A security verification method for cloud desktop system

Abstract

The present invention relates to a security verification method for a cloud desktop system, comprising: logging into a first operating system on a terminal after a first authentication; accessing a cloud desktop server using a cloud desktop system client after a second authentication in the first operating system; and logging into a second operating system after a third authentication. The cloud desktop system security verification method of the present application enables users to log into the cloud desktop system through a triple verification method when they need to use the cloud desktop system, greatly increasing the security of the cloud desktop system.

Description

Technical Field

[0001] The present invention relates to the field of computer network technology, and in particular to a security verification method for a cloud desktop system. Background Art

[0002] With years of technological development, cloud desktop systems have become relatively mature. Traditional cloud desktop systems store users' desktop systems on servers. Remote servers enable unified management of user desktop systems, dynamic provisioning and operation, and flexible allocation and recycling. For example, VDI (Virtual Desktop Infrastructure) is a typical cloud desktop system. All operations are performed on the server, and thin terminals only provide network connectivity and interactive functions. However, VDI-based cloud desktop systems are heavily dependent on the network, making offline use very difficult. Furthermore, VDI's support for peripheral devices is very limited. As a result, the user experience is poor.

[0003] As PC computing power continues to grow, Intel has introduced the IDV (Intelligent Desktop Virtualization) model for cloud desktop systems. IDV utilizes distributed computing, leveraging local computing resources to provide a better bandwidth experience and peripheral device compatibility, and can even operate offline.

[0004] However, when migrating from a network with a large number of existing computers to a cloud desktop system, the various models of computers in the existing network require IDV to create a corresponding image for each model in the cloud, making the management and maintenance of the cloud desktop system extremely complex and cumbersome. This makes migrating existing computer networks to a cloud desktop system prohibitively expensive, hindering the promotion and use of cloud desktop systems. Furthermore, existing cloud desktop systems have simple security verification during use, which is detrimental to the secure use of the entire cloud desktop system. Summary of the Invention

[0005] In response to the technical problems existing in the prior art, the present invention proposes a security verification method for a cloud desktop system, including: at a terminal, logging into a first operating system after a first authentication; in the first operating system, using a cloud desktop system client to access a cloud desktop server after a second authentication; and logging into a second operating system after a third authentication.

[0006] The method as described above, wherein the first authentication is performed via an access password.

[0007] In the method described above, the second authentication is implemented via a USB flash drive containing a specified security mechanism.

[0008] The method as described above, wherein the second authentication is authorized by the user's mobile device.

[0009] In the method as described above, the authorization through the user's mobile device includes sending an authentication request including a specific operation to the user's mobile device.

[0010] The method as described above, wherein the third authentication is implemented by biometric recognition of the user.

[0011] In the method described above, the user's biometric identification includes one or more of fingerprint or palm print recognition, facial recognition, and finger vein recognition.

[0012] The method as described above further includes: in response to passing the second authentication, the server allowing the terminal to run the second operating system.

[0013] In the method described above, the cloud desktop system administrator is only responsible for the management of the third authentication.

[0014] In the method described above, the terminal local administrator is only responsible for managing the first authentication and the second authentication.

[0015] The security verification method of the cloud desktop system of the present application allows users to log in to the cloud desktop system through a triple verification method when they need to use the cloud desktop system, greatly increasing the security of the use of the cloud desktop system. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Below, the preferred embodiments of the present invention will be further described in detail with reference to the accompanying drawings, in which:

[0017] Figure 1 is a schematic structural diagram of a cloud desktop system according to an embodiment of the present invention;

[0018] Figure 2 is a schematic diagram of the system structure of a terminal according to an embodiment of the present invention;

[0019] Figure 3 This is a schematic diagram of the operation process of the cloud desktop system client according to one embodiment of the present invention;

[0020] Figure 4 is a flow chart of a server of a cloud desktop system according to an embodiment of the present invention; and

[0021] Figure 5 The following is a flowchart of security verification of a cloud desktop system according to one embodiment of the present application. DETAILED DESCRIPTION

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0023] In the detailed description that follows, reference may be made to the various drawings that form part of this application and illustrate specific embodiments of the present application. In the drawings, similar reference numerals describe substantially similar components in different figures. Each specific embodiment of the present application is described below in sufficient detail to enable a person of ordinary skill in the art to implement the technical solutions of the present application. It should be understood that other embodiments may be utilized or that structural, logical, or electrical changes may be made to the embodiments of the present application.

[0024] This invention proposes a cloud desktop system based on IDV. A virtualization application running on a computer terminal's local operating system retrieves virtualization configurations from the cloud and simulates the corresponding hardware. Based on the simulated hardware, secondary virtualization is performed and the cloud desktop is distributed via the IDV framework, thus achieving a network-wide cloud desktop system. Because the number of virtualization configuration types is controllable, cloud desktop maintenance in the cloud is predictable. This will facilitate the deployment and promotion of cloud desktop systems within existing computer networks.

[0025] Figure 1 The figure is a schematic diagram of the structure of a cloud desktop system according to one embodiment of the present invention. As shown, cloud desktop system 100 includes a server 101 and multiple terminals 102-107 connected thereto. Terminals 102 and 103 are in a first local area network (LAN), while terminals 104 and 105 are in a second LAN. Terminals 102 and 103 are not in the same LAN as terminals 104 and 105. Terminals 106 and 107 are connected to server 101 via VPNs.

[0026] In some embodiments, server 101 includes one or more processors, memory, and a communication interface. The processor can be coupled to the memory and communication interface via a high-speed bus. The processor includes one or more central processing units (CPUs), graphics processing units (GPUs), application-specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), or a combination thereof. The processor can execute software or computer-readable instructions stored in the memory to perform the methods or operations described herein. The memory can store software, data, logs, or a combination thereof. The memory can be internal memory or external memory. Examples of internal memory include disk storage, flash memory, non-volatile random access memory (NVRAM), etc. Examples of external memory include memory residing on a storage node, cloud server, or storage server. Examples of communication interfaces include network interface cards, modems, etc. Server 101 can use the communication interface to connect to a first local area network and a second local area network, and communicate with terminals 102-105 located therein, respectively. The server can also use the communication interface to communicate with terminals 106 and 107 located in an external network via a VPN protocol.

[0027] In some embodiments, any of the terminals 102-107 includes: a first processor, a first RAM, a first I / O device, a first display, a first keyboard, and a first mouse; wherein the first I / O device may include a first hard drive and a second network interface card. These devices are all physical facilities of each terminal. As will be understood, the terminals 102-107 are configured to run a first operating system, i.e., a local operating system. These operating systems include, but are not limited to, Windows, Linux, Mac OS, iOS, or Android, or other operating systems based on these operating systems, such as Kylin, Hongqi Linux, AliOS (formerly Yun OS), and Harmony OS. Many of the terminals 102-107 already include the first operating system when purchased. In some cases, maintenance services for the hardware and first operating system of the terminals 102-107 can also be independently provided by the brand service provider or other organization of the terminals 102-107. Therefore, in some embodiments, maintenance of the cloud desktop system does not necessarily include maintenance work for the hardware and first operating system of the terminals 102-107.

[0028] In some embodiments, any one of the terminals 102-107 further includes a first virtualization layer, a second virtualization layer, and a cloud desktop. The first virtualization layer is generated by virtualization in the first operating system, and includes multiple virtual hardware: a second processor, a second RAM, a second I / O device, a second display, a second keyboard, and a second mouse; wherein the second I / O device may include a second hard disk and a second network interface card; it may be the same as the first processor, the first RAM, the first I / O device, the first display, the first keyboard, and the first mouse, or it may be different from them. The second virtualization layer is virtualization software running on the basis of the virtual hardware of the first virtualization layer. Under the IDV framework, the virtualization software of the second virtualization layer has a similar function to the local virtualization software of the IDV, providing support for the cloud desktop thereon. The difference is that in the present invention, the IDV virtualization software runs on each virtualization hardware of the first virtualization layer. A cloud desktop is a second operating system running on a terminal, which includes but is not limited to Windows, Linux, Mac OS, IOS, or Android, or other operating systems based on these operating systems, such as Kylin, Hongqi Linux, AliOS (formerly Yun OS), Harmony OS, etc.

[0029] The secondary virtualization of the terminal provides great flexibility for the cloud desktop system. Although it has undergone secondary virtualization, the loss of local computing performance is not great. Moreover, the performance improvement of the local terminal can also be achieved under the same framework. In some embodiments, if the hardware of the terminal itself, such as the first processor, the first RAM, etc., does not support the virtualization software under the IDV framework, the first virtualization layer can upgrade the hardware such as the first processor and the first RAM through virtualization means and support the client upgrade through the resources of the server 101. For example, the first processor of the terminal is an Intel i3 processor before 2016 and does not support Intel Broadwell, and cannot run the IDV framework. In the first virtualization layer, the virtual second processor can be set to Intel i5-5675C through virtualization means, and the required computing power can be achieved through the computing resources on the server side. This not only makes it easy for the IDV framework to be installed and run smoothly on old terminals, but also can substantially improve the user experience of the terminal.

[0030] Secondary virtualization of terminals also reduces the maintenance burden of cloud desktop systems. Since virtualized hardware configurations are distributed by cloud servers, the number of terminal images can be controlled from the server side. This significantly reduces maintenance workload and actual operating costs of cloud desktop systems.

[0031] The server runs the cloud management platform software to provide management functions for the cloud desktop system. In some embodiments, the server includes an image library 110 and a cloud desktop management module 112; wherein the image library 110 stores one or more images related to the terminal. In some embodiments, multiple terminals can correspond to one image. The reduction in the number of images can reduce the maintenance work required for the images. In other embodiments, the image library 110 includes a base image and multiple incremental images. The base image corresponds to the virtual hardware configuration. There are different base images for different virtual hardware configurations. The incremental image corresponds to the terminal. Each terminal has an incremental image in the image library. The incremental image stores personalized updates of the terminal based on the base image. The smaller number of base images can reduce the maintenance workload and provide flexibility in terminal personalization settings.

[0032] The cloud desktop management module 112 provides management functions for the cloud desktop system. In some embodiments, the cloud desktop management module 112 manages images in the image library, including but not limited to creating new images, binding images to terminals, updating and deleting images, etc. In some embodiments, the cloud desktop management module 112 manages terminals, including but not limited to adding and deleting terminals, configuring networks, setting management policies, and backing up and restoring data. These functions are similar to the management functions in the existing IDV framework and will not be further described here.

[0033] Unlike the existing IDV framework, the cloud desktop management module 112 also provides virtual configuration management functions. The cloud desktop management module receives a virtual configuration request from the terminal. The virtual configuration request includes at least the hardware configuration of the terminal: a first processor, a first RAM, a first I / O device, a first display, a first keyboard, and a first mouse, etc. The cloud desktop management module selects a virtual configuration suitable for the terminal from the multiple existing virtual configurations and sends the virtual configuration to the terminal. As understood, the virtual configuration may be lower than the terminal hardware configuration in terms of computing and storage capabilities; it may also be higher than the terminal hardware configuration in terms of computing and storage capabilities. In order to make full use of the local computing and storage resources of the terminal as much as possible and save computing and storage resources in the cloud, the computing and storage capabilities of the virtual configuration are generally lower than those of the terminal hardware configuration.

[0034] In some embodiments, the server further includes a security authentication service module 114. The security authentication service module 114 provides access services between the terminal and the server, including but not limited to user services, login authentication services, transmission encryption services, and flow control services. These functions are similar to those in the existing IDV framework and will not be further described here.

[0035] In some embodiments, the server also includes a cloud computing management module 116 and a cloud resource management module 118. When the computing or storage capabilities provided by the terminal's hardware are insufficient, a virtual second processor, second RAM, or second I / O port utilizes the server's cloud computing and storage capabilities to provide services to the terminal. Therefore, the server needs to provide corresponding resources based on the virtual configuration to support cloud computing and storage. Furthermore, the server itself also needs to manage multiple terminals and provide corresponding cloud services, which also requires computing and storage resources. The cloud computing management module 116 and cloud resource management module 118 provide and allocate the resources required for cloud computing and storage and manage cloud computing.

[0036] Figure 2 : It is a schematic diagram of the system structure of a terminal according to an embodiment of the present invention. As shown in the figure, the terminal includes a 5-layer structure, namely the basic hardware layer, the local operating system layer, the first virtualization layer, the second virtualization layer and the cloud desktop layer. The basic hardware layer refers to the hardware possessed by the terminal, including a first processor, a first RAM, a first I / O device, a first display, a first keyboard and a first mouse, etc. The local operating system layer (i.e., the first operating system) refers to the local operating system running on the basic hardware layer, which can be Windows, Linux, Mac OS, IOS or Android or other operating systems based on these operating systems, such as Kylin, Hongqi Linux, AliOS (formerly Yun OS), Harmony OS, etc.

[0037] In some embodiments, the terminal can run the client of the cloud desktop system of the present invention at the local operating system layer by installing software or an APP. As will be appreciated, the client of the present invention is provided in different forms depending on the local operating system. For example, an installation package for Windows systems, a dmg file or pkg file for Mac OS systems, an apk file for Android systems, etc. The terminal can obtain the client of the cloud desktop system through website download or other means; and install it on the local operating system of the terminal.

[0038] Through the cloud desktop system client, the terminal can communicate with the server and obtain the virtual hardware settings assigned by the server, and then virtualize the corresponding hardware on the terminal's local operating system. This virtual hardware forms the first virtualization layer, including: a second processor, a second RAM, a second I / O device, a second display, a second keyboard, a second mouse, etc.

[0039] The terminal deploys the IDV framework on the basis of the virtual hardware of the first virtualization layer to remotely run the cloud desktop. As is known, a second virtualization layer, namely a hypervisor, is set on top of the first virtualization layer. The hypervisor runs directly on the virtual hardware to provide the drivers required by the virtual hardware or at least the drivers of the CPU, Interrupt (terminal) and RAM, such as XEN. Since the hypervisor can run directly on the virtual hardware, although it is also virtualization, the performance loss is relatively small, and the reliability of operation can be guaranteed. The hypervisor manages the second operating system running on it. The second operating system can be Windows, Linux, Mac OS, IOS or Android or other operating systems based on these operating systems, such as Kylin, Hongqi Linux, AliOS (formerly Yun OS), Harmony OS, etc. The second virtualization layer and the second operating system layer are similar to the technology of the existing IDV framework, and will not be repeated here.

[0040] Figure 3 1 is a schematic diagram of the operation process of the cloud desktop system client according to one embodiment of the present invention. As shown in the figure, after the cloud desktop system client is installed in the local operating system of the terminal, the cloud desktop system client runs and executes the following steps: In step 310, the hardware configuration of the terminal is obtained, namely the first processor, the first RAM, the first I / O device, the first display, as well as the first keyboard and the first mouse, etc. In step 320, the terminal hardware configuration is sent to the server. These hardware configurations include at least the first processor and the first RAM. In some embodiments, these configurations also include the first I / O device. As understood, the hardware configuration of the terminal sent to the server may also include other hardware, such as a display, a printer, a scanner, etc.

[0041] In step 330, a virtual hardware configuration is received from the server. The virtual hardware configuration includes at least a second processor and a second RAM. In some embodiments, the virtual hardware configuration also includes a second I / O device. As will be appreciated, the virtual hardware configuration sent to the terminal may also include other virtual hardware, such as a display, a printer, a scanner, and the like. After receiving the hardware configuration from the terminal, the server first determines whether the terminal's hardware configuration is capable of running the cloud desktop system and the performance of running the cloud desktop system. Thus, the server determines whether the terminal's hardware configuration needs to be upgraded, that is, whether it is necessary to utilize the computing resources in the cloud to improve the terminal's operating experience. If the computing power needs to be upgraded, the server determines the processor type and amount of RAM to be assigned to the terminal after the upgrade. Next, the server determines the virtual hardware configuration to be allocated to the terminal based on the terminal's hardware configuration and the processor type and amount of RAM to be assigned if an upgrade is required. Similar procedures can also be used for other terminal hardware types that need to be upgraded, such as storage space.

[0042] In some embodiments, the server maintains a certain number of virtual hardware configurations. The server assigns one of these virtual hardware configurations to a terminal based on the terminal's hardware configuration and the specified processor type and RAM amount. As will be appreciated, each virtual hardware configuration corresponds to a different image. This allows the server to maintain a manageable number of images.

[0043] In step 340, the corresponding virtual hardware is simulated on the terminal according to the virtual hardware configuration. The client of the cloud desktop system has the function of simulating hardware with software. This function of the cloud desktop system client is similar to that of VMware Workstation or Visual Box, that is, virtual hardware is generated by software. In some embodiments, when the computing resources of the server are not needed, the communication for the virtual hardware is transferred to the local operating system and then executed by the local hardware. In other embodiments, when the computing resources of the server need to be utilized, the communication for the virtual processor and RAM is sent to the server and the calculation results are received from the server. When the storage resources of the server are needed, the communication for storage, such as the read and write request for the hard disk, will be sent to the server and the read and write results will be received from the server.

[0044] In step 350, the client of the IDV framework is set up based on the virtual hardware configuration. In some embodiments, a hypervisor, such as XEN, is installed on the basis of the virtual hardware. Then, the IDV cloud desktop client is installed on the terminal through the hypervisor. A suitable second operating system, i.e., the cloud desktop, is selected according to the needs of the terminal. In this way, double virtualization and the operation of the cloud desktop are achieved on the terminal. In this step, the above process is similar to the existing IDV framework client setting method and will not be repeated here.

[0045] Figure 4 The following is a flow diagram of a server in a cloud desktop system according to one embodiment of the present invention. As shown, the process of the server in the cloud desktop system includes the following steps: In step 410, the hardware configuration of the terminal is received. As previously described, the terminal's hardware configuration includes: a first processor, a first RAM, a first I / O device, a first display, a first keyboard, a first mouse, etc. In step 420, it is determined whether the terminal's hardware configuration needs to be upgraded. In some embodiments, the server determines whether the terminal meets the requirements for running the IDV framework. If the terminal's computing power or processor type does not meet the requirements for installing the IDV framework client, the server will increase the terminal's computing power. In some embodiments, if the terminal's storage capacity is insufficient, such as if the storage space is too small, the server will increase the terminal's storage capacity. In some embodiments, in step 430, the server determines whether the performance experience provided by the terminal meets minimum standards. These performance experiences include, but are not limited to, the terminal's wait time for executing certain tasks, the terminal's graphics or video rendering capabilities, and the terminal's storage capacity. If the server determines that the performance experience provided by the terminal does not meet the minimum standards, the server will increase the terminal's computing power and / or storage capacity.

[0046] In step 440, the server determines the computing power and / or storage capacity to be provided to the terminal. In some embodiments, if the purpose is to increase the computing power of the terminal, the server determines the processor type and RAM size of the virtual terminal. For example, the server determines the processor type and RAM size based on the minimum hardware requirements for running the IDV framework or the minimum performance experience requirements. If the purpose is to increase the storage capacity of the terminal, the server determines the size of the cloud storage space to be provided. For example, cloud storage space is allocated to the terminal based on the terminal's needs.

[0047] In step 450, the server determines the virtual hardware configuration of the terminal. In some embodiments, the server's image library stores multiple images. Each image corresponds to multiple virtual hardware configurations. In other embodiments, the images in the image library include a base image and an incremental image. The base image corresponds to a virtual hardware configuration. Thus, the server includes multiple virtual hardware configurations. In some embodiments, the server compares the terminal's hardware configuration with the multiple virtual hardware configurations and assigns the virtual hardware configuration that is closest to the terminal's hardware configuration to the terminal. In some embodiments, the processing power of the CPU in the virtual hardware configuration is less than or equal to the processing power of the CPU in the terminal hardware. The size of the RAM in the virtual hardware configuration is equal to the size of the RAM in the terminal hardware. The size of the hard disk space in the virtual hardware configuration is equal to the size of the hard disk space in the terminal hardware. Of course, the size of the virtual RAM and hard disk space can also be slightly smaller than the size of the terminal RAM and hard disk space. Generally, the size of the virtual CPU processing power, RAM, and hard disk space will not exceed the size of the terminal CPU processing power, RAM, and hard disk space.

[0048] In some embodiments, the server replaces the hardware corresponding to the terminal with the increased computing power and / or storage capacity, and then compares it with multiple virtual hardware configurations to determine the virtual configuration to assign to the terminal. Since the computing power and / or storage capacity of the terminal has been increased, the increased computing power and / or storage capacity corresponds to the computing power and / or storage capacity in the existing multiple virtual configurations. Therefore, after the computing power and / or storage capacity of the terminal has been increased, the corresponding virtual hardware configuration can be easily determined.

[0049] In some embodiments, if the server does not have a virtual hardware configuration suitable for the terminal, a new virtual hardware configuration can be created on the server and a corresponding image can be created in the image library. The newly created virtual hardware configuration is then allocated to the terminal. If the computing power and / or storage capacity of the terminal exceeds the existing virtual hardware configuration on the server, a new virtual hardware configuration is created so that the computing power and / or storage capacity of the terminal are not underutilized.

[0050] In step 460, an image associated with the terminal is specified. The server determines an image suitable for the terminal based on the terminal's computing power and / or storage capacity. In some embodiments, the server obtains the type of operating system required by the terminal and selects an image that matches the terminal's operating system from among the images suitable for the terminal. For example, if the terminal uses Windows XP, a Windows XP image or base image corresponding to the terminal's virtual hardware configuration is selected and assigned to the terminal. The terminal then downloads the specified image and runs the Windows XP cloud desktop.

[0051] In some embodiments, the server manages the image specified by the terminal to remotely manage the cloud desktop of the terminal. For example, the server can change the operating system used by the terminal by changing the image specified for the terminal. The server can add new software to the second operating system of the terminal by installing new software in the image. The server can add new hardware to the second operating system by adding the driver of the terminal hardware in the image. The server can manage the users who use the terminal by configuring login information in the image. The server can manage the permissions of the users who use the terminal by configuring user permissions in the image. The server's management of the cloud desktops of each terminal is similar to the management method under the existing IDV framework and will not be repeated here.

[0052] The present invention implements the distribution and management of cloud desktops by running the IDV framework on virtual hardware simulated on computer terminals. In some embodiments of the present invention, the number of images managed on the server can be effectively reduced, thereby alleviating the workload of cloud desktop maintenance and promoting the deployment and promotion of cloud desktop systems in existing computer networks. In some embodiments of the present invention, the computing power and / or storage capacity provided by the server are used to enhance the virtual hardware of the terminal, thereby smoothly running the cloud desktop system. This not only expands the scope of application of the cloud desktop system, but also improves the user experience of using the cloud desktop system.

[0053] In the process of using the cloud desktop system on the terminal, the security of the cloud desktop system needs to be guaranteed. According to one embodiment of the present application, the present application also proposes a security verification method when using the cloud desktop system, which will be described in detail below.

[0054] Figure 5 This is a flow chart of security verification of a cloud desktop system according to an embodiment of the present application. As shown in the figure, in step 510, at the terminal, the first operating system is logged in after the first authentication. When you want to use the cloud desktop system, you need to first start the terminal where the cloud desktop system client is located and log in to the first operating system of the terminal. In this embodiment, you need to log in to the first operating system of the terminal through the first authentication. In some embodiments, the first authentication can be implemented through an access password. In some embodiments, the first authentication can also be implemented through the user's biometric identification. The user's biometric identification includes one or more of fingerprint or palm print recognition, facial recognition, and finger vein recognition. In some embodiments, the first authentication is to log in to the first operating system on the terminal, and the management of the first authentication may be the responsibility of the local administrator of the terminal.

[0055] In step 520, in the first operating system, after the second authentication, the cloud desktop system client is used to access the cloud desktop server. After logging into the first operating system through the first authentication, you can click on the cloud desktop system client in the first operating system and use the cloud desktop system client to access the cloud desktop server to obtain authorization to use the cloud desktop system. In this embodiment, using the cloud desktop system client to access the cloud desktop server requires passing the second authentication verification. In some embodiments, after passing the second authentication verification, the server can allow the terminal to run the second operating system. In some embodiments, the second authentication is to access the cloud desktop server through the cloud desktop system client in the first operating system, and the management of the second authentication can be the responsibility of the local administrator of the terminal.

[0056] In some embodiments, the second authentication can be implemented through a USB flash drive that contains a specified security mechanism. For example: when the cloud desktop system client is opened, the cloud desktop system client calls the USB interface of the terminal, and when it recognizes that a USB flash drive is inserted into the interface, it identifies whether the inserted USB flash drive contains a relevant security mechanism. If the inserted USB flash drive contains a corresponding security mechanism, the cloud desktop client is allowed to access the cloud desktop server. In some embodiments, when the cloud desktop system client is opened, the user can also be reminded to insert a USB flash drive. In some embodiments, the reminder to the user to insert the USB flash drive can be a reminder from the cloud desktop system client, or a reminder from the first operating system of the terminal. In some embodiments, the reminder to the user can be a text reminder or a voice reminder, etc.

[0057] In some embodiments, the second authentication can also be implemented through authorization by the user's mobile device. For example: verification through the user's mobile device authorization code or verification code. In some embodiments, authorization through the user's mobile device may include sending an authentication request including a specific operation to the user's mobile device. For example: when the cloud desktop system client is opened, an authentication request is automatically sent to the cloud desktop system. After receiving the authentication request, the cloud desktop server automatically sends an authorization code or verification code to the authorized user's mobile phone, and the authorized user enters the authorization code or verification code into the cloud desktop system client for verification. If the verification is successful, the cloud desktop system client can access the cloud desktop server. In some embodiments, the mobile device can also be a tablet computer, a laptop computer, smart glasses, etc.

[0058] In step 530, after the third authentication, the user logs into the second operating system. When the server allows the terminal to run the second operating system, the second operating system can be run through the cloud desktop system client. In this embodiment, running the second operating system through the cloud desktop system client requires the third authentication verification. In some embodiments, the third authentication is performed by logging into the second operating system through the cloud desktop system client. Therefore, the management of the third authentication may be the responsibility of the cloud desktop system administrator.

[0059] In some embodiments, the third authentication can be implemented by biometric identification of the user. For example, the third authentication can be implemented by verifying the user's fingerprint to log into the second operating system. In some embodiments, the third authentication can also be implemented by accessing a password.

[0060] In some embodiments, the third authentication is performed using a different method than the first authentication. For example, if the first authentication is performed using an access code, the third authentication is performed using user biometrics. In some embodiments, both the first and third authentications are performed using user biometrics, but the biometrics used in the two authentications are different. For example, if the first authentication is performed using fingerprint recognition, the third authentication is performed using facial recognition.

[0061] The security verification method of the cloud desktop system of the present application allows users to log in to the cloud desktop system through a triple verification method when they need to use the cloud desktop system, greatly increasing the security of the use of the cloud desktop system. It also differentiates the management of the triple verification method, and local administrators can also be responsible for part of the security verification, which can greatly reduce the workload of cloud desktop administrators.

[0062] The above embodiments are only used to illustrate the present invention, and are not intended to limit the present invention. Ordinary technicians in the relevant technical field can make various changes and modifications without departing from the scope of the present invention. Therefore, all equivalent technical solutions should also fall within the scope of the present invention.

Claims

1. A security verification method for a cloud desktop system, comprising: At a terminal, after a first authentication, logging into a first operating system, wherein the terminal is installed with a cloud desktop system client, the cloud desktop system client is used for the terminal to communicate with a cloud desktop server, wherein the cloud desktop server includes an image library, and the image library includes images corresponding to virtual hardware required by the terminal; In the first operating system, after a second authentication, the cloud desktop system client is used to access the cloud desktop server, wherein, if the second authentication verification is passed, the cloud desktop server runs an image specially configured for the virtual hardware, so that the terminal forms a first virtualization layer based on the multiple virtual hardware, and runs a hypervisor on the first virtualization layer, wherein the hypervisor corresponds to the second virtualization layer and is used to run the second operating system; After the third authentication, the user logs in to the second operating system. If the third authentication is passed, the second operating system is run based on the hypervisor installed on the cloud desktop system client.

2. The method according to claim 1, wherein the first authentication is performed by means of an access code.

3. The method according to claim 1, wherein the second authentication is implemented through a USB flash drive containing a specified security mechanism. The method according to claim 1 , wherein the second authentication is performed by authorizing the user's mobile device.

5. The method of claim 4, wherein authorizing through the user's mobile device comprises sending an authentication request including a specific operation to the user's mobile device. The method according to claim 1 , wherein the third authentication is performed by biometric recognition of the user.

7. The method according to claim 6, wherein the user's biometric recognition includes one or more of fingerprint or palm print recognition, facial recognition, and finger vein recognition.

8. The method according to claim 1, further comprising: In response to passing the second authentication, the server allows the terminal to run the second operating system.

9. The method according to claim 1, wherein the cloud desktop system administrator is only responsible for the management of the third authentication.

10. The method according to claim 9, wherein the terminal local administrator is only responsible for managing the first authentication and the second authentication.

Images