Request processing method and system and electronic equipment

Abstract

The invention provides a request processing method and system and electronic equipment, and relates to the technical field of communication. Comprising the following steps: receiving an access request sent by a client, and identifying access information; generating request information related to the access request, and sending the request information to an authentication server; and responding to verification information sent by the authentication server, and processing the access request according to the verification information. By providing an additional security layer, identity verification is carried out on the client, it is ensured that only the client with the access authority can access the bastion host, and the risk that an interface of the bastion host is directly exposed to a public network is reduced. Through the implementation of limited access, the security of the bastion host is improved, the refinement of access control is realized, and the possibility of potential illegal access is reduced. The technical problem of single-point fault risk caused by centralized management in the prior art is solved, and the stability, safety and reliability of the system are ensured.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a request processing method, system and electronic device. Background Art

[0002] Bastion Host is a highly specialized system that is based on advanced cloud computing technology and network security concepts and focuses on providing sophisticated permission management and comprehensive auditing capabilities. The system builds a secure and reliable remote access environment by centrally managing and strictly controlling user access rights, allowing managers to easily remotely manage key resources within the enterprise. At the same time, the bastion host also has powerful auditing capabilities, which can record and track every user operation in detail, including key information such as login time, operation content, and result feedback, providing strong support for the enterprise's security management and compliance review.

[0003] In a multi-tenant scenario, the bastion host is a security device that can be used to manage and control the access rights of servers and network devices within the enterprise, providing a centralized management method. By authenticating the user, it is determined whether the user has the right to access the target resource based on the user's role and preset policies. If the user's identity and permissions meet the requirements, the bastion host will forward the connection to the server or device in the internal network. However, in the process of implementing the technical solution of the invention in the embodiments of the present application, the inventors of the present application found that the above technology has at least the following technical problems:

[0004] The bastion host can query the corresponding servers that the user is allowed to log in to based on the identity information of the logged-in user, but before the user logs in to the bastion host, the bastion host cannot determine whether the user has the permission to access the bastion host. As a centralized management entrance, once the bastion host is compromised, it may cause security vulnerabilities in the entire system and even lead to catastrophic consequences. Summary of the invention

[0005] The embodiments of the present application provide a request processing method, system and electronic device to solve the technical problem of the risk of single point failure caused by centralized management in the prior art.

[0006] In a first aspect, the present application provides a request processing method, comprising the following steps:

[0007] Receiving an access request sent by a client and identifying access information, wherein the access request refers to information requested by the client for access, and the access information includes identity information and address information;

[0008] Generate request information related to the access request and send it to the authentication server;

[0009] Respond to the verification information sent by the authentication server and process the access request according to the verification information, wherein the verification information indicates whether the verification is passed or not.

[0010] In some embodiments, before generating request information related to the access request and sending it to the authentication server, the following steps are also included:

[0011] Searching for valid information from the memory, where the valid information is used to represent verification information of the access request within a validity period;

[0012] If the search is successful, the access request is forwarded to the bastion host, the address of the bastion host is determined according to the address information, and the bastion host is used to return the requested resource of the client;

[0013] Generate request information related to the access request and send it to the authentication server, including:

[0014] If the search fails, request information related to the access request is generated and sent to the authentication server.

[0015] In some embodiments, when the verification information indicates that the verification is passed, responding to the verification information sent by the authentication server and processing the access request according to the verification information specifically includes:

[0016] The verification information is stored in a memory, and the access request is forwarded to a bastion server.

[0017] In some embodiments, when the verification information indicates that the verification fails, responding to the verification information sent by the authentication server and processing the access request according to the verification information specifically includes:

[0018] Deny forwarding access request.

[0019] In some embodiments, generating request information related to the access request and sending it to the authentication server specifically includes:

[0020] Generate a string to be signed based on the access information and the bastion host address;

[0021] According to the preset key information and encryption algorithm, the signature of the character string to be signed is calculated to generate a signature certificate;

[0022] The access information and the signature credential are encapsulated to generate request information.

[0023] In some embodiments, generating a string to be signed according to the access information and the bastion host address specifically includes:

[0024] Generate request parameters according to the access information and the bastion host address;

[0025] Hash the request parameters as a request body summary;

[0026] Obtaining identification code information and request date of the access request, concatenating the identification code information and the request date, and generating a header string;

[0027] Extracting query parameters related to the access request, and sorting the query parameters according to a preset sorting rule to generate a query parameter character string;

[0028] The header string, the query parameter string and the request body digest are concatenated together to generate a string to be signed.

[0029] In some embodiments, according to the preset key information and encryption algorithm, the signature calculation of the character string to be signed is performed to generate a signature certificate, which specifically includes:

[0030] Using the preset key information and encryption algorithm, encrypt the request date to generate a first intermediate key;

[0031] Performing an encryption operation on the first intermediate key and preset identifier information to generate a second intermediate key;

[0032] Performing encryption calculation on the second intermediate key and the request date to generate a signature key;

[0033] The signature key and the character string to be signed are used to perform encryption calculation to generate the signature certificate.

[0034] In a second aspect, an embodiment of the present application further provides a request processing system, including:

[0035] The client communicates with the proxy gateway and the bastion host respectively, and is used to send access requests to the proxy gateway and receive the requested resources returned by the bastion host to the client;

[0036] A proxy gateway, which is respectively connected to the client, the authentication server and the bastion host for executing any one of the request processing methods;

[0037] The authentication server is connected to the proxy gateway for receiving the request information sent by the proxy gateway and generating the verification information and sending it to the proxy gateway;

[0038] The bastion host is connected to the client and the proxy gateway respectively, and is used to receive access requests sent by the proxy gateway and return the requested resources to the client.

[0039] In some embodiments, generating verification information includes the following steps:

[0040] Receive the request information sent by the proxy gateway and determine the access information and signature credentials;

[0041] Decrypt the signature certificate according to the preset key information and encryption algorithm to obtain the original information;

[0042] Determining whether the access information is consistent with the original information;

[0043] If yes, verification is successful;

[0044] If not, the verification fails.

[0045] In a third aspect, an embodiment of the present application further provides an electronic device, including:

[0046] processor;

[0047] A memory, configured to store instructions executable by the processor;

[0048] The processor is configured to execute the instructions to implement any one of the request processing methods.

[0049] Compared with the prior art, this application has the following advantages:

[0050] The client sends an access request to the proxy gateway. After receiving the access request sent by the client, the proxy gateway obtains the access information by parsing the access request information. The access information includes identity information and address information. According to the identity information and address information, the proxy gateway searches for verification information within the validity period. If so, the proxy gateway forwards the access request to the bastion host. After further authentication of the access request, the bastion host returns all operation execution results of the target device of the access request to the user terminal and audits the entire process. If the verification information related to the access request does not exist in the memory, the proxy gateway generates the request information and sends the request information to the authentication server for processing. The authentication server generates the verification information by verifying the request information and sends it to the proxy gateway. The proxy gateway forwards the access request or rejects the access request according to the verification information. As an additional security layer, the proxy gateway authenticates the client to ensure that only clients with access rights can access the bastion host, reducing the risk of directly exposing the bastion host interface to the public network. By limiting access, the security of the bastion host is improved, the access control is refined, and the possibility of potential illegal access is reduced. The technical problem of the risk of single point failure caused by centralized management in the prior art is solved, and the stability, security and reliability of the system are guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 is a method flow chart of a request processing method provided by an embodiment of the present application;

[0052] Figure 2is a method flow chart of a request processing method provided by another embodiment of the present application;

[0053] Figure 3 is a method flow chart of a request processing method provided by another embodiment of the present application;

[0054] Figure 4 is a flow chart of a method for processing an access request provided by an embodiment of the present application;

[0055] Figure 5 is a flow chart of a method for generating request information provided by an embodiment of the present application;

[0056] Figure 6 is a flow chart of a method for generating a character string to be signed provided in an embodiment of the present application;

[0057] Figure 7 is a flow chart of a method for generating a signature certificate provided in an embodiment of the present application;

[0058] Figure 8 It is a structural diagram of a request processing system provided in an embodiment of the present application;

[0059] Fig. 9 is a flow chart of a method for generating verification information provided in an embodiment of the present application;

[0060] Fig.10 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0061] Cloud service providers need to provide tenants with a secure and reliable cloud environment. As a security device, the bastion host can be used to manage and control the access rights of servers and network devices within the enterprise. It provides a centralized management method to authenticate, authorize, and audit users. As a key device, the security of cloud data and assets is directly related to the bastion host. However, while the bastion host concentrates permissions and assets, it also poses potential risks. The bastion host has high permissions. Once it is compromised or abused, it will pose a security threat to internal network assets. In a multi-tenant scenario, the security of the bastion host is even more important. Due to the large number of tenants, a large number of bastion hosts need to be managed, and each bastion host may be accessed by multiple users. To ensure security, the bastion host must not only be able to authenticate the accessing user, but also control the permissions of each user to access the bastion host. The bastion host itself can query the server that the logged-in user is allowed to log in to based on the identity information of the logged-in user, but before the user logs in to the bastion host, it is impossible to determine whether the user has the permission to access the bastion host.

[0062] In order to enhance the security of the bastion host and limit potential illegal access from the access source, the embodiment of the present application provides a request processing method, reduces the risk through multi-level defense measures, adds a layer of permission verification before the user logs in to the bastion host, ensures that the user has the permission to access the bastion host, and provides a safe and reliable cloud operation and maintenance environment.

[0063] The following are some explanations of terms:

[0064] Bastion Host: A bastion host is a permission management and audit system based on cloud computing and network security technology. It provides a secure and reliable remote access and management method by centrally managing and controlling user access rights, and can audit and record user operations.

[0065] Proxy Gateway: An intermediate layer between the client and the server that processes and forwards network requests. It acts as a proxy between the client and the server, while providing some additional functionality and security.

[0066] OpenResty is a high-performance Web platform based on Nginx and LuaJIT. You can use Lua scripts to write custom Nginx modules to implement flexible request processing and business logic, such as caching, security authentication, access control, etc.

[0067] The HMAC (Hash-based Message Authentication Code) algorithm is a key-based message integrity verification method. The HMAC algorithm can be used for encryption, digital signature, message verification, etc.

[0068] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0069] Embodiment 1

[0070] Reference Figure 1 , the embodiment of the present application provides a request processing method, comprising the following steps:

[0071] S100: Receive an access request sent by a client and identify access information. The access request refers to information requested by the client to access, and the access information includes identity information and address information.

[0072] S300: Generate request information related to the access request and send it to the authentication server.

[0073] S400, responding to the verification information sent by the authentication server, and processing the access request according to the verification information, where the verification information indicates whether the verification is passed or not.

[0074] Specifically, identity information includes account ID, password, digital certificate and biometric identification code, and address information indicates the client's current network location and the specific resource path requested for access. The authentication server verifies the access request based on the request information and generates verification information. The verification information indicates whether the access request has been verified and takes corresponding measures based on the verification information.

[0075] Exemplarily, the above embodiment uses a proxy server, which includes but is not limited to a proxy gateway based on OpenResty, an API gateway based on Apache APISIX, an open source API gateway, and a reverse proxy gateway based on Netty. The identity information refers to the account ID, the address information refers to the bastion machine address requested for access, and the request information is generated based on the access information. Using OpenResty as a proxy gateway, the proxy gateway exists between the client and the bastion machine as an intermediate node, and receives access requests from the client, obtains the client's access information from the client's access request, including identity information, such as account ID, etc., and obtains the bastion machine address requested by the user. The proxy gateway uses the acquired identity information and bastion machine address to construct request parameters, and sorts these parameters according to certain rules to generate a string to be signed. The proxy gateway then uses the HMAC-SHA256 algorithm to calculate the signature of the string to be signed using a pre-agreed key to generate a signature value. In this process, the proxy gateway is used to implement the identity authentication and authorization mechanism to improve the refinement of access control on the bastion machine side. The security of the bastion machine is enhanced. As an additional security layer, the proxy gateway authenticates the client to ensure that only clients with access rights can access the bastion host, reducing the risk of directly exposing the bastion host interface to the public network. By limiting access, the security of the bastion host is improved, access control is refined, and the possibility of potential illegal access is reduced. The technical problem of the single point failure risk brought by centralized management in the existing technology is solved, ensuring the stability, security and reliability of the system.

[0076] See also Figure 1-Figure 3 , before S300, generating request information related to the access request and sending it to the authentication server, the following steps are also included:

[0077] S200. Searching for valid information from the memory, where the valid information is used to represent verification information of the access request within a validity period.

[0078] If the search is successful, S500, the access request is forwarded to the bastion host, the address of the bastion host is determined according to the address information, and the bastion host is used to return the requested resources of the client.

[0079] S300, generating request information related to the access request and sending it to the authentication server, including:

[0080] If the search fails, request information related to the access request is generated and sent to the authentication server.

[0081] In this embodiment, the memory is first searched to see whether there is verification information of the access request within the validity period, and whether the access request has been verified within the validity period. The validity period refers to the effective time of the verification information in the memory. During the validity period, the verification information is stored in the memory.

[0082] If the search is successful, it means that there is verification information related to the access request within the validity period. The found valid information is used as the verification information to process the access request and forward the access request to the bastion host.

[0083] If the search fails, it is necessary to generate request information based on the access information and send it to the authentication server for further verification.

[0084] For example, see Figure 2 and Figure 3 When the client requests to access the bastion host for the first time, the proxy gateway receives the request and obtains the user's identity information and request address from the request. After receiving the request, if there is no relevant information in the cache, the proxy gateway encapsulates the obtained identity information and request address into the request body, generates a signature credential for identity authentication, encapsulates it into the request header, and sends the request information to the authentication server. The proxy gateway obtains the verification information, which is either a successful verification or a failed verification. The proxy gateway performs different operations on the client's access request based on the verification information.

[0085] More specifically, the client requests access to the bastion host address, the identity information is the account ID, the request address is the requested IP address, and the data format is JSON, for example:

[0086] {

[0087] "id": "353q5fgs246gdw2301",

[0088] "ip": "139.196.0.1"

[0089] }

[0090] After receiving the request, the proxy gateway combines the id and ip into a string of the form "id-ip" and uses it as a keyword to search in the cache. If there is no successful verification information of the id and ip in the cache, it generates the signature certificate required by the authentication server, generates request information based on the signature certificate, and requests the authentication server to verify whether it has the right to access the ip address. The authentication server returns the query result. The proxy gateway performs corresponding processing based on the returned result.

[0091] If the response is no access, the access request is directly rejected and the session is terminated. If the response is authorized, the access request is forwarded to the IP address. The authorized id and IP are combined into a string of the form "id-ip" and stored in the cache. The cache validity period is set to 1 hour.

[0092] The bastion host that requested access returns the client's requested resource. When the client requests to access the bastion host address multiple times, after receiving the access request, the proxy gateway combines the id and ip into a string in the form of "id-ip" and uses it as a keyword to search in the cache. If there is information that the request has passed the verification within the cache validity period, the access request is directly forwarded to the ip address. The bastion host that requested access returns the client's requested resource.

[0093] The embodiment of the present application caches the access data of the client, reduces the requests to the bastion host, speeds up the response speed of the bastion host, and reduces the burden on the bastion host.

[0094] See also Figure 4 When the verification information is verified, S400 responds to the verification information sent by the authentication server and processes the access request according to the verification information, specifically including:

[0095] S410, storing the verification information in the memory, and forwarding the access request to the bastion host.

[0096] Specifically, if the verification information is verified, the client's access request is forwarded to the bastion host in its entirety, and the verification information is stored in the shared memory. When the client makes multiple access requests within the cache validity period, after the proxy gateway receives the request, if the corresponding valid key-value pair is read from the shared memory, the client's request is directly forwarded to the bastion host in its entirety. The caching mechanism reduces the number of authentications. The proxy gateway reduces requests to the bastion host by caching frequently accessed data, speeds up the response of the bastion host, and reduces the burden on the bastion host. The use of a shared memory caching mechanism reduces access to the authentication server and improves the performance and efficiency of the system.

[0097] See also Figure 5When the verification information indicates that the verification fails, S400 responds to the verification information sent by the authentication server and processes the access request according to the verification information, specifically including:

[0098] S420: Refuse to forward the access request.

[0099] Specifically, if the verification information indicates that the verification fails, the access request is rejected, thereby achieving the purpose of restricting access.

[0100] See also Figure 5 S300: Generate request information related to the access request and send it to the authentication server, specifically including:

[0101] S310. Generate a character string to be signed based on the access information and the bastion host address.

[0102] Specifically, the character string to be signed is the basis for the subsequent generation of the signature certificate, which ensures the integrity and pertinence of the signature certificate content and prevents tampering and forgery of information.

[0103] Exemplarily, the proxy gateway constructs request parameters using the acquired identity information and bastion host address, and sorts these parameters according to certain rules to generate a string to be signed. Identity information refers to access information related to the access request.

[0104] S320: Calculate the signature of the signature string according to the preset key information and encryption algorithm to generate a signature certificate.

[0105] Specifically, key information refers to confidential information that can only be accessed by specific systems or services. The encryption algorithm can ensure the uniqueness and reliability of the signature credential. The signature credential refers to the signature header information that conforms to a specific format and is used for identity authentication in the request header. The required signature credential is constructed based on the incoming query parameters, request parameters, request date, access request identification code information (request UUID), access key ID (AK, Access Key) and secret access key (SK, Secret Key).

[0106] Exemplarily, the proxy gateway uses the HMAC-SHA256 algorithm to perform signature calculation on the string to be signed using a pre-agreed key. First, the key is initialized and processed, and then internal padding and iterative hash calculation are performed to finally generate a signature value.

[0107] S330: Encapsulate access information and signature credentials to generate request information.

[0108] Specifically, the request information includes all necessary information required by the authentication server to verify the access request, and the encapsulated request information is sent to the authentication server for verification.

[0109] Exemplarily, the generated signature value will be sent to the authentication server for verification together with the key information as part of the signature credential. The authentication server uses the same key information and algorithm to calculate the signature of the received parameters, and compares the calculated signature value with the signature value sent by the client to verify the identity and authority of the client. The signature value sent by the client refers to the access information related to the access request.

[0110] The use of signature credentials and identity authentication mechanisms ensures the security and accuracy of identity information. Among them, the signature credentials are generated through the HMAC-SHA256 algorithm. First, a signature key is generated. This key will be used to sign the request to ensure the integrity and authenticity of the request. The purpose is to increase the security of the signature, and at the same time, it can also implement time limits on requests to prevent replay attacks. The signature key is generated using AK, SK, and the date of the request, thereby ensuring the security and validity period of the signature. The signature value generated by the proxy gateway will be sent to the authentication server for verification as part of the signature credential along with other authentication information. Verify whether the user has the right to access the bastion host, and then forward the client's request to the bastion host after verification.

[0111] See also Figure 6 , S310, generating a string to be signed according to the access information and the bastion host address, specifically including:

[0112] S311. Generate request parameters based on the access information and the bastion host address.

[0113] S312: Perform hash processing on the request parameters as the request body summary.

[0114] S313: Obtain the identification code information and request date of the access request, concatenate the identification code information and request date, and generate a header string.

[0115] S314: extract query parameters related to the access request, and sort the query parameters according to a preset sorting rule to generate a query parameter character string.

[0116] S315: Concatenate the header string, the query parameter string, and the request body summary together to generate a string to be signed.

[0117] Exemplarily, first, the request parameters are converted into a JSON string, and its SHA-256 hash value is calculated, and then the hash value is converted into a hexadecimal string as the request body summary. Next, the identification code information of the access request (the requested UUID) and the request date are concatenated together to construct a header string. Then, the query parameters are sorted to generate a sorted query parameter string. Finally, the header string, the query parameter string, and the request body summary are concatenated together to form a string to be signed.

[0118] See also Figure 7 S320: Perform signature calculation on the signature string according to the preset key information and encryption algorithm to generate a signature certificate, specifically including:

[0119] S321. Use the preset key information and encryption algorithm to encrypt the request date and generate a first intermediate key.

[0120] Specifically, the request date is encrypted using the preset key information and encryption algorithm to obtain a first intermediate key, which serves as the basis for subsequent encryption steps and can ensure the security of the signature credential generation process.

[0121] S322: Perform encryption operation on the first intermediate key and preset identifier information to generate a second intermediate key.

[0122] Specifically, the identifier information refers to a unique identifier of the key information, which is used to distinguish different requests, and uses the first intermediate key to perform encryption operations, further enhancing the complexity and security of the signature.

[0123] S323. Perform encryption calculation on the second intermediate key and the request date to generate a signature key.

[0124] Specifically, by reintroducing the request date into the encryption process, it is ensured that the signature key is closely associated with the request date, thereby improving the timeliness and accuracy of the signature.

[0125] S324: Use the signature key and the character string to be signed to perform encryption calculation to generate a signature certificate.

[0126] Specifically, the string to be signed contains specific parameters of the access request, and is encrypted with the signature key to generate a unique and tamper-proof signature certificate for verifying the legitimacy and integrity of the access request.

[0127] Exemplarily, the encryption algorithm adopts the HMAC-SHA256 algorithm, the access key ID (AK, Access Key) and the secret access key (SK, Secret Key) constitute the key information, k_time refers to the first intermediate key, k_ak refers to the second intermediate key, and k_date refers to the signature key. First, the HMAC-SHA256 algorithm is used to calculate k_time, k_ak and k_date respectively. These calculations are to generate the final signature key k_date. The string to be signed is calculated by HMAC-SHA256 using the signature key k_date, and then the calculated signature value is converted to Base64 format to obtain the signature value. Finally, the access key ID, the header field used for the signature, the signature value and other information are spliced ​​together to form the final signature credential, which is used to generate the request information for requesting the authentication server to verify.

[0128] Among them, the HMAC-SHA256 algorithm process is a common key derivation process. It is used to generate the final signing key from the given access key ID (AK) and secret access key (SK) for HMAC signing. This process is a standard method for authenticating API requests. First, use the secret access key (SK) and the requested date to perform HMAC-SHA256 calculation to obtain k_time. Secondly, use k_time and the access key ID (AK) to perform HMAC-SHA256 calculation to obtain k_ak. Finally, use k_ak and the date to perform HMAC-SHA256 calculation to obtain k_date, which is the key used to perform HMAC signing on the request.

[0129] In the embodiment of the present application, the request processing process is as follows:

[0130] The client sends an access request to the proxy gateway. After receiving the access request sent by the client, the proxy gateway parses the access request information to obtain the access information, which includes identity information and address information. Based on the identity information and address information, the proxy gateway searches for verification information within the validity period. If so, the proxy gateway forwards the access request to the bastion host. After further authentication of the access request, the bastion host returns all operation execution results of the target device of the access request to the user terminal and audits the entire process.

[0131] If the verification information related to the access request does not exist in the memory, the proxy gateway will generate request information and send it to the authentication server for processing. The authentication server generates verification information based on the verification request information and sends it to the proxy gateway. The proxy gateway will forward the access request or reject the access request based on the verification information.

[0132] When generating request information, the proxy gateway generates request parameters based on the access information, obtains the request body summary by hashing the request parameters, concatenates the request body summary with the generated header string and query parameter string to generate a string to be signed, uses the preset key information and encryption algorithm to encrypt the signature string, generates a signature credential, and generates the request information by encapsulating the signature credential and access information.

[0133] After receiving the request information, the authentication server decrypts the signature certificate in the request information to obtain the original information, compares the original information with the access information to see if they are consistent, and generates verification information. When the verification is successful, the proxy gateway forwards the access request to the bastion host and caches the verification information in the shared memory, so that when the client accesses multiple times within the validity period, the proxy gateway can process the access request based on the verification information in the memory; when the verification fails, the proxy gateway rejects the client's access request, reducing the risk of the bastion host interface being exposed to the public network.

[0134] Embodiment 2

[0135] See also Figure 8 , an embodiment of the present application provides a request processing system, including:

[0136] The client 500 is respectively connected to the proxy gateway and the bastion host for communication, and is used to send an access request to the proxy gateway and receive the requested resources returned by the bastion host to the client.

[0137] The proxy gateway 600 is respectively connected to the client, the authentication server and the bastion host for communication, and is used to execute any one of the request processing methods.

[0138] The authentication server 700 is connected to the proxy gateway for communication, and is used to receive the request information sent by the proxy gateway, generate the verification information and send it to the proxy gateway.

[0139] The bastion machine 800 is respectively connected to the client and the proxy gateway for receiving the access request sent by the proxy gateway and returning the requested resource to the client.

[0140] Specifically, the proxy gateway is used to receive access requests from clients, generate the signature certificate required by the authentication server, generate request information and send it to the authentication server, and decide whether to forward the bastion host address requested by the client based on the verification information returned by the authentication server. The authentication server is used to receive request information from the proxy gateway, and after verifying the signature certificate, verify whether the user has the authority to access the requested bastion host address, and finally return the verification information to the proxy gateway. If the verification is successful, the proxy gateway forwards the access request to the bastion host. If the verification fails, the proxy gateway rejects the access request.

[0141] See also Fig. 9 , generating verification information, including the following steps:

[0142] S10. Receive the request information sent by the proxy gateway, and determine the access information and signature certificate.

[0143] S20. Decrypt the signature certificate according to the preset key information and encryption algorithm to obtain the original information.

[0144] S30: Determine whether the access information is consistent with the original information.

[0145] If yes, S40, verification passed.

[0146] If not, S50, verification fails.

[0147] In this embodiment, by parsing the request information, clarifying the access information and signature credentials, using the preset key information and encryption algorithm to decrypt the signature credentials, the original information before encryption is obtained, and by comparing the decrypted original information with the access information in detail, the legitimacy and validity of the request are judged. According to the judgment result, the authentication server generates corresponding verification information and sends it to the proxy gateway. Exemplarily, the preset key information and encryption algorithm refer to the preset access key ID (AK, Access Key) and secret access key (SK, Secret Key), as well as the HMAC-SHA256 algorithm.

[0148] As for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0149] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0150] Embodiment 3

[0151] See also Fig.10 , an embodiment of the present application provides an electronic device, including:

[0152] processor.

[0153] A memory is used to store processor executable instructions.

[0154] The processor is configured to execute instructions to implement any one of the request processing methods.

[0155] In this embodiment, the computer device includes a processor, a memory, and a network interface connected via a system bus.

[0156] The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data samples. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, any request processing method is implemented.

[0157] Those skilled in the art will understand that Fig.10 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0158] Embodiment 4

[0159] The embodiment of the present application also provides a computer-readable storage medium. When the instructions in the computer-readable storage medium are executed by the processor of the terminal, the terminal is enabled to execute any request processing method.

[0160] The computer-readable storage medium mentioned above can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0161] Optionally, a readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0162] Embodiment 5

[0163] An embodiment of the present application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, any request processing method is implemented.

[0164] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0165] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0166] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0167] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0168] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0169] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A request processing method, characterized in that: The steps include: Receive an access request sent by a client, and identify access information, wherein the access request refers to information requested by the client to access, and the access information includes identity information and address information; Generate request information related to the access request and send it to the authentication server; Respond to the verification information sent by the authentication server and process the access request according to the verification information, wherein the verification information indicates whether the verification is passed or not.

2. The method according to claim 1, characterized in that Before generating request information related to the access request and sending it to the authentication server, the following steps are also included: Searching for valid information from the memory, where the valid information is used to represent verification information of the access request within a validity period; If the search is successful, the access request is forwarded to the bastion host, the address of the bastion host is determined according to the address information, and the bastion host is used to return the requested resource of the client; Generate request information related to the access request and send it to the authentication server, including: If the search fails, request information related to the access request is generated and sent to the authentication server.

3. The method according to claim 1 or 2, characterized in that When the verification information indicates that the verification is successful, respond to the verification information sent by the authentication server and process the access request according to the verification information, specifically including: The verification information is stored in a memory, and the access request is forwarded to a bastion server.

4. The method according to claim 3, characterized in that When the verification information indicates that the verification fails, responding to the verification information sent by the authentication server, and processing the access request according to the verification information, specifically includes: Deny forwarding access request.

5. The method according to claim 2 or 4, characterized in that Generate request information related to the access request and send it to the authentication server, specifically including: Generate a string to be signed based on the access information and the bastion host address; According to the preset key information and encryption algorithm, the signature of the character string to be signed is calculated to generate a signature certificate; The access information and the signature credential are encapsulated to generate request information.

6. The method according to claim 5, characterized in that Generate a string to be signed based on the access information and the bastion host address, specifically including: Generate request parameters according to the access information and the bastion host address; Hash the request parameters as a request body summary; Obtaining identification code information and request date of the access request, concatenating the identification code information and the request date, and generating a header string; Extracting query parameters related to the access request, and sorting the query parameters according to a preset sorting rule to generate a query parameter character string; The header string, the query parameter string and the request body digest are concatenated together to generate a string to be signed.

7. The method according to claim 6, characterized in that According to the preset key information and encryption algorithm, the signature of the character string to be signed is calculated to generate a signature certificate, which specifically includes: Using the preset key information and encryption algorithm, encrypt the request date to generate a first intermediate key; Performing an encryption operation on the first intermediate key and preset identifier information to generate a second intermediate key; Performing encryption calculation on the second intermediate key and the request date to generate a signature key; The signature key and the character string to be signed are used to perform encryption calculation to generate the signature certificate.

8. A request processing system, characterized in that: include: The client communicates with the proxy gateway and the bastion host respectively, and is used to send access requests to the proxy gateway and receive the requested resources returned by the bastion host to the client; A proxy gateway, respectively connected to the client, the authentication server and the bastion host for communication, and configured to execute the request processing method according to any one of claims 1 to 7; The authentication server is connected to the proxy gateway for receiving the request information sent by the proxy gateway and generating the verification information and sending it to the proxy gateway; The bastion host is connected to the client and the proxy gateway respectively, and is used to receive access requests sent by the proxy gateway and return the requested resources to the client.

9. The system according to claim 8, characterized in that Generating verification information includes the following steps: Receive the request information sent by the proxy gateway and determine the access information and signature credentials; Decrypt the signature certificate according to the preset key information and encryption algorithm to obtain the original information; Determining whether the access information is consistent with the original information; If yes, verification is successful; If not, the verification fails.

10. An electronic device, characterized in that: include: processor; A memory, configured to store instructions executable by the processor; The processor is configured to execute the instructions to implement the request processing method according to any one of claims 1 to 7.

Images