A request processing method, system and electronic device

Abstract

The application provides a request processing method and system and an electronic device, and relates to the technical field of communication.The method comprises the following steps: receiving an access request sent by a client, identifying access information;generating request information related to the access request and sending the request information to an authentication server;responding to verification information sent by the authentication server, processing the access request according to the verification information.Through providing an additional security layer, the identity of the client is verified, ensuring that only clients with access rights can access the bastion host, reducing the risk of directly exposing the interface of the bastion host to the public network.Through access limitation, the security of the bastion host is improved, the refinement of access control is realized, and the possibility of potential illegal access is reduced.The technical problem of single-point failure risk caused by centralized management in the prior art is solved, and the stability, security and reliability of the system are ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to a request processing method, system and electronic device. BACKGROUND

[0002] A bastion host is a highly specialized system that is based on advanced cloud computing technology and network security concepts, and focuses on providing fine-grained permission management and comprehensive auditing functions. The system builds a secure and reliable remote access environment by centrally managing and strictly controlling user access permissions, allowing administrators to conveniently manage key resources within the enterprise remotely. At the same time, the bastion host also has powerful auditing capabilities, which can record and track every operation of the user, including login time, operation content, result feedback and other key information, providing strong support for the security management and compliance review of the enterprise.

[0003] In a multi-tenant scenario, the bastion host, as a security device, can be used to manage and control the access permissions of servers and network devices within the enterprise, providing a centralized management approach. By authenticating the user, the system determines whether the user has access to the target resource based on the user's role and pre-set policies. If the user's identity and permissions meet the requirements, the bastion host will forward the connection to the server or device in the internal network. However, the present inventors have found that the above-mentioned technology has at least the following technical problems in the process of implementing the technical solutions of the embodiments of the present application:

[0004] The bastion host itself can query the servers that the user is allowed to log in to based on the user's identity information, but before the user logs in to the bastion host, the bastion host cannot determine whether the user has access to the bastion host. As a centralized management portal, once it is compromised, it may lead to security vulnerabilities in the entire system, and even cause catastrophic consequences. SUMMARY

[0005] The embodiments of the present application provide a request processing method, system and electronic device to solve the technical problem of single point of failure risk caused by centralized management in the prior art.

[0006] In a first aspect, the embodiments of the present application provide a request processing method, including the following steps

[0007] Receiving an access request sent by a client, identifying access information, the access request refers to the information requested by the client to access, and the access information includes identity information and address information;

[0008] Generating request information related to the access request and sending it to an authentication server;

[0009] In response to the verification information sent by the authentication server, the access request is processed according to the verification information, wherein the verification information indicates that the verification is passed or the verification is failed.

[0010] In some embodiments, before the request information related to the access request is generated and sent to the authentication server, the following step is further included:

[0011] The valid information is searched from the memory, wherein the valid information is used to indicate the verification information of the access request within a valid period;

[0012] If the searching is successful, the access request is forwarded to the bastion host, wherein the address of the bastion host is determined according to the address information, and the bastion host is used to return the requested resource of the client;

[0013] The request information related to the access request is generated and sent to the authentication server, including:

[0014] If the searching is failed, the request information related to the access request is generated and sent to the authentication server.

[0015] In some embodiments, when the verification information indicates that the verification is passed, in response to the verification information sent by the authentication server, the access request is processed according to the verification information, and specifically includes:

[0016] The verification information is stored in the memory, and the access request is forwarded to the bastion host.

[0017] In some embodiments, when the verification information indicates that the verification is failed, in response to the verification information sent by the authentication server, the access request is processed according to the verification information, and specifically includes:

[0018] The access request is rejected to be forwarded.

[0019] In some embodiments, the request information related to the access request is generated and sent to the authentication server, and specifically includes:

[0020] The to-be-signed string is generated according to the access information and the address of the bastion host;

[0021] The signature credential is generated by signing and calculating the to-be-signed string according to the preset key information and the encryption algorithm;

[0022] The access information and the signature credential are encapsulated to generate the request information.

[0023] In some embodiments, the to-be-signed string is generated according to the access information and the address of the bastion host, and specifically includes:

[0024] The request parameter is generated according to the access information and the address of the bastion host;

[0025] hashing the request parameter as a request body digest;

[0026] obtaining identification code information and request date of the access request, concatenating the identification code information and the request date to generate a header string;

[0027] extracting query parameters related to the access request and sorting the query parameters according to a preset sorting rule to generate a query parameter string;

[0028] concatenating the header string, the query parameter string and the request body digest to generate a to-be-signed string.

[0029] In some embodiments, the to-be-signed string is signed and calculated according to preset key information and an encryption algorithm to generate a signature credential, specifically including:

[0030] encrypting the request date using the preset key information and the encryption algorithm to generate a first intermediate key;

[0031] encrypting the first intermediate key and preset identifier information to generate a second intermediate key;

[0032] encrypting the second intermediate key and the request date to generate a signature key;

[0033] encrypting the signature key and the to-be-signed string to generate the signature credential.

[0034] In a second aspect, the embodiments of the present application further provide a request processing system, comprising:

[0035] a client, which is in communication connection with a proxy gateway and a bastion host respectively, and is configured to send an access request to the proxy gateway and receive a request resource returned by the bastion host;

[0036] a proxy gateway, which is in communication connection with the client, an authentication server and the bastion host respectively, and is configured to execute the request processing method according to any one of the embodiments;

[0037] an authentication server, which is in communication connection with the proxy gateway, and is configured to receive request information sent by the proxy gateway and send verification information to the proxy gateway after generating the verification information;

[0038] a bastion host, which is in communication connection with the client and the proxy gateway respectively, and is configured to receive an access request sent by the proxy gateway and return a request resource to the client.

[0039] In some embodiments, the verification information is generated, including the following steps:

[0040] receiving request information sent by the proxy gateway, determining access information and a signature credential;

[0041] decrypt the signature certificate according to the preset key information and the encryption algorithm, to obtain original information;

[0042] determine whether the access information is consistent with the original information;

[0043] if yes, the verification is passed;

[0044] if no, the verification is not passed.

[0045] In a third aspect, an electronic device is also provided, comprising:

[0046] a processor;

[0047] a memory for storing instructions executable by the processor;

[0048] The processor is configured to execute the instructions to implement the request processing method.

[0049] Compared with the prior art, the present application has the following advantages:

[0050] The client sends an access request to the proxy gateway, the proxy gateway obtains access information including identity information and address information by parsing the access request information after receiving the access request sent by the client, and according to the identity information and the address information, checks whether there is validation information within the valid period, if yes, the proxy gateway forwards the access request to the bastion host, the bastion host returns all operation execution results of the target device of the access request to the user terminal after further authentication, and audits the whole process. If there is no validation information related to the access request in the memory, the proxy gateway generates request information and sends it to the authentication server for processing, the authentication server generates validation information through the validation request information and sends it to the proxy gateway, and the proxy gateway executes the operation of forwarding the access request or rejecting the access request according to the validation information. The proxy gateway acts as an additional security layer to authenticate the client, ensuring that only clients with access rights can access the bastion host, reducing the risk of directly exposing the bastion host interface to the public network. Through the implementation of access limitation, the security of the bastion host is improved, the fine-grained access control is realized, and the possibility of potential illegal access is reduced. The technical problem of single point failure risk caused by centralized management in the prior art is solved, and the stability, security and reliability of the system are ensured. BRIEF DESCRIPTION OF DRAWINGS

[0051] Figure 1 is a method flowchart of the request processing method provided by the embodiments of the present application;

[0052] Figure 2is a method flowchart of a request processing method provided by another embodiment of the application;

[0053] Figure 3 is a method flowchart of a request processing method provided by another embodiment of the application;

[0054] Figure 4 is a method flowchart of a request processing method provided by another embodiment of the application;

[0055] Figure 5 is a method flowchart of a request processing method provided by another embodiment of the application;

[0056] Figure 6 is a method flowchart of a request processing method provided by another embodiment of the application;

[0057] Figure 7 is a method flowchart of a request processing method provided by another embodiment of the application;

[0058] Figure 8 is a structure schematic diagram of a request processing system provided by an embodiment of the application;

[0059] Figure 9 is a method flowchart of a request processing method provided by another embodiment of the application;

[0060] Figure 10 is a structure schematic diagram of a request processing system provided by an embodiment of the application. DETAILED DESCRIPTION

[0061] A cloud service provider needs to provide a secure and reliable cloud environment for tenants. A bastion host, as a kind of security device, can be used to manage and control the access permission of servers and network devices in an enterprise, and provides a centralized management mode, which can perform identity verification, authorization and auditing on users. As a key device, the security of data and assets on the cloud is directly related to the bastion host. However, the bastion host has potential risks while it concentrates permissions and assets. The bastion host has high permissions, and once it is broken or misused, it will pose a security threat to internal network assets. In a multi-tenant scenario, the security of the bastion host is even more important. Because there are many tenants, a large number of bastion hosts need to be managed, and each bastion host may be accessed by multiple users. In order to ensure security, the bastion host not only needs to be able to verify the identity of the access user, but also preferably controls the permission of each user to access the bastion host. The bastion host itself can query the server that the user is permitted to log in according to the identity information of the logged-in user, but before the user logs in the bastion host, it cannot be determined whether the user has the permission to access the bastion host.

[0062] To enhance the security of the bastion host, potential illegal access is limited from the access source. The embodiment of the application provides a request processing method, which increases a layer of permission verification before a user logs in the bastion host through multi-level defense measures, ensures that the user has the permission to access the bastion host, and provides a safe and reliable cloud operation and maintenance environment.

[0063] The following are some explanations of nouns:

[0064] Bastion host: a bastion host is a permission management and auditing system based on cloud computing and network security technology. It provides a safe and reliable remote access and management method by centrally managing and controlling user access permissions, and can audit and record user operations.

[0065] Proxy gateway: a proxy gateway is an intermediate layer between the client and the server, which processes and forwards network requests. It acts as a proxy between the client and the server, while providing some additional functions and security.

[0066] OpenResty is a high-performance web platform based on Nginx and LuaJIT, which can use Lua scripts to write custom Nginx modules to implement flexible request processing and business logic, such as caching, security authentication, access control, etc.

[0067] HMAC (Hash-based Message Authentication Code) algorithm is a key-based message integrity verification method. HMAC algorithm can be used for encryption, digital signature, message verification, etc.

[0068] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0069] Embodiment one

[0070] With reference to Figure 1 The embodiment of the application provides a request processing method, which comprises the following steps:

[0071] S100, receiving an access request sent by a client, identifying access information, the access request indicating information requested by the client to access, and the access information including identity information and address information.

[0072] S300, generating request information related to the access request and sending it to the authentication server.

[0073] S400, in response to the authentication server sending the verification information, processing the access request according to the verification information, and the verification information indicating that the verification is passed or not passed.

[0074] Specifically, the identity information includes an account ID, a password, a digital certificate, and a biometric identification code, and the address information indicates the current network location of the client and the specific resource path of the request access. The authentication server verifies the access request according to the request information, generates verification information, and the verification information indicates whether the access request is verified. According to the verification information, corresponding measures are taken.

[0075] Exemplarily, the above embodiment uses a proxy server, which includes but is not limited to an OpenResty-based proxy gateway, an Apache APISIX-based API gateway, an open source API gateway, and a Netty-based reverse proxy gateway. The identity information refers to an account ID, and the address information refers to the bastion host address of the request access. The request information is generated according to the access information. Using OpenResty as a proxy gateway, the proxy gateway exists between the client and the bastion host as an intermediate node and receives access requests from the client. The access information of the client is obtained from the access request of the client, including identity information such as account ID, and the bastion host address requested by the user is obtained. The proxy gateway uses the obtained identity information and bastion host address to construct request parameters, and sorts these parameters according to certain rules to generate a string to be signed. Then the proxy gateway uses the HMAC-SHA256 algorithm to sign the string to be signed using a previously agreed key to generate a signature value. In this process, the identity verification and authorization mechanism is realized by using the proxy gateway, which improves the fine degree of access control of the bastion host. The security of the bastion host is enhanced. The proxy gateway as an additional security layer performs identity verification on the client to ensure that only clients with access rights can access the bastion host, reducing the risk of directly exposing the bastion host interface to the public network. Through the implementation of access limitation, the security of the bastion host is improved, the fine access control is realized, and the possibility of potential illegal access is reduced. The technical problem of single point failure risk caused by centralized management in the prior art is solved, and the stability, security and reliability of the system are ensured.

[0076] Referring to Figures 1-3 Before S300, generating request information related to the access request and sending it to the authentication server, the following steps are also included:

[0077] S200, searching for valid information from the memory, and the valid information is used to indicate the verification information of the access request within the validity period.

[0078] If the search is successful, S500 forwards the access request to the bastion machine, the address of the bastion machine being determined according to the address information, and the bastion machine is used to return the requested resource of the client.

[0079] S300 generates request information related to the access request and sends it to the authentication server, including:

[0080] If the search fails, request information related to the access request is generated and sent to the authentication server.

[0081] In this embodiment, first, it is searched in the memory whether there is verification information of the access request within the valid period, it is determined whether the access request has been verified within the valid period, the valid period refers to the valid time of the verification information in the memory, and within the valid period, the verification information is stored in the memory.

[0082] When the search is successful, it indicates that there is verification information related to the access request within the valid period, the found valid information is used as the verification information to process the access request, and the access request is forwarded to the bastion machine, which returns the requested resource of the client.

[0083] If the search fails, request information needs to be generated according to the access information and sent to the authentication server for further verification.

[0084] For example, referring to Figure 2 and Figure 3 , when the client requests to access the bastion machine for the first time, the proxy gateway receives the request and obtains the identity information and request address of the user from the request, after the proxy gateway receives the request, if there is no related information in the cache, the obtained identity information and request address are encapsulated into the request body, and a signature credential for identity verification is generated and encapsulated into the request header, and the request information is sent to the authentication server. The proxy gateway obtains the verification information, which is verification pass or verification fail, and the proxy gateway makes different operations on the access request of the client according to the verification information.

[0085] More specifically, the client requests to access the bastion machine address, the identity information is the account id, the request address is the ip address of the request, and the data format is json, for example:

[0086] {

[0087] "id":"353q5fgs246gdw2301",

[0088] "ip":"139.196.0.1"

[0089] }

[0090] After the proxy gateway receives the request, an id-ip string is formed with the id and ip, and is used as a key to search in the cache. If there is no id-ip authentication success information in the cache, a signature certificate required by the authentication server is generated, a request message is generated according to the signature certificate, and a verification query is requested to the authentication server to query whether the ip address has access right. The authentication server returns a query result. The proxy gateway processes according to the returned result.

[0091] If the returned result is no access right, the access request is directly rejected, and the session is ended. If the returned result is access right, the access request is forwarded to the ip address. The id-ip string of the access right is stored in the cache, and the cache validity time is set to 1 hour.

[0092] The request resource is returned by the bastion machine accessed by the client. When the client repeatedly requests to access the bastion machine address, the proxy gateway receives the access request, forms an id-ip string with the id and ip, and uses the id-ip string as a key to search in the cache. If there is id-ip authentication success information in the cache, the access request is directly forwarded to the ip address. The request resource is returned by the bastion machine accessed by the client.

[0093] The embodiment of the application reduces the request to the bastion machine by caching the access data of the client, accelerates the response speed of the bastion machine, and reduces the burden of the bastion machine.

[0094] Referring to Figure 4 When the verification information is authentication success, S400, the access request is processed according to the verification information in response to the verification information sent by the authentication server, and specifically includes:

[0095] S410, the verification information is stored in the memory, and the access request is forwarded to the bastion machine.

[0096] Specifically, if the verification information is authentication success, the access request of the client is completely forwarded to the bastion machine, and the verification information is stored in the shared memory. When the client repeatedly requests to access within the cache validity time, the proxy gateway receives the request, reads the corresponding valid key-value pair from the shared memory, and directly forwards the request of the client to the bastion machine. Through the cache mechanism, the authentication times are reduced. The proxy gateway caches the frequently accessed data, reduces the request to the bastion machine, accelerates the response speed of the bastion machine, and reduces the burden of the bastion machine. The shared memory cache mechanism is used, the access to the authentication server is reduced, and the performance and efficiency of the system are improved.

[0097] Referring to Figure 5When the verification information is verification failure, S400, in response to the verification information sent by the authentication server, processing the access request according to the verification information, specifically including:

[0098] S420, reject forwarding the access request.

[0099] Specifically, if the verification information is verification failure, the access request is rejected, and the purpose of limiting access is achieved.

[0100] Referring to Figure 5 S300, generating request information related to the access request and sending it to the authentication server, specifically including:

[0101] S310, generating a to-be-signed string according to the access information and the bastion host address.

[0102] Specifically, the to-be-signed string is the basis for generating the signature credential subsequently, ensuring the integrity and pertinence of the signature credential content, preventing tampering and forgery of information.

[0103] Illustratively, the proxy gateway uses the obtained identity information and the bastion host address to construct request parameters, and sorts these parameters according to certain rules to generate a to-be-signed string. The identity information refers to the access information related to the access request.

[0104] S320, signing and calculating the to-be-signed string according to the preset key information and encryption algorithm to generate a signature credential.

[0105] Specifically, the key information refers to information that is kept secret, and only specific systems or services can access it. The encryption algorithm can ensure the uniqueness and reliability of the signature credential. The signature credential refers to the signature header information that meets the specific format, which is used for identity verification in the request header. The required signature credential is constructed according to the incoming query parameters, request parameters, request date, access request identification code information (request UUID), access key ID (AK, Access Key), and secret access key (SK, Secret Key).

[0106] Illustratively, the proxy gateway uses the HMAC-SHA256 algorithm to perform signature calculation on the to-be-signed string using the pre-agreed key. First, the key is initialized and processed, then internally filled and iteratively hashed, and finally the signature value is generated.

[0107] S330, encapsulating the access information and the signature credential to generate the request information.

[0108] Specifically, the request information contains all the necessary information required by the authentication server to verify the access request, and the encapsulated request information is sent to the authentication server for verification.

[0109] The generated signature value will be sent to the authentication server as part of the signature credential along with the key information for verification. The authentication server uses the same key information and algorithm to perform a signature calculation on the received parameters and compares the calculated signature value with the signature value sent by the client to verify the identity and authority of the client. The signature value sent by the client refers to the access information related to the access request.

[0110] The signature credential and identity verification mechanism ensure the security and accuracy of the identity information. The signature credential is generated by the HMAC-SHA256 algorithm, which first generates a signature key that will be used to sign the request to ensure the integrity and authenticity of the request. The purpose is to increase the security of the signature and also to implement time limit for the request to prevent replay attacks. The signature key is generated using AK, SK and the date of the request, thereby ensuring the security and validity period of the signature. The signature value generated by the proxy gateway will be sent to the authentication server as part of the signature credential along with other authentication information for verification. Verify whether the user has the right to access the bastion host, and after verification, forward the client's request to the bastion host.

[0111] Referring to Figure 6 , S310, generating a to-be-signed string according to the access information and the bastion host address, specifically including:

[0112] S311, generating request parameters according to the access information and the bastion host address.

[0113] S312, performing hash processing on the request parameters as a request body digest.

[0114] S313, obtaining the identification code information and the request date of the access request, concatenating the identification code information and the request date to generate a header string.

[0115] S314, extracting the query parameters related to the access request and sorting the query parameters according to the preset sorting rule to generate a query parameter string.

[0116] S315, concatenating the header string, the query parameter string and the request body digest to generate the to-be-signed string.

[0117] For example, first, the request parameters are converted into a JSON string, and a SHA-256 hash value thereof is calculated, and then the hash value is converted into a hexadecimal string as a request body digest. Next, the identification code information of the access request (UUID of the request) and the request date are spliced together to construct a header string. Then, the query parameters are sorted to generate a sorted query parameter string. Finally, the header string, the query parameter string, and the request body digest are spliced together to form a to-be-signed string.

[0118] Referring to Figure 7 , S320, according to the preset key information and the encryption algorithm, a signature credential is generated by signature calculation on the to-be-signed string, specifically including:

[0119] S321, using the preset key information and the encryption algorithm, the request date is encrypted to generate a first intermediate key.

[0120] Specifically, the request date is encrypted by the preset key information and the encryption algorithm to obtain the first intermediate key, and the first intermediate key serves as the basis for subsequent encryption steps, which can ensure the security of the signature credential generation process.

[0121] S322, the first intermediate key and the preset identifier information are encrypted to generate a second intermediate key.

[0122] Specifically, the identifier information refers to the unique identification of the key information, which is used to distinguish different requests, and the first intermediate key is used for encryption operation, which further enhances the complexity and security of the signature.

[0123] S323, the second intermediate key and the request date are encrypted to generate a signature key.

[0124] Specifically, by introducing the request date into the encryption process again, it is ensured that the signature key is closely related to the request date, which improves the timeliness and accuracy of the signature.

[0125] S324, using the signature key and the to-be-signed string, a signature credential is generated by encryption calculation.

[0126] Specifically, the to-be-signed string contains specific parameters of the access request, and by encryption processing of the signature key, a signature credential with uniqueness and tamper resistance is generated, which is used to verify the legality and integrity of the access request.

[0127] For example, the encryption algorithm uses the HMAC-SHA256 algorithm, the access key ID (AK, Access Key) and the secret access key (SK, Secret Key) form the key information, k_time refers to the first intermediate key, k_ak refers to the second intermediate key, and k_date refers to the signature key. First, the HMAC-SHA256 algorithm is used to calculate k_time, k_ak and k_date respectively. These calculations are to generate the final signature key k_date. The signature key k_date is used for HMAC-SHA256 calculation on the string to be signed, and then the calculated signature value is converted to Base64 format to obtain the signature value. Finally, the access key ID, the header field used for signature, the signature value and other information are spliced together to form the final signature certificate, which is used to generate request information for verification by the authentication server.

[0128] The HMAC-SHA256 algorithm process is a common key derivation process. It is used to generate the final signature key from the given access key ID (AK, Access Key) and secret access key (SK, Secret Key) for HMAC signature. This process is a standard method for authenticating API requests. First, the secret access key (SK, Secret Key) and the requested date are used for HMAC-SHA256 calculation to obtain k_time. Second, k_time and the access key ID (AK, Access Key) are used for HMAC-SHA256 calculation to obtain k_ak. Finally, k_ak and the date are used for HMAC-SHA256 calculation to obtain k_date, which is the key used for HMAC signature of the request.

[0129] In the embodiments of the present application, the request processing process is as follows:

[0130] The client sends an access request to the proxy gateway, and the proxy gateway receives the access request sent by the client, parses the access request information, obtains the access information, and the access information includes identity information and address information. According to the identity information and the address information, it is checked whether there is valid verification information within the validity period. If there is, the proxy gateway forwards the access request to the bastion host, and the bastion host returns all operation execution results of the target device of the access request to the user terminal after further authentication of the access request, and audits the whole process.

[0131] If the authentication information related to the access request does not exist in the memory, the proxy gateway generates request information and sends the request information to the authentication server for processing. The authentication server generates authentication information by verifying the request information and sends it to the proxy gateway. The proxy gateway executes the operation of forwarding the access request or rejecting the access request according to the authentication information.

[0132] In generating the request information, the proxy gateway generates request parameters according to the access information, obtains a request body digest by performing hash processing on the request parameters, concatenates the request body digest with the generated header string and query parameter string to generate a to-be-signed string, uses a preset key information and an encryption algorithm to encrypt and calculate the to-be-signed string to generate a signature credential, and generates the request information by encapsulating the signature credential and the access information.

[0133] After the authentication server receives the request information, the signature credential in the request information is decrypted to obtain original information. The original information is compared with the access information to generate authentication information. When the authentication is passed, the proxy gateway forwards the access request to the bastion host and caches the authentication information in the shared memory, so that the proxy gateway can process the access request according to the authentication information in the memory when the client accesses multiple times within the valid period. When the authentication is not passed, the proxy gateway rejects the access request of the client, thereby reducing the risk of exposing the interface of the bastion host to the public network.

[0134] Embodiment Two

[0135] Referring to Figure 8 The embodiment of the application provides a request processing system, comprising:

[0136] The client 500 is in communication connection with the proxy gateway and the bastion host respectively, and is used to send an access request to the proxy gateway and receive a request resource returned by the bastion host to the client.

[0137] The proxy gateway 600 is in communication connection with the client, the authentication server and the bastion host respectively, and is used to execute any one of the request processing methods.

[0138] The authentication server 700 is in communication connection with the proxy gateway, and is used to receive the request information sent by the proxy gateway and send the authentication information to the proxy gateway after generating the authentication information.

[0139] The bastion host 800 is in communication connection with the client and the proxy gateway respectively, and is used to receive the access request sent by the proxy gateway and return a request resource to the client.

[0140] Specifically, the proxy gateway is configured to receive an access request from a client, generate a signature credential required by an authentication server, generate request information and send the request information to the authentication server, and determine whether to forward an address of a bastion host requested by the client according to verification information returned by the authentication server. The authentication server is configured to receive the request information from the proxy gateway, verify the signature credential, check whether the user has the access right to the address of the bastion host requested by the user, and finally return the verification information to the proxy gateway. If the verification is passed, the proxy gateway forwards the access request to the bastion host. If the verification is not passed, the proxy gateway rejects the access request.

[0141] With reference to Figure 9 generating verification information, comprising the following steps:

[0142] S10, receiving the request information sent by the proxy gateway, determining access information and a signature credential.

[0143] S20, decrypting the signature credential according to preset key information and an encryption algorithm to obtain original information.

[0144] S30, determining whether the access information is consistent with the original information.

[0145] If yes, S40, the verification is passed.

[0146] If no, S50, the verification is not passed.

[0147] In the embodiment, the request information is parsed to determine the access information and the signature credential, the signature credential is decrypted using the preset key information and the encryption algorithm to obtain the original information before encryption, the original information obtained by decryption is compared with the access information in detail to determine the legality and validity of the request, and the authentication server generates corresponding verification information according to the determination result and sends the verification information to the proxy gateway. For example, the preset key information and the encryption algorithm refer to a preset access key ID (AK, Access Key) and a secret access key (SK, Secret Key), and an HMAC-SHA256 algorithm.

[0148] For the system embodiment, the description is relatively simple because the system embodiment is basically similar to the method embodiment. For related parts, refer to the description of the method embodiment.

[0149] Each embodiment in the specification is described in a progressive manner, and each embodiment mainly describes the difference from other embodiments. For the same and similar parts between the embodiments, refer to each other.

[0150] Embodiment Three

[0151] With reference to Figure 10 The embodiment of the application provides an electronic device, which comprises:

[0152] a processor.

[0153] a memory for storing processor-executable instructions.

[0154] wherein the processor is configured to execute the instructions to implement any of the request processing methods.

[0155] In the embodiment, the computer device comprises a processor, a memory and a network interface connected by a system bus.

[0156] wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The database of the computer device is configured to store data samples. The network interface of the computer device is configured to communicate with an external terminal through a network connection. The computer program is executed by the processor to implement any of the request processing methods.

[0157] Those skilled in the art can understand that, Figure 10 the structure shown in the above embodiment is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can comprise more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0158] Embodiment Four

[0159] The embodiments of the present application also provide a computer readable storage medium, when the instructions in the computer readable storage medium are executed by the processor of the terminal, the terminal can execute any of the request processing methods.

[0160] The computer readable storage medium described above can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic storage, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0161] Optionally, a readable storage medium can be coupled to the processor, such that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can be a component of the processor. Alternatively, the processor and the readable storage medium can exist at two different physical locations, and the connection between the processor and the readable storage medium can be created by a wired communication means, a wireless communication means, or a combination of both. Of course, the processor and the storage medium can also be located in a single physical location.

[0162] Embodiment Five

[0163] The embodiments of the present application also provide a computer program product, which comprises a computer program. The computer program is executed by a processor to implement any one of the processing methods.

[0164] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk memory, CD-ROM, optical memory, etc.) containing computer-usable program code.

[0165] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus generate a means for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 means for performing the functions specified in the flowchart and / or block diagram.

[0166] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction means, which implements the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 means for performing the functions specified in the flowchart and / or block diagram.

[0167] These computer program instructions can also be loaded into a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 The flowchart blocks Figure 1 The flowchart blocks

[0168] Although preferred embodiments of the application have been described herein, it will be apparent to those skilled in the art that various modifications and changes can be made to the embodiments without departing from the spirit and scope of the application. Accordingly, it is intended that all such modifications and changes be included within the scope of the application as set forth in the following claims and their equivalents.

[0169] Obviously, numerous modifications and variations of the present application are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described herein.

Claims

1. A request processing method characterized by comprising: The method comprises the following steps: receiving an access request sent by a client, and identifying access information, wherein the access request indicates information requested by the client to access, and the access information comprises identity information and address information; generating request information related to the access request, and sending the request information to an authentication server; processing the access request according to verification information sent by the authentication server in response to the verification information, wherein the verification information indicates that the verification is passed or the verification is failed; wherein the generating of the request information related to the access request and the sending of the request information to the authentication server specifically comprises: generating a to-be-signed string according to the access information and a bastion host address; performing signature calculation on the to-be-signed string according to preset key information and an encryption algorithm to generate a signature credential; and encapsulating the access information and the signature credential to generate the request information; the generating of the to-be-signed string according to the access information and the bastion host address specifically comprises: generating request parameters according to the access information and the bastion host address; performing hash processing on the request parameters as a request body digest; obtaining identification code information and a request date of the access request, splicing the identification code information and the request date to generate a header string; extracting query parameters related to the access request, and sorting the query parameters according to a preset sorting rule to generate a query parameter string; and splicing the header string, the query parameter string and the request body digest together to generate the to-be-signed string.

2. The method of claim 1, wherein, Before the generating of the request information related to the access request and the sending of the request information to the authentication server, the method further comprises the following steps: finding valid information in a memory, wherein the valid information is used to indicate verification information of the access request within a valid period; if the finding is successful, forwarding the access request to a bastion host, wherein an address of the bastion host is determined according to the address information, and the bastion host is used to return a requested resource of the client; the generating of the request information related to the access request and the sending of the request information to the authentication server comprise: if the finding is failed, the generating of the request information related to the access request and the sending of the request information to the authentication server.

3. The method of claim 1 or 2, wherein, When the verification information is the verification passed, the processing of the access request according to the verification information in response to the verification information sent by the authentication server specifically comprises: storing the verification information in the memory, and forwarding the access request to the bastion host.

4. The method of claim 3, wherein, When the verification information is the verification failed, the processing of the access request according to the verification information in response to the verification information sent by the authentication server specifically comprises: refusing to forward the access request.

5. The method of claim 1, wherein, The signature calculation on the to-be-signed string according to the preset key information and the encryption algorithm to generate the signature credential specifically comprises: encrypting the request date using the preset key information and the encryption algorithm to generate a first intermediate key; performing encryption operation on the first intermediate key and preset identifier information to generate a second intermediate key; performing encryption calculation on the second intermediate key and the request date to generate a signature key; performing encryption calculation on the signature key and the to-be-signed string to generate the signature credential.

6. A request processing system characterized by comprising: ​ The client is in communication connection with the proxy gateway and the bastion host respectively, and is used for sending an access request to the proxy gateway and receiving a request resource returned by the bastion host to the client; The proxy gateway is in communication connection with the client, the authentication server and the bastion host respectively, and is used for executing the request processing method in any one of claims 1 to 5; The authentication server is in communication connection with the proxy gateway, and is used for receiving the request information sent by the proxy gateway, generating authentication information and sending the authentication information to the proxy gateway; The bastion host is in communication connection with the client and the proxy gateway respectively, and is used for receiving the access request sent by the proxy gateway and returning a request resource to the client.

7. The system of claim 6, wherein, The authentication information is generated, including the following steps: Receiving the request information sent by the proxy gateway, determining the access information and the signature certificate; Decrypting the signature certificate according to the preset key information and the encryption algorithm to obtain the original information; Judging whether the access information is consistent with the original information; If yes, the authentication is passed; If no, the authentication is not passed.

8. An electronic device, comprising: It comprises: A processor; A memory for storing executable instructions of the processor; Wherein, the processor is configured to execute the instructions to realize the request processing method in any one of claims 1 to 5.

Images