Intranet security operation and maintenance method and device based on bastion host, medium and program product

Abstract

The embodiment of the invention provides an intranet security operation and maintenance method and device based on a bastion host, a medium and a program product, and relates to the technical field of operation and maintenance management. The method comprises the following steps: in response to a connection request actively initiated by a zero-trust proxy client, establishing an end-to-end encrypted application layer tunnel between a zero-trust proxy server and the zero-trust proxy client under the condition that bidirectional authentication is passed; acquiring context information corresponding to the operation and maintenance terminal, and determining a dynamic authorization strategy based on the context information; and performing operation and maintenance management and control on the operation and maintenance operation of the operation and maintenance terminal based on the dynamic authorization strategy, and transmitting operation and maintenance traffic generated between the operation and maintenance terminal and the intranet resource side through the application layer tunnel. According to the embodiment of the invention, the zero-trust system model taking the internal resource side as the active connection end is constructed, and the dynamic authorization strategy is generated by acquiring the related context information in real time, so that the security of internal network operation and maintenance is greatly improved.

Description

Technical Field

[0001] This application relates to the field of operation and maintenance management technology, and more specifically, to an intranet security operation and maintenance method, device, media and program product based on a bastion host. Background Technology

[0002] As enterprises deepen their digital transformation, internal network environments are becoming increasingly complex, typically exhibiting heterogeneous environments where physically isolated networks, multi-level VLANs (Virtual Local Area Networks), and cloud-based VPCs (Virtual Private Clouds) coexist. Against this backdrop, ensuring secure operational and maintenance access to internal network assets (such as servers, databases, and network devices) has become a critical challenge. Traditional security and maintenance solutions primarily rely on VPNs (Virtual Private Networks) or jump server models.

[0003] VPNs establish encrypted tunnels at the enterprise network boundary, enabling authorized operations and maintenance personnel to access internal network resources from the outside. However, this model has significant limitations: VPN deployment, configuration, and management are extremely complex, and its inherent "network layer penetration" characteristic creates a persistent channel at the enterprise boundary. If VPN credentials are leaked or unpatched vulnerabilities exist, attackers may exploit this channel for lateral movement, creating a large attack surface and thus failing to effectively guarantee internal traffic security. Furthermore, while bastion hosts (or jump servers) add an extra layer of protection, traditional jump server technologies are mostly based on a "boundary trust" model. Once the boundary is breached, the jump server itself becomes a key target, thus also suffering from the weakness of failing to guarantee internal traffic security.

[0004] In summary, an operation and maintenance management solution that can effectively ensure the security of internal traffic is needed. Summary of the Invention

[0005] The purpose of this application is to provide a method, device, medium, and program product for intranet security operation and maintenance based on a bastion host, so as to effectively ensure the security of internal traffic.

[0006] In a first aspect, embodiments of this application provide an intranet security operation and maintenance method based on a bastion host, applied to a bastion host, wherein a zero-trust proxy server is deployed in the bastion host, and the method includes: In response to a connection request initiated by the zero-trust proxy client, and provided that mutual authentication is successful, an end-to-end encrypted application layer tunnel is established between the zero-trust proxy server and the zero-trust proxy client; wherein, the zero-trust proxy client is deployed on the intranet resource side; Obtain the context information corresponding to the operation and maintenance terminal, and determine the dynamic authorization policy based on the context information; The operation and maintenance operations of the operation and maintenance terminal are controlled and managed based on the dynamic authorization policy, and the operation and maintenance traffic generated between the operation and maintenance terminal and the intranet resource side is transmitted through the application layer tunnel.

[0007] In this embodiment of the application, by constructing a zero-trust system model with the internal resource side as the active connection end, and by obtaining relevant context information in real time to generate dynamic authorization policies, the security of intranet operation and maintenance is greatly improved.

[0008] In some embodiments, the intranet security operation and maintenance method based on a bastion host further includes: Reacquire the context information corresponding to the operation and maintenance terminal according to the preset cycle; The corresponding dynamic authorization policy is redefined based on the reacquired context information.

[0009] In this embodiment, the reliability of operation and maintenance management is further improved by periodically re-acquiring context information and updating the dynamic authorization policy.

[0010] In some embodiments, the step of managing and controlling the operation and maintenance operations of the operation and maintenance terminal based on the dynamic authorization policy, and transmitting the operation and maintenance traffic generated between the operation and maintenance terminal and the intranet resource side through the application layer tunnel, includes: In response to an access request initiated by the operation and maintenance terminal for a target asset device in the intranet resource side, a login interface corresponding to the target asset device is fed back to the operation and maintenance terminal; If the authentication of the operation and maintenance terminal is successful through the login interface, the session credential corresponding to the target asset device is obtained from the preset credential library; An encrypted session is established between the maintenance terminal and the target asset device based on the session credentials; The operation and maintenance operations of the operation and maintenance terminal are controlled and managed based on the dynamic authorization policy, and the operation and maintenance traffic generated between the operation and maintenance terminal and the intranet resource side is transmitted through the application layer tunnel based on the encrypted session.

[0011] In this embodiment of the application, an encrypted session is established by automatically injecting credentials, which does not require user input, effectively avoiding credential exposure and further improving the reliability of operation and maintenance management.

[0012] In some embodiments, the operation and maintenance management of the operation and maintenance terminal based on the dynamic authorization policy includes: Obtain each maintenance operation instruction generated by the maintenance terminal for the intranet resource side; Based on the dynamic authorization strategy, the permissions of each operation and maintenance command are verified in real time. If the permission verification is successful, the operation and maintenance terminal is allowed to perform operation and maintenance tasks on the intranet resource side through the operation and maintenance operation instructions.

[0013] In this embodiment, the reliability of internal resource operation and maintenance management is further improved by continuously and dynamically verifying each operation and maintenance instruction in a refined manner.

[0014] In some embodiments, the intranet security operation and maintenance method based on a bastion host further includes: If the permission verification fails, the operation and maintenance command will be rejected, and an operation and maintenance anomaly alarm will be pushed to the administrator terminal.

[0015] In this embodiment of the application, when a verification failure occurs during the continuous dynamic verification process, the operation and maintenance instruction is rejected and an alarm message is triggered, thereby further improving the flexibility of internal resource operation and maintenance management.

[0016] In some embodiments, the intranet security operation and maintenance method based on a bastion host further includes: Real-time acquisition of operation and maintenance traffic transmitted in the application layer tunnel; The operation and maintenance traffic is parsed according to protocols, and the parsed data is converted into structured protocol data according to a preset structured format and stored in the audit database.

[0017] In this embodiment of the application, by performing protocol-level parsing and structured storage of traffic during the operation and maintenance process, the convenience of auditing and tracing the operation and maintenance management is further improved.

[0018] In some embodiments, prior to responding to a connection request initiated by a zero-trust proxy client, the method further includes: In response to a login request sent by the operation and maintenance terminal through the bastion host web portal, if the login request successfully passes the identity authentication, the operation and maintenance selection interface is fed back to the operation and maintenance terminal; Obtain the maintenance target information sent by the maintenance terminal based on the maintenance selection interface; Based on the operation and maintenance target information, a connection command is sent to the zero-trust proxy client, so that the zero-trust proxy client responds to the connection command and actively initiates a connection request.

[0019] In this embodiment, by authenticating the operation and maintenance terminal, the zero-trust proxy client is triggered to actively initiate a connection request, thereby further improving the reliability of internal resource operation and maintenance management.

[0020] In some embodiments, the context information includes at least one of the following: the resource object requested for access, the access initiation time, the identity information of the operation and maintenance personnel, the request protocol, the status of the operation and maintenance terminal device, and the real-time behavior risk level.

[0021] In this embodiment, context information is set from multiple aspects such as the accessed resource object and the access initiation time as the basis for generating dynamic authorization policies, thereby further improving the reliability of internal resource operation and maintenance management.

[0022] In some embodiments, the step of managing the operation and maintenance operations of the operation and maintenance terminal based on the dynamic authorization policy is to follow the principle of least privilege; wherein, the scope of privileges defined by the principle of least privilege includes at least one of a specific network port, a specific command set, and a specific application URL path.

[0023] In this embodiment of the application, the reliability of internal resource operation and maintenance management is further improved by following the principle of least privilege during the operation and maintenance management process.

[0024] Secondly, embodiments of this application provide an intranet security operation and maintenance device based on a bastion host, applied to a bastion host, wherein a zero-trust proxy server is deployed in the bastion host, and the device includes: The tunnel establishment module is used to respond to connection requests initiated by the zero-trust proxy client and, upon successful two-way authentication, establish an end-to-end encrypted application layer tunnel between the zero-trust proxy server and the zero-trust proxy client; wherein, the zero-trust proxy client is deployed on the intranet resource side; The strategy determination module is used to obtain the context information corresponding to the operation and maintenance terminal, and determine the dynamic authorization strategy based on the context information; The operation and maintenance management module is used to control the operation and maintenance operations of the operation and maintenance terminal based on the dynamic authorization policy, and to transmit the operation and maintenance traffic generated between the operation and maintenance terminal and the intranet resource side through the application layer tunnel.

[0025] Thirdly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement the method described in any embodiment of the first aspect.

[0026] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0027] Fifthly, embodiments of this application provide a computer program product, the computer program product including a computer program, wherein when the computer program is executed by a processor, it can implement the method described in any embodiment of the first aspect. Attached Figure Description

[0028] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 A flowchart illustrating an intranet security operation and maintenance method based on a bastion host, provided as an embodiment of this application; Figure 2 A schematic diagram of the structure of an intranet security operation and maintenance device based on a bastion host provided in this application embodiment; Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0030] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0031] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0032] It should be noted that traditional bastion hosts primarily achieve internal network resource operation and maintenance access management through VPN or jump server modes. This operation and maintenance management solution faces the following challenges: 1. Insufficient adaptability to complex network environments: Traditional VPNs are complex to deploy and manage in multi-cloud, hybrid cloud, or deeply isolated intranet environments, and once a VPN tunnel is established, its "hole punching" mode can create a large attack surface. Jump servers increase the complexity of the operation and maintenance path and require the maintenance of additional host resources.

[0033] 2. The Challenges of Fine-Grained Access Control and Dynamic Authorization: Traditional bastion hosts typically manage authorization based on IP addresses or hosts, making it difficult to dynamically, on-demand, and grant the least privilege authorization for specific ports, services, or even commands. When temporarily granting access to external personnel or authorizing individual tasks, the process is cumbersome and risky.

[0034] 3. Lack of Zero-Trust Architecture: Existing technologies are mostly based on the "boundary trust" model. Once the boundary is breached, the security of internal traffic is difficult to guarantee. In situations where the security of the external user terminal environment is uncertain, how to achieve an access mechanism of "never trusting, always verifying" becomes a key challenge.

[0035] 4. Difficulty in large-scale deployment and elastic scaling: When it is necessary to maintain a large number of intranet assets scattered in different network areas, traditional solutions have poor scalability and high maintenance costs.

[0036] 5. Limitations on the completeness of auditing and tracing: Although bastion hosts have auditing capabilities, ensuring that all cross-network and cross-protocol operation and maintenance behaviors can be seamlessly captured, recorded and traced in complex intranet scenarios remains a challenge.

[0037] To address at least one of the problems existing in the prior art, this application provides a bastion host intranet security operation and maintenance solution based on the zero-trust concept, aiming to solve the shortcomings of existing intranet operation and maintenance solutions in terms of security operation and maintenance, fine-grained authorization, continuous identity verification, and comprehensive operation auditing in multi-heterogeneous network environments.

[0038] like Figure 1 As shown in the figure, this application provides an intranet security operation and maintenance method based on a bastion host, applied to a bastion host, in which a zero-trust proxy server is deployed. The method may include the following steps: S1. In response to a connection request initiated by the zero-trust proxy client, and provided that mutual authentication is successful, establish an end-to-end encrypted application layer tunnel between the zero-trust proxy server and the zero-trust proxy client; wherein, the zero-trust proxy client is deployed on the intranet resource side.

[0039] It should be noted that the operation and maintenance management system mainly includes operation and maintenance terminals, bastion hosts, and internal network resource side. The internal network resource side has one or more asset devices, and the bastion host is used to isolate the internal network resource side from the outside network.

[0040] First, deploy a Zero Trust Connection Proxy (ZTCP) on the operation and maintenance management system. Specifically, deploy the ZTCP server (Zero Trust Proxy server) on the bastion host side, serving as the unified entry point for all intranet resource access; and deploy the ZTCP client (Zero Trust Proxy client) on the intranet resource side, which is responsible for establishing reverse, encrypted, and two-way authenticated connections with the ZTCP server.

[0041] It's important to note that the ZTCP client can proactively initiate a connection request to the ZTCP server at appropriate times (e.g., based on preset working hours), rather than the server proactively accessing the intranet. The connection establishment process includes client authentication (based on digital certificates or dynamic keys) to ensure that only legitimate intranet proxies can connect to the bastion host. Once authentication (mutual authentication) is successful, a persistent application tunnel can be established between the ZTCP client and the ZTCP server, and all traffic passing through this tunnel undergoes end-to-end encryption.

[0042] It's important to note that in the traditional bastion host proactive connection mode, the network layer's listening ports and service vulnerabilities are exposed, representing the attack surface at the operating system and application levels. In contrast, in the client-initiated zero-trust connection mode, a strongly authenticated, encrypted communication endpoint at the application layer is exposed. It's easy to understand that the traditional method is like opening a door on each internal network server; although only the bastion host is allowed to open it, the door itself exists, and weaknesses in the lock and frame can be exploited. The method in this application's embodiment is like having no door at all, only a dedicated encrypted telephone line; attackers can't even find a place to "knock." From the attacker's perspective, in the traditional mode, after breaching the bastion host, they can directly scan and attack the internal network server's service ports; however, in the zero-trust mode of this application's embodiment, after breaching the bastion host, they only encounter a tunnel management interface. To access specific internal network resources, they must go through those established, two-way authenticated encrypted tunnels.

[0043] In some embodiments, prior to responding to a connection request initiated by a zero-trust proxy client, the method further includes: In response to a login request sent by the operation and maintenance terminal through the bastion host web portal, if the authentication is successfully passed based on the login request, the operation and maintenance selection interface is displayed to the operation and maintenance terminal. Obtain the maintenance target information sent by the maintenance terminal based on the maintenance selection interface; Based on the operation and maintenance target information, a connection command is sent to the zero-trust agent client, so that the zero-trust agent client responds to the connection command and actively initiates a connection request.

[0044] It should be noted that this scenario assumes a company has data centers and cloud platforms in multiple locations, with strict isolation between their internal networks. An operations engineer at headquarters needs to perform an emergency configuration change on a Linux server within a specific VPC in another data center (let's say A). The operations engineer can submit the operation request through the login portal provided by the bastion host. Since the engineer's local terminal environment is complex and cannot directly expose internal network credentials, the bastion host internal network operations management solution based on a zero-trust system provided in this application effectively improves the security of operations management.

[0045] Specifically, operations and maintenance personnel can first log in through the bastion host web portal and complete multi-factor authentication (e.g., username / password + one-time password).

[0046] Understandably, on the bastion host's web login interface, operations and maintenance personnel can select the target information for their operations and maintenance needs, that is, which specific asset device to access using which communication protocol. For example, they can select the "Linux Production Server-01" asset device under "A Data Center-VPC" and choose the SSH protocol for access.

[0047] Based on the operational goals information entered by the operations and maintenance personnel, the bastion host can send connection commands to the corresponding zero-trust proxy clients, such as initiating a connection command to the ZTCP client pre-installed on "Linux Production Server-01". In this way, the corresponding zero-trust proxy client will respond to the connection command and actively initiate a connection request. After two-way authentication (such as TLS authentication through the digital certificates of both parties) is successfully completed, an encrypted and persistent application layer tunnel is established between the ZTCP client and the ZTCP server. This tunnel only carries traffic for specific applications (SSH) and does not connect to the entire network.

[0048] S2. Obtain the context information corresponding to the operation and maintenance terminal, and determine the dynamic authorization policy based on the context information.

[0049] In some embodiments, the context information includes at least one of the following: the resource object requested for access, the time the access was initiated, the identity information of the operation and maintenance personnel, the request protocol, the status of the operation and maintenance terminal device, and the real-time behavior risk level.

[0050] For example, step S2 can be implemented by the Identity-Aware & Dynamic Authorization Engine (IDAE). When an operations and maintenance personnel initiates an access request to intranet resources through an operations and maintenance terminal (e.g., via SSH, RDP, Web, etc.), the bastion host first performs identity authentication (multi-factor authentication); then, the IDAE module performs real-time and dynamic authorization assessment based on contextual information such as the operations and maintenance personnel's identity, role, requested resources, time, terminal device status, and even the current behavior risk level.

[0051] It should be noted that during the access phase of the maintenance terminal and during the maintenance operation, the bastion host can obtain the context information corresponding to the current maintenance terminal in real time, including the resource object requested for access, the access initiation time, the identity information of the maintenance personnel, the request protocol, the status of the maintenance terminal device, and real-time behavioral risks.

[0052] For example, the requested resource object refers to the specific asset device on the internal network resource terminal that the operation and maintenance terminal wants to perform operation and maintenance operations on, such as "Linux production server-01"; the access initiation time refers to the time when the current operation and maintenance operation is initiated, mainly used to determine whether it is within the allowed working hours; the operation and maintenance personnel identity information refers to the identity information of the personnel performing the operation on the current operation and maintenance terminal, mainly used to determine the permission level and scope, such as determining that the operation and maintenance personnel belong to the "Linux operation and maintenance group"; the request protocol refers to the communication protocol to be adopted for the current operation and maintenance operation, such as SSH (Secure Shell); the operation and maintenance terminal device status refers to the relevant basic information of the operation and maintenance terminal, including whether antivirus software is installed, whether the security baseline is met, etc.; real-time behavioral risk refers to the current risk level of the operation and maintenance personnel, for example, the system can determine whether there is any abnormality based on the historical behavior of the operation and maintenance personnel, and dynamically determine the security risk level.

[0053] In this way, the corresponding dynamic authorization policy can be determined based on the context information obtained in real time. For example, the evaluation result of IDAE (dynamic authorization policy) is: allow the operator to access port 22 of "Linux production server-01" via SSH, and only allow execution of the command "sudo systemctl restart nginx". Other high-risk commands such as "rm -rf / " will be blocked.

[0054] S3. Based on dynamic authorization policies, the operation and maintenance operations of the operation and maintenance terminal are controlled and managed, and the operation and maintenance traffic generated between the operation and maintenance terminal and the internal network resource side is transmitted through the application layer tunnel.

[0055] In some embodiments, the steps for managing the operation and maintenance operations of the operation and maintenance terminal based on the dynamic authorization policy are to follow the principle of least privilege; wherein, the scope of privileges defined by the principle of least privilege includes at least one of a specific network port, a specific command set, and a specific application URL path.

[0056] It should be noted that the Identity Awareness and Dynamic Authorization Engine (IDAE) can also manage and control the operations of maintenance terminals based on dynamic authorization policies. For example, IDAE can adopt the principle of least privilege to ensure that only the minimum permissions required to complete the current maintenance task are granted, such as allowing access to a specific port of a server, allowing the execution of a specific set of commands, or allowing access to a specific URL path of a web application.

[0057] It's important to note that during operations and maintenance (O&M), the IDAE module continuously monitors the behavior of O&M personnel. If authorization is successful, O&M traffic between the O&M terminal and the internal network resource side can be transmitted through the application layer tunnel. This includes access requests (O&M operation instructions) initiated by the O&M terminal to the internal network resource side, as well as response information returned by the internal network resource side. If any anomalies or operations outside the authorized scope occur during O&M management, alerts can be immediately triggered, blocking or requiring re-authentication, reflecting the core principle of zero trust: "Never trust, always verify."

[0058] For example, after the operations engineer completes the operation and maintenance task, they can log out of the SSH session. At this time, the bastion host can terminate the SSH connection and disconnect the specific application tunnel between the ZTCP server and the ZTCP client. It is understood that for this operation and maintenance operation, all audit data such as command logs, recordings, and alarm information generated through this session are securely archived to the bastion host audit database for later query and backtracking.

[0059] Based on this, by constructing a zero-trust system model with the internal resource side as the active connection end, and by obtaining relevant context information in real time to generate dynamic authorization policies, the security of intranet operation and maintenance is greatly improved.

[0060] In some embodiments, the intranet security operation and maintenance method based on a bastion host further includes: Reacquire the context information corresponding to the operation and maintenance terminal according to the preset cycle; The corresponding dynamic authorization policy is redefined based on the reacquired context information.

[0061] It should be noted that during the operation and maintenance management process, a preset cycle can be set, and the context information corresponding to the operation and maintenance terminal can be re-acquired periodically based on this cycle, so as to update and determine the corresponding dynamic authorization policy according to the latest acquired context information.

[0062] In this way, the system can promptly detect changes in the status of maintenance terminals and achieve dynamic real-time maintenance management. For example, after the preset working time has elapsed, the system can update the dynamic authorization policy in a timely manner based on the current context information to prevent maintenance terminals from performing maintenance operations after the specified time.

[0063] Based on this, the reliability of operation and maintenance management can be further improved by periodically re-acquiring context information and updating dynamic authorization policies.

[0064] In some embodiments, operation and maintenance operations of the operation and maintenance terminal are controlled based on a dynamic authorization policy, and operation and maintenance traffic generated between the operation and maintenance terminal and the intranet resource side is transmitted through an application layer tunnel, including: In response to the access request initiated by the operation and maintenance terminal for the target asset device in the intranet resource side, the login interface corresponding to the target asset device is fed back to the operation and maintenance terminal; If the authentication of the operation and maintenance terminal is successful through the login interface, the session credential corresponding to the target asset device is obtained from the preset credential library. Establish an encrypted session between the maintenance terminal and the target asset device based on session credentials; The operation and maintenance of the operation and maintenance terminal is controlled based on the dynamic authorization policy, and the operation and maintenance traffic generated between the operation and maintenance terminal and the internal network resource side is transmitted through the application layer tunnel based on the encrypted session.

[0065] It should be noted that after establishing an end-to-end encrypted application tunnel, it is also necessary to establish an encrypted session between the operation and maintenance terminal and the specific asset device being operated.

[0066] It's important to note that bastion hosts can have a built-in encrypted credential repository to securely store sensitive information such as account passwords and API keys for all target assets. When operations and maintenance personnel access target assets, they do not need to directly handle or enter sensitive credentials. The bastion host automatically injects credentials based on identity authentication and dynamic authorization, achieving passwordless operations and maintenance (relative to the target asset) from the operations and maintenance end.

[0067] For example, the bastion host can push an SSH web terminal interface (login interface) to the web browser of the operations and maintenance personnel. The operations and maintenance personnel can try to log in on this interface, for example, by entering authentication information (username + password). After the bastion host completes the authentication of the operations and maintenance personnel's terminal, the bastion host (acting as an SSH proxy) can automatically extract the corresponding session credentials (such as SSH key or username / password) of the target asset device from the internal credential repository and inject them into the SSH connection. The operations and maintenance personnel do not need to manually enter them, as this avoids exposing the credential information on the operations and maintenance personnel's terminal side.

[0068] Based on this, establishing encrypted sessions by automatically injecting credentials, without requiring user input, can effectively prevent credential exposure and further improve the reliability of operation and maintenance management.

[0069] In some embodiments, operation and maintenance management is performed on the operation and maintenance operations of the operation and maintenance terminal based on a dynamic authorization policy, including: Obtain every maintenance operation instruction generated by the maintenance terminal for the intranet resource side; Based on a dynamic authorization strategy, the permissions of each operation and maintenance command are verified in real time. Once authorization is verified, the operation and maintenance terminal is allowed to perform operation and maintenance tasks on the intranet resource side via operation and maintenance operation commands.

[0070] In some embodiments, the intranet security operation and maintenance method based on a bastion host further includes: If the permission verification fails, the operation and maintenance command will be rejected, and an operation and maintenance anomaly alarm will be pushed to the administrator terminal.

[0071] It should be noted that the bastion host can monitor and acquire every operation and maintenance command generated by the operation and maintenance terminal on the internal network resource side and perform permission verification to achieve refined operation and real-time auditing.

[0072] For example, suppose an engineer successfully logs into the server and connects to an asset device (Linux production server-01). He first executes the `ls -l / ` command (this is a Linux and Unix command, meaning to view the detailed attributes of all visible files in the current directory in long format). The bastion host can parse the SSH traffic in real time and record the `ls -l / ` command and its output through the Protocol Parsing & Session Reconstruction Auditing Module (PPSRAM).

[0073] When an operations and maintenance personnel attempts to execute the command `sudo rm -rf / tmp / test.txt`, the PPSRAM module, based on the dynamic authorization policy, identifies this as a prohibited high-risk command. The bastion host can then immediately block the execution of the command and send a "insufficient permissions" message to the engineer's terminal, while also pushing an alarm message to the administrator.

[0074] Next, suppose the operations and maintenance personnel try to execute the command `sudo systemctl restart nginx`. The PPSRAM module confirms that the command is within the authorized scope, so it allows execution and records the command and its execution result.

[0075] Based on this, by continuously and dynamically verifying each operation and maintenance command in a refined manner, the reliability of internal resource operation and maintenance management can be further improved.

[0076] In some embodiments, the intranet security operation and maintenance method based on a bastion host further includes: Real-time acquisition of operational traffic transmitted in the application layer tunnel; The operation and maintenance traffic is parsed according to the protocol, and the parsed data is converted into structured protocol data according to the preset structured format and stored in the audit database.

[0077] It should be noted that during the operation and maintenance management process, especially during the entire SSH session, the PPSRAM module can pull all operation and maintenance traffic in real time and perform detailed protocol interpretation, including command input, output, blocking records, etc. It can also record screen recordings. At the same time, this information and data are structured and stored in the audit database for subsequent auditing and tracing.

[0078] Specifically, the PPSRAM module can perform in-depth analysis on various operation and maintenance traffic (including SSH, RDP, Web, and other protocol data) transmitted through the ZTCP tunnel.

[0079] For example, for SSH / Telnet protocols: it captures and records all command input, output, file transfers, etc., and can intercept high-risk commands in real time. For RDP / VNC (Remote Desktop Protocol / Virtual Network Console): it can record complete graphical sessions and identify key application window titles and user behavior events (such as file copying and pasting). For the Web: it can parse HTTP / HTTPS requests, identify URLs, form submissions (including sensitive field information), click events, etc., and can perform page-level screen recording.

[0080] Understandably, the parsed data can be stored in a structured manner, which enables the playback and search capabilities of historical sessions, thus facilitating behavior tracing.

[0081] Based on this, by performing protocol-level parsing and structured storage of traffic during the operation and maintenance process, the convenience of auditing and tracing in operation and maintenance management can be further improved.

[0082] It should be noted that, through the process of this application embodiment, zero-trust security operation and maintenance of sensitive production servers is achieved in a complex network environment: there is no need to directly expose the internal network connection port or the credentials, and the operation and maintenance permissions are strictly limited and the operation and maintenance behavior is controllable. At the same time, all operations are comprehensively and meticulously audited and recorded, which greatly improves the security and compliance of operation and maintenance.

[0083] Specifically, the embodiments of this application have at least the following beneficial effects compared to the prior art: 1. Achieve more secure intranet operation and maintenance: By establishing application-layer reverse tunnels and two-way authentication through ZTCP, there is no need to break through large-scale network boundaries, which fundamentally eliminates the "hole punching" risk of traditional VPNs and the management burden of jump servers, and realizes point-to-point intranet access with minimal exposure.

[0084] 2. Enhance zero-trust secure access capabilities: By combining identity awareness and dynamic authorization engine, continuous verification and on-demand authorization of operation and maintenance personnel and terminals are achieved, ensuring the implementation of the "never trust, always verify" security policy and greatly improving the security of intranet operation and maintenance.

[0085] 3. Provides highly granular authorization: It can perform multi-dimensional, dynamic, and minimal-granular authorization based on user identity, resource type, operation type, time, terminal environment, and even behavioral risks, effectively reducing operational security risks.

[0086] 4. Comprehensive and traceable operation and maintenance audit: Through the protocol parsing and session reconstruction audit module, it performs in-depth analysis and auditing of various operation and maintenance protocols and complete recording, including command level, form level and event level, and with the help of visual playback, it provides tamper-proof and high-value data for security incident analysis and compliance audit.

[0087] 5. Simplified deployment and elastic scaling: The ZTCP client can be deployed lightweight on the intranet asset side without complex network topology modifications, making it easy to deploy and scale elastically in large-scale, heterogeneous network environments.

[0088] 6. Improve operational efficiency and user experience: Operation and maintenance personnel no longer need to remember a large number of credentials. They can access intranet resources with authorization through a unified portal, and there is no need to install complicated plugins on the client side, which greatly improves operational efficiency and user experience.

[0089] Please refer to Figure 2 , Figure 2 This document illustrates a block diagram of a bastion host-based intranet security operation and maintenance device provided in some embodiments of this application. It should be understood that this bastion host-based intranet security operation and maintenance device is similar to the one described above. Figure 1 Corresponding to the method embodiments, it is able to execute the various steps involved in the above method embodiments. The specific functions of the intranet security operation and maintenance device based on the bastion host can be found in the description above. To avoid repetition, detailed descriptions are appropriately omitted here.

[0090] Figure 2 The bastion host-based intranet security operation and maintenance device includes at least one software function module that can be stored in memory or embedded in the bastion host-based intranet security operation and maintenance device in the form of software or firmware. This bastion host-based intranet security operation and maintenance device is applied to a bastion host, which deploys a zero-trust proxy server. The device includes: The tunnel establishment module 210 is used to respond to the connection request initiated by the zero-trust proxy client and establish an end-to-end encrypted application layer tunnel between the zero-trust proxy server and the zero-trust proxy client after the two-way authentication is successful; wherein, the zero-trust proxy client is deployed on the intranet resource side; The policy determination module 220 is used to obtain the context information corresponding to the operation and maintenance terminal, and determine the dynamic authorization policy based on the context information; The operation and maintenance management module 230 is used to control the operation and maintenance operations of the operation and maintenance terminal based on dynamic authorization policies, and to transmit the operation and maintenance traffic generated between the operation and maintenance terminal and the internal network resource side through the application layer tunnel.

[0091] It is understood that the above-described device embodiments correspond to the method embodiments of the present invention. The intranet security operation and maintenance device based on a bastion host provided by the embodiments of the present invention can implement the intranet security operation and maintenance method based on a bastion host provided by any one of the method embodiments of the present invention.

[0092] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the aforementioned method, and will not be elaborated further here.

[0093] like Figure 3 As shown, some embodiments of this application provide an electronic device 300, which includes a memory 310, a processor 320, and a computer program stored in the memory 310 and executable on the processor 320. When the processor 320 reads the program from the memory 310 via a bus 330 and executes the program, it can implement any of the methods included in the above-described intranet security operation and maintenance method based on a bastion host.

[0094] Processor 320 can process digital signals and may include various computing architectures. For example, it may be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 320 may be a microprocessor.

[0095] The memory 310 can be used to store instructions executed by the processor 320 or data related to the execution of instructions. These instructions and / or data may include code used to implement some or all of the functions of one or more modules described in the embodiments of this application. The processor 320 of this disclosure embodiment can be used to execute the instructions in the memory 310 to implement the methods shown above. The memory 310 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0096] Some embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, describes the method described in the method embodiments.

[0097] Some embodiments of this application also provide a computer program product that, when run on a computer, causes the computer to perform the methods described in the method embodiments.

[0098] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For apparatus embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0099] It should be understood, in the several embodiments provided in this application, that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0100] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0101] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0102] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0103] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0104] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for internal network security operation and maintenance based on a bastion host, characterized in that, The method is applied to a bastion host in which a zero-trust proxy server is deployed, and the method comprises the following steps: In response to a connection request initiated by a zero-trust proxy client, an end-to-end encrypted application layer tunnel is established between the zero-trust proxy server and the zero-trust proxy client in the case of successful mutual authentication. The context information corresponding to the operation and maintenance terminal is obtained, and a dynamic authorization policy is determined based on the context information. The operation and maintenance operation of the operation and maintenance terminal is controlled based on the dynamic authorization policy, and the operation and maintenance traffic generated between the operation and maintenance terminal and the internal network resource side is transmitted through the application layer tunnel.

2. The bastion host-based internal network security operation and maintenance method according to claim 1, characterized in that, Further comprising: The context information corresponding to the operation and maintenance terminal is reacquired according to a preset period. The corresponding dynamic authorization policy is re-determined based on the reacquired context information.

3. The method of claim 1, wherein the method further comprises: The operation and maintenance operation of the operation and maintenance terminal is controlled based on the dynamic authorization policy, and the operation and maintenance traffic generated between the operation and maintenance terminal and the internal network resource side is transmitted through the application layer tunnel, comprising: In response to an access request initiated by the operation and maintenance terminal to a target asset device in the internal network resource side, a login interface corresponding to the target asset device is fed back to the operation and maintenance terminal. In the case that the identity of the operation and maintenance terminal is verified through the login interface, a session credential corresponding to the target asset device is obtained from a preset credential library. An encrypted session between the operation and maintenance terminal and the target asset device is established based on the session credential. The operation and maintenance operation of the operation and maintenance terminal is controlled based on the dynamic authorization policy, and the operation and maintenance traffic generated between the operation and maintenance terminal and the internal network resource side is transmitted through the application layer tunnel based on the encrypted session.

4. The bastion host-based internal network security operation and maintenance method according to claim 1, characterized in that, The operation and maintenance operation of the operation and maintenance terminal is controlled based on the dynamic authorization policy, comprising: Each operation and maintenance operation instruction generated by the operation and maintenance terminal to the internal network resource side is obtained. The permission of each operation and maintenance operation instruction is verified in real time based on the dynamic authorization policy. In the case that the permission verification is passed, the operation and maintenance terminal is allowed to perform operation and maintenance work on the internal network resource side through the operation and maintenance operation instruction.

5. The bastion host-based internal network security operation and maintenance method according to claim 4, characterized in that, Further comprising: In the case that the permission verification is not passed, the operation and maintenance operation instruction is rejected, and operation and maintenance exception alarm information is pushed to the administrator terminal.

6. The bastion host-based internal network security operation and maintenance method according to claim 1, characterized in that, Further comprising: The operation and maintenance traffic transmitted in the application layer tunnel is obtained in real time. The operation and maintenance traffic is protocol-analyzed, the data obtained by the protocol analysis is converted into structured protocol data according to a preset structured format, and the structured protocol data is stored in an audit database.

7. The bastion host-based internal network security operation and maintenance method according to claim 1, characterized in that, Before the step of responding to the connection request initiated by the zero-trust proxy client, the method further comprises the following steps: In response to a login request sent by the operation and maintenance terminal through the Web portal of the bastion host, an operation and maintenance selection interface is fed back to the operation and maintenance terminal in the case that the identity authentication based on the login request is passed successfully. The operation and maintenance target information sent by the operation and maintenance terminal based on the operation and maintenance selection interface is obtained. The connection instruction is sent to the zero-trust proxy client based on the operation and maintenance target information, so that the zero-trust proxy client responds to the connection instruction and initiates a connection request actively.

8. The bastion host-based internal network security operation and maintenance method according to claim 1, characterized in that, The context information includes at least one of a resource object requested to be accessed, an access initiation time, operation and maintenance personnel identity information, a request protocol, an operation and maintenance terminal device state, and a real-time behavior risk level.

9. The bastion host-based internal network security operation and maintenance method according to claim 1, characterized in that, The operation and maintenance operation of the operation and maintenance terminal based on the dynamic authorization strategy is controlled in compliance with a least privilege principle, and the permission range defined by the least privilege principle includes at least one of a specific network port, a specific command set, and a specific application URL path.

10. An electronic device, comprising: The computer readable storage medium stores a computer program, and the computer program is run on the processor to implement the method for internal network security operation and maintenance based on a bastion host according to any one of claims 1-9.

11. A computer readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is run on the processor to implement the method for internal network security operation and maintenance based on a bastion host according to any one of claims 1-9.

12. A computer program product, characterised in that, The computer program product includes a computer program, and the computer program is run on the processor to implement the method for internal network security operation and maintenance based on a bastion host according to any one of claims 1-9.

Images