, by first marking the agent programs of the operation and maintenance protocols that are no longer frequently used in the program library as programs to be uninstalled, and then uninstalling the programs to be uninstalled from the program library after confirming that the programs to be uninstalled have stopped running, it is possible to prevent problems such as abnormal execution of operation and maintenance operations caused by uninstalling programs during program operation, and effectively improve the operation and maintenance efficiency of the bastion host cluster.

[0030] Secondly, embodiments of this application provide a resource deployment apparatus for a bastion host cluster, comprising:

[0031] The indicator evaluation module is used to evaluate the usage indicator values ​​of at least one operation and maintenance protocol supported by the bastion host cluster; wherein, the usage indicator values ​​of various operation and maintenance protocols among the at least one operation and maintenance protocol are used to indicate the usage of the various operation and maintenance protocols by the bastion host cluster.

[0032] The resource deployment module is used to download the proxy program of the operation and maintenance protocol to the program library when the usage index value of any one of the at least one operation and maintenance protocol exceeds a first preset threshold and there is no proxy program of the operation and maintenance protocol in the program library of the bastion host cluster.

[0033] Thirdly, embodiments of this application provide an electronic device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; when the processor executes the computer program, it implements the method described above.

[0034] Fourthly, embodiments of this application provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program; wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the method described above. Attached Figure Description

[0035] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 A flowchart illustrating a resource deployment method for a bastion host cluster provided in the first embodiment of this application;

[0037] Figure 2 This is a schematic diagram of the structure of a resource deployment device for a bastion host cluster provided in the second embodiment of this application;

[0038] Figure 3 This is a schematic diagram of the structure of an electronic device provided in the third embodiment of this application. Detailed Implementation

[0039] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0040] It should be noted that in the description of this application, the terms "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance. Furthermore, the step numbers in the text are only for the convenience of explaining the embodiments of this application and are not intended to limit the order in which the steps are performed.

[0041] A bastion host is a network security management tool that acts as an interface or gateway between external and internal networks. It mainly uses protocol proxying to take over access to various devices within the internal network from external operation and maintenance terminals. By monitoring and recording the operation behavior of operation and maintenance users on various devices within the internal network, it can achieve centralized alarms, timely handling, and auditing and accountability, thereby ensuring the security of the internal network.

[0042] In related technologies, due to the large number of devices within an internal network, multiple bastion hosts in a bastion host cluster typically share the maintenance and operation tasks for these devices. However, to ensure that all bastion hosts in the cluster support all functionalities, it is necessary to deploy proxy programs for each of the various maintenance protocols, such as SSH (Secure Shell), RDP (Remote Desktop Protocol), and SQL (Structured Query Language). This results in excessive consumption of storage resources in the bastion host cluster, reducing the efficiency of its maintenance and operation.

[0043] To address this, this application proposes a resource deployment method for a bastion host cluster. By evaluating the usage index values ​​of various operation and maintenance protocols, and based on the comparison results of the usage index values ​​of various operation and maintenance protocols with a first preset threshold, as well as the judgment results of whether there are proxy programs for various operation and maintenance protocols in the program library of the bastion host cluster, it is determined whether to download the proxy programs for various operation and maintenance protocols to the program library of the bastion host cluster. This method enables the deployment of proxy programs for commonly used operation and maintenance protocols in the bastion host cluster, thereby dynamically deploying proxy programs for operation and maintenance protocols in the bastion host cluster and avoiding excessive consumption of storage resources in the bastion host cluster.

[0044] The technical solutions of the embodiments of this application will be described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0045] The methods provided in this application can be executed by relevant terminal devices, and the following description uses the server of the bastion host cluster as the execution subject.

[0046] Please refer to Figure 1 , Figure 1 This is a flowchart illustrating a resource deployment method for a bastion host cluster provided in the first embodiment of this application. The first embodiment of this application provides a resource deployment method for a bastion host cluster, including steps S101 to S102:

[0047] S101. Evaluate the usage index values ​​of at least one operation and maintenance protocol supported by the bastion host cluster; wherein, the usage index values ​​of various operation and maintenance protocols in the at least one operation and maintenance protocol are used to indicate the usage of various operation and maintenance protocols by the bastion host cluster.

[0048] As an example, a bastion host cluster contains multiple bastion hosts. Each bastion host can take over access to various devices in the internal network from external operation and maintenance terminals by using a protocol proxy. It can use one or more operation and maintenance protocols supported by the bastion host, such as SSH, RDP and SQL, to monitor and record the operation behavior of operation and maintenance users on various devices in the internal network, and perform operation and maintenance operations such as centralized alarm, timely processing and auditing and accountability.

[0049] It should be noted that maintenance terminals include terminal devices such as mobile phones, tablets, and computers held by maintenance users.

[0050] During the operation of the bastion host cluster, the server determines at least one operation and maintenance protocol supported by the bastion host cluster, and evaluates the usage index value of each operation and maintenance protocol. The usage index value of each operation and maintenance protocol is used to indicate the usage of the bastion host cluster for that operation and maintenance protocol, thereby obtaining the usage index values ​​of various operation and maintenance protocols.

[0051] S102. If the usage index value of any one of the at least one operation and maintenance protocols is greater than the first preset threshold, and there is no proxy program for the operation and maintenance protocol in the program library of the bastion host cluster, download the proxy program for the operation and maintenance protocol to the program library.

[0052] As an example, considering factors such as the available storage resources of the bastion host cluster and the enterprise's internal network operation and maintenance strategies in practical applications, a usage indicator threshold is pre-set as the first preset threshold.

[0053] After obtaining the usage index values ​​of various operation and maintenance protocols, the server compares the usage index value of each operation and maintenance protocol with a first preset threshold, and searches for the agent program of that operation and maintenance protocol in the program library of the bastion host cluster.

[0054] If the usage index value of this type of operation and maintenance protocol is greater than the first preset threshold, and there is no proxy program for this type of operation and maintenance protocol in the program library, it is considered that the bastion host cluster commonly uses this type of operation and maintenance protocol to perform operation and maintenance operations, and the program library has not yet stored the proxy program for this type of operation and maintenance protocol. At this time, the proxy program for this type of operation and maintenance protocol is downloaded to the program library.

[0055] If the usage index value of this type of operation and maintenance protocol is greater than the first preset threshold, and there is an agent program for this type of operation and maintenance protocol in the program library, it is considered that the program library already stores the agent program for this type of operation and maintenance protocol commonly used in bastion host clusters. At this time, there is no need to download the agent program for this type of operation and maintenance protocol to the program library again, and no processing is required.

[0056] If the usage index value of this type of operation and maintenance protocol is less than or equal to the first preset threshold, it is considered that the bastion host cluster does not frequently use this type of operation and maintenance protocol to perform operation and maintenance operations. At this time, there is no need to consider deploying the proxy program of this type of operation and maintenance protocol to the bastion host cluster to occupy the storage resources of the bastion host cluster. There is no need to search for the proxy program of this type of operation and maintenance protocol in the program library, and no processing is required.

[0057] Since an operation and maintenance protocol has one or more agent programs, if an operation and maintenance protocol has one agent program, the usage index value of the operation and maintenance protocol is greater than the first preset threshold, and the program library does not contain this agent program of the operation and maintenance protocol, then this agent program of the operation and maintenance protocol is downloaded to the program library; if an operation and maintenance protocol has multiple agent programs, the usage index value of the operation and maintenance protocol is greater than the first preset threshold, and the program library does not contain at least some of the agent programs of the operation and maintenance protocol, then these agent programs of the operation and maintenance protocol are downloaded to the program library.

[0058] In practical applications, to ensure the secure and complete download of the operation and maintenance protocol proxy program to the program library, the server can establish a secure connection with an external protocol program source. The proxy program is then encrypted and transmitted from the source to the server's local machine. After the proxy program on the server passes data integrity verification, it is stored in the program library. The protocol program source can be an internal software repository or an authorized third-party software vendor. For example, the server uses HTTPS (Hypertext Transfer Protocol Secure) to download the proxy program from an internal software repository and verifies the downloaded proxy program's integrity using a digital signature. If the program has not been tampered with, it is stored in the program library.

[0059] In practical applications, the program library serves as a central repository for storing proxy programs for operation and maintenance protocols. It can employ efficient storage structures and indexing mechanisms to store these proxies, facilitating quick server retrieval and management of the proxy programs within the library. The proxy programs for operation and maintenance protocols in the library can be stored as executable files or scripts. For example, the library might store client programs for SSH remote login and related programs for RDP remote desktop connections.

[0060] This application embodiment evaluates the usage index values ​​of various operation and maintenance protocols, compares the usage index values ​​of various operation and maintenance protocols with a first preset threshold, and determines whether to download the proxy programs of various operation and maintenance protocols to the program library of the bastion host cluster. This enables the deployment of proxy programs of commonly used operation and maintenance protocols in the bastion host cluster, thereby dynamically deploying proxy programs of operation and maintenance protocols in the bastion host cluster and avoiding excessive consumption of storage resources in the bastion host cluster.

[0061] In an optional embodiment, the evaluation of the usage index value of at least one operation and maintenance protocol supported by the bastion host cluster includes: determining the data packet statistics of various operation and maintenance protocols based on the data packets of various operation and maintenance protocols received by the bastion host cluster within a preset time period; determining the operation and maintenance operation statistics of various operation and maintenance protocols based on the operation and maintenance operations performed by the bastion host cluster using various operation and maintenance protocols within the preset time period; and evaluating the usage index value of various operation and maintenance protocols based on the data packet statistics and the operation and maintenance operation statistics of various operation and maintenance protocols.

[0062] As an example, during the operation of the bastion host cluster, the server monitors the network traffic of the bastion host cluster in real time, identifies the operation and maintenance protocols used by each data packet, and compiles the data packets of various operation and maintenance protocols received by the bastion host cluster in a time period before the current time, i.e., a preset time period, such as 1 minute before the current time. The server then performs statistics on the data packets of various operation and maintenance protocols received by the bastion host cluster in the preset time period to determine the statistical volume of data packets of various operation and maintenance protocols.

[0063] In practical applications, servers can use deep packet inspection technology to identify the type of operation and maintenance protocol used by each data packet.

[0064] During the operation of the bastion host cluster, the server monitors the operation and maintenance operations performed by the operation and maintenance users through the bastion host cluster in real time, identifies the operation and maintenance protocols used in each operation and maintenance operation, compiles the operation and maintenance operations performed by the bastion host cluster using various operation and maintenance protocols within a preset time period, and statistically analyzes the operation and maintenance operations performed by the bastion host cluster using various operation and maintenance protocols within the preset time period to determine the statistical volume of operation and maintenance operations for each operation and maintenance protocol.

[0065] In practical applications, servers can check the maintenance operations performed by maintenance users through the bastion host cluster by obtaining the maintenance operation logs of the bastion host cluster in real time.

[0066] For each type of operation and maintenance protocol, after obtaining the data packet statistics and operation and maintenance statistics of that protocol, the server evaluates the usage index value of that protocol based on the data packet statistics and operation and maintenance statistics of that protocol, thereby obtaining the usage index value of various operation and maintenance protocols.

[0067] This application embodiment evaluates the usage index values ​​of various operation and maintenance protocols by using the statistical volume of data packets received by the bastion host cluster within a preset time period and the statistical volume of operation and maintenance operations performed by the bastion host cluster using various operation and maintenance protocols within the preset time period. This allows for a comprehensive evaluation of the usage index values ​​of various operation and maintenance protocols by considering both the data packets processed by the bastion host cluster and the operation and maintenance operations performed by the bastion host cluster, thus ensuring a reasonable and accurate evaluation of the usage index values ​​of various operation and maintenance protocols.

[0068] In an optional embodiment, the step of evaluating the usage index values ​​of various operation and maintenance protocols based on the data packet statistics and operation and maintenance operation statistics of various operation and maintenance protocols includes: weighting the data packet statistics and operation and maintenance operation statistics of various operation and maintenance protocols according to the pre-set weights of data packet statistics and operation and maintenance operation statistics to obtain the usage index values ​​of various operation and maintenance protocols.

[0069] As an example, considering factors such as enterprise internal network operation and maintenance strategies in practical applications, the weights of packet statistics and operation and maintenance statistics are pre-set. For instance, if an enterprise places greater emphasis on the impact of operation and maintenance operations on the usage of operation and maintenance protocols, the weights of packet statistics and operation and maintenance statistics are pre-set, with the packet statistics weight being less than the operation and maintenance statistics weight.

[0070] For each O&M protocol, after obtaining the packet statistics and operation statistics for that protocol, the server performs a weighted calculation based on the weights of the packet statistics and operation statistics to obtain the usage index value for that O&M protocol. This yields the usage index values ​​for various O&M protocols. For example, the usage index value for an O&M protocol = packet statistics × packet statistics weight + operation statistics × operation statistics weight.

[0071] This application embodiment calculates the usage index values ​​of various operation and maintenance protocols by weighting the data packet statistics and operation and maintenance operation statistics according to the pre-set data packet statistics weight and operation and maintenance operation statistics weight. This results in the usage index values ​​of various operation and maintenance protocols. It can comprehensively evaluate the usage of various operation and maintenance protocols by considering the data packets processed by the bastion host cluster and the operation and maintenance operations executed by the bastion host cluster, thus ensuring a more reasonable and accurate evaluation of the usage index values ​​of various operation and maintenance protocols.

[0072] In optional embodiments, the data packet statistics for various operation and maintenance protocols include the number of data packets and / or the percentage of data packets for each operation and maintenance protocol, and the operation and maintenance operation statistics for various operation and maintenance protocols include the number of operation and maintenance operations and / or the frequency of operation and maintenance operations for each operation and maintenance protocol.

[0073] As an example, the server can select the number of data packets and / or the proportion of data packets for various operation and maintenance protocols as the data packet statistics for various operation and maintenance protocols, and select the number of operation and maintenance operations and / or the operation and maintenance operation frequency for various operation and maintenance protocols as the operation and maintenance operation statistics for various operation and maintenance protocols.

[0074] It should be noted that the data packet statistics for various operation and maintenance protocols include the number of data packets and / or the percentage of data packets for each protocol, mainly in the following three scenarios: the data packet statistics for various operation and maintenance protocols include the number of data packets for each protocol; the data packet statistics for various operation and maintenance protocols include the percentage of data packets for each protocol; and the data packet statistics for various operation and maintenance protocols include both the number of data packets and the percentage of data packets for each protocol.

[0075] The operational statistics for various operational protocols include the number of operational operations and / or the frequency of operational operations for each protocol. There are three main scenarios: the operational statistics for various operational protocols include the number of operational operations for each protocol; the operational statistics for various operational protocols include the frequency of operational operations for each protocol; and the operational statistics for various operational protocols include both the number of operational operations and the frequency of operational operations for each protocol.

[0076] If the server selects the number of data packets for various operation and maintenance protocols as the statistical measure for each protocol, then after obtaining the data packets received by the bastion host cluster for each protocol within a preset time period, the server will count the number of data packets received by the bastion host cluster for that protocol within the preset time period, thus obtaining the total number of data packets for each protocol. Alternatively, if the server selects the percentage of data packets for each protocol as the statistical measure, then after obtaining the data packets received by the bastion host cluster for each protocol within a preset time period, the server will count the number of data packets received by the bastion host cluster for that protocol within the preset time period, along with the total number of data packets for all protocols, and calculate the percentage of that protocol's data packets in the total number of data packets for all protocols, thus obtaining the percentage of data packets for each protocol. Finally, if the server selects both the number of data packets and their percentages as the statistical measures for each protocol, then the above statistical operations will be performed to obtain the number of data packets and their percentages for each protocol.

[0077] If the server selects the number of maintenance operations for various maintenance protocols as the statistical measure for maintenance operations of various maintenance protocols, then after obtaining the maintenance operations performed by the bastion host cluster using various maintenance protocols within a preset time period, for each maintenance protocol, the number of maintenance operations performed by the bastion host cluster using that maintenance protocol within the preset time period is counted, thus obtaining the number of maintenance operations for that maintenance protocol, and consequently, the number of maintenance operations for various maintenance protocols. If the server selects the frequency of maintenance operations for various maintenance protocols as the statistical measure for maintenance operations of various maintenance protocols, then after obtaining the maintenance operations performed by the bastion host cluster using various maintenance protocols within a preset time period, for each maintenance protocol, the frequency of maintenance operations performed by the bastion host cluster using that maintenance protocol within the preset time period is counted, thus obtaining the frequency of maintenance operations for that maintenance protocol, and consequently, the frequency of maintenance operations for various maintenance protocols. If the server selects both the number of maintenance operations and the frequency of maintenance operations for various maintenance protocols as the statistical measures for maintenance operations of various maintenance protocols, then the above statistical operations are performed to obtain the number of maintenance operations and the frequency of maintenance operations for various maintenance protocols.

[0078] This application embodiment evaluates the usage index values ​​of various operation and maintenance protocols based on the number and / or proportion of data packets of various operation and maintenance protocols, as well as the number and / or frequency of operation and maintenance operations of various operation and maintenance protocols. It can comprehensively evaluate the usage index values ​​of various operation and maintenance protocols by combining the data packets processed by the bastion host cluster and the operation and maintenance operations performed by the bastion host cluster, thus ensuring a fast and accurate evaluation of the usage index values ​​of various operation and maintenance protocols.

[0079] In an optional embodiment, the method further includes step S103:

[0080] S103. When the bastion host cluster receives an operation and maintenance request sent by the operation and maintenance terminal, it controls the target bastion host in the bastion host cluster to respond to the operation and maintenance request and load the target agent program from the program library to execute the target operation and maintenance operation; wherein, the target agent program and the target operation and maintenance operation are determined according to the operation and maintenance request.

[0081] As an example, when the server detects that the bastion host cluster has received an operation and maintenance request from an operation and maintenance terminal, it selects a bastion host from the cluster as the target bastion host, controls the target bastion host to respond to the operation and maintenance request, determines the target agent program in the program library based on the operation and maintenance request, and identifies the target operation and maintenance operation that can be executed by running the target agent program. The server then loads the target agent program from the program library and runs it to perform the target operation and maintenance operation. For example, it runs an SSH protocol agent program to connect to the server for command-line input, and an RDP protocol agent program for remote desktop control.

[0082] In practical applications, the server can randomly select an idle bastion host from the bastion host cluster as the target bastion host. During the execution of the target maintenance operation on the target bastion host, the server can monitor the execution status of the operation in real time. If any abnormal execution is detected, such as connection interruption or operation timeout, the server will return a response message indicating abnormal execution to the maintenance terminal and record the relevant error information.

[0083] This application embodiment, upon receiving an operation and maintenance request from an operation and maintenance terminal, controls the target bastion host in the bastion host cluster to respond to the operation and maintenance request, loads the target agent program from the program library to execute the target operation and maintenance operation, thereby enabling the target bastion host to respond to the operation and maintenance request and directly load the target agent program from the program library to execute the target operation and maintenance operation, which is beneficial to improving the operation and maintenance efficiency of the bastion host cluster.

[0084] In an optional embodiment, the method further includes steps S104 to S105:

[0085] S104. When the preset period arrives, evaluate the usage index value of the operation and maintenance protocol corresponding to each agent program in the program library.

[0086] S105. If the usage index value of the operation and maintenance protocol corresponding to the current agent program is less than the second preset threshold, uninstall the current agent program from the program library; wherein the second preset threshold is less than the first preset threshold.

[0087] As an example, since the proxy programs for operation and maintenance protocols in the program library are unlikely to always be the proxy programs for operation and maintenance protocols commonly used by the bastion host cluster, they may become proxy programs for operation and maintenance protocols that are not commonly used by the bastion host cluster. Therefore, it is necessary to regularly clean up the proxy programs for operation and maintenance protocols that are no longer commonly used by the bastion host cluster in the program library.

[0088] Considering factors such as the available storage resources of the bastion host cluster and the enterprise's internal network operation and maintenance strategies in practical applications, a pre-set period is set as the preset period, and another usage indicator threshold is set as the second preset threshold, wherein the second preset threshold is less than the first preset threshold.

[0089] When the preset period arrives, the server evaluates the usage index value of the operation and maintenance protocol corresponding to each agent program in the program library according to the above usage index evaluation operation, and compares the usage index value of the operation and maintenance protocol corresponding to the current agent program with the second preset threshold.

[0090] If the usage index value of the operation and maintenance protocol corresponding to the current agent program is less than the second preset threshold, it is considered that the bastion host cluster no longer frequently uses the operation and maintenance protocol corresponding to the current agent program, and the current agent program's occupation of the program library's storage resources is unreasonable. At this time, the current agent program is uninstalled from the program library, related configuration information and temporary files are cleaned up, and the program library's storage resources are released.

[0091] If the usage index value of the operation and maintenance protocol corresponding to the current agent program is greater than or equal to the second preset threshold, it is considered that the bastion host cluster still commonly uses the operation and maintenance protocol corresponding to the current agent program, and the storage resources occupied by the current agent program in the program library are reasonable. At this time, there is no need to uninstall the current agent program from the program library, and no action is taken.

[0092] This application embodiment determines whether to uninstall each agent program from the program library by periodically checking whether the usage index value of the operation and maintenance protocol corresponding to each agent program in the program library is less than a second preset threshold. This can periodically clean up the agent programs of operation and maintenance protocols that are no longer frequently used in the bastion host cluster, and better avoid occupying too much storage resources of the bastion host cluster.

[0093] In an optional embodiment, the step of uninstalling the current agent program from the program library when the usage index value of the operation and maintenance protocol corresponding to the current agent program is less than the second preset threshold includes: marking the current agent program as a program to be uninstalled when the usage index value of the operation and maintenance protocol corresponding to the current agent program is less than the second preset threshold; and uninstalling the program to be uninstalled from the program library when the program to be uninstalled stops running.

[0094] As an example, if the server determines that the usage index value of the operation and maintenance protocol corresponding to the current agent program is less than the second preset threshold, it considers that the bastion host cluster no longer frequently uses the operation and maintenance protocol corresponding to the current agent program, and that the current agent program's occupation of the program library's storage resources is unreasonable. In this case, the current agent program is first marked as a program to be uninstalled, and only after confirming that the program to be uninstalled has stopped running is the current agent program uninstalled from the program library, the relevant configuration information and temporary files are cleaned up, and the program library's storage resources are released.

[0095] This application embodiment first marks the proxy programs of operation and maintenance protocols that are no longer frequently used in the program library as programs to be uninstalled, and then uninstalls the programs to be uninstalled from the program library after confirming that the programs to be uninstalled have stopped running. This can prevent problems such as abnormal execution of operation and maintenance operations caused by uninstalling programs during program operation, and effectively improve the operation and maintenance efficiency of the bastion host cluster.

[0096] The resource deployment method for a bastion host cluster provided in the first embodiment of this application has the following advantages:

[0097] 1. Optimize resource utilization: By dynamically downloading and uninstalling agent programs for various operation and maintenance protocols, only agent programs for commonly used operation and maintenance protocols of the bastion host cluster are retained in the program library of the bastion host cluster. This not only avoids wasting the storage resources of the bastion host cluster, but also improves the performance of the bastion host cluster in performing operation and maintenance operations by limiting the occupation of storage resources by agent programs of various operation and maintenance protocols, thereby improving the efficiency of operation and maintenance operations of the bastion host cluster.

[0098] 2. Enhanced Security Protection: Since proxy programs for various operation and maintenance protocols may contain security vulnerabilities, by only retaining proxy programs for commonly used operation and maintenance protocols in the program library, vulnerabilities in proxy programs for less frequently used operation and maintenance protocols will not pose a threat to the bastion host cluster. This reduces the security risks associated with storing proxy programs for infrequently used operation and maintenance protocols. Simultaneously, regularly removing proxy programs for infrequently used or outdated operation and maintenance protocols from the program library further strengthens the security protection of the bastion host cluster, aligning with best practices for enterprise network security.

[0099] 3. Enhanced flexibility and adaptability: The bastion host cluster can automatically adapt to the dynamically changing internal network operation and maintenance needs of an enterprise. When new business applications require support for new operation and maintenance protocols, the cluster can automatically download the agent program for the new protocol without manual intervention, reducing downtime.

[0100] Please refer to Figure 2 , Figure 2 This is a schematic diagram of a resource deployment device for a bastion host cluster provided in the second embodiment of this application. The second embodiment of this application provides a resource deployment device for a bastion host cluster, including: an indicator evaluation module 201, used to evaluate the usage indicator values ​​of at least one operation and maintenance protocol supported by the bastion host cluster; wherein, the usage indicator values ​​of various operation and maintenance protocols among the at least one operation and maintenance protocol are used to indicate the usage status of various operation and maintenance protocols by the bastion host cluster; and a resource deployment module 202, used to download the proxy program of the operation and maintenance protocol to the program library when the usage indicator value of any one of the at least one operation and maintenance protocol exceeds a first preset threshold, and there is no proxy program for the operation and maintenance protocol in the program library of the bastion host cluster.

[0101] In an optional embodiment, the evaluation of the usage index value of at least one operation and maintenance protocol supported by the bastion host cluster includes: determining the data packet statistics of various operation and maintenance protocols based on the data packets of various operation and maintenance protocols received by the bastion host cluster within a preset time period; determining the operation and maintenance operation statistics of various operation and maintenance protocols based on the operation and maintenance operations performed by the bastion host cluster using various operation and maintenance protocols within the preset time period; and evaluating the usage index value of various operation and maintenance protocols based on the data packet statistics and the operation and maintenance operation statistics of various operation and maintenance protocols.

[0102] In an optional embodiment, the step of evaluating the usage index values ​​of various operation and maintenance protocols based on the data packet statistics and operation and maintenance operation statistics of various operation and maintenance protocols includes: weighting the data packet statistics and operation and maintenance operation statistics of various operation and maintenance protocols according to the pre-set weights of data packet statistics and operation and maintenance operation statistics to obtain the usage index values ​​of various operation and maintenance protocols.

[0103] In optional embodiments, the data packet statistics for various operation and maintenance protocols include the number of data packets and / or the percentage of data packets for each operation and maintenance protocol, and the operation and maintenance operation statistics for various operation and maintenance protocols include the number of operation and maintenance operations and / or the frequency of operation and maintenance operations for each operation and maintenance protocol.

[0104] In an optional embodiment, the apparatus further includes: an operation and maintenance module, configured to, upon receiving an operation and maintenance request initiated by a user, control the target bastion host in the bastion host cluster to respond to the operation and maintenance request and load a target agent program from the program library to execute the target operation and maintenance operation; wherein the target agent program and the target operation and maintenance operation are determined according to the operation and maintenance request.

[0105] In an optional embodiment, the indicator evaluation module 201 is further configured to evaluate the usage indicator value of the operation and maintenance protocol corresponding to each agent program in the program library when a preset period arrives; the resource deployment module 202 is further configured to uninstall the current agent program from the program library when the usage indicator value of the operation and maintenance protocol corresponding to the current agent program is less than a second preset threshold; wherein, the second preset threshold is less than the first preset threshold.

[0106] In an optional embodiment, the step of uninstalling the current agent program from the program library when the usage index value of the operation and maintenance protocol corresponding to the current agent program is less than the second preset threshold includes: marking the current agent program as a program to be uninstalled when the usage index value of the operation and maintenance protocol corresponding to the current agent program is less than the second preset threshold; and uninstalling the program to be uninstalled from the program library when the program to be uninstalled stops running.

[0107] The specific implementation process of the functions and roles of each module in the above-mentioned device can be found in the implementation process of the corresponding steps in the method described in the first embodiment of this application, and will not be repeated here.

[0108] Please refer to Figure 3 , Figure 3This is a schematic diagram of the structure of an electronic device provided in the third embodiment of this application. The third embodiment of this application provides an electronic device 30, including a processor 301, a memory 302, and a computer program stored in the memory 302 and configured to be executed by the processor 301; when the processor 301 executes the computer program, it implements the method described in the first embodiment of this application and can achieve the same beneficial effects.

[0109] When the processor 301 reads a computer program from the memory 302 via the bus 303 and executes the computer program, it can implement any of the methods described in the first embodiment of this application.

[0110] Processor 301 can process digital signals and may include various computing architectures. For example, it may be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 301 may be a microprocessor.

[0111] The memory 302 can be used to store instructions executed by the processor 301 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all of the functions of one or more modules described in the embodiments of this application. The processor 301 of this disclosure embodiment can be used to execute instructions in the memory 302 to implement the method described in the first embodiment of this application. The memory 302 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0112] The fourth embodiment of this application provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to perform the method described in the first embodiment of this application, and can achieve the same beneficial effects.

[0113] The method described in the first embodiment of this application can be implemented, in whole or in part, by software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on a computer, the processes or functions described in the various embodiments of this application are executed, in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user equipment, a core network device, an OAM (Open Application Model), or other programmable devices.

[0114] The computer program or instructions may be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, the computer program or instructions may be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. The computer-readable storage medium may be any available medium that a computer can access, or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, hard disk, or magnetic tape; or an optical medium, such as a digital video optical disc; or a semiconductor medium, such as a solid-state drive. The computer-readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0115] In summary, this application provides a resource deployment method, device, medium, and program product for a bastion host cluster. The resource deployment method for the bastion host cluster includes: evaluating the usage index values ​​of at least one operation and maintenance protocol supported by the bastion host cluster; wherein, the usage index values ​​of various operation and maintenance protocols in the at least one operation and maintenance protocol are used to indicate the usage status of various operation and maintenance protocols by the bastion host cluster; if the usage index value of any one of the at least one operation and maintenance protocol is greater than a first preset threshold, and there is no proxy program for the operation and maintenance protocol in the program library of the bastion host cluster, the proxy program for the operation and maintenance protocol is downloaded to the program library. This application, by evaluating the usage index values ​​of various operation and maintenance protocols, and based on the comparison result of the usage index values ​​of various operation and maintenance protocols with the first preset threshold, and the judgment result of whether there is a proxy program for various operation and maintenance protocols in the program library of the bastion host cluster, determines whether to download the proxy programs for various operation and maintenance protocols to the program library of the bastion host cluster. This enables the deployment of proxy programs for commonly used operation and maintenance protocols of the bastion host cluster to the bastion host cluster, thereby dynamically deploying proxy programs for operation and maintenance protocols to the bastion host cluster and avoiding excessive consumption of storage resources of the bastion host cluster.

[0116] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0117] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0118] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0119] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A resource deployment method for a bastion host cluster, characterized in that, include: Evaluate the usage index values ​​of at least one operation and maintenance protocol supported by the bastion host cluster; wherein, the usage index values ​​of various operation and maintenance protocols among the at least one operation and maintenance protocol are used to indicate the usage of the various operation and maintenance protocols by the bastion host cluster. If the usage index value of a certain operation and maintenance protocol is greater than a first preset threshold, it is considered that the bastion host cluster frequently performs operation and maintenance operations using that operation and maintenance protocol. If the usage index value of any of the at least one operation and maintenance protocol is greater than the first preset threshold, and there is no proxy program for the operation and maintenance protocol in the program library of the bastion host cluster, the proxy program for the operation and maintenance protocol shall be downloaded to the program library. When the preset period arrives, for each agent program in the program library, evaluate the usage index value of the operation and maintenance protocol corresponding to the current agent program; If the usage index value of the operation and maintenance protocol corresponding to the current agent program is less than a second preset threshold, the current agent program is uninstalled from the program library; wherein, the second preset threshold is less than the first preset threshold.

2. The method according to claim 1, characterized in that, The evaluation metrics for the use of at least one operational protocol supported by the bastion host cluster include: Based on the data packets of the various operation and maintenance protocols received by the bastion host cluster within a preset time period, determine the data packet statistics of the various operation and maintenance protocols; Based on the operation and maintenance operations performed by the bastion host cluster using the various operation and maintenance protocols within the preset time period, determine the operation and maintenance operation statistics of the various operation and maintenance protocols; Based on the data packet statistics and operation statistics of the various operation and maintenance protocols, evaluate the usage index values ​​of the various operation and maintenance protocols.

3. The method according to claim 2, characterized in that, The evaluation of the usage index values ​​of various operation and maintenance protocols based on the data packet statistics and operation and maintenance operation statistics of various operation and maintenance protocols includes: Based on the pre-set weights of data packet statistics and operation and maintenance statistics, the data packet statistics and operation and maintenance statistics of the various operation and maintenance protocols are weighted and calculated to obtain the usage index values ​​of the various operation and maintenance protocols.

4. The method according to claim 2, characterized in that, The data packet statistics of the various operation and maintenance protocols include the number of data packets and / or the proportion of data packets of the various operation and maintenance protocols, and the operation and maintenance operation statistics of the various operation and maintenance protocols include the number of operation and maintenance operations and / or the operation and maintenance operation frequency of the various operation and maintenance protocols.

5. The method according to claim 1, characterized in that, The method further includes: When the bastion host cluster receives an operation and maintenance request sent by the operation and maintenance terminal, it controls the target bastion host in the bastion host cluster to respond to the operation and maintenance request and load the target agent program from the program library to execute the target operation and maintenance operation; wherein, the target agent program and the target operation and maintenance operation are determined according to the operation and maintenance request.

6. The method according to claim 1, characterized in that, The step of uninstalling the current agent program from the program library when the usage index value of the operation and maintenance protocol corresponding to the current agent program is less than a second preset threshold includes: If the usage index value of the operation and maintenance protocol corresponding to the current agent program is less than the second preset threshold, the current agent program will be marked as a program to be uninstalled. If the program to be uninstalled stops running, uninstall the program from the program library.

7. A resource deployment device for a bastion host cluster, characterized in that, include: The indicator evaluation module is used to evaluate the usage indicator values ​​of at least one operation and maintenance protocol supported by the bastion host cluster. The usage indicator values ​​of various operation and maintenance protocols among the at least one operation and maintenance protocol are used to indicate the usage of the various operation and maintenance protocols by the bastion host cluster. If the usage indicator value of a certain operation and maintenance protocol is greater than a first preset threshold, it is considered that the bastion host cluster frequently performs operation and maintenance operations using that operation and maintenance protocol. The resource deployment module is used to download the proxy program of the operation and maintenance protocol to the program library when the usage index value of any one of the at least one operation and maintenance protocol exceeds the first preset threshold and there is no proxy program of the operation and maintenance protocol in the program library of the bastion host cluster. The indicator evaluation module is also used to evaluate the usage indicator value of the operation and maintenance protocol corresponding to each agent program in the program library when a preset period arrives. The resource deployment module is also used to uninstall the current agent program from the program library when the usage index value of the operation and maintenance protocol corresponding to the current agent program is less than a second preset threshold; wherein the second preset threshold is less than the first preset threshold.

8. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; when the processor executes the computer program, it implements the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program; wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the method according to any one of claims 1 to 6.

Images