Bastion host system applied to remote operation and maintenance of supplier and remote operation and maintenance method

Abstract

The invention relates to a bastion host system applied to remote operation and maintenance of a supplier and a remote operation and maintenance method, and the bastion host system comprises a portal arranged in an isolation area, and an extension assembly and a bastion host which are arranged in the same server. The portal comprises a first service module and a first encryption channel module; the first service module is connected with the first encryption channel module and is used for providing static resources and processing service data; the first encryption channel module is connected with the expansion component and is used for building an encryption channel with the fortress under the cooperation of the expansion component; according to the encrypted channel and the web access request, the supplier is allowed to remotely access the bastion host; the problems of high security management and control cost and low maintenance efficiency caused by security risks in related technologies are solved; only static resources are provided on the portal, and the interactive data can only be acquired through an encryption channel, so that the data security is improved, and data leakage is prevented.

Description

Technical Field

[0001] The present application relates to the field of bastion host technology, and in particular to a bastion host system and a remote operation and maintenance method for supplier remote operation and maintenance. Background Art

[0002] In data centers, users use bastion hosts to manage, control, and audit internal user access to devices. However, third-party vendors also have a practical need to remotely operate and maintain assets within customer data centers. Due to security concerns, users face numerous challenges in managing vendor operations and maintenance, and cannot easily access bastion host services via the internet.

[0003] Current remote O&M solutions for suppliers typically use a VPN model. Through VPN, secure access policies are configured, and customers apply for VPN certificates and account passwords for suppliers. Suppliers dial into the customer's intranet via VPN and then use a local browser to access the bastion host web page to perform intranet asset O&M. Due to inherent VPN security risks (such as exposed ports and credential sharing), security management costs are high and maintenance efficiency is low.

[0004] There is currently no effective solution to the security risks in related technologies, which lead to high security management costs and low maintenance efficiency. Summary of the Invention

[0005] In this embodiment, a bastion host system and a remote operation and maintenance method for supplier remote operation and maintenance are provided to address the security risks in related technologies, resulting in high security management and control costs and low maintenance efficiency.

[0006] First, in this embodiment, a bastion host system for supplier remote operation and maintenance is provided, comprising: a portal provided in an isolation zone, and an extension component and a bastion host provided in the same server;

[0007] The portal includes a first service module and a first encryption channel module;

[0008] The first service module is connected to the first encryption channel module and is used to provide static resources and process business data; the static resources are to present web pages to suppliers; the business data processing is to receive and forward web access requests initiated by the suppliers to the encryption channel module;

[0009] The first encryption channel module is connected to the extension component and is used to build an encryption channel with the bastion host in cooperation with the extension component; according to the encryption channel and the web access request, the supplier can remotely access the bastion host.

[0010] In some embodiments, the bastion host interacts with the portal for data through the extension component and the encrypted channel, and isolates the portal from directly accessing the port of the bastion host through the isolation policy built into the bastion host.

[0011] In some of the embodiments, after configuring the portal port and portal address of the portal, the bastion host regenerates the trust certificate of the portal installation package and provides a download link for the portal installation package;

[0012] The download link is used to provide downloading of the portal installation package to complete the deployment of the portal.

[0013] In some embodiments, the bastion host completes the construction of the encrypted channel through the portal address and the trust certificate; the encrypted channel has two-way security trust.

[0014] In some of these embodiments, the portal further comprises an agent module;

[0015] The proxy module is connected to the first service module and is used to act as an agent for the web access request of the public network and filter the web access request.

[0016] In some of these embodiments, the extension component includes a second encryption channel module and a second service module;

[0017] The second encryption channel module is connected to the second service module and the first encryption channel module respectively, and is used to actively initiate the construction of the reverse encryption channel and forward the relevant data of the first encryption channel module in the portal to the second service module;

[0018] The second service module is connected to the bastion host and is used to provide external data services.

[0019] In some of these embodiments, the second service module includes a business data service submodule and an access data service submodule;

[0020] The business data service submodule is connected to the second encryption channel module and the bastion host, respectively, and is used to process the authentication request and permission request sent by the portal; specifically: the authentication request and the permission request in the whitelist are encapsulated into a business request; based on the authentication module and permission module of the called bastion host, the authentication result and permission information of the business processing are returned to the portal through the encrypted channel;

[0021] The access data service submodule is connected to the second encrypted channel module and the bastion host, respectively, and is used to process the remote operation and maintenance image request sent by the portal; specifically: based on the access module of the called bastion host, verify whether the corresponding user meets the operation and maintenance permissions; when the user meets the operation and maintenance permissions, establish an operation and maintenance connection with the target asset and forward the remote operation and maintenance image request; return the HTTP traffic of the target asset to the portal through the encrypted channel.

[0022] In some embodiments, the access module of the bastion host supports horizontal expansion deployment.

[0023] Secondly, in this embodiment, a remote operation and maintenance method for a bastion host system is provided, which is applicable to the bastion host system used for remote operation and maintenance of suppliers. The method includes:

[0024] Determine an authentication result based on an authentication request initiated by a user on a portal; and construct an asset access list for the user based on the authentication result;

[0025] Initiating a web access request to a remote target asset based on the asset access list, and transmitting the web access request through an encrypted channel;

[0026] According to the encrypted channel and the web access request, the supplier is allowed to remotely access the bastion host; the encrypted channel is constructed with the bastion host in collaboration with the extension component.

[0027] In some embodiments, the method further comprises:

[0028] After the user submits the registration application via the invitation email, the administrator of the bastion host will review the registration application and return the review result via the invitation email. The link in the invitation email is a dynamically generated link with a validity period.

[0029] Compared with the related art, the bastion host system and remote operation and maintenance method for supplier remote operation and maintenance provided in this embodiment; wherein, the bastion host system includes a portal set in an isolation area, and an extension component and a bastion host set in the same server; the portal includes a first service module and a first encryption channel module; the first service module is connected to the first encryption channel module, and is used to provide static resources and process business data; the static resource is to present a web page to the supplier; the business data is processed to receive and forward the web access request initiated by the supplier to the encryption channel module; the first encryption channel module is connected to the extension component, and is used to build an encrypted channel with the bastion host in collaboration with the extension component; according to the encrypted channel and the web access request, the supplier is allowed to remotely access the bastion host; solves the security risks in the related art, resulting in high security management costs and low maintenance efficiency; the portal of this application only provides static resources, and the interactive data can only be obtained through the encrypted channel, thereby improving data security and preventing data leakage.

[0030] The details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0032] Figure 1 This is a structural block diagram of a bastion host system for supplier remote operation and maintenance provided by an embodiment of the present application;

[0033] Figure 2 This is a structural block diagram of a bastion host system for supplier remote operation and maintenance, provided by another embodiment of the present application;

[0034] Figure 3 This is a structural block diagram of a second encryption channel module provided in one embodiment of the present application;

[0035] Figure 4 This is a flow chart of a remote operation and maintenance method for a bastion host system provided by an embodiment of the present application;

[0036] Figure 5 This is a flowchart of a remote operation and maintenance method for a bastion host system provided in one embodiment of the present application.

[0037] In the figure: 10, portal; 11, first service module; 12, first encryption channel module; 20, extension component; 30, bastion host. DETAILED DESCRIPTION

[0038] In order to more clearly understand the purpose, technical solutions and advantages of the present application, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0039] Unless otherwise defined, the technical terms or scientific terms involved in this application should have the general meaning understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "an", "a", "the", "these" and the like in this application do not indicate quantitative restrictions, and they can be singular or plural. The terms "include", "comprise", "have" and any variants thereof involved in this application are intended to cover non-exclusive inclusions; for example, a process, method and system, product or device comprising a series of steps or modules (units) is not limited to the listed steps or modules (units), but may include unlisted steps or modules (units), or may include other steps or modules (units) inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "plurality" involved in this application refers to two or more. "And / or" describes the relationship between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, and B exists alone. Generally, the character " / " indicates that the related objects are in an "or" relationship. The terms "first," "second," "third," etc. used in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0040] In this embodiment, a bastion host system for supplier remote operation and maintenance is provided. Figure 1 This is a structural block diagram of the bastion host system used for supplier remote operation and maintenance in this embodiment. Figure 1 As shown, the bastion host system includes: a portal 10 set in an isolation zone, and an extension component 20 and a bastion host 30 set in the same server;

[0041] The portal 10 includes a first service module 11 and a first encryption channel module 12;

[0042] The first service module 11 is connected to the first encryption channel module 12 and is used to provide static resources and process business data; static resources are used to present web pages to suppliers; business data processing is used to receive and forward web access requests initiated by suppliers to the encryption channel module;

[0043] The first encrypted channel module 12 is connected to the extension component 20 and is used to build an encrypted channel with the bastion host 30 in cooperation with the extension component 20; based on the encrypted channel and web access request, the supplier can remotely access the bastion host 30.

[0044] Specifically, a demilitarized zone (DMZ) is an intermediate, publicly accessible area located between the intranet (trusted zone) and the extranet (untrusted zone). Its primary purpose is to prevent external users from directly accessing the intranet while providing online services to the outside world, thereby ensuring the security of the internal network environment. A demilitarized zone can be an independent client, which can be a mobile, fixed, or portable terminal, such as a mobile phone, station, unit, device, multimedia computer, multimedia tablet, internet node, communicator, desktop computer, laptop computer, notebook computer, netbook computer, tablet computer, personal communication system (PCS) device, personal navigation device, personal digital assistant (PDA), audio / video player, digital camera / camcorder, positioning device, television receiver, radio receiver, e-book device, gaming device, or any combination thereof, including accessories and peripherals for these devices, or any combination thereof. Vendors are external companies or individuals that provide various resources required by an enterprise, including equipment, raw materials, and labor. A server is a high-performance computer that provides various services and resources to other computers in a network environment. The portal 10 is set in the isolation area, and the extension component 20 and the bastion host 30 are set in the same server, so that the supplier can remotely access the bastion host 30 in the intranet through the first service module 11 in the isolation area portal 10, and then through the extension component 20, so as to realize the supplier's remote operation and maintenance through the Internet.

[0045] The portal 10 is an object that can be operated by the supplier. It includes a first service module 11 and a first encrypted channel module 12. The first service module 11 is connected to the first encrypted channel module 12 and is used to provide static resources (HTML / CSS / JS) and process business data. Static resources are presented to the supplier by presenting web pages. The supplier converts web page operations into local data requests to initiate web access requests. Web access requests include but are not limited to authentication requests, permission requests, and remote operation and maintenance image requests (connection requests, keyboard and mouse operations, etc.). The first service module 11 processes business data by receiving and forwarding web access requests initiated by the supplier to the encrypted channel module. The encrypted channel then transmits the data request to the intranet bastion host 30 and presents the returned request data to the supplier. Through this process, it can be considered that the portal 10 only provides static resources. All interactive data can only be obtained through the encrypted channel (constructed by the extension component 20 and the first encrypted channel module 12 of the portal 10). While preventing local information leakage in the portal 10, the extension component 20 is used to further isolate the bastion host 30, thereby improving the security of the bastion host 30 data and preventing data leakage.

[0046] Related technologies employ a VPN model. Through VPN, secure access policies are configured, and customers apply for VPN certificates and account passwords for suppliers. Suppliers dial into the customer's intranet via VPN and then access the web page of the bastion host 30 through an external client browser to complete intranet asset operations. However, VPNs inherently pose security risks (such as exposed ports and credential sharing within the intranet), leading to high security management costs and low maintenance efficiency. The bastion host system of the present application includes a portal 10 set in an isolation area, and an extension component 20 and a bastion host 30 set in the same server; the portal 10 includes a first service module 11 and a first encryption channel module 12; the first service module 11 is connected to the first encryption channel module 12, and is used to provide static resources and process business data; static resources are to present web pages to suppliers; processing business data is to receive and forward web access requests initiated by suppliers to the encryption channel module; the first encryption channel module 12 is connected to the extension component 20, and is used to build an encrypted channel with the bastion host 30 in collaboration with the extension component 20; according to the encrypted channel and the web access request, the supplier is allowed to remotely access the bastion host 30; it solves the security risks in related technologies, resulting in high security management costs and low maintenance efficiency; the portal 10 of the present application only provides static resources, and interactive data can only be obtained through an encrypted channel, thereby improving data security and preventing data leakage.

[0047] Below Figure 1 Based on Figure 2 Detailed description of each of the above components:

[0048] Since the portal 10 is exposed to the Internet, in order to further improve the data security of the bastion host 30, further restrictions are added in the following embodiments.

[0049] In some of the embodiments, the bastion host 30 interacts with the portal 10 for data through the extension component 20 and the encrypted channel, and isolates the portal 10 from directly accessing the port of the bastion host 30 through the isolation policy built into the bastion host 30.

[0050] Specifically, the portal 10 cannot directly access the intranet where the bastion host 30 is located. All access to the portal 10 is achieved through encrypted channels and extension components 20 to achieve access and data interaction; and an isolation policy is built into the bastion host 30; the isolation policy includes but is not limited to a network policy or a firewall policy, which is used to deny direct access to the portal 10; thereby achieving that the bastion host 30 in the intranet does not open any port to the isolation zone (portal 10), and the services of the bastion host 30 in the intranet are not visible to the isolation zone.

[0051] In this embodiment, the physical isolation of the extension component 20 and the encryption channel is utilized, and the software isolation of the isolation strategy is combined to further improve the data security of the bastion host 30 and prevent data leakage.

[0052] In some of the embodiments, after the bastion host 30 configures the portal port and portal address of the portal 10, it regenerates the trust certificate of the portal installation package and provides a download link for the portal installation package;

[0053] The download link is used to provide downloading of the portal installation package to complete the deployment of the portal 10.

[0054] Specifically, there is a unique one-to-one relationship between the bastion host 30 and the portal installation package. That is, before installing the portal installation package, after configuring the portal port and portal address of the portal 10 on the bastion host 30, the portal installation package's trust certificate is regenerated, and a download link for the portal installation package is provided. The trust certificate, which includes but is not limited to the CA certificate, server certificate, and client certificate, is used for portal 10 deployment. The download link is used to download the portal installation package to complete the portal 10 deployment.

[0055] Through this embodiment, by regenerating the trust certificate and the download link mechanism, it is ensured that there is a unique one-to-one relationship between the base machine and the portal installation package, thereby improving the compliance and security of the use of the portal 10.

[0056] In some of the embodiments, the bastion host 30 completes the construction of the encrypted channel through the portal address and the trust certificate; the encrypted channel has two-way security trust.

[0057] Specifically, after the user downloads the portal installation package through the download link and completes the deployment of portal 10 based on the portal installation package, bastion host 30 completes the construction of the encrypted channel using the portal address and trust certificate. Specifically, the encrypted channel is initiated by the bastion host 30 on the intranet, and portal 10 cannot actively connect to the bastion host 30 on the intranet until the encrypted channel is successfully established. The existence of trust certificates (CA certificate, server certificate, and client certificate) ensures bidirectional security trust in the encrypted channel, further improving the security of portal 10 access.

[0058] The encryption channel uses an internal private protocol. Specifically, when HTTP traffic reaches the private port of the encryption channel, the protocol message is first packaged using the socks protocol, and then the transport layer TLS encryption is performed once. Only then can the encrypted data be transmitted through the encrypted channel; the encrypted data is passed to the other end of the channel; then TLS decryption is performed, and then the protocol message is decrypted using the socks protocol to restore the HTTP traffic. The encryption key is private, the encryption algorithm suite is not public, the format of the socks protocol encapsulated data is private, and the port of the encryption channel is also a private port. Therefore, the encryption channel uses an internal private protocol to improve data security and prevent data leakage. In other embodiments, there is no restriction on the specific encryption method and transmission protocol.

[0059] In some of these embodiments, the portal 10 further includes an agent module;

[0060] The proxy module is connected to the first service module 11 and is used to proxy web access requests from the public network and filter web access requests.

[0061] Specifically, a proxy whitelist is provided in the portal 10, which is used to filter non-compliant web access requests from the public network. Specifically, the proxy module is used to proxy web access requests from the public network. After receiving a web access request, it compares the web access request with the proxy whitelist. If the proxy for the web access request is on the proxy whitelist, the web access request is forwarded to the first service module 11. If the proxy for the web access request is not on the proxy whitelist, the web access request is directly rejected. This reduces the risk of network attacks on the portal 10 and further improves the data security of the bastion host 30.

[0062] In some of these embodiments, Figure 3 As shown, the extension component includes a second encryption channel module and a second service module;

[0063] The second encryption channel module is connected to the second service module and the first encryption channel module respectively, and is used to actively initiate the construction of a reverse encryption channel and forward the relevant data of the first encryption channel module in the portal to the second service module;

[0064] The second service module is connected to the bastion host and is used to provide external data services.

[0065] The hardware structure of the second encryption channel module can be identical to that of the first, differing from the first in that it is located in a different location. The two modules work together to establish a stable encryption channel. The second vendor service module is primarily responsible for providing external data services, including but not limited to authentication, permission control, and asset access.

[0066] In this embodiment, the extended components are used to physically isolate the bastion host of the intranet, and authentication and permissions are managed in advance, and the control of asset access is combined to simplify the access process and improve access efficiency.

[0067] In some of these embodiments, the second service module includes a business data service submodule and an access data service submodule;

[0068] The business data service submodule is connected to the second encrypted channel module and the bastion host, respectively, and is used to process authentication requests and permission requests sent by the portal. Specifically, it encapsulates authentication requests and permission requests in the whitelist into business requests; based on the authentication module and permission module of the called bastion host, it returns the authentication results and permission information of the business processing to the portal through the encrypted channel.

[0069] The access data service submodule is connected to the second encrypted channel module and the bastion host respectively, and is used to process the remote operation and maintenance image request sent by the portal; specifically: based on the access module of the called bastion host, it verifies whether the corresponding user meets the operation and maintenance permissions; when the user meets the operation and maintenance permissions, it establishes an operation and maintenance connection with the target asset and forwards the remote operation and maintenance image request; and returns the HTTP traffic of the target asset to the portal through the encrypted channel.

[0070] Specifically, the external data services of the second service module can be divided into authentication and permission control, and asset access. Among them, authentication and permission control are handled by the business data service submodule, while asset access is handled by the access data service submodule.

[0071] More specifically, after receiving a web access request, the second service module determines whether the web access request is an authentication request, a permission request, or a remote operation and maintenance image request. If it is an authentication request or a permission request, it is forwarded to the business data service submodule for processing. The business data service submodule is provided with a whitelist of suppliers, and the authentication requests and permission requests in the whitelist are encapsulated into business requests. Based on the authentication module and permission module of the called bastion host, the authentication results and permission information of the business processing are returned to the portal through an encrypted channel. If it is a remote operation and maintenance image request, it is forwarded to the access data service submodule for processing. Based on the access module of the called bastion host, it is verified whether the corresponding user meets the operation and maintenance permissions. When the user meets the operation and maintenance permissions, an operation and maintenance connection is established with the target asset, and the remote operation and maintenance image request is forwarded. The HTTP traffic of the target asset is returned to the portal through an encrypted channel.

[0072] Through this embodiment, the operation and maintenance efficiency of the supplier is improved, and the management efficiency of the bastion host administrator is also improved.

[0073] In some of the embodiments, the access module of the bastion host supports horizontal expansion deployment.

[0074] Specifically, the bastion host's access module supports horizontal scalability; it can be deployed on the same server as the second service module or on a separate server, adapting to different application scenarios. The second service module supports sending access data requests to the node hosting the access module hosting the current operation and maintenance session.

[0075] It should be noted that the above modules can be functional modules or program modules, and can be implemented through software or hardware. For modules implemented through hardware, the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0076] This embodiment also provides a remote operation and maintenance method for a bastion host system. This method is used to implement the above embodiments and preferred implementation methods, and will not be repeated here.

[0077] Figure 4 This is a flow chart of the remote operation and maintenance method of the bastion host system of this embodiment. Figure 4 As shown, the method includes:

[0078] Step S210: determining an authentication result based on the authentication request initiated by the user on the portal; and constructing an asset access list for the user based on the authentication result;

[0079] Step S220: Initiate a web access request to the remote target asset based on the asset access list; and transmit the web access request through an encrypted channel;

[0080] Step S230: Based on the encrypted channel and the web access request, the supplier is allowed to remotely access the bastion host. The encrypted channel is constructed with the bastion host in collaboration with the extension component.

[0081] Specifically, such as Figure 5 As shown, users can access the portal from the internet and log in to it using the portal address via a browser installed on the desktop system of an extranet client, making it easy to use. After the user successfully logs in to the portal, a two-factor authentication request is initiated on the portal. The authentication request is forwarded to the encrypted channel through the proxy module. The business data service submodule of the second service module then submits the request to the bastion host authentication module for identity authentication to determine the authentication result. If the authentication result is successful, the current user's permission information is returned to construct the user's asset access list. The two-factor authentication request refers to two-factor authentication using a password and a mobile phone token. When registering, a password for one-dimensional authentication and information for a mobile phone token bound to two-dimensional authentication are set, which can greatly improve user security.

[0082] After the authentication result is passed, the user can view the asset access list on the portal to obtain the assets to which they have access rights. Based on the asset access list, a web access request is initiated for the remote asset; the web access request is transmitted through an encrypted channel; and based on the encrypted channel and the web access request, the supplier is allowed to remotely access the bastion host. The specific process is as follows:

[0083] The web access request is forwarded to the encrypted channel through the proxy module; the access data service submodule of the second service module submits it to the access module of the bastion host to create a session access connection; after verifying that the user has access rights, an operation and maintenance connection is established with the target asset, and the operation and maintenance image of the target asset is encapsulated as standard HTTP traffic through the graphics protocol and transmitted back to the portal through the encrypted channel; the operation and maintenance image of the remote asset is presented on the user's client browser.

[0084] After receiving the operation and maintenance image of the remote asset, the user performs remote operation and maintenance of the intranet asset through keyboard and mouse operations on the browser. The access request of the keyboard and mouse operation is packaged into a web access request for the remote operation and maintenance image, and forwarded to the encrypted channel through the proxy module. The access data service sub-module of the second service module forwards the request to the access module of the bastion host, and the access module of the bastion host converts the request into access protocol traffic and sends it to the target asset; the response of the target asset is encapsulated into standard HTTP traffic through the graphics protocol, and transmitted back to the portal through the encrypted channel, presenting the operation and maintenance image of the remote asset on the user's browser.

[0085] Through this embodiment, the security risks existing in related technologies are solved, which lead to high security management costs and low maintenance efficiency. The portal of this application only provides static resources, and interactive data can only be obtained through encrypted channels, thereby improving data security and preventing data leakage.

[0086] In some embodiments, the remote operation and maintenance method of the bastion host system further includes:

[0087] After a user submits a registration application via an invitation email, the bastion host administrator will review the application and return the approval result via an invitation email. The link in the invitation email is a dynamically generated link with a validity period.

[0088] Specifically, the administrator on the bastion host configures the supplier information and sends an invitation email to the supplier's designated email address. After the user submits a registration application via the invitation email, the administrator on the bastion host reviews the registration application and returns the approval result via the invitation email, thereby improving the administrator's management efficiency.

[0089] Among them, the supplier's email address supports the configuration of multiple. The link in the invitation email is a dynamically generated link with a validity period control. At the same time, the portal address and invitation code are provided to the supplier in the email. The supplier obtains the portal's access address / email address / invitation code through the email address, initiates access through the web, enters the email address and invitation code, and enters the user registration page.

[0090] After a user submits a registration application, the bastion host administrator must review it. After approval, the user receives an email confirming the application's approval. Using the portal address in the email, the user accesses the portal through a browser. After logging in, the user can view a list of authorized assets. The user can then initiate a remote operation and maintenance connection request through the browser to perform remote operations and maintenance.

[0091] It should be noted that the steps shown in the above process or the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0092] It should be understood that the specific embodiments described herein are only used to explain this application and are not used to limit it. Based on the embodiments provided in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0093] Obviously, the accompanying drawings are merely examples or embodiments of the present application. A person skilled in the art can also apply the present application to other similar situations based on these drawings without inventive effort. Furthermore, it is understandable that, although the work involved in this development process may be complex and lengthy, certain design, manufacturing, or production changes based on the technical content disclosed in this application are merely routine technical means for a person skilled in the art and should not be considered to constitute a deficiency in the disclosure of the present application.

[0094] The term "embodiment" as used in this application refers to specific features, structures, or characteristics described in conjunction with the embodiment that can be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily mean that the embodiment is the same, nor does it mean that it is mutually exclusive with other embodiments and is independent or optional. It is understood, either explicitly or implicitly, by those skilled in the art that the embodiments described in this application can be combined with other embodiments when there is no conflict.

[0095] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of patent protection. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A bastion host system used for supplier remote operation and maintenance, characterized in that: include: A portal set up in an isolated zone, and extension components and a bastion host set up on the same server; The portal includes a first service module and a first encryption channel module; The first service module is connected to the first encryption channel module and is used to provide static resources and process business data; the static resources are to present web pages to suppliers; the business data processing is to receive and forward web access requests initiated by the suppliers to the encryption channel module; The first encryption channel module is connected to the extension component and is used to build an encryption channel with the bastion host in cooperation with the extension component; according to the encryption channel and the web access request, the supplier can remotely access the bastion host.

2. The bastion host system for supplier remote operation and maintenance according to claim 1 is characterized in that: The bastion host interacts with the portal for data through the extension component and the encrypted channel, and isolates the portal from directly accessing the port of the bastion host through the built-in isolation strategy in the bastion host.

3. The bastion host system for supplier remote operation and maintenance according to claim 1 is characterized in that: After the bastion host configures the portal port and portal address of the portal, it regenerates the trust certificate of the portal installation package and provides a download link for the portal installation package; The download link is used to provide downloading of the portal installation package to complete the deployment of the portal.

4. The bastion host system for supplier remote operation and maintenance according to claim 3 is characterized in that: The bastion host completes the construction of the encrypted channel through the portal address and the trust certificate; the encrypted channel has two-way security trust.

5. The bastion host system for supplier remote operation and maintenance according to claim 1 is characterized in that: The portal also includes an agent module; The proxy module is connected to the first service module and is used to act as an agent for the web access request of the public network and filter the web access request.

6. The bastion host system for supplier remote operation and maintenance according to claim 1 is characterized in that: The extension component includes a second encryption channel module and a second service module; The second encryption channel module is connected to the second service module and the first encryption channel module respectively, and is used to actively initiate the construction of the reverse encryption channel and forward the relevant data of the first encryption channel module in the portal to the second service module; The second service module is connected to the bastion host and is used to provide external data services.

7. The bastion host system for supplier remote operation and maintenance according to claim 6 is characterized in that: The second service module includes a business data service submodule and an access data service submodule; The business data service submodule is connected to the second encryption channel module and the bastion host, respectively, and is used to process the authentication request and permission request sent by the portal; specifically: the authentication request and the permission request in the whitelist are encapsulated into a business request; based on the authentication module and permission module of the called bastion host, the authentication result and permission information of the business processing are returned to the portal through the encrypted channel; The access data service submodule is connected to the second encrypted channel module and the bastion host, respectively, and is used to process the remote operation and maintenance image request sent by the portal; specifically: based on the access module of the called bastion host, verify whether the corresponding user meets the operation and maintenance permissions; when the user meets the operation and maintenance permissions, establish an operation and maintenance connection with the target asset and forward the remote operation and maintenance image request; return the HTTP traffic of the target asset to the portal through the encrypted channel.

8. The bastion host system for supplier remote operation and maintenance according to claim 7 is characterized in that: The access module of the bastion host supports horizontal expansion deployment.

9. A remote operation and maintenance method for a bastion host system, characterized in that: The method is applicable to the bastion host system for supplier remote operation and maintenance according to any one of claims 1 to 8; the method comprises: Determine an authentication result based on an authentication request initiated by a user on a portal; and construct an asset access list for the user based on the authentication result; Initiating a web access request to a remote target asset based on the asset access list, and transmitting the web access request through an encrypted channel; According to the encrypted channel and the web access request, the supplier is allowed to remotely access the bastion host; the encrypted channel is constructed with the bastion host in collaboration with the extension component.

10. The remote operation and maintenance method of the bastion host system according to claim 9, characterized in that: The method further comprises: After the user submits the registration application via the invitation email, the administrator of the bastion host will review the registration application and return the review result via the invitation email. The link in the invitation email is a dynamically generated link with a validity period.

Images