WO2016202007A1 - 一种设备运维方法及系统 - Google Patents
一种设备运维方法及系统 Download PDFInfo
- Publication number
- WO2016202007A1 WO2016202007A1 PCT/CN2016/074457 CN2016074457W WO2016202007A1 WO 2016202007 A1 WO2016202007 A1 WO 2016202007A1 CN 2016074457 W CN2016074457 W CN 2016074457W WO 2016202007 A1 WO2016202007 A1 WO 2016202007A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- proxy
- local area
- area network
- network device
- gateway
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/28—Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/34—Signalling channels for network management communication
- H04L41/344—Out-of-band transfers
Definitions
- This application relates to, but is not limited to, the field of network management equipment operation and maintenance.
- the current network environment of the LAN device is usually the internal network address and cannot be directly accessed.
- the operation and maintenance personnel need to open the port on the device. Need to jump through the jumper step by step, through the open port to log in to the target device, undoubtedly increase the cumbersome operation and maintenance work, low efficiency; and once the device open port, there will be security risks, equivalent to stay on the device After the back door, there is no guarantee that it will not encounter cyber attacks, which also makes the security of operation and maintenance work impossible.
- This paper provides a method and device for equipment operation and maintenance, which can improve the security of equipment operation and maintenance, improve management efficiency, and is simple and convenient.
- a device operation and maintenance method comprising:
- a built-in proxy server that accesses the portal of the user and a proxy gateway that is a gateway of the local area network device establish a control channel for transmitting control signaling between each other;
- the user accesses a portal query gateway of the local area network device that requests the login, and a control channel established by the proxy gateway and the proxy server;
- the proxy server and the proxy gateway of the local area network device requesting to log in utilize the queried Control channel, establish data channel;
- the proxy server establishes a control channel for transmitting control signaling with the proxy gateway, including:
- the already opened proxy server receives a connection establishment request sent by the proxy gateway
- the proxy server and the proxy gateway of the local area network device that requests the login use the queried control channel to establish a data channel, including:
- the proxy server sends a establish data channel command to the proxy gateway of the local area network device that requests the login through the control channel;
- the proxy server receives a setup data channel request message sent by the proxy gateway;
- the proxy server establishes a data channel with each other with the proxy gateway.
- the method further includes:
- the proxy gateway forwards the data packet to a local area network device that the user requests to operate.
- a device operation and maintenance system comprising: a user access portal of a local area network device and a proxy gateway as a gateway of the local area network device, wherein
- the user accesses the portal, and is configured to: establish a control channel for transmitting control signaling through the built-in proxy server and the proxy gateway; receive a request for the user to operate the local area network device; a proxy gateway of the recorded local area network device, and a control channel established by the proxy gateway and the proxy server; and a proxy gateway of the local area network device that requests the login to use the queried control channel to establish a data channel;
- the operation data of the user of the local area network device is sent to the proxy gateway of the queried LAN device requested by the proxy server via the data channel;
- the proxy gateway is configured to: establish a control channel for transmitting control signaling by the user accessing the portal through the user accessing the portal; and establishing with the proxy server and using the queried control channel And a data channel, through which the operation data of the user on the local area network device is received, and the operation data is sent to a local area network device that the user requests to operate.
- the user accessing the portal is set to:
- the already opened proxy server receives a connection establishment request sent by the proxy gateway
- the built-in proxy server for the user access portal is set to:
- the proxy gateway of the local area network device that requests the login to the query is set to:
- the data packet is forwarded to a local area network device that the user requests to operate.
- a user access portal for a local area network device including:
- proxy module a proxy module, a receiving module and a query module, the proxy module comprising a plurality of proxy servers; the proxy server establishing a control channel for transmitting control signaling with a proxy gateway as a gateway of the local area network device;
- the receiving module is configured to: receive a request for a user to operate the local area network device, and send operation data of the user to the local area network device to the proxy server;
- the query module is configured to: query a proxy gateway of the local area network device that requests the login, and a control channel established by the proxy gateway and the proxy server;
- the proxy module is configured to: establish, by the proxy server, the data channel of the queried control channel with the proxy gateway of the local area network device that requests the login; and pass the received operation data of the user to the local area network device through the proxy server The data channel is sent to the queried proxy gateway.
- the receiving module is further configured to: receive an inquiry message sent by the proxy gateway, and send the opened proxy server list information to the proxy gateway;
- the proxy module is further configured to: receive, by the proxy server that has been started, a connection establishment request sent by the proxy gateway, and establish, by the proxy server that establishes a connection with the proxy gateway, a control channel with the proxy gateway.
- the proxy server in the proxy module is set to:
- a computer readable storage medium storing computer executable instructions for performing the method of any of the above.
- the method and the device of the embodiment of the invention solve the problems of cumbersome and inefficient procedures caused by low security or installation procedures for the local area network device in the related art.
- the operation of the proxy server to the local area network is transmitted through a dedicated data channel, thereby improving security. It not only improves the security of equipment operation and maintenance, but also does not need to modify the program of the LAN equipment, which simplifies the operation and improves the management efficiency.
- Figure 1 is a flow chart of an embodiment of the present invention
- FIG. 2 is a structural diagram of a system networking provided by an embodiment of the present invention.
- FIG. 3 is a sequence diagram of registration of an Agent and a Portal according to an embodiment of the present invention.
- FIG. 4 is a timing diagram of establishing an agent control channel according to an embodiment of the present invention.
- FIG. 5 is a sequence diagram of a user logging in to a managed device through a portal SSH (Secure Shell) according to an embodiment of the present invention
- FIG. 6 is a structural diagram of a user access portal provided by an embodiment of the present invention.
- Figure 7 is a schematic diagram of a reverse proxy technique.
- a device operation and maintenance method comprising:
- a built-in proxy server that accesses the portal of the user and a proxy gateway that is a gateway of the local area network device establish a control channel for transmitting control signaling between each other;
- the user accesses a portal query gateway of the local area network device that requests the login, and a control channel established by the proxy gateway and the proxy server;
- the proxy server and the proxy gateway of the local area network device requesting to log in use the queried control channel to establish a data channel;
- the queried proxy gateway of the logged-in local area network device sends the operation data to the local area network device requested by the user for operation.
- Figure 1 is a flow chart of an embodiment of the present invention:
- Step S101 The user accesses the built-in proxy server of the portal and the proxy gateway that is the gateway of the local area network device to establish a control channel for transmitting control signaling between each other;
- Step S102 The user accessing the portal receives a request for the user to operate the local area network device
- Step S103 The user accesses a proxy gateway of the local area network device that the portal query requests to log in, and a control channel established by the proxy gateway and the proxy server;
- Step S104 The proxy server and the proxy gateway of the local area network device that requests the login use the queried control channel to establish a data channel.
- Step S105 The user accesses the portal to send the operation data of the user equipment to the local area network device to the queried proxy gateway via the data channel.
- Step S106 The queried proxy gateway sends the operation data to a local area network device that the user requests to operate.
- FIG. 2 is a structural diagram of a system networking provided by an embodiment of the present invention, where a portal is a user accessing a portal, and an agent is a proxy gateway.
- the communication between the Agent and the Portal provided by the embodiment of the present invention is based on a standard SSL (Secure Socket Layer) encryption system.
- SSL Secure Socket Layer
- the registration process is as shown in FIG. 3, and the agent needs to use the certificate signature and the key information after the registration authentication.
- the Agent can establish a communication channel with the Portal.
- FIG. 3 is a timing diagram of registration of an Agent and a Portal according to an embodiment of the present invention:
- Step S301 judging whether the agent matches the Portal according to the certificate
- Step S302 If the matching is successful, continue, if it fails, interrupt;
- Step S303 The agent delivers relevant registration information to the Portal.
- Step S304 The Portal sends a message to the user to notify the user of the review
- Step S305 The user sends a message to the Portal to notify the Portal to pass the verification, and the registration is successful.
- Step S306 The Portal sends a registration success message to the Agent.
- the communication process between Agent and Portal uses two communication channels: control channel and data channel.
- the control channel is established when the Agent starts registration. After the registration is completed, a control channel is established.
- the control channel is used for the control information interaction between the Agent and the Portal and the control data channel establishment and shutdown.
- the proxy server establishes a control channel for transmitting control signaling with the proxy gateway, including:
- the proxy gateway sends an inquiry message to the user access portal
- the user access portal sends the already-opened proxy server list information to the proxy gateway;
- the already opened proxy server receives a connection establishment request sent by the proxy gateway
- FIG. 4 is a timing diagram of establishing an agent control channel according to an embodiment of the present invention.
- Step S401 The Agent first accesses all proxy servers of the Portal;
- Step S402 The Portal returns to the list of proxy server Agent servers that the Agent has opened;
- Step S403 The Agent attempts to establish a connection with all deployed proxy server servers on the Portal, and finds an optimal one.
- an Agent in the Portal, it may correspond to multiple proxy servers.
- the agent server finds the proxy server that finds the fastest response, that is, the optimal server, and establishes a connection with the optimal proxy server.
- Step S404 The Agent establishes a connection with the proxy server of the Portal to form a control channel.
- the agent actually establishes a connection with the proxy server Agent Server built in the Portal side, and the proxy server Opens the port and processes the message relay;
- the data channel is a channel through which the user uses the remote tool provided on the Portal to communicate with the accessed device through the built-in service of the proxy server of the Portal server.
- the Portal and Agent will perform security check based on the communication certificate through the control channel. Once the check fails, the Agent and Portal will automatically cut off the data channel.
- the proxy server and the proxy gateway of the local area network device that requests the login use the queried control channel to establish a data channel, including:
- the proxy server sends a establish data channel command to the proxy gateway of the local area network device that requests the login through the control channel;
- the proxy gateway of the local area network device requesting to log in sends a setup data channel request message to the proxy server;
- the proxy server receives the request message
- the proxy server the discovered proxy gateway of the local area network device requesting to log in establish a data channel between each other.
- the queried proxy gateway of the local area network device that requests the login to send the operation data to the local area network device that the user requests to operate including:
- the proxy gateway forwards the data packet to a local area network device that the user requests to operate.
- the portal serves as a server through a fixed port.
- the agent establishes a reverse connection with the portal through the TCP reverse proxy technology.
- FIG. 5 is a schematic diagram of a user that is logged in to the host through the portal SSH (Secure Shell) according to an embodiment of the present invention.
- Equipment timing diagram is a schematic diagram of a user that is logged in to the host through the portal SSH (Secure Shell) according to an embodiment of the present invention.
- step S501 the operation and maintenance personnel need to log in to a device A of the local area network through the SSH tool from the portal.
- the portal query database searches for information of the device A, including the agent that governs the device A, the control channel ID of the agent and the portal, and the like.
- step S503 the built-in service agent server of the portal finds the control channel by using the control channel ID, and sends an instruction to request the agent to actively establish a data channel with the portal for the interaction between the SSH client and the target device.
- Step S504 the Agent establishes a data channel to the Portal, and establishes a Socket connection according to the IP and the proxy port sent by the Portal.
- step S505 the portal records the newly created data channel ID, and the operation of the remote device by the user on the Portal is forwarded to the Agent by the Agent server of the Portal through the data channel.
- Step S506 after receiving the data packet, the Agent directly forwards it to the local SOCKS5 proxy service for processing, and the SOCKS5 proxy service is a general standard for forwarding the data packet.
- the data packet can contain the IP address message of the LAN device. After receiving the data packet, the agent can send the data packet to the local area network device according to the IP address message.
- step S507 the SOCKS5 proxy service transmits the data packet to the local area network device A.
- step S508 the local area network device A processes the corresponding instruction, and then sends the response data to the agent's SOCKS5 agent.
- step S509 the SOCKS5 agent on the Agent transmits the response data back to the Portal side along the original path.
- the Portal finally echoes the response data to the user.
- the agent acts as a gateway and the agent itself is not open to the outside, but is based on the reverse proxy technology and the portal communication, and the managed device has zero intrusion, ensuring that the operation and maintenance personnel can access the device quickly and conveniently while ensuring being Manage the security of the device network.
- An embodiment of the present invention provides a device operation and maintenance system, where the system includes: a user access portal of a local area network device and a proxy gateway as a gateway of the local area network device, where
- the user accesses the portal, and is configured to: establish a control channel for transmitting control signaling by using the built-in proxy server and the proxy gateway; receive a request for the user to operate the local area network device; query a proxy gateway of the local area network device that requests the login, and the proxy gateway a control channel established with the proxy server; a proxy gateway of the local area network device that is logged in with the query request, establishes a data channel by using the queried control channel; and passes the received operation data of the received user to the local area network device Sending, by the data server, the proxy server to the proxy gateway of the queried LAN device requesting login;
- the proxy gateway is configured to: establish a control channel for transmitting control signaling by the user accessing the portal through the user accessing the portal; and establishing with the proxy server and using the queried control channel And a data channel, through which the operation data of the user on the local area network device is received, and the operation data is sent to a local area network device that the user requests to operate.
- FIG. 2 is a structural diagram of a system networking provided by an embodiment of the present invention.
- the agent is the proxy gateway 21; the portal is the user access portal 22, or a user access portal.
- the system includes a proxy gateway Agent 21 as a gateway of the local area network device and a user access portal Portal 22 of the local area network device.
- the agent 21 is responsible for opening a message channel between the portal 22 and the local area network device 23, and is only open to the portal 22.
- Portal 22 provides a unified management portal for access management devices.
- the local area network identification is divided into two groups. Each group has a proxy gateway Agent 21, and one user access portal Portal 22 includes a plurality of proxy servers Agent Server 221.
- the user accessing the portal 22 is set to:
- the already opened proxy server 221 receives the connection establishment sent by the proxy gateway 21 begging,
- the built-in proxy server 221 of the user access portal 22 is set to:
- the proxy gateway 21 of the local area network device requesting login is established with a data channel between each other.
- the proxy gateway 21 of the local area network device that requests the login to be queried is configured to: receive the data packet sent by the proxy server 221;
- the data packet is forwarded to the local area network device 23 that the user requests to operate.
- a user of a local area network device accesses the portal
- the user accesses the portal, including the proxy module 603, the receiving module 601 and the query module 602, and the proxy module 603 includes a plurality of proxy servers;
- the receiving module 601 is configured to: receive a request for a user to operate the local area network device, and send operation data of the user to the local area network device to the proxy server;
- the query module 602 is configured to: query a proxy gateway of the local area network device that requests the login, and a control channel established by the proxy gateway and the proxy server;
- the proxy module 603 is configured to: establish, by the proxy server, the data channel of the queried control channel with the proxy gateway of the local area network device that requests the login; and obtain the operation data of the received user to the local area network device by using the proxy server.
- the data channel is sent to the queried proxy gateway.
- the receiving module 601 is further configured to: receive an inquiry message sent by the proxy gateway, and send the opened proxy server list information to the proxy gateway;
- the proxy module 603 is further configured to: receive, by using the already-opened proxy server, a connection establishment request sent by the proxy gateway, and establish, by the proxy server that establishes a connection with the proxy gateway, a control channel with the proxy gateway. .
- the proxy server in the proxy module 603 is set to:
- the embodiment of the present invention can solve the problem of remote operation and maintenance.
- the operation and maintenance personnel can access the target device in the LAN environment in the operating environment through a simple unified portal, and the target device does not need to open ports or install an agent.
- the agent acts as a gateway, and the agent itself is not open to the outside, but is based on the reverse proxy technology and the portal communication, and the managed device has zero intrusion, ensuring that the operation and maintenance personnel can access the device quickly and conveniently while ensuring being Manage the security of the device network.
- a typical agent is generally called a forward proxy and is only used to proxy the internal network connection request to the external network, and does not support the external network access request to the internal network.
- a proxy server can proxy hosts on the external network to access the internal network, such an agent is called a reverse proxy.
- the client 701, the reverse proxy server 702, and the server 703 are included. As can be seen from the figure, between the real server 703 and the client 701, a server, also called a reverse proxy server 702, is also provided.
- the reverse proxy server directly connects with the client and then connects to the real server, which can reduce the load of the real server. For example, if the content accessed by the client is cached on the reverse proxy server, the proxy server can directly send the content to the client. Thereby reducing the load on the real server.
- the client directly collects only the information of the reverse proxy server when accessing, which protects the information and data of the real server, blocks the attack of the hacker, and improves the reality. Server security.
- the Agent is equivalent to the reverse proxy server, and the controlled device in the local area network is equivalent to the real server; the Portal is equivalent to the client.
- the client is to access the controlled device of the LAN.
- the reason for using the agent as the proxy is that the client and the LAN device server cannot be directly connected, so the agent data is forwarded through the agent agent; since the agent does not open the port for security, The client must have a connection channel to communicate with the agent agent, so the agent server starts the port listening, and the agent establishes the reverse connection to form a data channel, so that the communication between the client and the real server of the local area network can be opened.
- the Agent also becomes a reverse proxy server.
- the reverse proxy technology is used to implement a unified and secure access to managed devices. This solution enables fast remote access to LAN devices on the operating environment.
- all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve.
- the devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.
- the device/function module/functional unit in the above embodiment When the device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium.
- the above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
- the embodiment of the invention solves the problem that the program caused by the low security or the installation procedure of the local area network device is cumbersome and inefficient in the related art.
- the operation of the proxy server to the local area network in the embodiment of the present invention is transmitted through a dedicated data channel, thereby improving security.
- the embodiment of the invention not only improves the security of the operation and maintenance of the device, but also does not need to modify the program of the local area network device, simplifies the operation and improves the management efficiency.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Computer And Data Communications (AREA)
Abstract
本文公布一种设备运维方法,所述方法包括:用户访问门户的内置代理服务器与作为局域网设备的网关的代理网关建立彼此之间传输控制信令的控制通道;所述代理服务器与所述请求登录的局域网设备的代理网关利用查询到的控制通道,建立数据通道;用户访问门户将接收到的用户对所述局域网设备的操作数据通过所述代理服务器经由所述数据通道发送至所述查询到的请求登录的局域网设备的代理网关。
Description
本申请涉及但不限于网管设备运维领域。
由于局域网设备的现网环境一般都是内网地址,并且对外不能直达,为了保证运维人员能够在该环境下登录并维修出现故障的设备,运维人员需要在设备上开放端口,运维人员需要通过跳板机逐级跳转,通过开放端口才能登录到目标设备上,无疑增加了运维工作的繁琐性,效率低下;而一旦设备开放端口,就会存在安全隐患,相当于在设备上留下了后门,无法保证不会遭遇网络攻击,这也导致运维工作的安全性无法保证。
也可以在设备上安装代理程序,但是涉及到对设备上安装软件,尤其是在局域网中,设备数量巨大的情况下,过程繁琐。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本文提供了一种设备运维的方法及装置,可以提高设备运维的安全性,提高管理的效率,简单方便。
一种设备运维方法,所述方法包括:
用户访问门户的内置代理服务器与作为局域网设备的网关的代理网关建立彼此之间传输控制信令的控制通道;
所述用户访问门户接收用户操作局域网设备的请求;
所述用户访问门户查询请求登录的局域网设备的代理网关,以及该代理网关与所述代理服务器建立的控制通道;
所述代理服务器与所述请求登录的局域网设备的代理网关利用查询到的
控制通道,建立数据通道;
用户访问门户将接收到的用户对所述局域网设备的操作数据通过所述代理服务器经由所述数据通道发送至所述查询到的请求登录的局域网设备的代理网关,以使所述代理网关将所述操作数据发送至用户请求操作的局域网设备。
可选地,其中,所述代理服务器与所述代理网关建立传输控制信令的控制通道,包括:
所述用户访问门户接收所述代理网关发送的询问消息,将已经开启的代理服务器列表信息发送至所述代理网关;
所述已经开启的代理服务器接收所述代理网关发送的连接建立请求,
由最快与所述代理网关建立连接的代理服务器与所述代理网关建立控制通道。
可选地,所述代理服务器与所述请求登录的局域网设备的代理网关利用查询到的控制通道,建立数据通道,包括:
所述代理服务器通过所述控制通道向所述请求登录的局域网设备的代理网关发送建立数据通道命令;
所述代理服务器接收所述代理网关发送的建立数据通道请求消息;
所述代理服务器与所述代理网关建立彼此之间的数据通道。
可选地,所述用户访问门户将接收到的用户对所述局域网设备的操作数据通过所述代理服务器经由所述数据通道发送至所述代理网关之后,还包括:
所述代理网关接收所述代理服务器发送的数据包;
所述代理网关将所述数据包转发至所述用户请求操作的局域网设备。
一种设备运维系统,所述系统包括:局域网设备的用户访问门户和作为局域网设备的网关的代理网关,其中,
所述用户访问门户,设置为:通过内置的代理服务器和所述代理网关建立传输控制信令的控制通道;接收用户操作局域网设备的请求;查询请求登
录的局域网设备的代理网关,以及该代理网关与所述代理服务器建立的控制通道;与所述查询到的请求登录的局域网设备的代理网关,利用查询到的控制通道,建立数据通道;将接收到的用户对所述局域网设备的操作数据通过所述代理服务器经由所述数据通道发送至所述查询到的请求登录的局域网设备的代理网关;
所述代理网关,设置为:和所述用户访问门户,通过所述用户访问门户中的代理服务器建立传输控制信令的控制通道;以及,与所述代理服务器与利用查询到的控制通道,建立数据通道,通过所述数据通道接收用户对所述局域网设备的操作数据,将所述操作数据发送至用户请求操作的局域网设备。
可选地,
所述用户访问门户,是设置为:
接收所述代理网关发送的询问消息;
将已经开启的代理服务器列表信息发送至所述代理网关;
所述已经开启的代理服务器接收所述代理网关发送的连接建立请求,
由最快与所述代理网关建立连接的代理服务器与所述代理网关建立控制通道。
可选地,
所述用户访问门户的内置代理服务器是设置为:
通过所述查询到的控制通道向所述查询到的请求登录的局域网设备的代理网关发送建立数据通道命令;
接收所述代理网关发送的建立数据通道请求消息;
与所述请求登录的局域网设备的代理网关建立彼此之间的数据通道。
可选地,
所述查询到的请求登录的局域网设备的代理网关,是设置为:
接收所述代理服务器发送的数据包;
将所述数据包转发至所述用户请求操作的局域网设备。
一种局域网设备的用户访问门户,包括:
代理模块,接收模块和查询模块,所述代理模块包括多个代理服务器;所述代理服务器与作为局域网设备的网关的代理网关建立传输控制信令的控制通道;
所述接收模块,设置为:接收用户操作局域网设备的请求,并将用户对局域网设备的操作数据发送到所述代理服务器;
所述查询模块,设置为:查询请求登录的局域网设备的代理网关,以及该代理网关与所述代理服务器建立的控制通道;
所述代理模块,设置为:通过代理服务器与所述请求登录的局域网设备的代理网关利用查询到的控制通道,建立数据通道;通过代理服务器将接收到的用户对所述局域网设备的操作数据通过所述数据通道发送至查询到的代理网关。
可选地,
所述接收模块,还设置为:接收所述代理网关发送的询问消息,将已经开启的代理服务器列表信息发送至所述代理网关;
所述代理模块,还设置为:通过所述已经开启的代理服务器接收所述代理网关发送的连接建立请求,由最快与所述代理网关建立连接的代理服务器与所述代理网关建立控制通道。
可选地,
所述代理模块中的代理服务器,是设置为:
通过所述控制通道向所述请求登录的局域网设备的代理网关发送建立数据通道命令;
接收所述代理网关发送的建立数据通道请求消息;
与所述查找到的请求登录的局域网设备的代理网关建立彼此之间的数据通道。
一种计算机可读存储介质,存储有计算机可执行指令,所述计算机可执行指令用于执行上述任一项的方法。
采用本发明实施例的方法及装置,解决了相关技术中,安全性低或者对局域网设备进行安装程序所造成的程序繁琐,效率低下的问题。
代理服务器对局域网的操作通过专用的数据通道发送,从而提高了安全性。既提高了设备运维的安全性,又不需要对局域网设备进行程序上的修改,简化了操作,提高了管理效率。
在阅读并理解了附图和详细描述后,可以明白其他方面。
附图概述
图1是本发明实施例的流程图;
图2是本发明实施例提供的系统组网结构图;
图3是本发明实施例提供的Agent与Portal注册时序图;
图4是本发明实施例提供的Agent控制通道建立时序图;
图5是本发明实施例提供的用户通过门户SSH(Secure Shell)登录到被管设备时序图;
图6是本发明实施例提供的用户访问门户结构图;
图7是反向代理技术原理图。
下面将结合附图对本发明的实施方式进行说明。
需要说明的是,如果不冲突,本发明实施例以及实施例中的特征可以相互结合。另外,虽然在流程图中示出了逻辑顺序,但是在一些情况下,可以以不同于此处的顺序执行所示出或描述的步骤。
一种设备运维方法,所述方法包括:
用户访问门户的内置代理服务器与作为局域网设备的网关的代理网关建立彼此之间传输控制信令的控制通道;
所述用户访问门户接收用户操作局域网设备的请求;
所述用户访问门户查询请求登录的局域网设备的代理网关,以及该代理网关与所述代理服务器建立的控制通道;
所述代理服务器与所述请求登录的局域网设备的代理网关利用查询到的控制通道,建立数据通道;
用户访问门户将接收到的用户对所述局域网设备的操作数据通过所述代理服务器经由所述数据通道发送至所述查询到的请求登录的局域网设备的代理网关;
所述查询到的请求登录的局域网设备的代理网关将所述操作数据发送至用户请求操作的局域网设备。
图1是本发明实施例的流程图:
步骤S101:用户访问门户的内置代理服务器与作为局域网设备的网关的代理网关建立彼此之间传输控制信令的控制通道;
步骤S102:所述用户访问门户接收用户操作局域网设备的请求;
步骤S103:用户访问门户查询请求登录的局域网设备的代理网关,以及该代理网关与所述代理服务器建立的控制通道;
步骤S104:所述代理服务器与所述请求登录的局域网设备的代理网关利用查询到的控制通道,建立数据通道;
步骤S105:用户访问门户将接收到的用户对所述局域网设备的操作数据通过所述代理服务器经由所述数据通道发送至查询到的代理网关;
步骤S106:所述查询到的代理网关将所述操作数据发送至用户请求操作的局域网设备。
图2是本发明实施例提供的系统组网结构图,其中Portal为用户访问门户,Agent为代理网关。
本发明实施例提供的Agent和Portal之间通信基于标准的SSL(Secure Socket Layer,安全套接层)加密体系,注册流程如图3所示,Agent进行注册认证时需要使用证书签名和关键信息加密后传送给Portal,Portal进行签名检查和证书认证成功后,Agent才能真正和Portal建立通讯通道。
图3是本发明实施例提供的Agent与Portal注册时序图:
步骤S301:根据证书判断Agent与Portal是否匹配;
步骤S302:若匹配成功,则继续,若失败,则中断;
步骤S303:Agent向Portal传递相关注册信息;
步骤S304:Portal向用户发送消息,通知用户审核;
步骤S305:用户向Portal发送消息,通知Portal审核通过,注册成功;
步骤S306:Portal向Agent发送注册成功消息。
Agent和Portal的通讯过程使用两个通讯通道:控制通道和数据通道。控制通道在Agent启动注册时建立,在注册完成后,建立控制通道,控制通道用于Agent与Portal之间的控制信息交互以及控制数据通道建立、关闭。
可选地,
可选地,其中,所述代理服务器与所述代理网关建立传输控制信令的控制通道,包括:
所述代理网关向所述用户访问门户发送询问消息;
所述用户访问门户将已经开启的代理服务器列表信息发送至所述代理网关;
所述代理网关向所述已经开启的代理服务器发送连接建立请求;
所述已经开启的代理服务器接收所述代理网关发送的连接建立请求,
由最快与所述代理网关建立连接的代理服务器与所述代理网关建立控制通道。
图4是本发明实施例提供的Agent控制通道建立时序图;
步骤S401:Agent首先访问Portal的所有代理服务器Agent server;
步骤S402:Portal返回给Agent已开启的代理服务器Agent server列表;
步骤S403:Agent尝试与Portal上所有部署的代理服务器Agent server建立连接,并寻找最优的一个。
也就是说,对于一个Agent,在Portal中,可能对应多个代理服务器
Agent server,通过比较,找出寻找响应最快的代理服务器,也就是最优的服务器,与所述最优的代理服务器建立连接。
步骤S404:Agent与Portal的代理服务器建立连接,形成控制通道。
Agent实际与Portal侧内置的代理服务器Agent Server建立连接,代理服务器Agent Server开放端口,处理消息中转;
数据通道是用户使用Portal上提供的远程工具通过Portal端的代理服务器Agent Server内置服务和被访问设备进行网络通讯的通道。
Portal和Agent会通过控制通道进行基于通讯证书的安全检查,一旦检查失败,Agent和Portal会自动切断数据通道。
可选地,所述代理服务器、所述请求登录的局域网设备的代理网关利用查询到的控制通道,建立数据通道,包括:
所述代理服务器通过所述控制通道向所述请求登录的局域网设备的代理网关发送建立数据通道命令;
所述请求登录的局域网设备的代理网关向所述代理服务器发送建立数据通道请求消息;
所述代理服务器接收所述请求消息;
所述代理服务器、所述查找到的请求登录的局域网设备的代理网关建立彼此之间的数据通道。
可选地,所述查询到的请求登录的局域网设备的代理网关将所述操作数据发送至用户请求操作的局域网设备,包括:
所述代理网关接收所述代理服务器发送的数据包;
所述代理网关将所述数据包转发至所述用户请求操作的局域网设备。
Agent和Portal整个通讯过程中,Portal作为服务端通过固定的端口对外提供服务,Agent通过TCP反向代理技术和Portal建立反向连接。
这确保了Agent没有开放任何固定的对外端口,从而防止Agent侧遭遇网络攻击。
图5是本发明实施例提供的用户通过门户SSH(Secure Shell)登录到被管
设备时序图
一种实现通过Portal使用SSH登录被管理设备的应用场景:
下面结合附图5对本发明的实施方法进一步说明:
步骤S501,运维人员从Portal上需要通过SSH工具登录局域网某一台设备A。
步骤S502,Portal查询数据库查找设备A的信息,包括管辖设备A的Agent,Agent与Portal的控制通道ID等。
步骤S503,Portal的内置服务Agent Server会通过控制通道ID查找到该控制通道,发送指令请求Agent主动再与Portal建立一条数据通道,用于SSH客户端与目标设备之间交互,指令格式为type=ReqConnect&agentSrvId=2&hostIp=10.46.180.130&agentPort=8323。
步骤S504,Agent向Portal建立数据通道,根据Portal发过来的IP和代理端口建立Socket连接。
步骤S505,Portal将新建立的数据通道ID记录,用户在Portal上对远程设备的操作都会被Portal的Agent Server通过数据通道转发给Agent。
步骤S506,Agent收到数据包后,直接转发给本地的SOCKS5代理服务去处理,SOCKS5代理服务是通用标准,用于转发数据包。
值得注意的是,数据包中可以包含局域网设备的IP地址消息。Agent收到数据包后,可以根据IP地址消息,将数据包发送给局域网设备。
步骤S507,SOCKS5代理服务将数据包传送给局域网设备A。
步骤S508,局域网设备A处理相应的指令,然后把响应数据发给Agent的SOCKS5代理。
步骤S509,Agent上面的SOCKS5代理将响应数据沿原路传回到Portal侧。
步骤S510,Portal最终回显响应数据给用户。本发明实施例由Agent作为网关而且Agent本身对外不开放,而是基于反向代理技术与Portal通信,被管设备零入侵,在保证运维人员快捷便利地访问设备的同时,又能保证被
管设备网络的安全性。
本发明实施例提供一种设备运维系统,所述系统包括:局域网设备的用户访问门户和作为局域网设备的网关的代理网关,其中,
所述用户访问门户,设置为:通过内置的代理服务器和所述代理网关建立传输控制信令的控制通道;接收用户操作局域网设备的请求;查询请求登录的局域网设备的代理网关,以及该代理网关与所述代理服务器建立的控制通道;与所述查询到的请求登录的局域网设备的代理网关,利用查询到的控制通道,建立数据通道;将接收到的用户对所述局域网设备的操作数据通过所述代理服务器经由所述数据通道发送至所述查询到的请求登录的局域网设备的代理网关;
所述代理网关,设置为:和所述用户访问门户,通过所述用户访问门户中的代理服务器建立传输控制信令的控制通道;以及,与所述代理服务器与利用查询到的控制通道,建立数据通道,通过所述数据通道接收用户对所述局域网设备的操作数据,将所述操作数据发送至用户请求操作的局域网设备。
图2是本发明实施例提供的系统组网结构图。
Agent为代理网关21;Portal为用户访问门户22,或者称为用户访问入口。
该系统包括作为局域网设备的网关的代理网关Agent21和局域网设备的用户访问入口Portal22,Agent21负责打通Portal22与局域网设备23之间的消息通道,并只对Portal22开放。Portal22提供了访问管理设备的统一管理入口,局域网识别分为两组,每一组都有个代理网关Agent21,一个用户访问入口Portal22中包含有多个代理服务器Agent Server221。
可选地,
所述用户访问门户22,是设置为:
接收所述代理网关21发送的询问消息;将已经开启的代理服务器列表信息发送至所述代理网关21;
所述已经开启的代理服务器221接收所述代理网关21发送的连接建立请
求,
由最快与所述代理网关21建立连接的代理服务器221与所述代理网关21建立控制通道。
可选地,
所述用户访问门户22的内置代理服务器221是设置为:
通过所述查询到的控制通道向所述查询到的请求登录的局域网设备的代理网关21发送建立数据通道命令;
接收所述代理网关21发送的建立数据通道请求消息;
与所述请求登录的局域网设备的代理网关21建立彼此之间的数据通道。
可选地,
所述查询到的请求登录的局域网设备的代理网关21,是设置为:接收所述代理服务器221发送的数据包;
将所述数据包转发至所述用户请求操作的局域网设备23。
如图6所示,一种局域网设备的用户访问门户,
所述用户访问门户,包括代理模块603,接收模块601和查询模块602、所述代理模块603包括多个代理服务器;
所述代理服务器与作为局域网设备的网关的代理网关建立传输控制信令的控制通道;
所述接收模块601,设置为:接收用户操作局域网设备的请求,并将用户对局域网设备的操作数据发送到所述代理服务器;
查询模块602,设置为:查询请求登录的局域网设备的代理网关,以及该代理网关与所述代理服务器建立的控制通道;
所述代理模块603,设置为:通过代理服务器与所述请求登录的局域网设备的代理网关利用查询到的控制通道,建立数据通道;通过代理服务器将接收到的用户对所述局域网设备的操作数据通过所述数据通道发送至查询到的代理网关。
可选地,
所述接收模块601,还设置为:接收所述代理网关发送的询问消息,将已经开启的代理服务器列表信息发送至所述代理网关;
所述代理模块603,还设置为:通过所述已经开启的代理服务器接收所述代理网关发送的连接建立请求,由最快与所述代理网关建立连接的代理服务器与所述代理网关建立控制通道。
可选地,
所述代理模块603中的代理服务器,是设置为:
通过所述控制通道向所述请求登录的局域网设备的代理网关发送建立数据通道命令;
接收所述代理网关发送的建立数据通道请求消息;
与所述查找到的请求登录的局域网设备的代理网关建立彼此之间的数据通道。
本发明实施例可以解决远程运维场景下,运维人员能够通过简单的统一的门户入口,安全快捷的访问运营环境中局域网环境下的目标设备,而且目标设备无需开放端口或安装代理程序。
本发明实施例由Agent作为网关,而且Agent本身对外不开放,而是基于反向代理技术与Portal通信,被管设备零入侵,在保证运维人员快捷便利地访问设备的同时,又能保证被管设备网络的安全性。
关于反向代理技术:
通常的代理一般称为正向代理,只用于代理内部网络对外部网络的连接请求,不支持外部网络对内部网络的访问请求。当一个代理服务器能够代理外部网络上的主机访问内部网络时,这种代理称为反向代理。
图7表明了反向代理技术的工作原理:
包括客户端701,反向代理服务器702,服务器703;从图中可知,在真实的服务器703与客户端701之间,还设置一个服务器,称为反向代理服务器702。
在真实服务器前面设置反向代理服务器,有以下作用:
反向代理服务器直接与客户端相连,然后连接真实服务器,可以降低真实服务器的负载,比如,客户端访问的内容如果缓存在反向代理服务器上,代理服务器就可以直接将内容发送给客户端,从而减小了真实服务器的负载。
另外,真实服务器设置在反向代理服务器之后,客户端在访问时,直接采集到的只是反向代理服务器的信息,这就保护了真实服务器的信息和数据,阻挡了黑客的攻击,提高了真实服务器的安全性。
也就是说,本发明实施例中,Agent相当于反向代理服务器,而局域网内的被控设备相当于真实服务器;Portal相当于客户端。
客户端就是为了访问局域网的被控设备,使用agent作为代理的原因是由于客户端和局域网设备服务器无法直连,所以要通过agent代理去转发通信数据;由于agent为了安全性不对外开放端口,但是客户端要和agent代理通信就必须有连接通道,所以这里由agent server启动端口监听,由agent去建立反向连接,形成数据通道,这样才能打通客户端与局域网真实服务器之间的通信。Agent也就成为反向代理服务器。
使用反向代理的技术来实现统一安全地访问被管设备的方案,通过此方案可以快捷的与运营环境上的局域网设备实现远程访问。
本领域普通技术人员可以理解上述实施例的全部或部分步骤可以使用计算机程序流程来实现,所述计算机程序可以存储于一计算机可读存储介质中,所述计算机程序在相应的硬件平台上(如系统、设备、装置、器件等)执行,在执行时,包括方法实施例的步骤之一或其组合。
可选地,上述实施例的全部或部分步骤也可以使用集成电路来实现,这些步骤可以被分别制作成一个个集成电路模块,或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。
上述实施例中的装置/功能模块/功能单元可以采用通用的计算装置来实现,它们可以集中在单个的计算装置上,也可以分布在多个计算装置所组成的网络上。
上述实施例中的装置/功能模块/功能单元以软件功能模块的形式实现并作为独立的产品销售或使用时,可以存储在一个计算机可读取存储介质中。上述提到的计算机可读取存储介质可以是只读存储器,磁盘或光盘等。
本发明实施例解决了相关技术中,安全性低或者对局域网设备进行安装程序所造成的程序繁琐,效率低下的问题。本发明实施例中的代理服务器对局域网的操作通过专用的数据通道发送,从而提高了安全性。本发明实施例既提高了设备运维的安全性,又不需要对局域网设备进行程序上的修改,简化了操作,提高了管理效率。
Claims (12)
- 一种设备运维方法,包括:用户访问门户的内置代理服务器与作为局域网设备的网关的代理网关建立彼此之间传输控制信令的控制通道;所述用户访问门户接收用户操作局域网设备的请求;所述用户访问门户查询请求登录的局域网设备的代理网关,以及该代理网关与所述代理服务器建立的控制通道;所述代理服务器与所述请求登录的局域网设备的代理网关利用查询到的控制通道,建立数据通道;用户访问门户将接收到的用户对所述局域网设备的操作数据通过所述代理服务器经由所述数据通道发送至所述查询到的请求登录的局域网设备的代理网关,以使所述代理网关将所述操作数据发送至用户请求操作的局域网设备。
- 如权利要求1所述的方法,其中,所述代理服务器与所述代理网关建立彼此之间传输控制信令的控制通道,包括:所述用户访问门户接收所述代理网关发送的询问消息,将已经开启的代理服务器列表信息发送至所述代理网关;所述已经开启的代理服务器接收所述代理网关发送的连接建立请求,由最快与所述代理网关建立连接的代理服务器与所述代理网关建立控制通道。
- 如权利要求1或2所述的方法,其中,所述代理服务器与所述请求登录的局域网设备的代理网关利用查询到的控制通道,建立数据通道,包括:所述代理服务器通过所述控制通道向所述请求登录的局域网设备的代理网关发送建立数据通道命令;所述代理服务器接收所述代理网关发送的建立数据通道请求消息;所述代理服务器与所述代理网关建立彼此之间的数据通道。
- 如权利要求1所述的方法,其中,所述用户访问门户将接收到的用 户对所述局域网设备的操作数据通过所述代理服务器经由所述数据通道发送至所述代理网关之后,还包括:所述代理网关接收所述代理服务器发送的数据包;所述代理网关将所述数据包转发至所述用户请求操作的局域网设备。
- 一种设备运维系统,包括:局域网设备的用户访问门户和作为局域网设备的网关的代理网关,其中,所述用户访问门户,设置为:通过内置的代理服务器和所述代理网关建立传输控制信令的控制通道;接收用户操作局域网设备的请求;查询请求登录的局域网设备的代理网关,以及该代理网关与所述代理服务器建立的控制通道;与所述查询到的请求登录的局域网设备的代理网关,利用查询到的控制通道,建立数据通道;将接收到的用户对所述局域网设备的操作数据通过所述代理服务器经由所述数据通道发送至所述查询到的请求登录的局域网设备的代理网关;所述代理网关,设置为:和所述用户访问门户,通过所述用户访问门户中的代理服务器建立传输控制信令的控制通道;以及,与所述代理服务器与利用查询到的控制通道,建立数据通道,通过所述数据通道接收用户对所述局域网设备的操作数据,将所述操作数据发送至用户请求操作的局域网设备。
- 如权利要求5所述的系统,其中,所述用户访问门户,是设置为:接收所述代理网关发送的询问消息;将已经开启的代理服务器列表信息发送至所述代理网关;所述已经开启的代理服务器接收所述代理网关发送的连接建立请求,由最快与所述代理网关建立连接的代理服务器与所述代理网关建立控制通道。
- 如权利要求5或6所述的系统,其中,所述用户访问门户的内置代理服务器是设置为:通过所述查询到的控制通道向所述查询到的请求登录的局域网设备的代理网关发送建立数据通道命令;接收所述代理网关发送的建立数据通道请求消息;与所述请求登录的局域网设备的代理网关建立彼此之间的数据通道。
- 如权利要求5所述的系统,其中,所述查询到的请求登录的局域网设备的代理网关,是设置为:接收所述代理服务器发送的数据包;将所述数据包转发至所述用户请求操作的局域网设备。
- 一种局域网设备的用户访问门户,包括:代理模块,接收模块和查询模块,所述代理模块包括多个代理服务器;所述代理服务器与作为局域网设备的网关的代理网关建立传输控制信令的控制通道;所述接收模块,设置为:接收用户操作局域网设备的请求,并将用户对局域网设备的操作数据发送到所述代理服务器;所述查询模块,设置为:查询请求登录的局域网设备的代理网关,以及该代理网关与所述代理服务器建立的控制通道;所述代理模块,设置为:通过代理服务器与所述请求登录的局域网设备的代理网关利用查询到的控制通道,建立数据通道;通过代理服务器将接收到的用户对所述局域网设备的操作数据通过所述数据通道发送至查询到的代理网关。
- 如权利要求9所述的用户访问门户,其中,所述接收模块,还设置为:接收所述代理网关发送的询问消息,将已经开启的代理服务器列表信息发送至所述代理网关;所述代理模块,还设置为:通过所述已经开启的代理服务器接收所述代理网关发送的连接建立请求,由最快与所述代理网关建立连接的代理服务器与所述代理网关建立控制通道。
- 如权利要求9所述的用户访问门户,其中,所述代理模块中的代理服务器,是设置为:通过所述控制通道向所述请求登录的局域网设备的代理网关发送建立数据通道命令;接收所述代理网关发送的建立数据通道请求消息;与所述查找到的请求登录的局域网设备的代理网关建立彼此之间的数据通道。
- 一种计算机可读存储介质,存储有计算机可执行指令,所述计算机可执行指令用于执行权利要求1-4任一项的方法。
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201510334489.0 | 2015-06-16 | ||
CN201510334489.0A CN106330479A (zh) | 2015-06-16 | 2015-06-16 | 一种设备运维方法及系统 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2016202007A1 true WO2016202007A1 (zh) | 2016-12-22 |
Family
ID=57544999
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2016/074457 WO2016202007A1 (zh) | 2015-06-16 | 2016-02-24 | 一种设备运维方法及系统 |
Country Status (2)
Country | Link |
---|---|
CN (1) | CN106330479A (zh) |
WO (1) | WO2016202007A1 (zh) |
Cited By (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN111988347A (zh) * | 2019-05-22 | 2020-11-24 | 网宿科技股份有限公司 | 跳板机系统的数据处理方法和跳板机系统 |
CN112187491A (zh) * | 2019-07-01 | 2021-01-05 | 阿里巴巴集团控股有限公司 | 服务器的管理方法、装置和设备 |
CN114615254A (zh) * | 2022-03-25 | 2022-06-10 | 医渡云(北京)技术有限公司 | 远程连接方法、装置及系统、存储介质、电子设备 |
CN115037525A (zh) * | 2022-05-18 | 2022-09-09 | 深圳奇迹智慧网络有限公司 | 一种多连接动态安全外壳协议反向代理系统及方法 |
CN115190168A (zh) * | 2022-07-08 | 2022-10-14 | 苏州浪潮智能科技有限公司 | 一种边缘服务器管理系统及服务器集群 |
Families Citing this family (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN111092885B (zh) * | 2019-12-17 | 2021-10-08 | 国网江苏省电力有限公司苏州供电分公司 | 一种电力运维系统 |
CN111092911B (zh) * | 2019-12-31 | 2021-11-02 | 成都科来网络技术有限公司 | 一种增强安全性的网络代理实现方法 |
CN111901361B (zh) * | 2020-08-11 | 2022-06-28 | 深圳墨世科技有限公司 | 一种堡垒机服务方法、装置、计算机设备及存储介质 |
CN116032611A (zh) * | 2022-12-28 | 2023-04-28 | 北京深盾科技股份有限公司 | 网络设备的登录方法、系统及存储介质 |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20030154306A1 (en) * | 2002-02-11 | 2003-08-14 | Perry Stephen Hastings | System and method to proxy inbound connections to privately addressed hosts |
US6665721B1 (en) * | 2000-04-06 | 2003-12-16 | International Business Machines Corporation | Enabling a home network reverse web server proxy |
CN101087224A (zh) * | 2006-06-08 | 2007-12-12 | 刘劲彤 | 一种访问防火墙后节点上服务的方法 |
-
2015
- 2015-06-16 CN CN201510334489.0A patent/CN106330479A/zh not_active Withdrawn
-
2016
- 2016-02-24 WO PCT/CN2016/074457 patent/WO2016202007A1/zh active Application Filing
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6665721B1 (en) * | 2000-04-06 | 2003-12-16 | International Business Machines Corporation | Enabling a home network reverse web server proxy |
US20030154306A1 (en) * | 2002-02-11 | 2003-08-14 | Perry Stephen Hastings | System and method to proxy inbound connections to privately addressed hosts |
CN101087224A (zh) * | 2006-06-08 | 2007-12-12 | 刘劲彤 | 一种访问防火墙后节点上服务的方法 |
Cited By (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN111988347A (zh) * | 2019-05-22 | 2020-11-24 | 网宿科技股份有限公司 | 跳板机系统的数据处理方法和跳板机系统 |
CN111988347B (zh) * | 2019-05-22 | 2023-10-24 | 网宿科技股份有限公司 | 跳板机系统的数据处理方法和跳板机系统 |
CN112187491A (zh) * | 2019-07-01 | 2021-01-05 | 阿里巴巴集团控股有限公司 | 服务器的管理方法、装置和设备 |
CN114615254A (zh) * | 2022-03-25 | 2022-06-10 | 医渡云(北京)技术有限公司 | 远程连接方法、装置及系统、存储介质、电子设备 |
CN114615254B (zh) * | 2022-03-25 | 2023-09-29 | 医渡云(北京)技术有限公司 | 远程连接方法、装置及系统、存储介质、电子设备 |
CN115037525A (zh) * | 2022-05-18 | 2022-09-09 | 深圳奇迹智慧网络有限公司 | 一种多连接动态安全外壳协议反向代理系统及方法 |
CN115190168A (zh) * | 2022-07-08 | 2022-10-14 | 苏州浪潮智能科技有限公司 | 一种边缘服务器管理系统及服务器集群 |
CN115190168B (zh) * | 2022-07-08 | 2023-08-04 | 苏州浪潮智能科技有限公司 | 一种边缘服务器管理系统及服务器集群 |
Also Published As
Publication number | Publication date |
---|---|
CN106330479A (zh) | 2017-01-11 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2016202007A1 (zh) | 一种设备运维方法及系统 | |
US10027761B2 (en) | Facilitating a secure 3 party network session by a network device | |
CN108881308B (zh) | 一种用户终端及其认证方法、系统、介质 | |
US10601810B2 (en) | Private cloud routing server connection mechanism for use in a private communication architecture | |
CN102047262B (zh) | 用于分布式安全内容管理系统的认证 | |
US20060109850A1 (en) | IP-SAN network access control list generating method and access control list setup method | |
CN104426837B (zh) | Ftp的应用层报文过滤方法及装置 | |
WO2022247751A1 (zh) | 远程访问应用的方法、系统、装置、设备及存储介质 | |
TW201312370A (zh) | 與一公用雲端網路一同使用之方法及系統 | |
CN108173827B (zh) | 基于区块链思维的分布式sdn控制平面安全认证方法 | |
JP5864598B2 (ja) | ユーザにサービスアクセスを提供する方法およびシステム | |
CN109067937A (zh) | 终端准入控制方法、装置、设备、系统及存储介质 | |
US10749851B2 (en) | Network monitoring method and device | |
JP2009163546A (ja) | ゲートウェイ、中継方法及びプログラム | |
Lu et al. | An SDN‐based authentication mechanism for securing neighbor discovery protocol in IPv6 | |
CN108848145A (zh) | 通过web代理访问设备近端网管的方法、系统及远端网管 | |
CN115603932A (zh) | 一种访问控制方法、访问控制系统及相关设备 | |
WO2023279782A1 (zh) | 一种访问控制方法、访问控制系统及相关设备 | |
CN111526150A (zh) | 关于单集群或多集群云电脑远程运维端口零信任自动化规则放行平台及放行方法 | |
US10931662B1 (en) | Methods for ephemeral authentication screening and devices thereof | |
JP6289656B2 (ja) | セキュアなコンピュータシステム間の通信のための方法及びコンピュータネットワーク・インフラストラクチャ | |
US9678772B2 (en) | System, method, and computer-readable medium | |
US20190007306A1 (en) | Device and method for controlling route of traffic flow | |
JP2013034096A (ja) | アクセス制御システム、端末装置、中継装置及びアクセス制御方法 | |
US20200274903A1 (en) | Systems and methods for network management |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 16810748 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 16810748 Country of ref document: EP Kind code of ref document: A1 |