CN101980481B - Method for realizing session replication and tracking during security terminal emulation protocol monitoring - Google Patents

Abstract

A method for realizing session replication and tracking during security terminal emulation protocol monitoring, the implementation steps are: (1) the monitoring system performs secondary login or proxy to the SSH protocol, the client initiates a request for opening session replication to the monitoring system, and the monitoring system and Establish a new independent virtual session between the clients; (2) The monitoring system initiates a session replication request to the server at the same time, and also establishes a new independent virtual session between the server and the monitoring system; (3) The monitoring system connects both ends All virtual sessions are mapped one by one; (4) draw a virtual memory screen in memory, and capture the operation of each session in this screen, achieving the purpose of tracking each session individually. Through the technical means of the present invention, on the premise of satisfying the monitoring of the security terminal emulation protocol, it also realizes session duplication and tracking during the monitoring of the security terminal emulation protocol, and the operation is simple and easy.

Description

A method for implementing session duplication and tracking during security terminal emulation protocol monitoring

technical field

The invention belongs to the technical field of security terminal emulation protocol monitoring, and in particular relates to a method for realizing session duplication and tracking during security terminal emulation protocol monitoring.

Background technique

The terminal emulation protocol is a common protocol used to maintain UNIX or LINUX servers. There are two popular protocols based on TCP/IP network terminal emulation in the early days, TELNET and RLOGIN, but because they use plain text during network transmission, this A great security risk has been generated, and those with malicious intentions can easily monitor and intercept user names, passwords, and even operations in the bypass. Therefore, these two protocols are gradually replaced by the secure terminal emulation protocol (hereinafter referred to as the SSH protocol) with more secure transmission and more powerful functions. The SSH protocol not only makes network data transmission more secure by using SSL asymmetric encryption, but also provides the function of opening multiple virtual sessions on the same TCP connection through the virtual channel method, that is, SSH session replication, Greatly facilitate the server maintenance personnel. It is precisely because of the security of the SSH protocol that it is impossible to obtain valid data from it through the commonly used bypass method of grabbing data packets. Therefore, if you need to monitor SSH-based remote access operations, you must monitor the SSH protocol on the monitoring system. Perform secondary login or proxy, otherwise, the operation of the maintenance personnel cannot be restored from the encrypted data. The so-called secondary login means that the operator first logs in to the monitoring system through the SSH protocol. The monitoring system provides a friendly menu interface for the authorized operator, and the operator can select the server he needs to log in in the menu to log in directly. The so-called proxy means that the operator designates the monitoring system as the proxy server of the SSH protocol, and all SSH protocol access uses the monitoring system as the proxy to access the target server. To sum up, according to the principle of secondary login or proxy, it can be known that the SSH protocol connection initiated by the operator is terminated on the monitoring system, and all connections to the target server for maintenance are initiated by the monitoring system. In this way, the monitoring system For the client, it is a server, and for the server, it is a client. In this way, the operation behavior can be reversed very conveniently. This can satisfy the monitoring of the SSH protocol, but in this case, the SSH protocol connection of the client is established with the monitoring system, and the SSH protocol connection of the server is also established with the monitoring system, so the forwarding of the session replication function , and tracking the entire process of each session becomes very difficult.

Contents of the invention

The invention mainly solves the technical problems existing in the prior art, and provides a method for realizing session duplication and tracking during security terminal emulation protocol monitoring.

The above-mentioned technical problems of the present invention are mainly solved by the following technical solutions: a method for realizing session duplication and tracking during monitoring of a security terminal emulation protocol, the implementation steps of which are as follows: (1) the monitoring system performs secondary login or proxy to the SSH protocol , the client initiates a request to the monitoring system to enable session replication, and requests an identifier, and the monitoring system responds to the session replication request. After the negotiation is completed, a new independent virtual session is established between the monitoring system and the client; (2) the monitoring system simultaneously Initiate a session replication request to the server, and the server responds to the session replication request and requests an identifier. After the negotiation is completed, a new independent virtual session is also established between the server and the monitoring system; The incoming session data finds the corresponding server-oriented session channel and sends the data to the server through this session channel. The data is sent to the client, and all the virtual sessions at both ends are mapped one by one; (4) draw the virtual memory screen in the memory, and capture the operation of each session in this screen, so as to track each session individually the goal of.

As preferably, in the step (3), the monitoring system establishes a linked list to the mapping of the virtual session, and respectively establishes a hash table indexed by the client session and a hash table indexed by the server session on this linked list, when receiving When the client session data is received, it is retrieved in the hash table indexed by the client session, and when the server-side session data is received, it is retrieved in the hash table indexed by the server-side session.

As preferably, in the described step (4), the monitoring system maintains a session node for each session, and the virtual memory screen is as a member of the session node, whenever session data is received, the session node is found and the screen is drawn, and the screen is intercepted at the same time corresponding operation.

The present invention overcomes the defect that the forwarding of the session replication function and the whole process tracking of each session cannot be realized in the existing security terminal emulation protocol technology, and satisfies the premise of monitoring the security terminal emulation protocol through the technical means of the present invention It also implements session duplication and tracking when monitoring the security terminal emulation protocol, and the operation is simple and easy.

Detailed ways

The technical solutions of the present invention will be further specifically described below through examples.

Embodiment: the method for realizing session duplication and tracking when a kind of security terminal emulation protocol monitoring of the present invention, its realization step is: (1) monitoring system carries out secondary login or agent to SSH agreement, and client initiates the request of opening session duplication to monitoring system , and request an identifier, the monitoring system responds to the session replication request, and after the negotiation is completed, a new independent virtual session is established between the monitoring system and the client; (2) The monitoring system simultaneously initiates a session replication request to the server, and the server responds Respond to the session copy request and request an identifier, and after the negotiation is completed, a new independent virtual session is also established between the server and the monitoring system; (3) The monitoring system finds out the corresponding server-oriented session according to the session data sent by the client channel and send data to the server through this session channel, and at the same time, the monitoring system finds out the corresponding client-oriented session channel based on the session data sent by the server and sends the data to the client through this session channel, and all virtual Sessions are mapped one by one; (4) Draw a virtual memory screen in memory, and capture the operation of each session in this screen, achieving the purpose of tracking each session individually.

In the process of secondary login and proxy for the SSH protocol, since the operation of the entire connection process needs to be monitored, the data decrypted during the protocol transmission process is transmitted in NVT mode. The so-called NVT refers to the network virtual terminal, which not only contains the user's operation data, but also contains a lot of format information, so it is not enough to only record the data packet, and it is necessary to de-analyze the data packet. Due to the uncertainty of the operation, the operation cannot be correctly parsed only by filtering the format data. The present invention adopts the method of drawing a virtual memory screen in the memory to obtain the input operation, which is equivalent to simulating a screen in the memory that is the same as the operation terminal actually seen by the user, and intercepting the operation performed by the user in this screen , thus satisfying the correctness and timeliness of operation restoration. Since the user can perform relatively independent operations in each copied session, it is necessary to establish an independent virtual memory screen when tracking each session, and intercept the operations of each session independently in each screen, This achieves the purpose of tracking each session individually.

In order to improve the transmission efficiency, in step (3), the monitoring system sets up a linked list to the mapping of the virtual session, and respectively establishes a hash table indexed by the client session and a hash table indexed by the server session on this linked list. The client session data is retrieved in the hash table indexed by the client session, and retrieved in the hash table indexed by the server session when receiving the server session data; in step (4), the monitoring system is used for each session A session node is maintained, and the virtual memory screen is a member of the session node. Whenever session data is received, the session node is found and the screen is drawn, and corresponding operations are intercepted.

Finally, it should be pointed out that the above embodiments are only representative examples of the present invention. Apparently, the technical solutions of the present invention are not limited to the above-mentioned embodiments, and many variations are possible. All deformations that can be directly derived or associated by those skilled in the art from the content disclosed in the present invention should be considered as the protection scope of the present invention.

Claims (3)

1. A method for realizing session duplication and tracking when a security terminal emulates SSH protocol monitoring is characterized in that the implementation steps of the method are: (1) the monitoring system performs secondary login or proxy to the SSH protocol, and the client initiates opening to the monitoring system Session replication request, and request an identification, the monitoring system responds to the session replication request, after the negotiation is completed, a new independent virtual session is established between the monitoring system and the client; (2) The monitoring system initiates a session replication request to the server at the same time , the server responds to the session replication request and requests an identifier. After the negotiation is completed, a new independent virtual session is established between the server and the monitoring system; (3) the monitoring system finds out the corresponding session data according to the session data sent by the client. The server-side session channel is used to send data to the server through this session channel. At the same time, the monitoring system finds out the corresponding client-side session channel based on the session data sent by the server side and sends the data to the client through this session channel. All the virtual sessions on the terminal are mapped one by one; (4) draw the virtual memory screen in the memory, and intercept the operation of each session in this screen, so as to achieve the purpose of tracking each session individually. 2. The method for realizing session duplication and tracking when a kind of security terminal emulation SSH protocol monitoring according to claim 1 is characterized in that in said step (3), the monitoring system is set up as a linked list to the mapping of the virtual session, and in this A hash table indexed by the client session and a hash table indexed by the server session are respectively established on the linked list. When the client session data is received, it is retrieved in the hash table indexed by the client session. Session data is retrieved in the hash table indexed by the server-side session. 3. the method for realizing session replication and tracking when a kind of security terminal emulation SSH protocol monitoring according to claim 1 is characterized in that in the step (4), the monitoring system all maintains a session node for each session, and the virtual memory screen As a member of the session node, whenever session data is received, the session node is found and the screen is drawn, and corresponding operations are intercepted at the same time.