WO2023050110A1

WO2023050110A1 - Method for implementing automatic password change having fault tolerance mechanism for cloud host and cloud bastion host

Info

Publication number: WO2023050110A1
Application number: PCT/CN2021/121543
Authority: WO
Inventors: 吴中岱; 王骏翔; 郭磊; 胡蓉; 韩冰; 刘晋
Original assignee: 中远海运科技股份有限公司
Priority date: 2021-09-29
Filing date: 2021-09-29
Publication date: 2023-04-06

Abstract

The present invention relates to the technical field of cloud computing and information security, and in particular, to a method for implementing automatic password change having a fault tolerance mechanism for a cloud host and a cloud bastion host. In the present invention, an open-source bastion host are deployed and integrated by means of cloud computing service orchestration, a cloud computing platform is connected to a cloud bastion host, and automatic synchronization of cloud asset information of the cloud computing platform is completed; by adding a fault tolerance mechanism and a password issuance by cloud computing platform policy, timed and automatic password change for cloud asset information of the cloud computing platform is implemented. An open-source bastion host is deployed and integrated, and a cloud bastion host verification module is developed; a fault tolerance mechanism response rule is established; a response rule for real-time synchronization of cloud asset information in a cloud computing platform is established; a password change policy is obtained; and automatic password change is performed. According to the present invention, automatic password change for a cloud host and a cloud bastion host is implemented, random password change for all cloud resource accounts is completed and synchronization with the cloud bastion host is also implemented, and a cloud tenant directly logs into the cloud bastion host by means of the cloud platform after automatic password change.

Description

A method for automatically changing encryption with a fault-tolerant mechanism for cloud hosts and cloud bastion hosts

technical field

The invention relates to the technical field of cloud computing and information security, in particular to a method for realizing automatic encryption with a fault-tolerant mechanism for cloud hosts and cloud bastion hosts.

Background technique

Cloud host is an important part of cloud computing in infrastructure applications. It is located at the bottom of the cloud computing industry chain pyramid, and its products originate from cloud computing platforms. The platform integrates three core elements of Internet applications: computing, storage, and network, and provides users with public Internet infrastructure services. Cloud host is a virtualization technology similar to VPS host. VPS uses virtual software. VZ or VM virtualizes multiple parts similar to independent hosts on one host. operating system, the management method is the same as that of the host. With the development of cloud computing, the network security issues cannot be ignored.

As an important part of the security system of the cloud computing platform, the bastion host plays a key role in performing security compliance audits in the hybrid cloud environment. At the same time, it also faces many problems: the infrastructure is highly heterogeneous and widely distributed; The scale of cloud resources continues to grow, requiring the bastion machine to have sufficient scalability; cloud resource management and automatic encryption under cloud dynamic resource delivery and elastic scaling.

Due to the traditional physical equipment, virtualization platform, private cloud, and public cloud within the enterprise, the construction of the cloud computing platform has introduced a large number of different types of IT infrastructure. In order to reduce the difficulty of platform resource management, it is well adapted to the cloud The API interface of the computing platform also requires the bastion machine to have better adaptability and flexibility in asset access and management; in addition, because the current cloud computing platform has multiple enterprises, organizations, and tenants, resulting in the distribution of IT assets The scope is wide and the management is relatively decentralized. The operation and maintenance security audit system based on the bastion machine needs to provide a multi-level authorization management system to adapt to the current IT management model

The infrastructure is highly heterogeneous and widely distributed, and the labor cost of password and other information maintenance is high. The construction of a cloud computing platform introduces a large number of different types of IT infrastructure, including traditional physical bare metal devices within the enterprise, cloud computing virtualized resources, and so on. The traditional bastion host does not have good adaptability and flexibility in asset access and management. In the traditional mode, the addition, deletion, and modification of cloud host accounts need to be completed manually on both sides of the cloud resource and the bastion host. The cost of configuration and manual maintenance is high, and the accuracy and real-time performance are not enough.

The isolation of the cloud computing platform and the traditional bastion host makes it difficult to realize real-time linkage and automatic encryption. The cloud computing platform is relatively isolated from the traditional bastion host. It is difficult for cloud computing platform tenants and bastion host users to link up. It is often necessary to manually maintain the resources of the cloud computing platform and the bastion host. Due to the isolation of the traditional bastion host and the cloud computing platform, the cloud computing platform It is difficult to regularly and automatically change encryption through the cloud computing platform.

In the case of cloud dynamic resource delivery and elastic scaling, cloud resource management is difficult, and automatic encryption is unstable. Due to the dynamic delivery of cloud resources and the flexibility of elastic scaling, resource changes and information maintenance often require manual maintenance. Abnormal, there are unstable factors in automatic encryption.

Therefore, how to solve the problems of highly heterogeneous and scattered infrastructure of the cloud computing platform, the isolation of the cloud computing platform and the traditional bastion machine, which makes it difficult to realize automatic encryption, and even if it is realized, there will be automatic encryption instability. Technical problems that need to be solved urgently.

Contents of the invention

In order to solve the problems of highly heterogeneous and scattered infrastructure of the cloud computing platform, the isolation of the cloud computing platform and the traditional bastion machine, it is difficult to realize automatic encryption and the automatic encryption is unstable after realization, etc., the present invention develops a A method for automatically changing encryption with a fault-tolerant mechanism for cloud hosts and cloud bastion machines, which can complete the automatic synchronization of cloud asset information in the cloud computing platform of the cloud computing platform and the bastion machine, and can issue password policies through the cloud computing platform to realize cloud computing. The cloud asset information in the computing platform is automatically changed; under the unified management of the cloud platform, the random change of the cloud asset information in all cloud computing platforms is completed, and the information is synchronized with the cloud bastion machine, and the automatic change is realized. After encryption, the cloud tenant directly logs in to the cloud bastion machine through the cloud platform.

The present invention claims to protect the following technical solutions:

Through the docking and function development of the API interface of the cloud computing platform with the open source bastion machine, the automatic synchronization of cloud asset information on the cloud computing platform and the cloud bastion machine is completed, and the seamless connection between the cloud computing platform and the bastion machine is realized. , It is no longer necessary to manually maintain two sets of system information, and the cloud asset information in the cloud computing platform only needs to be maintained on the cloud computing platform.

The cloud computing platform uses the self-developed bastion machine verification module and uses the cloud computing service orchestration technology to develop the cloud resource automatic encryption technology, which can directly set the cloud asset information encryption plan in the cloud computing platform on the cloud computing platform. The docking between the platform and the open source bastion host completes automatic encryption and information synchronization.

The cloud computing platform has added an automatic password change fault-tolerant mechanism to improve the stability of automatic password changes, support strategic periodic batch password changes, increase the differentiation of passwords between different systems, and increase the complexity to meet management needs and meet different business scenarios. Resource security compliance requirements.

specific:

The present invention provides a method for automatically changing encryption with a fault-tolerant mechanism for cloud hosts and cloud bastion hosts, which is characterized in that it specifically includes the following steps:

S1 deploys and integrates the open source bastion host, builds a cloud bastion host suitable for cloud business scenarios on the cloud computing platform through the open API interface of the open source bastion host, realizes the connection between the cloud computing platform and the cloud bastion host, and realizes the cloud The cloud asset information of the computing platform and the cloud asset information of the cloud bastion machine are managed and maintained in a unified manner on the cloud computing platform; at the same time, a cloud bastion machine verification module is established on the connected cloud computing platform to ensure Under the structural environment, to verify and ensure the accuracy of the cloud asset information in the cloud computing platform synchronized between the cloud computing platform and the cloud bastion machine, to ensure that the automatic encryption plan can be executed normally;

S2 establishes a fault-tolerant mechanism response rule, and establishes a fault-tolerant mechanism response rule added in the cloud computing platform, which is used to increase the password differentiation between different systems and improve the stability of automatic password change; wherein, the fault-tolerant mechanism refers to the cloud computing platform. When establishing the verification module of the cloud bastion machine, the automatic encryption and fault-tolerant mechanism was added;

S3 establishes the response rules for real-time synchronization of cloud asset information in the cloud computing platform, establishes real-time response rules for cloud asset information in the cloud computing platform under business scenarios such as dynamic delivery and elastic scaling of cloud computing platform, and realizes the cloud Real-time automatic synchronization of cloud asset information on the cloud computing platform between the bastion host and the cloud computing platform;

S4 acquires the encryption policy, obtains the planned task customized by the cloud computing platform for automatic encryption, and determines the encryption strategy according to the planned task;

S5 executes automatic encryption, and after obtaining the automatic encryption strategy, the cloud computing platform automatically calls the cloud computing platform and the cloud bastion machine docked in step S1, and completes the arrangement of the automatic encryption strategy of cloud asset information in the cloud computing platform Automatically responding to the fault-tolerant mechanism in step S2 and the verification module of the cloud bastion machine and performing regular automatic verification and performing batch re-encryption by the cloud bastion machine according to the described automatic encryption policy; and automatically by step S3 The execution result is synchronized by the cloud bastion host to the cloud computing platform, and takes effect in the corresponding cloud host.

Further, in the step S1, the cloud bastion machine adopts a distributed architecture, supports cross-regional deployment of multiple computer rooms, supports horizontal expansion, and has no cloud asset information quantity and concurrency restrictions in the cloud computing platform;

The cloud asset information in the cloud computing platform includes: basic information such as ip and port of the cloud host, operation authority information of the cloud tenant, user names and password information of administrator users/non-administrator users in the cloud host resources, and other accounts. Cloud resource account information;

The cloud bastion host is provided to cloud tenants as one of the services provided by the cloud computing platform, and the cloud tenants can directly jump to use the cloud bastion host through the cloud computing platform.

Further, in the step S1, the verification module of the cloud bastion machine is used for the cloud computing platform to automatically and/or manually complete the verification function with the cloud tenant on a regular basis, and to complete the verification of the relevant cloud in the cloud computing platform through automation technology. Host cloud asset information verification, verify its correctness through automatic remote login, and then verify with the cloud bastion host to ensure that the cloud asset information in the cloud platform is consistent with the cloud bastion, and initiate verification when the verification results are consistent.

Further, in the step S2, the automatic re-encryption fault-tolerant mechanism includes: when the automatic re-encryption task is executed, the password verification function is performed synchronously one by one, and after the password modification is automatically completed, the previous password will be recorded. Then record the newly modified password together; then try to automatically verify the new password of the cloud host. If the verification fails, this cloud host task will be rolled back to ensure that the old password can be logged in; all automatic password change tasks are terminated and need Manual intervention, choose to skip or continue; if the verification is correct, continue to the next task.

Further, in the step S3, the business scenarios such as dynamic delivery and elastic scaling include: through the dynamic scaling of cloud host resources, the newly expanded cloud host will have an independent account and password, and the independent account and The password will be synchronized with the cloud bastion host to ensure the operability of the new cloud host resources.

Further, in the step S4, the cloud computing platform customizes the scheduled tasks for automatic encryption, including: start time, list of related cloud hosts, users related to cloud hosts, etc.

The present invention also provides a device for automatically changing encryption with a fault-tolerant mechanism for cloud hosts and cloud bastion hosts, which is characterized in that it includes:

Deploy and integrate the open source bastion machine module, which is used to build a cloud bastion machine suitable for cloud business scenarios on the cloud computing platform through the open api interface of the open source bastion machine itself, realize the connection between the cloud computing platform and the cloud bastion machine, and realize all The cloud asset information of the cloud computing platform and the cloud asset information of the cloud bastion machine are managed and maintained in a unified manner on the cloud computing platform; at the same time, a cloud bastion machine verification module is established on the connected cloud computing platform to ensure that In a multi-cloud heterogeneous environment, to verify and ensure the accuracy of the cloud asset information in the cloud computing platform synchronized between the cloud computing platform and the cloud bastion machine, to ensure that the automatic encryption plan can be executed normally;

The fault-tolerant mechanism response module is used to automatically respond to the rules of the fault-tolerant mechanism, and is used to increase the password differentiation between different systems and improve the stability of automatic password change; wherein, the fault-tolerant mechanism is to establish a cloud bastion machine verification module on the cloud computing platform , the added automatic password change fault-tolerant mechanism;

The real-time synchronization cloud asset information response module in the cloud computing platform is used to automatically respond to the real-time synchronization rules of the cloud asset information in the cloud computing platform under business scenarios such as dynamic delivery of cloud asset information in the cloud computing platform and elastic scaling, and realize the above-mentioned Real-time automatic synchronization of the cloud asset information on the cloud computing platform between the cloud bastion machine and the cloud computing platform;

Obtaining an encryption policy module, used to acquire the planned tasks customized by the cloud computing platform for automatic encryption, and determine the encryption strategy according to the planned tasks;

Execute the automatic encryption module, which is used to automatically call the cloud computing platform and the cloud bastion machine that are deployed and integrated with the open source bastion machine module in the cloud computing platform after obtaining the automatic encryption policy, and complete the cloud assets in the cloud computing platform The arrangement of the automatic re-encryption strategy of information; the automatic fault-tolerant mechanism in the fault-tolerant mechanism response module and the verification module of the cloud bastion machine and the regular automatic verification and verification carried out by the cloud bastion machine according to the automatic re-encryption strategy Execute batch encryption; and through the cloud asset information response module in the real-time synchronization cloud computing platform, the result of automatic execution is synchronized from the cloud bastion machine to the cloud computing platform, and takes effect in the corresponding cloud host .

Further, the module of obtaining and changing the encryption policy also includes:

The display sub-module is used to display the interface of the module in the cloud computing platform that is specially used for the automatic encryption task of the cloud host, and can provide user-defined timing tasks that need to enable automatic encryption;

Custom encryption policy sub-module, cloud tenants can directly configure the cloud resource encryption plan through the cloud computing platform, and get a customized automatic encryption policy after the configuration is completed.

The present invention also includes an electronic device, which is characterized in that the device includes a memory and a processor, and the memory is stored with a cloud host and cloud bastion machine implementation that can run on the processor according to the present invention. The configuration program of the device of automatic encryption technology, when the configuration program is executed by the processor, it can realize the automatic encryption method with fault-tolerant mechanism for cloud host and cloud bastion machine according to the present invention.

The present invention also includes a computer-readable storage medium, which is characterized in that the computer-readable storage medium stores the configuration of a device for implementing automatic encryption technology for cloud hosts and cloud bastion machines according to the present invention program, and the configuration program can be executed by one or more processors, so as to realize a method for automatically changing encryption with a fault-tolerant mechanism for cloud hosts and cloud bastion machines according to the present invention.

Compared with the prior art, the present invention has the advantages of:

The present invention develops a method for realizing automatic encryption technology for cloud hosts and cloud bastion machines. Through the docking of the cloud computing platform and the open source bastion machine, the automatic synchronization of cloud resources and cloud asset information in the cloud computing platform of the bastion machine can be completed. The password policy can be issued through the cloud computing platform to realize the automatic encryption of cloud asset information in the cloud computing platform; under the unified management of the cloud platform, the random encryption of cloud asset information in all cloud computing platforms can be completed and at the same time the information can be encrypted. Synchronize with the cloud bastion host, and realize that after automatic encryption, cloud tenants can directly log in to the cloud bastion host through the cloud platform.

Through the seamless connection between the cloud computing platform and the open source fortress, the cloud asset information in the cloud computing platform will be synchronized with the cloud bastion machine in real time, and the cloud computing platform will verify the template through the cloud bastion machine to ensure the accuracy of cloud asset information synchronization in the cloud computing platform , for a multi-cloud heterogeneous environment, it is only necessary to maintain a set of cloud asset information in the cloud computing platform on the cloud computing platform to ensure that the automatic encryption plan can be executed normally.

Through the seamless connection between the cloud computing platform and the cloud fortress, the linkage between the cloud computing platform and the cloud fortress machine can solve the isolation problem, and the automatic encryption technology can be released and developed as a cloud service of the cloud computing platform to all parties. Cloud tenants only need to use the cloud computing platform to complete the arrangement of the cloud resource automatic encryption plan, and the cloud bastion machine can strategically perform batch encryption regularly.

Through the connection between the cloud computing platform and the cloud bastion machine, it can meet the dynamic delivery of cloud resources and elastic expansion and other business scenarios to realize the synchronization timeliness of cloud asset information in the cloud computing platform and cloud bastion machine information, without manual maintenance of bastion machine information, reducing labor costs. At the same time, the unified management of passwords can be carried out through the cloud computing platform to meet the needs of different tenants to change passwords and improve the stability of automatic password changes.

Description of drawings

Figure 1. The steps of a method for implementing automatic encryption with fault-tolerant mechanisms for cloud hosts and cloud bastion hosts provided by the present invention.

Fig. 2. A block diagram of a configuration program for implementing automatic encryption with a fault-tolerant mechanism for cloud hosts and cloud bastion hosts provided by the present invention.

Fig. 3. A program module diagram of the obtaining and reciphering policy module in another automatic reciphering configuration program with fault-tolerant mechanism for cloud hosts and cloud bastion machines provided by the present invention.

Fig. 4 is a specific flow chart of another method for implementing automatic encryption with a fault-tolerant mechanism for cloud hosts and cloud bastion hosts provided by the present invention.

Detailed ways

In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only Embodiments of some, but not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts shall fall within the protection scope of the present invention.

It should be noted that the terms "first" and "second" in the description and claims of the present invention and the above drawings are used to distinguish similar objects, but not necessarily used to describe a specific sequence or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances such that the embodiments of the invention described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having" and any variations thereof are intended to cover a non-exclusive inclusion, for example, a process, method, system, product or device comprising a series of steps or units need not be limited to the explicitly listed Instead, other steps or elements not explicitly listed or inherent to the process, method, product or apparatus may be included.

In order to make the advantages of the technical solution of the present invention clearer, the present invention will be described in detail below in conjunction with the accompanying drawings and embodiments.

Fig. 1 shows the steps of a method for implementing automatic encryption with a fault-tolerant mechanism for cloud hosts and cloud bastion hosts provided by the present invention.

As shown in Figure 1, a method for automatically changing encryption with a fault-tolerant mechanism for cloud hosts and cloud bastion machines provided by the present invention, specifically includes the following steps:

Step S1 deploys and integrates the Jumpserver open-source bastion host, constructs a cloud bastion host suitable for cloud business scenarios on the cloud computing platform through the open API interface of the open-source bastion host, realizes the connection between the cloud computing platform and the cloud bastion host, and realizes all The cloud asset information of the cloud computing platform and the cloud asset information of the cloud bastion machine are managed and maintained in a unified manner on the cloud computing platform; at the same time, a cloud bastion machine verification module is established on the connected cloud computing platform to ensure that In a multi-cloud heterogeneous environment, to verify and ensure the accuracy of the cloud asset information in the cloud computing platform that is synchronized between the cloud computing platform and the cloud bastion machine, to ensure that the automatic encryption plan can be executed normally.

In the present invention, the open source bastion host is not limited to the Jumpserver open source bastion host already used in this embodiment.

The cloud bastion machine adopts a distributed architecture, supports cross-regional deployment of multiple computer rooms, supports horizontal expansion, and has no cloud asset information quantity and concurrency restrictions in the cloud computing platform.

The cloud hosts involved in this embodiment include various operating systems and versions (such as windows, linux) on various types of cloud basic resources (Vware, openstack, bare metal, etc.), and the users involved are cloud computing service platforms. All cloud tenants, application scenarios: industry-wide production, development, UAT, testing and other business systems, general-purpose. It should be noted that in practical applications, the solutions provided by the present invention are not limited to the users or application fields described in the above-mentioned embodiments, but include commonly used devices understood by those skilled in the art.

In the step S1, the cloud bastion machine verification module is used for the cloud computing platform to automatically or/and cloud tenants to manually complete the verification function on a regular basis, and to complete the verification of the relevant cloud host cloud assets in the cloud computing platform through automation technology Information verification, verify its correctness through automatic remote login, and at the same time verify with the cloud bastion machine to ensure that the cloud asset information in the cloud platform is consistent with that in the cloud bastion, and initiate verification when the verification results are consistent. The cloud asset information includes cloud host ip, cloud host operating system, cloud host remote login port, account, password, etc.

The cloud asset information in the cloud computing platform includes: basic information such as ip and port of the cloud host, operation authority information of the cloud tenant, user names and password information of administrator users/non-administrator users in the cloud host resources, and other accounts. Cloud resource account information. In this embodiment, one cloud asset corresponds to multiple cloud resource account information.

In this embodiment, the cloud bastion host is provided to cloud tenants as one of the services provided by the cloud computing platform, and the cloud tenants can directly jump to use the cloud bastion host through the cloud computing platform.

Step S2 establishes a fault-tolerant mechanism response rule, and establishes a fault-tolerant mechanism response rule added in the cloud computing platform, which is used to increase the password differentiation between different systems and improve the stability of automatic password change; wherein, the fault-tolerant mechanism is in the cloud computing platform When establishing the verification module of the cloud bastion machine, the automatic code change fault-tolerant mechanism is added; the automatic code change fault-tolerant mechanism includes: when the automatic code change task is executed, the password verification function is performed synchronously one by one, after the password modification is automatically completed , will record the previous password, and then record the newly modified password; then try to automatically verify the new password of the cloud host. If the verification fails, this cloud host task will be rolled back to ensure that the old password can be logged in; all The automatic password change task is terminated and manual intervention is required. Choose to skip or continue; if the verification is correct, continue to the next task.

Step S3 establishes a response rule for synchronizing cloud asset information in the cloud computing platform in real time, establishes a real-time response rule for cloud asset information in the cloud computing platform under business scenarios such as dynamic delivery of cloud asset information in the cloud computing platform and elastic scaling, and realizes the above The real-time automatic synchronization of the cloud asset information on the cloud computing platform between the cloud bastion machine and the cloud computing platform; the business scenarios such as dynamic delivery and elastic scaling include: through the dynamic scaling of cloud host resources, the newly expanded cloud host will have an independent Account and password, the independent account and password will be synchronized with the cloud bastion host to ensure the operability of the new cloud host resources.

Step S4 obtains the encryption policy, obtains the planned task customized by the cloud computing platform for automatic encryption, and determines the encryption strategy according to the planned task; the planned task customized by the cloud computing platform for automatic encryption includes: start time , the list of cloud hosts involved, the users of cloud hosts, etc.

Step S5 executes the automatic encryption change. After the automatic encryption change strategy is obtained, the cloud computing platform and the cloud bastion machine docked in step S1 are automatically invoked in the cloud computing platform to complete the automatic encryption strategy of the cloud asset information in the cloud computing platform. Arranging; automatically responding to the fault-tolerant mechanism in step S2 and the verification module of the cloud bastion machine and performing regular automatic verification and performing batch re-encryption by the cloud bastion machine according to the automatic re-encryption strategy; and passing through step S3 The result of automatic execution is synchronized by the cloud bastion host to the cloud computing platform, and takes effect in the corresponding cloud host.

Fig. 2 is a module diagram of a configuration program for implementing automatic encryption with fault-tolerant mechanism for cloud hosts and cloud bastion hosts provided by the present invention.

As shown in Fig. 2, the present invention provides a kind of device that realizes the automatic reciphering that contains fault-tolerant mechanism for cloud host and cloud bastion machine, wherein, comprises:

Deploy and integrate the open source bastion host module 101, which is used to build a cloud bastion host suitable for cloud business scenarios on the cloud computing platform through the open api interface of the Jumpserver open source bastion host, so as to realize the connection between the cloud computing platform and the cloud bastion host, and Realize that the cloud asset information of the cloud computing platform and the cloud asset information of the cloud bastion machine are managed and maintained in a unified manner on the cloud computing platform; at the same time, a cloud bastion machine verification module is established on the connected cloud computing platform for Ensure that in a multi-cloud heterogeneous environment, to verify and ensure the accuracy of the cloud asset information that is synchronized between the cloud computing platform and the cloud bastion machine, and ensure that the automatic encryption plan can be executed normally;

The fault-tolerant mechanism response module 102 is used to automatically respond to the rules of the fault-tolerant mechanism, to increase the password differentiation between different systems, and to improve the stability of automatic encryption; wherein, the fault-tolerant mechanism is to establish a cloud bastion machine verification on the cloud computing platform When the module is installed, the automatic password change fault-tolerant mechanism is added;

The real-time synchronization cloud asset information response module 103 in the cloud computing platform is used to automatically respond to the real-time synchronization rules of the cloud asset information in the cloud computing platform under business scenarios such as dynamic delivery of cloud asset information and elastic scaling in the cloud computing platform, and realize all Real-time automatic synchronization of cloud asset information on the cloud computing platform between the cloud bastion machine and the cloud computing platform;

Obtaining an encryption policy module 104, configured to acquire a planned task customized by the cloud computing platform for automatic encryption, and determine an encryption policy according to the planned task;

Execute the automatic encryption module 105, for after obtaining the automatic encryption strategy, automatically call the cloud computing platform and the cloud bastion machine that are deployed and merged with the open source bastion machine module in the cloud computing platform, and complete the cloud computing platform in the cloud computing platform. Arrangement of the automatic re-encryption strategy of asset information; automatic fault-tolerant mechanism in the fault-tolerant mechanism response module and the verification module of the cloud bastion machine, and regular automatic verification carried out by the cloud bastion machine according to the automatic re-encryption strategy and perform batch re-encryption; and through the cloud asset information response module in the real-time synchronization cloud computing platform, the result of automatic execution is synchronized from the cloud bastion machine to the cloud computing platform, and in the corresponding cloud host take effect.

In addition to the above-mentioned method for automatically changing encryption, the present invention also provides another method for automatically changing encryption with a fault-tolerant mechanism for cloud hosts and cloud bastion machines, wherein the obtained encryption strategy also includes cloud tenant-defined Change encryption policy. Fig. 3 is a program module diagram of another automatic re-encryption device implementing a fault-tolerant mechanism for cloud hosts and cloud bastion machines provided by the present invention.

In FIG. 3 , the present invention provides another program module diagram of the acquisition and modification policy module in an automatic modification device with fault-tolerant mechanism for cloud hosts and cloud bastion machines. Wherein, obtaining the modification strategy module 104 also includes:

The display sub-module 1041 is used to display the interface of the module that is specially used for the automatic encryption task of the cloud host in the cloud computing platform, and can provide the timed task that user-defined needs to enable automatic encryption;

The sub-module 1042 of self-defining encryption policy is used for cloud tenants to directly configure the cloud resource encryption plan through the cloud computing platform, and obtain a customized automatic encryption policy after the configuration is completed.

In this embodiment, the cloud computing platform can be opened to any authorized user through the authority control of the cloud platform itself. Through the display sub-module 1041, the interface of the module specially used for the automatic encryption task of the cloud host in the cloud computing platform is displayed on the user terminal interface, which can provide the timing task that the user needs to enable automatic encryption; and through the customization The encryption policy sub-module 1042 enables the cloud tenant to directly configure the cloud resource encryption plan through the cloud computing platform, and obtain a self-defined automatic encryption policy after the configuration is completed.

In this embodiment, the implementation process of automatic encryption is further described.

Fig. 4 is a specific flow chart of another method for implementing automatic encryption with fault-tolerant mechanism for cloud hosts and cloud bastion hosts provided by the present invention.

As shown in Figure 4, through the above-mentioned deployment and integration of the open source bastion machine module 101, fault-tolerant mechanism response module 102, real-time synchronization of cloud asset information response module 103 in the cloud computing platform, acquisition and modification strategy module 104, and automatic modification module 105, Cloud service automation with automatic password change has been established; by utilizing the automation capabilities of cloud services, the cloud resource account information of cloud tenants can be synchronized in the cloud computing platform, so that cloud tenants can remotely control and log in for verification through the cloud computing platform The fault-tolerant judgment mechanism of , encryption, N-time verification, etc., realizes the fault-tolerant ability of the automatic encryption of the cloud fortress machine and realizes automatic encryption.

The cloud computing platform automatically obtains the planned tasks for automatic encryption customization of the cloud computing platform by obtaining the encryption policy module 104, determines the encryption strategy according to the planned tasks, and automatically performs cloud host encryption by executing the automatic encryption module 105 ; Run the remote login verification according to the asset information of the cloud computing platform and the bastion machine, and enter the verification module of the cloud bastion machine.

Wherein, in this embodiment, the self-defined reclassification plan also includes the automatic reclassification policy of the cloud tenant's custom configuration: during the cloud tenant's custom configuration process, the self-defined automatic reclassification is realized by editing the reclassification plan Policy configuration includes: configuration of basic settings on the display interface, including configuration of basic content, such as name, remarks, account type, and encryption execution time. It also includes the setting of resources on the display interface. The interface is set with a visual click window component and a search window component, and there are candidate options, which are the main and commonly used basic settings in the existing encryption configuration. It is used for cloud tenants to directly select without Search; if users have specific needs or queries, they can directly search for keywords in the search window and then click to confirm. The custom configured plan can carry out basic maintenance, modification and debugging, including sharing, recreation, etc.

The cloud bastion machine verification module completes the verification of the relevant cloud asset information of the cloud host through automated technology, including the cloud host ip, cloud host operating system, cloud host remote login port, account, password, etc., and verifies it through automatic remote login. At the same time, it is verified with the cloud bastion machine to ensure that the cloud asset information in the cloud platform is consistent with that in the cloud bastion. When the verification results are consistent, the verification is successful, and the verification is initiated to enter the automatic encryption stage. After triggering [Change Encryption Successfully 1], it will enter N times of verification. If the verification is successful, the encryption will be successfully changed. It will automatically take effect in the cloud host, and at the same time update the cloud asset information and synchronize the asset information of the cloud bastion machine. The cloud bastion machine acts as a cloud computing platform. One of the services provided is provided to cloud tenants, and cloud tenants can use the cloud bastion host directly through the cloud computing platform or through single sign-in.

If the verification fails in the verification module of the cloud bastion machine or the automatic re-encryption fails, it enters the fault-tolerant module, automatically responds to the fault-tolerant mechanism, and returns to the cloud computing platform; the specific process includes: when the automatic re-encryption task is executed, the background is parallel Perform the password verification function in batches one by one. After the password modification is automatically completed, the previous password will be recorded, and the newly modified password will be recorded together; then try to automatically verify the new password of the cloud host. If the verification fails, Then this cloud host task is rolled back to ensure that the old password can be logged in; all automatic password change tasks are terminated and manual intervention is required, choose to skip or continue; if the verification is correct, continue to the next task.

The present invention also includes an electronic device, wherein the device includes a memory and a processor, and the memory stores a configuration program that can run the device as provided in this embodiment on the processor, and the configuration program When executed by the processor, a method for automatically changing encryption with a fault-tolerant mechanism for cloud hosts and cloud bastion hosts as provided in this embodiment can be realized.

The present invention also includes a computer-readable storage medium, which is characterized in that the computer-readable storage medium stores a configuration program of the device provided in this embodiment, and the configuration program can be processed by one or more Execution by the server, so as to implement a method for implementing automatic encryption with a fault-tolerant mechanism for cloud hosts and cloud bastion hosts as provided in this embodiment.

The above is only a preferred embodiment of the present invention, it should be pointed out that, for those of ordinary skill in the art, without departing from the principle of the present invention, some improvements and modifications can also be made, and these improvements and modifications can also be made. It should be regarded as the protection scope of the present invention.

Claims

The method for realizing automatic encryption with a fault-tolerant mechanism for cloud hosts and cloud bastion hosts is characterized in that it specifically includes the following steps:

S1 deploys and integrates the open source bastion host, builds a cloud bastion host suitable for cloud business scenarios on the cloud computing platform through the open API interface of the open source bastion host, realizes the connection between the cloud computing platform and the cloud bastion host, and realizes the cloud The cloud asset information of the computing platform and the cloud asset information of the cloud bastion machine are managed and maintained in a unified manner on the cloud computing platform; at the same time, a cloud bastion machine verification module is established on the connected cloud computing platform to ensure Under the structural environment, to verify and ensure the accuracy of the cloud asset information in the cloud computing platform synchronized between the cloud computing platform and the cloud bastion machine, to ensure that the automatic encryption plan can be executed normally;

S2 establishes a fault-tolerant mechanism response rule, and establishes a fault-tolerant mechanism response rule added in the cloud computing platform, which is used to increase the password differentiation between different systems and improve the stability of automatic password change; wherein, the fault-tolerant mechanism refers to the cloud computing platform. When establishing the verification module of the cloud bastion machine, the automatic encryption and fault-tolerant mechanism was added;

S3 establishes the response rules for real-time synchronization of cloud asset information in the cloud computing platform, establishes real-time response rules for cloud asset information in the cloud computing platform under business scenarios such as dynamic delivery and elastic scaling of cloud computing platform, and realizes the cloud Real-time automatic synchronization of cloud asset information on the cloud computing platform between the bastion host and the cloud computing platform;

S4 acquires the encryption policy, obtains the planned task customized by the cloud computing platform for automatic encryption, and determines the encryption strategy according to the planned task;

S5 executes automatic encryption, and after obtaining the automatic encryption strategy, the cloud computing platform automatically calls the cloud computing platform and the cloud bastion machine docked in step S1, and completes the arrangement of the automatic encryption strategy of cloud asset information in the cloud computing platform Automatically responding to the fault-tolerant mechanism in step S2 and the verification module of the cloud bastion machine and performing regular automatic verification and performing batch re-encryption by the cloud bastion machine according to the described automatic encryption policy; and automatically by step S3 The execution result is synchronized by the cloud bastion host to the cloud computing platform, and takes effect in the corresponding cloud host.
The method for automatic encryption technology according to claim 1, further characterized in that,

In the step S1, the cloud bastion machine adopts a distributed architecture, supports cross-regional deployment of multiple computer rooms, supports horizontal expansion, and has no cloud asset information quantity and concurrency restrictions in the cloud computing platform;

The cloud asset information in the cloud computing platform includes: basic information such as ip and port of the cloud host, operation authority information of the cloud tenant, user names and password information of administrator users/non-administrator users in the cloud host resources, and other accounts. Cloud resource account information;

The cloud bastion host is provided to cloud tenants as one of the services provided by the cloud computing platform, and the cloud tenants can directly jump to use the cloud bastion host through the cloud computing platform.
The method according to claim 1 or 2, further characterized in that,

In the step S1, the cloud bastion machine verification module is used for the cloud computing platform to automatically or/and cloud tenants to manually complete the verification function on a regular basis, and to complete the verification of the relevant cloud host cloud assets in the cloud computing platform through automation technology Information verification, verify its correctness through automatic remote login, and at the same time verify with the cloud bastion machine to ensure that the cloud asset information in the cloud platform is consistent with that in the cloud bastion, and initiate verification when the verification results are consistent.
The method according to any one of claims 1-3, further characterized in that,

In the step S2, the automatic code change fault-tolerant mechanism includes: when the automatic code change task is executed, the password verification function is performed synchronously one by one. After the password modification is automatically completed, the previous password will be recorded, and then the new Record the modified password together; then try to automatically verify the new password of the cloud host. If the verification fails, this cloud host task will be rolled back to ensure that the old password can be logged in; all automatic password change tasks will be terminated and manual intervention is required. Choose to skip or continue; if the verification is correct, continue to the next task.
According to the method for automatic encryption technology of claim 1, it is also characterized in that,

In the step S3, the business scenarios such as dynamic delivery and elastic scaling include: through the dynamic scaling of cloud host resources, the newly stretched cloud host will have an independent account and password, and the independent account and password will be consistent with The cloud bastion host performs synchronization to ensure the operability of the new cloud host resources.
According to the method for automatic encryption technology of claim 1, it is also characterized in that,

In the step S4, the cloud computing platform customizes the planned tasks for automatic encryption, including: start time, list of related cloud hosts, users related to cloud hosts, etc.
A device for automatically changing encryption with a fault-tolerant mechanism for cloud hosts and cloud bastion hosts, characterized in that it includes:

Deploy and integrate the open source bastion machine module, which is used to build a cloud bastion machine suitable for cloud business scenarios on the cloud computing platform through the open api interface of the open source bastion machine itself, realize the connection between the cloud computing platform and the cloud bastion machine, and realize all The cloud asset information of the cloud computing platform and the cloud asset information of the cloud bastion machine are managed and maintained in a unified manner on the cloud computing platform; at the same time, a cloud bastion machine verification module is established on the connected cloud computing platform to ensure that In a multi-cloud heterogeneous environment, to verify and ensure the accuracy of the cloud asset information in the cloud computing platform synchronized between the cloud computing platform and the cloud bastion machine, to ensure that the automatic encryption plan can be executed normally;

The fault-tolerant mechanism response module is used to automatically respond to the rules of the fault-tolerant mechanism, and is used to increase the password differentiation between different systems and improve the stability of automatic password change; wherein, the fault-tolerant mechanism is to establish a cloud bastion machine verification module on the cloud computing platform , the added automatic password change fault-tolerant mechanism;

The real-time synchronization cloud asset information response module in the cloud computing platform is used to automatically respond to the real-time synchronization rules of the cloud asset information in the cloud computing platform under business scenarios such as dynamic delivery of cloud asset information in the cloud computing platform and elastic scaling, and realize the above-mentioned Real-time automatic synchronization of the cloud asset information on the cloud computing platform between the cloud bastion machine and the cloud computing platform;

Obtaining an encryption policy module, used to acquire the planned tasks customized by the cloud computing platform for automatic encryption, and determine the encryption strategy according to the planned tasks;

Execute the automatic encryption module, which is used to automatically call the cloud computing platform and the cloud bastion machine that are deployed and integrated with the open source bastion machine module in the cloud computing platform after obtaining the automatic encryption policy, and complete the cloud assets in the cloud computing platform The arrangement of the automatic re-encryption strategy of information; the automatic fault-tolerant mechanism in the fault-tolerant mechanism response module and the verification module of the cloud bastion machine and the regular automatic verification and verification carried out by the cloud bastion machine according to the automatic re-encryption strategy Execute batch encryption; and through the cloud asset information response module in the real-time synchronization cloud computing platform, the result of automatic execution is synchronized from the cloud bastion machine to the cloud computing platform, and takes effect in the corresponding cloud host .
The device of automatic encryption technology according to claim 7, further characterized in that,

The module of acquiring and changing the encryption strategy also includes:

The display sub-module is used to display the interface of the module in the cloud computing platform that is specially used for the automatic encryption task of the cloud host, and can provide user-defined timing tasks that need to enable automatic encryption;

Custom encryption policy sub-module, cloud tenants can directly configure the cloud resource encryption plan through the cloud computing platform, and get a customized automatic encryption policy after the configuration is completed.
An electronic device, characterized in that the device includes a memory and a processor, and the memory stores a configuration program that can run on the processor as described in claims 7-8, and the configuration program is controlled by the When said processor executes, it can realize the method for realizing automatic encryption including fault-tolerant mechanism for cloud host and cloud bastion machine as described in claims 1-6.
A computer-readable storage medium, characterized in that, the computer-readable storage medium stores the configuration program of the device according to claims 7-8, and the configuration program can be executed by one or more processors to Realize the method for automatically changing encryption with a fault-tolerant mechanism for cloud hosts and cloud bastion machines as described in claims 1-6.