WO2023142070A1 - 面向云主机和云堡垒机实现云主机权限联动的方法 - Google Patents
面向云主机和云堡垒机实现云主机权限联动的方法 Download PDFInfo
- Publication number
- WO2023142070A1 WO2023142070A1 PCT/CN2022/075076 CN2022075076W WO2023142070A1 WO 2023142070 A1 WO2023142070 A1 WO 2023142070A1 CN 2022075076 W CN2022075076 W CN 2022075076W WO 2023142070 A1 WO2023142070 A1 WO 2023142070A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- cloud
- bastion
- host
- bastion machine
- hosts
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 35
- 238000013475 authorization Methods 0.000 claims abstract description 43
- 230000008859 change Effects 0.000 claims abstract description 17
- 230000004044 response Effects 0.000 claims abstract description 11
- 238000003032 molecular docking Methods 0.000 claims abstract description 10
- 230000001360 synchronised effect Effects 0.000 claims abstract description 9
- 238000012423 maintenance Methods 0.000 claims description 19
- 230000010354 integration Effects 0.000 claims description 11
- 230000008569 process Effects 0.000 claims description 8
- 230000006870 function Effects 0.000 claims description 4
- 230000000694 effects Effects 0.000 claims description 3
- 238000005516 engineering process Methods 0.000 abstract description 2
- 238000007726 management method Methods 0.000 description 15
- 230000004048 modification Effects 0.000 description 3
- 238000012986 modification Methods 0.000 description 3
- 230000002159 abnormal effect Effects 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 2
- 238000011161 development Methods 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 238000002955 isolation Methods 0.000 description 2
- 230000009191 jumping Effects 0.000 description 2
- 238000012550 audit Methods 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 230000008520 organization Effects 0.000 description 1
- 238000012384 transportation and delivery Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/105—Multiple levels of security
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/10—Protocols in which an application is distributed across nodes in the network
- H04L67/1095—Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
Definitions
- the invention relates to the technical field of cloud computing and information security, in particular to a method for realizing cloud host authority linkage for cloud hosts and cloud bastion hosts.
- Cloud host is an important part of cloud computing in infrastructure applications. It is located at the bottom of the cloud computing industry chain pyramid, and its products originate from cloud computing platforms. The platform integrates three core elements of Internet applications: computing, storage, and network, and provides public Internet infrastructure services for users. Cloud host is a virtualization technology similar to VPS host. VPS uses virtual software. VZ or VM virtualizes multiple parts similar to independent hosts on one host. operating system, the management method is the same as that of the host. With the development of cloud hosts and cloud computing, network security issues cannot be ignored.
- the bastion host plays a key role in security compliance auditing in the hybrid cloud environment.
- infrastructure is highly heterogeneous and widely distributed; cloud dynamic resource delivery and cloud resource management in the case of elastic scaling.
- the construction of a cloud computing platform introduces a large number of different types of IT infrastructure, including traditional physical equipment, virtualization platforms, private clouds, and public clouds within the enterprise. Because the current cloud platform adopts a multi-organization and multi-tenant model, IT assets are widely distributed and management is relatively scattered. Traditional bastion hosts need to divide resource permissions according to the cloud computing platform architecture, and manual maintenance costs are high.
- the cloud computing platform is relatively isolated from the traditional bastion host, and it is difficult to link the permissions of cloud computing platform tenants and bastion host users. It is often necessary to create users on the bastion host and assign corresponding resource permissions according to the organization tenant account permissions corresponding to cloud computing platform resources. Invest in higher labor costs.
- the existing traditional bastion hosts and cloud computing platforms each use different identity authentication systems.
- the cloud computing platform tenant permissions change, they cannot be adjusted and changed in a timely manner with the corresponding bastion host user permissions.
- Manual configuration adjustments are required, and the timeliness is poor.
- the present invention provides a method for realizing the linkage of the permission of the cloud host for the cloud host and the bastion host.
- the present invention provides a method for realizing cloud host authority linkage for cloud hosts and bastion hosts, including the following process:
- S1 Deploy and integrate the open source bastion machine: deploy the bastion machine on the cloud computing platform through the open api interface of the open source bastion machine itself, so that the cloud bastion machine is suitable for cloud computing multi-cloud tenants and multi-cloud resource scenarios, realizing cloud computing Docking and integration of computing platform and cloud bastion machine;
- S2 unified management authority information based on the connected cloud computing platform and cloud bastion machine, in the cloud bastion machine, the access authorization relationship and access account information of the cloud computing platform and cloud bastion machine are managed in a unified manner, so as to realize safe operation and maintenance at the same time Guarantee the security of the use of all cloud hosts;
- S3 establishes permission information automatic synchronization response rules: establish permission information automatic synchronization response rules in the cloud bastion machine, when the cloud tenant permissions are adjusted, the cloud bastion machine account permissions will also automatically respond and change synchronously, realizing the cloud computing platform and cloud fortress Automatic synchronization of machine permission information without manual intervention;
- S4 Linkage Authorization By obtaining the changes of the operation authority and management authority of the main cloud host to which the cloud host resources belong, the access authorization relationship and access account information are managed uniformly in the bastion machine, and the automatic synchronization rules of the authority information are automatically responded , synchronously adjust the cloud host resources corresponding to the cloud bastion machine, and after the cloud host resource authorization relationship changes, it will be automatically synchronized to the cloud bastion machine, realizing the linkage between cloud tenant roles and permissions and the cloud host resources of the cloud bastion machine Authorization strengthens the automatic synchronization capability and security compliance of cloud tenants and cloud host resources.
- the cloud bastion machine realizes safe operation and maintenance while ensuring the security of the use of all cloud hosts through: all operations of cloud host resources on the cloud platform will use the unified identity of the cloud bastion machine On the basis of authentication and log records, permission control such as upload/download and copy/paste can better control the security operation and maintenance risks in scenarios such as remote office, and ensure the security of all cloud hosts.
- step S1 it also includes: the cloud bastion machine, in addition to the functions that the cloud bastion machine system itself can provide, can also realize the effect of integrating the cloud platform and the bastion machine, and use the bastion machine login capability as One of the cloud platform services is provided to the terminal cloud tenants, and the cloud tenants can directly jump to use the cloud bastion machine through the cloud platform.
- the cloud bastion machine in addition to the functions that the cloud bastion machine system itself can provide, can also realize the effect of integrating the cloud platform and the bastion machine, and use the bastion machine login capability as One of the cloud platform services is provided to the terminal cloud tenants, and the cloud tenants can directly jump to use the cloud bastion machine through the cloud platform.
- the cloud platform administrator of the cloud tenant can manually synchronize the concerned cloud host resources on the management interface, and this synchronization will synchronize all relevant basic information, permission information, etc. updates to the cloud bastion host.
- the cloud tenant roles and permissions refer to the roles and permissions that the cloud tenants have already distinguished on the cloud platform, and different organizations and workspaces have different roles and permissions .
- the cloud bastion machine adopts a distributed architecture, supports cross-regional deployment of multiple computer rooms, supports horizontal expansion, and has no limit on the number of cloud host resources and concurrency.
- the present invention also provides a cloud host and bastion machine to realize cloud host authority linkage device, including:
- the open source bastion machine module which is used to deploy on the cloud computing platform through the open api interface of the open source bastion machine itself, so that the cloud bastion machine is suitable for cloud computing multi-cloud tenants and multi-cloud resource scenarios, and realizes cloud computing platform and Docking and integration of cloud bastion machines;
- the authority information management module is used to uniformly manage the access authorization relationship between the cloud computing platform and the cloud bastion machine and the access account information based on the docked cloud computing platform and the cloud bastion machine, so as to realize safe operation and maintenance. At the same time, ensure the security of the use of all cloud hosts;
- the authority information automatic synchronization response module is used to automatically synchronize and respond to the authority information in the cloud bastion machine.
- the cloud bastion machine account authority will also automatically respond and change synchronously, realizing the integration of the cloud computing platform and the cloud bastion machine. Automatic synchronization of permission information without manual intervention;
- the linkage authorization module is used to obtain the change of the operation authority and management authority of the main cloud host to which the cloud host resource belongs, uniformly manage the access authorization relationship and access account information in the bastion machine, and automatically respond to the automatic synchronization of the authority information Rules, synchronously adjust the cloud host resources corresponding to the cloud bastion machine, and automatically synchronize to the cloud bastion machine after the authorization relationship of the cloud host resources changes, so that the role and authority of the cloud tenant can be synchronized with the cloud host resources of the cloud bastion machine
- Linkage authorization strengthens the automatic synchronization capability and security compliance of cloud tenants and cloud host resources.
- the present invention also provides an electronic device, which includes a memory and a processor, and the memory stores a configuration program that can be run on the processor to implement the cloud host authority linkage device for the cloud host and the bastion host, so that When the configuration program is executed by the processor, the method for realizing permission linkage of the cloud host and the bastion host can be realized.
- the present invention also provides a computer-readable storage medium, characterized in that the computer-readable storage medium stores the configuration program for realizing the cloud host permission linkage device for the cloud host and the bastion host, and the configuration program can be Executed by one or more processors to implement the method for implementing permission linkage between cloud hosts and bastion hosts.
- the present invention has the advantages of:
- the invention realizes that under the unified management of the cloud platform, different cloud tenants can synchronize and update the authority of the cloud host in the cloud bastion machine within the scope of their current authority, and realize that after the authority of the cloud tenant is changed, the cloud tenant directly passes through the cloud platform. Log in to the cloud bastion host.
- the unified identity authentication of the cloud computing platform and the cloud bastion machine realizes the automatic synchronization of the cloud computing platform and the cloud bastion machine's cloud host resource information and permission information.
- the cloud bastion machine user permissions are linked.
- the cloud bastion machine account permissions will also be changed synchronously without manual intervention.
- the tenant roles and permissions of the cloud computing platform are jointly authorized with the cloud host assets of the cloud bastion host.
- the cloud platform tenant cloud host resources are added, deleted, or changed, the corresponding cloud host host resources of the cloud bastion host will also be synchronized. Make corresponding adjustments and carry out linkage authorization according to the permissions of the cloud computing platform tenants.
- the same set of identity authentication system is adopted to realize the linkage authorization of the cloud computing platform and the cloud bastion machine, which not only reduces the operation and maintenance cost of personnel maintaining the two systems, but also solves the possibility of manual maintenance by personnel There are problems of human error and poor timeliness.
- Fig. 1 The steps of a method for realizing cloud host authority linkage for cloud hosts and bastion hosts provided by the present invention.
- FIG. 2 A block diagram of a configuration program for cloud hosts and bastion hosts to realize the linkage of cloud host permissions provided by the present invention.
- Fig. 3 is an implementation flowchart of a method for realizing cloud host authority linkage for cloud hosts and bastion hosts provided by the present invention.
- the present invention adopts scheme:
- the cloud computing platform and the cloud bastion machine adopt a set of identity authentication system to uniformly manage the access authorization relationship and access account information, so as to realize the seamless connection between the cloud computing platform and the bastion machine, resource management and comprehensive audit management.
- Fig. 1 shows the steps of a method for realizing cloud host authority linkage for cloud hosts and bastion hosts provided by the present invention.
- the present invention provides a method for realizing cloud host authority linkage for cloud hosts and bastion hosts, wherein,
- Step S1 deploying and merging the open source bastion machine refers to deploying on the cloud computing platform through the open api interface of the open source bastion machine itself, so that the cloud bastion machine is suitable for cloud computing multi-cloud tenants and multi-cloud resource scenarios, and realizes the cloud computing platform Docking and integration with the cloud bastion machine.
- deploying and merging an open source bastion host includes using an open source bastion host combined with a cloud computing platform to build a cloud computing module suitable for cloud computing multi-cloud tenants and multi-cloud resource scenarios in the bastion host.
- the cloud bastion machine in addition to the functions that the cloud bastion machine system itself can provide, can also realize the effect of integrating the cloud platform and the bastion machine, and provide the terminal cloud tenant with the login capability of the bastion machine as one of the cloud platform services, Cloud tenants can directly jump to use the cloud bastion machine through the cloud platform.
- different cloud tenants Under the unified management of the cloud platform, different cloud tenants can synchronize and update the permissions of the cloud host in the cloud bastion machine within the scope of their current permissions. After the permission of the cloud tenant is changed, the cloud tenant can directly log in to the cloud through the cloud platform. Fortress machine.
- the cloud bastion machine adopts a distributed architecture, supports cross-regional deployment of multiple computer rooms, supports horizontal expansion, and has no limit on the number of cloud host resources and concurrency.
- the open source bastion host in the present invention includes but is not limited to: open source bastion host products in the industry, such as Jumpserver.
- the cloud platform administrator of the cloud tenant can manually synchronize the concerned cloud host resources on the management interface, and this synchronization will synchronize all relevant basic information, authority information, etc. updates to the cloud fortress machine.
- Step S2 unified management authority information refers to: based on the connected cloud computing platform and cloud bastion machine, in the cloud bastion machine, the access authorization relationship and access account information of the cloud computing platform and cloud bastion machine are managed in a unified manner to achieve safe operation. At the same time, it ensures the security of the use of all cloud hosts.
- the cloud bastion machine described here realizes safe operation and maintenance while ensuring the security of the use of all cloud hosts through: all operations of cloud host resources on the cloud platform will pass the cloud bastion machine unified identity authentication and On the basis of log records, permission control such as upload/download and copy/paste can better control the security operation and maintenance risks in scenarios such as remote office, and ensure the security of the use of all cloud hosts.
- Step S3 establishes the authority information automatic synchronization response rule: establishes the authority information automatic synchronization response rule in the cloud bastion machine, when the cloud tenant authority is adjusted, the cloud bastion machine account authority will also automatically respond and change synchronously, realizing the cloud computing platform Automatic synchronization of permission information with the cloud bastion machine without manual intervention.
- Step S4 linkage authorization refers to: by obtaining the change of the operation authority and management authority of the main cloud host to which the cloud host resource belongs, uniformly manage the access authorization relationship and access account information in the bastion machine, and automatically respond to the authority information Automatic synchronization rules, synchronously adjust the cloud host resources corresponding to the cloud bastion machine, after the cloud host resource authorization relationship changes, it will be automatically synchronized to the cloud bastion machine, so that the role and authority of the cloud tenant are the same as the cloud host of the cloud bastion machine Linked authorization of resources strengthens the automatic synchronization capability and security compliance of cloud tenants and cloud host resources.
- the security compliance for example: cloud computing resource cloud host account password length, random combination, regular update and modification, cloud tenants do not know the cloud resource super administrator password but can operate and record and leave traces, etc. Compliance and traceability requirements.
- the cloud tenant roles and permissions mentioned here refer to the roles and permissions that the cloud tenants have already distinguished on the cloud platform, and different organizations and workspaces have different roles and permissions.
- the cloud host resources corresponding to the cloud bastion machine will also be adjusted accordingly, and linkage authorization will be performed according to the permissions of the cloud computing platform tenants.
- cloud tenant A in the cloud computing platform applies for a new cloud host resource B
- the cloud computing platform will initialize a compliant If the traditional bastion machine cannot complete the identification and management (manual operation is required), if the cloud bastion D in this method is used, the new cloud resources, related basic information, and password c can be completed. Linkage synchronization; at the same time, cloud tenant A will have permissions for different cloud accounts of the cloud resource B according to its own permissions on the cloud platform. Fortress capability.
- the cloud bastion machine connected to the cloud computing platform adopts the same set of identity authentication system as the cloud computing platform. After unified management of authority information, it automatically responds to the authority synchronization rules, and automatically realizes the linkage between the cloud computing platform and the cloud bastion machine.
- Authorization requires no manual intervention in the whole process, which not only reduces the operation and maintenance cost of personnel maintaining the two systems, but also solves the problems of human errors and poor timeliness that may occur in manual maintenance.
- the method of permission communication is also implemented in the backend of the cloud platform, and no operation is required by the user.
- Cloud platform administrators can manually synchronize the cloud host assets they care about on the management interface. This synchronization will synchronize all relevant basic information, permission information and other updates to the bastion host.
- FIG. 2 is a block diagram of a configuration program for cloud hosts and bastion hosts to realize the linkage of cloud host permissions provided by the present invention. As shown in Figure 2, including:
- the open source bastion host module 101 which is used to deploy on the cloud computing platform through the open API interface of the open source bastion host, so that the cloud bastion host is suitable for cloud computing multi-cloud tenants and multi-cloud resource scenarios, and realizes the cloud computing platform Docking and integration with the cloud bastion machine.
- the deployment and integration of the open source bastion host module 101 is a functional module built in the bastion host using the open source bastion host combined with the cloud computing platform, which is suitable for cloud computing multi-cloud tenants and multi-cloud resource scenarios.
- the authority information management module 102 is used to uniformly manage the access authorization relationship and access account information between the cloud computing platform and the cloud bastion machine based on the docked cloud computing platform and the cloud bastion machine, so as to realize safe operation and maintenance While ensuring the security of the use of all cloud hosts.
- the authority information automatic synchronization response module 103 is used to automatically synchronize and respond to the authority information in the cloud bastion machine.
- the cloud bastion machine account authority will also automatically respond and change synchronously, realizing the cloud computing platform and the cloud bastion machine. Automatic synchronization of permission information without manual intervention.
- the linkage authorization module 104 is used to obtain changes in the operation authority and management authority of the main cloud host to which the cloud host resource belongs, uniformly manage the access authorization relationship and access account information in the bastion machine, and automatically respond to the authority information automatically. Synchronization rules, synchronously adjust the cloud host resources corresponding to the cloud bastion machine, and automatically synchronize to the cloud bastion machine after the authorization relationship of the cloud host resources changes, so as to realize the cloud tenant role and authority and the cloud host resources of the cloud bastion machine Linkage authorization strengthens the automatic synchronization capability and security compliance of cloud tenants and cloud host resources.
- Fig. 3 is an implementation flowchart of a method for realizing cloud host authority linkage for cloud hosts and bastion hosts provided by the present invention.
- Cloud tenants log in to the cloud platform to enter the workspace to which the cloud tenant belongs.
- the bastion host if the cloud tenant has permission, it will directly log in to the cloud host; if it does not have permission, it will return to the login interface or directly notify The cloud tenant does not have permission to log in to the cloud host.
- the bastion machine has been deployed on the cloud computing platform through the open api interface of the open source bastion machine itself, so that the cloud bastion
- the machine is suitable for cloud computing multi-cloud tenants and multi-cloud resource scenarios, realizes the docking and integration of the cloud computing platform and the cloud bastion machine, and adopts the same set of identity authentication system; make changes or replacements.
- the linkage authorization module 104 it is used to obtain the change of the operation authority and management authority of the main cloud host to which the cloud host resource belongs, uniformly manage the access authorization relationship and access account information in the bastion machine, and automatically respond to the The authority information automatic synchronization rule, synchronously adjusts the cloud host resources corresponding to the cloud bastion machine, and automatically synchronizes to the cloud bastion machine after the resource authorization relationship of the cloud host changes; in the case of normal execution, the cloud tenant role and Authorization is linked with the cloud host resources of the cloud bastion machine, and cloud group users log in to the cloud host from the bastion machine, which strengthens the automatic synchronization capability and security compliance of cloud tenants and cloud host resources.
- the linkage authorization process does not require manual operation at all, which not only reduces the operation and maintenance
- security compliance needs to be considered.
- the cloud host account password length, random combination, regular Updating and modifying, and cloud tenants do not have the password of the cloud resource super administrator, but they can operate and record it as a security guarantee.
- the anomaly analysis function or security compliance rules claimed in the present invention are not limited to the above-mentioned process, but should also include abnormal analysis of login authority in the field.
- the present invention also provides an electronic device, wherein the device includes a memory and a processor, and the memory stores a configuration program that can run the device as described in this embodiment on the processor, and the configuration program is controlled by When the processor executes, it can implement a method for implementing permission linkage between cloud hosts and bastion hosts as described in this embodiment.
- the present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a configuration program of the device described in this embodiment, and the configuration program can be executed by one or more processors , so as to implement a method for implementing permission linkage of cloud hosts for cloud hosts and bastion hosts as described in this embodiment.
Abstract
本发明涉及云计算以及信息安全技术领域，具体涉及一种面向云主机和云堡垒机实现云主机权限联动的方法及装置。本发明通过云计算服务编排技术来部署开源云堡垒机，实现云计算平台与所述云堡垒机的对接；统一管理权限信息；通过建立权限信息自动同步响应规则，实现云堡垒机账号权限自动响应并同步变更；通过获取云主机资源信息授权变化后，自动同步至所述云堡垒机，依次联动授权。本发明解决了传统云主机和云堡垒机的难以权限联动及变更的问题，实现在云平台的统一管理下，不同云租户在其当前权限范围内，对于云堡垒机中云主机的权限同步及更新，在云租户权限变更后，云租户可以直接通过云平台，登入云堡垒机。
Description
本发明涉及云计算以及信息安全技术领域，具体涉及一种面向云主机和云堡垒机实现云主机权限联动的方法。
云主机是云计算在基础设施应用上的重要组成部分，位于云计算产业链金字塔底层，产品源自云计算平台。该平台整合了互联网应用三大核心要素：计算、存储、网络，面向用户提供公用化的互联网基础设施服务。云主机是一种类似VPS主机的虚拟化技术，VPS是采用虚拟软件，VZ或VM在一台主机上虚拟出多个类似独立主机的部分，能够实现单机多用户，每个部分都可以做单独的操作系统，管理方法同主机一样。而随着云主机、云计算的发展的网络安全问题也不容忽视。
堡垒机作为云计算平台安全体系重要部件，堡垒机承担着在混合云环境下进行安全合规审计的关键作用，同时也面临许多问题：基础设施高度异构化、分布范围广；云动态资源交付和弹性伸缩情况下的云资源管理。
首先，云计算平台的建设引入了大量不同类型的IT基础设施，包括企业内部的传统物理设备、虚拟化平台、私有云，以及公有云。由于目前云平台采用多组织多租户模式，导致IT资产分布范围广，管理也相对分散，传统堡垒机要根据云计算平台架构进行资源权限划分，人工维护成本高。
其次，云计算平台与传统堡垒机相对孤立，云计算平台租户权限与堡垒机用户权限难以联动，往往需要根据云计算平台资源对应的组织租户账号权限，在堡垒机上创建用户赋予相应资源权限，要投入较高的人工成本。
此外，现有传统堡垒机与云计算平台各自采用不同的身份认证体系，当云计算平台租户权限发生变化时，无法及时与对应的堡垒机用户权限进行调整变更，需要人工进行配置调整，时效性差，云计算平台与传统堡垒机难以实现云主机资源权限联动，两套维护体系存在人为误差因素，同时也加重了人工成本。
因此，面对传统堡垒机存在的门槛高、时效性低的问题，如何解决云计算平台的基础设施高度异构化、分布散乱、云计算平台与传统堡垒机相对孤立性，带来的难以实现权限联动或难以变更权限联动的问题，云租户在云平台上，根据其自身的组织和工作空间，有不同的权限，同时这些权限与他所管理的云主机也有着不同的权限差异，传统堡垒机不能实现与云平台的权限关联，是目前亟待解决的技术问题。
发明内容
面对传统堡垒机存在的门槛高、时效性低的问题，如何解决云计算平台的基础设施高度异构化、分布散乱、云计算平台与传统堡垒机相对孤立性，带来的难以实现权限联动或难以 变更权限联动的问题，云租户在云平台上，根据其自身的组织和工作空间，有不同的权限，同时这些权限与他所管理的云主机也有着不同的权限差异，传统堡垒机不能实现与云平台的权限关联，本发明提供了一种面向云主机和堡垒机实现云主机权限联动的方法。
本发明请求保护以下技术方案：
本发明提供一种面向云主机和堡垒机实现云主机权限联动的方法，包括如下过程：
S1部署并融合开源堡垒机：通过开源堡垒机自身的开放的api接口在云计算平台上对所述堡垒机进行部署，使得所述云堡垒机适用于云计算多云租户和多云资源场景，实现云计算平台与云堡垒机的对接与融合；
S2统一管理权限信息：基于对接后的云计算平台与云堡垒机，在所述云堡垒机中，统一管理云计算平台与云堡垒机的访问授权关系以及访问账号信息，实现安全运维的同时保证所有云主机的使用的安全性；
S3建立权限信息自动同步响应规则：在云堡垒机中建立权限信息自动同步响应规则，当云租户权限发生调整时，云堡垒机账号权限也将自动响应并同步变更，实现云计算平台和云堡垒机的权限信息的自动同步，无需人工干预；
S4联动授权：通过获取云主机资源所属的主要的云主机的操作权限和管理权限的变化，在所述堡垒机中统一管理访问授权关系以及访问账号信息，并自动响应所述权限信息自动同步规则，同步调整所述云堡垒机对应的云主机资源，所述云主机资源授权关系变化后，会自动同步至所述云堡垒机，实现云租户角色和权限与云堡垒机的云主机资源进行联动授权，加强了云租户与云主机资源的自动化同步能力和安全合规性。
进一步的，在所述步骤S2中，所述云堡垒机实现安全运维的同时保证所有云主机的使用的安全性是通过：云主机资源在云平台上的所有操作将通过云堡垒机统一身份认证和日志记录的基础上进行，上传/下载和复制/粘贴等权限控制能够更好地管控远程办公等场景下的安全运维风险，保证所有云主机的使用的安全性。
进一步的，在所述步骤S1中，还包括：所述云堡垒机，除云堡垒机系统本身可以提供的功能外，还可以实现云平台与堡垒机一体化的效果，将堡垒机登录能力作为云平台服务之一提供给终端云租户，云租户通过云平台可直接跳转使用云堡垒机。
进一步的，所述云租户的云平台管理员可以在管理界面对所关心的云主机资源进行手动同步，此同步会将所有的相关基础信息、权限信息等更新同步至所述云堡垒机。
进一步的，在所述步骤S4中，所述云租户角色和权限是指，云租户在云平台上本身就已经区分的角色和权限，且不同的组织和工作空间内，具有不同的角色和权限。
优选的，所述云堡垒机采用分布式架构，支持多机房跨区域部署，支持横向扩展，无云主机资源数量及并发限制。
本发明还提供一种面向云主机和堡垒机实现云主机权限联动装置，包括：
部署并融合开源堡垒机模块，用于通过开源堡垒机自身的开放的api接口在云计算平台上进行部署，使得所述云堡垒机适用于云计算多云租户和多云资源场景，实现云计算平台与云堡垒机的对接与融合；
权限信息管理模块，用于基于对接后的云计算平台与云堡垒机，在所述云堡垒机中，统一管理云计算平台与云堡垒机的访问授权关系以及访问账号信息，实现安全运维的同时保证所有云主机的使用的安全性；
权限信息自动同步响应模块，用于在云堡垒机中自动同步响应权限信息，当云租户权限发生调整时，云堡垒机账号权限也将自动响应并同步变更，实现云计算平台和云堡垒机的权限信息的自动同步，无需人工干预；
联动授权模块，用于获取云主机资源所属的主要的云主机的操作权限和管理权限的变化，在所述堡垒机中统一管理访问授权关系以及访问账号信息，并自动响应所述权限信息自动同步规则，同步调整所述云堡垒机对应的云主机资源，在所述云主机资源授权关系变化后，自动同步至所述云堡垒机，实现云租户角色和权限与云堡垒机的云主机资源进行联动授权，加强了云租户与云主机资源的自动化同步能力和安全合规性。
本发明还提供一种电子装置，该装置包括存储器、处理器，所述存储器上存储有可在所述处理器上运行所述面向云主机和堡垒机实现云主机权限联动装置的配置程序，所述配置程序被所述处理器执行时可以实现所述的面向云主机和堡垒机实现云主机权限联动的方法。
本发明还提供一种计算机可读存储介质，其特征在于，所述计算机可读的存储介质上存储有所述面向云主机和堡垒机实现云主机权限联动装置的配置程序，所述配置程序可以被一个或多个处理器执行，以实现所述的面向云主机和堡垒机实现云主机权限联动的方法。
与现有技术相比，本发明的优点在于：
本发明实现了在云平台的统一管理下，不同云租户在其当前权限范围内，对于云堡垒机中云主机的权限同步及更新，实现在云租户权限变更后，云租户直接通过云平台，登入云堡垒机。
通过云计算平台整与云堡垒无缝的对接，云计算平台与云堡垒机统一身份认证，实现云计算平台与云堡垒机的云主机资源信息和权限信息的自动同步，云计算平台用户权限与云堡垒机用户权限联动，当云平台租户权限发生调整，云堡垒机账号权限也将同步变更，无需人工干预。
云计算平台的租户角色和权限与云堡垒机的云主机资产进行联动授权，当云平台租户云主机资源发生新增，删除，所属变化等行为时，对应云堡垒机的云主机资源也将同步进行相应调整，并根据云计算平台租户权限进行联动授权。
通过云计算平台与云堡垒机的对接，采用同一套身份认证体系，实现云计算平台与云堡垒机联动授权，既减少了人员维护两套体系系统的运维成本，还解决了人员手工维护可能发生人为误差及时效性差的问题。
图1.本发明提供的一种面向云主机和堡垒机实现云主机权限联动的方法步骤。
图2.本发明提供的一种面向云主机和堡垒机实现云主机权限联动的配置程序模块图。
图3.本发明提供的一种面向云主机和堡垒机实现云主机权限联动的方法的实现流程图。
为了使本技术领域的人员更好地理解本发明方案，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚完整地描述，显然，所描述的实施例仅仅是本发明一部分的实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本发明保护的范围。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本发明的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆益不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统，产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
本发明采用方案：
云计算平台通过与开源堡垒机的对接和功能开发，完成了云计算平台和云堡垒机的关于云主机资源信息和权限信息的自动同步；同时，通过统一的身份证和权限管理，实现云计算平台租户、云堡垒机用户的账户权限联动。
通过云计算平台的租户角色和权限与云堡垒机的云主机资源进行联动授权，加强了云租户与云资产的自动化同步能力和安全合规性。
云计算平台与云堡垒机采用一套身份认证体系，统一管理访问授权关系以及访问账号信息，实现云计算平台与堡垒机的无缝衔接、资源纳管以及审计全方位管理。
为使本发明技术方案的优点更加清楚，下面结合附图和实施例对本发明做详细说明。
图1是本发明提供的一种面向云主机和堡垒机实现云主机权限联动的方法步骤。
如图1所示，本发明提供了一种面向云主机和堡垒机实现云主机权限联动的方法，其中，
步骤S1部署并融合开源堡垒机是指：通过开源堡垒机自身的开放的api接口在云计算平台上进行部署，使得所述云堡垒机适用于云计算多云租户和多云资源场景，实现云计算平台与云堡垒机的对接与融合。在本实施例中，部署并融合开源堡垒机包括，利用开源堡垒机结 合云计算平台，在堡垒机中云构建一个适用于云计算多云租户和多云资源场景下的模块。
其中，所述云堡垒机，除云堡垒机系统本身可以提供的功能外，还可以实现云平台与堡垒机一体化的效果，将堡垒机登录能力作为云平台服务之一提供给终端云租户，云租户通过云平台可直接跳转使用云堡垒机。实现了在云平台的统一管理下，不同云租户在其当前权限范围内，对于云堡垒机中云主机的权限同步及更新，实现在云租户权限变更后，云租户直接通过云平台，登入云堡垒机。
所述云堡垒机采用分布式架构，支持多机房跨区域部署，支持横向扩展，无云主机资源数量及并发限制。这里需要注意的是本发明所述的开源堡垒机包括不限于：业界开源的堡垒机产品，如Jumpserver等。
在本实施例中，所述云租户的云平台管理员可以在管理界面对所关心的云主机资源进行手动同步，此同步会将所有的相关基础信息、权限信息等更新同步至所述云堡垒机。
步骤S2统一管理权限信息是指：基于对接后的云计算平台与云堡垒机，在所述云堡垒机中，统一管理云计算平台与云堡垒机的访问授权关系以及访问账号信息，实现安全运维的同时保证所有云主机的使用的安全性。
在本实施例中，这里所述的云堡垒机实现安全运维的同时保证所有云主机的使用的安全性是通过：云主机资源在云平台上的所有操作将通过云堡垒机统一身份认证和日志记录的基础上进行，上传/下载和复制/粘贴等权限控制能够更好地管控远程办公等场景下的安全运维风险，保证所有云主机的使用的安全性。
步骤S3建立权限信息自动同步响应规则是指：在云堡垒机中建立权限信息自动同步响应规则，当云租户权限发生调整时，云堡垒机账号权限也将自动响应并同步变更，实现云计算平台和云堡垒机的权限信息的自动同步，无需人工干预。
步骤S4联动授权是指：通过获取云主机资源所属的主要的云主机的操作权限和管理权限的变化，在所述堡垒机中统一管理访问授权关系以及访问账号信息，并自动响应所述权限信息自动同步规则，同步调整所述云堡垒机对应的云主机资源，所述云主机资源授权关系变化后，会自动同步至所述云堡垒机，实现云租户角色和权限与云堡垒机的云主机资源进行联动授权，加强了云租户与云主机资源的自动化同步能力和安全合规性。
本实施例中，所述安全合规，例如：云计算资源的云主机账号密码长度、随机性组合、定期更新修改、云租户不掌握云资源超级管理员密码但可以操作并记录留痕等安全合规及可回溯需求。
在本实施例中，这里所述的云租户角色和权限是指，云租户在云平台上本身就已经区分的角色和权限，且不同的组织和工作空间内，具有不同的角色和权限。
当云平台租户云主机资源发生新增，删除，所属变化等行为时，对应云堡垒机的云主机资源也将同步进行相应调整，并根据云计算平台租户权限进行联动授权。
在实际应用中，当一个云主机资源发生新增，例如：在云计算平台中的云租户A申请了一台新的云主机资源B，此时云计算平台会根据自身的算法初始化一个符合合规性要求的密码c，此时若是传统的堡垒机无法完成识别和管理(需要人工手动操作)，如果采用本方法中的云堡垒D，就可以完成新增云资源以及相关基础信息、密码c的联动同步；同时云租户A根据自身在云平台上的权限会有针对该云资源B不同云账户的权限，此时，云堡垒D亦可完成相应的联动同步，确保在云租户权限范围内的堡垒机能力。
本实施例中，与云计算平台对接后的云堡垒机，与云计算平台采用同一套身份认证体系，通过统一管理权限信息后，自动响应权限同步规则，自动实现云计算平台与云堡垒机联动授权，全程无需人工干预，既减少了人员维护两套体系系统的运维成本，还解决了人员手工维护可能发生人为误差及时效性差的问题。
在本实施例中，权限联通的方法还在于，是在云平台后端实现的，无需用户进行操作。云平台管理员可以在管理界面对所关心的云主机资产进行手动同步。此同步会将所有的相关基础信息、权限信息等更新同步至堡垒机。
图2是本发明提供的一种面向云主机和堡垒机实现云主机权限联动的配置程序模块图。如图2所示，包括：
部署并融合开源堡垒机模块101，用于通过开源堡垒机自身的开放的api接口在云计算平台上进行部署，使得所述云堡垒机适用于云计算多云租户和多云资源场景，实现云计算平台与云堡垒机的对接与融合。在本实施例中，所述部署并融合开源堡垒机模块101，是利用开源堡垒机结合云计算平台，在堡垒机中云构建的一个适用于云计算多云租户和多云资源场景下的功能模块。
权限信息管理模块102，用于基于对接后的云计算平台与云堡垒机，在所述云堡垒机中，统一管理云计算平台与云堡垒机的访问授权关系以及访问账号信息，实现安全运维的同时保证所有云主机的使用的安全性。
权限信息自动同步响应模块103，用于在云堡垒机中自动同步响应权限信息，当云租户权限发生调整时，云堡垒机账号权限也将自动响应并同步变更，实现云计算平台和云堡垒机的权限信息的自动同步，无需人工干预。
联动授权模块104，用于获取云主机资源所属的主要的云主机的操作权限和管理权限的变化，在所述堡垒机中统一管理访问授权关系以及访问账号信息，并自动响应所述权限信息自动同步规则，同步调整所述云堡垒机对应的云主机资源，在所述云主机资源授权关系变化后，自动同步至所述云堡垒机，实现云租户角色和权限与云堡垒机的云主机资源进行联动授权，加强了云租户与云主机资源的自动化同步能力和安全合规性。
图3.本发明提供的一种面向云主机和堡垒机实现云主机权限联动的方法的实现流程图。云租户通过登录云平台进入云租户所属的工作空间，在通过堡垒机跳转到相应的云主机时， 若云租户有权限则直接登入云主机；如无权限则会返回至登录界面或直接告知该云租户无权限登入该云主机。
在上述通过堡垒机跳转到相应的云主机过程中，在云计算平台中，已经通过开源堡垒机自身的开放的api接口在云计算平台上对所述堡垒机进行部署，使得所述云堡垒机适用于云计算多云租户和多云资源场景，实现云计算平台与云堡垒机的对接与融合，采用同一套身份认证体系；因此，云组户权限已经(已授予云平台)可以通过云计算平台进行变更或更替。
当云平台租户云主机资源发生新增，删除，所属变化等行为时，发生变更的云资产、云租户权限、云主机权限会同步至对应的云资产信息、云组户权限以及云主机权限信息。通过开发的联动授权模块104，用于获取云主机资源所属的主要的云主机的操作权限和管理权限的变化，在所述堡垒机中统一管理访问授权关系以及访问账号信息，并自动响应所述权限信息自动同步规则，同步调整所述云堡垒机对应的云主机资源，在所述云主机资源授权关系变化后，自动同步至所述云堡垒机；正常执行的情况下，实现云租户角色和权限与云堡垒机的云主机资源进行联动授权，云组户由堡垒机登入云主机，加强了云租户与云主机资源的自动化同步能力和安全合规性。联动授权过程完全不需要手动操作，既减少了人员维护两套体系系统的运维成本，还解决了人员手工维护可能发生人为误差及时效性差的问题。
还需要注意的是，登入异常或失败的情况下，就需要考了是否安全合规，例如，为了满足安全合规及可回溯需求，云计算资源的云主机账号密码长度、随机性组合、定期更新修改、云租户不掌握云资源超级管理员密码，但可以操作并记录留痕等来作为安全保障。本发明所要求保护的异常分析功能或安全合规规则不仅局限于上述过程，应当还包含本领域常规的登录权限的异常分析等情形。
本发明还提供一种电子装置，其中，该装置包括存储器、处理器，所述存储器上存储有可在所述处理器上运行如本实施例所述的装置的配置程序，所述配置程序被所述处理器执行时可以实现如本实施例所述的一种面向云主机和堡垒机实现云主机权限联动的方法。
本发明还提供一种计算机可读存储介质，其特征在于，所述计算机可读的存储介质上存储有如本实施例所述装置的配置程序，所述配置程序可以被一个或多个处理器执行，以实现如本实施例所述的一种面向云主机和堡垒机实现云主机权限联动的方法。
以上所述仅是本发明的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。
Claims (9)
- 一种面向云主机和堡垒机实现云主机权限联动的方法，其特征在于，包括如下过程：S1部署并融合开源堡垒机：通过开源堡垒机自身的开放的api接口在云计算平台上对所述堡垒机进行部署，使得所述云堡垒机适用于云计算多云租户和多云资源场景，实现云计算平台与云堡垒机的对接与融合；S2统一管理权限信息：基于对接后的云计算平台与云堡垒机，在所述云堡垒机中，统一管理云计算平台与云堡垒机的访问授权关系以及访问账号信息，实现安全运维的同时保证所有云主机的使用的安全性；S3建立权限信息自动同步响应规则：在云堡垒机中建立权限信息自动同步响应规则，当云租户权限发生调整时，云堡垒机账号权限也将自动响应并同步变更，实现云计算平台和云堡垒机的权限信息的自动同步，无需人工干预；S4联动授权：通过获取云主机资源所属的主要的云主机的操作权限和管理权限的变化，在所述堡垒机中统一管理访问授权关系以及访问账号信息，并自动响应所述权限信息自动同步规则，同步调整所述云堡垒机对应的云主机资源，所述云主机资源授权关系变化后，会自动同步至所述云堡垒机，实现云租户角色和权限与云堡垒机的云主机资源进行联动授权，加强了云租户与云主机资源的自动化同步能力和安全合规性。
- 根据权利要求1所述的云主机权限联动的方法，其特征还在于，在所述步骤S2中，所述云堡垒机实现安全运维的同时保证所有云主机的使用的安全性是通过：云主机资源在云平台上的所有操作将通过云堡垒机统一身份认证和日志记录的基础上进行，上传/下载和复制/粘贴等权限控制能够更好地管控远程办公等场景下的安全运维风险，保证所有云主机的使用的安全性。
- 根据权利要求1所述的云主机权限联动的方法，其特征还在于，在所述步骤S1中，还包括：所述云堡垒机，除云堡垒机系统本身可以提供的功能外，还可以实现云平台与堡垒机一体化的效果，将堡垒机登录能力作为云平台服务之一提供给终端云租户，云租户通过云平台可直接跳转使用云堡垒机。
- 根据权利要求1所述的云主机权限联动的方法，其特征还在于，所述云租户的云平台管理员可以在管理界面对所关心的云主机资源进行手动同步，此同步会将所有的相关基础信息、权限信息等更新同步至所述云堡垒机。
- 根据权利要求1所述的云主机权限联动的方法，其特征还在于，在所述步骤S4中，所述云租户角色和权限是指，云租户在云平台上本身就已经区分的角色和权限，且不同的组织和工作空间内，具有不同的角色和权限。
- 根据权利要求1所述的云主机权限联动的方法，其特征还在于，所述云堡垒机采用分布式架构，支持多机房跨区域部署，支持横向扩展，无云主机资源 数量及并发限制。
- 一种面向云主机和堡垒机实现云主机权限联动装置，其特征在于，包括：部署并融合开源堡垒机模块，用于利用开源堡垒机自身的开放的api接口在云计算平台上进行部署，使得所述云堡垒机适用于云计算多云租户和多云资源场景，实现云计算平台与云堡垒机的对接与融合；权限信息管理模块，用于基于对接后的云计算平台与云堡垒机，在所述云堡垒机中，统一管理云计算平台与云堡垒机的访问授权关系以及访问账号信息，实现安全运维的同时保证所有云主机的使用的安全性；权限信息自动同步响应模块，用于在云堡垒机中自动同步响应权限信息，当云租户权限发生调整时，云堡垒机账号权限也将自动响应并同步变更，实现云计算平台和云堡垒机的权限信息的自动同步，无需人工干预；联动授权模块，用于获取云主机资源所属的主要的云主机的操作权限和管理权限的变化，在所述堡垒机中统一管理访问授权关系以及访问账号信息，并自动响应所述权限信息自动同步规则，同步调整所述云堡垒机对应的云主机资源，在所述云主机资源授权关系变化后，自动同步至所述云堡垒机，实现云租户角色和权限与云堡垒机的云主机资源进行联动授权，加强了云租户与云主机资源的自动化同步能力和安全合规性。
- 一种电子装置，其特征在于，该装置包括存储器、处理器，所述存储器上存储有可在所述处理器上运行如权利要求7所述装置的配置程序，所述配置程序被所述处理器执行时可以实现如权利要求1-6所述的一种面向云主机和堡垒机实现云主机权限联动的方法。
- 一种计算机可读存储介质，其特征在于，所述计算机可读的存储介质上存储有如权利要求7所述装置的配置程序，所述配置程序可以被一个或多个处理器执行，以实现如权利要求1-6所述的一种面向云主机和堡垒机实现云主机权限联动的方法。
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| PCT/CN2022/075076 WO2023142070A1 (zh) | 2022-01-29 | 2022-01-29 | 面向云主机和云堡垒机实现云主机权限联动的方法 |
| CN202280000639.2A CN114747180A (zh) | 2022-01-29 | 2022-01-29 | 面向云主机和云堡垒机实现云主机权限联动的方法 |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| PCT/CN2022/075076 WO2023142070A1 (zh) | 2022-01-29 | 2022-01-29 | 面向云主机和云堡垒机实现云主机权限联动的方法 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2023142070A1 true WO2023142070A1 (zh) | 2023-08-03 |
Family
ID=82287309
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2022/075076 WO2023142070A1 (zh) | 2022-01-29 | 2022-01-29 | 面向云主机和云堡垒机实现云主机权限联动的方法 |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN114747180A (zh) |
| WO (1) | WO2023142070A1 (zh) |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110730153A (zh) * | 2018-07-16 | 2020-01-24 | 阿里巴巴集团控股有限公司 | 云设备的账号配置方法、装置和系统、数据处理方法 |
| CN111756765A (zh) * | 2020-06-30 | 2020-10-09 | 无锡启创梦网络科技有限公司 | 一种基于SaaS平台的系统安全架构 |
| US20210377252A1 (en) * | 2020-06-01 | 2021-12-02 | Citrix Systems, Inc. | Application integration using multiple user identities |
| CN113810415A (zh) * | 2021-09-17 | 2021-12-17 | 成都高新愿景数字科技有限公司 | 一种通过堡垒机免托管主机账户运维的方法 |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US11223613B2 (en) * | 2014-05-02 | 2022-01-11 | Cloudblue Llc | Methods and systems for roles and membership management in a multi-tenant cloud environment |
| US11223615B2 (en) * | 2019-05-09 | 2022-01-11 | Sap Se | Provisioning initial keystore for multi-tenant, microservice architecture-based integration service in a cloud computing environment setup |
| CN110324338B (zh) * | 2019-06-28 | 2023-07-18 | 深圳前海微众银行股份有限公司 | 数据交互方法、装置、堡垒机与计算机可读存储介质 |
| CN110913024B (zh) * | 2019-12-30 | 2022-02-01 | 中国联合网络通信集团有限公司 | 云平台信息同步方法、系统、控制设备及存储介质 |
| CN113992494B (zh) * | 2021-12-23 | 2022-03-11 | 武汉迈异信息科技有限公司 | 一种云平台创建堡垒机并自动纳管云主机的方法 |
-
2022
- 2022-01-29 WO PCT/CN2022/075076 patent/WO2023142070A1/zh unknown
- 2022-01-29 CN CN202280000639.2A patent/CN114747180A/zh active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110730153A (zh) * | 2018-07-16 | 2020-01-24 | 阿里巴巴集团控股有限公司 | 云设备的账号配置方法、装置和系统、数据处理方法 |
| US20210377252A1 (en) * | 2020-06-01 | 2021-12-02 | Citrix Systems, Inc. | Application integration using multiple user identities |
| CN111756765A (zh) * | 2020-06-30 | 2020-10-09 | 无锡启创梦网络科技有限公司 | 一种基于SaaS平台的系统安全架构 |
| CN113810415A (zh) * | 2021-09-17 | 2021-12-17 | 成都高新愿景数字科技有限公司 | 一种通过堡垒机免托管主机账户运维的方法 |
Non-Patent Citations (1)
| Title |
|---|
| XIANG, YUANJIN: "A Solution for Government Affair Cloud Security", CYBERSECURITY & INFORMATIZATION, no. 04, 30 April 2020 (2020-04-30), pages 126 - 130, XP009548333, ISSN: 2096-2215 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114747180A (zh) | 2022-07-12 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102947797B (zh) | 使用横向扩展目录特征的在线服务访问控制 | |
| US10079837B2 (en) | Distributed topology enabler for identity manager | |
| WO2018095416A1 (zh) | 信息处理方法、装置及系统 | |
| US8606897B2 (en) | Systems and methods for exporting usage history data as input to a management platform of a target cloud-based network | |
| CN106411857B (zh) | 一种基于虚拟隔离机制的私有云gis服务访问控制方法 | |
| CN107357660A (zh) | 一种虚拟资源的分配方法及装置 | |
| CN107332899A (zh) | 一种虚拟化云计算桌面 | |
| US11740936B2 (en) | Method and system for managing cloud resources | |
| CN103685441B (zh) | 一种基于龙芯终端的远程桌面控制系统 | |
| CN110048855A (zh) | 国密算法的引入方法及调用方法、及装置、设备、Fabric平台 | |
| CN109284170A (zh) | 一种局域网内usb共享系统及共享方法 | |
| US11063982B2 (en) | Object scope definition for enterprise security management tool | |
| CN112256439B (zh) | 一种基于云计算资源池的服务目录动态更新系统及方法 | |
| CN111901154B (zh) | 基于nfv的安全架构系统和安全部署及安全威胁处理方法 | |
| Andreetto et al. | Merging OpenStack-based private clouds: the case of CloudVeneto. it | |
| CN114650170B (zh) | 跨集群资源管理方法、装置、设备和存储介质 | |
| CN112702348A (zh) | 一种系统权限管理方法及装置 | |
| CN104363306A (zh) | 一种企业私有云管理控制方法 | |
| CN113190609B (zh) | 数据仓库管理方法及系统、装置、存储介质、电子设备 | |
| CN112286985B (zh) | 一种基于云计算的临床研究统计分析系统 | |
| WO2023142087A1 (zh) | 面向云主机和云堡垒机实现云资源多账户权限管控的方法 | |
| WO2023050110A1 (zh) | 面向云主机和云堡垒机实现含容错机制的自动改密的方法 | |
| WO2023142070A1 (zh) | 面向云主机和云堡垒机实现云主机权限联动的方法 | |
| CN116319341A (zh) | 一种云化共享工控网络安全靶场系统 | |
| US9405923B2 (en) | Establishing isolation between content hosting services executing on common support server |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 22922900 Country of ref document: EP Kind code of ref document: A1 |