Cloud desktop access method, zero trust gateway, cloud desktop client and server

Abstract

The present invention provides a cloud desktop access method, a zero-trust gateway, a cloud desktop client and a server, which are used to solve the technical problem of implementing a cloud desktop system based on a zero-trust network security framework. The present invention starts the cloud desktop client through a security authentication portal, and the security authentication portal transmits the authentication information of the cloud desktop user to the cloud desktop client. When the cloud desktop client establishes a control connection and a data connection with the cloud desktop server, the authentication information transmitted by the security authentication portal is carried in the connection request message and the login request message. The zero-trust gateway extracts the authentication information from the request message for authentication and forwards it to the cloud desktop server. The cloud desktop server, the zero-trust gateway and the security authentication portal all use a unified security authentication center for authentication. The present invention can realize the integration of the zero-trust network security framework and the cloud desktop basic framework, realize the single sign-on of the cloud desktop, and improve the security of the cloud desktop system.

Description

Technical Field

[0001] The present invention relates to the field of communication and cloud computing technology, and in particular to a cloud desktop access method, a zero-trust gateway, a cloud desktop client and a server. Background Art

[0002] With the continuous development of Internet technology, network security threats and risks continue to emerge under the new technology situation. New application scenarios such as mobile Internet, industrial Internet, and Internet of Vehicles have also gradually disintegrated the physical network security boundary. In order to cope with the increasingly complex network environment, the industry has proposed a "zero trust" network security framework. The core idea of ​​the zero trust network security framework is: do not trust anyone, equipment, and system inside or outside the enterprise network by default, and rebuild the trust foundation of access control based on identity authentication and authorization, so as to ensure that the identity is trustworthy, the device is trustworthy, the application is trustworthy, and the link is trustworthy. Based on the zero trust principle, the terminal security, link security, and access control security of the office system can be guaranteed.

[0003] As cloud computing and device virtualization technologies become increasingly mature, remote office work using cloud desktops has gradually become a normalized working mode. Virtual Desktop Infrastructure (VDI), or cloud desktop systems, mainly rely on virtual machines deployed on servers to provide users with virtual computing resources. These virtual machines consume little resources, are easy to manage in a unified manner, and are easy to use. At present, cloud desktops have become the preferred way for many enterprises and institutions to work.

[0004] At present, the security system of zero-trust network is still imperfect, and various manufacturers have not yet reached a unified solution on how cloud desktops can be connected to the zero-trust network system. Because cloud desktops are a special case in the zero-trust system, they can be seen as a tool for accessing data in the user domain, or as a special-purpose application in the data domain. Compared with some WEB applications, cloud desktops are relatively special in terms of business logic, data access methods, network connection methods, etc., so cloud desktops still face many problems in connecting to the zero-trust network security framework.

[0005] Among the problems faced, one of the main issues is how to achieve single sign-on. The cloud desktop has its own security authentication system, and the zero-trust network security framework also has its own security authentication system. The two independent authentication systems cannot achieve unified authentication and single sign-on. Summary of the invention

[0006] In view of this, the present invention provides a cloud desktop access method, a zero-trust gateway, a cloud desktop client and a server, which are used to solve the technical problem of implementing a cloud desktop system based on a zero-trust network security framework.

[0007] Based on one aspect of an embodiment of the present invention, the present invention provides a cloud desktop access method, which is applied to a cloud desktop client, and the method includes:

[0008] When the cloud desktop client is started, receiving authentication information transmitted by the security authentication portal; the authentication information comes from the security authentication center in the zero-trust network security framework;

[0009] In the process of the cloud desktop client interacting with the cloud desktop server to establish a control connection and a data connection, the authentication information is carried in the interactive message so that the zero-trust gateway authenticates the interactive message.

[0010] Furthermore, the process of the cloud desktop client interacting with the cloud desktop server to establish a control connection and a data connection includes:

[0011] The cloud desktop client sends a connection request to the cloud desktop server, wherein the message of the connection request includes an extension field, and the extension field carries the authentication information; the authentication information is used by the zero-trust gateway to authenticate the connection request through the security authentication center;

[0012] The cloud desktop client receives a connection response sent by the cloud desktop server and forwarded by the zero trust gateway to establish a connection with the cloud desktop server.

[0013] Furthermore, the method further comprises:

[0014] The cloud desktop client sends a login request to the cloud desktop server through the control connection to log in to the cloud desktop server; the authentication information is carried in the content field of the login request so that the cloud desktop service authenticates the authentication information through the security authentication center;

[0015] Receive a login response sent by the cloud desktop server, and obtain a cloud desktop list from the login response;

[0016] The cloud desktop client establishes a connection with a selected cloud desktop in the cloud desktop list.

[0017] Further, the cloud desktop client includes a client main module and a client submodule, and the cloud desktop server includes a virtualization management platform and a virtualization kernel platform;

[0018] The method for the cloud desktop client to establish a connection with the selected cloud desktop in the cloud desktop list is:

[0019] The client main module obtains the cloud desktop information of the selected cloud desktop from the cloud desktop list;

[0020] The client main module starts a client submodule for connecting to the selected cloud desktop, and transmits the cloud desktop information and authentication information of the selected cloud desktop to the client submodule;

[0021] The client submodule establishes a control connection with the virtualization management platform based on the cloud desktop information and the authentication information, and establishes a data connection with the selected cloud desktop located in the virtualization kernel platform.

[0022] Furthermore, the process of the cloud desktop client interacting with the cloud desktop server to establish a control connection includes:

[0023] A process in which the client main module sends a first connection request to the virtualization management platform to establish a connection with the virtualization management platform; and

[0024] The client submodule sends a second connection request to the virtualization management platform based on the cloud desktop information and the authentication information to establish a control connection with the virtualization management platform;

[0025] Wherein, the extension field is included in the messages of the first connection request and the second connection request.

[0026] Based on one aspect of an embodiment of the present invention, the present invention further provides a zero-trust cloud desktop access method, which is applied to a zero-trust gateway, and the method includes:

[0027] Receive a control connection request sent by the cloud desktop client to the cloud desktop server, extract authentication information from the control connection request, authenticate the control connection request through a security authentication center in a zero-trust network security framework, and release the control connection request after successful authentication;

[0028] Receiving a login request sent by the cloud desktop client to the cloud desktop server through the established connection with the cloud desktop server, and forwarding the login request to the cloud desktop server;

[0029] Receive a virtual desktop protocol connection request for connecting to a selected cloud desktop sent by a cloud desktop client to a cloud desktop server, extract authentication information from the virtual desktop protocol connection request, authenticate the virtual desktop protocol connection request through a security authentication center in a zero-trust network security framework, and release the virtual desktop protocol connection request after successful authentication.

[0030] Further, the receiving of a control connection request sent by the cloud desktop client to the cloud desktop server includes:

[0031] Receiving a first connection request sent by a client main module of the cloud desktop client to a virtualization management platform of the cloud desktop server; and

[0032] Receiving a second connection request sent by the client submodule of the cloud desktop client to the virtualization kernel platform of the cloud desktop server;

[0033] The messages of the first connection request and the second connection request both include an extension field, and the extension field carries the authentication information.

[0034] Furthermore, the authentication information includes at least: a user token and an application token.

[0035] Furthermore, the authentication information also includes two fields: a destination IP address and a destination port for message forwarding.

[0036] Based on one aspect of an embodiment of the present invention, the present invention further provides a cloud desktop client, the cloud desktop client comprising a client main module and a client submodule;

[0037] The client main module is used to obtain authentication information transmitted by the security authentication portal when the cloud desktop client is started; the authentication information comes from the security authentication center in the zero-trust network security framework;

[0038] The client main module is also used to send a first connection request to the virtualization management platform of the cloud desktop server to establish a first control connection with the virtualization management platform; send a login request to the cloud desktop server through the first control connection to log in to the cloud desktop server; carry the authentication information in the login request content field;

[0039] The client main module is also used to receive a login response sent by the virtualization management platform, obtain a cloud desktop list from the login response; obtain cloud desktop information of the selected cloud desktop from the cloud desktop list; start a client submodule for connecting to the selected cloud desktop, and transfer the cloud desktop information and authentication information of the selected cloud desktop to the client submodule;

[0040] The client submodule is used to send a second connection request to the virtualization management platform based on the cloud desktop information and the authentication information to establish a second control connection with the virtualization management platform; and send a virtual desktop protocol connection request to the virtualization kernel platform of the cloud desktop server to establish a data connection with the selected cloud desktop in the virtualization kernel platform of the cloud desktop server;

[0041] The messages of the first connection request and the second connection request both include an extension field, and the extension field carries the authentication information.

[0042] Furthermore, the authentication information at least includes: a user token and an application token; or the authentication information at least includes: a user token, an application token, and two fields: a destination IP address and a destination port for message forwarding.

[0043] Based on one aspect of an embodiment of the present invention, the present invention further provides a zero-trust gateway, the zero-trust gateway comprising:

[0044] A first authentication forwarding module is used to receive a first connection request sent by a client main module of a cloud desktop client to a virtualization management platform of a cloud desktop server, extract authentication information from the first connection request, authenticate the first connection request through a security authentication center in a zero-trust network security framework, and release the first connection request after successful authentication; and receive and forward a login request sent by the client main module to the virtualization management platform;

[0045] A second authentication forwarding module is used to receive a second connection request sent by a client submodule of the cloud desktop client to the virtualization management platform of the cloud desktop server, and a virtual desktop protocol connection request sent by the client submodule of the cloud desktop client to the virtualization kernel platform of the cloud desktop server, extract authentication information from the second connection request and the virtual desktop protocol connection request, authenticate the second connection request and the virtual desktop protocol connection request through a security authentication center in a zero-trust network security framework, and release the second connection request and the virtual desktop protocol connection request after successful authentication;

[0046] The first connection request and the second connection request both carry an extension field, and the authentication information is carried in the extension field.

[0047] Furthermore, the authentication information at least includes: a user token and an application token; or the authentication information at least includes: a user token, an application token, and two fields: a destination IP address and a destination port for message forwarding.

[0048] Based on one aspect of an embodiment of the present invention, the present invention also provides a zero-trust cloud desktop access method, which is applied to a cloud desktop server, and the method includes:

[0049] Receive a login request forwarded by a zero-trust gateway, wherein the login request carries authentication information;

[0050] The login request is authenticated by the security authentication center in the zero-trust network security framework.

[0051] Furthermore, the method also includes: synchronizing user information with the security authentication center.

[0052] Based on one aspect of an embodiment of the present invention, the present invention further provides a cloud desktop server, the cloud desktop server comprising:

[0053] A login authentication module is used to receive a login request forwarded by a zero-trust gateway, wherein the login request carries authentication information; and authenticate the login request through a security authentication center in a zero-trust network security framework;

[0054] A synchronization module is used to synchronize user information with the security authentication center.

[0055] The present invention starts the cloud desktop client through a security authentication portal, and the security authentication portal transmits the authentication information of the cloud desktop user to the cloud desktop client. When the cloud desktop client establishes a control connection and a data connection with the cloud desktop server, the authentication information transmitted by the security authentication portal is carried in the connection request message and the login request message. The zero-trust gateway extracts the authentication information from the request message for authentication and forwards it to the cloud desktop server. The cloud desktop server, the zero-trust gateway, and the security authentication portal all use a unified security authentication center for authentication. The present invention can realize the integration of the zero-trust network security framework and the cloud desktop basic framework, realize the single sign-on of the cloud desktop, and improve the security of the cloud desktop system. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments of the present invention or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings of the embodiments of the present invention.

[0057] Figure 1 A schematic diagram of the steps of a cloud desktop access method based on a zero-trust network security framework provided by an embodiment of the present invention;

[0058] Figure 2 A schematic diagram of the structure of an electronic device provided in one embodiment of the present invention for implementing the zero-trust cloud desktop access method provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0059] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, rather than limiting the embodiments of the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention are also intended to include plural forms, unless the context clearly indicates other meanings. The term "and / or" used in the present invention refers to any or all possible combinations of one or more associated listed items.

[0060] It should be understood that although the terms first, second, third, etc. may be used to describe various information in embodiments of the present invention, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of embodiments of the present invention, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, in addition, the word "if" used may be interpreted as "at the time of" or "when" or "in response to determining".

[0061] Since the cloud desktop basic framework and the zero-trust network security framework each have their own independent security authentication systems, when cloud desktop users access the cloud desktop system deployed in the zero-trust network, they need to perform two security authentications with the authentication systems of the zero-trust network and the cloud desktop system respectively. Single-point sign-on authentication is not possible. In addition, in order to ensure the consistency of authentication of the two systems, administrators need to do a lot of work to synchronize user authentication information, which reduces the intelligence and maintenance management efficiency of the entire system.

[0062] In view of the problems faced by the cloud desktop system based on the zero-trust network security framework, the present invention proposes a zero-trust cloud desktop access method to achieve access to the cloud desktop located in the zero-trust network security framework. The basic idea of ​​the present invention is: start the cloud desktop client through the security authentication portal, and the security authentication portal transmits the authentication information of the cloud desktop user to the cloud desktop client. When the cloud desktop client establishes a control connection and a data connection with the cloud desktop server, the authentication information transmitted by the security authentication portal is carried in the connection request message and the login request message. The zero-trust gateway extracts the authentication information from the request message for authentication, and only the request message that passes the authentication is released and forwarded to the cloud desktop server. The cloud desktop server, the zero-trust gateway and the security authentication portal all use a unified security authentication center for authentication. Through the present invention, the integration of the zero-trust network security framework and the cloud desktop basic framework can be realized, the single sign-on of the cloud desktop can be realized, and the security of the cloud desktop system can be improved.

[0063] Based on the basic idea of ​​the present invention, the specific implementation process of the present invention is described below in conjunction with the accompanying drawings and specific embodiments.

[0064] Figure 1A schematic diagram of the steps of a cloud desktop access method based on a zero-trust network security framework provided in one embodiment of the present invention. In this example, a zero-trust gateway 1300 is deployed before the cloud desktop server 1200, and the zero-trust gateway 1300 performs trusted access inspection on all traffic between the cloud desktop client 1100 and the cloud desktop server 1200. The cloud desktop client 1100 is composed of a client main module 1110 (referred to as the main module) and a client submodule 1120 (referred to as the submodule). The cloud desktop server 1200 includes a virtualization management platform (Cloud Virtualization Manager, CVM) 1210 and a virtualization kernel platform (Cloud Virtualization Kernel, CVK) 1220. The virtualization management platform 1210 is responsible for management functions such as login authentication of cloud desktop users, distribution of cloud desktop lists, status monitoring of cloud desktop clients, and login authentication. The virtualization kernel platform 1220 is used to carry virtual machines that provide cloud desktops.

[0065] The client main module 1110 is mainly used to complete the functions of the control layer, such as connection establishment, cloud desktop login, policy control, and startup of the client sub-module 1120 corresponding to the cloud desktop. The client sub-module 1120 corresponds to the cloud desktop virtual machine one by one, and the client sub-module establishes a connection with CVM and CVK respectively. When a cloud desktop user logs in and opens multiple cloud desktops, the cloud desktop client 1100 will start multiple client sub-modules 1120 through the client main module 1110 to connect to multiple virtual machines in the virtualization kernel platform 1220.

[0066] The security authentication portal, zero trust gateway 1300 and cloud desktop server 1200 are uniformly authenticated by the security authentication center 1400.

[0067] In the embodiment of the present invention, the connection used for the purpose of cloud desktop management and control is called a control connection, and the connection specifically used for cloud desktop data transmission is called a data connection. For example, the connection established between the cloud desktop client main module 1110 and the virtualization management platform 1210 through the connection request and connection response message, and the connection established between the client submodule 1120 and the virtualization management platform 1210 through the connection request and connection response message are both control connections; the connection established between the cloud client submodule 1120 and the cloud desktop virtual machine in the virtualization kernel platform through the VDP connection request and connection response message is a data connection.

[0068] The following is a step-by-step description of the process of the cloud desktop client 1100 accessing the cloud desktop server 1200:

[0069] S101. The security authentication portal authenticates the cloud desktop user and obtains authentication information;

[0070] Unlike the cloud desktop system of the traditional non-integrated zero-trust network, in the cloud desktop system based on the zero-trust network security framework, the cloud desktop user must first pass the authentication of the security authentication portal, and use the security authentication portal to start the cloud desktop client. The cloud desktop user logs in to the security authentication portal and enters the user name and password in the security authentication portal. The security authentication portal sends the user name and password to the security authentication center 1400 for authentication. The security authentication center 1400 can be implemented using identity identification and access management (IAM). After the authentication is successful, the security authentication center sends the authentication information to the security authentication portal. The authentication information may include a user token and an application token or a combination of other necessary information. The specific form of the authentication information is not limited by the present invention.

[0071] S102. Start the cloud desktop client through the security authentication portal and transfer the authentication information to the cloud desktop client;

[0072] Cloud desktop users can access the cloud desktop entry interface only after passing the authentication of the security authentication portal.

[0073] Cloud desktop users can start the cloud desktop client only after passing the security authentication portal. When starting the cloud desktop client, the security authentication portal can pass the authentication information as program running parameters to the cloud desktop client program.

[0074] For security reasons, the security authentication portal can use a preset key to encrypt the authentication information and pass the encrypted authentication information to the cloud desktop client as a program running parameter. When the cloud desktop client starts, it uses the preset key to decrypt the passed parameters to obtain the authentication information. The preset key can be obtained by reading it from a configuration file or using a fixed key.

[0075] The authentication information can be a user token, a combination of a user token and an application token, or other necessary information, and can be determined according to the specific application scenario and authentication requirements. For example, in a scenario where only identity authentication is required, only a user token may be included; in a scenario where both identity authentication and application access permission authentication are required, a user token and an application token may be included at the same time. The cloud desktop client can obtain information such as the user ID and application ID by decrypting the user token and application token. The embodiment of the present invention does not specifically limit the specific form and content of the authentication information in each step, and it can be determined according to the specific security authentication requirements.

[0076] S103. The cloud desktop client sends a connection request to the cloud desktop server, and the connection request carries authentication information;

[0077] In the zero-trust network security framework, all traffic between the cloud desktop client and the server must be monitored by the zero-trust gateway, and only connection requests that pass the authentication of the zero-trust gateway can successfully establish a connection. Therefore, when the cloud desktop client establishes a connection with the cloud desktop server, the connection request sent by the cloud desktop client to the cloud desktop server will first be intercepted by the zero-trust gateway, and the zero-trust gateway will authenticate the connection request. After the authentication is successful, the zero-trust gateway will release the connection request to the cloud desktop server.

[0078] How the cloud desktop client passes authentication information to the zero-trust gateway and successfully penetrates the zero-trust gateway to establish a connection with the cloud desktop server is a key step in the integration of the cloud desktop system and the zero-trust network security framework.

[0079] In the embodiment of the present invention, after the cloud desktop client is started, a connection request is initiated to the cloud desktop server according to the pre-set cloud desktop server address, and the connection request carries authentication information. In order to enable the zero-trust gateway to extract authentication information from the connection request, the protocol message structure used between the cloud desktop client and the cloud desktop server can be expanded, so that the zero-trust gateway can extract authentication information from the connection request message on the basis of being able to identify the connection request message.

[0080] In one embodiment of the present invention, the cloud desktop client and the cloud desktop server use the Remote Procedure Calls (RPC) protocol, such as the gRPC protocol, to communicate. In the Transport Layer Security (TLS) protocol that gRPC relies on, the ClientHello message of the TLS protocol can be used as the aforementioned connection request, and the message structure is extended. A new extension field is added to the ClientHello message and the encrypted authentication information is carried in the extension field. For example, the authentication information such as the user token and application token obtained by the cloud desktop client from the security authentication portal is stored in the form of an encrypted string, and may also include the IP address, MAC address, CVM address and port of the terminal device where the cloud desktop client is located. The zero-trust gateway must be able to identify the ClientHello message of the TLS protocol and extract the carried authentication information from the extension field.

[0081] In addition to the gRPC protocol, the HTTPS protocol can also be used to establish a connection between the cloud desktop client and the cloud desktop server. The HTTPS protocol also relies on the TLS protocol, and the TLS protocol ClientHello message can be extended in the same way to carry authentication information. It can be understood by those skilled in the art that based on the same principle, other types of transport layer security protocols or other upper layer protocol types that support TLS can also be selected to implement the function of this step, and the present invention does not make specific limitations.

[0082] S104. The zero-trust gateway extracts authentication information from the connection request, performs security authentication through the security authentication center, releases the connection request after successful authentication, and forwards the connection request to the cloud desktop server to establish a connection between the cloud desktop client and the cloud desktop server.

[0083] After receiving the connection request sent by the cloud desktop client, the zero-trust gateway parses the message and extracts the encrypted authentication information from the extended field, and decrypts the message extended field using the secret key agreed with the cloud desktop client to obtain the original authentication information.

[0084] The zero-trust gateway uses the extracted authentication information to authenticate the identity and access rights at the security authentication center. Only after the authentication is passed will the connection request sent by the cloud desktop client be released and the connection request will be forwarded to the virtualization management platform CVM on the cloud desktop server side. CVM will respond to the connection request and send a connection response message to the cloud desktop client. The connection response message is forwarded to the cloud desktop client main module through the zero-trust gateway. The cloud desktop client main module can establish a connection with CVM after receiving the connection response.

[0085] S105. The cloud desktop client sends a login request to the cloud desktop server, and the login request carries authentication information;

[0086] After the cloud desktop client main module establishes a connection with the cloud desktop server CVM, the cloud desktop client main module can initiate a login request to the CVM to obtain information such as the cloud desktop list of the cloud desktop user.

[0087] The main module of the cloud desktop client needs to write the authentication information passed in by the security authentication portal into the content field of the login request message. Different from the way the connection request carries authentication information, in the login request, the authentication information needs to be written into the content field of the login message, while in the connection request message, it is carried in the extension field of the message header. Since the authentication information in the content field is used for security authentication of the cloud desktop server, and the authentication information in the extension field is used for security authentication of the zero trust gateway, the specific content and form of the authentication information in the content field and the authentication information in the extension field can be different.

[0088] S106. The zero-trust gateway extracts authentication information from the login request, performs security authentication through the security authentication center, and after successful authentication, releases the login request and forwards the login request to the cloud desktop server.

[0089] The zero-trust gateway parses the connection request message (clienthello), extracts the authentication information and performs authentication. After the authentication is passed, the connection request message is released to the cloud desktop server. After the connection between the cloud desktop client and the cloud desktop server is successfully established, the connection will be maintained for a long time until the connection is closed. Subsequent login messages, virtual machine application messages, etc. are sent and responded through this connection. Normally, the zero-trust gateway only authenticates the security of the connection by authenticating the connection request message when the connection is established. After the authentication is passed, the messages transmitted through this connection are no longer authenticated and are directly forwarded.

[0090] S107. After receiving the login request, the cloud desktop server extracts the authentication information in the login request and performs security authentication through the security authentication center;

[0091] After receiving the login request, the CVM on the cloud desktop server obtains the authentication information from the login request, and uses the authentication information, such as the user token and application token, to authenticate the identity and access rights of the cloud desktop user at the security authentication center. After the authentication is successful, the authentication result is notified to the CVM through an authentication response message.

[0092] The address of the security certification center can be provided to CVM through the configuration file.

[0093] S108. The cloud desktop server sends a login response message to the cloud desktop client, and the login response message carries a cloud desktop list;

[0094] After passing the login authentication, CVM sends the cloud desktop list of the cloud desktop user to the client main module in the cloud desktop client through a login response message. The cloud desktop list includes a collection of cloud desktop information to which the logged-in cloud desktop user has access rights. For example, if the cloud desktop user has two cloud desktops, the cloud desktop list includes the cloud desktop information of these two cloud desktops. The cloud desktop information may include but is not limited to: access address information of the virtual machine providing the cloud desktop, desktop policy information, etc.

[0095] S109. The cloud desktop server synchronizes authentication related information with the security authentication center;

[0096] If the cloud desktop system and the zero-trust network security framework use two completely independent user identity authentication systems, the user will need to authenticate twice in the security authentication portal and the cloud desktop server CVM when connecting to the cloud desktop. Therefore, in order to achieve single sign-on for users, the cloud desktop server, security authentication portal, and zero-trust gateway all need to use the same authentication system to authenticate the cloud desktop user's identity and application access rights.

[0097] CVM needs to maintain information such as cloud desktop user information, cloud desktop user's cloud desktop list, user policy, desktop policy, user log, etc. In order to achieve single sign-on and integrate the cloud desktop system with the security authentication in the zero-trust network security framework, the cloud desktop system and the zero-trust network security framework need to synchronize some authentication-related information. For example, authentication-related information may include user lists, access rights, etc. Any changes in authentication-related information (such as the addition, deletion, or modification of cloud desktop users or permissions, etc.) between the cloud desktop server and the security authentication center need to be synchronized.

[0098] If the zero-trust network security framework does not allow sensitive information (such as user passwords, tokens, etc.) to be implemented in systems outside the security authentication center, the synchronization process of the above authentication-related information can only synchronize non-sensitive information such as user IDs, and the user ID can be used as a keyword to associate user-related information in the cloud desktop system.

[0099] The present invention does not limit the timing of synchronizing the authentication related information in this step, which may be periodic synchronization or event-based synchronization, such as triggering a synchronization operation when adding, deleting, or modifying authentication related information.

[0100] S110-S111. The cloud desktop client submodule sends a connection request to the cloud desktop service, and the connection request carries authentication information; the zero-trust gateway extracts the authentication information from the connection request, authenticates it to the security authentication center, and forwards the connection request to the cloud desktop server after successful authentication, so that the cloud desktop client submodule establishes a connection with the cloud desktop server;

[0101] When the client main module receives the login response from the CVM, it obtains the cloud desktop list of the cloud desktop user from the login response message. After the cloud desktop user selects a cloud desktop virtual machine in the cloud desktop client main interface and initiates a connection request for the selected cloud desktop virtual machine, the client main module will correspondingly start a client sub-module and transmit the cloud desktop information and authentication information of the selected cloud desktop to the client sub-module. After the client sub-module is started, it sends a connection request to the CVM based on the cloud desktop information and authentication information passed in by the client main module.

[0102] Step S110, step S111, and the step of CVM feeding back a connection response message to the cloud desktop client submodule can be implemented by referring to step S103, step S1040, and the step of CVM feeding back a connection response message to the cloud desktop client main module. For example, using the ClientHello message of TLS as the connection request message, carrying authentication information in the extension field of the ClientHello message header, and the zero-trust gateway extracting the authentication information from the connection request message for security authentication, etc., will not be repeated here.

[0103] After receiving the connection response message sent by CVM, the client submodule establishes a control connection with CVM. The established control connection is mainly used to complete the control functions of CVM on the client submodule such as status monitoring and policy issuance. The client submodule can periodically report the running status of the client submodule. When CVM does not receive the status information reported by the client submodule for a long time, it determines that the client submodule is faulty and promptly cuts off the connection between the client submodule and the corresponding virtual machine to release resources.

[0104] S112~S113. The client sub-module sends a connection request to the virtualization kernel platform CVK in the cloud desktop server, requesting to establish a virtual desktop protocol connection with the selected cloud desktop virtual machine, and carrying at least authentication information in the connection request; the zero trust gateway extracts the authentication information from the connection request, performs security authentication through the security authentication center, releases the connection request after successful authentication, and forwards the connection request to the cloud desktop server, so that the cloud desktop client and the cloud desktop server establish a virtual desktop protocol connection.

[0105] After startup, the client submodule initiates a connection request to CVK based on the cloud desktop address information and authentication information transmitted by the client main module to establish a virtual desktop protocol (Virtual Desktop Protocol, VDP) connection with the selected cloud desktop virtual machine. Different from the control connection established by the aforementioned steps S103, S105, and S110, the connection established by the steps S112 to S113 is a virtual desktop protocol connection, which is a data connection. Among them, the Simple Protocol for Independent Computing Environment (SPICE) is a high-performance, dynamic, adaptive remote presentation protocol, and the VDP protocol is a remote desktop protocol developed based on the SPICE protocol. The present invention does not limit the specific protocol type of the data connection.

[0106] The processing method of steps S112 to S113 can refer to steps S103 to S104 to extend the connection request message of the VDP protocol, and carry cloud desktop address information, authentication information, etc. in the extended field. Among them, the cloud desktop address information can be the CVK server address + port number, or it can be an independent IP address + port number allocated to the virtual machine.

[0107] The following example illustrates a method for extending the ClientHello message, which adds an extension field to the ClientHello message header, and the extension field may include the user token, application token, application identifier, terminal address and terminal identifier, forwarding destination IP address and destination port, etc. Steps S103, S105, S110 and S112 may all refer to the following example extension method to extend the connection request, login request and other messages.

[0108] {

[0109] "time":"1612350126",#unix timestamp

[0110] "user_token":"xxx",#User token

[0111] "app_token":"yyy",#Application token

[0112] "app_code":"zzz",#Application ID

[0113] "terminal_ip":"bb.bb.bb.bb",#The terminal IP where the cloud desktop client is located

[0114] "terminal_id":"zzz",#Terminal ID where the cloud desktop client is located, fill in the mac address

[0115] "forward_ip":"aa.aa.aa.aa",#The destination IP address to be forwarded.

[0116] "forward_port":"5888",#Destination port to be forwarded

[0117] }

[0118] For the cloud desktop data flow, it is slightly different from the control flow. When the CVK on the cloud desktop server provides cloud desktops with a server cluster, the address of the cloud desktop virtual machine to which the cloud desktop client data flow is connected is unknown to the administrator in advance, while the address of the CVM is known to the administrator. Therefore, the administrator can configure the address of the CVM on the zero-trust gateway. When the type field in the message header determines that the received message is a connection request message to establish a connection with the CVM or a login request message to log in to the CVM, the zero-trust gateway can forward the control flow message to the CVM through the pre-configured CVM address. For messages sent to the virtual machines on the CVK in the cluster, there are two ways to forward them. One is to carry the cloud desktop address information in the extension field, and the other is to parse the message and obtain the destination address and port in the inner message header.

[0119] When the zero-trust gateway receives a connection request or data message sent to a virtual machine on a CVK server in the CVK server cluster, if the extension field does not carry the cloud desktop address information (CVK server address and port), the zero-trust gateway cannot obtain the destination address of the message forwarding only from the extension field, so it is necessary to further parse the destination address and port in the inner message header, which will affect the forwarding efficiency to a certain extent. Therefore, in a preferred embodiment of the present invention, the extension field also includes two fields: the destination IP address forward_ip and the destination port forward_port of the message forwarding. The cloud desktop client informs the zero-trust gateway of the destination IP and port of the message through these two fields. The zero-trust gateway can directly obtain the forwarding destination address of the message through these two fields, thereby improving the forwarding efficiency. If these two fields are empty values, the zero-trust gateway can forward the message to a pre-configured default address, or further parse the message to obtain the destination address of the message.

[0120] When the CVK server receives the VDP connection request sent by the cloud desktop client sub-module, it sends a connection response message to the client sub-module. After receiving the connection response message from the CVK, the cloud desktop client sub-module can establish a connection with the cloud desktop virtual machine.

[0121] In the embodiment of the present invention, after the control connection and the data connection are successfully established, the corresponding control message transmission channel and the data message transmission channel are established. After the connection is established, the control message or data message transmitted in the transmission channel can be protected by the security mechanism of the channel itself to ensure the security of message transmission. For important messages transmitted in the channel, the aforementioned extension method for connection request and login request messages can also be referred to for extension to achieve better security.

[0122] Figure 2 A schematic diagram of the structure of an electronic device for implementing the zero-trust cloud desktop access method provided by an embodiment of the present invention is provided in an embodiment of the present invention. The device 200 includes: a processor 210 such as a central processing unit (CPU), a communication bus 220, a communication interface 240, and a storage medium 230. Among them, the processor 210 and the storage medium 230 can communicate with each other through the communication bus 220. The storage medium 230 stores a computer program, and when the computer program is executed by the processor 210, it can implement the functions of one or more steps in the zero-trust cloud desktop access method provided by the embodiment of the present invention. The functions implemented by the steps of the zero-trust cloud desktop access method provided by the present invention can be combined into a logical device in the form of program components, software modules, etc., and loaded and run in the storage medium 230, so as to cooperate with other program function modules to realize the access and application of virtual desktops in the zero-trust network security system.

[0123] Figure 2 In the example, the storage medium may include a random access memory (RAM) and may also include a non-volatile memory (NVM), such as at least one disk storage. In addition, the storage medium may also be at least one storage device located away from the aforementioned processor. The processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0124] It should be appreciated that embodiments of the present invention may be implemented or enforced by computer hardware, a combination of hardware and software, or by computer instructions stored in a non-transitory memory. The method may be implemented in a computer program using standard programming techniques, including a non-transitory storage medium configured with a computer program, wherein the storage medium so configured causes the computer to operate in a specific and predefined manner. Each program may be implemented in a high-level process or object-oriented programming language to communicate with a computer system. However, if necessary, the program may be implemented in an assembly or machine language. In any case, the language may be a compiled or interpreted language. In addition, the program may be run on a programmed ASIC for this purpose. In addition, the operation of the process described in the present invention may be performed in any suitable order, unless the present invention otherwise indicates or otherwise clearly contradicts the context. The process described in the present invention (or variations and / or combinations thereof) may be performed under the control of one or more computer systems configured with executable instructions, and may be implemented as a code (e.g., executable instructions, one or more computer programs, or one or more applications) executed on one or more processors in common, by hardware or a combination thereof. The computer program includes a plurality of instructions that may be executed by one or more processors.

[0125] Further, the method can be implemented in any type of computing platform that is operably connected to a suitable computer, including but not limited to a personal computer, a minicomputer, a mainframe, a workstation, a network or distributed computing environment, a separate or integrated computer platform, or in communication with a charged particle tool or other imaging device, etc. Various aspects of the present invention can be implemented in machine-readable code stored on a non-transitory storage medium or device, whether removable or integrated into a computing platform, such as a hard disk, an optical read and / or write storage medium, a RAM, a ROM, etc., so that it can be read by a programmable computer, and when the storage medium or device is read by the computer, it can be used to configure and operate the computer to perform the process described herein. In addition, the machine-readable code, or portions thereof, can be transmitted via a wired or wireless network. When such media includes instructions or programs that implement the steps described above in conjunction with a microprocessor or other data processor, the invention described in the present invention includes these and other different types of non-transitory computer-readable storage media. When programmed according to the methods and techniques of the present invention, the present invention also includes the computer itself.

[0126] The above description is only an embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A cloud desktop access method, characterized in that: The method is applied to a cloud desktop client, and the method includes: When the cloud desktop client is started, receiving authentication information transmitted by the security authentication portal; the authentication information comes from the security authentication center in the zero-trust network security framework; Sending a first connection request to the virtualization management platform of the cloud desktop server to establish a first control connection with the virtualization management platform; Sending a login request to the cloud desktop server through the first control connection to log in to the cloud desktop server; carrying the authentication information in the login request content field; Receiving a login response sent by the virtualization management platform, and obtaining a cloud desktop list from the login response; Acquire cloud desktop information of the selected cloud desktop from the cloud desktop list; A second connection request sent to the virtualization management platform based on the cloud desktop information and the authentication information to establish a second control connection with the virtualization management platform; Sending a virtual desktop protocol connection request to the virtualization kernel platform of the cloud desktop server to establish a data connection with the selected cloud desktop in the virtualization kernel platform of the cloud desktop server; The messages of the first connection request and the second connection request both include an extension field, the first connection request and the second connection request are intercepted by the zero trust gateway, the zero trust gateway authenticates the first connection request and the second connection request through the security authentication center, and releases them after successful authentication, the extension field carries the authentication information, and the authentication information is used by the zero trust gateway to authenticate the first connection request and the second connection request through the security authentication center.

2. The method according to claim 1, characterized in that The cloud desktop client includes a client main module and a client submodule; The method for the cloud desktop client to establish a connection with the selected cloud desktop in the cloud desktop list is: The client main module obtains the cloud desktop information of the selected cloud desktop from the cloud desktop list; The client main module starts a client submodule for connecting to the selected cloud desktop, and transmits the cloud desktop information and authentication information of the selected cloud desktop to the client submodule; The client submodule establishes a control connection with the virtualization management platform based on the cloud desktop information and the authentication information, and establishes a data connection with the selected cloud desktop located in the virtualization kernel platform.

3. The method according to claim 2, characterized in that The process of the cloud desktop client interacting with the cloud desktop server to establish a control connection includes: A process in which the client main module sends a first connection request to the virtualization management platform to establish a connection with the virtualization management platform; and The client submodule sends a second connection request to the virtualization management platform based on the cloud desktop information and the authentication information to establish a control connection with the virtualization management platform; Wherein, both the first connection request and the second connection request messages include the extension field.

4. The method according to any one of claims 1 to 3, characterized in that The authentication information at least includes: a user token and an application token; or The authentication information at least includes: a user token, an application token, and two fields: a destination IP address and a destination port for message forwarding.

5. A zero-trust cloud desktop access method, characterized in that: The method is applied to a zero-trust gateway, and the method includes: Receive a control connection request sent by the cloud desktop client to the cloud desktop server, extract authentication information from the control connection request, authenticate the control connection request through a security authentication center in a zero-trust network security framework, and release the control connection request after successful authentication; Receiving a login request sent by the cloud desktop client to the cloud desktop server through the established connection with the cloud desktop server, and forwarding the login request to the cloud desktop server; Receive a virtual desktop protocol connection request for connecting to a selected cloud desktop sent by a cloud desktop client to a cloud desktop server, extract authentication information from the virtual desktop protocol connection request, authenticate the virtual desktop protocol connection request through a security authentication center in a zero-trust network security framework, and release the virtual desktop protocol connection request after successful authentication; The control connection request includes a first connection request sent by the cloud desktop client to the virtualization management platform of the cloud desktop server and a second connection request sent by the cloud desktop client to the virtualization kernel platform of the cloud desktop server; wherein, both the first connection request and the second connection request messages include an extension field, and the extension field carries the authentication information; the authentication information of the cloud desktop client is generated by the security authentication portal in the zero-trust network security framework after authenticating the cloud desktop user, and is transmitted to the cloud desktop client by the security authentication portal when the cloud desktop client is started.

6. The method according to claim 5, characterized in that The receiving of a control connection request sent by the cloud desktop client to the cloud desktop server includes: Receiving a first connection request sent by a client main module of the cloud desktop client to a virtualization management platform of the cloud desktop server; and A second connection request is received, which is sent by the client submodule of the cloud desktop client to the virtualization kernel platform of the cloud desktop server.

7. The method according to any one of claims 5 to 6, characterized in that The authentication information at least includes: a user token and an application token; or The authentication information at least includes: a user token, an application token, and two fields: a destination IP address and a destination port for message forwarding.

8. A cloud desktop client, characterized in that: The cloud desktop client includes a client main module and a client submodule; The client main module is used to obtain authentication information transmitted by the security authentication portal when the cloud desktop client is started; The authentication information comes from the security authentication center in the zero-trust network security framework; The client main module is also used to send a first connection request to the virtualization management platform of the cloud desktop server to establish a first control connection with the virtualization management platform; send a login request to the cloud desktop server through the first control connection to log in to the cloud desktop server; carry the authentication information in the login request content field; The client main module is also used to receive a login response sent by the virtualization management platform, and obtain a cloud desktop list from the login response; Acquire cloud desktop information of the selected cloud desktop from the cloud desktop list; start a client submodule for connecting to the selected cloud desktop, and transfer the cloud desktop information and authentication information of the selected cloud desktop to the client submodule; The client submodule is used to send a second connection request to the virtualization management platform based on the cloud desktop information and the authentication information to establish a second control connection with the virtualization management platform; and sending a virtual desktop protocol connection request to the virtualization kernel platform of the cloud desktop server to establish a data connection with the selected cloud desktop in the virtualization kernel platform of the cloud desktop server; The messages of the first connection request and the second connection request both include an extension field, the first connection request and the second connection request are intercepted by the zero trust gateway, the zero trust gateway authenticates the first connection request and the second connection request through the security authentication center, and releases them after successful authentication, the extension field carries the authentication information, and the authentication information is used by the zero trust gateway to authenticate the first connection request and the second connection request through the security authentication center.

9. The cloud desktop client according to claim 8, characterized in that: The authentication information at least includes: a user token and an application token; or The authentication information at least includes: a user token, an application token, and two fields: a destination IP address and a destination port for message forwarding.

10. A zero-trust gateway, characterized in that: The zero trust gateway includes: A first authentication forwarding module is used to receive a first connection request sent by a client main module of a cloud desktop client to a virtualization management platform of a cloud desktop server, extract authentication information from the first connection request, authenticate the first connection request through a security authentication center in a zero-trust network security framework, and release the first connection request after successful authentication; and receive and forward a login request sent by the client main module to the virtualization management platform; A second authentication forwarding module is used to receive a second connection request sent by a client submodule of the cloud desktop client to the virtualization management platform of the cloud desktop server, and a virtual desktop protocol connection request sent by the client submodule of the cloud desktop client to the virtualization kernel platform of the cloud desktop server, extract authentication information from the second connection request and the virtual desktop protocol connection request, authenticate the second connection request and the virtual desktop protocol connection request through a security authentication center in a zero-trust network security framework, and release the second connection request and the virtual desktop protocol connection request after successful authentication; Among them, the messages of the first connection request and the second connection request both carry an extension field, and the authentication information is carried in the extension field; the authentication information of the cloud desktop client is generated by the security authentication portal in the zero-trust network security framework after authenticating the cloud desktop user, and is transmitted to the cloud desktop client by the security authentication portal when the cloud desktop client is started.

11. The zero-trust gateway according to claim 10, characterized in that: The authentication information at least includes: a user token and an application token; or The authentication information at least includes: a user token, an application token, and two fields: a destination IP address and a destination port for message forwarding.

12. An electronic device, characterized in that: It includes a processor, a communication interface, a storage medium and a communication bus, wherein the processor, the communication interface and the storage medium communicate with each other via the communication bus; Storage medium for storing computer programs; A processor, for implementing the method steps described in any one of claims 1 to 7 when executing a computer program stored on a storage medium.

Images