Baseboard management controller initial password generation method, device and computer equipment

Abstract

The present application relates to server security technology and provides a method, apparatus, and computer device for generating an initial password for a baseboard management controller. The method comprises obtaining a unique identification code of a BMC chip as a first identification code; obtaining a user requirement text and extracting and converting it accordingly to obtain a second identification code; obtaining an encryption strategy from multiple encryption strategies as a target encryption strategy; encrypting the first identification code using the target encryption strategy to obtain first encrypted data and storing it as the initial password of the baseboard management controller; encrypting the second identification code using the target encryption strategy to obtain second encrypted data and storing it as the initial account number of the baseboard management controller. The baseboard management controller password is generated based on the encryption of the unique identification code of the BMC chip, and the baseboard management controller account number is generated based on the user requirement text. The initial generated account number and password initial data are highly secure and can still protect the security of the BMC system when the initial account number and password are not modified.

Description

Technical Field

[0001] The present application relates to the field of server security technology, and in particular to a method, device, and computer equipment for generating an initial password for a baseboard management controller. Background Art

[0002] With the increasing prevalence of internet applications, the number of servers deployed worldwide has reached a massive scale, and server security has become a key research topic. Baseboard Management Controller (BMC) chips are often deployed in mid-range and high-end servers. BMCs perform a range of monitoring and control functions, managing system hardware.

[0003] As the server's "master steward," the BMC has extensive management authority (such as power on / off, cooling control, and more), making its security extremely important. To ensure secure BMC operation, protecting its account and password is crucial. Currently, a common solution is to generate a unified initial login account and password at the factory or during firmware compilation, which the user then modifies during use.

[0004] However, this common solution doesn't account for security risks during user deployment. Users might connect servers to the network first and then modify their passwords one by one. The time it takes to modify the initial passwords during network access presents a risk of network attacks. A single, unified initial password offers no protection, and if someone forgets to change the initial password after server deployment, it poses a significant security risk. When deploying in batches, modifying the initial passwords is time-consuming, labor-intensive, and error-prone, and can be easily missed when the network is unstable. Summary of the Invention

[0005] The embodiments of the present application provide a method, apparatus, and computer device for generating an initial password for a baseboard management controller, aiming to solve the problem that a baseboard management controller generates an initial account and password for a unified login when it leaves the factory or when the firmware is compiled. When a user deploys the baseboard management controller, he or she may first connect the server to the network and then modify it one by one. This not only poses a data security risk, but also causes low modification efficiency and is prone to errors.

[0006] In a first aspect, an embodiment of the present application provides a method for generating an initial password of a baseboard management controller, comprising:

[0007] Get the unique identification code of the BMC chip as the first identification code;

[0008] Obtaining a user demand text, performing user index extraction and index coding on the user demand text to obtain a second identification code;

[0009] Obtaining an encryption policy from a plurality of pre-stored encryption policies as a target encryption policy;

[0010] Encrypting the first identification code using a target encryption strategy to obtain first encrypted data as an initial password for the baseboard management controller;

[0011] Encrypting the second identification code using the target encryption policy to obtain second encrypted data as the initial account of the baseboard management controller;

[0012] The baseboard management controller initial password and the baseboard management controller initial account are stored in a preset storage area.

[0013] In a second aspect, an embodiment of the present application provides a baseboard management controller initial password generation device, comprising:

[0014] A first generating module is used to obtain a unique identification code of the BMC chip as a first identification code;

[0015] The second generating module is used to obtain the user demand text, perform user index extraction and index encoding on the user demand text, and obtain a second identification code;

[0016] A target encryption policy acquisition module is used to acquire an encryption policy from a plurality of pre-stored encryption policies as a target encryption policy;

[0017] A first encryption module is used to encrypt the first identification code using a target encryption strategy to obtain first encrypted data as an initial password of the baseboard management controller;

[0018] A second encryption module is used to encrypt the second identification code using a target encryption policy to obtain second encrypted data as an initial account of the baseboard management controller;

[0019] The data storage module is used to store the initial password of the baseboard management controller and the initial account number of the baseboard management controller in a preset storage area.

[0020] In a third aspect, an embodiment of the present application provides a computer device, which includes a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the computer program, the baseboard management controller initial password generation method of the first aspect mentioned above is implemented.

[0021] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor executes the baseboard management controller initial password generation method of the first aspect mentioned above.

[0022] The embodiment of the present application provides a method, apparatus, and computer device for generating an initial password for a baseboard management controller, which comprises obtaining a unique identification code of a BMC chip as a first identification code; obtaining a user requirement text and extracting and converting it accordingly to obtain a second identification code; obtaining an encryption strategy from multiple encryption strategies as a target encryption strategy; encrypting the first identification code using the target encryption strategy to obtain first encrypted data and storing it as the initial password of the baseboard management controller; encrypting the second identification code using the target encryption strategy to obtain second encrypted data and storing it as the initial account of the baseboard management controller. The baseboard management controller password is generated based on the encryption of the unique identification code of the BMC chip, and the baseboard management controller account is generated based on the user requirement text. The initial generated account and password data have high security, and can still protect the security of the BMC system when the initial account and password are not modified. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0024] Figure 1 A schematic diagram of an application scenario of the method for generating an initial password for a baseboard management controller provided in an embodiment of the present application;

[0025] Figure 2 A flow chart of a method for generating an initial password for a baseboard management controller according to an embodiment of the present application;

[0026] Figure 3 A schematic diagram of a sub-process of a method for generating an initial password for a baseboard management controller provided in an embodiment of the present application;

[0027] Figure 4 A schematic diagram of another sub-flow of the method for generating an initial password for a baseboard management controller provided in an embodiment of the present application;

[0028] Figure 5 Another flowchart of the method for generating an initial password for a baseboard management controller provided in an embodiment of the present application;

[0029] Figure 6 A schematic block diagram of a device for generating an initial password for a baseboard management controller according to an embodiment of the present application;

[0030] Figure 7 A schematic block diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0032] It will be understood that when used in this specification and the appended claims, the terms “comprises” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0033] It should also be understood that the terms used in this specification are for the purpose of describing specific embodiments only and are not intended to limit the present application. As used in this specification and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0034] It should be further understood that the term "and / or" used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0035] See also Figure 1 and Figure 2 , Figure 1 A schematic diagram of an application scenario of the method for generating an initial password for a baseboard management controller provided in an embodiment of the present application; Figure 2 This is a flow chart of a method for generating an initial password for a baseboard management controller provided in an embodiment of the present application. The method for generating an initial password for a baseboard management controller is applied to a baseboard management controller.

[0036] like Figure 2 As shown, the method includes steps S101 to S106.

[0037] S101. Obtain a unique identification code of a BMC chip as a first identification code; wherein the unique identification code of the BMC chip is a unique identification code of a baseboard management controller chip.

[0038] In this embodiment, the technical solution is described with the baseboard management controller in the server as the execution subject. When the baseboard management controller (i.e., BMC, the full name of BMC is Baseboard Management Controller, BMC is the remote management controller that executes the server, and is also a small operating system independent of the server system; BMC is a chip integrated on the server motherboard, or plugged into the server motherboard through PCIE and other forms and its external appearance is just a standard RJ45 network port with an independent IP address firmware system) is started and starts running, the BMC chip unique identification code is obtained as the first identification code. Because the BMC chip unique identification code is read-only and unique (read-only ensures that the BMC chip unique identification code cannot be modified), it is not the same as any other chip (other chips are chips of any company, any type, and any model), so obtaining the BMC chip unique identification code as the first identification code can be used as the first password seed (the password seed can be understood as the original data before it is encrypted by the encryption strategy).

[0039] S102: Obtain a user demand text, perform user index extraction and index coding on the user demand text, and obtain a second identification code.

[0040] In this embodiment, after establishing a remote communication connection with the baseboard management controller through a user terminal (such as a tablet computer, a laptop computer, etc.), the user can send a user demand text to the baseboard management controller by operating the user terminal to propose a demand for a BMC account name. For example, the user demand text includes at least a user name and a user name conversion identifier for identifying whether the user name remains in the original text. After receiving the user demand text, the baseboard management controller can extract and convert the core keywords or key values ​​(such as the user name and the user name conversion identifier) ​​in the user demand text (such as converting the core keywords from Chinese characters to English characters or numeric characters can be regarded as a conversion method) as a user index, and then index encode the user index to obtain a second identification code. Because the generation process of the second identification code is triggered by the user demand text, the corresponding second identification codes can be generated based on different user demand texts, thereby achieving the difference and diversity of the generation of the second identification code.

[0041] In one embodiment, if Figure 3 As shown, step S102 includes:

[0042] S1021. Obtain the user requirement text including the user name and the user name conversion identifier;

[0043] S1022: If it is determined that the user name conversion flag corresponds to a non-conversion flag, use the user name as a user index;

[0044] S1023: If it is determined that the user name conversion identifier corresponds to the conversion identifier, encoding the user name based on a preset user name encoding strategy to obtain an encoding result, and using the encoding result as the user index;

[0045] S1024: Encode the user index based on a preset index encoding strategy to obtain the second identification code.

[0046] In this embodiment, the technical solution is described in detail with reference to a specific example. In this specific example, the user requirement text is "Company A, Department A, no requirements for account privacy", and the baseboard management controller extracts the core keywords "Company A, Department A" and "no requirements" in the user requirement text based on a pre-stored regular expression or keyword extraction model (such as the Jieba word segmentation model combined with the word frequency-inverse file frequency model to form a keyword extraction model).

[0047] First, the core keyword "Company A, Department A" is used as the user name. Then, the core keyword "No requirement" is converted to the corresponding user name conversion flag "0" (wherein, when the user name conversion flag is 0, it means that the user name remains in the original text, that is, when the user name conversion flag is 0, it corresponds to the no conversion flag; when the user name conversion flag is 1, it means that the user name does not remain in the original text and needs to be further converted to another form, that is, when the user name conversion flag is 1, it corresponds to the conversion flag). Finally, if it is determined that the user name conversion flag corresponds to the no conversion flag, the user name "Company A, Department A" is directly used as the user index.

[0048] If the user requirement text in the above example is replaced with "Company A, Department A, has requirements for account privacy", the baseboard management controller will also extract the core keywords "Company A, Department A" and "have requirements" in the user requirement text based on the regular expression or keyword extraction model pre-stored therein. Similarly, the core keyword "Company A, Department A" is first used as the user name, and then the core keyword "have requirements" is converted into the corresponding username conversion identifier "1". Finally, if it is determined that the username conversion identifier corresponds to the conversion identifier, the username "Company A, Department A" is directly encoded based on the preset username encoding strategy to obtain the encoding result, and the encoding result is used as the user index.

[0049] In one embodiment, encoding the user name based on a preset user name encoding strategy to obtain an encoding result includes:

[0050] Converting characters of a preset character type in the user name into characters of a first preset character type to obtain an encoding result;

[0051] Alternatively, random encoding results obtained by randomly encoding each character in the user name in sequence are connected to obtain the encoding result.

[0052] In this embodiment, when the user name is encoded based on a preset user name encoding strategy, the user name encoding strategy is used to convert characters with a preset character type in the user name into characters of a first preset character type. For example, if the preset character type is a numeric character and the first preset character type is an English character, then all the numeric characters in the user name are replaced with English characters based on the user name encoding strategy); or the user name encoding strategy is used to randomly encode each character in the user name and connect the random encoding results. Specifically, each character in the user name is first randomly encoded in order according to its order in the user name to obtain a random encoding result corresponding to each character, and then the random encoding results of each character are connected based on the concat function according to the previous order of each character in the user name to obtain an encoding result. Based on the user name encoding strategy, the user name can be effectively converted into a conversion similar to desensitization or encryption, thereby obtaining an encoding result that is different from the original user name, and the encoding result is used as the user index corresponding to the user demand text.

[0053] S103: Obtain an encryption policy from a plurality of pre-stored encryption policies as a target encryption policy.

[0054] In this embodiment, multiple encryption strategies (which can also be understood as multiple encryption algorithms) can be pre-stored in the baseboard management controller, such as symmetric encryption algorithms and asymmetric encryption algorithms. Symmetric encryption algorithms include at least encryption algorithms such as the Data Encryption Standard symmetric encryption algorithm (i.e., the DES symmetric encryption algorithm), the Triple Data Encryption Algorithm (i.e., the 3DES symmetric encryption algorithm), and the Advanced Encryption System encryption algorithm (i.e., the AES symmetric encryption algorithm). Asymmetric encryption algorithms include at least encryption algorithms based on factorization (i.e., the RSA encryption algorithm), encryption algorithms based on discrete logarithms (i.e., the ElGamal encryption algorithm), and key exchange algorithms (i.e., the DH encryption algorithm). After obtaining the first identification code and the second identification code, an encryption strategy can be obtained from the multiple encryption strategies pre-stored in the baseboard management controller as the target encryption strategy, such as selecting the DH encryption algorithm as the target encryption strategy.

[0055] In one embodiment, if Figure 4 As shown, step S103 includes:

[0056] S1031. Obtain a username conversion identifier in the user requirement text, and obtain a current identifier value corresponding to the username conversion identifier;

[0057] S1032. According to the sequence number corresponding to the current identification value, obtain the encryption policy corresponding to the sequence number from multiple encryption policies as the target encryption policy.

[0058] In this embodiment, in order to quickly obtain one of the encryption strategies stored in the baseboard management controller as the target encryption strategy, the user name conversion identifier in the user requirement text can be obtained, such as its value is 1, and then the value 1 is directly used as the sequence number to randomly select an encryption strategy from the first group of multiple encryption strategies (such as the corresponding asymmetric encryption algorithm group) as the target encryption strategy, such as using the DH encryption algorithm in the asymmetric encryption algorithm group as the selected encryption strategy and as the target encryption strategy. It can be seen that based on the sequence number corresponding to the current identifier value, an encryption strategy can be quickly obtained from multiple encryption strategies as the target encryption strategy.

[0059] Of course, an encryption strategy can also be obtained from multiple encryption strategies as a target encryption strategy based on other methods. For example, the user requirement text can also include the user type, and the encryption strategy corresponding to the user type can be directly obtained in the baseboard management controller based on the user type as the target encryption strategy.

[0060] In one embodiment, if Figure 5 As shown, before step S103, the following steps are also included:

[0061] S103a: Save the first identification code as first password seed data, and save the second identification code as second password seed data.

[0062] In this embodiment, after the first and second identification codes are acquired by the baseboard management controller, the first identification code can be used as first cryptographic seed data and stored in the baseboard management controller for subsequent distribution and use. Similarly, the second identification code can be used as second cryptographic seed data and stored in the baseboard management controller for subsequent distribution and use. Furthermore, storing the first and second identification codes allows the baseboard management controller to more quickly acquire and promptly transmit the seed data when it receives a seed data acquisition request.

[0063] S104: Encrypt the first identification code using the target encryption policy to obtain first encrypted data as an initial password for the baseboard management controller.

[0064] In this embodiment, after the first identification code is obtained in the baseboard management controller, the first identification code can be encrypted based on the target encryption policy to obtain first encrypted data, and the first encrypted data is used as the initial password of the baseboard management controller. Because the first identification code is unique, it can be encrypted by the encryption algorithm to further enhance data security.

[0065] S105: Encrypt the second identification code using the target encryption policy to obtain second encrypted data and use it as the initial account of the baseboard management controller.

[0066] In this embodiment, after the second identification code is obtained from the baseboard management controller, it can be encrypted based on the target encryption policy to obtain second encrypted data, which is then used as the initial account number of the baseboard management controller. Because the second identification code is also unique, encryption by the encryption algorithm can further enhance data security.

[0067] S106: Storing the baseboard management controller initial password and the baseboard management controller initial account number in a preset storage area.

[0068] In this embodiment, after the baseboard management controller initial password and the baseboard management controller initial account are obtained in the baseboard management controller, the baseboard management controller initial password and the baseboard management controller initial account can be stored as a pair of binding data in a preset storage area in the baseboard management controller for subsequent data calling and data distribution.

[0069] In one embodiment, if Figure 5 As shown, after step S106, the following steps are further included:

[0070] S107: If a seed data acquisition request sent by a requesting end is detected, the first identification code is sent as first password seed data to the requesting end, and the second identification code is sent as second password seed data to the requesting end.

[0071] In this embodiment, a user can use a server equipped with the baseboard management controller as a requesting end to send a seed data acquisition request to the baseboard management controller, or can use a user terminal as a requesting end to send a seed data acquisition request to the baseboard management controller. After the baseboard management controller receives the seed data acquisition request, it can obtain the first identification code and the second identification code from the storage area where the seed data is locally stored, and send the first identification code as the first password seed data and the second identification code as the second password seed data to the requesting end.

[0072] When the requesting end obtains the first password seed data and the second password seed data, it can also encrypt the first password seed data and the second password seed data respectively based on the same encryption policy as the target encryption policy, thereby obtaining the baseboard management controller initial password and baseboard management controller initial account number on the requesting end. The user can then log in to the baseboard management controller system based on the baseboard management controller initial password and baseboard management controller initial account number.

[0073] In one embodiment, after detecting the seed data acquisition request sent by the requesting end, before sending the first identification code as the first password seed data to the requesting end and before sending the second identification code as the second password seed data to the requesting end, further comprising:

[0074] Establish a communication connection with the requesting end based on any one of the Web protocol, Redfish protocol or IPMI protocol; wherein the Web protocol is a network protocol, the Redfish protocol is a management standard protocol based on Hypertext Transfer Protocol Security Service, and the IPMI protocol is an Intelligent Platform Management Interface protocol.

[0075] In this embodiment, when the request end communicates with the baseboard management controller, it can be based on any one of the Web protocol, the Redfish protocol, or the IPMI protocol.

[0076] When the baseboard management controller establishes a communication connection with the requesting end based on a web protocol, the requesting end logs into the website corresponding to the baseboard management controller. When a user browses the baseboard management controller's website, a prompt box pops up, requiring the user to enter the account and password registered by the requesting end on the website. After successfully logging into the website, the first password seed data and the second password seed data are displayed to the user as attachments in the user prompt box on the website. This way, the user obtains the password seed data and can use it to regenerate the baseboard management controller's initial password and initial baseboard management controller account.

[0077] When the baseboard management controller establishes a communication connection with the requesting end based on the Redfish protocol, since the Redfish protocol is a management standard based on HTTPs service, the device management is implemented using the RESTful interface. The baseboard management controller complies with the RESTful interface specification. After the baseboard management controller receives the API request from the requesting end (the API request is the application program interface request), it will respond to the API request and return the accompanying information to the requesting end. In this way, the baseboard management controller can return the first password seed data and the second password seed data to the requesting end as the attached information as the response information, thereby completing the distribution of the password seed. Since the password seed distribution is adopted instead of directly writing the account password, the flexibility is improved and the probability of error is reduced. Moreover, the password seed distribution is adopted in this application to replace the conventional plain text account password to ensure security. Among them, the Redfish interface can be set to not require verification.

[0078] When the baseboard management controller establishes a communication connection with the requester based on the IPMI protocol, similar to Redfish, upon receiving the IPMI request from the requester, the baseboard management controller will respond to the IPMI request and return the attached information to the requester. In this way, the baseboard management controller can return the first and second cryptographic seed data as attached information to the requester, thus completing the distribution of the cryptographic seed.

[0079] After the requesting end obtains the first password seed data and the second password seed data, it encrypts the first password seed data and the second password seed data using the same encryption policy as the target encryption policy, thereby obtaining the baseboard management controller initial password and baseboard management controller initial account number on the requesting end. The user can then log in to the baseboard management controller system using the baseboard management controller initial password and baseboard management controller initial account number.

[0080] This method realizes that the baseboard management controller password is encrypted and generated based on the first identification code corresponding to the unique identification code of the BMC chip, and the baseboard management controller account is encrypted and generated based on the second identification code corresponding to the user's required text. Afterwards, the first identification code and the second identification code can be sent to the requesting end as password seed data. Through the above method, firstly, a first identification code that is unique to the data and a second identification code with a flexible encoding generation process are obtained; secondly, the initial data security of the initially generated account and password is relatively high, and the security of the BMC system can still be protected when the initial account and password are not modified; thirdly, the password seed is distributed to the requesting end instead of directly writing the account and password, which improves flexibility, reduces the probability of error, and ensures data security.

[0081] The present application also provides a baseboard management controller initial password generation device, which is used to execute any embodiment of the above-mentioned baseboard management controller initial password generation method. Figure 6 , Figure 6 1 is a schematic block diagram of a baseboard management controller initial password generating device 100 provided in an embodiment of the present application.

[0082] Among them, Figure 6 As shown, the baseboard management controller initial password generation device 100 includes a first generation module 101 , a second generation module 102 , a target encryption policy acquisition module 103 , a first encryption module 104 , a second encryption module 105 and a data storage module 106 .

[0083] The first generating module 101 is configured to obtain a unique identification code of a BMC chip as a first identification code; wherein the unique identification code of the BMC chip is a unique identification code of a baseboard management controller chip.

[0084] In this embodiment, the technical solution is described with the baseboard management controller in the server as the execution subject. When the baseboard management controller (i.e., BMC, the full name of BMC is Baseboard Management Controller, BMC is the remote management controller that executes the server, and is also a small operating system independent of the server system; BMC is a chip integrated on the server motherboard, or plugged into the server motherboard through PCIE and other forms and its external appearance is just a standard RJ45 network port with an independent IP address firmware system) is started and starts running, the BMC chip unique identification code is obtained as the first identification code. Because the BMC chip unique identification code is read-only and unique (read-only ensures that the BMC chip unique identification code cannot be modified), it is not the same as any other chip (other chips are chips of any company, any type, and any model), so obtaining the BMC chip unique identification code as the first identification code can be used as the first password seed (the password seed can be understood as the original data before it is encrypted by the encryption strategy).

[0085] The second generating module 102 is used to obtain a user demand text, perform user index extraction and index coding on the user demand text, and obtain a second identification code.

[0086] In this embodiment, after establishing a remote communication connection with the baseboard management controller through a user terminal (such as a tablet computer, a laptop computer, etc.), the user can send a user demand text to the baseboard management controller by operating the user terminal to propose a demand for a BMC account name. For example, the user demand text includes at least a user name and a user name conversion identifier for identifying whether the user name remains in the original text. After receiving the user demand text, the baseboard management controller can extract and convert the core keywords or key values ​​(such as the user name and the user name conversion identifier) ​​in the user demand text (such as converting the core keywords from Chinese characters to English characters or numeric characters can be regarded as a conversion method) as a user index, and then index encode the user index to obtain a second identification code. Because the generation process of the second identification code is triggered by the user demand text, the corresponding second identification codes can be generated based on different user demand texts, thereby achieving the difference and diversity of the generation of the second identification code.

[0087] In one embodiment, the second generating module 102 is configured to:

[0088] Obtaining the user requirement text including the user name and the user name conversion identifier;

[0089] If it is determined that the user name conversion flag corresponds to the non-conversion flag, the user name is used as the user index;

[0090] If it is determined that the user name conversion identifier corresponds to the conversion identifier, encoding the user name based on a preset user name encoding strategy to obtain an encoding result, and using the encoding result as the user index;

[0091] The user index is encoded based on a preset index encoding strategy to obtain the second identification code.

[0092] In this embodiment, the technical solution is described in detail with reference to a specific example. In this specific example, the user requirement text is "Company A, Department A, no requirements for account privacy", and the baseboard management controller extracts the core keywords "Company A, Department A" and "no requirements" in the user requirement text based on a pre-stored regular expression or keyword extraction model (such as the Jieba word segmentation model combined with the word frequency-inverse file frequency model to form a keyword extraction model).

[0093] First, the core keyword "Company A, Department A" is used as the user name. Then, the core keyword "No requirement" is converted to the corresponding user name conversion flag "0" (wherein, when the user name conversion flag is 0, it means that the user name remains in the original text, that is, when the user name conversion flag is 0, it corresponds to the no conversion flag; when the user name conversion flag is 1, it means that the user name does not remain in the original text and needs to be further converted to another form, that is, when the user name conversion flag is 1, it corresponds to the conversion flag). Finally, if it is determined that the user name conversion flag corresponds to the no conversion flag, the user name "Company A, Department A" is directly used as the user index.

[0094] If the user requirement text in the above example is replaced with "Company A, Department A, has requirements for account privacy", the baseboard management controller will also extract the core keywords "Company A, Department A" and "have requirements" in the user requirement text based on the regular expression or keyword extraction model pre-stored therein. Similarly, the core keyword "Company A, Department A" is first used as the user name, and then the core keyword "have requirements" is converted into the corresponding username conversion identifier "1". Finally, if it is determined that the username conversion identifier corresponds to the conversion identifier, the username "Company A, Department A" is directly encoded based on the preset username encoding strategy to obtain the encoding result, and the encoding result is used as the user index.

[0095] In one embodiment, encoding the user name based on a preset user name encoding strategy to obtain an encoding result includes:

[0096] Converting characters of a preset character type in the user name into characters of a first preset character type to obtain an encoding result;

[0097] Alternatively, random encoding results obtained by randomly encoding each character in the user name in sequence are connected to obtain the encoding result.

[0098] In this embodiment, when the user name is encoded based on a preset user name encoding strategy, the user name encoding strategy is used to convert characters with a preset character type in the user name into characters of a first preset character type. For example, if the preset character type is a numeric character and the first preset character type is an English character, then all the numeric characters in the user name are replaced with English characters based on the user name encoding strategy); or the user name encoding strategy is used to randomly encode each character in the user name and connect the random encoding results. Specifically, each character in the user name is first randomly encoded in order according to its order in the user name to obtain a random encoding result corresponding to each character, and then the random encoding results of each character are connected based on the concat function according to the previous order of each character in the user name to obtain an encoding result. Based on the user name encoding strategy, the user name can be effectively converted into a conversion similar to desensitization or encryption, thereby obtaining an encoding result that is different from the original user name, and the encoding result is used as the user index corresponding to the user demand text.

[0099] The target encryption policy acquisition module 103 is configured to acquire an encryption policy from a plurality of pre-stored encryption policies as a target encryption policy.

[0100] In this embodiment, multiple encryption strategies (which can also be understood as multiple encryption algorithms) can be pre-stored in the baseboard management controller, such as symmetric encryption algorithms and asymmetric encryption algorithms. Symmetric encryption algorithms include at least encryption algorithms such as the Data Encryption Standard symmetric encryption algorithm (i.e., the DES symmetric encryption algorithm), the Triple Data Encryption Algorithm (i.e., the 3DES symmetric encryption algorithm), and the Advanced Encryption System encryption algorithm (i.e., the AES symmetric encryption algorithm). Asymmetric encryption algorithms include at least encryption algorithms based on factorization (i.e., the RSA encryption algorithm), encryption algorithms based on discrete logarithms (i.e., the ElGamal encryption algorithm), and key exchange algorithms (i.e., the DH encryption algorithm). After obtaining the first identification code and the second identification code, an encryption strategy can be obtained from the multiple encryption strategies pre-stored in the baseboard management controller as the target encryption strategy, such as selecting the DH encryption algorithm as the target encryption strategy.

[0101] In one embodiment, the target encryption policy acquisition module 103 is used to:

[0102] Obtaining a username conversion identifier in the user requirement text, and obtaining a current identifier value corresponding to the username conversion identifier;

[0103] According to the sequence number corresponding to the current identification value, an encryption policy corresponding to the sequence number is obtained from multiple encryption policies as the target encryption policy.

[0104] In this embodiment, in order to quickly obtain one of the multiple encryption strategies stored in the baseboard management controller as the target encryption strategy, the user name conversion identifier in the user requirement text can be obtained, such as if its value is 1, and then the value 1 is directly used as the sequence number to randomly select an encryption strategy from the first group of multiple encryption strategies (such as the corresponding asymmetric encryption algorithm group) as the target encryption strategy, such as using the DH encryption algorithm in the asymmetric encryption algorithm group as the selected encryption strategy as the target encryption strategy. It can be seen that based on the sequence number corresponding to the current identifier value, an encryption strategy can be quickly obtained from multiple encryption strategies as the target encryption strategy.

[0105] Of course, an encryption strategy can also be obtained from multiple encryption strategies as a target encryption strategy based on other methods. For example, the user requirement text can also include the user type, and the encryption strategy corresponding to the user type can be directly obtained in the baseboard management controller based on the user type as the target encryption strategy.

[0106] In one embodiment, the baseboard management controller initial password generation device 100 further includes:

[0107] The seed data storage module is configured to store the first identification code as first password seed data and store the second identification code as second password seed data.

[0108] In this embodiment, after the first and second identification codes are acquired by the baseboard management controller, the first identification code can be used as first cryptographic seed data and stored in the baseboard management controller for subsequent distribution and use. Similarly, the second identification code can be used as second cryptographic seed data and stored in the baseboard management controller for subsequent distribution and use. Furthermore, storing the first and second identification codes allows the baseboard management controller to more quickly acquire and promptly transmit the seed data when it receives a seed data acquisition request.

[0109] The first encryption module 104 is configured to encrypt the first identification code using the target encryption policy to obtain first encrypted data as an initial password for the baseboard management controller.

[0110] In this embodiment, after the first identification code is obtained in the baseboard management controller, the first identification code can be encrypted based on the target encryption policy to obtain first encrypted data, and the first encrypted data is used as the initial password of the baseboard management controller. Because the first identification code is unique, it can be encrypted by the encryption algorithm to further enhance data security.

[0111] The second encryption module 105 is configured to encrypt the second identification code using the target encryption policy to obtain second encrypted data as the initial account of the baseboard management controller.

[0112] In this embodiment, after the second identification code is obtained from the baseboard management controller, it can be encrypted based on the target encryption policy to obtain second encrypted data, which is then used as the initial account number of the baseboard management controller. Because the second identification code is also unique, encryption by the encryption algorithm can further enhance data security.

[0113] The data storage module 106 is configured to store the baseboard management controller initial password and the baseboard management controller initial account number in a preset storage area.

[0114] In this embodiment, after the baseboard management controller initial password and the baseboard management controller initial account are obtained in the baseboard management controller, the baseboard management controller initial password and the baseboard management controller initial account can be stored as a pair of binding data in a preset storage area in the baseboard management controller for subsequent data calling and data distribution.

[0115] In one embodiment, the baseboard management controller initial password generation device 100 further includes:

[0116] The seed data sending module is used to send the first identification code as first password seed data to the requesting end and send the second identification code as second password seed data to the requesting end if a seed data acquisition request sent by the requesting end is detected.

[0117] In this embodiment, a user can use a server equipped with the baseboard management controller as a requesting end to send a seed data acquisition request to the baseboard management controller, or can use a user terminal as a requesting end to send a seed data acquisition request to the baseboard management controller. After the baseboard management controller receives the seed data acquisition request, it can obtain the first identification code and the second identification code from the storage area where the seed data is locally stored, and send the first identification code as the first password seed data and the second identification code as the second password seed data to the requesting end.

[0118] When the requesting end obtains the first password seed data and the second password seed data, it can also encrypt the first password seed data and the second password seed data respectively based on the same encryption policy as the target encryption policy, thereby obtaining the baseboard management controller initial password and baseboard management controller initial account number on the requesting end. The user can then log in to the baseboard management controller system based on the baseboard management controller initial password and baseboard management controller initial account number.

[0119] In one embodiment, the seed data sending module is further configured to:

[0120] Establish a communication connection with the requesting end based on any one of the Web protocol, Redfish protocol or IPMI protocol; wherein the Web protocol is a network protocol, the Redfish protocol is a management standard protocol based on Hypertext Transfer Protocol Security Service, and the IPMI protocol is an Intelligent Platform Management Interface protocol.

[0121] In this embodiment, when the request end communicates with the baseboard management controller, it can be based on any one of the Web protocol, the Redfish protocol, or the IPMI protocol.

[0122] When the baseboard management controller establishes a communication connection with the requesting end based on a web protocol, the requesting end logs into the website corresponding to the baseboard management controller. When a user browses the baseboard management controller's website, a prompt box pops up, requiring the user to enter the account and password registered by the requesting end on the website. After successfully logging into the website, the first password seed data and the second password seed data are displayed to the user as attachments in the user prompt box on the website. This way, the user obtains the password seed data and can use it to regenerate the baseboard management controller's initial password and initial baseboard management controller account.

[0123] When the baseboard management controller establishes a communication connection with the requesting end based on the Redfish protocol, since the Redfish protocol is a management standard based on HTTPs services, device management is implemented using a RESTful interface. The baseboard management controller complies with the RESTful interface specification. After receiving the API request from the requesting end (the API request is an application program interface request), the baseboard management controller will respond to the API request and return accompanying information to the requesting end. In this way, the baseboard management controller can return the first password seed data and the second password seed data to the requesting end as an attachment as response information, thus completing the distribution of the password seed. Among them, the Redfish interface can be set to not require verification.

[0124] When the baseboard management controller establishes a communication connection with the requesting end based on the IPMI protocol, similar to Redfish, after receiving the IPMI request from the requesting end, the baseboard management controller will respond to the IPMI request and return the accompanying information to the requesting end. In this way, the baseboard management controller can return the first password seed data and the second password seed data to the requesting end as attached information as response information, thus completing the distribution of the password seed. Since the password seed distribution method is adopted instead of directly writing the account password, flexibility is improved and the probability of error is reduced. In addition, the password seed distribution in this application replaces the conventional clear text account password to ensure security.

[0125] After the requesting end obtains the first password seed data and the second password seed data, it encrypts the first password seed data and the second password seed data using the same encryption policy as the target encryption policy, thereby obtaining the baseboard management controller initial password and baseboard management controller initial account number on the requesting end. The user can then log in to the baseboard management controller system using the baseboard management controller initial password and baseboard management controller initial account number.

[0126] This device implements the encryption generation of the baseboard management controller password based on the first identification code corresponding to the unique identification code of the BMC chip, and the encryption generation of the baseboard management controller account based on the second identification code corresponding to the user's required text. The first identification code and the second identification code can then be sent to the requesting end as password seed data. Through the above method, firstly, a first identification code that is unique to the data and a second identification code with a flexible encoding generation process are obtained; secondly, the initial data security of the initially generated account and password is relatively high, and the security of the BMC system can still be protected when the initial account and password are not modified; thirdly, the password seed is distributed to the requesting end instead of directly writing the account and password, which improves flexibility, reduces the probability of error, and ensures data security.

[0127] The above-mentioned baseboard management controller initial password generating device can be implemented in the form of a computer program, which can be used in Figure 7 Runs on the computer equipment shown.

[0128] See also Figure 7 , Figure 7 1 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device 500 is a baseboard management controller.

[0129] See Figure 7 The computer device 500 includes a processor 502 , a memory, and a network interface 505 connected via a device bus 501 , wherein the memory may include a storage medium 503 and an internal memory 504 .

[0130] The storage medium 503 can store an operating system 5031 and a computer program 5032. When the computer program 5032 is executed, the processor 502 can execute a method for generating an initial password for a baseboard management controller.

[0131] The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500.

[0132] The internal memory 504 provides an environment for the operation of the computer program 5032 in the storage medium 503 . When the computer program 5032 is executed by the processor 502 , the processor 502 can execute the method for generating an initial password for the baseboard management controller.

[0133] The network interface 505 is used for network communication, such as providing data information transmission. Those skilled in the art will understand that Figure 7 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the computer device 500 to which the solution of the present application is applied. The specific computer device 500 may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0134] The processor 502 is configured to execute a computer program 5032 stored in the memory to implement the method for generating an initial password for a baseboard management controller disclosed in the embodiment of the present application.

[0135] Those skilled in the art will understand that Figure 7 The embodiment of the computer device shown in the figure does not constitute a limitation on the specific composition of the computer device. In other embodiments, the computer device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, in some embodiments, the computer device may only include a memory and a processor. In such an embodiment, the structure and function of the memory and processor are the same as those in the figure. Figure 7 The embodiments shown are consistent and will not be described again here.

[0136] It should be understood that in the embodiment of the present application, the processor 502 may be a central processing unit (CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0137] In another embodiment of the present application, a computer-readable storage medium is provided. The computer-readable storage medium may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the method for generating an initial password for a baseboard management controller disclosed in an embodiment of the present application is implemented.

[0138] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described equipment, devices and units can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0139] In the several embodiments provided in this application, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, or units with the same function may be combined into one unit. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices or units, or may be an electrical, mechanical or other form of connection.

[0140] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0141] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0142] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a background server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk or an optical disk.

[0143] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present application, and such modifications or substitutions should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A method for generating an initial password for a baseboard management controller, characterized in that: include: Obtaining a unique identification code of a BMC chip as a first identification code; wherein the unique identification code of the BMC chip is a unique identification code of a baseboard management controller chip; Obtaining a user demand text, performing user index extraction and index coding on the user demand text to obtain a second identification code; Obtaining an encryption policy from a plurality of pre-stored encryption policies as a target encryption policy; Encrypting the first identification code using the target encryption strategy to obtain first encrypted data as the initial password of the baseboard management controller; Encrypting the second identification code using the target encryption policy to obtain second encrypted data as the initial account of the baseboard management controller; Storing the baseboard management controller initial password and the baseboard management controller initial account number in a preset storage area; The step of performing user index extraction and index coding on the user demand text to obtain a second identification code includes: Obtaining the user requirement text including the user name and the user name conversion identifier; If it is determined that the user name conversion flag corresponds to the non-conversion flag, the user name is used as the user index; If it is determined that the user name conversion identifier corresponds to the conversion identifier, encoding the user name based on a preset user name encoding strategy to obtain an encoding result, and using the encoding result as the user index; Encoding the user index based on a preset index encoding strategy to obtain the second identification code; The encoding of the user name based on a preset user name encoding strategy to obtain an encoding result includes: Converting characters of a preset character type in the user name into characters of a first preset character type to obtain the encoding result; Alternatively, random encoding results obtained by sequentially randomly encoding each character in the user name are connected to obtain the encoding result; The acquiring of an encryption policy from a plurality of pre-stored encryption policies as a target encryption policy includes: Obtaining a username conversion identifier in the user requirement text, and obtaining a current identifier value corresponding to the username conversion identifier; According to the sequence number corresponding to the current identification value, an encryption policy corresponding to the sequence number is obtained from multiple encryption policies as the target encryption policy.

2. The method for generating an initial password for a baseboard management controller according to claim 1, wherein: Before obtaining an encryption policy from a plurality of pre-stored encryption policies as a target encryption policy, the method further includes: The first identification code is used as first password seed data and is saved, and the second identification code is used as second password seed data and is saved.

3. The method for generating an initial password for a baseboard management controller according to claim 1, wherein: After storing the baseboard management controller initial password and the baseboard management controller initial account in a preset storage area, the method further includes: If a seed data acquisition request sent by a requesting end is detected, the first identification code is sent to the requesting end as first password seed data, and the second identification code is sent to the requesting end as second password seed data.

4. The method for generating an initial password for a baseboard management controller according to claim 3, wherein: After detecting the seed data acquisition request sent by the requesting end, before sending the first identification code as the first password seed data to the requesting end and before sending the second identification code as the second password seed data to the requesting end, the method further includes: Establish a communication connection with the requesting end based on any one of the Web protocol, Redfish protocol or IPMI protocol; wherein the Web protocol is a network protocol, the Redfish protocol is a management standard protocol based on the Hypertext Transfer Protocol Security Service, and the IPMI protocol is an Intelligent Platform Management Interface Protocol.

5. A device for generating an initial password for a baseboard management controller, characterized in that: include: A first generating module is configured to obtain a unique identification code of a BMC chip as a first identification code; wherein the unique identification code of the BMC chip is a unique identification code of a baseboard management controller chip; A second generating module is used to obtain a user demand text, perform user index extraction and index coding on the user demand text, and obtain a second identification code; A target encryption policy acquisition module is used to acquire an encryption policy from a plurality of pre-stored encryption policies as a target encryption policy; A first encryption module is configured to encrypt the first identification code using the target encryption policy to obtain first encrypted data as an initial password for the baseboard management controller; A second encryption module is configured to encrypt the second identification code using the target encryption policy to obtain second encrypted data as an initial account number of the baseboard management controller; A data storage module, configured to store the baseboard management controller initial password and the baseboard management controller initial account number in a preset storage area; The second generating module is specifically configured to: Obtaining the user demand text including a username and a username conversion identifier; if it is determined that the username conversion identifier corresponds to a non-conversion identifier, using the username as a user index; if it is determined that the username conversion identifier corresponds to a conversion identifier, encoding the username based on a preset username encoding strategy to obtain an encoding result, and using the encoding result as the user index; encoding the user index based on a preset index encoding strategy to obtain a second identification code; When executing the step of encoding the user name based on a preset user name encoding strategy to obtain an encoding result, the second generating module is specifically configured to: Converting characters of a preset character type in the user name into characters of a first preset character type to obtain the encoding result; or concatenating random encoding results obtained by randomly encoding each character in the user name in sequence to obtain the encoding result; The target encryption policy acquisition module is specifically used to: Obtaining a username conversion identifier in the user requirement text, and obtaining a current identifier value corresponding to the username conversion identifier; According to the sequence number corresponding to the current identification value, an encryption policy corresponding to the sequence number is obtained from multiple encryption policies as the target encryption policy.

6. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method for generating an initial password for a baseboard management controller according to any one of claims 1 to 4 is implemented.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, causes the processor to execute the method for generating an initial password for a baseboard management controller according to any one of claims 1 to 4.

Images