WO2016141808A1 - 一种服务器的安全管理方法及装置 - Google Patents

一种服务器的安全管理方法及装置 Download PDF

Info

Publication number
WO2016141808A1
WO2016141808A1 PCT/CN2016/074422 CN2016074422W WO2016141808A1 WO 2016141808 A1 WO2016141808 A1 WO 2016141808A1 CN 2016074422 W CN2016074422 W CN 2016074422W WO 2016141808 A1 WO2016141808 A1 WO 2016141808A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
address
port
server
mapping relationship
Prior art date
Application number
PCT/CN2016/074422
Other languages
English (en)
French (fr)
Inventor
李立中
Original Assignee
阿里巴巴集团控股有限公司
李立中
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司, 李立中 filed Critical 阿里巴巴集团控股有限公司
Publication of WO2016141808A1 publication Critical patent/WO2016141808A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/40—Support for services or applications

Definitions

  • the present application relates to the security field in the field of computing, and in particular, to a security management method and apparatus for a server.
  • servers offer a variety of online services to users around the world, such as booking a hotel, booking a flight, shopping online, providing information, and more. While the server provides online services, it also needs to protect the server to avoid hackers or intruders attacking the server.
  • the server needs to provide online services, it needs to access the external network or the internal network.
  • the management ports of the existing servers are mostly static and open. Therefore, the hacker or the intruder can use the scanner to scan the server's port by violently exhausting the server's port through the Internet Protocol (IP) address of the server's network, thereby finding that the server port can be intruded or controlled. To achieve the purpose of malicious attack on the server.
  • IP Internet Protocol
  • the present invention will provide a new server security management method to overcome the above problems.
  • the embodiment of the present application provides a security management method and device for a server, which can effectively protect the security of the server.
  • the embodiment of the present application provides a security management method and apparatus for a server.
  • a server security management method includes:
  • the management server receives an access request sent by the terminal
  • a server security management device includes:
  • a receiving unit configured to receive an access request of the terminal
  • a processing unit configured to dynamically allocate an IP address and a port to the terminal according to the access request received by the receiving unit
  • a sending unit configured to return the IP address and port information allocated by the processing unit to the terminal, to allow the terminal to connect to the server corresponding to the IP address and the port.
  • the management server when the terminal initiates the service access request, the management server randomly allocates the IP address and port of the service, so that the IP and port information of the service need not be static. Open state to prevent malicious access by hackers or intruders, effectively protecting the security of the server.
  • FIG. 1 is a structural diagram of a cluster server according to an embodiment of the present application
  • FIG. 2 is a flowchart of a method for security management of a server according to an embodiment of the present application
  • FIG. 3 is a flowchart of dynamically allocating an IP address and a port to a terminal according to an embodiment of the present disclosure
  • FIG. 4 is a flowchart of a method for security management of a server according to another embodiment of the present application.
  • FIG. 5 is a structural diagram of a security management apparatus of a server according to an embodiment of the present application.
  • FIG. 1 is a schematic structural diagram of an embodiment of a cluster server, which includes a management server and a plurality of servers connected thereto (server 1 Server 2, server 3, ... server N), the management server is connected to the above several servers, the management server can allocate a floating IP address and port to the server, and the management server can connect with the server through the fixed IP address of the server, and pass The above fixed IP address allocates a floating IP address and port to the server.
  • the terminal that needs to access the server can be connected to the server through the floating IP address and port.
  • the management server pre-defines a number of floating IP addresses and ports.
  • the predefined IP addresses and ports may be all applicable IP addresses and ports, or may be custom IP addresses and ports, according to service requests of the access terminal.
  • the management server randomly selects one or more IP addresses and one or more ports from the plurality of floating IP addresses and the plurality of ports, and randomly selects one or more services that can provide the service request from the services connected to the management server.
  • the server assigns the randomly selected IP address and port to the server, and then transmits the information of the randomly assigned IP address and the port to the terminal, and establishes a mapping relationship between the terminal and the IP address and the port, so that the terminal
  • the server that can provide the requested service can be accessed through the above IP address and port.
  • the management server randomly assigns an IP address and a port according to the service request of the terminal, and the terminal accesses the corresponding server according to the information of the IP address and the port.
  • the management server assigns the corresponding IP address and port to the server 2, so that the terminal can continue to pass the above IP address and The port information continues to access the server 2 and a corresponding online payment operation is performed.
  • FIG. 2 it is an embodiment of a security management method for a server according to the present application, and the specific working steps are as follows:
  • S101 The management server receives an access request sent by the terminal.
  • the terminal sends an access request to the management server, where the access request includes the service information requested by the terminal, and may specifically carry the service identifier of the requested service.
  • the access request of the terminal may be sent in the form of an access management server, or may be sent to the management server by sending a short message. For example, when an access request needs to be sent, a message containing a specific instruction is sent to the management server, and the management server The received short message determines the service request of the terminal.
  • S102 Dynamically allocate an IP address and a port to the terminal according to the access request.
  • the IP address is a floating IP address; the port is a randomly allocated port.
  • dynamically assigning an IP address and a port to the terminal dynamically may include:
  • the management server determines, according to an access request of the terminal, the service requested by the access request. Specifically, it can be determined according to the service identifier of the requested service.
  • S1022 Find a server that provides the service according to a service of the access request of the terminal.
  • the service identifier find the server that can provide the service, or find the IP address and port that can provide the service.
  • it may be a fixed IP address and port of the server, which is internal information stored in a cluster on the management server, and the fixed IP address and port information may not be disclosed to the terminal.
  • the management server randomly selects a dynamic IP address and port for the selected server by selecting one or an IP address and one or more ports from a plurality of predefined IP addresses and a plurality of ports.
  • the above-mentioned predefined IP address is pre-defined by the management server and is selected by the management server in the form of a floating IP address.
  • the management server can pre-define the IP address segment of the IP: 124.158.26.30-IP: 124.158.26.39 to be predefined.
  • the IP address when the terminal accesses the management server, the management server randomly selects one or more IP addresses from the predefined IP address segments.
  • the management server may also predefine several IP addresses according to different service requests of the terminal.
  • the management server pre-defines the IP address of the service request for online payment to be an IP address segment of IP: 124.158.26.30-124.158.26.39; the IP address defining the service request for online booking of the hotel is IP: 124.158.26.10-124.158.26.19 IP address segment; defines the IP address of the service request for online retrieval as the IP address segment of IP: 124.158.26.40-124.158.26.49, so that when the service request of the terminal is online payment, the management server from IP: 124.158.26.30-124.158
  • the IP address segment of .26.39 randomly selects one or more IP addresses; when the service request of the terminal is online booking, the management server randomly selects one or more IP addresses from IP: 124.158.26.10-124.158.26.19. IP address; when the service request of the terminal is online retrieval, the management server randomly selects one or more IP addresses from the IP address segment of IP: 124.158.26.40-124.158.26
  • the management server may also predefine a plurality of port numbers, for example, 1-100.
  • the management server selects one or more of the above predefined port numbers.
  • the management server may also predefine the port number of the service request for online payment as: 10-40; the port number defining the service request for online booking of the hotel is: 60-90; the port number defining the service request for online retrieval is 100-130
  • the management server randomly selects one or more port numbers from the port number of port number: 10-40; when the service request of the terminal is online reservation of the hotel, the management server One or more port numbers are randomly selected from the port number of the port number: 60-90.
  • the management server randomly selects one or more port numbers from the port number: 100-130. The port number.
  • IP address and port number are in the closed state before being selected by the management server, and the selected IP address and port are opened after being selected by the management server.
  • a server is randomly selected in the server list, and the above IP address and port are assigned to the selected server.
  • the dynamic IP address and the port are allocated to the terminal, and a mapping relationship between the terminal information and the dynamically configured IP address and port information of the server is formed, where the terminal information includes a client feature. Or terminal IP address.
  • the management server selects a server that can provide the above service from the server list, and the above The selected IP address and port are assigned to the selected server, so that the terminal can access the corresponding server through the above IP address and port.
  • the above-mentioned IP address can also be mapped to the fixed IP address of the server.
  • the terminal accesses the server, the terminal can access the corresponding server through the mapping relationship between the IP address and the fixed IP address of the server.
  • the method further includes: storing a mapping relationship between the terminal information and the allocated IP address and port information.
  • the management server returns the selected IP address and port information to the terminal.
  • the management server can be returned to the terminal through the access interface of the terminal, or can be returned to the terminal through a short message.
  • the management server performs unified random and dynamic allocation of IP addresses and ports, so that the IP and port information of the provided service need not be in a static open state to prevent malicious attacks by hackers or intruders. Access, effectively protecting the security of the server.
  • the method further includes: receiving a login request sent by the terminal, where the login request carries the client feature or the terminal IP address; And verifying the validity of the login request according to the client feature or the terminal IP address in the login request. If yes, the terminal is allowed to connect to the server corresponding to the IP address and the port by using the verification.
  • the management server verifies whether the information of the terminal is legal, that is, whether the terminal requesting the access is a legitimate user. For example, the user can verify whether the requested terminal is a legitimate user by using an account number, a password, a certificate, or a terminal IP address. Way to verify if it is a legitimate user.
  • the terminal can access the corresponding server through the mapping relationship.
  • the management server After the mapping relationship is established, the management server stores the foregoing mapping relationship to maintain a connection state between the terminal and the server. In addition, the terminal information and the assigned IP address and port information are formed. After the mapping relationship, the management server may further set the effective time of the mapping relationship, so that the terminal is allowed to connect to the server corresponding to the IP address and the port at the effective time of the mapping relationship.
  • the method further includes: receiving a request sent by the terminal to extend an effective time of the mapping relationship, and extending an effective time of the mapping relationship.
  • the connection time between the terminal and the server corresponding to the IP address and port can be extended according to the request of the terminal.
  • a security management method for a server of the present application has the following specific working steps:
  • S201 The management server receives an access request sent by the terminal.
  • S202 Dynamically allocate an IP address and a port to the terminal according to the access request.
  • S204 randomly select one server in the server list, and assign the above IP address and port to the selected server.
  • the management server first returns the selected IP address and port to the terminal, and then allocates the above IP address and port to the corresponding server.
  • the management server may also perform S203 and S204 simultaneously, that is, assign the above IP address and port to the corresponding server while returning to the terminal IP address and the terminal.
  • the allocation time of the foregoing IP address and port is set to a fixed duration, that is, the effective time of the mapping relationship between the terminal and the assigned IP address and the terminal is a fixed duration, such as an IP address and a mapping between the port and the terminal.
  • the management server will time it.
  • the duration of the mapping is longer than the preset duration, the above IP address and port will be released and closed, that is, the management server will interrupt the above IP address and port and the corresponding server. The mapping relationship between them. In this way, the terminal will not be able to continue to access the above server.
  • the terminal When the terminal needs to extend the duration of accessing the server, that is, when the effective time of the above IP address and the mapping relationship between the port and the terminal needs to be extended, the terminal needs to apply.
  • the above-mentioned delayed application can be applied through the login interface of the terminal or by sending a short message.
  • Another When the terminal logs out, the above IP address and port are released in time and are closed, that is, the mapping between the IP address and the port and the terminal is immediately interrupted. In this way, the above-mentioned released IP address and port will enter an idle state, waiting for the management server to select again.
  • the management server needs to randomly assign an IP address and a port, and the IP address and port may be dynamically changed after a valid period of time, so that the violent use of the scanner can be effectively circumvented.
  • the malicious connection of the illegal terminal can be effectively prevented, thereby effectively protecting the security of the server.
  • the receiving unit 301 is configured to receive an access request of the terminal.
  • the processing unit 302 is configured to dynamically allocate an IP address and a port to the terminal according to the access request received by the receiving unit;
  • the sending unit 303 is configured to return the IP address and port information allocated by the processing unit to the terminal, to allow the terminal to connect to the server corresponding to the IP address and the port.
  • the processing unit 302 includes:
  • a determining subunit 3021 configured to determine a service requested by the access request
  • the finding subunit 3022 is configured to find a server that provides the service according to the service determined by the determining subunit;
  • An allocation subunit 3023 configured to randomly select a found server, and randomly allocate a dynamic IP address and a port to the server;
  • the mapping subunit 3024 is configured to allocate the dynamic IP address and port allocated by the allocation subunit to the terminal, and form a mapping between the terminal information and the dynamic IP address and port information of the server. Relationship, the terminal information includes a client feature or a terminal IP address;
  • the setting subunit 3025 is configured to set an effective time of the mapping relationship formed by the mapping subunit, so that the terminal is allowed to connect to the server corresponding to the IP address and the port when the mapping relationship is valid.
  • a security management device for a server of the present application further includes: a storage unit 304, configured to store Determining a mapping relationship between the terminal information formed by the mapping subunit and the allocated IP address and port information.
  • the receiving unit 301 is further configured to: after returning the IP address and port information to the terminal, receive a login request sent by the terminal, where the login request carries the client feature or a terminal IP address; and a request sent by the terminal to extend the effective time of the valid mapping relationship.
  • the processing unit 302 is further configured to verify, by using the mapping relationship formed by the mapping subunit, the validity of the login request according to the client feature or the terminal IP address in the login request, and if yes, pass the verification.
  • the terminal is allowed to connect to the server corresponding to the IP address and port.
  • the functions of the foregoing units may correspond to the processing steps of the foregoing security management method described in detail in FIG. 2 or FIG. 3, and details are not described herein again.
  • embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the device is implemented in a flow or a flow chart The functions specified in a block or blocks of a flow and/or block diagram.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.
  • a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • the memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory.
  • RAM random access memory
  • ROM read only memory
  • Memory is an example of a computer readable medium.
  • Computer readable media includes both permanent and non-persistent, removable and non-removable media.
  • Information storage can be implemented by any method or technology.
  • the information can be computer readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape storage or other magnetic storage devices or any other non-transportable media can be used to store information that can be accessed by a computing device.
  • computer readable media does not include temporary storage of computer readable media, such as modulated data signals and carrier waves.
  • embodiments of the present application can be provided as a method, system, or computer program product.
  • the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment in combination of software and hardware.
  • the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

Landscapes

  • Engineering & Computer Science (AREA)
  • Multimedia (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了一种服务器的安全管理方法，其中，所述方法包括：管理服务器接收终端发送的访问请求；根据所述访问请求，为所述终端动态随机分配IP地址和端口；将所述IP地址和端口信息返回给所述终端，以允许所述终端连接所述IP地址和端口所对应的服务器。通过上述方法，终端访问服务器的IP地址和端口，由管理服务器随机分配，从防止终端的恶意访问，有效的保护服务器的安全。

Description

一种服务器的安全管理方法及装置 技术领域
本申请涉及计算领域的安全领域，尤其涉及一种服务器的安全管理方法及装置。
背景技术
在当今互联网时代，服务器给世界各地的用户提供各种各样的在线服务，例如预订酒店、预订机票、在线购物、提供资讯等。在服务器提供在线服务的同时，也需要对服务器进行防护，以避免黑客或入侵者对攻击服务器。
服务器因需要提供在线服务，需要接入外网或内网，现有服务器的管理端口大多都是静态开放的。故，黑客或入侵者可以利用扫描器通过服务器的网络之间互连的协议(Internet Protocol，IP)地址对服务器的端口进行暴力穷举等方式扫描服务器的端口，从而查找可以入侵或控制服务器端口，达到恶意攻击服务器的目的。
故，本发明将提供一种新服务器的安全管理方法，以克服上述问题。
发明内容
本申请实施例提供一种服务器的安全管理方法及装置，可以有效保护服务器的安全。
为解决上述问题，本申请实施例提供一种服务器的安全管理方法及装置。
一种服务器的安全管理方法，包括：
管理服务器接收终端发送的访问请求；
根据所述访问请求，为所述终端动态随机分配IP地址和端口；
将所述IP地址和端口信息返回给所述终端，以允许所述终端连接所述IP地址和端口所对应的服务器。
一种服务器的安全管理装置，包括：
接收单元，用于接收终端的访问请求；
处理单元，用于根据所述接收单元接收的所述访问请求，为所述终端动态随机分配IP地址和端口；
发送单元，用于将所述处理单元分配的所述IP地址和端口信息返回给所述终端，以允许所述终端连接所述IP地址和端口所对应的服务器。
由以上本申请实施例提供的技术方案可见，本申请实施例中，当终端发起服务的访问请求时，由管理服务器随机分配服务的IP地址和端口，使提供服务的IP和端口信息无需处于静态开放状态，以防止黑客或入侵者的恶意访问，有效的保护服务器的安全。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1为本申请实施例提供的集群式服务器的结构图；
图2为本申请一个实施例提供的服务器的安全管理方法流程图；
图3为本申请一个实施例提供的为终端动态随机分配IP地址和端口的流程图；
图4为本申请另一个实施例提供的服务器的安全管理方法流程图；
图5为本申请实施例提供的服务器的安全管理装置结构图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合本申请具体实施例及相应的附图对本申请技术方案进行清楚、完整地描述。显然，所描述的实施例仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施 例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请一种服务器的安全管理方法应用于集群式服务器，如图1所示，为一种集群式服务器的一种实施例的结构示意图，其包括一个管理服务器和若干与其连接的服务器(服务器1、服务器2、服务器3、……服务器N)，管理服务器与上述若干服务器连接，管理服务器可以为服务器分配浮动的IP地址和端口，上述管理服务器可以通过服务器的固定IP地址与服务器连接，并且通过上述固定IP地址为服务器分配浮动的IP地址和端口，需要访问上述服务器的终端，可以通过上述浮动的IP地址和端口连接到服务器。管理服务器预先定义若干浮动IP地址和若干端口，所述预先定义的IP地址和端口可以为所有的适用的IP地址和端口，也可以是自定义的IP地址和端口，根据访问终端的服务请求，管理服务器从上述若干浮动IP地址和若干端口中随机选取一个或多个IP地址以及一个或多个端口，再从上述与管理服务器连接的服务中随机选取一个或多个可以提供上述服务请求的服务的服务器，将上述随机选取的IP地址和端口分配给上述服务器，然后将上述随机分配的IP地址和端口的信息传递给终端，建立终端与上述IP地址和端口之间的映射关系，这样，终端可以通过上述IP地址和端口访问到可以提供其所请求的服务的服务器。
通过上述方式，管理服务器根据终端的服务请求为其随机分配IP地址和端口，终端根据上述IP地址和端口的信息访问到相应的服务器。另，即使提供服务的服务器被切换，例如提供在线支付服务的服务器由服务器1变成服务器2，管理服务器会将相应的IP地址和端口分配给服务器2，这样，终端可以继续通过上述IP地址和端口信息继续访问到服务器2，并且进行相应的在线支付操作。
如图2所示，为本申请的一种服务器的安全管理方法的实施例，其具体工作步骤如下：
S101：管理服务器接收终端发送的访问请求。
终端向管理服务器发送访问请求，该访问请求中包含终端所请求的服务信息，具体可以携带所请求的服务的服务标识。
上述终端的访问请求可以通过访问管理服务器的形式发送，也可以通过发送短信的形式发送给管理服务器，例如，当需要发送访问请求时，先发送一条包含具体指令的短信给管理服务器，管理服务器根据上述接收到的短信确定终端的服务请求。
S102：根据所述访问请求，为所述终端动态随机分配IP地址和端口。
其中，所述IP地址为浮动IP地址；所述端口为随机分配的端口。
具体地，如图3所示，为所述终端动态随机分配IP地址和端口，可以包括：
S1021、管理服务器根据终端的访问请求确定所述访问请求所请求的服务。具体可以根据所请求的服务的服务标识来确定。
S1022、根据终端的访问请求的服务，查找到提供所述服务的服务器。
根据服务标识，查找到能够提供该服务的服务器，或者，查找到能够提供该服务的IP地址和端口。此时，可以是服务器的固定IP地址和端口，是存储于管理服务器上的集群中的内部信息，该固定IP地址和端口信息可以不公开给终端。
S1023、随机选择一个查找到的服务器，为所述服务器随机地分配动态的IP地址和端口。
管理服务器从预先定义的若干IP地址和若干端口中选取一个或IP地址以及一个或多个端口，为选择的服务器随机地分配动态的IP地址和端口。
上述预先定义的IP地址是由管理服务器预先定义的，以浮动IP地址的形式由管理服务器选取，例如管理服务器可以预先定义IP:124.158.26.30-IP:124.158.26.39的IP地址段为预先定义的IP地址，则当终端访问管理服务器时，管理服务器会从上述预先定义的IP地址段中随机选取一个或多个IP地址。另，管理服务器也可以根据终端的不同的服务请求分别预先定义若干IP地址， 例如，管理服务器预先定义在线支付的服务请求的IP地址为IP:124.158.26.30-124.158.26.39的IP地址段；定义在线预订酒店的服务请求的IP地址为IP:124.158.26.10-124.158.26.19的IP地址段；定义在线检索的服务请求的IP地址为IP:124.158.26.40-124.158.26.49的IP地址段，这样，当终端的服务请求为在线支付时，管理服务器从IP:124.158.26.30-124.158.26.39的IP地址段中随机选取一个或多个IP地址；当终端的服务请求为在线预订酒店时，管理服务器从IP:124.158.26.10-124.158.26.19的IP地址段中随机选取一个或多个IP地址；当终端的服务请求为在线检索时，管理服务器从IP:124.158.26.40-124.158.26.49的IP地址段中随机选取一个或多个IP地址。
同理，管理服务器也可以预先定义若干端口号，例如1-100，当终端访问管理服务器时，管理服务器会从上述预先定义的端口号中选取一个或多个。另管理服务器也可以预先定义在线支付的服务请求的端口号为：10-40；定义在线预订酒店的服务请求的端口号为：60-90；定义在线检索的服务请求的端口号为100-130，这样，当终端的服务请求为在线支付时，管理服务器从端口号为：10-40的端口号中随机选取一个或多个端口号；当终端的服务请求为在线预订酒店时，管理服务器从端口号为：60-90的端口号中随机选取一个或多个端口号；当终端的服务请求为在线检索时，管理服务器从端口号为：100-130的端口号中随机选取一个或多个端口号。
另，上述IP地址和端口号被管理服务器选取前，处于被关闭状态，被管理服务器选取后，被选取的IP地址和端口被开放。
在服务器列表中随机选择一个服务器，并且将上述IP地址和端口分配给所选择的服务器。
S1024、将所述动态的IP地址和端口分配给所述终端，形成所述终端信息与分配的所述服务器的动态的IP地址和端口信息之间的映射关系，所述终端信息包括客户端特征或终端IP地址。
管理服务器从服务器列表中选取一个可以提供上述服务的服务器，将上述 选取的IP地址和端口分配给被选取的服务器，使终端可以通过上述IP地址和端口访问相应的服务器。
上述分配的IP地址也可以先和服务器的固定IP地址建立映射关系，当终端访问服务器时，通过上述分配的IP地址与服务器的固定IP地址的映射关系，使上述终端可以访问到相应的服务器。
可选地，在为所述终端动态随机分配IP地址和端口之后，还包括：存储所述终端信息与分配的所述IP地址和端口信息之间形成的映射关系。
S103：将上述IP地址和端口信息返回给上述终端。
管理服务器将选取的IP地址和端口信息返回给终端。
管理服务器可以通过终端的访问界面返回给终端，也可以通过短信的形式返回给终端。
这样，服务器的IP地址和端口信息可以不用对外公开，由管理服务器进行统一随机动态地分配IP地址和端口，使提供服务的IP和端口信息无需处于静态开放状态，以防止黑客或入侵者的恶意访问，有效的保护服务器的安全。
可选地，将IP地址和端口信息返回给终端后，还包括：接收所述终端发送的登录请求，所述登录请求中携带有所述客户端特征或终端IP地址；利用所述映射关系，根据所述登录请求中的客户端特征或终端IP地址验证所述登录请求的合法性，若符合，则通过验证，允许所述终端连接所述IP地址和端口所对应的服务器。
管理服务器会验证终端的信息是否合法，即请求访问的终端是否为合法用户，例如可以通过账号和密码、证书、终端IP地址等方式验证所请求的终端是否为合法用户，也可以通过短信验证码的方式验证其是否为合法用户。
当上述终端的身份通过验证后，通过上述映射关系终端可以访问到相应的服务器。
上述映射关系建立之后，管理服务器储存上述映射关系，以使终端和服务器之间保持连接状态。另外，在形成所述终端信息与分配的IP地址和端口信息 之间的映射关系之后，管理服务器还可以设置所述映射关系的有效时间，以便在所述映射关系的有效时间允许所述终端连接所述IP地址和端口所对应的服务器。
可选地，所述方法还包括：接收所述终端发送的延长所述映射关系的有效时间的请求，并延长所述映射关系的有效时间。这样，可以根据终端的请求，延长终端与所述IP地址和端口所对应的服务器的连接时间。
如图4所示，在另一实施例中，本申请的一种服务器的安全管理方法，具体工作步骤如下：
S201：管理服务器接收终端发送的访问请求。
S202：根据所述访问请求，为所述终端动态随机分配IP地址和端口。
S203：将上述IP地址和端口信息返回给上述终端。
S204：在服务器列表中随机选者一个服务器，并且将上述IP地址和端口分配给所选择的服务器。
S205：建立上述IP地址和端口与终端的之间的映射关系。
上述实施例中，管理服务器会先将选取的IP地址和端口返回给终端，然后再将上述IP地址和端口分配给相应的服务器。当然，管理服务器也可以将S203和S204同时执行，即在返回给终端IP地址和终端的同时，将上述IP地址和端口分配给相应的服务器。
上述IP地址和端口的分配时间被设定成一个固定的时长，即终端与被分配的IP地址和终端之间的映射关系的有效时间为一个固定的时长，例如IP地址和端口与终端的映射关系建立后，管理服务器将对其进行计时，当建立映射的时长超过预设的时长时，上述IP地址和端口将被释放，并且被关闭，即管理服务器会中断上述IP地址和端口与相应服务器之间的映射关系。这样，终端将不能继续访问上述服务器。当终端需要延长访问服务器的时长时，即需要延长上述IP地址和端口与终端的映射关系的有效时间时，需要终端提出申请。上述延时的申请，可以通过终端的登入界面申请，也可以通过发送短信的形式申请。另， 当终端退出登入时，上述IP地址和端口会被及时释放，并且被关闭，即上述IP地址和端口与终端之间的映射关系会被立即中断。这样，上述被释放的IP地址和端口将进入空闲状态，等待管理服务器再次选取。
通过上述方式，终端每次连接到服务器需要管理服务器为其随机分配IP地址和端口，而且，在一段有效时间之后IP地址和端口可能又将进行动态变化，这样，可以有效规避通过扫描器暴力穷举找到对应的IP地址和端口，可以有效地阻止非法终端的恶意连接，从而有效地保护了服务器的安全。
如图5所示，以下介绍本申请的一种服务器的安全管理装置的实施例：
接收单元301，用于接收终端的访问请求；
处理单元302，用于根据所述接收单元接收的所述访问请求，为所述终端动态随机分配IP地址和端口；；
发送单元303，用于将所述处理单元分配的所述IP地址和端口信息返回给所述终端，以允许所述终端连接所述IP地址和端口所对应的服务器。
上述处理单元302包括：
确定子单元3021，用于确定所述访问请求所请求的服务；
查找子单元3022，用于根据所述确定子单元确定的所述服务，查找到提供所述服务的服务器；
分配子单元3023，用于随机选择一个查找到的服务器，为所述服务器随机地分配动态的IP地址和端口；
映射子单元3024，用于将所述分配子单元分配的所述动态的IP地址和端口分配给所述终端，形成所述终端信息与所述服务器的动态的IP地址和端口信息之间的映射关系，所述终端信息包括客户端特征或终端IP地址；
设置子单元3025，用于设置所述映射子单元形成的所述映射关系的有效时间，以便在所述映射关系的有效时间允许所述终端连接所述IP地址和端口所对应的服务器。
本申请的一种服务器的安全管理装置还包括：存储单元304，用于存储所 述映射子单元形成的所述终端信息与分配的所述IP地址和端口信息之间形成的映射关系。
可选地，所述接收单元301还用于在将所述IP地址和端口信息返回给所述终端之后，接收所述终端发送的登录请求，所述登录请求中携带有所述客户端特征或终端IP地址；以及接受所述终端发送的延长所述有效映射关系的有效时间的请求。
所述处理单元302还用于利用所述映射子单元形成的所述映射关系，根据所述登录请求中的客户端特征或终端IP地址验证所述登录请求的合法性，若符合，则通过验证，允许所述终端连接所述IP地址和端口所对应的服务器。
上述各单元的功能可对应于图2或图3详细描述的上述安全管理方法的处理步骤，于此不再赘述。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个 流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
本领域技术人员应明白，本申请的实施例可提供为方法、系统或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
以上所述仅为本申请的实施例而已，并不用于限制本申请。对于本领域技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的权利要求范围之内。

Claims (14)

  1. 一种服务器的安全管理方法，其特征在于，所述方法包括：
    管理服务器接收终端发送的访问请求；
    根据所述访问请求，为所述终端动态随机分配IP地址和端口；
    将所述IP地址和端口信息返回给所述终端，以允许所述终端连接所述IP地址和端口所对应的服务器。
  2. 如权利要求1所述的方法，其特征在于，根据所述访问请求，为所述终端动态随机分配IP地址和端口，具体包括：
    确定所述访问请求所请求的服务；
    根据上述请求的服务，查找到提供所述服务的服务器；
    随机选择一个查找到的服务器，为所述服务器随机地分配动态的IP地址和端口；
    将所述动态的IP地址和端口分配给所述终端，形成所述终端信息与分配的所述服务器的动态的IP地址和端口信息之间的映射关系，所述终端信息包括客户端特征或终端IP地址。
  3. 如权利要求1或2所述的方法，所述IP地址为浮动IP地址；所述端口为随机分配的端口。
  4. 如权利要求2所述的方法，其特征在于，在为所述终端动态随机分配IP地址和端口之后，还包括：
    存储所述终端信息与分配的所述IP地址和端口信息之间形成的映射关系。
  5. 如权利要求2所述的方法，其特征在于，在将所述IP地址和端口信息返回给所述终端之后，还包括：
    接收所述终端发送的登录请求，所述登录请求中携带有所述客户端特征或终端IP地址；
    利用所述映射关系，根据所述登录请求中的客户端特征或终端IP地址验证所述登录请求的合法性，若符合，则通过验证，允许所述终端连接所述IP 地址和端口所对应的服务器。
  6. 如权利要求2所述的方法，其特征在于，在形成所述终端信息与分配的IP地址和端口信息之间的映射关系之后，还包括：
    设置所述映射关系的有效时间，以便在所述映射关系的有效时间允许所述终端连接所述IP地址和端口所对应的服务器。
  7. 如权利要求6所述的方法，其特征在于，所述方法还包括：
    接收所述终端发送的延长所述映射关系的有效时间的请求，并延长所述映射关系的有效时间。
  8. 一种服务器的安全管理装置，其特征在于，包括：
    接收单元，用于接收终端的访问请求；
    处理单元，用于根据所述接收单元接收的所述访问请求，为所述终端动态随机分配IP地址和端口；
    发送单元，用于将所述处理单元分配的所述IP地址和端口信息返回给所述终端，以允许所述终端连接所述IP地址和端口所对应的服务器。
  9. 如权利要求8所述的装置，其特征在于，所述处理单元包括：
    确定子单元，用于确定所述访问请求所请求的服务；
    查找子单元，用于根据所述确定子单元确定的所述服务，查找到提供所述服务的服务器；
    分配子单元，用于随机选择一个查找到的服务器，为所述服务器随机地分配动态的IP地址和端口；
    映射子单元，用于将所述分配子单元分配的所述动态的IP地址和端口分配给所述终端，形成所述终端信息与所述服务器的动态的IP地址和端口信息之间的映射关系，所述终端信息包括客户端特征或终端IP地址。
  10. 如权利要求9所述的装置，其特征在于，所述装置还包括：
    存储单元，用于存储所述映射子单元形成的所述终端信息与分配的所述IP地址和端口信息之间形成的映射关系。
  11. 如权利要求9所述的装置，其特征在于，所述接收单元还用于在将所述IP地址和端口信息返回给所述终端之后，接收所述终端发送的登录请求，所述登录请求中携带有所述客户端特征或终端IP地址；
    所述处理单元还用于利用所述映射子单元形成的所述映射关系，根据所述登录请求中的客户端特征或终端IP地址验证所述登录请求的合法性，若符合，则通过验证，允许所述终端连接所述IP地址和端口所对应的服务器。
  12. 如权利要求9所述的装置，其特征在于，所述处理单元还包括：
    设置子单元，用于设置所述映射子单元形成的所述映射关系的有效时间，以便在所述映射关系的有效时间允许所述终端连接所述IP地址和端口所对应的服务器。
  13. 如权利要求12所述的装置，其特征在于，所述接收单元还用于接收所述终端发送的延长所述映射关系的有效时间的请求；
    所述设置子单元延长所述映射关系的有效时间。
  14. 如权利要求8所述的装置，其特征在于，所述IP地址为浮动IP地址；所述端口为随机分配的端口。
PCT/CN2016/074422 2015-03-06 2016-02-24 一种服务器的安全管理方法及装置 WO2016141808A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510099111.7A CN105991624B (zh) 2015-03-06 2015-03-06 一种服务器的安全管理方法及装置
CN201510099111.7 2015-03-06

Publications (1)

Publication Number Publication Date
WO2016141808A1 true WO2016141808A1 (zh) 2016-09-15

Family

ID=56880000

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/074422 WO2016141808A1 (zh) 2015-03-06 2016-02-24 一种服务器的安全管理方法及装置

Country Status (2)

Country Link
CN (1) CN105991624B (zh)
WO (1) WO2016141808A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113014565A (zh) * 2021-02-19 2021-06-22 北京天维信通科技有限公司 实现防端口扫描的零信任架构及服务端口访问方法和设备
CN114338595A (zh) * 2021-12-31 2022-04-12 山石网科通信技术股份有限公司 报文的分布式处理方法、装置、存储介质及处理器

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018067399A1 (en) * 2016-10-03 2018-04-12 Stratus Digital Systems Transient transaction server
CN106598881B (zh) * 2016-12-20 2020-10-09 北京小米移动软件有限公司 页面处理方法及装置
CN107781949A (zh) * 2017-10-13 2018-03-09 青岛海信日立空调系统有限公司 风冷模块机组扩展方法和风冷模块机组
CN109040225B (zh) * 2018-07-27 2021-06-18 北京志翔科技股份有限公司 一种动态端口桌面接入管理方法和系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1456979A (zh) * 2002-05-10 2003-11-19 智旺全球科技股份有限公司 利用非固定ip在互联网上提供网路服务的方法
US20110208846A1 (en) * 2008-09-19 2011-08-25 Kiyoshige Ito Communication method and terminal apparatuses using the communication method in an ad-hoc network
CN103888358A (zh) * 2012-12-20 2014-06-25 中国移动通信集团公司 一种路由方法、装置、系统及网关设备
CN103916492A (zh) * 2014-04-11 2014-07-09 深信服网络科技（深圳）有限公司 一种网络设备访问控制方法及装置
CN104168165A (zh) * 2014-07-02 2014-11-26 北京交通大学 基于gprs网络和一体化标识网络的访问控制方法和装置

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030200441A1 (en) * 2002-04-19 2003-10-23 International Business Machines Corporation Detecting randomness in computer network traffic
US8670316B2 (en) * 2006-12-28 2014-03-11 Telecom Italia S.P.A. Method and apparatus to control application messages between client and a server having a private network address
CN101272389A (zh) * 2008-05-27 2008-09-24 华为技术有限公司 一种cs通信方法、系统和装置
CN102014114B (zh) * 2010-07-09 2013-10-23 北京哈工大计算机网络与信息安全技术研究中心 物联网中保护物体位置隐私的方法和装置
CN102143154B (zh) * 2010-12-28 2015-12-09 华为技术有限公司 用于媒体服务器上防攻击的方法和媒体服务器

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1456979A (zh) * 2002-05-10 2003-11-19 智旺全球科技股份有限公司 利用非固定ip在互联网上提供网路服务的方法
US20110208846A1 (en) * 2008-09-19 2011-08-25 Kiyoshige Ito Communication method and terminal apparatuses using the communication method in an ad-hoc network
CN103888358A (zh) * 2012-12-20 2014-06-25 中国移动通信集团公司 一种路由方法、装置、系统及网关设备
CN103916492A (zh) * 2014-04-11 2014-07-09 深信服网络科技（深圳）有限公司 一种网络设备访问控制方法及装置
CN104168165A (zh) * 2014-07-02 2014-11-26 北京交通大学 基于gprs网络和一体化标识网络的访问控制方法和装置

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113014565A (zh) * 2021-02-19 2021-06-22 北京天维信通科技有限公司 实现防端口扫描的零信任架构及服务端口访问方法和设备
CN114338595A (zh) * 2021-12-31 2022-04-12 山石网科通信技术股份有限公司 报文的分布式处理方法、装置、存储介质及处理器
CN114338595B (zh) * 2021-12-31 2024-02-02 山石网科通信技术股份有限公司 报文的分布式处理方法、装置、存储介质及处理器

Also Published As

Publication number Publication date
CN105991624A (zh) 2016-10-05
CN105991624B (zh) 2019-07-26

Similar Documents

Publication Publication Date Title
WO2016141808A1 (zh) 一种服务器的安全管理方法及装置
US11245576B2 (en) Blockchain-based configuration profile provisioning system
JP6720211B2 (ja) 仮想ネットワーク機能の安全なブートストラップ技術
WO2019037775A1 (zh) 下发业务配置文件
US11044236B2 (en) Protecting sensitive information in single sign-on (SSO) to the cloud
US8719900B2 (en) Validating updates to domain name system records
US8948399B2 (en) Dynamic key management
US9288193B1 (en) Authenticating cloud services
US9935937B1 (en) Implementing network security policies using TPM-based credentials
KR101837678B1 (ko) 신뢰실행환경 기반의 컴퓨팅 장치
TW201227395A (en) Cloud data security controlling system and method
CN112738100B (zh) 数据访问的鉴权方法、装置、鉴权设备和鉴权系统
CN112688773A (zh) 一种令牌的生成和校验方法及装置
US20140122716A1 (en) Virtual private network access control
US11165761B2 (en) Methods, devices, and computer program products for service security protection
EP4172818B1 (en) Shared resource identification
WO2020019420A1 (zh) 一种登录管理系统、方法、服务器及计算机可读存储介质
JP6943511B2 (ja) リソース処理方法、装置、システムおよびコンピュータ読み取り可能な媒体
US9864853B2 (en) Enhanced security mechanism for authentication of users of a system
WO2016197850A1 (zh) 一种访问电子设备的物理内存中私密数据的方法和装置
WO2016183906A1 (zh) 一种存储空间分配方法及装置
CN116484338A (zh) 数据库访问方法及装置
US10542001B1 (en) Content item instance access control
US11716333B2 (en) System and method for single use, fixed process privilege elevation
US11368459B2 (en) Providing isolated containers for user request processing

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16761035

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16761035

Country of ref document: EP

Kind code of ref document: A1