Character command processing method based on bastion host, bastion host and storage medium

Abstract

The present application relates to a character command processing method based on a bastion host, a bastion host and a storage medium, wherein the method comprises: after establishing SSH channels between the bastion host and the target client and target server respectively, utilizing an SSH protocol parsing engine to parse the character data transmitted in the SSH channel to obtain the original character stream input by the target client; utilizing a shadow terminal to synchronize the context of the target server, and simulating the execution of the target server based on the original character stream to generate a simulated echo, and determining the corresponding target command; utilizing a dual-channel checker to compare the original character stream and the simulated echo to obtain a comparison result; utilizing a decision maker to determine a release decision or an interception decision based on the comparison result. Through the present application, the problems in the related art that lead to low recognition accuracy, false positives and missed reports are solved, false positives and missed reports are eliminated, the integrity of target command recognition is ensured, and recognition accuracy is improved.

Description

Technical Field

[0001] The present application relates to the technical field of bastion hosts, and in particular to a character command processing method based on a bastion host, a bastion host, and a storage medium. Background Art

[0002] A bastion host is a server that uses various technical means to monitor and record the operations of servers, network equipment, security equipment, databases, and other equipment within a specific network environment to protect the network and data from intrusion and damage from external and internal users. This allows for centralized alarming, timely processing, and auditing to determine accountability.

[0003] With the rapid development of the internet, industries are becoming increasingly reliant on it. The demand for servers, applications, and network equipment within enterprises is increasing, and the corresponding number of operations and maintenance personnel is also gradually increasing. Traditional bastion hosts use a TTY echo parsing solution to achieve this. The user's SSH character stream echo is cached and recognized by the character command recognition module, which then matches regular expressions to determine whether to block or allow the connection. However, this solution can suffer from interference such as network latency, resulting in low recognition accuracy and the possibility of false positives and false negatives.

[0004] Currently, no effective solution has been proposed to address the problems of low recognition accuracy, false positives, and missed positives in related technologies. Summary of the Invention

[0005] In this embodiment, a character command processing method based on a bastion host, a bastion host, and a storage medium are provided to solve the problems in related technologies that lead to low recognition accuracy, false positives, and missed positives.

[0006] In a first aspect, this embodiment provides a character command processing method based on a bastion host, which is applied to the bastion host; the method includes:

[0007] After establishing SSH channels between the bastion host and the target client and the target server respectively, using the SSH protocol parsing engine in the bastion host to parse the character data transmitted in the SSH channel to obtain the original character stream input by the target client;

[0008] Utilize the shadow terminal in the bastion host to synchronize the context of the target server, simulate the execution of the target server based on the original character stream to generate a simulated echo, and determine the corresponding target command;

[0009] Using a dual-channel checker in the bastion host, the original character stream and the simulated echo are compared to obtain a comparison result;

[0010] Utilize the decision maker in the bastion host to determine a release decision or an interception decision based on the comparison result; the release decision is used to release the target command to the target server; the interception decision is used to intercept the target command to the target server.

[0011] In some embodiments, the method further comprises:

[0012] Before synchronizing the context of the target server, the configuration of the shadow terminal is initialized according to the type and parameters of the terminal corresponding to the target server.

[0013] In some embodiments, the original character stream and the simulated echo are compared to obtain a comparison result, including:

[0014] Comparing the original character stream and the simulated echo;

[0015] If the original character stream and the simulated echo are inconsistent, the comparison result is comparison failure;

[0016] If the original character stream and the simulated echo are consistent, the comparison result is a successful comparison.

[0017] In some embodiments, determining a release decision or an interception decision based on the comparison result includes:

[0018] When the comparison result is successful, matching the original character stream and the simulated echo with a preset strategy library respectively;

[0019] If the original character stream and / or the simulated echo matches the target rule in the policy library, an interception decision is made;

[0020] If neither the original character stream nor the simulated echo matches the target rule in the policy library, a release decision is made.

[0021] In some embodiments, the method further comprises:

[0022] When the release decision is determined, the SSH server in the bastion host is used to forward the released target command to the target server, and the target echo returned by the target server is transmitted to the target client;

[0023] When the interception decision is determined, the decision maker is used to intercept commands in the target command that match the target rule, and return a simulated echo to the target client.

[0024] In some embodiments, the method further comprises:

[0025] A SIGWINCH signal of the target client is obtained, and a virtual terminal window size of the shadow terminal is synchronized based on the SIGWINCH signal.

[0026] Secondly, in this embodiment, a bastion host is provided, including an SSH server, an SSH client, an SSH protocol parsing engine, a shadow terminal, a dual-channel checker, and a decision maker;

[0027] The SSH server is connected to the SSH client, the target client and the SSH protocol parsing engine respectively, and is used to establish an SSH channel with the target client;

[0028] The SSH client is connected to the shadow terminal and the target server respectively, and is used to establish an SSH channel with the target server;

[0029] The SSH protocol parsing engine is used to parse the character data transmitted in the SSH channel to obtain the original character stream input by the target client;

[0030] The shadow terminal is used to synchronize the context of the target server, simulate the execution of the target server based on the original character stream to generate a simulated echo, and determine the corresponding target command;

[0031] The dual-channel checker is used to compare the original character stream and the simulated echo to obtain a comparison result;

[0032] The decision maker is used to determine a release decision or an interception decision based on the comparison result; the release decision is used to release the target command to the target server; the interception decision is used to intercept the target command to the target server.

[0033] In some embodiments, the data format for interaction between the SSH protocol parsing engine and the shadow terminal, and the data format for interaction between the shadow terminal and the dual-channel checker are both in JSON format.

[0034] In some of the embodiments, the bastion host further includes: an adaptation module;

[0035] The adaptation module is used to initialize the configuration of the shadow terminal according to the type and parameters of the terminal corresponding to the target server.

[0036] In a third aspect, a storage medium is provided in this embodiment, on which a computer program is stored. When the program is executed by a processor, the character command processing method based on the bastion host described in the first aspect above is implemented.

[0037] Compared with the related art, the character command processing method based on the bastion host, the bastion host and the storage medium provided in this embodiment, after establishing SSH channels between the bastion host and the target client and target server respectively, uses the SSH protocol parsing engine in the bastion host to parse the character data transmitted in the SSH channel to obtain the original character stream input by the target client; uses the shadow terminal in the bastion host to synchronize the context of the target server, and simulates the execution of the target server based on the original character stream to generate a simulated echo, and determines the corresponding target command; uses the dual-channel checker in the bastion host to compare the original character stream and the simulated echo to obtain a comparison result; uses the decision maker in the bastion host to determine a release decision or an interception decision based on the comparison result; the release decision is used to release the target command to the target server; the interception decision is used to intercept the target command to the target server, which solves the problems of low recognition accuracy and false positives and missed positives in the related art. The collaboration of the SSH protocol parsing engine and the shadow terminal makes command extraction independent of the context, completely eliminates the misjudgment and missed judgment caused by data packet disorder, loss, and crossover caused by TTY echo technology, and combines the dual-channel double verification to ensure the integrity of target command recognition and improve recognition accuracy.

[0038] The details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0040] Figure 1 This is a hardware structure diagram of the bastion host provided in one embodiment of the present application;

[0041] Figure 2 This is a flowchart of a character command processing method based on a bastion host provided in one embodiment of the present application;

[0042] Figure 3 This is a flowchart of the shadow terminal initialization provided by an embodiment of the present application;

[0043] Figure 4 This is a flowchart of the rule engine verification provided by an embodiment of the present application;

[0044] Figure 5 This is a timing diagram of scenario 1 provided by an embodiment of the present application;

[0045] Figure 6 This is a mode state diagram of scenario 2 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] In order to more clearly understand the purpose, technical solutions and advantages of the present application, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0047] Unless otherwise defined, technical or scientific terms used in this application shall have the ordinary meanings as understood by persons of ordinary skill in the art to which this application belongs. The terms "a," "an," "the," "these," and similar expressions in this application do not denote limitations on quantity and may be singular or plural. The terms "comprise," "include," "have," and any variations thereof, as used in this application, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or device comprising a series of steps or modules (units) is not limited to the listed steps or modules (units) but may include unlisted steps or modules (units) or other steps or modules (units) inherent to the process, method, product, or device. The terms "connected," "connected," "coupled," and similar expressions used in this application are not limited to physical or mechanical connections but may include electrical connections, whether direct or indirect. As used in this application, "plurality" means two or more. "And / or" describes an association between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can mean: A exists alone; A and B exist simultaneously; or B exists alone. Generally, the character " / " indicates that the objects in the preceding and following relationship are in an "or" relationship. The terms "first", "second", "third", etc. involved in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0048] The method embodiment provided in this embodiment can be executed in a bastion host. Figure 1 This is a hardware structure diagram of the bastion host based on the character command processing method of the bastion host in this embodiment. Figure 1As shown, the bastion host may include an SSH server, an SSH client, an SSH protocol parsing engine, a shadow terminal, a dual-channel checker, and a decision maker; the SSH server is connected to the SSH client, the target client, and the SSH protocol parsing engine, respectively, to establish an SSH channel with the target client; the SSH client is connected to the shadow terminal and the target server, respectively, to establish an SSH channel with the target server; the SSH protocol parsing engine is used to parse the character data transmitted in the SSH channel to obtain the original character stream input by the target client; the shadow terminal is used to synchronize the context of the target server, and simulate the execution of the target server based on the original character stream to generate a simulated echo, and determine the corresponding target command; the dual-channel checker is used to compare the original character stream and the simulated echo to obtain a comparison result; the decision maker is used to determine a release decision or an interception decision based on the comparison result; the release decision is used to release the target command to the target server; the interception decision is used to intercept the target command to the target server. It can be understood by ordinary technicians in this field that Figure 1 The structure shown is for illustration only and does not limit the structure of the bastion host. Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown.

[0049] Through the above-mentioned bastion host, the problems of low recognition accuracy, false positives and missed positives in related technologies are solved. The collaboration of the SSH protocol parsing engine and the shadow terminal makes command extraction independent of the context, and completely eliminates the misjudgment and missed judgment caused by data packet disorder, loss, and crossover brought by TTY echo technology. Combined with dual-channel double verification, the integrity of target command recognition is ensured, and the recognition accuracy is improved.

[0050] The SSH server and SSH client are the core components of the bastion host. They assist in establishing two SSH channels using the SSH protocol, which involves two processes. The first process involves the target client (XTerminal / Putty) initiating an SSH connection request to the bastion host's SSH server, completing key exchange and user authentication, generating a session ID, and allocating resources. The second process involves the bastion host's SSH server forwarding the target client's SSH destination information to the SSH client. The SSH client uses pre-configured keys or credentials to establish an SSH channel with the target server (Linux / AIX / FW) and verify the target server's identity. Specifically, the SSH protocol divides the communication process into multiple layers: the Transport Layer, which is responsible for encryption, authentication, and integrity protection; the User Authentication Layer, which verifies user identity; and the Connection Layer, which manages multiple logical channels for different sessions (such as shell, SFTP, and port forwarding).

[0051] After completing the authentication, the SSH client sends and stty -a to the target server. The server parses the data returned by the command, extracts the target environment parameters such as the TERM type (for example, TERM=vt220, rows=24, cols=80), and initializes the shadow terminal (virtual PTY device). After initializing the shadow terminal, it loads the control character mapping table and loads predefined configurations based on the TERM type. For example, the AIX backspace character \x08 is mapped to a delete operation.

[0052] The SSH protocol parsing engine parses connection-layer messages (character data) to extract the original character stream entered by the target client user. This raw character stream includes control characters such as the backspace key. For example, the user's raw character stream (original command) contains control characters, such as "rm file\x08\x08new.txt." The SSH protocol parsing engine processes the raw character stream, parses the SSH_MSG_CHANNEL_DATA message, skips the protocol header, and extracts the plaintext character stream. This resolves misjudgments and missed detections caused by out-of-order, loss, and crossover due to interference such as network latency.

[0053] After initialization, the shadow terminal dynamically simulates the target server's terminal environment (e.g., Linux / AIX PTY configuration) and behavior, synchronizing context such as the working directory and environment variables in real time. This enables contextual awareness and can handle sensitive operations such as the relative path after changing directories using the `cd` command. The data flow is as follows: client input commands, the SSH protocol parsing engine, command execution in the shadow terminal, and updating the CWD / environment variables. The original input stream is first sent to the shadow terminal for simulated execution, generating simulated echo (e.g., AIX backspace behavior). The target server's terminal state is then captured and synchronized in real time (window size changes are captured via the `SSH_MSG_CHANNEL_REQUEST` message).

[0054] The dual-channel checker receives the comparison results of the SSH protocol parsing engine and the simulated echo of the shadow terminal simulation, compares them, and accurately extracts the user's target command, sending it to the rule engine in the decision maker for verification. In other words, double verification is used to ensure command integrity and support accurate command extraction in complex terminal links. The rule engine then matches the preset rules in the policy library to determine whether it matches the target rule. If the original character stream and / or simulated echo match the target rule in the policy library, it is an interception decision, and the interceptor in the decision maker intercepts the target command. If neither the original character stream nor the simulated echo match the target rule in the policy library, it is a release decision, and the interceptor in the decision maker releases the target command.

[0055] In some of the embodiments, an independent shadow terminal may be provided for each SSH session to achieve full terminal emulation.

[0056] In some embodiments, the data format for interaction between the SSH protocol parsing engine and the shadow terminal, and the data format for interaction between the shadow terminal and the dual-channel checker are both in JSON format.

[0057] The data formats of the SSH protocol parsing engine and the shadow terminal are as follows:

[0058] json

[0059] {

[0060] "session_id":"sess_01", / / session unique identifier

[0061] "raw_input":"rmfile\x08",

[0062] "target_TERM":"aixterm",

[0063] "window_size":{"rows":24,"cols":80}

[0064] }.

[0065] The interaction logic is as follows: the SSH protocol parsing engine pushes the original character stream to the shadow terminal; the shadow terminal returns the simulated echo and the updated context (such as CWD).

[0066] The data formats of the shadow terminal and rule engine are as follows:

[0067] json

[0068] {

[0069] "original_cmd":"rmfile\x08",

[0070] "parsed_cmd":"rmfil",

[0071] "risk_level":"high",

[0072] "action":"block"

[0073] }.

[0074] The interaction logic is as follows: the shadow terminal pushes the simulated echo to the rule engine.

[0075] In some embodiments, the bastion host further includes: an adaptation module; the adaptation module is used to initialize the configuration of the shadow terminal according to the type and parameters of the terminal corresponding to the target server.

[0076] It should be noted that the above modules can be functional modules or program modules, and can be implemented through software or hardware. For modules implemented through hardware, the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0077] Based on the above bastion host, this embodiment provides a character command processing method based on the bastion host. Figure 2 This is a flowchart of the character command processing method based on the bastion host of this embodiment. Figure 2 As shown, the process includes the following steps:

[0078] Step S210: After establishing SSH channels between the bastion host and the target client and target server, the SSH protocol parsing engine in the bastion host is used to parse the character data transmitted in the SSH channel to obtain the original character stream input by the target client.

[0079] Step S220: Utilize the shadow terminal in the bastion host to synchronize the context of the target server, simulate the execution of the target server based on the original character stream to generate a simulated echo, and determine the corresponding target command;

[0080] Step S230: Using the dual-channel checker in the bastion host, compare the original character stream and the simulated echo to obtain a comparison result.

[0081] In step S240, the decision maker in the bastion host is used to determine a release decision or an interception decision based on the comparison result; the release decision is used to release the target command to the target server; the interception decision is used to intercept the target command to the target server.

[0082] For details, please refer to the specific structure of the bastion host. Figure 1 The description of the embodiments thereof will not be repeated here.

[0083] The character data is transmitted in the SSH channel using the SSH protocol. It is related to the original command entered by the user in the target client and contains control characters. The SSH protocol parsing engine parses the character data transmitted in the SSH channel, skipping the protocol header and extracting the plaintext character stream to obtain the original character stream entered by the target client. This resolves misjudgments and missed detections caused by out-of-order, loss, and crossover caused by interference such as network latency. For example, the "SSH_MSG_CHANNEL_DATA" message is parsed to extract the original input (including control characters such as `Backspace` and `Ctrl+C`). For example, if the user enters "rmfile.txt\x08\x08new.txt", which includes two backspace (x08) control characters, the SSH protocol parsing engine directly extracts the original character stream "rm file.txt\x08\x08new.txt".

[0084] The shadow terminal can dynamically simulate the target server's terminal environment (such as the Linux / AIX PTY configuration) and behavior, synchronizing the target server's context. After writing the original character stream output by the SSH protocol parsing engine, it simulates the target server's execution, generates a simulated echo, and determines the corresponding target command. For example, if the original character stream represents input A, input B, carriage return to undo B, and input C, then the simulated echo is AC. This simulated echo can be considered the target command obtained by modifying the original command entered by the user. This achieves context awareness and can handle sensitive operations such as the relative path command after changing the directory after `cd`. The shadow terminal only simulates execution, extracts valid commands, and ignores control characters, achieving the purpose of a lightweight state machine.

[0085] In the dual-channel checker, regular expressions, syntax trees, context awareness, and machine learning models can be used to compare the original character stream and the simulated echo to obtain comparison results. Different methods are selected in different application scenarios to expand the application scenarios while reducing missed reports and false positives. When different comparison methods are selected, the corresponding similarity threshold can be set. When the similarity of the comparison meets the similarity threshold, the comparison is considered successful, otherwise the comparison fails. Generally, the similarity threshold of the regular expression is higher than the similarity threshold of the machine learning model. For example: the similarity threshold of the regular expression is 99%; the similarity threshold of the machine learning model is 80%. The comparison method and the corresponding similarity threshold can be set according to the usage scenario and there are no restrictions on this.

[0086] Finally, the decision maker makes the final decision. After successful comparison, the two data sources (original character stream and simulated echo) can be independently analyzed based on the policy library to complete double verification and determine the release decision or interception decision. The release decision is used to release the target command to the target server; the interception decision is used to intercept the target command to the target server. Among them, the policy library is pre-set with various high-risk target rules (for example: high-risk rule: Matches a force save action).

[0087] Related technologies employ a TTY echo parsing solution to achieve this. The user's SSH character stream echo is cached and recognized by the character command recognition module, which then matches regular expressions to determine whether to intercept or allow it. However, TTY echo parsing has inherent flaws: it relies on the integrity and timing of TTY echoes, making it susceptible to interference from network latency, terminal control characters (such as ANSI escape codes), and multi-line commands (such as Vim editing). Terminal compatibility and server-supported PTYs are poor, leading to inconsistent parsing of PTY control characters (such as \x1b[2J to clear the screen) between different clients (such as Xterm and PuTTY) and matching servers. Network latency can affect the parsing logic when echo packets arrive out of order, potentially misjudging command boundaries. Dynamic environment interference means that in full-screen editors like Vim and Tmux, as well as line-level command editors like head and tail, echo data, control characters, and command character data can be intertwined, making it difficult to extract valid commands and leading to command matching errors. Consequently, this solution suffers from low recognition accuracy and the risk of both false positives and false negatives.

[0088] The present application, through the above steps, establishes SSH channels between the bastion host and the target client and target server respectively, and then uses the SSH protocol parsing engine in the bastion host to parse the character data transmitted in the SSH channel to obtain the original character stream input by the target client; uses the shadow terminal in the bastion host to synchronize the context of the target server, and simulates the execution of the target server based on the original character stream to generate a simulated echo, and determines the corresponding target command; uses the dual-channel checker in the bastion host to compare the original character stream and the simulated echo to obtain a comparison result; uses the decision maker in the bastion host to determine a release decision or an interception decision based on the comparison result; the release decision is used to release the target command to the target server; the interception decision is used to intercept the target command to the target server, which solves the problems in the related technology that lead to low recognition accuracy and the existence of false positives and missed negatives, and adopts the collaboration of the SSH protocol parsing engine and the shadow terminal to achieve accurate extraction of the protocol layer and dynamic perception of the context, so that command extraction is independent of the context, and completely eliminates the misjudgment and missed judgment caused by data packet disorder, loss, and crossover brought by TTY echo technology, and then combines the dual verification of the dual channel to ensure the integrity of target command recognition and improve recognition accuracy.

[0089] The following is a detailed description of each of the above steps:

[0090] In some of these embodiments, Figure 3 The figure shows a flowchart for initializing the shadow terminal. The character command processing method based on the bastion host also includes the following steps:

[0091] Step S310 , before synchronizing the context of the target server, initialize the configuration of the shadow terminal according to the type and parameters of the terminal corresponding to the target server.

[0092] Specifically, in order to enable the shadow terminal to dynamically adapt to various heterogeneous environments and support unknown terminals and new terminal protocols without code modification, it is necessary to initialize the shadow terminal before it runs. The specific process is: the SSH client sends and stty -a to the target server. The SSH client parses the data returned by the command, extracts the TERM type (for example, TERM=vt220, rows=24, cols=80), and initializes the shadow terminal (virtual PTY device). After initializing the shadow terminal, it loads the control character mapping table and loads predefined configurations based on the TERM type. For example, the AIX backspace character \x08 is mapped to a delete operation.

[0093] Through this embodiment, various heterogeneous environments can be dynamically adapted, and unknown terminals and new terminal protocols can be supported without code modification.

[0094] For shadow terminals, you can set a configuration template, which includes the terminal type and configuration parameters of the target server, including the number of rows, columns, control character mapping, etc. Use a configuration file method and dynamic loading to achieve dynamic conversion of compatibility with new TTY types and control characters without code changes. The configuration file can be in JSON format. For example:

[0095] #Load configuration according to TERM type

[0096] configs={

[0097] "xterm":{"rows":24,"cols":80,"backspace":"\x7F"},

[0098] "vt220":{"rows":24,"cols:80","backspace":"\x08"},

[0099] "cisco-cli":{"rows":24,"cols":80,"enter":"\r\n"}

[0100] }.

[0101] This embodiment provides default configuration and dynamic adaptation, with the default setting acting as a fallback strategy. For example, if the TERM value cannot be obtained (e.g., on some firewall devices), a generic terminal configuration (e.g., TERM=linux) is used. Control characters are dynamically detected (e.g., by tentatively entering the backspace key and observing the target server's response).

[0102] In some embodiments, comparing the original character stream and the simulated echo to obtain a comparison result in step S230 includes the following steps:

[0103] Compare the original character stream and the simulated echo;

[0104] If the original character stream and the simulated echo are inconsistent, the comparison result is comparison failure;

[0105] If the original character stream and the simulated echo are consistent, the comparison result is successful.

[0106] In this embodiment, a regular expression can be used to compare the original character stream and the simulated echo. For example, if the original character stream represents input A, input B, carriage return to cancel B, and input C, then the simulated echo is AC. When the original character stream and the simulated echo are compared using a regular expression, if all simulated echoes fall into the original character stream, the similarity is 100%. If the similarity threshold is greater than 99%, the original character stream and the simulated echo are considered to be consistent, and the comparison result is a successful comparison. Otherwise, the original character stream and the simulated echo are considered to be inconsistent, and the comparison result is a failed comparison.

[0107] This embodiment utilizes a dual data source comparison mechanism to avoid misjudgment caused by control character interference or context loss in a single data source (such as traditional TTY echo), thereby improving accuracy.

[0108] In some of these embodiments, Figure 4 FIG. 2 is a flowchart of the rule engine verification process; that is, the process of determining a release decision or an interception decision based on the comparison result in step S240 includes the following steps:

[0109] Step S241: When the comparison result is successful, the original character stream and the simulated echo are matched with the preset strategy library respectively;

[0110] Step S242: If the original character stream and / or simulated echo matches the target rule in the policy library, an interception decision is made;

[0111] Step S243: If neither the original character stream nor the simulated echo matches the target rule in the policy library, a release decision is made.

[0112] Specifically, various target rules are stored in the pre-set policy library; target rules refer to dangerous commands. Usually, the bastion host or other systems will have built-in default preset target rules. Users can customize target rules according to the actual production environment and security compliance requirements. In this embodiment, the interception decision is made after the comparison results of the dual channels are matched with the target rules to achieve double verification. If at least one of the original character stream and the simulated echo matches the target rule in the policy library, it is an interception decision; if neither the original character stream nor the simulated echo matches the target rule in the policy library, it is a release decision.

[0113] Through this embodiment, the user input intention (original character stream) and the actual execution effect (simulated echo) are detected simultaneously, thereby increasing coverage.

[0114] The above embodiment combines a dual data source verification mechanism, using both the original character stream and the simulated echo of a shadow terminal, to accurately identify dangerous commands within SSH sessions. This avoids misjudgments caused by control character interference or context loss in a single data source (such as traditional TTY echo), improving accuracy. It simultaneously detects both the user's input intent (the original stream) and the actual execution effect (the simulated echo), increasing coverage. The rules engine independently analyzes both data sources, matching and defining target rules separately, thereby reducing missed and false positives.

[0115] In some embodiments, the character command processing method based on the bastion host further includes the following steps:

[0116] When the decision to release is made, the SSH server in the bastion host is used to forward the target command to the target server, and transmit the target echo returned by the target server to the target client;

[0117] When an interception decision is determined, the decision maker is used to intercept commands in the target command that match the target rule and return a simulated echo to the target client.

[0118] Specifically, different scenarios will be generated based on different decisions. For example, a release decision corresponds to a release scenario, while an intercept decision corresponds to an intercept scenario.

[0119] In the release scenario, if the policy library does not match the target rule and considers the target command not dangerous, the target command "rm new.txt" from the shadow terminal is forwarded to the target server through the SSH server as a corrected command. The target command is executed on the target server and the target output is returned.

[0120] In an interception scenario, if the policy library matches a target rule and identifies the target command as containing a dangerous command, interception is triggered and a simulated echo (for example, "Command blocked: rm new.txt") is returned to the target client. Commands within the target command that do not trigger interception are released. The target server does not receive the intercepted command. After interception is triggered, auditing can be performed in the audit module of the bastion host.

[0121] Example:

[0122] Input raw character stream: `echo "test"> / tmp / log.txt&&rm / tmp / log.txt`.

[0123] Comparison and verification process: (1) The SSH protocol parsing engine extracts the original command (including the `&&` connector). (2) After the shadow terminal simulates execution, it is found that `rm / tmp / log.txt` triggers the target rule. (3) The rule engine intercepts the command and only allows `echo "test"> / tmp / log.txt` to run.

[0124] Through this embodiment, dangerous commands can be effectively intercepted, thereby improving the use security of the target server.

[0125] In some embodiments, the character command processing method based on the bastion host further includes the following steps:

[0126] Get the SIGWINCH signal of the target client and synchronize the virtual terminal window size of the shadow terminal based on the SIGWINCH signal.

[0127] Specifically, the target client's SIGWINCH (window change) signal is a Unix / Linux signal that notifies a process that its terminal window size (number of rows and columns) has changed. The SIGWINCH signal allows for dynamic adjustment of display content, thus achieving window synchronization.

[0128] The following examples illustrate the implementation of the above method embodiments in different scenarios.

[0129] The above method embodiment can completely resolve SSH command recognition scenarios for pre-configured character device configurations. It can also be used to identify and intercept target rules (dangerous commands) for unusual character devices or full-screen editors. The following two examples illustrate how to identify SSH commands in a mainframe system (System A) and how to identify the high-risk file write (:wq) command during vi (vim) editing.

[0130] Scenario 1: Reference Figure 5 , which is a precise interception of the backspace key command in a certain system A.

[0131] User input:

[0132] "bash

[0133] #Enter a command containing a backspace character (the backspace character on an AIX terminal is \x08)

[0134] ”.

[0135] The processing flow is as follows: 1. The SSH protocol parsing engine extracts the original character stream: "rm / var / log / old.log\x08\x08\x082023.log"; 2. The shadow terminal detects the target as system A, obtains and loads the AIX PTY configuration, and initializes the shadow terminal instance. It converts the `\x08` string into a "delete the previous character" operation. After simulated execution, the final target command is generated: "rm / var / log / 2023.log." 3. The rule engine matches the "rm / var / log / ×.log" rule, triggering interception.

[0136] Scenario 2: Reference Figure 6 , which identifies high-risk file commands in vi full-screen editing mode.

[0137] User behavior: 1. A user connects to the target server through the bastion host and uses vi to edit a read-only configuration file (such as / etc / network / interfaces). 2. The user enters :wq! to attempt to force a save and exit, which may corrupt the system configuration. 3. The bastion host must recognize :wq! in vi command mode and block this high-risk operation.

[0138] The processing flow is as follows: 1. SSH protocol parsing engine: extracts the original character stream: vi / etc / network / interfaces\n, and forwards it to the target server. 2. Target server: starts the vi process, enters full-screen editing mode, and returns terminal control characters (such as clearing the screen and positioning the cursor). 3. User operation sequence, Vim operation and command input:

[0139] "i#Enter insert mode

[0140] (Modify file content)

[0141] <esc>#Exit insert mode (\x1b control character)

[0142] :wq! <enter>.#Force to hold and exit (high-risk instruction)".

[0143] 4. Extract the original character stream: i...<text content>...\x1b:wq!\r;

[0144] 5. Shadow terminal status tracking and command extraction:

[0145] 5.1, State Machine Tracking:

[0146] Initial mode: vi normal mode (triggered by the target server echoing control characters).

[0147] User input i: Switch to insert mode and ignore subsequent text input (only record the status).

[0148] User input\x1b: Switch back to normal mode and start obtaining command input.

[0149] User input: wq!\r: Extract the complete target command: wq!.

[0150] 5.2. Shadow terminal output: Generates the expected target command: wq!, marked as "Force save and exit".

[0151] 6. Rule engine interception decision:

[0152] 6.1. Rule matching: Predefined target rules: (Matches a force save action).

[0153] 6.2. Interception decision: The rule engine detects :wq! and triggers the rule, blocking command forwarding.

[0154] 6.3. Target client feedback: A simulated echo message is returned to the client: Command blocked: ":wq!" is not allowed for read-only files.

[0155] 7. The target server did not execute the command: The target server did not receive the :wq! command, the file was not modified, and the Vim process remained in an unsaved state.

[0156] Control characters are processed as:

[0157] 1. Esc character (\x1b): triggers mode switching and starts command acquisition in the shadow terminal.

[0158] 2. Carriage return (\r): marks the end of the command and submits it to the rule engine.

[0159] This implementation accurately extracts vi commands, distinguishing between insert mode and command mode to avoid misjudging text content. High-risk operations are intercepted in real time, blocking commands before they are sent to the target server. It is compatible with complex interactive scenarios, supporting security management and control of full-screen editors and multi-mode terminal applications. It can be extended to other interactive tools (such as Tmux, Nano, and Python), providing a universal solution for SSH session auditing.

[0160] It should be noted that the steps shown in the above process or the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0161] In addition, in conjunction with the bastion host-based character command processing method provided in the above embodiments, this embodiment may also provide a storage medium for implementation. The storage medium stores a computer program; when executed by a processor, the computer program implements any of the bastion host-based character command processing methods in the above embodiments.

[0162] It should be noted that the information and data involved in this application are all authorized by the user or fully authorized by all parties and will be used legally.

[0163] It should be understood that the specific embodiments described herein are only used to explain this application and are not used to limit it. Based on the embodiments provided in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0164] Obviously, the accompanying drawings are merely examples or embodiments of the present application. A person skilled in the art can also apply the present application to other similar situations based on these drawings without inventive effort. Furthermore, it is understandable that, although the work involved in this development process may be complex and lengthy, certain design, manufacturing, or production changes based on the technical content disclosed in this application are merely routine technical means for a person skilled in the art and should not be considered to constitute a deficiency in the disclosure of the present application.

[0165] The term "embodiment" as used herein refers to specific features, structures, or characteristics described in connection with the embodiment that may be included in at least one embodiment of the present invention. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it imply that the embodiments are mutually exclusive, independent, or optional. It is understood, either explicitly or implicitly, that the embodiments described herein may be combined with other embodiments unless there is a conflict.

[0166] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of patent protection. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.< / enter> < / esc>

Claims

1. A character command processing method based on a bastion host, characterized in that: Applied to the bastion host; the method includes: After establishing SSH channels between the bastion host and the target client and the target server respectively, using the SSH protocol parsing engine in the bastion host to parse the character data transmitted in the SSH channel to obtain the original character stream input by the target client; Utilize the shadow terminal in the bastion host to synchronize the context of the target server, simulate the execution of the target server based on the original character stream to generate a simulated echo, and determine the corresponding target command; Using a dual-channel checker in the bastion host, the original character stream and the simulated echo are compared to obtain a comparison result; Utilize the decision maker in the bastion host to determine a release decision or an interception decision based on the comparison result; the release decision is used to release the target command to the target server; the interception decision is used to intercept the target command to the target server.

2. The character command processing method based on the bastion host according to claim 1 is characterized in that: The method further comprises: Before synchronizing the context of the target server, the configuration of the shadow terminal is initialized according to the type and parameters of the terminal corresponding to the target server.

3. The character command processing method based on the bastion host according to claim 1 is characterized in that: Comparing the original character stream and the simulated echo to obtain a comparison result includes: Comparing the original character stream and the simulated echo; If the original character stream and the simulated echo are inconsistent, the comparison result is comparison failure; If the original character stream and the simulated echo are consistent, the comparison result is a successful comparison.

4. The character command processing method based on the bastion host according to claim 3 is characterized in that: Based on the comparison results, a release decision or an interception decision is determined, including: When the comparison result is successful, matching the original character stream and the simulated echo with a preset strategy library respectively; If the original character stream and / or the simulated echo matches the target rule in the policy library, an interception decision is made; If neither the original character stream nor the simulated echo matches the target rule in the policy library, a release decision is made.

5. The character command processing method based on the bastion host according to claim 1 is characterized in that: The method further comprises: When the release decision is determined, the SSH server in the bastion host is used to forward the released target command to the target server, and the target echo returned by the target server is transmitted to the target client; When the interception decision is determined, the decision maker is used to intercept commands in the target command that match the target rule, and return a simulated echo to the target client.

6. The character command processing method based on the bastion host according to claim 1 is characterized in that: The method further comprises: A SIGWINCH signal of the target client is obtained, and a virtual terminal window size of the shadow terminal is synchronized based on the SIGWINCH signal.

7. A bastion host, characterized in that: Includes SSH server, SSH client, SSH protocol parsing engine, shadow terminal, dual-channel checker and decision maker; The SSH server is connected to the SSH client, the target client and the SSH protocol parsing engine respectively, and is used to establish an SSH channel with the target client; The SSH client is connected to the shadow terminal and the target server respectively, and is used to establish an SSH channel with the target server; The SSH protocol parsing engine is used to parse the character data transmitted in the SSH channel to obtain the original character stream input by the target client; The shadow terminal is used to synchronize the context of the target server, simulate the execution of the target server based on the original character stream to generate a simulated echo, and determine the corresponding target command; The dual-channel checker is used to compare the original character stream and the simulated echo to obtain a comparison result; The decision maker is configured to determine a release decision or an interception decision based on the comparison result; The release decision is used to release the target command to the target server; The interception decision is used to intercept the target command to the target server.

8. The bastion host according to claim 7, characterized in that: The data format for interaction between the SSH protocol parsing engine and the shadow terminal, and the data format for interaction between the shadow terminal and the dual-channel checker are both in JSON format.

9. The bastion host according to claim 7, characterized in that: The bastion host also includes: an adaptation module; The adaptation module is used to initialize the configuration of the shadow terminal according to the type and parameters of the terminal corresponding to the target server.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the character command processing method based on the bastion host according to any one of claims 1 to 6 are implemented.

Images