CN115391804A

CN115391804A - File transfer protocol command execution method and device

Info

Publication number: CN115391804A
Application number: CN202211018446.8A
Authority: CN
Inventors: 陈亚坤; 宗涛
Original assignee: Bank of China Ltd
Current assignee: Bank of China Ltd
Priority date: 2022-08-24
Filing date: 2022-08-24
Publication date: 2022-11-25

Abstract

The invention discloses a method and a device for executing a file transfer protocol command, which relate to network security, wherein the method comprises the following steps: when the operation flow is executed to the command of executing the FTP step, reading an FTP command file and then decrypting the FTP command file to obtain an FTP step command, wherein the FTP command file is used for storing the FTP step command after the FTP step command in the operation flow is extracted, and the FTP command file is encrypted after the FTP step command is stored; and executing the FTP step command to complete the FTP operation. The invention can avoid the situation of storing the password in the plaintext, and also can avoid the problem of very high risk caused by similar plaintext storage password brought by the FTP command.

Description

File transfer protocol command execution method and device

Technical Field

The present invention relates to the field of network security technologies, and in particular, to a method and an apparatus for executing a file transfer protocol command.

Background

In the field of computers, a job refers to a specific operation step performed by a computer in the whole data processing process. Each job typically performs only one basic function. The job flow is a combination of a plurality of independent jobs in a certain order, and the flow is executed in a predetermined order to complete a predetermined processing target.

A mainframe: also known as MAINFRAME, MAINFRAME. A dedicated instruction set, operating system and application software are used. The computer has greater advantages of I/O capability, non-numerical calculation capability, stability and safety than a microcomputer, and is mainly used for business fields with more centralized processing operation, such as banks and telecommunications.

Under normal conditions, for a data transmission task that needs to be completed at fixed time and fixed point every day, the host platform relies on using a workflow to perform FTP (File Transfer Protocol) transmission to a great extent.

FTP (File Transfer Protocol) is an application layer Protocol used for File Transfer between clients and servers over a computer network.

Like most Internet services, FTP is also a client/server system. The user connects to the FTP server program on the remote host through a client program that supports the FTP protocol. The user issues an FTP command to the server program through the client program, and the server program executes the FTP command issued by the user and returns the result of the execution to the client.

The FTP command is one of the most frequently used commands by Internet users.

At present, a commonly used scheme is that an FTP command (including a password) is extracted into another file, and authority control such as reading and writing is performed on the file, so that any user can be prevented from seeing the file.

The prior art is not sufficient in that there is a security risk because the jobs in the job flow employ FTP commands.

Disclosure of Invention

The embodiment of the invention provides a method for executing a file transfer protocol command, which is used for solving the problem of security risk caused by the fact that the operation in the operation flow adopts an FTP command, and comprises the following steps:

when the operation flow is executed to the command of executing the FTP step, reading an FTP command file and then decrypting the FTP command file to obtain an FTP step command, wherein the FTP command file is used for storing the FTP step command after the FTP step command in the operation flow is extracted, and the FTP command file is encrypted after the FTP step command is stored;

and executing the FTP step command to complete the FTP operation.

An embodiment of the present invention further provides a file transfer protocol command execution device, configured to solve a problem that a security risk exists due to an FTP command being used for a job in a job flow, where the device includes:

the encryption and decryption module is used for reading an FTP command file and then decrypting the FTP command file to obtain an FTP step command when the operation flow is executed to the FTP step command, wherein the FTP command file is used for storing the FTP step command after the FTP step command in the operation flow is extracted, and the FTP command file is encrypted after the FTP step command is stored;

and the execution module is used for executing the FTP step command to finish the FTP operation.

The embodiment of the invention also provides computer equipment, which comprises a memory, a processor and a computer program which is stored on the memory and can run on the processor, wherein the processor realizes the file transfer protocol command execution method when executing the computer program.

An embodiment of the present invention further provides a computer-readable storage medium, where a computer program is stored, and when the computer program is executed by a processor, the computer program implements the file transfer protocol command execution method.

An embodiment of the present invention further provides a computer program product, where the computer program product includes a computer program, and when the computer program is executed by a processor, the method for executing the file transfer protocol command is implemented.

In the embodiment of the invention, compared with the technical scheme in the prior art that the risk is very high due to the similar plaintext storage password brought by the FTP command, the FTP step commands in the jobs in the job flow are extracted to form independent files for encryption, and the FTP step commands are decrypted only when the FTP step commands are executed, so that the FTP step commands are in a state that the FTP step commands cannot be checked in other links, the condition that the similar plaintext storage password is brought is avoided, and the problem that the risk is very high due to the similar plaintext storage password brought by the FTP command can be avoided.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts. In the drawings:

FIG. 1 is a schematic diagram illustrating an implementation flow of a method for executing a file transfer protocol command according to an embodiment of the present invention;

FIG. 2 is a diagram illustrating an architecture for executing a file transfer protocol command according to an embodiment of the present invention;

FIG. 3 is a flow chart illustrating an implementation of a file transfer protocol command in an embodiment of the present invention;

FIG. 4 is a diagram illustrating an exemplary architecture of a file transfer protocol command execution apparatus according to an embodiment of the present invention;

FIG. 5 is a diagram of a computer device according to an embodiment of the present invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the embodiments of the present invention more apparent, the embodiments of the present invention are further described in detail below with reference to the accompanying drawings. The exemplary embodiments and descriptions of the present invention are provided to explain the present invention, but not to limit the present invention.

The inventor notices in the process of invention that:

under normal conditions, for data transmission tasks which need to be completed at fixed time and fixed point every day, the host platform is greatly dependent on using the workflow to perform FTP transmission.

At present, a commonly used scheme is that when an FTP command is processed, information including a password is extracted into another file, and authority control such as reading and writing is performed on the file, so that any user can be prevented from seeing the file.

However, the minimum scope awareness principle of privacy is not met due to the failure to distinguish between user right control and application right control.

In addition, according to the normal job flow writing method, the input content of the FTP step needs to be realized by a complete FTP command. Such as:

//FTP EXEC PGM＝FTP,PARM＝'(EXIT＝12TIMEOUT 20',COND＝(4,LT)

//SYSPRINT DD SYSOUT＝*

//SYSIN DD*

//XX.XXX.XX.XX

//abcdefg

//ASCII

//cd receive/org/

//quit

when the server is connected, after the address is input to the address XX.XXX.XX.XX ", the server inquires the user name abcdefg and the corresponding password abcdefg, and the user can log in after the authentication is passed. Therefore, the scheme has certain security risk, namely the risk is very high when the password is stored in the clear text.

Based on the above, the invention provides a file transfer protocol command execution scheme of a workflow, which is used for solving the security problem caused by the fact that the jobs in the workflow adopt FTP commands.

The following description will be given with reference to examples.

Fig. 1 is a schematic flow chart of an implementation of a file transfer protocol command execution method, as shown in the figure, including:

step 101, when the operation flow is executed to the FTP step command, reading an FTP command file and then decrypting the FTP command file to obtain an FTP step command, wherein the FTP command file is used for storing the FTP step command after the FTP step command in the operation flow is extracted, and the FTP command file is encrypted after the FTP step command is stored;

and step 102, executing the FTP step command to finish the FTP operation.

In the implementation, when the FTP step command is stored in the FTP command file, the FTP step command of each job in the job flow is extracted and then stored in the isomorphic file.

Specifically, the FTP step command for each job may be extracted from the job flow and stored as an isomorphic file.

In the implementation, the password field of the FTP command file is encrypted when the FTP step command is stored.

Specifically, when the FTP command text is encrypted, the encryption may generally be only performed on the password field.

In implementation, the FTP command file is read and then decrypted, and when the encrypted FTP command file is read, the decryption proc is called in the operation flow to read the password into the cache, and the memory is released after the password is used.

Specifically, the encrypted file is read, the decryption proc is called, and the password is read into the cache. And releasing the memory after the password is used.

Adding proc in the operation flow, reading the encrypted file, reading the password into the cache for use after decryption, and releasing the password immediately after use without leaving any trace.

Proc means: for different job flows that accomplish the same function, part of the processing logic common to them can be abstracted to form a common unit, like a common function in C language, and the output can be determined as long as the input is determined. The method has the advantages of multiplexing, easy development process, and concise and understandable codes.

In specific implementation, the FTP step command of a certain job flow can be stored in the FTP command text.

It is also possible to store FTP commands without text, such as using database tables.

The FTP command text is then encrypted, typically only for the password field.

And finally, reading the FTP command text by the daily operation flow, and decrypting the password by using the decryption proc to finish the FTP operation.

Fig. 2 is a schematic diagram of a file transfer protocol command execution architecture, as shown in the figure, at least one functional architecture capable of implementing a file transfer protocol command execution scheme is shown, which may include:

and the FTP command module stores FTP step commands of all the job flows.

Specifically, in the FTP command management link, FTP step commands of each job are extracted from the job flow and stored as isomorphic files individually.

And the encryption and decryption module is used for carrying out encryption and decryption operation management on the password column of the FTP command module.

Specifically, in the password management link, the FTP command file is encrypted and decrypted, and only the password column is processed.

And the daily decryption module reads the FTP step command of the FTP command module, decrypts the password and uses the password.

Specifically, in a daily workflow decryption link, proc is added in a workflow, an encrypted file is read, a password is read into a cache for use after decryption, and the password is released immediately after use without leaving any trace.

The following is an example.

The file transfer protocol command execution implementation may include the following links:

1. and (4) extracting to form an FTP command file.

2. Encryption and decryption proc.

3. And adding a decryption link to the workflow.

Fig. 3 is a schematic diagram of an implementation flow of executing a file transfer protocol command, and as shown in the figure, an implementation of three module architectures including an FTP command module, an encryption decryption module, and a daily decryption module may be as follows:

step 301, FTP command file.

A. Recording FTP steps of operation, such as ip address, user name, password, target path, local path, file name access or storage, code system setting, etc.;

B. and when the operation flow is in the FTP step, reading the text to acquire FTP information.

And step 302, encryption and decryption management.

In the implementation, when the FTP step command is changed, the method further comprises:

after reading the FTP command file, decrypting to obtain an FTP step command;

and after the FTP step command is correspondingly changed, encrypting the FTP command file after the FTP step command is stored.

Specifically, if an FTP command is newly added or modified, the following processing can be performed:

A. the FTP command file on the FTP command module can be decrypted using a decryption program.

B. And newly adding or modifying the decrypted FTP command file.

C. The FTP command file is re-encrypted.

And step 303, decrypting the daily operation flow.

A. And reading the encrypted FTP command file, calling the decryption proc, and reading the password into the cache.

B. And releasing the memory after the password is used.

Steps 301 to 303 are only used to illustrate how to implement, but do not represent that there is a time sequence relationship corresponding to the step sequence number between the steps, and steps 302 and 303 can be regarded as a dynamic maintenance management process, and occur alternately.

The embodiment of the invention also provides an FTP command executing device, which is described in the following embodiments. Because the principle of the device for solving the problems is similar to the FTP command execution method, the implementation of the device can refer to the implementation of the FTP command execution method, and repeated parts are not described again.

Fig. 4 is a schematic structural diagram of a file transfer protocol command execution apparatus, as shown in the figure, the file transfer protocol command execution apparatus may include:

the encryption and decryption module 401 is configured to read an FTP command file and decrypt the file to obtain an FTP step command when the command from the job flow to the FTP step is executed, where the FTP command file is a file used to store the FTP step command after the FTP step command in the job flow is extracted, and the FTP command file is encrypted after the FTP step command is stored;

and an executing module 402, configured to execute the FTP step command to complete the FTP operation.

In implementation, the encryption and decryption module is further configured to extract the FTP step command of each job in the job flow and store the FTP step command in the isomorphic file when the FTP command file stores the FTP step command.

In an implementation, the encryption and decryption module is further configured to encrypt a password field of the FTP command file when the FTP step command is stored.

In implementation, the encryption and decryption module is further used for reading the FTP command file and then decrypting the FTP command file, when the encrypted FTP command file is read, the decryption proc is called in a workflow, the password is read into the cache, and after the password is used, the memory is released.

In an implementation, the encryption and decryption module is further configured to, when the FTP step command changes, further include:

after reading the FTP command file, decrypting to obtain an FTP step command;

When the technical scheme provided by the embodiment of the invention is implemented, the implementation can be carried out as follows.

FIG. 5 is a schematic diagram of a computer device, as shown, the computer device includes:

the processor 500, which is used to read the program in the memory 520, executes the following processes:

executing an FTP step command to complete FTP operation;

a transceiver 510 for receiving and transmitting data under the control of the processor 500.

In the implementation, when the FTP step command is changed, the method further comprises the following steps:

after reading the FTP command file, decrypting to obtain an FTP step command;

Wherein in fig. 5 the bus architecture may comprise any number of interconnected buses and bridges, in particular one or more processors, represented by the processor 500, and various circuits, represented by the memory 520, linked together. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, power management circuits, and the like, which are well known in the art, and therefore, will not be described any further herein. The bus interface provides an interface. The transceiver 510 may be a number of elements including a transmitter and a receiver that provide a means for communicating with various other apparatus over a transmission medium. The processor 500 is responsible for managing the bus architecture and general processing, and the memory 520 may store data used by the processor 500 in performing operations.

An embodiment of the present invention further provides a computer-readable storage medium, where a computer program is stored, and when the computer program is executed by a processor, the FTP command execution method is implemented.

An embodiment of the present invention further provides a computer program product, where the computer program product includes a computer program, and when the computer program is executed by a processor, the FTP command execution method is implemented.

In the embodiment of the invention, compared with the technical scheme in the prior art that the risk is very high due to the similar plaintext storage password brought by the FTP command, the FTP step command in each operation in the operation flow is extracted to form an independent file for encryption, and the file is decrypted only when the FTP step command is executed, so that the FTP step command is in a state that the FTP step command cannot be checked in other links, thereby avoiding the situation of similar plaintext storage password, and avoiding the problem of very high risk due to the similar plaintext storage password brought by the FTP command.

Further, at present, in the daily file transfer of the host platform, the FTP is an indispensable tool. However, when using FTP, strong commands such as ip address, user name, password, etc. need to be explicitly issued, and these commands, especially where and how to manage sensitive information such as password, are one of the most important links of information security.

In the technical scheme provided by the embodiment of the invention, the storage and the use of the passwords on the host platform are finished by utilizing the isomorphic FTP command file and/or the encryption and decryption proc, and the method has the following beneficial effects:

A. and the user authority and the application authority are isolated, and the authority is clear. In the operation, application maintenance and system management, the operation and application maintenance can access the file, but only the maintenance of the encryption and decryption of the password can be operated, and the encryption and decryption module is authorized to be executed by the system management role for the application maintenance, but the system management cannot access the command file. Thus, the clear text password cannot be seen by someone other than the application maintenance.

B. The process of maintaining the encryption and decryption files is very simple, so that the method is simple, convenient and easy to use.

C. Because the existing application is less invasive, the daily workflow decryption link is embedded into the proc of the workflow for reading the FTP command file, the workflow itself does not need to be modified and changed, and no extra burden is brought to the development.

As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

The above-mentioned embodiments are provided to further explain the objects, technical solutions and advantages of the present invention in detail, and it should be understood that the above-mentioned embodiments are only examples of the present invention and should not be used to limit the scope of the present invention, and any modifications, equivalents, improvements and the like made within the spirit and principle of the present invention should be included in the scope of the present invention.

Claims

1. A file transfer protocol command execution method, comprising:

and executing the FTP step command to complete the FTP operation.

2. The method according to claim 1, wherein when the FTP step command is stored in the FTP command file, the FTP step command of each job in the job flow is extracted and stored in a isomorphic file.

3. The method of claim 1 wherein the password field of the FTP command file is encrypted when storing the FTP step command.

4. The method as claimed in claim 1, wherein the decryption is performed after reading the FTP command file, and when the encrypted FTP command file is read, the password is read into the cache by calling the decryption proc in the workflow, and the memory is released after the password is used.

5. The method according to any one of claims 1 to 4, wherein, when the FTP step commands a change, further comprising:

after reading the FTP command file, decrypting to obtain an FTP step command;

6. A file transfer protocol command execution apparatus, comprising:

the encryption and decryption module is used for reading an FTP command file and then decrypting the FTP command file to obtain an FTP step command when the FTP command file is from the execution of a job flow to the execution of the FTP step command, wherein the FTP command file is used for storing the FTP step command after the FTP step command in the job flow is extracted, and the FTP command file is encrypted after the FTP step command is stored;

7. The apparatus of claim 6, wherein the encryption/decryption module is further configured to extract the FTP step command for each job in the job flow and store the FTP step command in an isomorphic file when the FTP step command file stores the FTP step command.

8. The apparatus of claim 6, wherein the encryption/decryption module is further configured to encrypt the password field of the FTP command file when the FTP step command is stored.

9. The apparatus of claim 6, wherein the encryption/decryption module is further configured to perform decryption after reading the FTP command file, and when the encrypted FTP command file is read, read the password into the cache by invoking the decryption proc in the workflow, and release the memory after the password is used.

10. The apparatus according to any one of claims 6 to 9, wherein the encryption/decryption module is further configured to, when the FTP step commands a change, further include:

after reading the FTP command file, decrypting to obtain an FTP step command;

11. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the method of any one of claims 1 to 5 when executing the computer program.

12. A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program which, when executed by a processor, implements the method of any of claims 1 to 5.

13. A computer program product, characterized in that the computer program product comprises a computer program which, when being executed by a processor, carries out the method of any one of claims 1 to 5.