Method and device for controlling access of bastion host based on multi-service architecture

Abstract

The application relates to a bastion host access management method and device based on a multi-service architecture, wherein the method comprises the following steps: completing authentication with a client according to a request; obtaining session access traffic after the authentication is passed; the session access traffic is integrated with authentication credentials generated after the authentication is passed; judging whether the current session access traffic belongs to an SSH session or an SFTP session; when the current session access traffic belongs to the SSH session, enabling a first service to establish an SSH communication link with character assets accessed by a user through a second service based on the authentication credentials; processing the current session access traffic; when the current session access traffic belongs to the SFTP session, enabling the first service to establish an SFTP communication link with the character assets accessed by the user through a third service based on the authentication credentials; and processing the current session access traffic. The method solves the problem that SSH sessions and SFTP sessions influence each other in the related art, realizes decoupled access of the two sessions, and avoids direct mutual influence between the two sessions.

Description

Technical Field

[0001] This application relates to the field of bastion host technology, and in particular to a method and apparatus for bastion host access control based on a multi-service architecture. Background Technology

[0002] Currently, bastion hosts use the SSHD component and service to support character asset access via SSH and SFTP protocols. The SSHD component and service bind the SSH and SFTP protocols together; that is, the SFTP protocol is a protocol for transferring file data within a secure channel opened by the SSH protocol.

[0003] Users access character assets through the bastion host as follows: A URL for accessing the corresponding character asset is generated at the access function entry point on the bastion host management page. This URL is then routed to a specific worker node via the same port (port 22). The character service on the worker node establishes a connection with the target character asset using the SSH protocol (SSH session). During the interaction, the character service can parse the commands executed by the user and upload / download file data streams (SFTP session). It also manages and audits the operations performed during the access process according to pre-configured rules on the bastion host. The fact that both types of sessions are processed by the same program means they can directly affect each other, leading to character service anomalies and other core business processes becoming unresponsive or even unavailable. For example, when the bastion host parses a large number of file data packets, the frequent decryption and encryption of SSH data packets can cause the CPU usage of the character service to spike, affecting character session access on the bastion host worker nodes and potentially causing all business processes to freeze or crash. Another example is when file logging is enabled on the bastion host; the large number of file transfers that need to be recorded in the bastion host background can lead to persistently high disk I / O, impacting the overall business operations of the bastion host worker nodes.

[0004] There is currently no effective solution to the problem that SSH and SFTP sessions are processed in the same program, causing them to interfere with each other and thus affecting normal access. Summary of the Invention

[0005] This embodiment provides a bastion host access control method and apparatus based on a multi-service architecture to solve the problem in related technologies where SSH sessions and SFTP sessions are loaded into the same program for processing, causing them to interfere with each other and thus affecting the normal operation of access.

[0006] Firstly, this embodiment provides a bastion host access control method based on a multi-service architecture, applicable to bastion hosts; the bastion host includes a client and worker nodes; the client has a management node; the worker nodes deploy a first service, a second service, and a third service to form a multi-service architecture; the first service is connected to the target port of the client; the second service and the third service are respectively connected to the first service; the method includes:

[0007] The first service receives a request initiated by a user in the client and completes authentication with the client based on the request; after successful authentication, it acquires session access traffic; the session access traffic integrates authentication credentials generated after successful authentication.

[0008] Determine whether the current session access traffic belongs to an SSH session or an SFTP session;

[0009] When the session is in the SSH session, based on the authentication credentials, the first service establishes an SSH communication link with the character assets accessed by the user through the second service; and processes the current session access traffic through the SSH communication link.

[0010] When the session belongs to the SFTP session, based on the authentication credentials, the first service establishes an SFTP communication link with the character assets accessed by the user through the third service; and processes the current session access traffic through the SFTP communication link.

[0011] In some embodiments, the method further includes:

[0012] After determining whether the current session access traffic belongs to an SSH session or an SFTP session based on the channel type of the request, and after completing the processing of the request, the re-key exchange process is actively triggered.

[0013] In some of these embodiments, the first service, the second service, and the third service are deployed on at least one of the worker nodes.

[0014] In some embodiments, the third service is deployed on one of the worker nodes; the first service and the second service are deployed on another worker node.

[0015] In some embodiments, the method further includes:

[0016] Configure an encryption protocol for encrypting data transmitted between the third service and the first service.

[0017] In some embodiments, the method further includes:

[0018] Configure corresponding file transfer rates for different users in the management node;

[0019] When establishing the SSH communication link or the SFTP communication link, the corresponding file transfer rate is transmitted to the first service;

[0020] Under the file transfer rate managed by the first service, the third service controls the corresponding file transfer rate based on the file transfer rate.

[0021] In some embodiments, the method further includes:

[0022] Detect the resource utilization rate of the working node where the third service is located;

[0023] When the resource utilization rate is detected to be lower than a preset utilization threshold, a rate request to increase the file transfer rate is initiated to the first service.

[0024] Secondly, this embodiment provides a bastion host access control device based on a multi-service architecture, applicable to bastion hosts; the bastion host includes a client and worker nodes; the client has a management node; the worker nodes deploy a first service, a second service, and a third service to form a multi-service architecture; the first service is connected to the target port of the client; the second service and the third service are respectively connected to the first service; the device includes: an authentication module, a judgment module, a first communication module, and a second communication module;

[0025] The authentication module is used to receive a request initiated by a user in the client in the first service, and complete authentication with the client according to the request; after successful authentication, it acquires session access traffic; the session access traffic integrates authentication credentials generated after successful authentication;

[0026] The determination module determines whether the current session access traffic belongs to an SSH session or an SFTP session.

[0027] The first communication module is used to, when belonging to the SSH session, enable the first service to establish an SSH communication link with the character assets accessed by the user through the second service based on the authentication credentials; and process the current session access traffic through the SSH communication link.

[0028] The second communication module is used to, when belonging to the SFTP session, based on the authentication credentials, enable the first service to establish an SFTP communication link with the character assets accessed by the user through the third service; and process the current session access traffic through the SFTP communication link.

[0029] Thirdly, this embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the bastion host access control method based on a multi-service architecture as described in the first aspect.

[0030] Fourthly, this embodiment provides a storage medium storing a computer program that, when executed by a processor, implements the bastion host access control method based on a multi-service architecture as described in the first aspect.

[0031] Compared with related technologies, the bastion host access control method and device based on a multi-service architecture provided in this embodiment receives requests initiated by users in the client in the first service and completes authentication with the client based on the requests; after successful authentication, it obtains session access traffic; the session access traffic integrates authentication credentials generated after successful authentication; it determines whether the current session access traffic belongs to an SSH session or an SFTP session; when it belongs to an SSH session, based on the authentication credentials, the first service establishes an SSH communication link with the character assets accessed by the user through the second service; and processes the current session access traffic through the SSH communication link; when it belongs to an SFTP session, based on the authentication credentials, the first service establishes an SFTP communication link with the character assets accessed by the user through the third service; and processes the current session access traffic through the SFTP communication link. This solves the problem in related technologies where SSH sessions and SFTP sessions are processed in the same program, causing them to affect each other and thus affecting the normal operation of access. By utilizing a multi-service architecture consisting of the first service, the second service, and the third service, corresponding communication links are built for SSH sessions and SFTP sessions respectively, so as to decouple the access of SSH sessions and SFTP sessions under the same port, thereby avoiding direct mutual interference between the two sessions.

[0032] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0033] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0034] Figure 1 This is a structural block diagram of a bastion host provided in one embodiment of this application;

[0035] Figure 2 This is a flowchart of a bastion host access control method based on a multi-service architecture provided in an embodiment of this application;

[0036] Figure 3 This is a flowchart of an embodiment of the present application providing an active triggering of a re-key exchange process;

[0037] Figure 4 This is a structural block diagram of a bastion host provided in another embodiment of this application;

[0038] Figure 5 This is a flowchart of file transfer rate control provided in an embodiment of this application;

[0039] Figure 6 This is a structural block diagram of a bastion host access control device based on a multi-service architecture provided in an embodiment of this application.

[0040] In the diagram: 100, Management Node; 200, Worker Node; 210, First Service; 220, Second Service; 230, Third Service; 610, Authentication Module; 620, Judgment Module; 630, First Communication Module; 640, Second Communication Module. Detailed Implementation

[0041] To better understand the purpose, technical solution, and advantages of this application, the application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0042] Unless otherwise defined, the technical or scientific terms used in this application shall have the general meaning understood by one of ordinary skill in the art to which this application pertains. Words such as “a,” “an,” “an,” “the,” “the,” and “these” used in this application do not indicate quantitative limitation and may be singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that comprises a series of steps or modules (units) is not limited to the listed steps or modules (units) but may include steps or modules (units) not listed, or may include other steps or modules (units) inherent to these processes, methods, products, or devices. Words such as “connected,” “linked,” and “coupled” used in this application are not limited to physical or mechanical connections but may include electrical connections, whether direct or indirect. “Multiple” used in this application refers to two or more. “And / or” describes the relationship between related objects, indicating that three relationships may exist; for example, “A and / or B” can represent: A alone, A and B simultaneously, and B alone. Normally, the character " / " indicates that the objects before and after it are in an "or" relationship. The terms "first," "second," "third," etc., used in this application are merely to distinguish similar objects and do not represent a specific order of objects.

[0043] The method embodiments provided in this example can be executed in a bastion host. Figure 1 This is a hardware structure block diagram of the bastion host in this embodiment. For example... Figure 1 As shown, the bastion host includes a client and worker nodes 200; the client includes a management node 100; the worker nodes 200 deploy a first service 210, a second service 220, and a third service 230 to form a multi-service architecture; the first service 210 is connected to the target port of the client; the second service 220 and the third service 230 are respectively connected to the first service 210. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the bastion host described above. For example, the bastion host may also include components that are larger than... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown are illustrated.

[0044] In this context, "client" refers to the device used by the user, such as a PC with an SSH client (Putty, SecureCRT) or a web browser installed. The target port is the standard default port for the SSH protocol, which is port 22 on the client. The management node 100 (master) is the bastion host's management console, responsible for user management, authorization management, audit logs, etc.; it can be the web management interface on the client. The worker node 200 (worker) is the bastion host server that actually provides the redirection service; when a user accesses a target asset, they first connect to the multi-service architecture of worker node 200, and then are redirected to the target character asset. Character assets refer to devices managed via character protocols (SSH / Telnet), such as Linux servers and network devices.

[0045] The first service 210 connects to the target port of the client, handling session access traffic from the client, identifying whether the current session access traffic belongs to SSH or SFTP, and then establishing the SSH / SFTP communication link and forwarding subsequent traffic. The second service 220 establishes an SSH communication link with the character asset, handling session access traffic from the SSH session of the first service 210, and is responsible for SSH session traffic processing (traffic in the CHANNEL_EXEC and CHANNEL_SHELL channels), primarily handling command execution control and auditing. The third service 230 handles SFTP session access traffic from the first service 210, and is responsible for SFTP session traffic processing (traffic in the CHANNEL_SUBSYSTEM channel), primarily handling file upload and download traffic control and auditing.

[0046] Based on the aforementioned bastion host, this embodiment provides a bastion host access control method based on a multi-service architecture. Figure 2 This is a flowchart of the bastion host access control method based on a multi-service architecture in this embodiment, as shown below. Figure 2 As shown, the process includes the following steps:

[0047] Step S210: In the first service, a request initiated by the user in the client is received, and authentication is completed with the client according to the request; after successful authentication, session access traffic is obtained; the session access traffic integrates the authentication credentials generated after successful authentication;

[0048] Step S220: Determine whether the current session access traffic belongs to an SSH session or an SFTP session;

[0049] Step S230: When it belongs to an SSH session, based on the authentication credentials, enable the first service to establish an SSH communication link with the character assets accessed by the user through the second service; process the current session access traffic through the SSH communication link;

[0050] Step S240: When it belongs to an SFTP session, based on the authentication credentials, the first service establishes an SFTP communication link with the character assets accessed by the user through the third service; and processes the current session access traffic through the SFTP communication link.

[0051] Specifically, before a user can access character assets, an SSH connection and authentication must be established with the primary service. This involves the user initiating an SSH connection and authentication request in the client, the primary service receiving the request, and completing the SSH connection and authentication accordingly. This establishes a stable SSH connection between the client and the primary service, enabling continuous acquisition of subsequent session access traffic. After authentication, the primary service maintains the generated authentication credentials, integrating them into the session access traffic.

[0052] The session access traffic contains the channel type that the request needs to be transmitted; this channel type can be used to determine whether the current session access traffic belongs to an SSH session or an SFTP session. In other embodiments, other methods can be used to determine whether the current session access traffic belongs to an SSH session or an SFTP session, such as using identification operations, and there is no limitation on this.

[0053] Taking channel type as an example: If the channel type is "subsystem", then the current session access traffic is determined to be an SFTP session. Based on authentication credentials, the first service establishes an SFTP communication link with the user's accessed character assets through the third service. This SFTP communication link can handle the current session access traffic, i.e., it is responsible for the SFTP session (traffic processing in the CHANNEL_SUBSYSTEM channel), and can be considered to primarily handle file upload and download traffic control and auditing. If the channel type is not "subsystem" or belongs to an SSH session, then the current session access traffic is determined to be an SSH session. Based on authentication credentials, the first service establishes an SSH communication link with the user's accessed character assets through the second service. This SSH communication link can handle the current session access traffic, i.e., it is responsible for the SSH session (traffic processing in the CHANNEL_EXEC and CHANNEL_SHELL channels), and can be considered to primarily handle command execution control and auditing. This achieves decoupling access between SSH and SFTP sessions on the same port, thereby avoiding direct mutual interference between the two sessions.

[0054] In related technologies, users access character assets through a bastion host as follows: A URL for accessing the corresponding character asset is generated at the access function entry point on the bastion host management page. This URL is then routed to a specific worker node via the same port (port 22). The character service on the worker node establishes a connection with the target character asset using the SSH protocol (SSH session). During the interaction, the character service can parse the commands executed by the user and upload / download file data streams (SFTP session). It also manages and audits the operations performed during the access process according to pre-configured rules on the bastion host. The fact that both types of sessions are processed by the same program in this process means they can directly affect each other, leading to character service anomalies and other core business processes becoming sluggish or even unavailable. For example, when the bastion host parses a large number of file data packets, the frequent decryption and encryption of SSH data packets can cause the CPU usage of the character service to spike, affecting character session access on the bastion host worker node and potentially causing all business processes to lag or crash. Another example is when file logging is enabled on the bastion host; the large number of file transfers that need to be recorded in the bastion host background can lead to persistently high disk I / O, impacting the overall business operations of the bastion host worker node. In this embodiment, the first service receives requests initiated by the user in the client and completes authentication with the client based on the requests. After successful authentication, it acquires session access traffic, which includes authentication credentials generated after successful authentication. It determines whether the current session access traffic belongs to an SSH session or an SFTP session. If it belongs to an SSH session, based on the authentication credentials, the first service establishes an SSH communication link with the user's accessed character assets through the second service; the current session access traffic is processed through the SSH communication link. If it belongs to an SFTP session, based on the authentication credentials, the first service establishes an SFTP communication link with the user's accessed character assets through the third service; the current session access traffic is processed through the SFTP communication link. This solves the problem in related technologies where SSH and SFTP sessions are processed in the same program, causing them to interfere with each other and thus affecting normal access. By utilizing a multi-service architecture consisting of the first, second, and third services, corresponding communication links are built for SSH and SFTP sessions respectively, decoupling access between SSH and SFTP sessions on the same port. This avoids direct interference between the two sessions and solves the long-standing problem of the serious impact of concurrent file transfers on bastion host services.

[0055] The steps described above are explained in detail below:

[0056] Among them, the authentication credentials include, but are not limited to, the authentication result status, session key, session identifier, access target device information (such as account, password, and port number, etc.). The authentication credentials are maintained by the first service, and the first service passes them to the second service or the third service through a shunt channel; the second service or the third service receives the authentication credentials and constructs a connection from the second service or the third service to the target character asset through the sshClient code.

[0057] An example of the authentication credentials is as follows:

[0058] loginData={devId=15,de member=10.10.10.10,devName=Asset Name - 1,charset=UTF-8,type=0,sysType=Linux,protocol=ssh,port=22,account=root,passwordFromPam=false,password=passwd,dynamicRuleId=1…}。

[0059] Among them, the authentication credentials can be integrated into the session access traffic by using a custom session data transfer protocol specification; that is, the authentication credentials and session access traffic are transmitted through the session data transfer protocol.

[0060] The custom session data transfer protocol specification is as follows:

[0061] Magic number (4) + version number (1) + packet type (1) + data length (4) + session data.

[0062] Among them, the numbers represent the data length of the protocol packets used, unit: byte. The packet type field is used to identify whether the current data packet is a data packet for session data migration (SFTP session) (eg: 0) or a data packet for SSH session (eg: 1). If it is a data packet for session data migration, the subsequent session data parsing is directly performed. If it is an SSH data packet, after parsing out the session data, it needs to be regarded as an ssh protocol format data packet. Therefore, to obtain the real data, the ssh protocol needs to be parsed using the migrated session data.

[0063] Through this embodiment, by using a custom session data transfer protocol specification, the transmission and parsing of data packets can be standardized, facilitating the processing of subsequent processes.

[0064] In some of the embodiments, as Figure 3 shown, the bastion host access control method based on a multi-service architecture further includes the following steps:

[0065] Step S310: After determining whether the current session access traffic belongs to an SSH session or an SFTP session based on the channel type of the request, and after completing the processing of the request, actively trigger the re-key exchange process.

[0066] It's important to note that because it's impossible to directly distinguish whether a connection request is for an SSH or SFTP communication channel (since SFTP is built on top of SSH) when a connection request is received on the target port, directly migrating session data parsed from the client by the first service to the second or third service can result in status anomalies. This is because the various algorithms used in the key exchange phase of the SSH protocol have consistency checks and implement various security measures to prevent man-in-the-middle attacks, making direct serialization and subsequent session data migration impossible.

[0067] Due to the aforementioned issues, after determining whether the current session access traffic belongs to an SSH or SFTP session based on the requested channel type, directly migrating session data may encounter the problems mentioned above. Therefore, the solution is as follows: After processing the request message (SSH_MSG_CHANNEL_OPEN), the first service proactively triggers a rekeying process in the SSH protocol to re-negotiate the key, thereby resetting the residual process state data used to transmit messages such as "SSH_MSG_CHANNEL_OPEN" after the initial SSH connection key negotiation. After the rekeying process is executed, forwarding subsequent data packets (session data) is a clean process of transmitting data from the beginning under the current protocol. Subsequent incoming SSH data packets can be forwarded by the first service to the backend service (second or third service) for processing via a traffic splitter channel; the backend service (second or third service) migrates the relevant data packets to the corresponding character assets based on the session data to complete the access without needing to pay additional attention to other states.

[0068] This embodiment enables decoupled access to SSH and SFTP sessions on the same port, while ensuring the integrity and effectiveness of data transmission, under various security protection measures such as preventing man-in-the-middle attacks.

[0069] In some embodiments, the first service, the second service, and the third service are deployed on at least one worker node.

[0070] Specifically, there are several deployment modes for the first, second, and third services. One deployment mode involves deploying the first, second, and third services on a single worker node to form a multi-service architecture. This mode is suitable for bastion hosts with a limited number of worker nodes. Another deployment mode involves deploying the first, second, and third services on different worker nodes to form a multi-service architecture. This mode maximizes decoupling and minimizes mutual interference. There are no restrictions on the specific deployment methods for the first, second, and third services.

[0071] The following explanation uses another deployment mode as an example:

[0072] For example: the third service is deployed on one worker node; the first and second services are deployed on another worker node. Figure 4 As shown, the first service (sshd-server) and the second service (text-server) are deployed on worker node 1; the first service (sshd-server) and the second service (text-server) are deployed on worker node 2; and the third service (sftp-server) is deployed on worker node 3. The master node in the client establishes an SSH connection with the first service (sshd-server) on worker node 1, and also establishes an SSH connection with the first service (sshd-server) on worker node 2. The first service (sshd-server) on worker node 1 connects to character asset 1 through the second service (text-server) on worker node 1; the first service (sshd-server) on worker node 1 connects to either character asset 1 or character asset 2 through the third service (sftp-server) on worker node 3; the first service (sshd-server) on worker node 2 connects to character asset 2 through the second service (text-server) on worker node 2; and the first service (sshd-server) on worker node 2 connects to either character asset 1 or character asset 2 through the third service (sftp-server) on worker node 3. The first service (sshd-server) has an SSH server (sshServer); the second service (text-server) has an SSH server (sshServer) and an SSH client (sshClient); and the third service (sftp-server) has an SSH server (sftpServer) and an SSH client (sftpClient).

[0073] Specifically, the first service on worker node 1 connects to character asset 1 through the second service on worker node 1, which is implemented as follows: based on authentication credentials, the first service establishes an SSH communication link with the character asset accessed by the user through the second service; and processes the current session access traffic through the SSH communication link.

[0074] Taking worker node 1 as an example, the specific process is as follows: Based on the login information of character asset 1 in the authentication credentials, an SSH connection from text-server to character asset 1 is constructed through sshClient (SSH client) code; then this connection is connected to sshServer in text-server. Since sshServer itself is connected to the routing channel, a connection is formed from client to sshServer of sshd-server to routing channel to sshServer of text-server (SSH server) to sshClient of text-server to character asset 1, forming an SSH communication link; the current session access traffic is processed through the SSH communication link to realize the control and auditing of bastion host asset access.

[0075] Specifically, the first service on worker node 1 connects to character asset 1 through the third service on worker node 3, which is implemented as follows: based on authentication credentials, the first service establishes an SFTP communication link with the character asset accessed by the user through the third service; and processes the current session access traffic through the SFTP communication link.

[0076] Taking worker node 1 as an example, the specific process is as follows: Based on the login information of character asset 1 in the authentication credentials, an SFTP connection from sftp-server to character asset 1 is constructed through sshClient code; then this connection is connected to sshServer in sftp-server. Since sshServer itself is connected to the distribution channel, this will form a connection from the client to sshServer of sshd-server to distribution channel to sshServer of sftp-server to sshClient of sftp-server to character asset 1, forming an SFTP communication link; the current session access traffic is processed through the SFTP communication link to realize core functions such as file upload and download, and file logging.

[0077] In this embodiment, by introducing an independent working node 3, the CPU and IO pressure under high concurrency is completely separated from other core services of the bastion host, avoiding the system from being sluggish or unavailable due to the concurrency pressure of character sessions, thus solving the long-standing problem of the serious impact of file transfer concurrency on bastion host services.

[0078] It should be noted that the above deployment mode is suitable for situations with limited node resources, but it has the following two limitations:

[0079] 1. The transmission rate of the SFTP communication link is affected by the additional forwarding layer (from sshd-server to sftp-server), and the transmission rate is influenced by the network bandwidth between the two nodes. 2. The security of data packets directly forwarded between the sshd-server worker node and the sftp-server worker node needs to be guaranteed, requiring the use of a custom encryption protocol. This encryption protocol is used to encrypt data transmitted between the third-party service and the first-party service. This encryption protocol can follow the Session Data Transfer Protocol specification, which will not be repeated here.

[0080] Furthermore, deploying the three services as three independent processes on the same worker node eliminates the need to consider network I / O limitations and the time-consuming encryption / decryption required for security. Because network I / O consumption is negligible when on the same node, no additional encryption is needed for data transmission within the worker node.

[0081] In some of these embodiments, such as Figure 5 As shown, the bastion host access control method based on a multi-service architecture also includes the following steps:

[0082] Step S510: Configure corresponding file transfer rates for different users in the management node;

[0083] Step S520: When establishing an SSH or SFTP communication link, transmit the corresponding file transfer rate to the first service.

[0084] Step S530: Under the file transfer rate managed by the first service, the third service controls the corresponding file transfer rate based on the file transfer rate.

[0085] Specifically, it supports adding file transfer rate limits for character sessions in the bastion host's management node, setting different rate limits for each user (regular users and member users) to configure the transfer rate. When establishing an SSH or SFTP communication link, i.e., a session is established, the management node sends the file transfer rate corresponding to that session to the first service; during the session, the first task maintains the file transfer rate; when the management node's file transfer rate changes, it notifies the first service to make the change, thereby achieving dynamic adjustment of the file transfer rate.

[0086] The rate limiting implementation process for the worker node (sftpworker node) where the third service resides is as follows:

[0087] 1. The sftpworker node only runs the sftp-server service. The CPU, memory and bandwidth resources of this worker node can be better utilized, which greatly increases the resource allocation ratio of the file transfer function.

[0088] 2. When the sftp-server service receives data from the sshd-server connection, it creates a session-level token bucket based on the file transfer rate. The lifecycle of this token bucket is consistent with the SFTP connection. The token bucket itself has a periodic task that automatically replenishes the token count every second. When the process handling the corresponding SFTP connection in the sftp-server service processes file stream data, it first attempts to acquire tokens from the token bucket. If the number of tokens is greater than 0, logical processing is performed; otherwise, it voluntarily yields CPU time slices and waits. Taking a configured file transfer rate of 5MB / s as an example: When an SFTP session attempts to establish, the sftp-server service initializes a token bucket of size 5 and simultaneously adds tokens to the bucket at a rate of 5 tokens / s. The thread handling the SFTP connection reads file data traffic from the sshd-server at a rate of 1MB blocks. Each time it reads, it decrements the number of tokens in the token bucket by one. When the number of tokens reaches 0, it voluntarily yields CPU time slices, thus ensuring that the maximum file transfer rate does not exceed 5MB / s.

[0089] This embodiment introduces a token bucket rate limiting algorithm into the file data stream processing, which overcomes the current drawback of not supporting independent file transfer rate limiting for SFTP and SSH connections based on the same SSH channel. From the perspective of the bastion host, this embodiment can achieve traffic control at the character access session level, and configure different file transfer rates for ordinary users and member users, thus solving the problem of file transfer rate limitation at the access session level.

[0090] In some embodiments, the bastion host access control method based on a multi-service architecture further includes the following steps:

[0091] Detect the resource utilization rate of the work node where the third service is located;

[0092] When resource utilization is detected to be lower than a preset utilization threshold, a rate request to increase the file transfer rate is sent to the first service.

[0093] In this embodiment, resource utilization detection can be added to the third service. Specifically, the resource utilization of the working node where the third service is located is detected; when the detected resource utilization is lower than a preset utilization threshold, it is considered that the current working node's resource utilization is low, and it can proactively initiate a rate request to the management node to increase the file transfer rate. The management node can adjust the file transfer rate according to the rate request, thereby improving file transfer speed and optimizing user experience.

[0094] This embodiment allows for dynamic monitoring of resource consumption at the working node where the third service is located, enabling timely adjustments to file transfer rates and maximizing the utilization of hardware resources.

[0095] It should be noted that the steps shown in the above process or in the flowchart of the accompanying figures can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0096] This embodiment also provides a bastion host access control device based on a multi-service architecture. This device is used to implement the above embodiments and preferred embodiments, and details already described will not be repeated. The terms "module," "unit," "subunit," etc., used below can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0097] Figure 6 This is a structural block diagram of the bastion host access control device based on a multi-service architecture in this embodiment, as shown below. Figure 6 As shown, the device includes: an authentication module 610, a judgment module 620, a first communication module 630, and a second communication module 640;

[0098] The authentication module 610 is used to receive requests initiated by users in the client in the first service, and complete authentication with the client based on the requests; after successful authentication, it obtains session access traffic; the session access traffic integrates the authentication credentials generated after successful authentication;

[0099] Module 620 determines whether the current session access traffic belongs to an SSH session or an SFTP session.

[0100] The first communication module 630 is used to enable the first service to establish an SSH communication link with the character assets accessed by the user through the second service based on authentication credentials when it belongs to an SSH session; and to process the current session access traffic through the SSH communication link.

[0101] The second communication module 640 is used to enable the first service to establish an SFTP communication link with the character assets accessed by the user through the third service based on authentication credentials when it belongs to an SFTP session; and to process the current session access traffic through the SFTP communication link.

[0102] The above-mentioned device solves the problem in related technologies where SSH sessions and SFTP sessions are processed in the same program, causing them to interfere with each other and thus affecting the normal operation of access. By using a multi-service architecture consisting of a first service, a second service, and a third service, corresponding communication links are built for SSH sessions and SFTP sessions respectively, so as to decouple the access of SSH sessions and SFTP sessions under the same port, thereby avoiding direct interference between the two sessions.

[0103] In some embodiments, the bastion host access control device based on a multi-service architecture further includes:

[0104] The trigger module is used to actively trigger the rekey exchange process after determining whether the current session access traffic belongs to an SSH session or an SFTP session based on the channel type of the request and after the request processing is completed.

[0105] In some of these embodiments, the first service, the second service, and the third service are deployed on at least one worker node.

[0106] In some of these embodiments, the third service is deployed on one worker node; the first and second services are deployed on another worker node.

[0107] In some embodiments, the bastion host access control device based on a multi-service architecture further includes:

[0108] The settings module is used to configure the encryption protocol for encrypting data transmitted between the third service and the first service.

[0109] In some embodiments, the bastion host access control device based on a multi-service architecture further includes:

[0110] The control module is used to configure the corresponding file transfer rate for different users in the management node;

[0111] When establishing an SSH or SFTP communication link, the corresponding file transfer rate is transmitted to the first service.

[0112] Under the file transfer rate managed by the first service, the third service controls the corresponding file transfer rate based on the file transfer rate.

[0113] In some embodiments, the bastion host access control device based on a multi-service architecture further includes:

[0114] The detection module is used to detect the resource utilization of the working node where the third service is located;

[0115] When resource utilization is detected to be lower than a preset utilization threshold, a rate request to increase the file transfer rate is sent to the first service.

[0116] It should be noted that the above modules can be functional modules or program modules, and can be implemented through software or hardware. For modules implemented through hardware, the above modules can reside in the same processor; or the above modules can be located in different processors in any combination.

[0117] This embodiment also provides a computer device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0118] Optionally, the computer device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0119] Optionally, in this embodiment, the processor can be configured to perform the following steps via a computer program:

[0120] S1 receives requests initiated by users in the client in the first service, completes authentication with the client based on the request; after successful authentication, it obtains session access traffic; the session access traffic integrates the authentication credentials generated after successful authentication;

[0121] S2, determine whether the current session access traffic belongs to an SSH session or an SFTP session;

[0122] S3, when in an SSH session, enables the first service to establish an SSH communication link with the character assets accessed by the user through the second service based on authentication credentials; and processes the current session access traffic through the SSH communication link.

[0123] S4, when in an SFTP session, enables the first service to establish an SFTP communication link with the user's accessed character assets through the third service based on authentication credentials; and processes the current session access traffic through the SFTP communication link.

[0124] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated in this embodiment.

[0125] Furthermore, in conjunction with the bastion host access control method based on a multi-service architecture provided in the above embodiments, this embodiment can also provide a storage medium for implementation. This storage medium stores a computer program; when executed by a processor, the computer program implements any of the bastion host access control methods based on a multi-service architecture in the above embodiments.

[0126] It should be noted that all information and data involved in this application are authorized by the user or fully authorized by all parties and will be used legally.

[0127] It should be understood that the specific embodiments described herein are merely illustrative of the application and not intended to limit it. All other embodiments derived by those skilled in the art based on the embodiments provided in this application without inventive effort are within the scope of protection of this application.

[0128] Obviously, the accompanying drawings are merely some examples or embodiments of this application. Those skilled in the art can apply this application to other similar situations based on these drawings without any creative effort. Furthermore, it is understood that although the work done in this development process may be complex and lengthy, for those skilled in the art, certain design, manufacturing, or production modifications made based on the technical content disclosed in this application are merely conventional technical means and should not be considered as insufficient disclosure of this application.

[0129] The term "embodiment" in this application refers to a specific feature, structure, or characteristic described in connection with an embodiment that may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily imply the same embodiment, nor does it imply that it is mutually exclusive with or independent of other embodiments. It will be clearly or implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0130] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of patent protection. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the appended claims.

Claims

1. A bastion host access control method based on a multi-service architecture, characterized in that, This is applicable to bastion hosts; the bastion host includes a client and worker nodes; the client has a management node; the worker nodes deploy a first service, a second service, and a third service to form a multi-service architecture; The first service connects to the target port of the client; The second service and the third service are respectively connected to the first service; the method includes: The first service receives a request initiated by a user in the client and completes authentication with the client based on the request; after successful authentication, it acquires session access traffic; the session access traffic integrates authentication credentials generated after successful authentication. Determine whether the current session access traffic belongs to an SSH session or an SFTP session; When the session is in the SSH session, based on the authentication credentials, the first service establishes an SSH communication link with the character assets accessed by the user through the second service; and processes the current session access traffic through the SSH communication link. When the session belongs to the SFTP session, based on the authentication credentials, the first service establishes an SFTP communication link with the character assets accessed by the user through the third service; and processes the current session access traffic through the SFTP communication link.

2. The bastion host access control method based on a multi-service architecture according to claim 1, characterized in that, The method further includes: After determining whether the current session access traffic belongs to an SSH session or an SFTP session based on the channel type of the request, and after completing the processing of the request, the re-key exchange process is actively triggered.

3. The bastion host access control method based on a multi-service architecture according to claim 1, characterized in that, The first service, the second service, and the third service are deployed in at least one of the working nodes.

4. The bastion host access control method based on a multi-service architecture according to claim 1, characterized in that, The third service is deployed on one of the working nodes; the first service and the second service are deployed on another working node.

5. The bastion host access control method based on a multi-service architecture according to claim 4, characterized in that, The method further includes: Configure an encryption protocol for encrypting data transmitted between the third service and the first service.

6. The bastion host access control method based on a multi-service architecture according to any one of claims 1 to 5, characterized in that, The method further includes: Configure corresponding file transfer rates for different users in the management node; When establishing the SSH communication link or the SFTP communication link, the corresponding file transfer rate is transmitted to the first service; Under the file transfer rate managed by the first service, the third service controls the corresponding file transfer rate based on the file transfer rate.

7. The bastion host access control method based on a multi-service architecture according to claim 6, characterized in that, The method further includes: Detect the resource utilization rate of the working node where the third service is located; When the resource utilization rate is detected to be lower than a preset utilization threshold, a rate request to increase the file transfer rate is initiated to the first service.

8. A bastion host access control device based on a multi-service architecture, characterized in that, This is applicable to bastion hosts; the bastion host includes a client and worker nodes; the client has a management node; the worker nodes deploy a first service, a second service, and a third service to form a multi-service architecture; The first service connects to the target port of the client; The second service and the third service are respectively connected to the first service; the device includes: an authentication module, a judgment module, a first communication module, and a second communication module; The authentication module is used to receive a request initiated by a user in the client in the first service, and complete authentication with the client according to the request; after successful authentication, it acquires session access traffic; the session access traffic integrates authentication credentials generated after successful authentication; The determination module determines whether the current session access traffic belongs to an SSH session or an SFTP session. The first communication module is used to, when belonging to the SSH session, enable the first service to establish an SSH communication link with the character assets accessed by the user through the second service based on the authentication credentials; and process the current session access traffic through the SSH communication link. The second communication module is used to, when belonging to the SFTP session, based on the authentication credentials, enable the first service to establish an SFTP communication link with the character assets accessed by the user through the third service; and process the current session access traffic through the SFTP communication link.

9. A computer device, comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the steps of the bastion host access control method based on a multi-service architecture as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the bastion host access control method based on a multi-service architecture as described in any one of claims 1 to 7.

Images