A BMC system with multi-level user remote authentication mechanism

Abstract

The present invention proposes a BMC system with a multi-level user remote authentication mechanism, comprising a business server cluster, an authentication server, and a switch. Each business server is provided with a BMC management unit. A client connects to the authentication server via the Internet to perform user identity and authority authentication. The authentication server includes a session management module for generating, updating, and destroying login sessions for users to log into the BMC system based on user login information; a VLAN management module for establishing a session VLAN subnet for each user login session to the BMC system, so that the user can manage the hardware resources of the business servers in the session VLAN subnet; and a permission configuration module for configuring the permission level for users to manage the hardware resources of the business servers in the session VLAN subnet. This system can improve authentication efficiency while providing higher security.

Description

Technical Field

[0001] The present invention relates to the field of security technology, and in particular to a BMC system with a multi-level user remote authentication mechanism. Background Art

[0002] The onboard BMC (Baseboard Management Controller) system is a common out-of-band management system used by users to monitor server hardware. It's a small operating system independent of the server's operating system, capable of monitoring and maintaining the server's hardware status. More specifically, the BMC reads data from internal server sensors, such as CPU temperature, fan speed, and voltage, to monitor the server's hardware status in real time. It also logs server information, including errors, warnings, and events, and provides event alerts. Server users or administrators can remotely connect to the BMC system over the network to obtain server hardware monitoring data. It can also allocate, configure, and monitor the usage of server hardware resources, such as the processor, memory, and hard disk.

[0003] Existing BMC systems store user authentication information within the BMC system. Users are added or configured through the onboard BIOS system or a remote client of the BMC system. This solution, on the one hand, easily leads to BMC system cracking and security information leakage. On the other hand, each server's BMC system authentication information is independently stored in its own onboard storage space, which is not conducive to achieving unified authentication for business server clusters and is not user-friendly for authentication and maintenance of data center administrators. Furthermore, for remote control of the BMC system, user authorization authentication relies on the user ID generated when the user logs in. Each resource access requires authorization authentication for the corresponding resource, which is inefficient and insecure. Summary of the Invention

[0004] Based on the above problems, the present invention proposes a BMC system with a multi-level user remote authentication mechanism, which can improve authentication efficiency and have higher security.

[0005] In view of this, the present invention proposes a BMC system with a multi-level user remote authentication mechanism, comprising a business server cluster for providing business services, an authentication server for providing BMC authentication services for the business server cluster, and a switch for connecting the business server cluster and the authentication server. The business server cluster is composed of multiple business servers, each of which is provided with a BMC management unit for managing the hardware resources of the corresponding business server. The client connects to the authentication server via the Internet to perform user identity and authority authentication, and after passing the authentication, connects to the BMC management program running in the BMC management unit of the business server to manage and maintain the hardware resources of the business server. The authentication server includes:

[0006] The session management module is used to generate, update and destroy the user's login session for the BMC system based on the user's login information;

[0007] A VLAN management module is used to establish a session VLAN subnet for each user's login session to the BMC system, so that the user can manage the hardware resources of the service server in the session VLAN subnet;

[0008] The authority configuration module is used to configure the authority level of the user to manage the hardware resources of the service server in the session VLAN subnet.

[0009] Furthermore, the session management module includes:

[0010] An authentication request receiving module is used to receive a login authentication request sent by a client, wherein the login authentication request includes a user identity ID and user authentication information;

[0011] An authentication information verification module, used to verify the legitimacy of the authentication information in the login authentication request;

[0012] The session ID generation module is used to generate a session ID for the login session when the user's authentication information passes the verification, and the session ID is bound to the user's identity ID.

[0013] Furthermore, the session management module further includes:

[0014] A user type identification module is used to identify the identity type of the logged-in user according to the user identity ID;

[0015] The VLAN management module includes:

[0016] A first list generating module is configured to obtain the server IDs of all the business servers in the business server cluster to generate a first target server ID list when the identity type of the logged-in user is a platform user;

[0017] A VLAN construction module is used to construct a session VLAN subnet based on the first target server ID list, and the session VLAN subnet is bound to the session ID.

[0018] Furthermore, the VLAN management module further includes:

[0019] A second list generating module is configured to obtain the server IDs of the business servers related to the logged-in user in the business server cluster to generate a second target server ID list when the identity type of the logged-in user is a tenant user;

[0020] A VLAN construction module is used to construct a session VLAN subnet based on the second target server ID list, and the session VLAN subnet is bound to the session ID.

[0021] Furthermore, the second list generating module includes:

[0022] A tenant ID matching module, used to match the tenant ID corresponding to the user identity ID;

[0023] A business service content acquisition module is used to obtain the business service content associated with the tenant ID;

[0024] The second list generating module is specifically configured to obtain the server ID of the business server where the service program of the business service content is deployed to generate the second target server ID list.

[0025] Furthermore, the permission configuration module includes:

[0026] An authority level matching module, used to match the authority level corresponding to the user identity ID;

[0027] The session permission allocation module is used to configure the data access permissions between various devices in the session VLAN subnet.

[0028] Furthermore, the session VLAN subnet is a virtual local area network defined based on a port, and the VLAN construction module includes:

[0029] a third list generating module, configured to obtain a switch port corresponding to each service server in the first target server ID list or the second target server ID list to generate a target switch port ID list;

[0030] The VLAN port binding module is used to bind the ports in the target switch port ID list as the networking ports of the session VLAN subnet.

[0031] Furthermore, the VLAN construction module further includes:

[0032] A virtual switch construction module, configured to construct a virtual switch for localizing the client, wherein the virtual switch includes a plurality of virtual ports;

[0033] A virtual client construction module, configured to construct a local virtual client device corresponding to the client, wherein the local virtual client device is connected to the virtual switch through the virtual port to connect to a local network of the data center;

[0034] The virtual client access module is used to add the virtual client device to the session VLAN subnet through the port number of the virtual port.

[0035] Furthermore, the VLAN construction module also includes an authentication server access module, which is used to add the authentication server to the session VLAN subnet through the port number of the virtual port.

[0036] Furthermore, the VLAN management module further includes:

[0037] A session status monitoring module, used to monitor the status of the login session corresponding to the session ID;

[0038] The subnet disbanding module is used to disband the session VLAN subnet when the state of the login session is invalid.

[0039] The present invention proposes a BMC system with a multi-level user remote authentication mechanism, comprising a business server cluster, an authentication server, and a switch. Each business server is provided with a BMC management unit. A client connects to the authentication server via the Internet to perform user identity and authority authentication. The authentication server includes a session management module for generating, updating, and destroying login sessions for users to log into the BMC system based on user login information; a VLAN management module for establishing a session VLAN subnet for each user login session to the BMC system, so that the user can manage the hardware resources of the business servers in the session VLAN subnet; and a permission configuration module for configuring the permission level for users to manage the hardware resources of the business servers in the session VLAN subnet. This system can improve authentication efficiency while providing higher security. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 The diagram is a schematic diagram of a BMC system with a multi-level user remote authentication mechanism provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0041] In order to more clearly understand the above-mentioned objects, features and advantages of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that, in the absence of conflict, the embodiments of the present application and the features therein can be combined with each other.

[0042] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the scope of protection of the present invention is not limited to the specific embodiments disclosed below.

[0043] In the description of the present invention, the term "plurality" refers to two or more. Unless otherwise specified, the terms "upper" and "lower" are based on the orientations or positional relationships shown in the accompanying drawings and are intended solely to facilitate and simplify the description of the present invention. They are not intended to indicate or imply that the devices or components referred to must have a specific orientation, be constructed, or operate in a specific manner. Therefore, they should not be construed as limiting the present invention. The terms "connected," "mounted," and "fixed," etc., should be interpreted broadly. For example, "connected" can refer to fixed, removable, or integral connections; directly or indirectly through an intermediary. A person of ordinary skill in the art will understand the specific meanings of these terms in the present invention based on the specific circumstances. Furthermore, the terms "first," "second," etc., etc., are used for descriptive purposes only and should not be construed to indicate or imply relative importance or to implicitly specify the number of the technical features indicated. Therefore, a feature designated "first," "second," etc., may explicitly or implicitly include one or more of such features. In the description of the present invention, unless otherwise specified, "plurality" means two or more.

[0044] Throughout this specification, terms such as "one embodiment," "some implementations," and "specific examples" indicate that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of the present invention. In this specification, schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0045] A BMC system with a multi-level user remote authentication mechanism provided according to some embodiments of the present invention will be described below with reference to the accompanying drawings.

[0046] like Figure 1As shown, the present invention proposes a BMC system with a multi-level user remote authentication mechanism, including a business server cluster for providing business services, an authentication server for providing BMC authentication services for the business server cluster, and a switch for connecting the business server cluster and the authentication server. The business server cluster is composed of multiple business servers, and each business server is provided with a BMC management unit for managing the hardware resources of the corresponding business server. The client connects to the authentication server via the Internet to perform user identity and authority authentication, and after the authentication is passed, connects to the BMC management program running in the BMC management unit of the business server to manage and maintain the hardware resources of the business server. The authentication server includes:

[0047] The session management module is used to generate, update and destroy the user's login session for the BMC system based on the user's login information;

[0048] A VLAN management module is used to establish a session VLAN subnet for each user's login session to the BMC system, so that the user can manage the hardware resources of the service server in the session VLAN subnet;

[0049] The authority configuration module is used to configure the authority level of the user to manage the hardware resources of the service server in the session VLAN subnet.

[0050] Specifically, the term "business service" refers to various internet services provided by business servers to internet users via business service programs. These include, but are not limited to, web service programs, search service programs, cloud storage service programs, and cloud computing service programs. Accordingly, these business services include, but are not limited to, web, search, cloud storage, and cloud computing services. Web services include news and information website services, e-commerce website services, and social networking website services, while cloud storage services include database storage services and cloud disk storage services, among others. These are not listed here.

[0051] The business servers in the business server cluster can provide external services independently or jointly. For example, one or more business servers can independently provide WEB services to Internet users, or the storage resources or computing resources of multiple business servers can be integrated to provide cloud storage or cloud computing services. In the technical solution of the present invention, the business server cluster refers to a computer cluster arranged in the same data center and connected together through several switches. The authentication server is set in the same data center as the business server cluster, and is connected to the business servers in the data center through the switches to provide BMC user authentication services and permission management services for the business servers in the data center.

[0052] It should be noted that both the authentication server and the business server can be deployed using a server with standard hardware configuration, so the authentication server and the business server can be the same in hardware, or they can be configured differently as needed. Figure 1 The authentication server is marked with a light background color, and the service server is marked with a dark background color. The authentication server and the service server are both connected to a data port of one of the switches via a network cable.

[0053] The BMC management unit provided in each business server is a hardware management unit independent of the business functions of the business server. It includes a BMC management chip and a network controller. The BMC operating system run by the BMC management chip is an operating system independent of the business operating system of the business server. The BMC management chip monitors the hardware status of the business server through various sensor devices provided in the business server and manages the hardware resources of the business server through interfaces with various components of the business server. The network controller can be a communication unit independently configured for the BMC management chip, or it can be a communication unit shared with the hardware system running the business operating system in the business server. The BMC management chip is connected to the switch via the network controller, thereby establishing a communication connection with the authentication server.

[0054] The BMC system with a multi-level user remote authentication mechanism is a hardware management system that uniformly manages the hardware of business servers in a business server cluster in a data center. After the BMC service program run by the BMC management chip of each business server establishes a communication connection with the authentication server through the corresponding network controller, the authentication server comprehensively manages its hardware resources through the BMC service program.

[0055] The login session is a login status management mechanism after the user logs in to the BMC system through authentication information. The status of the login session includes an active state and an invalid state. The authentication server manages the status of the login session through the active time of the user access event. After the user logs in to the BMC system through authentication information, the BMC system generates a corresponding login session through the session management module and configures the status of its login session to be active. Every time the user accesses the BMC system through the client, the session management module will trigger the session management module to update the status of the login session. When the user does not have an access event within a certain period of time, the session management module determines that the login session has timed out and configures its login session to be invalid. When the client corresponding to the login session does not log in again within the preset period of time, the session management module will destroy the login session to release the cache space occupied by the login session.

[0056] The session VLAN subnet is a virtual local area network built for each login session. It can be customized based on ports or MAC addresses. The network devices in each session VLAN subnet are in the same broadcast domain and have IP addresses in the same virtual network segment. They can communicate freely with each other through the corresponding IP addresses without the need to configure additional routing information.

[0057] Furthermore, the session management module includes:

[0058] An authentication request receiving module is used to receive a login authentication request sent by a client, wherein the login authentication request includes a user identity ID and user authentication information;

[0059] An authentication information verification module, used to verify the legitimacy of the authentication information in the login authentication request;

[0060] The session ID generation module is used to generate a session ID for the login session when the user's authentication information passes the verification, and the session ID is bound to the user's identity ID.

[0061] Specifically, the user connects to the authentication server through a client such as SSH or a web browser and sends a login authentication request to the authentication server. The user ID can be a user-defined username, or the user's mobile phone number, email address, etc. The user authentication information can be a password set by the user or a digital certificate issued by the platform.

[0062] Furthermore, when the user authentication information is a password set by the user, the authentication information can be a HASH code of the user's login password, that is, the client converts the plain text password entered by the user into a HASH code and transmits it to the authentication server. In the technical solution of the above embodiment, verifying the legitimacy of the authentication information in the login authentication request is specifically to match the HASH of the user's login password with the authentication information in the database.

[0063] The session ID is an identity identifier used to uniquely identify the login session, and each user identity ID can only be bound to one session ID at a time.

[0064] Furthermore, the session management module further includes:

[0065] A user type identification module is used to identify the identity type of the logged-in user according to the user identity ID;

[0066] The VLAN management module includes:

[0067] A first list generating module is configured to obtain the server IDs of all the business servers in the business server cluster to generate a first target server ID list when the identity type of the logged-in user is a platform user;

[0068] A VLAN construction module is used to construct a session VLAN subnet based on the first target server ID list, and the session VLAN subnet is bound to the session ID.

[0069] BMC system users have different levels of authority within the system depending on their identity type. For example, platform users are responsible for server management and maintenance in the data center and typically have the highest management authority within the BMC system. However, depending on actual implementation needs, cloud administrators can be divided into several functional tiers, such as cloud administrators and operations and maintenance users, and their corresponding management permissions can be assigned to them, resulting in different levels of authority.

[0070] In the technical solutions of some embodiments of the present invention, regardless of the level of the platform user, his or her functional scope generally covers all business servers in the data center. Therefore, for the platform user, the scope of his or her operating authority should cover the entire business server cluster. Therefore, when constructing the session VLAN subnet, all business servers in the business server cluster need to be included in the session VLAN subnet corresponding to the platform user's login session so that the platform user can perform remote operations on them.

[0071] In some other embodiments of the present invention, different platform users may be assigned business servers in different computer rooms or different areas as their management scopes. In this case, the first list generation module is used to obtain the server IDs of the business servers within the management scope of the platform user to generate the first target server ID list.

[0072] Furthermore, the VLAN management module further includes:

[0073] A second list generating module is configured to obtain the server IDs of the business servers related to the logged-in user in the business server cluster to generate a second target server ID list when the identity type of the logged-in user is a tenant user;

[0074] A VLAN construction module is used to construct a session VLAN subnet based on the second target server ID list, and the session VLAN subnet is bound to the session ID.

[0075] Specifically, tenants deploy internet services by renting business servers in data centers. The platform typically configures administrators and regular users for tenants. Tenant administrators have higher permissions on the corresponding business servers than regular users. Similarly, tenant users can be divided into more functional levels based on their roles, thereby assigning corresponding management permissions and giving them different levels of authority.

[0076] Furthermore, the second list generating module includes:

[0077] A tenant ID matching module, used to match the tenant ID corresponding to the user identity ID;

[0078] A business service content acquisition module is used to obtain the business service content associated with the tenant ID;

[0079] The second list generating module is specifically configured to obtain the server ID of the business server where the service program of the business service content is deployed to generate the second target server ID list.

[0080] The business server usually deploys service programs by establishing virtual machines in order to more efficiently utilize the server's hardware resources. The use of virtual machines for business service deployment is more flexible and diverse in resource utilization than directly using physical machines for deployment. The virtual machine resources for the same business service content can come from only one business server, or they can be implemented by aggregating the resources of multiple business servers, so that the diverse needs of different business service contents for virtual machine hardware resources can be met to the greatest extent without having to set up correspondingly configured business servers for each business service content. In this case, the business service content of a tenant may involve a greater or lesser number of business servers. In the technical solution of the above-mentioned embodiment, the second list generation module generates the second target server ID list by obtaining the server ID of the business server related to the tenant's business service content.

[0081] Furthermore, the permission configuration module includes:

[0082] An authority level matching module, used to match the authority level corresponding to the user identity ID;

[0083] The session permission allocation module is used to configure the data access permissions between various devices in the session VLAN subnet.

[0084] Furthermore, the session authority allocation module includes:

[0085] An authority rule generation module is used to generate data filtering rules corresponding to the authority level of the user identity ID;

[0086] The authority rule sending module is used to send the data filtering rule to the BMC management unit of the service server corresponding to the session VLAN subnet.

[0087] Furthermore, in the BMC system with a multi-level user remote authentication mechanism, the BMC management unit includes:

[0088] An authority rule receiving module, configured to receive data filtering rules sent by the authentication server;

[0089] A data access request receiving module, configured to receive a data access request sent by a client;

[0090] A rule matching module, used for matching the data access request with the data filtering rule;

[0091] The data filtering module is used to determine the interception and release of data according to the matching result between the data access request and the data filtering rule.

[0092] Furthermore, the session VLAN subnet is a virtual local area network defined based on a port, and the VLAN construction module includes:

[0093] a third list generating module, configured to obtain a switch port corresponding to each service server in the first target server ID list or the second target server ID list to generate a target switch port ID list;

[0094] The VLAN port binding module is used to bind the ports in the target switch port ID list as the networking ports of the session VLAN subnet.

[0095] In the technical solution of the above-mentioned embodiment, the session VLAN subnet is a port-defined virtual local area network, specifically referring to the session VLAN subnet being formed by binding it to a switch port. The switch identifies the session VLAN subnet to which an access device belongs based on the port number and performs corresponding data packet forwarding. In the technical solution of this embodiment, the VLAN port binding module sends the binding information between the session VLAN subnet and the port to the corresponding switch, so that the switch can identify the session VLAN subnet to which the access device belongs based on the binding information.

[0096] Furthermore, the VLAN construction module further includes:

[0097] A virtual switch construction module, configured to construct a virtual switch for localizing the client, wherein the virtual switch includes a plurality of virtual ports;

[0098] A virtual client construction module, configured to construct a local virtual client device corresponding to the client, wherein the local virtual client device is connected to the virtual switch through the virtual port to connect to a local network of the data center;

[0099] The virtual client access module is used to add the virtual client device to the session VLAN subnet through the port number of the virtual port.

[0100] Specifically, the virtual client building module is used to virtualize a client device connected to a data center via the Internet into a local network device connected to a local switch.

[0101] The number of virtual ports of the virtual switch can be configured as a fixed value or dynamically configured according to the number of session VLAN subnets. When the number of virtual ports of the virtual switch is fixed, when the virtual ports of any virtual switch are used up, a new virtual switch is constructed to connect client devices of the new session VLAN.

[0102] Furthermore, the VLAN construction module also includes an authentication server access module, which is used to add the authentication server to the session VLAN subnet through the port number of the virtual port.

[0103] In the technical solution of the above embodiment, the authentication server joins each session VLAN subnet through the virtual switch, so that the client devices and service servers in each session VLAN subnet can communicate with the authentication server in the corresponding session VLAN subnet.

[0104] Furthermore, the VLAN management module further includes:

[0105] A session status monitoring module, used to monitor the status of the login session corresponding to the session ID;

[0106] The subnet disbanding module is used to disband the session VLAN subnet when the state of the login session is invalid.

[0107] In the technical solution of the above embodiment, the session VLAN subnet has a lifecycle substantially the same as that of the login session. The authentication server maintains the corresponding session VLAN subnet only while each login session is active, allowing the client to access data within the session VLAN subnet within its authorized scope. After the login session expires, the session VLAN subnet is dissolved to release the cache space it occupied.

[0108] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0109] While embodiments of the present invention have been described above, these embodiments do not exhaustively describe all details and do not limit the invention to the specific embodiments described. Obviously, many modifications and variations are possible based on the above description. These embodiments are selected and described in detail in this specification in order to better explain the principles and practical applications of the present invention, thereby enabling those skilled in the art to better utilize the present invention and its modifications. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A BMC system with a multi-level user remote authentication mechanism, characterized in that: The system comprises a business server cluster for providing business services, an authentication server for providing BMC authentication services for the business server cluster, and a switch for connecting the business server cluster and the authentication server. The business server cluster is composed of multiple business servers, and each business server is provided with a BMC management unit for managing the hardware resources of the corresponding business server. The client connects to the authentication server via the Internet to perform user identity and authority authentication, and after passing the authentication, connects to the BMC management program running in the BMC management unit of the business server to manage and maintain the hardware resources of the business server. The authentication server includes: The session management module is used to generate, update and destroy the user's login session for the BMC system based on the user's login information; A VLAN management module is used to establish a session VLAN subnet for each user's login session to the BMC system, so that the user can manage the hardware resources of the service server in the session VLAN subnet. The session VLAN subnet is a virtual local area network built for each login session, and the network devices in each session VLAN subnet are in the same broadcast domain; A permission configuration module, used to configure the user's permission level for managing the hardware resources of the service server in the session VLAN subnet; The authority configuration module includes: The permission level matching module is used to match the permission level corresponding to the user identity ID; The session permission allocation module is used to configure the data access permissions between various devices in the session VLAN subnet.

2. The BMC system with a multi-level user remote authentication mechanism according to claim 1, characterized in that: The session management module includes: An authentication request receiving module is used to receive a login authentication request sent by a client, wherein the login authentication request includes a user identity ID and user authentication information; An authentication information verification module, used to verify the legitimacy of the authentication information in the login authentication request; The session ID generation module is used to generate a session ID for the login session when the user's authentication information passes the verification, and the session ID is bound to the user's identity ID.

3. The BMC system with a multi-level user remote authentication mechanism according to claim 2, characterized in that: The session management module also includes: A user type identification module is used to identify the identity type of the logged-in user according to the user identity ID; The VLAN management module includes: A first list generating module is configured to obtain the server IDs of all the business servers in the business server cluster to generate a first target server ID list when the identity type of the logged-in user is a platform user; A VLAN construction module is used to construct a session VLAN subnet based on the first target server ID list, and the session VLAN subnet is bound to the session ID.

4. The BMC system with a multi-level user remote authentication mechanism according to claim 3, characterized in that: The VLAN management module also includes: A second list generating module is configured to obtain the server IDs of the business servers related to the logged-in user in the business server cluster to generate a second target server ID list when the identity type of the logged-in user is a tenant user; A VLAN construction module is used to construct a session VLAN subnet based on the second target server ID list, and the session VLAN subnet is bound to the session ID.

5. The BMC system with a multi-level user remote authentication mechanism according to claim 4, characterized in that: The second list generating module includes: A tenant ID matching module, used to match the tenant ID corresponding to the user identity ID; A business service content acquisition module is used to obtain the business service content associated with the tenant ID; The second list generating module is specifically configured to obtain the server ID of the business server where the service program of the business service content is deployed to generate the second target server ID list.

6. The BMC system with a multi-level user remote authentication mechanism according to any one of claims 4-5, characterized in that: The session VLAN subnet is a virtual local area network defined based on a port, and the VLAN building module includes: a third list generating module, configured to obtain a switch port corresponding to each service server in the first target server ID list or the second target server ID list to generate a target switch port ID list; The VLAN port binding module is used to bind the ports in the target switch port ID list as the networking ports of the session VLAN subnet.

7. The BMC system with a multi-level user remote authentication mechanism according to claim 6, characterized in that: The VLAN building module also includes: A virtual switch construction module, configured to construct a virtual switch for localizing the client, wherein the virtual switch includes a plurality of virtual ports; A virtual client construction module, configured to construct a local virtual client device corresponding to the client, wherein the local virtual client device is connected to the virtual switch through the virtual port to connect to a local network of the data center; The virtual client access module is used to add the virtual client device to the session VLAN subnet through the port number of the virtual port.

8. The BMC system with a multi-level user remote authentication mechanism according to claim 7, characterized in that: The VLAN construction module further includes an authentication server access module, which is used to add the authentication server to the session VLAN subnet through the port number of the virtual port.

9. The BMC system with a multi-level user remote authentication mechanism according to claim 1, characterized in that: The VLAN management module also includes: The session status monitoring module is used to monitor the status of the login session corresponding to the session ID; The subnet disbanding module is used to disband the session VLAN subnet when the state of the login session is invalid.

Images