BMC (Baseboard Management Controller) system with multistage user remote authentication mechanism

Abstract

The invention provides a BMC (Baseboard Management Controller) system with a multistage user remote authentication mechanism, which comprises a business server cluster, authentication servers and a switch, a BMC management unit is arranged in each business server, and a client is connected with the authentication servers through the Internet to perform user identity and authority authentication. The authentication server comprises a session management module used for generating, updating and destroying login sessions of the users logging in the BMC system according to login information of the users, and a session VLAN subnet used for establishing a session VLAN subnet for the login sessions of the users logging in the BMC system. The VLAN management module is used for managing hardware resources of a service server in the session VLAN subnet by a user, and the authority configuration module is used for configuring the authority level of the user for managing the hardware resources of the service server in the session VLAN subnet. The authentication efficiency can be improved, and meanwhile higher safety is achieved.

Description

Technical Field

[0001] The present invention relates to the field of security technology, and in particular to a BMC system with a multi-level user remote authentication mechanism. Background Art

[0002] The onboard BMC (Baseboard Management Controller) system is a common out-of-band management system for users to monitor server hardware. It is a small operating system independent of the server operating system, which can monitor and maintain the hardware status of the server. More specifically, the BMC can read the sensor data inside the server, such as CPU temperature, fan speed, voltage, etc., to monitor the hardware status of the server in real time. It can also record the server's log information, including errors, warnings, events, etc., and provide event alarm functions. Server users or administrators can remotely connect to the BMC system through a network connection to obtain the server's hardware monitoring data, and can also allocate, configure, and monitor the usage status of the server's hardware resources such as processors, memory, hard disks, etc.

[0003] The existing BMC system stores user authentication information in the BMC system, and adds or configures users through the onboard BIOS system or the remote client of the BMC system. This solution, on the one hand, is prone to BMC system cracking and security information leakage, and on the other hand, the authentication information of the BMC system of each server is independently stored in its own onboard storage space, which is not conducive to the unified authentication of the business server cluster and is not friendly to the authentication maintenance of the data center administrator. At the same time, for the remote control of the BMC system, its user authority authentication depends on the user ID generated when the user logs in. Each resource access requires a corresponding resource to perform an authority authentication, which is inefficient and not very secure. Summary of the invention

[0004] Based on the above problems, the present invention proposes a BMC system with a multi-level user remote authentication mechanism, which can improve the authentication efficiency and have higher security.

[0005] In view of this, the present invention proposes a BMC system with a multi-level user remote authentication mechanism, including a business server cluster for providing business services, an authentication server for providing BMC authentication services for the business server cluster, and a switch for connecting the business server cluster and the authentication server. The business server cluster is composed of multiple business servers, each of which is provided with a BMC management unit for managing the hardware resources of the corresponding business server. The client connects to the authentication server through the Internet to perform user identity and authority authentication, and after the authentication is passed, connects to the BMC management program running in the BMC management unit of the business server to manage and maintain the hardware resources of the business server. The authentication server includes: The session management module is used to generate, update and destroy the login session of the user to log in to the BMC system according to the user's login information; A VLAN management module is used to establish a session VLAN subnet for each login session of a user logging into the BMC system, so that the user can manage the hardware resources of the service server in the session VLAN subnet; The authority configuration module is used to configure the authority level of the user to manage the hardware resources of the service server in the session VLAN subnet.

[0006] Furthermore, the session management module includes: An authentication request receiving module is used to receive a login authentication request sent by a client, wherein the login authentication request includes a user identity ID and user authentication information; An authentication information verification module, used to verify the legitimacy of the authentication information in the login authentication request; The session ID generation module is used to generate a session ID for the login session when the user's authentication information passes the verification, and the session ID is bound to the user identity ID.

[0007] Furthermore, the session management module also includes: A user type identification module, used to identify the identity type of the logged-in user according to the user identity ID; The VLAN management module includes: A first list generating module, used for obtaining the server IDs of all the business servers in the business server cluster to generate a first target server ID list when the identity type of the logged-in user is a platform user; A VLAN construction module is used to construct a session VLAN subnet based on the first target server ID list, and the session VLAN subnet is bound to the session ID.

[0008] Furthermore, the VLAN management module also includes: A second list generating module, configured to obtain the server IDs of the business servers related to the logged-in user in the business server cluster to generate a second target server ID list when the identity type of the logged-in user is a tenant user; A VLAN construction module is used to construct a session VLAN subnet based on the second target server ID list, and the session VLAN subnet is bound to the session ID.

[0009] Furthermore, the second list generating module includes: A tenant ID matching module, used to match the tenant ID corresponding to the user identity ID; A business service content acquisition module is used to acquire the business service content associated with the tenant ID; The second list generating module is specifically used to obtain the server ID of the business server deployed by the service program of the business service content to generate the second target server ID list.

[0010] Furthermore, the permission configuration module includes: An authority level matching module, used to match the authority level corresponding to the user identity ID; The session permission allocation module is used to configure the data access permissions between various devices in the session VLAN subnet.

[0011] Further, the session VLAN subnet is a virtual local area network defined based on a port, and the VLAN construction module includes: A third list generating module, configured to obtain a switch port corresponding to each service server in the first target server ID list or the second target server ID list to generate a target switch port ID list; The VLAN port binding module is used to bind the ports in the target switch port ID list as the networking ports of the session VLAN subnet.

[0012] Furthermore, the VLAN construction module also includes: A virtual switch construction module, used to construct a virtual switch for localizing the client, wherein the virtual switch includes a plurality of virtual ports; A virtual client construction module, used to construct a local virtual client device corresponding to the client, wherein the local virtual client device is connected to the virtual switch through the virtual port to connect to a local network of the data center; The virtual client access module is used to add the virtual client device to the session VLAN subnet through the port number of the virtual port.

[0013] Furthermore, the VLAN construction module also includes an authentication server access module, which is used to add the authentication server to the session VLAN subnet through the port number of the virtual port.

[0014] Furthermore, the VLAN management module also includes: A session status monitoring module, used to monitor the status of the login session corresponding to the session ID; The subnet disbanding module is used to disband the session VLAN subnet when the state of the login session is invalid.

[0015] The present invention proposes a BMC system with a multi-level user remote authentication mechanism, comprising a business server cluster, an authentication server and a switch, wherein each business server is provided with a BMC management unit, and a client connects to the authentication server through the Internet to perform user identity and authority authentication, wherein the authentication server comprises a session management module for generating, updating and destroying a login session of a user logging into a BMC system according to login information of the user, a VLAN management module for establishing a session VLAN subnet for each login session of a user logging into the BMC system so that the user can manage the hardware resources of the business server in the session VLAN subnet, and an authority configuration module for configuring the authority level of the user to manage the hardware resources of the business server in the session VLAN subnet, thereby improving the authentication efficiency and having higher security. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 The diagram is a schematic diagram of a BMC system with a multi-level user remote authentication mechanism provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0017] In order to more clearly understand the above-mentioned purpose, features and advantages of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0018] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the protection scope of the present invention is not limited to the specific embodiments disclosed below.

[0019] In the description of the present invention, the term "multiple" refers to two or more. Unless otherwise clearly defined, the orientation or positional relationship indicated by the terms "upper", "lower", etc. is based on the orientation or positional relationship shown in the drawings. It is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation of the present invention. The terms "connection", "installation", "fixed", etc. should be understood in a broad sense. For example, "connection" can be a fixed connection, a detachable connection, or an integral connection; it can be directly connected or indirectly connected through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to the specific circumstances. In addition, the terms "first", "second", etc. are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first", "second", etc. can explicitly or implicitly include one or more of the features. In the description of the present invention, unless otherwise specified, the meaning of "multiple" is two or more.

[0020] In the description of this specification, the description of the terms "one embodiment", "some implementations", "specific embodiments", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0021] A BMC system with a multi-level user remote authentication mechanism provided according to some embodiments of the present invention will be described below with reference to the accompanying drawings.

[0022] like Figure 1 As shown, the present invention proposes a BMC system with a multi-level user remote authentication mechanism, including a business server cluster for providing business services, an authentication server for providing BMC authentication services for the business server cluster, and a switch for connecting the business server cluster and the authentication server. The business server cluster is composed of multiple business servers, and each business server is provided with a BMC management unit for managing the hardware resources of the corresponding business server. The client connects to the authentication server through the Internet to perform user identity and authority authentication, so as to connect to the BMC management program running in the BMC management unit of the business server after the authentication is passed to manage and maintain the hardware resources of the business server. The authentication server includes: The session management module is used to generate, update and destroy the login session of the user to log in to the BMC system according to the user's login information; A VLAN management module is used to establish a session VLAN subnet for each login session of a user logging into the BMC system, so that the user can manage the hardware resources of the service server in the session VLAN subnet; The authority configuration module is used to configure the authority level of the user to manage the hardware resources of the service server in the session VLAN subnet.

[0023] Specifically, the business service refers to various Internet services provided by the business server to Internet users through the business service program, and the business service program includes but is not limited to WEB service program, search service program, cloud storage service program, and cloud computing service program. Accordingly, the business service includes but is not limited to WEB, search, cloud storage, cloud computing and other services, among which WEB services include news information website services, e-commerce website services, social networking website services, etc., and cloud storage services include database storage services or cloud disk storage services, etc., which are not listed here one by one.

[0024] The business servers in the business server cluster can provide external services independently or jointly. For example, one or more of the business servers can independently provide WEB services to Internet users, or integrate the storage resources or computing resources of multiple business servers to provide cloud storage or cloud computing services. In the technical solution of the present invention, the business server cluster refers to a computer cluster that is arranged in the same data center and connected together by several switches. The authentication server is set in the same data center as the business server cluster, and is connected to the business servers in the data center through the switch to provide BMC user authentication services and authority management services for the business servers in the data center.

[0025] It should be noted that both the authentication server and the business server can be deployed using a server with a standard hardware configuration. Therefore, the authentication server and the business server can be consistent in hardware, or they can be configured differently as needed. Figure 1 A light background color is used to mark the authentication server, and a dark background color is used to mark the business server. The authentication server and the business server are both connected to a data port of one of the switches through a network cable.

[0026] The BMC management unit set in each business server is a hardware management unit independent of the business functions of the business server, which includes a BMC management chip and a network controller. The BMC operating system run by the BMC management chip is an operating system independent of the business operating system of the business server. It monitors the hardware status of the business server through various sensor devices set in the business server, and manages the hardware resources of the business server through interfaces with various devices of the business server. The network controller can be a communication unit independently configured for the BMC management chip, or a communication unit shared with the hardware system running the business operating system in the business server. The BMC management chip is connected to the switch through the network controller, so that a communication connection can be established with the authentication server.

[0027] The BMC system with a multi-level user remote authentication mechanism is a hardware management system that uniformly manages the hardware of business servers in a business server cluster in a data center. After the BMC service program run by the BMC management chip of each business server establishes a communication connection with the authentication server through a corresponding network controller, the authentication server comprehensively manages its hardware resources through the BMC service program.

[0028] The login session is a login status management mechanism after the user logs in to the BMC system through authentication information. The status of the login session includes an active status and an invalid status. The authentication server manages the status of the login session through the active time of the user access event. After the user logs in to the BMC system through authentication information, the BMC system generates a corresponding login session through the session management module and configures the status of its login session to an active state. Each time the user accesses the BMC system through the client, the session management module will trigger the session management module to update the status of the login session. When the user does not have an access event within a certain period of time, the session management module determines that the login session has timed out and configures the login session to an invalid state. When the client corresponding to the login session does not log in again within a preset period of time, the session management module will destroy the login session to release the cache space occupied by the login session.

[0029] The session VLAN subnet is a virtual local area network built for each login session, which can be customized based on ports or MAC addresses. The network devices in each session VLAN subnet are in the same broadcast domain and have the IP addresses of the same virtual network segment. They can communicate freely with each other through the corresponding IP addresses without the need to configure additional routing information.

[0030] Furthermore, the session management module includes: An authentication request receiving module is used to receive a login authentication request sent by a client, wherein the login authentication request includes a user identity ID and user authentication information; An authentication information verification module, used to verify the legitimacy of the authentication information in the login authentication request; The session ID generation module is used to generate a session ID for the login session when the user's authentication information passes the verification, and the session ID is bound to the user identity ID.

[0031] Specifically, the user connects to the authentication server through a client such as ssh or a web browser to send a login authentication request to the authentication server. The user identity ID can be a user-defined user name, or a user's mobile phone number, email address, etc. The user authentication information can be a password set by the user, or a digital certificate issued by the platform.

[0032] Furthermore, when the user authentication information is a password set by the user, the authentication information may be a HASH code of the user's login password, that is, the client converts the plain text password entered by the user into a HASH code and transmits it to the authentication server. In the technical scheme of the above implementation, verifying the legitimacy of the authentication information in the login authentication request is specifically to match the HASH of the user's login password with the authentication information in the database.

[0033] The session ID is an identity identifier used to uniquely identify the login session, and each user identity ID can only be bound to one session ID at the same time.

[0034] Furthermore, the session management module also includes: A user type identification module, used to identify the identity type of the logged-in user according to the user identity ID; The VLAN management module includes: A first list generating module, used for obtaining the server IDs of all the business servers in the business server cluster to generate a first target server ID list when the identity type of the logged-in user is a platform user; A VLAN construction module is used to construct a session VLAN subnet based on the first target server ID list, and the session VLAN subnet is bound to the session ID.

[0035] The users of the BMC system have different levels of authority in the BMC system according to their different identity types. For example, the platform user is responsible for the management and maintenance of the servers in the data center and usually has the highest management authority of the BMC system. Of course, according to the needs of actual implementation, the cloud administrator can also be divided into several functional levels according to the functional division, such as cloud administrator and operation and maintenance user, so as to allocate corresponding management authority and have different levels of authority.

[0036] In the technical solutions of some embodiments of the present invention, regardless of the level of the platform user, the scope of their functions generally covers all business servers in the data center. Therefore, for the platform user, the scope of their operating authority should cover the entire business server cluster. Therefore, when constructing the session VLAN subnet, all business servers in the business server cluster need to be included in the session VLAN subnet corresponding to the login session of the platform user, so that the platform user can perform remote operations on them.

[0037] In the technical solutions of other embodiments of the present invention, different platform users may be assigned business servers in different computer rooms or different areas as their management scopes. In this case, the first list generation module is used to obtain the server IDs of the business servers within the management scope of the platform user to generate the first target server ID list.

[0038] Furthermore, the VLAN management module also includes: A second list generating module, configured to obtain the server IDs of the business servers related to the logged-in user in the business server cluster to generate a second target server ID list when the identity type of the logged-in user is a tenant user; A VLAN construction module is used to construct a session VLAN subnet based on the second target server ID list, and the session VLAN subnet is bound to the session ID.

[0039] Specifically, tenants deploy Internet services by renting business servers in data centers. The platform usually configures administrator users and ordinary users for tenants. Tenant administrators have higher permissions on corresponding business servers than ordinary tenant users. Similarly, tenant users can also be divided into more functional levels by functional division, so as to allocate corresponding management permissions and give them different permission levels.

[0040] Furthermore, the second list generating module includes: A tenant ID matching module, used to match the tenant ID corresponding to the user identity ID; A business service content acquisition module is used to acquire the business service content associated with the tenant ID; The second list generating module is specifically used to obtain the server ID of the business server deployed by the service program of the business service content to generate the second target server ID list.

[0041] The business server usually deploys service programs by establishing virtual machines in order to more efficiently utilize the server's hardware resources. The use of virtual machines for business service deployment is more flexible and diverse in resource utilization than directly using physical machines for deployment. The virtual machine resources for the same business service content can come from only one business server, or they can be realized by aggregating the resources of multiple business servers, so that the diverse needs of different business service contents for virtual machine hardware resources can be met to the greatest extent without having to set up a correspondingly configured business server for each business service content. In this case, the business service content of a tenant may involve a greater or lesser number of business servers. In the technical solution of the above-mentioned implementation method, the second list generation module generates the second target server ID list by obtaining the server ID of the business server related to the tenant's business service content.

[0042] Furthermore, the permission configuration module includes: An authority level matching module, used to match the authority level corresponding to the user identity ID; The session permission allocation module is used to configure the data access permissions between various devices in the session VLAN subnet.

[0043] Furthermore, the session authority allocation module includes: An authority rule generation module, used to generate data filtering rules corresponding to the authority level of the user identity ID; The authority rule sending module is used to send the data filtering rule to the BMC management unit of the service server corresponding to the session VLAN subnet.

[0044] Further, in the BMC system with a multi-level user remote authentication mechanism, the BMC management unit includes: An authority rule receiving module, used for receiving the data filtering rules sent by the authentication server; A data access request receiving module, used for receiving a data access request sent by a client; A rule matching module, used for matching the data access request with the data filtering rule; The data filtering module is used to determine the interception and release of data according to the matching result between the data access request and the data filtering rule.

[0045] Further, the session VLAN subnet is a virtual local area network defined based on a port, and the VLAN construction module includes: A third list generating module, configured to obtain a switch port corresponding to each service server in the first target server ID list or the second target server ID list to generate a target switch port ID list; The VLAN port binding module is used to bind the ports in the target switch port ID list as the networking ports of the session VLAN subnet.

[0046] In the technical solution of the above implementation, the session VLAN subnet is a virtual local area network based on port definition, which specifically means that the session VLAN subnet is networked by binding the switch port, and the switch identifies which session VLAN subnet the access device belongs to according to the port number, thereby performing corresponding data packet forwarding. In the technical solution of this implementation, the VLAN port binding module sends the binding information of the session VLAN subnet and the port to the corresponding switch, so that the switch identifies which session VLAN subnet the access device belongs to according to the binding information.

[0047] Furthermore, the VLAN construction module also includes: A virtual switch construction module, used to construct a virtual switch for localizing the client, wherein the virtual switch includes a plurality of virtual ports; A virtual client construction module, used to construct a local virtual client device corresponding to the client, wherein the local virtual client device is connected to the virtual switch through the virtual port to connect to a local network of the data center; The virtual client access module is used to add the virtual client device to the session VLAN subnet through the port number of the virtual port.

[0048] Specifically, the virtual client building module is used to virtualize a client device connected to a data center via the Internet into a local network device connected to a local switch.

[0049] The number of virtual ports of the virtual switch can be configured as a fixed value or dynamically configured according to the number of session VLAN subnets. When the number of virtual ports of the virtual switch is a fixed value, after the virtual ports of any virtual switch are used up, a new virtual switch is constructed to connect the client devices of the new session VLAN.

[0050] Furthermore, the VLAN construction module also includes an authentication server access module, which is used to add the authentication server to the session VLAN subnet through the port number of the virtual port.

[0051] In the technical solution of the above implementation, the authentication server joins each session VLAN subnet through the virtual switch, so that the client devices and service servers in each session VLAN subnet can communicate with the authentication server in the corresponding session VLAN subnet.

[0052] Furthermore, the VLAN management module also includes: A session status monitoring module, used to monitor the status of the login session corresponding to the session ID; The subnet disbanding module is used to disband the session VLAN subnet when the state of the login session is invalid.

[0053] In the technical solution of the above implementation, the session VLAN subnet has a life cycle substantially the same as that of the login session, and the authentication server maintains the corresponding session VLAN subnet only when each login session is active, allowing the client to access data within the scope of authority in the session VLAN subnet. After the login session expires, the session VLAN subnet is dissolved to release the cache space it occupies.

[0054] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0055] According to the embodiments of the present invention as described above, these embodiments do not describe all the details in detail, nor do they limit the invention to the specific embodiments described. Obviously, many modifications and changes can be made based on the above description. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can make good use of the present invention and the modified use based on the present invention. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A BMC system with a multi-level user remote authentication mechanism, It is characterized in that It includes a business server cluster for providing business services, an authentication server for providing BMC authentication services for the business server cluster, and a switch for connecting the business server cluster and the authentication server. The business server cluster is composed of multiple business servers. Each business server is provided with a BMC management unit for managing the hardware resources of the corresponding business server. The client connects to the authentication server through the Internet to perform user identity and authority authentication, and after the authentication is passed, connects to the BMC management program running in the BMC management unit of the business server to manage and maintain the hardware resources of the business server. The authentication server includes: The session management module is used to generate, update and destroy the login session of the user to log in to the BMC system according to the user's login information; A VLAN management module is used to establish a session VLAN subnet for each login session of a user logging into the BMC system, so that the user can manage the hardware resources of the service server in the session VLAN subnet; The authority configuration module is used to configure the authority level of the user to manage the hardware resources of the service server in the session VLAN subnet.

2. The BMC system with a multi-level user remote authentication mechanism according to claim 1, It is characterized in that The session management module includes: An authentication request receiving module is used to receive a login authentication request sent by a client, wherein the login authentication request includes a user identity ID and user authentication information; An authentication information verification module, used to verify the legitimacy of the authentication information in the login authentication request; The session ID generation module is used to generate a session ID for the login session when the user's authentication information passes the verification, and the session ID is bound to the user identity ID.

3. The BMC system with a multi-level user remote authentication mechanism according to claim 2, It is characterized in that The session management module also includes: A user type identification module, used to identify the identity type of the logged-in user according to the user identity ID; The VLAN management module includes: A first list generating module, used for obtaining the server IDs of all the business servers in the business server cluster to generate a first target server ID list when the identity type of the logged-in user is a platform user; A VLAN construction module is used to construct a session VLAN subnet based on the first target server ID list, and the session VLAN subnet is bound to the session ID.

4. The BMC system with a multi-level user remote authentication mechanism according to claim 3, It is characterized in that The VLAN management module also includes: A second list generating module, configured to obtain the server IDs of the business servers related to the logged-in user in the business server cluster to generate a second target server ID list when the identity type of the logged-in user is a tenant user; A VLAN construction module is used to construct a session VLAN subnet based on the second target server ID list, and the session VLAN subnet is bound to the session ID.

5. The BMC system with a multi-level user remote authentication mechanism according to claim 4, It is characterized in that The second list generating module comprises: A tenant ID matching module, used to match the tenant ID corresponding to the user identity ID; A business service content acquisition module is used to acquire the business service content associated with the tenant ID; The second list generating module is specifically used to obtain the server ID of the business server deployed by the service program of the business service content to generate the second target server ID list.

6. The BMC system with a multi-level user remote authentication mechanism according to claim 5, It is characterized in that The permission configuration module includes: An authority level matching module, used to match the authority level corresponding to the user identity ID; The session permission allocation module is used to configure the data access permissions between various devices in the session VLAN subnet.

7. The BMC system with a multi-level user remote authentication mechanism according to any one of claims 3 to 5, It is characterized in that The session VLAN subnet is a virtual local area network defined based on ports, and the VLAN building module includes: A third list generating module, configured to obtain a switch port corresponding to each service server in the first target server ID list or the second target server ID list to generate a target switch port ID list; The VLAN port binding module is used to bind the ports in the target switch port ID list as the networking ports of the session VLAN subnet.

8. The BMC system with a multi-level user remote authentication mechanism according to claim 7, It is characterized in that The VLAN building module also includes: A virtual switch construction module, used to construct a virtual switch for localizing the client, wherein the virtual switch includes a plurality of virtual ports; A virtual client construction module, used to construct a local virtual client device corresponding to the client, wherein the local virtual client device is connected to the virtual switch through the virtual port to connect to a local network of the data center; The virtual client access module is used to add the virtual client device to the session VLAN subnet through the port number of the virtual port.

9. The BMC system with a multi-level user remote authentication mechanism according to claim 8, It is characterized in that The VLAN construction module also includes an authentication server access module, which is used to add the authentication server to the session VLAN subnet through the port number of the virtual port.

10. The BMC system with a multi-level user remote authentication mechanism according to claim 1, It is characterized in that The VLAN management module also includes: A session status monitoring module, used to monitor the status of the login session corresponding to the session ID; The subnet disbanding module is used to disband the session VLAN subnet when the state of the login session is invalid.

Images