WO2024198734A1 - 访问管理的方法和系统 - Google Patents

访问管理的方法和系统 Download PDF

Info

Publication number
WO2024198734A1
WO2024198734A1 PCT/CN2024/075967 CN2024075967W WO2024198734A1 WO 2024198734 A1 WO2024198734 A1 WO 2024198734A1 CN 2024075967 W CN2024075967 W CN 2024075967W WO 2024198734 A1 WO2024198734 A1 WO 2024198734A1
Authority
WO
WIPO (PCT)
Prior art keywords
maintenance channel
client
access command
access
instance
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2024/075967
Other languages
English (en)
French (fr)
Inventor
谢鹏
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Cloud Computing Technologies Co Ltd
Original Assignee
Huawei Cloud Computing Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Cloud Computing Technologies Co Ltd filed Critical Huawei Cloud Computing Technologies Co Ltd
Priority to EP24777528.1A priority Critical patent/EP4679791A4/en
Publication of WO2024198734A1 publication Critical patent/WO2024198734A1/zh
Priority to US19/343,534 priority patent/US20260032124A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/085—Retrieval of network configuration; Tracking network configuration history
    • H04L41/0853—Retrieval of network configuration; Tracking network configuration history by actively collecting configuration information or by backing up configuration information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/50—Network service management, e.g. ensuring proper service fulfilment according to agreements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0806—Configuration setting for initial configuration or provisioning, e.g. plug-and-play
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/28—Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1001—Protocols in which an application is distributed across nodes in the network for accessing one among a plurality of replicated servers
    • H04L67/1004—Server selection for load balancing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1001—Protocols in which an application is distributed across nodes in the network for accessing one among a plurality of replicated servers
    • H04L67/1029—Protocols in which an application is distributed across nodes in the network for accessing one among a plurality of replicated servers using data related to the state of servers by a load balancer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0654—Management of faults, events, alarms or notifications using network fault recovery
    • H04L41/0668—Management of faults, events, alarms or notifications using network fault recovery by dynamic selection of recovery network elements, e.g. replacement by the most appropriate element after failure
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0895—Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/06—Generation of reports
    • H04L43/065—Generation of reports related to network devices

Definitions

  • the embodiments of the present application relate to the field of cloud computing, and more specifically, to a method and system for access management.
  • cloud service providers need to manage more and more cloud service resources, and the access security of cloud service resources is becoming more and more important. Therefore, many cloud service providers choose to deploy bastion hosts as a system for operation and maintenance security access audit to centrally manage user access requests to servers.
  • the existing bastion host system needs to record the user's login status and the session control established between the user and the server, which is called a stateful service. Since the bastion host nodes are all stateful, if you need to replace a node or add a new node, you need to reconfigure the state of the bastion host node. This process takes a certain amount of time, resulting in the bastion host system being unable to quickly recover from disasters or expand capacity. Therefore, how to enable the operation and maintenance channel management cluster to quickly replace nodes without disconnecting the connection has become a technical problem that needs to be solved urgently.
  • the embodiments of the present application provide a method and system for access management, which can record status information on a client located on a server.
  • the operation and maintenance channel instance distributes access commands to the client, making the operation and maintenance channel instance stateless, thereby being able to switch the operation and maintenance channel instance without interrupting the service.
  • a method for access management is provided, the method being applied to an access management system, the system comprising an operation and maintenance channel management cluster and a client, the client running on a target server, the operation and maintenance channel management cluster comprising multiple operation and maintenance channel instances, each operation and maintenance channel instance being used to interact with the client, each operation and maintenance channel instance being composed of at least one computing instance, the at least one computing instance comprising at least one of a physical host, a virtual machine, and a container, the method comprising: the operation and maintenance channel management cluster obtaining a user's access command to the target server; the operation and maintenance channel management cluster sending the access command to the client; the client executing the access command according to session status information, the session status information being the user's access information to the target server recorded by the client.
  • the operation and maintenance channel management cluster directly communicates with the client and distributes access commands to the client, so that the tasks of recording status information and managing sessions are completed by the client.
  • the operation and maintenance channel instance is stateless, so that while isolating the direct interaction between users and servers through the operation and maintenance channel management cluster and ensuring the security of server access, the operation and maintenance channel instance can be switched without interrupting the service, thereby solving the problem of rapid expansion and contraction of the operation and maintenance channel management cluster.
  • the operation and maintenance channel management cluster also includes a load balancing component
  • the multiple operation and maintenance channel instances include a first operation and maintenance channel instance and a second operation and maintenance channel instance
  • sending an access command to the client includes: the load balancing component sends the access command to the first operation and maintenance channel instance; the first operation and maintenance channel instance sends the access command to the client.
  • the operation and maintenance channel management cluster can manage the nodes responsible for distributing access commands, so that the operation and maintenance channel management cluster can autonomously regulate the working conditions of the nodes when necessary.
  • sending an access command to a client also includes: the first operation and maintenance channel instance reports exception information to the load balancing component, the exception information being used to indicate that the first operation and maintenance channel instance has failed to send an access command to the client; the load balancing component sends the access command to the second operation and maintenance channel instance; and the second operation and maintenance channel instance sends the access command to the client.
  • the forwarding task is reallocated to other nodes in the operation and maintenance channel management cluster, so as to achieve node switching without interrupting access, thereby improving the rapid disaster recovery or load balancing capabilities of the operation and maintenance channel management cluster and improving the availability of the operation and maintenance channel management cluster service.
  • the first operation and maintenance channel instance and the second operation and maintenance channel instance are deployed in different areas.
  • the nodes of the operation and maintenance channel management cluster can be deployed across regions, so that the nodes responsible for forwarding before and after the switch are located in different physical areas, reducing the possibility of simultaneous abnormalities, thereby achieving disaster recovery in different locations and further improving the availability of the operation and maintenance channel management cluster service.
  • sending an access command to a client also includes: the first operation and maintenance channel instance reports exception information to the load balancing component, the exception information being used to indicate that the first operation and maintenance channel instance has failed to send an access command to the client; the load balancing component establishes a third operation and maintenance channel instance; the load balancing component sends the access command to the third operation and maintenance channel instance; and the third operation and maintenance channel instance sends an access command to the client.
  • sending the access command to the client includes: the operation and maintenance channel management cluster sends the access command to the client according to the transmission control protocol.
  • the operation and maintenance channel instance and the client communicate directly through the transmission control protocol (TCP) of the transport layer, thereby avoiding the use of secure shell protocol (SSH) as a remote connection tool.
  • TCP transmission control protocol
  • SSH secure shell protocol
  • the server does not need to open the high-risk port 22 for the SSH service, thereby improving the security of the server.
  • the access command includes a session identifier
  • the session status information includes a correspondence between the session identifier and a subprocess in the operating system of the target server
  • the access command is executed based on the session status information, including: determining the subprocess corresponding to the session identifier based on the session identifier and the session status information of the access command; and calling the subprocess to execute the access command.
  • an identification value is assigned to each user's session through the client, and the session is managed based on the identification value carried in the user instruction, and the corresponding subprocess in the server operating system is called to execute the command, so that the client can manage the sessions of different users separately, thereby improving the efficiency of access management.
  • the method before obtaining the user's access command to the target server, the method also includes: the operation and maintenance channel management cluster obtains the user's login command; the operation and maintenance channel management cluster sends the login command to the authentication service, and the authentication service is used to authenticate the user's identity; the operation and maintenance channel management cluster receives authentication information from the authentication service; the operation and maintenance channel management cluster determines the user's login status based on the authentication information.
  • the operation and maintenance channel management cluster provides identity authentication for users by interacting with external services, so that the user's login status does not need to be recorded in the nodes of the operation and maintenance channel management cluster. Therefore, after the user logs in, the user does not need to log in again when the node providing the service is changed. On the basis of ensuring the security of user access, the user experience is improved.
  • the method before sending the access command to the client, the method also includes: the operation and maintenance channel management cluster obtains access rights from the external storage service; and the operation and maintenance channel management cluster determines that the access command satisfies the access rights.
  • the operation and maintenance channel management cluster obtains the user's access rights to the server from the external storage service, so that any node in the operation and maintenance channel management cluster can manage the user's access rights without pre-configuration, thereby improving the security of access management.
  • the method further includes: the client sends the execution result of the access command to the operation and maintenance channel management cluster; and the operation and maintenance channel management cluster sends the execution result to the user.
  • the access results are displayed to the user through the operation and maintenance channel management cluster, so that the operation and maintenance channel management cluster can monitor the entire process of user access to the server, facilitate the monitoring and auditing of user behavior, and improve the security of access management.
  • an access management system which includes an operation and maintenance channel management cluster and a client, the client runs on a target server, the operation and maintenance channel management cluster includes multiple operation and maintenance channel instances, each operation and maintenance channel instance is used to interact with the client, each operation and maintenance channel instance is composed of at least one computing instance, and the at least one computing instance includes at least one of a physical host, a virtual machine, and a container.
  • the operation and maintenance channel management cluster includes: a command acquisition module, used to obtain a user's access command to the target server; a command distribution module, used to send the access command to the client; the client is used to: execute the access command according to the session status information, the session status information is the user's access information to the target server recorded by the client.
  • the operation and maintenance channel management cluster also includes a load balancing component, the multiple operation and maintenance channel instances include a first operation and maintenance channel instance and a second operation and maintenance channel instance, and a command distribution module, which is used for: the load balancing component sends the access command to the first operation and maintenance channel instance; the first operation and maintenance channel instance sends the access command to the client.
  • the command distribution module is further used to: the first operation and maintenance channel instance reports abnormal information to the load balancing component, where the abnormal information is used to indicate that the first operation and maintenance channel instance fails to send an access command to the client; the load balancing component The component sends the access command to the second operation and maintenance channel instance; the second operation and maintenance channel instance sends the access command to the client.
  • the first operation and maintenance channel instance and the second operation and maintenance channel instance are deployed in different areas.
  • the command distribution module is also used for: the first operation and maintenance channel instance reports exception information to the load balancing component, the exception information is used to indicate that the first operation and maintenance channel instance failed to send an access command to the client; the load balancing component establishes a third operation and maintenance channel instance; the load balancing component sends the access command to the third operation and maintenance channel instance; the third operation and maintenance channel instance sends the access command to the client.
  • the command distribution module is used to: send an access command to the client according to the transmission control protocol.
  • the access command includes a session identifier
  • the session status information includes a correspondence between the session identifier and a subprocess in the operating system of the target server
  • the client is used to: determine the subprocess corresponding to the session identifier based on the session identifier and session status information of the access command; and call the subprocess to execute the access command.
  • the operation and maintenance channel management cluster also includes a login authentication module, which, before obtaining the user's access command to the target server, is used to: obtain the user's login command; send the login command to the authentication service, which is used to authenticate the user's identity; receive authentication information from the authentication service; and determine the user's login status based on the authentication information.
  • a login authentication module which, before obtaining the user's access command to the target server, is used to: obtain the user's login command; send the login command to the authentication service, which is used to authenticate the user's identity; receive authentication information from the authentication service; and determine the user's login status based on the authentication information.
  • the operation and maintenance channel management cluster also includes a permission management module, which is used to: obtain access rights from an external storage service; and determine whether the access command satisfies the access rights before sending the access command to the client.
  • a permission management module which is used to: obtain access rights from an external storage service; and determine whether the access command satisfies the access rights before sending the access command to the client.
  • the client is also used to: send the execution result of the access command to the operation and maintenance channel management cluster; the operation and maintenance channel management cluster also includes a result display module for sending the execution result to the user.
  • a computing device comprising a processor and a memory, wherein the memory is used to store instructions, and the processor is used to call and execute the instructions from the memory, so that the computing device executes the method in the first aspect or any possible implementation of the first aspect.
  • a computing device cluster comprising at least one computing device, each computing device comprising a processor and a memory, wherein the memory is used to store instructions, and the processor is used to call and execute the instructions from the memory, so that the computing device cluster executes the method in the first aspect or any possible implementation of the first aspect.
  • the processor may be a general-purpose processor, which may be implemented by hardware or software.
  • the processor may be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor may be a general-purpose processor, which is implemented by reading software codes stored in a memory, which may be integrated in the processor or may be located outside the processor and exist independently.
  • a chip which obtains instructions and executes the instructions to implement the method in the above-mentioned first aspect or any possible implementation manner of the first aspect.
  • the chip includes a processor and a data interface, and the processor reads instructions stored in the memory through the data interface to execute the method in the above-mentioned first aspect or any possible implementation of the first aspect.
  • the chip may also include a memory, in which instructions are stored, and the processor is used to execute the instructions stored in the memory.
  • the processor is used to execute the method in the above-mentioned first aspect or any possible implementation method of the first aspect.
  • a computer program product comprising instructions is provided.
  • the computing device cluster executes the method in the above-mentioned first aspect or any possible implementation manner of the first aspect.
  • a computer-readable storage medium comprising computer program instructions.
  • the computing device cluster executes the method in the above-mentioned first aspect or any possible implementation manner of the first aspect.
  • these computer-readable storage media include, but are not limited to, one or more of the following: read-only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), Flash memory, electrically EPROM (EEPROM), and hard drive.
  • ROM read-only memory
  • PROM programmable ROM
  • EPROM erasable PROM
  • Flash memory electrically EPROM (EEPROM)
  • hard drive electrically EPROM
  • the above-mentioned storage medium may specifically be a non-volatile storage medium.
  • FIG1 is a schematic diagram of a bastion host system.
  • FIG. 2 is a schematic diagram of a system architecture for access management provided in an embodiment of the present application.
  • FIG3 is a schematic flowchart of an access management method provided in an embodiment of the present application.
  • FIG4 is a schematic flowchart of a scheduling and operation and maintenance channel example provided in an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of another access management method provided in an embodiment of the present application.
  • FIG. 6 is a schematic structural block diagram of an access management system provided in an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of an operation and maintenance channel management cluster in an access management system provided in an embodiment of the present application.
  • FIG8 is a schematic structural block diagram of a computing device provided in an embodiment of the present application.
  • FIG. 9 is a schematic structural block diagram of a computing device cluster provided in an embodiment of the present application.
  • FIG. 10 is a schematic structural block diagram of another computing device cluster provided in an embodiment of the present application.
  • the network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application.
  • a person of ordinary skill in the art can appreciate that with the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.
  • references to "one embodiment” or “some embodiments” etc. described in this specification mean that a particular feature, structure or characteristic described in conjunction with the embodiment is included in one or more embodiments of the present application.
  • the phrases “in one embodiment”, “in some embodiments”, “in some other embodiments”, “in some other embodiments”, etc. appearing in different places in this specification do not necessarily all refer to the same embodiment, but mean “one or more but not all embodiments", unless otherwise specifically emphasized in other ways.
  • the terms “including”, “comprising”, “having” and their variations all mean “including but not limited to”, unless otherwise specifically emphasized in other ways.
  • At least one means one or more
  • plural means two or more.
  • “And/or” describes the association relationship of associated objects, indicating that three relationships may exist.
  • a and/or B can mean: including the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural.
  • the character “/” generally indicates that the previous and next associated objects are in an “or” relationship.
  • “At least one of the following” or similar expressions refers to any combination of these items, including any combination of single or plural items.
  • At least one of a, b, or c can mean: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c can be single or multiple.
  • Operation and maintenance channel management cluster also called the operation and maintenance security audit system, it is responsible for the centralized management of user access to cloud service resources.
  • the operation and maintenance channel management cluster is responsible for receiving access commands entered by users and distributing the access commands to the servers where the cloud service resources are located, so that the system status, security events and network activities of each component in the network environment can be collected and monitored in real time, protecting the network and data from intrusion and damage from external or internal users, and facilitating centralized alarm, timely processing and auditing.
  • the operation and maintenance channel management cluster is also called a bastion host or a cloud bastion host.
  • Session control A session refers to a connection established when a terminal user communicates with an interactive system.
  • the session control object is used to store the attributes and configuration information required for a specific user to access a specific service. In this way, when a user jumps between services, the variables stored in the session control object will not be lost, but will continue to exist throughout the user session.
  • the server When a user requests access to a specific service, if the user does not have a session yet, the server will automatically create a session control object. For sessions that have established session control objects, the new access instructions sent by the user need to be executed based on the session state information stored in the session control object.
  • the session state information is the user's access information to the server. As an example, the session state information may include user identity, user preferences, access commands that the user has executed for the service, etc. When the session expires or is abandoned, the server will terminate the session.
  • cloud service providers need to manage more and more cloud service resources.
  • the number of users increases. If the server providing cloud service resources directly manages user access, each server will need to store and process a large amount of user information and access records, which is not conducive to centralized management of access rights, resulting in a large waste of computing resources and low access efficiency.
  • the importance of cloud service resources is increasing, so access security is becoming more and more important. If users are allowed to directly access the server, the server address will be exposed, there will be security risks, and it will be difficult to investigate and audit when attacked.
  • FIG 1 shows an existing bastion host system.
  • the bastion host system includes multiple bastion hosts, a user interface (portal), and a load balancing (nginx) component.
  • the bastion host is used to provide functions such as authentication, authorization, authentication, command auditing, behavior recording and playback.
  • the user interface is used to provide a front-end operation interface for users to log in to the bastion host and access cloud service resources.
  • the access command entered by the user through the user interface is forwarded to a bastion host through the load balancing component, and the bastion host sends the access command to the server where the target cloud service resource is located through the secure shell protocol (SSH).
  • SSH secure shell protocol
  • the bastion host since the bastion host needs to record the user's login status and the session control (session) established between the user and the server, it is called stateful. Since the bastion host nodes are all stateful, if you need to replace the node or add a new node, you need to reconfigure the state information of the bastion host node. As an example, if the bastion host cluster has N nodes, after the current single bastion host node fails, 1/N of the user's ongoing sessions may be disconnected, and the operation and maintenance personnel need to re-authenticate and establish a new connection. The whole process takes at least several minutes to recover. The stateful feature of the bastion host makes it impossible for the bastion host system to quickly recover from disasters or expand capacity. Therefore, how to enable the operation and maintenance channel management cluster to quickly replace nodes without disconnecting has become a technical problem that needs to be solved urgently.
  • an embodiment of the present application provides an access management method, which is applied to an access management system, the system comprising an operation and maintenance channel management cluster and a client running on a server.
  • the operation and maintenance channel instance By recording state information on the client located on the server, the operation and maintenance channel instance distributes access commands to the client, making the operation and maintenance channel instance stateless, so that the operation and maintenance channel instance can be switched without interrupting the service.
  • FIG2 shows a schematic diagram of the system architecture of access management provided by the present application.
  • the system includes an operation and maintenance channel management cluster 110 and a client 120 running on a server 20 .
  • the client 120 is used to establish and manage the user's session control object. Specifically, the client 120 stores session state information. When the client 120 receives an access command, it interacts with the operating system (OS) of the server 20 according to the session state information in the session control object, thereby executing the user's access command and returning the execution result of the access command to the user.
  • OS operating system
  • the operation and maintenance channel management cluster 110 is used to distribute the access commands input by the user, and can also display the execution results returned by the client 120 after executing the access command to the customer.
  • the operation and maintenance channel management cluster 110 is composed of multiple operation and maintenance channel instances 111, and each operation and maintenance channel instance 111 can be composed of one or more computing instances, wherein the computing instance can include at least one of a physical host (computing device), a virtual machine, and a container.
  • different operation and maintenance channel instances 111 can be distributed in different regions (regions), or in the same region, that is, each region can include multiple operation and maintenance channel instances, wherein different regions correspond to different physical areas.
  • the operation and maintenance channel management cluster 110 can also include a load balancing (nginx) component 112, which is used to forward the user's operation and maintenance request to access the operation and maintenance channel management cluster to a specific operation and maintenance channel instance 111.
  • nginx load balancing
  • the operation and maintenance channel management cluster 110 can transmit commands with the client 120 through the transmission control protocol (TCP).
  • TCP transmission control protocol
  • the operation and maintenance channel management cluster uses the secure shell protocol (SSH) as a remote connection tool with the server.
  • SSH secure shell protocol
  • the use of the SSH service requires opening port 22 of the server. This port has many vulnerabilities. Attackers can detect it for remote access and launch security attacks, thereby causing security risks to the server.
  • the components within the system can communicate directly through the TCP protocol of the transport layer, which can avoid the use of the SSH service, thereby improving the security of the server.
  • the system may further include a front-end component user interface 130.
  • the user interface 130 provides an access interface (such as an interface or an application program interface (API)).
  • the user can remotely access the access interface through an operation interface such as a web page or an application, register a cloud account and password in the user interface 130, and log in to the operation and maintenance channel management cluster 110.
  • an operation interface such as a web page or an application
  • register a cloud account and password in the user interface 130 register a cloud account and password in the user interface 130
  • log in to the operation and maintenance channel management cluster 110 After the operation and maintenance channel management cluster 110 successfully authenticates the cloud account and password, the user can further send an access command to the operation and maintenance channel management cluster 110 through the user interface 30, and the user interface 130 can also display the execution result returned by the operation and maintenance channel management cluster 110 to the user through the operation interface.
  • the operation and maintenance channel management cluster 110 can communicate with the user interface 130 via the WebSocket protocol.
  • the operation and maintenance channel management cluster 110 and the user interface 130 only need to complete a handshake once, and a persistent connection can be directly created between the two, and two-way data transmission can be performed, so that the operation and maintenance channel management cluster 110 can receive user input in real time and return execution results.
  • the operation and maintenance channel management cluster 110 can also exchange information with external services 30, and provide additional functions for the operation and maintenance channel management cluster 110 through other cloud services.
  • the external services 30 may include but are not limited to authentication services, audit management services, storage services, etc.
  • the authentication service may be a unified identity authentication service (identity and access management, IAM), which provides identity authentication for users who request to log in to the operation and maintenance channel management cluster 110.
  • the audit management service may be a cloud audit service (cloud trace service, CTS), which records the access commands forwarded by the operation and maintenance channel management cluster 110 and the execution results, so as to facilitate the user's future query, audit and backtracking.
  • CTS cloud trace service
  • the storage service may be a relational database service (relational database service, RDS), which may store the user's access rights to the server or the cloud service in the server, so that the operation and maintenance channel management cluster 110 can obtain the access rights and perform permission management on the access commands sent by the user.
  • RDS relational database service
  • FIG3 shows a schematic flow chart of a method for access management provided in an embodiment of the present application.
  • the method of FIG3 can be executed by an access management system, such as the system shown in FIG2 above.
  • the system for executing the method for access management provided in an embodiment of the present application includes an operation and maintenance channel management cluster and a client running on a server.
  • the method includes the following steps.
  • S310 The operation and maintenance channel management cluster obtains the user's access command to the target server.
  • the operation and maintenance channel management cluster can obtain the user's access command to the target server.
  • the user can select the cloud service resource to be accessed on the user interface and enter a specific access operation.
  • the user interface generates the user's access command to the target server and sends the access command to the operation and maintenance channel management cluster.
  • the operation and maintenance channel management cluster can obtain the access command from the user interface through the WebSocket protocol.
  • S320 The operation and maintenance channel management cluster sends the access command to the client.
  • the operation and maintenance channel management cluster can send the user's access command to the target server to the client.
  • the operation and maintenance channel management cluster can be responsible for the access management of multiple servers, and each server is deployed with a client responsible for executing the access command of the corresponding server.
  • the access command indicates the target server, so the operation and maintenance channel management cluster can send the access command to the client on the target server.
  • the operation and maintenance channel management cluster can send access commands to the client on the target server based on TCP.
  • TCP Transmission Control Protocol
  • S330 The client executes the access command according to the session status information.
  • the client on the target server can execute the access command.
  • the client can create a session object for the session established between the user and the target server, and the session object stores the session state information recorded by the client, so the client can execute the access command according to the session state information.
  • the user may issue multiple continuous and interrelated access commands.
  • the above access commands may include a first access command, a second access command, and a third access command, wherein the first access command and the second access command are issued and executed before the third access command, and the third access command needs to be executed based on the content and execution results of the first access command and the second access command.
  • the client receives the third access command, the session state information of the current session stored in the client may include the content and execution results of the first access command and the second access command, so the client can correctly execute the third access command; if the above session state information is lost, the third access command cannot be executed correctly.
  • the client can manage multiple sessions at the same time, and the client can call different sub-processes to execute according to different sessions corresponding to different access commands.
  • the client can establish session objects according to the access of different users to different cloud services on the target server. After the session object is established, a unique session identifier will be assigned to each session object.
  • the access command may include the session identifier, so the client can determine the session corresponding to the access command according to the session identifier carried in the access command.
  • the session status information may include the correspondence between the session identifier and the sub-process in the target server OS, where different sub-processes can be used to perform access operations on different cloud services.
  • the client can further determine the sub-process used to execute the access command.
  • the client can call the corresponding sub-process in the server OS to execute the command according to the session identifier and session status information in the access command, so that the client can manage the sessions of different users separately, thereby improving the efficiency of access management.
  • the client can also display the access result to the user through the operation and maintenance channel management cluster.
  • the client can send the execution result to the operation and maintenance channel management cluster, and the operation and maintenance sends the execution result to the user.
  • the operation and maintenance channel management cluster can send the execution result to the user interface, so that the user interface generates a visual interface for displaying the execution result to the user. This enables the operation and maintenance channel management cluster to monitor the entire process of the user accessing the server, facilitates the monitoring and auditing of user behavior, and improves the security of access management.
  • a client is set on the server as an entrance to access the server, and the operation and maintenance channel manages the cluster. Communicate directly with the client and distribute access commands to the client, so that the session status information can be recorded on the client instead of the operation and maintenance channel management cluster. Therefore, the nodes in the operation and maintenance channel management cluster are stateless. When switching nodes, the new node can work directly without configuring the session status information, which can avoid the interruption of the established session due to the loss of session status information, so as to switch the operation and maintenance channel instance without interrupting the service, and solve the problem of rapid expansion and contraction of the operation and maintenance channel management cluster.
  • the operation and maintenance channel management cluster can set multiple nodes so that the operation and maintenance channel management cluster can manage the nodes responsible for distributing access commands. Since the nodes in the operation and maintenance channel management cluster are stateless, the operation and maintenance channel management cluster can autonomously regulate the working conditions of the nodes when necessary.
  • the operation and maintenance channel management cluster may include a load balancing component and at least one operation and maintenance channel instance. The load balancing component is used to forward the obtained access command to a currently working operation and maintenance channel instance, and the operation and maintenance channel instance is used to send the access command to the client.
  • FIG4 shows a schematic flow chart of a scheduling operation and maintenance channel instance provided by an embodiment of the present application.
  • the establishment of a session between the user and the server is regarded as the beginning of the process, and the disconnection of the session established between the user and the service is regarded as the end.
  • the load balancing component forwards the access command to the currently working operation and maintenance channel instance, and the operation and maintenance channel instance sends the access command to the client.
  • the operation and maintenance channel management cluster may include a first operation and maintenance channel instance, and the load balancing component may forward the obtained first access command to the first operation and maintenance channel instance.
  • the first operation and maintenance channel instance sends the first access command to the client. If the first operation and maintenance channel instance successfully sends the first access command, the client can receive the first access command and execute it.
  • the specific process of the client executing the first access command may include obtaining the corresponding subprocess in the server OS according to the session identifier carried in the first access command, calling the subprocess to execute the first access command and returning the execution result. If the session has not ended after the execution of the first access command, the operation and maintenance channel management cluster can continue to obtain access commands and repeat the above steps.
  • the operation channel instance can report the exception to the load balancing component, and the load balancing component forwards the access command to another currently working operation channel instance.
  • Example 1 In addition to the first operation and maintenance channel instance, the operation and maintenance channel management cluster may also include a second operation and maintenance channel instance.
  • the load balancing component forwards the acquired second access command to the first operation and maintenance channel instance, but the first operation and maintenance channel instance fails to successfully send the second access command to the client after receiving the second access command. For example, because the first operation and maintenance channel instance currently has a large number of access commands of other sessions being sent, the load of the first operation and maintenance channel instance is too high, and the second access command wait times out; for another example, because the first operation and maintenance channel instance fails after receiving the second access command, the first operation and maintenance channel instance loses the ability to work normally. In the above case, the first operation and maintenance channel instance can report the abnormal information to the load balancing component.
  • the load balancing component After the load balancing component receives the abnormal information sent by the first operation and maintenance channel instance, the load balancing component can forward the second access command to the second operation and maintenance channel instance, and the second operation and maintenance channel instance sends the second access command to the client. After the second operation and maintenance channel instance successfully sends the second access command to the client, the client can receive and execute the second access command.
  • the operation and maintenance channel instance currently responsible for forwarding access commands becomes abnormal due to load balancing or disaster recovery, for example, the current node fails to send the command to the client, and the forwarding task is reallocated to other nodes in the operation and maintenance channel management cluster, thereby achieving node switching without interrupting access, thereby improving the rapid disaster recovery or load balancing capabilities of the operation and maintenance channel management cluster and improving the availability of the operation and maintenance channel management cluster services.
  • the first operation and maintenance channel instance and the second operation and maintenance channel instance can be deployed in different regions. Since the switching node does not need to reconfigure the session state information, there is no need for information exchange between the operation and maintenance channel instance nodes, and there is no need to limit the physical region where the operation and maintenance channel instance is located, so that the cross-region deployment of the operation and maintenance channel instance is realized.
  • the nodes responsible for forwarding before and after the switch are located in different physical regions, reducing the possibility of abnormalities occurring at different nodes at the same time, thereby realizing disaster recovery in different locations and further improving the availability of the operation and maintenance channel management cluster service.
  • the operation and maintenance channel management cluster can also deploy new operation and maintenance channel instances.
  • the load balancing component forwards the obtained third access command to the first operation and maintenance channel instance.
  • the load balancing component can establish a third operation and maintenance channel instance and forward the third access command to the third operation and maintenance channel instance, which will send the third access command to the client.
  • the load balancing component can request one or more computing instances that were originally not included in the operation and maintenance channel management cluster to include the one or more computing instances in the scope of the operation and maintenance channel management cluster, thereby using them as the third operation and maintenance channel instance.
  • example 2 is only an example of the situation where the operation and maintenance channel management cluster currently has no working operation and maintenance channel instance, which illustrates that the operation and maintenance channel management cluster has the ability to expand the number of operation and maintenance channel instances, and does not limit the operation and maintenance channel instances to be added only in this situation.
  • a user can purchase a larger-scale operation and maintenance channel management cluster service through the user interface, and at this time the user interface can also issue instructions to instruct the operation and maintenance channel management cluster to establish a new operation and maintenance channel instance.
  • the operation and maintenance channel management cluster can deploy a new operation and maintenance channel instance and reallocate the forwarding task to the new operation and maintenance channel instance, thereby realizing the expansion of the operation and maintenance channel management cluster without interrupting access, thereby improving the rapid expansion capability of the operation and maintenance channel management cluster and improving the availability of the operation and maintenance channel management cluster service.
  • the operation and maintenance channel management cluster can also provide the ability to rapidly shrink.
  • the first operation and maintenance channel instance can report its currently unsuccessfully sent access commands to the load balancing component, and the load balancing component will redistribute these access commands to other operation and maintenance channel instances, thereby deleting the first operation and maintenance channel instance from the operation and maintenance channel management cluster.
  • the switching of the operation and maintenance channel instance responsible for forwarding access commands will not affect the session state information recorded in the client. Therefore, the switching of the operation and maintenance channel instance in all the above examples will not cause the user to disconnect the established session with the server, and the switched node can be used directly without configuration, making the time required for switching controllable and fast, so that the above switching process can be completed without the user's perception.
  • FIG5 shows a schematic flow chart of an access management method provided in an embodiment of the present application.
  • the method includes the following steps.
  • the operation and maintenance channel management cluster can obtain the user's login command before establishing a session between the user and the target server.
  • the login command is used to confirm the identity of the user who currently requests login and subsequently issues access commands.
  • the user can log in by entering a registered cloud account and password in the user interface, and the user interface can generate a login command based on the user's input and send it to the operation and maintenance channel management cluster.
  • S520 The operation and maintenance channel management cluster sends a login command to the authentication service.
  • the operation and maintenance channel management cluster can send the login command to the authentication service, so that the authentication service authenticates the identity of the user according to the login command.
  • the authentication service includes but is not limited to an IAM service.
  • the operation and maintenance channel management cluster receives authentication information from the authentication and authorization service.
  • the authentication service can confirm the user identity according to the login command sent by the operation and maintenance channel management cluster, thereby generating authentication information and sending it to the operation and maintenance channel management cluster, so that the operation and maintenance channel management cluster can receive the authentication information.
  • S540 The operation and maintenance channel management cluster determines the user's login status according to the authentication information.
  • the operation and maintenance channel management cluster can determine the user's login status based on the authentication information.
  • the authentication information can be authentication success information, such as the cloud account and password entered by the user are registered and matched, and the user of the cloud account has the right to access at least part of the cloud services managed by the operation and maintenance channel management cluster, then the authentication service generates and sends authentication success information, and the operation and maintenance channel management cluster can determine that the user has successfully logged in based on the authentication success information, and can continue to perform subsequent access steps.
  • the authentication information can also be authentication failure information, such as the cloud account entered by the user is not registered, or the cloud account and password do not match, or the cloud account has no right to access any cloud service managed by the operation and maintenance channel management cluster, etc., then the authentication service generates and sends authentication failure information, and the operation and maintenance channel management cluster can determine that the user has not successfully logged in based on the authentication failure information.
  • the operation and maintenance channel management cluster can inform the user of the login failure through the user interface and request the user to log in again. If the user fails to log in again correctly, he or she will not have the right to access later.
  • any operation and maintenance channel instance in the operation and maintenance channel management cluster can receive the authentication information from the authentication service when needed. Therefore, the user's login status does not need to be recorded in the node of the operation and maintenance channel management cluster, so that the identity authentication service does not depend on a specific operation and maintenance channel instance.
  • the switched operation and maintenance channel instance can request the user's authentication information from the authentication service again based on the user who sent the access command, thereby determining the user's login status without the user having to log in again. On the basis of ensuring user access security, the user's experience is improved.
  • the access management system can continue to manage the access command, including the following steps:
  • S550 The operation and maintenance channel management cluster obtains access commands.
  • S560 The operation and maintenance channel management cluster sends an access command to the client, or in other words, the client receives an access command from the operation and maintenance channel management cluster. Ask for orders.
  • the operation and maintenance channel management cluster can also obtain the user's access rights from the external storage service, and determine whether to send the access command to the client based on whether the access command satisfies the access rights.
  • the access rights are used to indicate the cloud services that the user can access and the specific operations that can be performed. If the operation and maintenance channel management cluster determines that the access command satisfies the access rights, the operation and maintenance channel management cluster can execute step S560 and subsequent steps; if the operation and maintenance channel management cluster determines that the access command does not satisfy the access rights, the operation and maintenance channel management cluster does not execute S560 and returns to step S550.
  • the external storage service includes but is not limited to databases, cloud databases, cloud storage services, etc., which are not specifically limited in this application.
  • the external storage service can be an authentication service, which can store the access rights corresponding to the user identity while storing the registered user identity, so that the user's access rights are sent to the operation and maintenance channel management cluster when the user login authentication is successful;
  • the external storage service can also be other independent storage services, such as RDS.
  • RDS independent storage services
  • the operation and maintenance channel management cluster can obtain the user's access rights to the server from the external storage service, so that any node in the operation and maintenance channel management cluster can manage the user's access rights without pre-configuration, thereby enabling the operation and maintenance channel management cluster to provide permission management services and improve the security of access management.
  • S570 The client executes the access command according to the session status information.
  • the method may further include:
  • S580 The client sends the execution result to the operation and maintenance channel management cluster, or in other words, the operation and maintenance channel management cluster receives the execution result from the client.
  • the implementation of the above steps S550 to S580 may be the same as the access management method described above.
  • the operation and maintenance channel management cluster can interact with the external authentication and authorization service, thereby strengthening user identity authentication management.
  • the method shown in Figure 5 only takes the authentication and authorization service as an example to illustrate that the operation and maintenance channel management cluster provided in the embodiment of the present application can provide stateless functions, but is not limited to providing identity authentication or authority management functions.
  • the operation and maintenance channel management cluster can also provide other stateless functions such as security compliance and operation audit.
  • the operation and maintenance channel management cluster can audit and manage the user's access operations. Specifically, after the user logs in successfully, the operation and maintenance channel management cluster can send each access command forwarded to the client during the session to CTS at the same time, and also send the corresponding execution results fed back by the client to CTS, so that CTS monitors and records the user's entire behavior.
  • the operation and maintenance channel management cluster can receive early warning information from CTS, and the operation and maintenance channel management cluster prompts the user through the user interface based on the early warning information, and can stop forwarding the user's access command if necessary.
  • the operation and maintenance channel management cluster can send a request to CTS and receive the operation record from CTS, and then feedback to the user through the user interface.
  • Fig. 6 shows a schematic structural diagram of an access management system 600 provided in an embodiment of the present application.
  • the system 600 includes an operation and maintenance channel management cluster 610 and a client 620, wherein the client 620 runs on a target server.
  • FIG. 7 shows a schematic structural block diagram of an operation and maintenance channel management cluster 610 in an access management system 600 provided in an embodiment of the present application.
  • the operation and maintenance channel management cluster 610 includes: a command acquisition module 611 and a command distribution module 612 .
  • the command acquisition module 611 is used to acquire a user's access command to a target server.
  • the command distribution module 612 is used to send the access command to the client.
  • the operation and maintenance channel management cluster includes a load balancing component, and the operation and maintenance channel management cluster also includes at least a first operation and maintenance channel instance and a second operation and maintenance channel instance.
  • the command distribution module 612 is specifically used for the load balancing component to send the access command to the first operation and maintenance channel instance; the first operation and maintenance channel instance sends the access command to the client.
  • the command distribution module 612 is also specifically used for the first operation and maintenance channel instance to report exception information to the load balancing component, where the exception information is used to indicate that the first operation and maintenance channel instance failed to send an access command to the client; the load balancing component sends the access command to the second operation and maintenance channel instance; and the second operation and maintenance channel instance sends the access command to the client.
  • the first operation and maintenance channel instance and the second operation and maintenance channel instance are deployed in different areas.
  • the command distribution module 612 is further configured to report abnormal information to the load balancing component for the first operation and maintenance channel instance, where the abnormal information indicates that the first operation and maintenance channel instance fails to send an access command to the client; the load balancing component establishes a third operation and maintenance channel instance; and the load balancing component generates an error message.
  • the balance component sends the access command to the third operation and maintenance channel instance; the third operation and maintenance channel instance sends the access command to the client.
  • the command distribution module 612 is specifically configured to send an access command to the client according to the transmission control protocol.
  • the client 620 is used to execute the access command according to the session state information
  • the session state information is the access information of the user to the target server recorded by the client.
  • the access command includes a session identifier
  • the session status information includes a correspondence between the session identifier and a subprocess in the operating system of the target server.
  • the client 620 is specifically used to determine the subprocess corresponding to the session identifier based on the session identifier and session status information of the access command; and call the subprocess to execute the access command.
  • the operation and maintenance channel management cluster 610 may also include a login authentication module 613, which is used to: obtain the user's login command before obtaining the user's access command to the target server; send the login command to the authentication service, which is used to authenticate the user's identity; receive authentication information from the authentication service; and determine the user's login status based on the authentication information.
  • a login authentication module 613 which is used to: obtain the user's login command before obtaining the user's access command to the target server; send the login command to the authentication service, which is used to authenticate the user's identity; receive authentication information from the authentication service; and determine the user's login status based on the authentication information.
  • the operation and maintenance channel management cluster 610 may further include a permission management module 614, which is used to: obtain access permissions from an external storage service; and determine whether the access command satisfies the access permissions before sending the access command to the client.
  • a permission management module 614 which is used to: obtain access permissions from an external storage service; and determine whether the access command satisfies the access permissions before sending the access command to the client.
  • the client 620 is further used to send the execution result of the access command to the operation and maintenance channel management cluster; the operation and maintenance channel management cluster 610 may also include a result display module 615 for sending the execution result to the user.
  • the above modules can be implemented by software or hardware.
  • the implementation of the command distribution module 612 is introduced below by taking the command distribution module 612 as an example.
  • the implementation of the command acquisition module 611, the login authentication module 613, the authority management module 614 and the result display module 615 can refer to the implementation of the command distribution module 612.
  • the command distribution module 612 may include code running on a computing instance.
  • the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more.
  • the command distribution module 612 may include code running on multiple hosts/virtual machines/containers. It should be noted that the multiple hosts/virtual machines/containers used to run the code may be distributed in the same region (region) or in different regions.
  • the multiple hosts/virtual machines/containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one data center or multiple data centers with similar geographical locations. Among them, usually a region may include multiple AZs.
  • VPC virtual private cloud
  • multiple hosts/virtual machines/containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs.
  • VPC virtual private cloud
  • a VPC is set up in a region.
  • a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.
  • the command distribution module 612 may include at least one computing device, such as a server, etc.
  • the command distribution module 612 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD).
  • ASIC application-specific integrated circuit
  • PLD programmable logic device
  • the PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.
  • CPLD complex programmable logical device
  • FPGA field-programmable gate array
  • GAL generic array logic
  • the multiple computing devices included in the command distribution module 612 can be distributed in the same region or in different regions.
  • the multiple computing devices included in the command distribution module 612 can be distributed in the same AZ or in different AZs.
  • the multiple computing devices included in the command distribution module 612 can be distributed in the same VPC or in multiple VPCs.
  • the multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.
  • the command acquisition module 611, the command distribution module 612, the login authentication module 613, the permission management module 614 and the result display module 615 can be used to execute any step in the above-mentioned access management method respectively, and the steps that the command acquisition module 611, the command distribution module 612, the login authentication module 613, the permission management module 614 and the result display module 615 are responsible for implementing can be specified as needed.
  • the command acquisition module 611, the command distribution module 612, the login authentication module 613, the permission management module 614 and the result display module 615 respectively implement different steps in the above-mentioned access management method to realize all the functions of the operation and maintenance channel management cluster.
  • the present application also provides a computing device 100.
  • the computing device 100 includes: a bus 102, a processor 104, a memory 106, and a communication interface 108.
  • the processor 104, the memory 106, and the communication interface 108 communicate with each other through the bus 102.
  • the computing device 100 may be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computing device 100.
  • the bus 102 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus.
  • the bus may be divided into an address bus, a data bus, a control bus, etc.
  • FIG8 shows only one line, but does not mean that there is only one bus or one type of bus.
  • the bus 102 may be Included are pathways for transferring information between various components of computing device 100 (eg, memory 106 , processor 104 , communication interface 108 ).
  • the processor 104 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP) or a digital signal processor (DSP).
  • processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP) or a digital signal processor (DSP).
  • CPU central processing unit
  • GPU graphics processing unit
  • MP microprocessor
  • DSP digital signal processor
  • the memory 106 may include a volatile memory (volatile memory), such as a random access memory (RAM).
  • volatile memory volatile memory
  • RAM random access memory
  • the processor 104 may also include a non-volatile memory (non-volatile memory), such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).
  • ROM read-only memory
  • HDD hard disk drive
  • SSD solid state drive
  • the memory 106 stores executable program codes, and the processor 104 executes the executable program codes to respectively implement the functions of the aforementioned command acquisition module, command distribution module, login authentication module, authority management module, and result display module, thereby implementing the aforementioned access management method. That is, the memory 106 stores instructions for executing the aforementioned access management method.
  • the communication interface 108 uses a command distribution module such as, but not limited to, a network interface card, a transceiver, etc. to implement communication between the computing device 100 and other devices or a communication network.
  • a command distribution module such as, but not limited to, a network interface card, a transceiver, etc. to implement communication between the computing device 100 and other devices or a communication network.
  • the embodiment of the present application also provides a computing device cluster.
  • the computing device cluster includes at least one computing device.
  • the computing device can be a server, such as a central server, an edge server, or a local server in a local data center.
  • the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.
  • the computing device cluster includes at least one computing device 100.
  • the memory 106 in one or more computing devices 100 in the computing device cluster may store the same instructions for executing the above access management method.
  • the memory 106 of one or more computing devices 100 in the computing device cluster may also store partial instructions for executing the above access management method.
  • the combination of one or more computing devices 100 may jointly execute instructions for executing the above access management method.
  • the memory 106 in different computing devices 100 in the computing device cluster can store different instructions, which are respectively used to execute part of the functions of the above-mentioned operation and maintenance channel management cluster. That is, the instructions stored in the memory 106 in different computing devices 100 can implement the functions of one or more modules of the command acquisition module, command distribution module, login authentication module, authority management module and result display module.
  • one or more computing devices in a computing device cluster may be connected via a network.
  • the network may be a wide area network or a local area network, etc.
  • FIG. 10 shows a possible implementation. As shown in FIG. 10 , two computing devices 100A and 100B are connected via a network. Specifically, the network is connected via a communication interface in each computing device.
  • the memory 106 in the computing device 100A stores instructions for executing the functions of the command acquisition module and the command distribution module. At the same time, the memory 106 in the computing device 100B stores instructions for the functions of the client.
  • the functions of the computing device 100A shown in FIG10 may also be completed by multiple computing devices 100.
  • the functions of the computing device 100B may also be completed by multiple computing devices 100.
  • An embodiment of the present application also provides a chip, which includes a processor and a data interface.
  • the processor reads instructions stored in a memory through the data interface to execute the above-mentioned access management method.
  • the embodiment of the present application also provides a computer program product including instructions.
  • the computer program product may be a software or program product including instructions that can be run on a computing device or stored in any available medium.
  • the at least one computing device executes the above-mentioned access management method.
  • the embodiment of the present application also provides a computer-readable storage medium.
  • the computer-readable storage medium can be any available medium that can be stored by the computing device or a data storage device such as a data center containing one or more available media.
  • the available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid-state hard disk), etc.
  • the computer-readable storage medium includes instructions, and the instructions instruct the computing device to perform the above-mentioned management.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请实施例涉及云计算领域，提供了一种访问管理的方法和系统，该系统包括运维通道管理集群和客户端，客户端运行在目标服务器上，该方法包括：运维通道管理集群获取用户对目标服务器的访问命令；运维通道管理集群将访问命令发送至客户端；客户端根据会话状态信息，执行访问命令，会话状态信息是客户端记录的用户对目标服务器的访问信息。上述方法通过将状态信息记录在位于服务器的客户端上，运维通道实例将访问命令分发至客户端，使得运维通道实例是无状态的，从而能够在不中断服务的情况下切换运维通道实例，解决运维通道管理集群的快速扩缩容问题。

Description

访问管理的方法和系统
本申请要求于2023年3月31日提交中国专利局、申请号为202310339767.6、申请名称为“访问管理的方法和系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及云计算领域，并且更为具体地，涉及一种访问管理的方法和系统。
背景技术
在云计算领域，云服务提供厂商需要管理的云服务资源越来越多，且云服务资源的访问安全也越来越重要。因此，很多云服务提供厂商选择部署堡垒机作为运维安全接入审计的系统，集中管理用户对服务器的访问请求。
但是，现有的堡垒机系统由于需要记录用户的登录状态以及用户与服务器建立的会话控制等状态信息，称之为有状态的服务。由于堡垒机节点都是有状态的，如果需要更换节点或增加新的节点，就需要重新配置堡垒机节点的状态，该过程需要一定时间，导致堡垒机系统无法快速容灾或扩容。因此，如何使运维通道管理集群能够不断开连接地快速更换节点成为亟需解决的技术问题。
发明内容
本申请实施例提供一种访问管理的方法和系统，可以将状态信息记录在位于服务器的客户端上，运维通道实例将访问命令分发至客户端，使得运维通道实例是无状态的，从而能够在不中断服务的情况下切换运维通道实例。
第一方面，提供一种访问管理的方法，该方法应用于访问管理的系统，该系统包括运维通道管理集群和客户端，客户端运行在目标服务器上，运维通道管理集群包括多个运维通道实例，每个运维通道实例用于与客户端进行信息交互，每个运维通道实例由至少一台计算实例组成，至少一台计算实例包括物理主机、虚拟机、容器中的至少一种，该方法包括：运维通道管理集群获取用户对目标服务器的访问命令；运维通道管理集群将访问命令发送至客户端；客户端根据会话状态信息，执行访问命令，会话状态信息是客户端记录的用户对目标服务器的访问信息。
根据本申请提供的技术方案，通过在服务器上设置客户端作为接入服务器的入口，运维通道管理集群直接与客户端通信，将访问命令分发至客户端，使得记录状态信息以及管理会话的任务由客户端完成，运维通道实例是无状态的，从而在通过运维通道管理集群隔离用户与服务器间直接交互，保证服务器访问安全性的前提下，能够在不中断服务的情况下切换运维通道实例，解决运维通道管理集群的快速扩缩容问题。
结合第一方面，在第一方面的某些实现方式中，运维通道管理集群还包括负载均衡组件，多个运维通道实例中包括第一运维通道实例和第二运维通道实例，将访问命令发送至客户端，包括：负载均衡组件将访问命令发送至第一运维通道实例；第一运维通道实例向客户端发送访问命令。
根据上述技术方案，通过在运维通道管理集群中设置多个节点，使得运维通道管理集群能够管理负责分发访问命令的节点，从而运维通道管理集群在需要时能够自主调控节点的工作情况。
结合第一方面，在第一方面的某些实现方式中，将访问命令发送至客户端，还包括：第一运维通道实例向负载均衡组件上报异常信息，异常信息用于指示第一运维通道实例向客户端发送访问命令失败；负载均衡组件将访问命令发送至第二运维通道实例；第二运维通道实例向客户端发送访问命令。
根据上述技术方案，通过在当前负责转发访问命令的运维通道实例异常时，将转发任务重新分配给运维通道管理集群内的其他节点，实现不中断访问情况下的切换节点，从而提高运维通道管理集群的快速容灾或负载均衡的能力，提高运维通道管理集群服务的可用性。
结合第一方面，在第一方面的某些实现方式中，第一运维通道实例和第二运维通道实例部署在不同的区域。
根据上述技术方案，运维通道管理集群的节点能够跨区域(region)部署，使得切换前后负责转发的节点位于不同的物理地区，降低同时发生异常的可能性，从而实现异地容灾，进一步提高运维通道管理集群服务的可用性。
结合第一方面，在第一方面的某些实现方式中，将访问命令发送至客户端，还包括：第一运维通道实例向负载均衡组件上报异常信息，异常信息用于指示第一运维通道实例向客户端发送访问命令失败；负载均衡组件建立第三运维通道实例；负载均衡组件将访问命令发送至第三运维通道实例；第三运维通道实例向客户端发送访问命令。
根据上述技术方案，通过在当前负责转发访问命令的运维通道实例异常时，部署新的运维通道实例，并将转发任务重新分配给该新的运维通道实例，实现不中断访问情况下的运维通道管理集群扩容，从而提高运维通道管理集群的快速扩容能力，提高运维通道管理集群服务的可用性。
结合第一方面，在第一方面的某些实现方式中，将访问命令发送至客户端，包括：运维通道管理集群根据传输控制协议向客户端发送访问命令。
根据上述技术方案，运维通道实例与客户端之间通过传输层的传输控制协议(transmission control protocol，TCP)直接通信，从而能够避免使用安全外壳协议(secure shell，SSH)作为远程连接工具，不需要服务器为SSH服务开启高风险的22端口，从而提高服务器的安全性。
结合第一方面，在第一方面的某些实现方式中，访问命令中包括会话标识，会话状态信息中包括会话标识与目标服务器的操作系统中的子进程的对应关系，根据会话状态信息，执行访问命令，包括：根据访问命令的会话标识和会话状态信息，确定与会话标识对应的子进程；调用子进程执行访问命令。
根据上述技术方案，通过客户端为每个用户的会话分配标识值，并基于用户指令中携带的标识值管理会话，调用服务器操作系统中相应的子进程执行命令，使得客户端能够将不同用户的会话分开管理，从而提高访问管理的效率。
结合第一方面，在第一方面的某些实现方式中，在获取用户对目标服务器的访问命令前，该方法还包括：运维通道管理集群获取用户的登录命令；运维通道管理集群向认证鉴权服务发送登录命令，认证鉴权服务用于认证用户的身份；运维通道管理集群接收来自认证鉴权服务的认证信息；运维通道管理集群根据认证信息，确定用户的登录状态。
根据本申请提供的技术方案，运维通道管理集群通过与外部服务交互为用户提供身份认证，使得用户的登录状态无需记录在运维通道管理集群的节点中，从而使用户登录后，提供服务的节点更换也无需用户重新登录，在保证用户访问安全性的基础上，提高用户的使用体验。
结合第一方面，在第一方面的某些实现方式中，在将访问命令发送至客户端前，该方法还包括：运维通道管理集群从外部存储服务获取访问权限；运维通道管理集群确定访问命令满足访问权限。
根据上述技术方案，运维通道管理集群通过从外部存储服务获取用户对服务器的访问权限，使得运维通道管理集群中的任意节点都能够在不预先配置的情况下对用户的访问权限进行管理，从而提高访问管理的安全性。
结合第一方面，在第一方面的某些实现方式中，该方法还包括：客户端将访问命令的执行结果发送至运维通道管理集群；运维通道管理集群向用户发送执行结果。
根据上述技术方案，通过运维通道管理集群将访问结果展示给用户，从而使得运维通道管理集群能够监控用户访问服务器的全过程，便于对用户行为的监控和审计，提高访问管理的安全性。
第二方面，提供一种访问管理的系统，该系统包括运维通道管理集群和客户端，客户端运行在目标服务器上，运维通道管理集群包括多个运维通道实例，每个运维通道实例用于与客户端进行信息交互，每个运维通道实例由至少一台计算实例组成，至少一台计算实例包括物理主机、虚拟机、容器中的至少一种，运维通道管理集群包括：命令获取模块，用于获取用户对目标服务器的访问命令；命令分发模块，用于将访问命令发送至客户端；客户端用于：根据会话状态信息，执行访问命令，会话状态信息是客户端记录的用户对目标服务器的访问信息。
结合第二方面，在第二方面的某些实现方式中，运维通道管理集群还包括负载均衡组件，多个运维通道实例中包括第一运维通道实例和第二运维通道实例，命令分发模块，用于：负载均衡组件将访问命令发送至第一运维通道实例；第一运维通道实例向客户端发送访问命令。
结合第二方面，在第二方面的某些实现方式中，命令分发模块，还用于：第一运维通道实例向负载均衡组件上报异常信息，异常信息用于指示第一运维通道实例向客户端发送访问命令失败；负载均衡组 件将访问命令发送至第二运维通道实例；第二运维通道实例向客户端发送访问命令。
结合第二方面，在第二方面的某些实现方式中，第一运维通道实例和第二运维通道实例部署在不同的区域。
结合第二方面，在第二方面的某些实现方式中，命令分发模块，还用于：第一运维通道实例向负载均衡组件上报异常信息，异常信息用于指示第一运维通道实例向客户端发送访问命令失败；负载均衡组件建立第三运维通道实例；负载均衡组件将访问命令发送至第三运维通道实例；第三运维通道实例向客户端发送访问命令。
结合第二方面，在第二方面的某些实现方式中，命令分发模块，用于：根据传输控制协议向客户端发送访问命令。
结合第二方面，在第二方面的某些实现方式中，访问命令中包括会话标识，会话状态信息中包括会话标识与目标服务器的操作系统中的子进程的对应关系，客户端，用于：根据访问命令的会话标识和会话状态信息，确定与会话标识对应的子进程；调用子进程执行访问命令。
结合第二方面，在第二方面的某些实现方式中，运维通道管理集群还包括登录认证模块，在获取用户对目标服务器的访问命令前，用于：获取用户的登录命令；向认证鉴权服务发送登录命令，认证鉴权服务用于认证用户的身份；接收来自认证鉴权服务的认证信息；根据认证信息，确定用户的登录状态。
结合第二方面，在第二方面的某些实现方式中，运维通道管理集群还包括权限管理模块，在将访问命令发送至客户端前，用于：从外部存储服务获取访问权限；确定访问命令满足访问权限。
结合第二方面，在第二方面的某些实现方式中，客户端还用于：将访问命令的执行结果发送至运维通道管理集群；运维通道管理集群还包括结果展示模块，用于向用户发送执行结果。
第三方面，提供一种计算设备，包括处理器和存储器，其中，存储器用于存储指令，处理器用于从存储器中调用并运行该指令，使得该计算设备执行第一方面或第一方面任意一种可能的实现方式中的方法。
第四方面，提供一种计算设备集群，包括至少一个计算设备，每个计算设备包括处理器和存储器，其中，存储器用于存储指令，处理器用于从存储器中调用并运行该指令，使得该计算设备集群执行第一方面或第一方面任意一种可能的实现方式中的方法。
可选地，该处理器可以是通用处理器，可以通过硬件来实现也可以通过软件来实现。当通过硬件来实现时，该处理器可以是逻辑电路、集成电路等；当通过软件来实现时，该处理器可以是一个通用处理器，通过读取存储器中存储的软件代码来实现，该存储器可以集成在处理器中，可以位于该处理器之外独立存在。
第五方面，提供了一种芯片，该芯片获取指令并执行该指令来实现上述第一方面或第一方面任意一种可能的实现方式中的方法。
可选地，作为一种实现方式，该芯片包括处理器与数据接口，该处理器通过该数据接口读取存储器上存储的指令，执行上述第一方面或第一方面任意一种可能的实现方式中的方法。
可选地，作为一种实现方式，该芯片还可以包括存储器，该存储器中存储有指令，该处理器用于执行该存储器上存储的指令，当该指令被执行时，该处理器用于执行上述第一方面或第一方面任意一种可能的实现方式中的方法。
第六方面，提供了一种包含指令的计算机程序产品，当该指令被计算设备集群运行时，使得计算设备集群执行上述第一方面或第一方面任意一种可能的实现方式中的方法。
第七方面，提供了一种计算机可读存储介质，包括计算机程序指令，当该计算机指令由计算设备集群执行时，使得计算设备集群执行上述第一方面或第一方面任意一种可能的实现方式中的方法。
作为示例，这些计算机可读存储介质包括但不限于如下的一个或者多个：只读存储器(read-only memory，ROM)、可编程ROM(programmable ROM，PROM)、可擦除的PROM(erasable PROM，EPROM)、Flash存储器、电EPROM(electrically EPROM，EEPROM)以及硬盘驱动器(hard drive)。
可选地，作为一种实现方式，上述存储介质具体可以是非易失性存储介质。
附图说明
图1是一种堡垒机系统的示意图。
图2是本申请实施例提供的一种访问管理的系统架构示意图。
图3是本申请实施例提供的一种访问管理的方法的示意性流程框图。
图4是本申请实施例提供的一种调度运维通道实例的示意性流程框图。
图5是本申请实施例提供的另一访问管理的方法的示意性流程框图。
图6是本申请实施例提供的一种访问管理的系统的示意性结构框图。
图7是本申请实施例提供的一种访问管理的系统中运维通道管理集群的示意性流程框图。
图8是本申请实施例提供的一种计算设备的示意性结构框图。
图9是本申请实施例提供的一种计算设备集群的示意性结构框图。
图10是本申请实施例提供的另一计算设备集群的示意性结构框图。
具体实施方式
下面将结合附图，对本申请实施例中的技术方案进行描述。
本申请将围绕包括多个设备、组件、模块等的系统来呈现各个方面、实施例或特征。应当理解和明白的是，各个系统可以包括另外的设备、组件、模块等，并且/或者可以并不包括结合附图讨论的所有设备、组件、模块等。此外，还可以使用这些方案的组合。
另外，在本申请实施例中，“示例的”、“例如”等词用于表示作例子、例证或说明。本申请中被描述为“示例”的任何实施例或设计方案不应被解释为比其它实施例或设计方案更优选或更具优势。确切而言，使用示例的一词旨在以具体方式呈现概念。
本申请实施例中，“相应的(corresponding，relevant)”和“对应的(corresponding)”有时可以混用，应当指出的是，在不强调其区别时，其所要表达的含义是一致的。
本申请实施例描述的网络架构以及业务场景是为了更加清楚地说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
在本说明书中描述的参考“一个实施例”或“一些实施例”等意味着在本申请的一个或多个实施例中包括结合该实施例描述的特定特征、结构或特点。由此，在本说明书中的不同之处出现的语句“在一个实施例中”、“在一些实施例中”、“在其他一些实施例中”、“在另外一些实施例中”等不是必然都参考相同的实施例，而是意味着“一个或多个但不是所有的实施例”，除非是以其他方式另外特别强调。术语“包括”、“包含”、“具有”及它们的变形都意味着“包括但不限于”，除非是以其他方式另外特别强调。
本申请中，“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：包括单独存在A，同时存在A和B，以及单独存在B的情况，其中A，B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b，或c中的至少一项(个)，可以表示：a，b，c，a-b，a-c，b-c，或a-b-c，其中a，b，c可以是单个，也可以是多个。
为了便于理解，下面先对本申请实施例可能涉及的相关术语和概念进行介绍。
1、运维通道管理集群：也叫做运维安全审计系统，负责对用户访问云服务资源进行集中管理的服务。运维通道管理集群负责接收用户输入的访问命令，并将访问命令分发至云服务资源所在的服务器，从而可以实时收集和监控网络环境中每个组成部分的系统状态、安全事件和网络活动，保障网络和数据不受来自外部或内部用户的入侵和破坏，便于集中报警、及时处理及审计定责。在其他实施方案中，运维通道管理集群也被叫做堡垒机或云堡垒机等。
2、会话控制：会话指的是一个终端用户与一个交互系统进行通信时建立的连接。会话控制(session)对象用于存储特定用户访问特定服务所需的属性及配置信息。这样，当用户在服务之间跳转时，存储在会话控制对象中的变量将不会丢失，而是在整个用户会话中一直存在下去。当用户请求访问特定服务时，如果该用户还没有会话，则服务器将自动创建一个会话控制对象。对于已经建立会话控制对象的会话，用户新发送的访问指令需要基于会话控制对象中存储的会话状态信息执行，会话状态信息是该用户对该服务器的访问信息。作为示例，会话状态信息可以包括用户身份、用户的首选项、用户对服务已执行的访问命令等。当会话过期或被放弃后，服务器将终止该会话。
在云计算领域，云服务提供厂商需要管理的云服务资源越来越多，同时伴随着访问云服务资源的用 户数量增加。如果由提供云服务资源的服务器直接管理用户的访问，会导致每个服务器都需要存储并处理大量的用户信息以及访问记录，不利于集中管理访问权限，造成大量运算资源浪费，访问效率低下。此外，云服务资源的重要程度也越来越高，因此访问安全也越来越重要。如果让用户能够直接访问服务器，会导致服务器地址暴露，存在安全隐患，且受到攻击时也不易排查与审计定责。
因此，很多云服务提供厂商选择在用户和服务器之间部署运维安全接入审计的系统，例如堡垒机，从而集中管理用户对服务器的访问请求。图1示出了一种现有的堡垒机系统。如图1所示，堡垒机系统包括多个堡垒机、用户界面(portal)和负载均衡(nginx)组件。堡垒机用于提供认证、授权、鉴权、命令审计、行为记录与回放等功能。用户界面用于提供用户登录堡垒机和访问云服务资源的前段操作界面，用户通过用户界面输入的访问命令通过负载均衡组件转发到某一个堡垒机上，该堡垒机通过安全外壳协议(secure shell，SSH)将访问命令发送至目标云服务资源所在的服务器。
但是，如图1所示的堡垒机系统中，由于堡垒机需要记录用户的登录状态以及用户与服务器建立的会话控制(session)等状态信息，称之为有状态的。由于堡垒机节点都是有状态的，如果需要更换节点或增加新的节点，就需要重新配置堡垒机节点的状态信息。作为示例，如果堡垒机集群有N个节点，当前单个堡垒机节点故障之后，用户正在进行中的会话可能会有1/N断开连接，运维人员需要重新认证建立新连接，整个过程至少需要几分钟才能恢复。堡垒机的有状态这一特点导致堡垒机系统无法快速容灾或扩容。因此，如何使运维通道管理集群能够不断开连接地快速更换节点成为亟需解决的技术问题。
鉴于此，本申请实施例提供一种访问管理的方法，该方法应用于访问管理的系统，该系统包括运维通道管理集群和运行在服务器上的客户端。通过将状态信息记录在位于服务器的客户端上，运维通道实例将访问命令分发至客户端，使得运维通道实例是无状态的，从而能够在不中断服务的情况下切换运维通道实例。
图2示出了本申请提供的访问管理的系统架构示意图。如图2所示，该系统包括运维通道管理集群110和运行在服务器20上的客户端120。
客户端120用于建立并管理用户的会话控制对象。具体地，客户端120中存储有会话状态信息，当客户端120接收到访问命令时，根据会话控制对象中的会话状态信息与服务器20的操作系统(operating system，OS)进行命令交互，从而执行用户的访问命令，并将访问命令的执行结果返回给用户。
运维通道管理集群110用于对用户输入的访问命令进行分发，还可以将客户端120执行访问命令后返回的执行结果展示给客户。运维通道管理集群110由多个运维通道实例111组成，每个运维通道实例111可以由一台或多台计算实例组成，其中，计算实例可以包括物理主机(计算设备)、虚拟机、容器中的至少一种。可选地，不同运维通道实例111可以分布在不同的区域(region)中，也可以分布在相同的region中，也即每个region中可以包括多个运维通道实例，其中不同region对应不同的物理地区。可选地，运维通道管理集群110还可以包括负载均衡(nginx)组件112，用于将用户运维接入运维通道管理集群的请求转发到一个具体的运维通道实例111上。
可选地，运维通道管理集群110可以与客户端120通过传输控制协议(transmission control protocol，TCP)进行命令传输。现有的堡垒机等运维通道管理集群实现方案中，运维通道管理集群通过安全外壳协议(secure shell，SSH)作为与服务器的远程连接工具。使用SSH服务需要开启服务器的22号端口，该端口存在较多漏洞，攻击者可以探测它以进行远程访问并发起安全攻击，从而造成服务器的安全隐患。系统内组件能够通过传输层的TCP协议直接通信，能够避免使用SSH服务，从而提高服务器的安全性。
可选地，该系统还可以包括前端组件用户界面130。用户界面130提供访问接口(如界面或应用程序界面(application program interface，API))，用户可通过网页或应用程序等操作界面远程接入访问接口，在用户界面130注册云账号和密码，并登录运维通道管理集群110。运维通道管理集群110对云账号和密码鉴权成功后，用户可进一步通过用户界面30向运维通道管理集群110发送访问命令，用户界面130还可以将运维通道管理集群110返回的执行结果通过操作界面展示给用户。
可选地，运维通道管理集群110可以与用户界面130通过网络套接字(WebSocket)协议进行通信。在WebSocket协议中，运维通道管理集群110与用户界面130只需要完成一次握手，两者之间就直接可以创建持久性的连接，并进行双向数据传输，使得运维通道管理集群110能够实时接收用户输入并返回执行结果。
可选地，运维通道管理集群110还可以与外部服务30进行信息交互，通过其它云服务为运维通道管理集群110提供额外功能。外部服务30可以包括但不限于认证鉴权服务、审计管理服务、存储服务等。 作为示例，认证鉴权服务可以是统一身份认证服务(identity and access management，IAM)，为请求登录运维通道管理集群110的用户提供身份认证。又例如，审计管理服务可以是云审计服务(cloud trace service，CTS)，为运维通道管理集群110记录其转发的访问命令以及执行结果，方便用户日后的查询、审计和回溯。再例如，存储服务可以是关系型数据库(relational database service，RDS)，其中可以存储有用户对服务器或服务器中云服务的访问权限，从而使运维通道管理集群110能够获取该访问权限，从而对用户发送的访问命令进行权限管理。
下面结合图3，详细描述本申请的访问管理的方法。
图3示出了本申请实施例提供的一种访问管理的方法的示意性流程图。可选地，图3的方法可以由访问管理的系统执行，例如上述图2中所示的系统。具体地，用于执行本申请实施例提供的访问管理的方法的系统包括运维通道管理集群和运行在服务器上的客户端。
如图3所示，该方法包括如下步骤。
S310：运维通道管理集群获取用户对目标服务器的访问命令。
例如，在步骤S310中，运维通道管理集群可以获取用户对目标服务器的访问命令。作为示例，用户可以在用户界面上选择要访问的云服务资源并输入具体的访问操作，根据该云服务资源所在的目标服务器，用户界面生成用户对目标服务器的访问命令，并将该访问命令发送至运维通道管理集群。可选地，运维通道管理集群可以通过WebSocket协议从用户界面获取访问命令。
S320：运维通道管理集群将访问命令发送至客户端。
例如，在步骤S320中，运维通道管理集群可以将用户对目标服务器的访问命令发送至客户端。作为示例，运维通道管理集群可以负责多个服务器的访问管理，每个服务器上都部署有客户端负责执行对应服务器的访问命令，访问命令指示了目标服务器，因此运维通道管理集群能够将该访问命令发送至目标服务器上的客户端。
可选地，运维通道管理集群可以根据TCP向目标服务器上的客户端发送访问命令。通过使运维通道管理集群与客户端之间通过传输层的TCP直接通信，能够避免使用SSH作为远程连接工具，从而不需要目标服务器为SSH服务开启高风险的22号端口，提高服务器的安全性。
S330：客户端根据会话状态信息，执行访问命令。
例如，在步骤S330中，目标服务器上的客户端可以执行访问命令。具体地，客户端能够为用户和目标服务器之间建立的会话创建session对象，session对象中存储有客户端记录的会话状态信息，因此客户端能够根据会话状态信息执行该访问命令。
作为示例，用户在与服务器建立一次会话的时间内，用户可以发出了多个连续且相互关联的访问命令。例如，上述访问命令可以包括第一访问命令、第二访问命令和第三访问命令，其中，第一访问命令和第二访问命令先于第三访问命令发出并执行，第三访问命令需要基于第一访问命令和第二访问命令的内容和执行结果执行。当客户端收到第三访问命令时，客户端中存储的当前会话的会话状态信息中可以包括第一访问命令和第二访问命令的内容以及执行结果，因此客户端能够正确执行第三访问命令；如果上述会话状态信息丢失，则会导致第三访问命令无法正确执行。
可选地，客户端可以同时管理多个会话，客户端可以根据不同访问命令对应的不同会话调用不同的子进程执行。具体地，客户端可以根据不同用户对目标服务器上不同云服务的访问分别建立session对象，session对象建立后会为每个session对象分配独有的会话标识，访问命令中可以包括会话标识，是的客户端可以根据访问命令中携带的会话标识确定该访问命令所对应的会话。进一步地，会话状态信息可以包括会话标识与目标服务器OS中的子进程的对应关系，其中不同的子进程可以用于对不同云服务执行访问操作，因此客户端在确定访问命令对应的会话后能够进一步确定用于执行该访问命令的子进程。通过上述方式，客户端能够根据访问命令中的会话标识以及会话状态信息，调用服务器OS中相应的子进程执行命令，使得客户端能够将不同用户的会话分开管理，从而提高访问管理的效率。
可选地，客户端在执行完成访问命令后，还可以通过运维通道管理集群将访问结果展示给用户。具体地，客户端可以将执行结果发送至运维通道管理集群，运维向用户发送执行结果。作为示例，运维通道管理集群可以将执行结果发送至用户界面，使用户界面生成用于向用户展示该执行结果的可视化界面。从而使得运维通道管理集群能够监控用户访问服务器的全过程，便于对用户行为的监控和审计，提高访问管理的安全性。
通过本申请实施例的技术方案，在服务器上设置客户端作为接入服务器的入口，运维通道管理集群 直接与客户端通信，将访问命令分发至客户端，使得会话状态信息能够被记录在客户端而不是运维通道管理集群上。因此运维通道管理集群中的节点是无状态的，切换节点时新的节点能够直接工作而无需配置会话状态信息，能够避免会话状态信息缺失导致已建立的会话中断，从而在不中断服务的情况下切换运维通道实例，解决运维通道管理集群的快速扩缩容问题。
对于上述步骤S320，在一些可能的实施方式中，运维通道管理集群可以设置多个节点，使得运维通道管理集群能够管理负责分发访问命令的节点，由于运维通道管理集群中的节点是无状态的，从而运维通道管理集群在需要时能够自主调控节点的工作情况。具体地，运维通道管理集群中可以包括负载均衡组件和至少一个运维通道实例，负载均衡组件用于将获取到的访问命令转发至一个当前可工作的运维通道实例，该运维通道实例用于将向客户端发送该访问命令。
在该情况下，图4示出了本申请实施例提供的一种调度运维通道实例的示意性流程图。如图4所示，将用户和服务器间建立会话作为流程的开始，用户和服务期间建立的该会话断开作为结束。在该过程中，运维通道管理集群获取访问命令后，负载均衡组件将访问命令转发至当前可工作的运维通道实例，该运维通道实例向客户端发送该访问命令。
例如，运维通道管理集群可以包括第一运维通道实例，负载均衡组件可以将获取的第一访问命令转发至第一运维通道实例。第一运维通道实例向客户端发送第一访问命令，如果第一运维通道实例发送第一访问命令成功，则客户端能够接收第一访问命令并执行。可选地，客户端执行第一访问命令的具体过程可以包括是根据第一访问命令中携带的会话标识获取服务器OS中对应的子进程，调用该子进程执行第一访问命令并返回执行结果。第一访问命令执行结束后如果会话尚未结束，则运维通道管理集群能够继续获取访问命令并重复上述步骤。
如果运维通道实例向客户端发送访问命令失败，则运维通道实例能够向负载均衡组件上报异常，由负载均衡组件将访问命令转发至另一个当前可工作的运维通道实例。下面结合两个示例进行具体说明。
示例一，运维通道管理集群除第一运维通道实例外还可以包括第二运维通道实例。负载均衡组件将获取的第二访问命令转发至第一运维通道实例，但第一运维通道实例接收到第二访问命令后未能成功向客户端发送第二访问命令。例如，由于第一运维通道实例当前有大量其他会话的访问命令正在发送中，导致第一运维通道实例负载过高，第二访问命令等待超时；又例如，由于第一运维通道实例在接收到第二访问命令后出现了故障，导致第一运维通道实例失去了正常工作的能力。在上述情况下，第一运维通道实例能够向负载均衡组件上报异常信息，负载均衡组件收到第一运维通道实例的发送的异常信息后，负载均衡组件能够将第二访问命令转发至第二运维通道实例，由第二运维通道实例向客户端发送第二访问命令。第二运维通道实例成功向客户端发送第二访问命令后，客户端能够接收并执行第二访问命令。
通过本申请实施例的技术方案，在例如负载均衡或容灾等导致当前负责转发访问命令的运维通道实例异常的情况下，当前节点没有成功向客户端发送，将转发任务重新分配给运维通道管理集群内的其他节点，实现不中断访问情况下的切换节点，从而提高运维通道管理集群的快速容灾或负载均衡的能力，提高运维通道管理集群服务的可用性。
可选地，在上述示例中，第一运维通道实例和第二运维通道实例可以部署在不同的region中。由于切换节点不需要重新配置会话状态信息，因此运维通道实例节点间可以无需信息交互，不需要限制运维通道实例所在的物理地区，实现运维通道实例的跨region部署。使得切换前后负责转发的节点位于不同的物理地区，降低不同节点同时发生异常的可能性，从而实现异地容灾，进一步提高运维通道管理集群服务的可用性。
示例二，运维通道管理集群还可以部署新的运维通道实例。负载均衡组件将获取的第三访问命令转发至第一运维通道实例，第一运维通道实例未成功发送第三访问命令并上报异常后，例如运维通道管理集群负载已满或全部运维通道实例故障等导致第二运维通道实例也处于不可工作的状态时，负载均衡组件能够建立第三运维通道实例，并将将第三访问命令转发至第三运维通道实例，由第三运维通道实例向客户端发送第三访问命令。作为示例，负载均衡组件可以请求原本不包括在运维通道管理集群内一台或多台计算实例，将该一台或多台计算实例包括至运维通道管理集群范围内，从而用作第三运维通道实例。
应理解，上述示例二仅是以运维通道管理集群当前无可工作的运维通道实例的情况为例，说明运维通道管理集群具有扩展运维通道实例数量的能力，并不限定仅在该情况下才可以新增运维通道实例。例如，用户可以通过用户界面购买了更大规格的运维通道管理集群服务，此时用户界面也能够发出指令，指示运维通道管理集群建立新的运维通道实例。
通过本申请实施例的技术方案，运维通道管理集群能够部署新的运维通道实例，并将转发任务重新分配给该新的运维通道实例，实现不中断访问情况下的运维通道管理集群扩容，从而提高运维通道管理集群的快速扩容能力，提高运维通道管理集群服务的可用性。
可选地，与快速扩容能力相对的，运维通道管理集群还可以提供快速缩容的能力。作为示例，当运维通道管理集群需要删除第一运维通道实例时，第一运维通道实例能够将其当前尚未成功发送的访问命令上报负载均衡组件，由负载均衡组件将这些访问命令重新分配至其他运维通道实例，从而将第一运维通道实例从运维通道管理集群中删除。
由于本申请技术方案中运维通道实例是无状态的，负责转发访问命令的运维通道实例的切换不会影响记录在客户端中的会话状态信息。因此，上述全部示例中的运维通道实例的切换均不会导致用户与服务器已建立的会话断开，切换后的节点无需配置可直接使用，使得切换所需的时间可控且迅速，从而使上述切换过程都能够在用户无感知的情况下完成。
本申请实施例提供的访问管理的系统中，仅是将需要节点有状态的功能，例如会话控制，由运维通道管理集群转移至目标服务器上的客户端执行。可以在节点无状态下执行的功能，能够继续由运维通道管理集群执行，从而为用户提供操作审计、权限管理、等保合规等服务。通过运维通道管理集群转发用户对服务器的访问命令，能够隔离用户和服务器，从而确保服务器访问的安全性；此外，也能够对不同用户对不同服务器的访问实现集中管理，便于认证鉴权以及后续审计定责。
作为示例，运维通道管理集群能够为用户提供身份认证服务。在该情况下，图5示出了本申请实施例提供的一种访问管理的方法的示意性流程图。
如图5所示，该方法包括如下步骤。
S510：运维通道管理集群获取登录命令。
例如，在步骤S510中，运维通道管理集群能够在建立用户与目标服务器的会话前，先获取用户的登录命令。具体地，该登录命令用于确认当前请求登录以及后续发出访问命令的用户的身份。作为示例，用户可以通过在用户界面输入已注册的云账号和密码进行登录，用户界面能够根据用户的输入，生成登录命令并发送至运维通道管理集群。
S520：运维通道管理集群向认证鉴权服务发送登录命令。
例如，在步骤S520中，运维通道管理集群能够向认证鉴权服务发送该登录命令，从而由认证鉴权服务根据该登录命令认证用户的身份。可选地，认证鉴权服务包括但不限于IAM服务。
S530：运维通道管理集群接收来自认证鉴权服务的认证信息。
例如，在步骤S530中，认证鉴权服务能够根据运维通道管理集群发送的登录命令确认用户身份，从而生成认证信息并发送给运维通道管理集群，使得运维通道管理集群能够接收该认证信息。
S540：运维通道管理集群根据认证信息，确定用户的登录状态。
例如，在步骤S540中，运维通道管理集群能够根据认证信息确定用户的登录状态。作为示例，认证信息可以是认证成功信息，例如用户输入的云账号和密码是已注册且匹配的，且该云账户的用户有权限访问运维通道管理集群管理的至少部分云服务，则认证鉴权服务生成并发送认证成功信息，运维通道管理集群根据认证成功信息能够确定用户登录成功，能够继续执行后续访问步骤。认证信息也可以是认证失败信息，例如用户输入的云账号为注册，或云账号与密码不匹配，或该云账号无权限访问该运维通道管理集群管理的任何云服务等情况，则认证鉴权服务生成并发送认证失败信息，运维通道管理集群根据认证失败信息能够确定用户没有成功登录。可选地，认证失败时，运维通道管理集群能够通过用户界面告知用户登录失败并请求用户重新登录，如果用户未能重新正确登录，则无权进行后续访问。
应理解，上述方案中由于认证信息是由认证鉴权服务向运维通道管理集群发送的，运维通道管理集群内任意运维通道实例在需要时均能接收到来自认证鉴权服务的认证信息，因此用户的登录状态无需记录在运维通道管理集群的节点中，使得身份认证服务并不依赖于某一具体的运维通道实例。例如，在会话过程中切换负责转发访问命令的运维通道实例后，切换后的运维通道实例能够根据发送访问命令的用户再次向认证鉴权服务请求该用户的认证信息，从而确定该用户的登录状态，无需用户重新登陆。在保证用户访问安全性的基础上，提高用户的使用体验。
在认证用户登录成功的情况下，访问管理的系统能够继续对访问命令进行管理，具体包括如下步骤：
S550：运维通道管理集群获取访问命令。
S560：运维通道管理集群向客户端发送访问命令，或者说，客户端接收来自运维通道管理集群的访 问命令。
可选地，运维通道管理集群在向客户端发送访问命令前，还能够从外部存储服务获取该用户的访问权限，并根据访问命令是否满足访问权限，确定是否向客户端发送该访问命令。具体地，访问权限用于指示该用户能够访问的云服务以及具体能够执行的操作，如果运维通道管理集群确定访问命令满足访问权限，则运维通道管理集群能够执行步骤S560以及后续步骤；如果运维通道管理集群确定访问命令不满足访问权限，则运维通道管理集群不执行S560，返回步骤S550。可选地，外部存储服务包括但不限于数据库、云数据库、云存储服务等，本申请不做具体限定。作为示例，外部存储服务可以是认证鉴权服务，认证鉴权服务在存储已注册的用户身份的同时还可以存储用户身份对应的访问权限，从而在用户登录认证成功时将该用户的访问权限发送给运维通道管理集群；外部存储服务还可以是其他独立的存储服务，例如RDS，用户的访问权限设置后运维通道管理集群能够将其上传至RDS，从而使任意运维通道实例在需要时都能够从RDS请求该访问权限。
通过上述方案，运维通道管理集群能够从外部存储服务获取用户对服务器的访问权限，使得运维通道管理集群中的任意节点都能够在不预先配置的情况下对用户的访问权限进行管理，从而使运维通道管理集群能够提供权限管理服务，提高访问管理的安全性。
S570：客户端根据会话状态信息，执行访问命令。
可选地，该方法还可以包括：
S580：客户端向运维通道管理集群发送执行结果，或者说，运维通道管理集群接收来自客户端的执行结果。
可选地，上述步骤S550至S580的实现方式可以与前文所述访问管理的方法相同，具体实施方式可以参考前文中对图3和图4以及相应实施例的说明，这里不再赘述。
通过本申请实施例的技术方案，运维通道管理集群能够与外部的认证鉴权服务交互，从而加强用户身份认证管理。
应理解，图5所示方法仅是以认证鉴权服务为例，说明本申请实施例提供的运维通道管理集群能够提供无状态的功能，但并不仅限于提供身份认证或权限管理功能，运维通道管理集群还能提供例如等保合规、操作审计等其他无状态的功能。
作为示例，运维通道管理集群能够对用户的访问操作进行审计管理。具体地，在用户登录成功后，运维通道管理集群能够将会话期间每一次向客户端转发的访问命令同时发送至CTS，同时将客户端反馈的对应的执行结果也发送至CTS，从而由CTS监控并记录用户全程的行为。当CTS发现用户的访问行为存在安全风险时，运维通道管理集群能够接收来自CTS的预警信息，运维通道管理集群根据预警信息通过用户界面提示用户，必要时能够中止转发该用户的访问命令。当用户请求查看操作记录时，运维通道管理集群能够向CTS发出请求并接收来自CTS的操作记录，从而通过用户界面反馈给用户。
上文结合图3至图5说明了本申请提供的访问管理的方法实施例，下面结合图6至图10，对本申请提供的访问管理的装置实施例进行说明。
图6示出了本申请实施例提供的一种访问管理的系统600的示意性结构图。如图6所示，系统600包括运维通道管理集群610和客户端620，其中客户端620运行在目标服务器上。
图7示出了本申请实施例提供的一种访问管理的系统600中运维通道管理集群610示意性结构框图。
如图7所示，该运维通道管理集群610包括：命令获取模块611，命令分发模块612。
具体地，该命令获取模块611用于获取用户对目标服务器的访问命令。
具体地，该命令分发模块612用于将访问命令发送至客户端。
可选地，运维通道管理集群包括负载均衡组件，运维通道管理集群至少还包括第一运维通道实例和第二运维通道实例，命令分发模块612具体用于负载均衡组件将访问命令发送至第一运维通道实例；第一运维通道实例向客户端发送访问命令。
可选地，命令分发模块612具体还用于第一运维通道实例向负载均衡组件上报异常信息，异常信息用于指示第一运维通道实例向客户端发送访问命令失败；负载均衡组件将访问命令发送至第二运维通道实例；第二运维通道实例向客户端发送访问命令。
可选地，第一运维通道实例和第二运维通道实例部署在不同的区域。
可选地，命令分发模块612具体还用于第一运维通道实例向负载均衡组件上报异常信息，异常信息用于指示第一运维通道实例向客户端发送访问命令失败；负载均衡组件建立第三运维通道实例；负载均 衡组件将访问命令发送至第三运维通道实例；第三运维通道实例向客户端发送访问命令。
可选地，命令分发模块612具体用于根据传输控制协议向客户端发送访问命令。
具体地，客户端620用于根据会话状态信息，执行访问命令，会话状态信息是客户端记录的用户对目标服务器的访问信息。
可选地，访问命令中包括会话标识，会话状态信息中包括会话标识与目标服务器的操作系统中的子进程的对应关系，客户端620具体用于根据访问命令的会话标识和会话状态信息，确定与会话标识对应的子进程；调用子进程执行访问命令。
可选地，运维通道管理集群610还可以包括登录认证模块613，在获取用户对目标服务器的访问命令前，用于：获取用户的登录命令；向认证鉴权服务发送登录命令，认证鉴权服务用于认证用户的身份；接收来自认证鉴权服务的认证信息；根据认证信息，确定用户的登录状态。
可选地，运维通道管理集群610还可以包括权限管理模块614，在将访问命令发送至客户端前，用于：从外部存储服务获取访问权限；确定访问命令满足访问权限。
可选地，客户端620还用于将访问命令的执行结果发送至运维通道管理集群；运维通道管理集群610还可以包括结果展示模块615，用于向用户发送执行结果。
其中，上述模块均可以通过软件实现，或者可以通过硬件实现。示例性的，接下来以命令分发模块612为例，介绍命令分发模块612的实现方式。类似的，命令获取模块611、登录认证模块613、权限管理模块614和结果展示模块615的实现方式可以参考命令分发模块612的实现方式。
模块作为软件功能单元的一种举例，命令分发模块612可以包括运行在计算实例上的代码。其中，计算实例可以包括物理主机(计算设备)、虚拟机、容器中的至少一种。进一步地，上述计算实例可以是一台或者多台。例如，命令分发模块612可以包括运行在多个主机/虚拟机/容器上的代码。需要说明的是，用于运行该代码的多个主机/虚拟机/容器可以分布在相同的区域(region)中，也可以分布在不同的region中。进一步地，用于运行该代码的多个主机/虚拟机/容器可以分布在相同的可用区(availability zone，AZ)中，也可以分布在不同的AZ中，每个AZ包括一个数据中心或多个地理位置相近的数据中心。其中，通常一个region可以包括多个AZ。
同样，用于运行该代码的多个主机/虚拟机/容器可以分布在同一个虚拟私有云(virtual private cloud，VPC)中，也可以分布在多个VPC中。其中，通常一个VPC设置在一个region内，同一region内两个VPC之间，以及不同region的VPC之间跨区通信需在每个VPC内设置通信网关，经通信网关实现VPC之间的互连。
模块作为硬件功能单元的一种举例，命令分发模块612可以包括至少一个计算设备，如服务器等。或者，命令分发模块612也可以是利用专用集成电路(application-specific integrated circuit，ASIC)实现、或可编程逻辑器件(programmable logic device，PLD)实现的设备等。其中，上述PLD可以是复杂程序逻辑器件(complex programmable logical device，CPLD)、现场可编程门阵列(field-programmable gate array，FPGA)、通用阵列逻辑(generic array logic，GAL)或其任意组合实现。
命令分发模块612包括的多个计算设备可以分布在相同的region中，也可以分布在不同的region中。命令分发模块612包括的多个计算设备可以分布在相同的AZ中，也可以分布在不同的AZ中。同样，命令分发模块612包括的多个计算设备可以分布在同一个VPC中，也可以分布在多个VPC中。其中，所述多个计算设备可以是服务器、ASIC、PLD、CPLD、FPGA和GAL等计算设备的任意组合。
需要说明的是，在其他实施例中，命令获取模块611、命令分发模块612、登录认证模块613、权限管理模块614和结果展示模块615可以分别用于执行上述访问管理的方法中的任意步骤，命令获取模块611、命令分发模块612、登录认证模块613、权限管理模块614和结果展示模块615负责实现的步骤可根据需要指定，通过命令获取模块611、命令分发模块612、登录认证模块613、权限管理模块614和结果展示模块615分别实现上述访问管理的方法中不同的步骤来实现运维通道管理集群的全部功能。
本申请还提供一种计算设备100。如图8所示，计算设备100包括：总线102、处理器104、存储器106和通信接口108。处理器104、存储器106和通信接口108之间通过总线102通信。计算设备100可以是服务器或终端设备。应理解，本申请不限定计算设备100中的处理器、存储器的个数。
总线102可以是外设部件互连标准(peripheral component interconnect，PCI)总线或扩展工业标准结构(extended industry standard architecture，EISA)总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示，图8中仅用一条线表示，但并不表示仅有一根总线或一种类型的总线。总线102可 包括在计算设备100各个部件(例如，存储器106、处理器104、通信接口108)之间传送信息的通路。
处理器104可以包括中央处理器(central processing unit，CPU)、图形处理器(graphics processing unit，GPU)、微处理器(micro processor，MP)或者数字信号处理器(digital signal processor，DSP)等处理器中的任意一种或多种。
存储器106可以包括易失性存储器(volatile memory)，例如随机存取存储器(random access memory，RAM)。处理器104还可以包括非易失性存储器(non-volatile memory)，例如只读存储器(read-only memory，ROM)，快闪存储器，机械硬盘(hard disk drive，HDD)或固态硬盘(solid state drive，SSD)。
存储器106中存储有可执行的程序代码，处理器104执行该可执行的程序代码以分别实现前述命令获取模块、命令分发模块、登录认证模块、权限管理模块和结果展示模块的功能，从而实现上述访问管理的方法。也即，存储器106上存有用于执行上述访问管理的方法的指令。
通信接口108使用例如但不限于网络接口卡、收发器一类的命令分发模块，来实现计算设备100与其他设备或通信网络之间的通信。
本申请实施例还提供了一种计算设备集群。该计算设备集群包括至少一台计算设备。该计算设备可以是服务器，例如是中心服务器、边缘服务器，或者是本地数据中心中的本地服务器。在一些实施例中，计算设备也可以是台式机、笔记本电脑或者智能手机等终端设备。
如图9所示，所述计算设备集群包括至少一个计算设备100。计算设备集群中的一个或多个计算设备100中的存储器106中可以存有相同的用于执行上述访问管理的方法的指令。
在一些可能的实现方式中，该计算设备集群中的一个或多个计算设备100的存储器106中也可以分别存有用于执行上述访问管理的方法的部分指令。换言之，一个或多个计算设备100的组合可以共同执行用于执行上述访问管理的方法的指令。
需要说明的是，计算设备集群中的不同的计算设备100中的存储器106可以存储不同的指令，分别用于执行上述运维通道管理集群的部分功能。也即，不同的计算设备100中的存储器106存储的指令可以实现命令获取模块、命令分发模块、登录认证模块、权限管理模块和结果展示模块中的一个或多个模块的功能。
在一些可能的实现方式中，计算设备集群中的一个或多个计算设备可以通过网络连接。其中，所述网络可以是广域网或局域网等等。图10示出了一种可能的实现方式。如图10所示，两个计算设备100A和100B之间通过网络进行连接。具体地，通过各个计算设备中的通信接口与所述网络进行连接。在这一类可能的实现方式中，计算设备100A中的存储器106中存有执行命令获取模块和命令分发模块的功能的指令。同时，计算设备100B中的存储器106中存有客户端的功能的指令。
应理解，图10中示出的计算设备100A的功能也可以由多个计算设备100完成。同样，计算设备100B的功能也可以由多个计算设备100完成。
本申请实施例还提供一种芯片，该芯片包括处理器与数据接口，该处理器通过该数据接口读取存储器上存储的指令，以执行上述访问管理的方法。
本申请实施例还提供了一种包含指令的计算机程序产品。所述计算机程序产品可以是包含指令的，能够运行在计算设备上或被储存在任何可用介质中的软件或程序产品。当所述计算机程序产品在至少一个计算设备上运行时，使得至少一个计算设备执行上述访问管理的方法。
本申请实施例还提供了一种计算机可读存储介质。所述计算机可读存储介质可以是计算设备能够存储的任何可用介质或者是包含一个或多个可用介质的数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘)等。该计算机可读存储介质包括指令，所述指令指示计算设备执行上述管理的各技术特征可以进行任意的组合，为使描述简洁，未对上述实施例中的各个技术特征所有可能的组合都进行描述，然而，只要这些技术特征的组合不存在矛盾，都应当认为是本说明书记载的范围。
以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的保护范围。

Claims (23)

  1. 一种访问管理的方法，其特征在于，所述方法应用于访问管理的系统，所述系统包括运维通道管理集群和客户端，所述客户端运行在目标服务器上，所述运维通道管理集群包括多个运维通道实例，每个运维通道实例用于与所述客户端进行信息交互，所述每个运维通道实例由至少一台计算实例组成，所述至少一台计算实例包括物理主机、虚拟机、容器中的至少一种，所述方法包括：
    所述运维通道管理集群获取用户对所述目标服务器的访问命令；
    所述运维通道管理集群将所述访问命令发送至所述客户端；
    所述客户端根据会话状态信息，执行所述访问命令，所述会话状态信息是所述客户端记录的所述用户对所述目标服务器的访问信息。
  2. 根据权利要求1所述的方法，其特征在于，所述运维通道管理集群还包括负载均衡组件，所述多个运维通道实例中包括第一运维通道实例和第二运维通道实例，所述将所述访问命令发送至所述客户端，包括：
    所述负载均衡组件将所述访问命令发送至所述第一运维通道实例；
    所述第一运维通道实例向所述客户端发送所述访问命令。
  3. 根据权利要求2所述的方法，其特征在于，所述将所述访问命令发送至所述客户端，还包括：
    所述第一运维通道实例向所述负载均衡组件上报异常信息，所述异常信息用于指示所述第一运维通道实例向所述客户端发送所述访问命令失败；
    所述负载均衡组件将所述访问命令发送至所述第二运维通道实例；
    所述第二运维通道实例向所述客户端发送所述访问命令。
  4. 根据权利要求3所述的方法，其特征在于，所述第一运维通道实例和所述第二运维通道实例部署在不同的区域。
  5. 根据权利要求2所述的方法，其特征在于，所述将所述访问命令发送至所述客户端，还包括：
    所述第一运维通道实例向所述负载均衡组件上报异常信息，所述异常信息用于指示所述第一运维通道实例向所述客户端发送所述访问命令失败；
    所述负载均衡组件建立第三运维通道实例；
    所述负载均衡组件将所述访问命令发送至所述第三运维通道实例；
    所述第三运维通道实例向所述客户端发送所述访问命令。
  6. 根据权利要求1至5中任意一项所述的方法，其特征在于，所述将所述访问命令发送至所述客户端，包括：
    所述运维通道管理集群根据传输控制协议向所述客户端发送所述访问命令。
  7. 根据权利要求1至6中任意一项所述的方法，其特征在于，所述访问命令中包括会话标识，所述会话状态信息中包括会话标识与所述目标服务器的操作系统中的子进程的对应关系，所述根据会话状态信息，执行所述访问命令，包括：
    根据所述访问命令的会话标识和所述会话状态信息，确定与所述会话标识对应的子进程；
    调用所述子进程执行所述访问命令。
  8. 根据权利要求1至7中任意一项所述的方法，其特征在于，在获取用户对所述目标服务器的访问命令前，所述方法还包括：
    所述运维通道管理集群获取所述用户的登录命令；
    所述运维通道管理集群向认证鉴权服务发送所述登录命令，所述认证鉴权服务用于认证所述用户的身份；
    所述运维通道管理集群接收来自所述认证鉴权服务的认证信息；
    所述运维通道管理集群根据所述认证信息，确定所述用户的登录状态。
  9. 根据权利要求1至8中任意一项所述的方法，其特征在于，在将所述访问命令发送至所述客户端前，所述方法还包括：
    所述运维通道管理集群从外部存储服务获取访问权限；
    所述运维通道管理集群确定所述访问命令满足所述访问权限。
  10. 根据权利要求1至9中任意一项所述的方法，其特征在于，所述方法还包括：
    所述客户端将所述访问命令的执行结果发送至所述运维通道管理集群；
    所述运维通道管理集群向所述用户发送所述执行结果。
  11. 一种访问管理的系统，其特征在于，所述系统包括运维通道管理集群和客户端，所述客户端运行在目标服务器上，所述运维通道管理集群包括多个运维通道实例，每个运维通道实例用于与所述客户端进行信息交互，所述每个运维通道实例由至少一台计算实例组成，所述至少一台计算实例包括物理主机、虚拟机、容器中的至少一种，所述运维通道管理集群包括：
    命令获取模块，用于获取用户对所述目标服务器的访问命令；
    命令分发模块，用于将所述访问命令发送至所述客户端；
    所述客户端用于：
    根据会话状态信息，执行所述访问命令，所述会话状态信息是所述客户端记录的所述用户对所述目标服务器的访问信息。
  12. 根据权利要求11所述的系统，其特征在于，所述运维通道管理集群还包括负载均衡组件，所述多个运维通道实例中包括第一运维通道实例和第二运维通道实例，所述命令分发模块，用于：
    所述负载均衡组件将所述访问命令发送至所述第一运维通道实例；
    所述第一运维通道实例向所述客户端发送所述访问命令。
  13. 根据权利要求12所述的系统，其特征在于，所述命令分发模块，还用于：
    所述第一运维通道实例向所述负载均衡组件上报异常信息，所述异常信息用于指示所述第一运维通道实例向所述客户端发送所述访问命令失败；
    所述负载均衡组件将所述访问命令发送至所述第二运维通道实例；
    所述第二运维通道实例向所述客户端发送所述访问命令。
  14. 根据权利要求13所述的系统，其特征在于，所述第一运维通道实例和所述第二运维通道实例部署在不同的区域。
  15. 根据权利要求12所述的系统，其特征在于，所述命令分发模块，还用于：
    所述第一运维通道实例向所述负载均衡组件上报异常信息，所述异常信息用于指示所述第一运维通道实例向所述客户端发送所述访问命令失败；
    所述负载均衡组件建立第三运维通道实例；
    所述负载均衡组件将所述访问命令发送至所述第三运维通道实例；
    所述第三运维通道实例向所述客户端发送所述访问命令。
  16. 根据权利要求11至15中任意一项所述的系统，其特征在于，所述命令分发模块，用于：
    根据传输控制协议向所述客户端发送所述访问命令。
  17. 根据权利要求11至16中任意一项所述的系统，其特征在于，所述访问命令中包括会话标识，所述会话状态信息中包括会话标识与所述目标服务器的操作系统中的子进程的对应关系，所述客户端，用于：
    根据所述访问命令的会话标识和所述会话状态信息，确定与所述会话标识对应的子进程；
    调用所述子进程执行所述访问命令。
  18. 根据权利要求11至17中任意一项所述的系统，其特征在于，所述运维通道管理集群还包括登录认证模块，在获取用户对所述目标服务器的访问命令前，用于：
    获取所述用户的登录命令；
    向认证鉴权服务发送所述登录命令，所述认证鉴权服务用于认证所述用户的身份；
    接收来自所述认证鉴权服务的认证信息；
    根据所述认证信息，确定所述用户的登录状态。
  19. 根据权利要求11至18中任意一项所述的系统，其特征在于，所述运维通道管理集群还包括权限管理模块，在将所述访问命令发送至所述客户端前，用于：
    从外部存储服务获取访问权限；
    确定所述访问命令满足所述访问权限。
  20. 根据权利要求11至19中任意一项所述的系统，其特征在于，所述客户端还用于：
    所述客户端将所述访问命令的执行结果发送至所述运维通道管理集群；
    所述运维通道管理集群还包括结果展示模块，用于向所述用户发送所述执行结果。
  21. 一种计算设备，其特征在于，包括处理器和存储器，所述处理器用于执行所述存储器中存储的指令，以使得所述计算设备执行如权利要求1至10中任一项所述的方法。
  22. 一种计算设备集群，其特征在于，包括至少一个计算设备，每个计算设备包括处理器和存储器；
    所述至少一个计算设备的处理器用于执行所述至少一个计算设备的存储器中存储的指令，以使得所述计算设备集群执行如权利要求1至10中任一项所述的方法。
  23. 一种计算机可读存储介质，其特征在于，包括计算机程序指令，当所述计算机指令由计算设备集群执行时，使得所述计算设备集群执行如权利要求1至10中任一项所述的方法。
PCT/CN2024/075967 2023-03-31 2024-02-05 访问管理的方法和系统 Ceased WO2024198734A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP24777528.1A EP4679791A4 (en) 2023-03-31 2024-02-05 ACCESS MANAGEMENT METHOD AND SYSTEM
US19/343,534 US20260032124A1 (en) 2023-03-31 2025-09-29 Access management method and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202310339767.6A CN118740661A (zh) 2023-03-31 2023-03-31 访问管理的方法和系统
CN202310339767.6 2023-03-31

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US19/343,534 Continuation US20260032124A1 (en) 2023-03-31 2025-09-29 Access management method and system

Publications (1)

Publication Number Publication Date
WO2024198734A1 true WO2024198734A1 (zh) 2024-10-03

Family

ID=92852030

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2024/075967 Ceased WO2024198734A1 (zh) 2023-03-31 2024-02-05 访问管理的方法和系统

Country Status (4)

Country Link
US (1) US20260032124A1 (zh)
EP (1) EP4679791A4 (zh)
CN (1) CN118740661A (zh)
WO (1) WO2024198734A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN120493285A (zh) * 2025-05-20 2025-08-15 自然资源部北海海域海岛中心(自然资源部北海信息中心) 一种基于html5技术的数据库堡垒资源管控方法
CN120711010A (zh) * 2025-08-22 2025-09-26 新立讯科技集团股份有限公司 弹性负载均衡千万级并发访问处理方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111478937A (zh) * 2020-02-29 2020-07-31 新华三信息安全技术有限公司 一种负载均衡方法和装置
CN113114643A (zh) * 2021-03-30 2021-07-13 成都安恒信息技术有限公司 一种运维审计系统的运维接入方法及系统
US20210243250A1 (en) * 2020-02-04 2021-08-05 Nutanix, Inc. Efficient virtual ip address management for service clusters
CN115248922A (zh) * 2021-04-27 2022-10-28 华为云计算技术有限公司 用于远程接入的设备以及方法

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10511584B1 (en) * 2016-09-29 2019-12-17 Amazon Technologies, Inc. Multi-tenant secure bastion
US10425473B1 (en) * 2017-07-03 2019-09-24 Pure Storage, Inc. Stateful connection reset in a storage cluster with a stateless load balancer

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210243250A1 (en) * 2020-02-04 2021-08-05 Nutanix, Inc. Efficient virtual ip address management for service clusters
CN111478937A (zh) * 2020-02-29 2020-07-31 新华三信息安全技术有限公司 一种负载均衡方法和装置
CN113114643A (zh) * 2021-03-30 2021-07-13 成都安恒信息技术有限公司 一种运维审计系统的运维接入方法及系统
CN115248922A (zh) * 2021-04-27 2022-10-28 华为云计算技术有限公司 用于远程接入的设备以及方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4679791A4

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN120493285A (zh) * 2025-05-20 2025-08-15 自然资源部北海海域海岛中心(自然资源部北海信息中心) 一种基于html5技术的数据库堡垒资源管控方法
CN120711010A (zh) * 2025-08-22 2025-09-26 新立讯科技集团股份有限公司 弹性负载均衡千万级并发访问处理方法及系统

Also Published As

Publication number Publication date
US20260032124A1 (en) 2026-01-29
EP4679791A1 (en) 2026-01-14
EP4679791A4 (en) 2026-03-25
CN118740661A (zh) 2024-10-01

Similar Documents

Publication Publication Date Title
CN108777625B (zh) 签名的验证方法、装置和系统、存储介质、电子装置
US11907046B2 (en) Distributed object identification system and method, and edge computing device
US10021143B2 (en) Method and apparatus for multi-tenancy secrets management in multiple data security jurisdiction zones
CA2946157C (en) Method and apparatus for multi-tenancy secrets management
US20260032124A1 (en) Access management method and system
CN111049695A (zh) 云网关配置方法和系统
US10447703B2 (en) VNF package operation method and apparatus
CN112948842A (zh) 一种鉴权方法及相关设备
US11363072B1 (en) Identifying and mitigating vulnerable security policies
US20230168973A1 (en) Providing a logical data isolation with intermittent connectivity
US10447818B2 (en) Methods, remote access systems, client computing devices, and server devices for use in remote access systems
CN113904847A (zh) 物联网卡的云平台绑定方法、系统、设备及介质
CN111212077A (zh) 主机访问系统及方法
WO2024169595A1 (zh) 混合云环境中的服务调用方法、电子设备及系统
US10013237B2 (en) Automated approval
CN111726328B (zh) 用于对第一设备进行远程访问的方法、系统以及相关设备
WO2014079489A1 (en) Methods and systems for managing access to a location indicated by a link in a remote access system
CN115277457A (zh) 服务器的控制方法、服务器及存储介质
CN114385447A (zh) 一种微服务总线技术架构系统
CN117879886B (zh) 一种安全外壳协议ssh远程连接进程管理方法及计算设备
WO2025010980A1 (zh) 链路追踪方法和装置
CN114090981B (zh) 一种针对远程主机的访问方法及装置
CN115374407A (zh) 业务访问方法、装置、电子设备和计算机可读存储介质
WO2025082280A1 (zh) 容器退出方法和装置
EP4701133A1 (en) Cloud-computing-based access management method and apparatus, and device

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 24777528

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2024777528

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2024777528

Country of ref document: EP

Effective date: 20251007

ENP Entry into the national phase

Ref document number: 2024777528

Country of ref document: EP

Effective date: 20251007

ENP Entry into the national phase

Ref document number: 2024777528

Country of ref document: EP

Effective date: 20251007

ENP Entry into the national phase

Ref document number: 2024777528

Country of ref document: EP

Effective date: 20251007