Device access method, product, device and medium

Abstract

The present invention discloses a device access method, product, device and medium, which relates to the field of servers. In order to solve the problem that the process of in-band identity authentication significantly reduces the efficiency of management, the device access method includes: in response to receiving an authentication request from the access party for an in-band trust domain established in the operating system of the server, performing identity authentication on the access party; when the identity authentication is passed, outputting the current access request to the target access interface of the server management device through the in-band trust domain, so that the server management device responds to the received current access request to meet the authentication-free condition, and returns feedback information based on the current access request; receiving the feedback information returned by the server management device. The present invention can simplify the in-band identity authentication process and improve management efficiency.

Description

Technical Field

[0001] The present invention relates to the field of servers, and in particular to a device access method, product, device and medium. Background Art

[0002] As a management device for servers, BMC (Baseboard Management Controller) is responsible for monitoring the operating status of servers and providing a remote management interface. With the advancement of technology, Redfish is an open standard protocol that provides a standardized method for remotely managing server hardware. With its standardization and flexibility, it has gradually replaced the traditional IPMI (Intelligent Platform Management Interface) protocol and become a new standard for server management. According to the Redfish specification, although authentication is not required to access the service root " / redfish / v1 / ", authentication is required when accessing other resources, even for in-band management within the server system, which undoubtedly increases the complexity of management. In the context of the rapid development of the server industry, the business operation unit and the server management unit are usually separated, and the business end often does not understand the management credentials of the BMC. Especially in large-scale data centers or in the case of customized user names / passwords for the access party, the in-band authentication process significantly reduces the efficiency of management.

[0003] Therefore, how to provide a solution to the above technical problems is a problem that those skilled in the art need to solve at present. Summary of the invention

[0004] The purpose of the present invention is to provide a device access method, product, device and medium, which relate to the server field, simplify the in-band identity authentication process and improve management efficiency.

[0005] To solve the above technical problems, the present invention provides a device access method, which is applied to a server, and the device access method includes: in response to receiving an authentication request from the access party for an in-band trust domain established in the operating system of the server, performing identity authentication on the access party; when the identity authentication is passed, outputting the current access request to the target access interface of a server management device through the in-band trust domain, so that the server management device returns feedback information based on the current access request in response to the received current access request satisfying the authentication-free condition; and receiving the feedback information returned by the server management device.

[0006] Optionally, the server management device responds to the current access request received satisfying the authentication-free condition and the process of returning feedback information based on the current access request includes: the server management device determines whether the uniform resource locator corresponding to the current access request received is in a preset access control list; if so, determines that the current access request satisfies the authentication-free condition, and returns feedback information based on the current access request.

[0007] Optionally, the process by which the server management device determines whether the uniform resource locator corresponding to the current access request received is in a preset access control list includes: the server management device determines whether the sending channel of the current access request is an in-band management channel corresponding to the in-band system; if the sending channel is the in-band management channel, determining whether the uniform resource locator corresponding to the current access request is in a preset access control list.

[0008] Optionally, the process of outputting the current access request to the target access interface of the server management device through the in-band trust domain includes: outputting the current access request with characteristic information to the target access interface of the server management device through the in-band trust domain; the characteristic information is information encrypted based on the encryption mode pre-shared by the in-band trust domain and the server management device; if the sending channel is the in-band management channel, the process of determining whether the uniform resource locator corresponding to the current access request is in a preset access control list includes: if the sending channel is the in-band management channel, determining whether the current access request is a valid current access request based on the characteristic information; if so, determining whether the uniform resource locator corresponding to the current access request is in a preset access control list.

[0009] Optionally, the process of determining whether the current access request is a valid current access request based on the characteristic information includes: decrypting the characteristic information according to the encryption mode to obtain decrypted characteristic information; performing validity verification on the decrypted characteristic information; if the verification passes, determining that the current access request is a valid current access request.

[0010] Optionally, the process of establishing an in-band trust domain in the operating system of the server includes: creating a container in the operating system of the server as the in-band trust domain; or creating a virtual machine in the operating system of the server as the in-band trust domain.

[0011] Optionally, the device access method also includes: the server management device distributes the current access request to the corresponding request method in response to receiving the current access request; the process of returning feedback information based on the current access request includes: determining the feedback information corresponding to the current access request according to the request method, and returning it.

[0012] Optionally, in response to receiving an authentication request from an accessor for an in-band trust domain established in an operating system of a server, the process of authenticating the accessor includes: receiving an authentication request input by the accessor including identity authentication information; the identity authentication information includes one of the accessor's user name and password, a digital certificate, a public-private key pair, and a preset authentication token; comparing the identity authentication information with the authentication data stored in the in-band trust domain; if the comparison is consistent, determining that the accessor's identity authentication has passed; if the comparison is inconsistent, determining that the accessor's identity authentication has failed.

[0013] Optionally, the device access method further includes: in response to the received current access request not satisfying the authentication-free condition, the server management device performs authentication access on the current access request in accordance with a standard protocol authentication method.

[0014] Optionally, the device access method further includes: receiving an access log recorded by the server management device; the access log includes one or more of access time, client identifier, request content, and feedback information.

[0015] Optionally, after establishing an in-band trust domain in the operating system of the server, the device access method further includes: allocating computing resources, memory resources and storage resources in the server to the in-band trust domain; and adjusting the computing resources, the memory resources and the storage resources based on the actual running status of a management tool or application running in the in-band trust domain.

[0016] In order to solve the above technical problems, the present invention also provides a device access method, which is applied to a server management device. The device access method includes: when a current access request is received, determining whether the current access request meets the authentication-free condition; the current access request includes the current access request output based on the in-band trust domain established in the server's operating system after the accessing party has passed the identity authentication; if so, returning feedback information based on the current access request; if not, performing authentication access on the current access request in accordance with a standard protocol authentication method.

[0017] To solve the above technical problem, the present invention further provides a computer program product, including a computer program / instruction, which implements the steps of the device access method as described in any one of the above items when executed by a processor.

[0018] To solve the above technical problems, the present invention further provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of the device access method as described in any one of the above items when executing the computer program.

[0019] To solve the above technical problem, the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the device access method described in any one of the above items are implemented.

[0020] The present invention provides a device access method, which reduces the need for identity authentication of other resources when performing in-band management inside a server by authenticating the access party in an in-band trust domain. The access party only needs to pass identity authentication once to access the server management device through the in-band trust domain. When the authentication-free condition is met, conventional identity authentication is not required in the server management device, and feedback information can be directly returned in response to the current access request, thereby reducing the complexity of management. In particular, in the case of large-scale data centers or customized access party names / passwords, the identity authentication process is simplified and management efficiency is improved.

[0021] The present invention also provides another device access method, electronic device, computer program product and computer readable storage medium, which have the same beneficial effects as the above device access method. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0023] Figure 1 This is a flow chart of the steps of the first device access method provided by the present invention.

[0024] Figure 2 A schematic diagram of an in-band access provided by the present invention.

[0025] Figure 3 This is a step flow chart of the second device access method provided by the present invention.

[0026] Figure 4 This is a structural schematic diagram of a device access system provided by the present invention.

[0027] Figure 5 This is a step flow chart of the third device access method provided by the present invention.

[0028] Figure 6 The present invention is a schematic structural diagram of an electronic device provided by the present invention.

[0029] Figure 7 This is a schematic diagram of the structure of a computer-readable storage medium provided by the present invention. DETAILED DESCRIPTION

[0030] The core of the present invention is to provide a device access method, product, device and medium, which relates to the server field, simplifies the in-band identity authentication process and improves management efficiency.

[0031] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] First, please refer to Figure 1 The present invention provides a device access method, which is applied to a server. The device access method includes:

[0033] S101: In response to receiving an authentication request from a visitor for an in-band trust domain established in an operating system of a server, performing identity authentication on the visitor.

[0034] In this embodiment, a trust domain is first established between the server management device and the in-band client. Figure 2 As shown, an in-band trust domain is established in the operating system of the server, and the in-band trust domain is isolated from other parts of the server, including but not limited to network isolation, memory isolation, etc., so that data and applications in the in-band trust domain will not be affected by malware or attacks in other parts of the server. Strict identity authentication and authorization are performed on the entrance to the in-band trust domain to ensure that only authorized access parties can access it. The access parties can specifically be users or applications.

[0035] Furthermore, a management tool that supports Redfish is installed and configured in the server's operating system. The management tool can run in the in-band trust domain. First, the management tool is deployed to the server's operating system and configured accordingly, including but not limited to setting the management tool's parameters, user permissions, etc., to ensure that the management tool can run normally in the in-band trust domain and communicate effectively with the BMC. The management tool running in the in-band trust domain communicates with the Redfish interface of the server management device (such as BMC) through the in-band transmission channel to achieve management and monitoring of the server. In addition, the management tool can be expanded according to actual needs, such as adding customized monitoring indicators, alarm rules, etc. Security policies are also deployed in the server management device, including but not limited to data encryption, access control lists, and firewall rules.

[0036] Specifically, the management tool receives an authentication request sent by an access party (which may be a user or an application) in the in-band trust domain, and performs identity authentication on the access party to ensure that it is an authorized user or authorized application.

[0037] In an exemplary embodiment, in response to receiving an authentication request from an accessor for an in-band trust domain established in an operating system of a server, a process for authenticating the accessor includes: receiving an authentication request input by the accessor including identity authentication information; the identity authentication information includes one of the accessor's user name and password, a digital certificate, a public-private key pair, and a preset authentication token; comparing the identity authentication information with the authentication data stored in the in-band trust domain; if the comparison is consistent, determining that the accessor's identity authentication has passed; if the comparison is inconsistent, determining that the accessor's identity authentication has failed.

[0038] The comparison process includes verifying whether the username and password of the accessor match the stored password hash value, verifying the validity of the digital certificate, the signature and whether it is issued by a trusted certificate authority, using the public key to verify the private key signature in the public-private key pair, and verifying at least one of the validity of the preset authentication token. Even if the identity authentication is passed, the accessor still needs to comply with the access control policy, including the access control list check. In this way, the management tool can ensure that only properly authenticated and authorized accessors can access resources within the in-band trust domain, thereby protecting the server from unauthorized access and potential security threats.

[0039] S102: When the identity authentication is passed, the current access request is output to the target access interface of the server management device through the in-band trust domain, so that the server management device returns feedback information based on the current access request in response to the received current access request satisfying the authentication-free condition.

[0040] S103: Receive feedback information returned by the server management device.

[0041] In this embodiment, the management data running in the in-band trust domain can generate a current access request based on the access requirements of the accessing party, and the current access request includes but is not limited to operations such as querying the server status, configuration changes, and firmware updates. The management tool sends the encrypted access request to the target access interface of the server management device through the in-band trust domain, and the target access interface includes but is not limited to the Redfish interface. The in-band trust domain provides a secure communication path to ensure the secure transmission of the request.

[0042] By authenticating the access party to the in-band trust domain, the need to authenticate other resources when performing in-band management within the server is reduced. The access party only needs to pass the identity authentication once to access the server management device through the in-band trust domain, thereby improving the security of the system.

[0043] In this embodiment, a Redfish interface is configured in the server management device (such as BMC) to enable it to communicate conveniently with the in-band trust domain. At the same time, the server management device is configured to configure the authentication-free condition for it. When the server management device receives a current access request that meets the authentication-free condition, it will return feedback information based on the request. The authentication-free condition means that in certain specific cases, the server management device can directly respond to the request without identity verification every time. The management tool receives feedback information returned by the server management device through the in-band trust domain. The feedback information includes but is not limited to the result of the request processing, server status update or other related information.

[0044] Furthermore, the management tool can verify the integrity of the feedback information to ensure that the information has not been tampered with during transmission, including verifying whether the feedback information conforms to the expected format and content. Based on the content of the feedback information, the management tool can decide how to further process it. For example, if the feedback information contains errors, the management tool may need to take corresponding measures, such as resending the request or notifying the user. If the feedback information contains information that has been successfully processed, the management tool needs to notify the accessing party or update the interface display.

[0045] It can be seen that in this embodiment, by authenticating the access party in the in-band trust domain, the need for authenticating other resources when performing in-band management inside the server is reduced. The access party only needs to pass the identity authentication once to access the server management device through the in-band trust domain. When the authentication-free condition is met, the server management device does not need to perform regular identity authentication, and can directly respond to the current access request and return feedback information, thereby reducing the complexity of management. In particular, in the case of large-scale data centers or customized access party names / passwords, the identity authentication process is simplified and management efficiency is improved.

[0046] Based on the above embodiments:

[0047] In an exemplary embodiment, the process in which the server management device returns feedback information based on the current access request in response to the current access request satisfying the authentication-free condition includes: the server management device determines whether the uniform resource locator corresponding to the received current access request is in a preset access control list; if so, determines that the current access request satisfies the authentication-free condition, and returns feedback information based on the current access request.

[0048] In this embodiment, after receiving the current access request, the server management device determines whether the Uniform Resource Locator (URL) corresponding to the current access request is in the preset access control list. The access control list (ACL) is a list of URLs that are allowed or prohibited to access, which is used to control access rights to server resources. If the URL exists in the preset access control list, the server management device will determine that the current access request meets the authentication-free condition, then the request can be directly responded to by the server management device without further identity verification. The server management device parses the current access request that meets the authentication-free condition, calls the background resource management, and directly returns feedback information. The feedback information may include the result of the request processing, server status update, or other related information.

[0049] The server management device supports user-defined Redfish URL access control lists, i.e. authentication-free access whitelists. Users can manually add or delete URLs to control which requests can be accessed without authentication and which require identity verification. If the URL of the current access request is not in the whitelist, the server management device will authenticate access in accordance with standard authentication methods, including but not limited to using basic authentication (Basic) or token authentication (Token) and other methods.

[0050] In this way, the server management device can flexibly control access to the server based on the user-defined access control list while maintaining the security protection of sensitive resources. This method improves management efficiency while ensuring the security of the system.

[0051] Different access permissions can be set according to the needs of different users and applications. For example, administrator users can be set to have full access permissions, while ordinary users can only view part of the information, and the rest of the information still requires identity authentication.

[0052] In an exemplary embodiment, different access rights can be assigned to different user or application roles, and roles can have predefined access rights, such as read, write, execute, etc. When a user or application logs in, it will be associated with one or more roles, thereby obtaining corresponding access rights. In an exemplary embodiment, multiple access control lists can be created in advance, each access control list contains a set of URLs that allow unauthenticated access, and when a user or application logs in, it will be associated with one or more access control lists based on its identity verification information, thereby obtaining corresponding access rights.

[0053] Combined with access permission settings, administrators can flexibly create and manage authentication-free access whitelists to meet the needs of different users and applications while ensuring system security. Through strict management and audit logging, abuse of permissions can be prevented and system security can be improved.

[0054] In an exemplary embodiment, the process by which the server management device determines whether the uniform resource locator corresponding to the current access request received is in a preset access control list includes: the server management device determines whether the sending channel of the current access request is an in-band management channel corresponding to the in-band system; if the sending channel is an in-band management channel, determines whether the uniform resource locator corresponding to the current access request is in the preset access control list.

[0055] It can be understood that LAN (Local Area Network) over USB (Universal Serial Bus) is a special in-band management method, which allows the BMC to be connected to the server through a USB interface. After the connection is established, the BMC device and the management client (system tools, etc.) can communicate through the USB interface. This method can ensure that a channel is provided for in-band management when the server has no network connection or the network connection is unstable. The in-band management channel in this embodiment can specifically be a LAN over USB channel.

[0056] Specifically, the server management device first determines whether the channel for issuing the current access request is the in-band management channel corresponding to the in-band system. For example, if the request is sent through the LAN over USB channel, it meets the conditions of the in-band management channel. If the transmission channel is the in-band management channel, the server management device will determine whether the uniform resource locator (URL) corresponding to the current access request is in the preset access control list. If it is not the in-band management channel, the authentication access (Basic or Token) is performed according to the standard protocol authentication method.

[0057] Correspondingly, the configuration of the server management device also includes configuring which Redfish interfaces can access the BMC without authentication through the LAN over USB in-band channel, ensuring that the Redfish interface can effectively communicate with the management tools in the in-band trust domain. Through this configuration, the server management device can decide whether to process the access request without authentication based on the access control list and the configuration of the Redfish interface under the in-band management channel. This method improves management efficiency while ensuring the security of the system.

[0058] In an exemplary embodiment, the process of outputting a current access request to a target access interface of a server management device through an in-band trust domain includes: outputting a current access request with characteristic information to a target access interface of a server management device through an in-band trust domain; the characteristic information is information encrypted based on an encryption mode pre-shared by the in-band trust domain and the server management device; if the sending channel is an in-band management channel, the process of determining whether a uniform resource locator corresponding to the current access request is in a preset access control list includes: if the sending channel is an in-band management channel, determining whether the current access request is a valid current access request based on the characteristic information; if so, determining whether the uniform resource locator corresponding to the current access request is in a preset access control list.

[0059] In this embodiment, the deployment management tool or application generates a current access request with characteristic information in the in-band trust domain. The characteristic information is information encrypted based on the encryption mode pre-shared by the in-band trust domain and the server management device, ensuring that the two can be securely authenticated in both directions. Accordingly, the BMC Redfish module is optimized to support the Redfish standard while adding the decryption logic of the characteristic information of the in-band trust domain request. The characteristic information carried by the current access request is used to determine whether the access request is sent from the in-band trust domain. In order to ensure the security of the interaction, the characteristic information is encrypted by the BMC and the tool or application through a pre-shared key or a public-private key pair. If it is not a request from the trust domain, the authentication access (Basic or Token) is performed in accordance with the standard protocol authentication method. In this way, the server management device can ensure that only requests from the trust domain can be accessed without authentication, while ensuring the security of the system, which is suitable for scenarios that require high security and management efficiency.

[0060] In an exemplary embodiment, the process of determining whether a current access request is a valid current access request based on characteristic information includes: decrypting the characteristic information according to an encryption mode to obtain decrypted characteristic information; performing validity verification on the decrypted characteristic information; if the verification passes, determining that the current access request is a valid current access request.

[0061] The server management device uses a pre-shared key or private key (in the public-private key pair encryption mode) to decrypt the feature information. The decrypted feature information will be restored to its original state. The decrypted feature information will be verified for validity to ensure its integrity and non-tampering. The verification may include checking the hash value of the feature information, verifying the digital signature, confirming the data integrity, etc. If the verification passes, the server management device will determine that the current access request is a valid current access request, which means that the request comes from a trusted source and can be regarded as a valid current access request.

[0062] Through this method, the server management device can ensure that only requests that have been effectively verified can be trusted and executed, thereby improving the security of the system.

[0063] In an exemplary embodiment, the process of establishing an in-band trust domain in the operating system of the server includes: creating a container in the operating system of the server as the in-band trust domain; or creating a virtual machine in the operating system of the server as the in-band trust domain.

[0064] In this embodiment, the process of establishing an in-band trust domain in the operating system of the server may include two methods: creating a container or creating a virtual machine. When creating a container as an in-band trust domain, it includes but is not limited to using a container orchestration tool (such as Docker) to create a container in the server operating system, configuring the container so that it has an independent file system, network interface and process isolation, installing necessary management tools and applications to support in-band management operations, configuring the network of the container so that it can communicate with other parts of the server while maintaining isolation, and configuring access control of the container to allow only authenticated access parties to access.

[0065] When creating a virtual machine as an in-band trust domain: Use virtualization software to create a virtual machine in the server operating system, configure the hardware resources of the virtual machine, such as the CPU (Central Processing Unit), memory, storage, and network interface, install the operating system in the virtual machine and configure it to support in-band management operations, configure the network of the virtual machine so that it can communicate with the rest of the server while maintaining isolation, and configure access control for the virtual machine to allow access only to authenticated parties.

[0066] Through these two methods, an independent in-band trust domain can be created in the server's operating system, which helps to improve the security and management efficiency of the server, especially in scenarios that require high security and management efficiency.

[0067] In an exemplary embodiment, the device access method also includes: the server management device distributes the current access request to the corresponding request method in response to receiving the current access request; the process of returning feedback information based on the current access request includes: determining the feedback information corresponding to the current access request according to the request method, and returning it.

[0068] Combination Figure 3 The device access method provided by the present invention is described in detail: In the server's operating system, a separate in-band trust domain is created using virtual machine or container technology. This domain is isolated from the rest of the server, and only authorized users and applications can access the container. After entering the operating system, user name and password, digital certificate, etc. can be used for identity authentication. Figure 3In-band trusted domain access authentication. Deploy and configure management tools or applications in the in-band trusted domain, run management tools, and call the target access interface (Redfish interface) to access the BMC with identifiable feature information, that is, encrypted feature information, so that the baseboard management controller can distinguish trust domain requests. This feature information is encrypted by the baseboard management controller and the tool or application through a pre-shared key or a public-private key pair to ensure secure two-way authentication between the two.

[0069] On the baseboard management controller response side: First, optimize the Redfish module of the baseboard management controller to support the Redfish standard, add the decryption logic of the trust domain request feature information, and configure which Redfish interfaces can access the baseboard management controller through the LAN over USB in-band channel without authentication according to the URL access control list (i.e., the whitelist based on the trust domain without authentication) rules, to ensure that the Redfish interface can effectively communicate with the management tools in the in-band trust domain. The specific implementation is as follows:

[0070] Step 1: After receiving the Redfish request (current access request), the baseboard management controller first distributes the request to the corresponding request method, such as obtain, submit, patch, delete, etc., and determines whether the current access request is issued through an in-band transmission channel, that is, whether it is issued by the in-band system through the USB channel. If not, it performs authentication access (Basic or Token) according to the standard protocol authentication method, that is, it determines whether it carries standard protocol authentication information. If so, it performs Redfish access authentication. If it is issued by the in-band system through the USB channel, it proceeds to Step 2;

[0071] Step 2: It is necessary to further determine whether the current access request is sent from the in-band trust domain, and to judge it through the characteristic information carried in the request, and determine whether the authentication is passed after the characteristic information is decrypted. In order to ensure the security of the interaction, the characteristic information is encrypted by the baseboard management controller and the tool or application through a pre-shared key or a public-private key pair. If it is not a request from the trust domain, the authentication access is performed according to the standard protocol authentication method (Basic or Token). If it is, proceed to Step 3. If not, determine whether it carries standard protocol authentication information. If so, perform Redfish access authentication;

[0072] Step 3: The baseboard management controller supports user-defined RedfishURL access control list (authentication-free access whitelist) to determine whether the URL of the current access request is in the access control list. If not, authentication access is performed according to the standard protocol authentication method (Basic or Token). If yes, proceed to Step 4.

[0073] Step 4: No need for Redfish access authentication, skip the Redfish standard authentication link, parse the request message, call the background resources and feedback information normally, and complete the entire process of in-band Redfish access to the baseboard management controller in the trust domain.

[0074] In an exemplary embodiment, the device access method further includes: receiving an access log recorded by the server management device; the access log includes one or more of access time, client identification, request content, and feedback information.

[0075] In this embodiment, the server management device records the logs of all accesses during the entire process, regardless of whether the access is authentication-free or not, and whether the access is successful or failed, including access time, client identification, request content, results and other information, for subsequent troubleshooting, auditing and security management.

[0076] In an exemplary embodiment, after establishing an in-band trust domain in the operating system of the server, the device access method also includes: allocating computing resources, memory resources and storage resources in the server to the in-band trust domain; and adjusting the computing resources, memory resources and storage resources based on the actual running status of the management tool or application running in the in-band trust domain.

[0077] After establishing an in-band trust domain in the server's operating system, in order to ensure that the applications in the trust domain can run normally, it is necessary to allocate appropriate computing resources, memory resources, and storage resources to the in-band trust domain. In order to improve resource utilization, these resources should be dynamically adjusted according to the actual running status of the management tools or applications running in the in-band trust domain. This ensures that the in-band trust domain has appropriate resources in the server, while maintaining effective resource utilization and stable system operation.

[0078] In summary, the present invention improves the access convenience of BMC. By establishing an in-band trust domain and configuring the Redfish interface, users can directly access the BMC through the management tool in the OS of the server according to their own needs, without the need to pass the authentication operation of the BMC username / password, which is more convenient and quick. The management tool can also be deeply integrated with the operating system of the server to provide richer management functions and better user experience. For example, users can directly view the hardware status, remote management, etc. of the server in the management tool without switching to other software or tools. The security of the BMC is enhanced: the in-band trust domain is isolated from the rest of the server, and only authorized applications and users can access it. At the same time, corresponding access rights and security policies are set to ensure that only legitimate requests can access the BMC through the Redfish interface, thereby improving the security of the BMC. The isolation mechanism of the in-band trust domain can effectively prevent the impact of malware and attacks on the BMC. Even if other parts of the server are attacked, the BMC in the in-band trust domain can still remain safe. The setting of access rights and security policies can ensure that only legitimate users and applications can access the BMC, preventing unauthorized access and data leakage.

[0079] Second, please refer to Figure 4 , Figure 4 A schematic diagram of the structure of a device access system provided by the present invention includes:

[0080] The first verification module 11 is used to perform identity authentication on the access party in response to receiving an authentication request from the access party for the in-band trust domain established in the operating system of the server.

[0081] The request output module 12 is used to output the current access request to the target access interface of the server management device through the in-band trust domain when the identity authentication is passed, so that the server management device responds to the current access request received to meet the authentication-free condition and returns feedback information based on the current access request.

[0082] The first receiving module 13 is used to receive the feedback information returned by the server management device.

[0083] It can be seen that in this embodiment, by authenticating the access party in the in-band trust domain, the need for authenticating other resources when performing in-band management inside the server is reduced. The access party only needs to pass the identity authentication once to access the server management device through the in-band trust domain. When the authentication-free condition is met, the server management device does not need to perform regular identity authentication, and can directly respond to the current access request and return feedback information, thereby reducing the complexity of management. In particular, in the case of large-scale data centers or customized access party names / passwords, the identity authentication process is simplified and management efficiency is improved.

[0084] In an exemplary embodiment, the process in which the server management device returns feedback information based on the current access request in response to the current access request satisfying the authentication-free condition includes: the server management device determines whether the uniform resource locator corresponding to the received current access request is in a preset access control list; if so, determines that the current access request satisfies the authentication-free condition, and returns feedback information based on the current access request.

[0085] In an exemplary embodiment, the process by which the server management device determines whether the uniform resource locator corresponding to the current access request received is in a preset access control list includes: the server management device determines whether the sending channel of the current access request is an in-band management channel corresponding to the in-band system; if the sending channel is an in-band management channel, determines whether the uniform resource locator corresponding to the current access request is in the preset access control list.

[0086] In an exemplary embodiment, the process of outputting a current access request to a target access interface of a server management device through an in-band trust domain includes: outputting a current access request with characteristic information to the target access interface of the server management device through the in-band trust domain; the characteristic information is information encrypted based on an encryption mode pre-shared by the in-band trust domain and the server management device. If the sending channel is an in-band management channel, the process of determining whether a uniform resource locator corresponding to the current access request is in a preset access control list includes: if the sending channel is an in-band management channel, determining whether the current access request is a valid current access request based on the characteristic information; if so, determining whether the uniform resource locator corresponding to the current access request is in the preset access control list.

[0087] In an exemplary embodiment, the process of determining whether a current access request is a valid current access request based on characteristic information includes: decrypting the characteristic information according to an encryption mode to obtain decrypted characteristic information; performing validity verification on the decrypted characteristic information; if the verification passes, determining that the current access request is a valid current access request.

[0088] In an exemplary embodiment, the process of establishing an in-band trust domain in the operating system of the server includes: creating a container in the operating system of the server as the in-band trust domain; or creating a virtual machine in the operating system of the server as the in-band trust domain.

[0089] In an exemplary embodiment, the device access system also includes: a distribution module, which is used to distribute the current access request to the corresponding request system in response to receiving the current access request at the server management device; the process of returning feedback information based on the current access request includes: determining the feedback information corresponding to the current access request according to the request method, and returning it.

[0090] In an exemplary embodiment, in response to receiving an authentication request from a visitor for an in-band trust domain established in an operating system of a server, a process for authenticating the visitor includes: receiving an authentication request input by the visitor including identity authentication information; the identity authentication information includes one of the visitor's user name and password, a digital certificate, a public-private key pair, and a preset authentication token; comparing the identity authentication information with the authentication data stored in the in-band trust domain; if the comparison is consistent, determining that the visitor's identity authentication has passed; if the comparison is inconsistent, determining that the visitor's identity authentication has failed.

[0091] In an exemplary embodiment, the device access system further includes: a second verification module, configured to perform authentication access according to a standard protocol authentication method for the current access request in response to the server management device receiving the current access request not satisfying the authentication-free condition.

[0092] In an exemplary embodiment, the device access system further includes: a second receiving module for receiving an access log recorded by the server management device; the access log includes one or more of access time, client identification, request content, and feedback information.

[0093] In an exemplary embodiment, after establishing an in-band trust domain in the operating system of the server, the device access system also includes: an allocation module for allocating computing resources, memory resources and storage resources in the server to the in-band trust domain; the computing resources, memory resources and storage resources are adjusted based on the actual running status of the management tool or application running in the in-band trust domain.

[0094] Third, please refer to Figure 5 The present invention also provides a device access method, which is applied to a server management device. The device access method includes:

[0095] S201: receiving a current access request; the current access request includes a current access request output based on the in-band trust domain after the accessing party passes the identity authentication of the in-band trust domain established in the operating system of the server.

[0096] S202: Determine whether the current access request meets the authentication-free condition. If so, execute S203; if not, execute S204.

[0097] S203: Return feedback information based on the current access request.

[0098] S204: Performing authentication access according to a standard protocol authentication method for the current access request.

[0099] It can be seen that in this embodiment, by authenticating the access party in the in-band trust domain, the need for authenticating other resources when performing in-band management inside the server is reduced. The access party only needs to pass the identity authentication once to access the server management device through the in-band trust domain. When the authentication-free condition is met, the server management device does not need to perform regular identity authentication, and can directly respond to the current access request and return feedback information, thereby reducing the complexity of management. In particular, in the case of large-scale data centers or customized access party names / passwords, the identity authentication process is simplified and management efficiency is improved.

[0100] In a fourth aspect, the present invention further provides a computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the device access method described in any of the above embodiments.

[0101] For an introduction to a computer program product provided by the present invention, please refer to the above embodiments, and the present invention will not be described in detail here.

[0102] A computer program product provided by the present invention has the same beneficial effects as the above-mentioned device access method.

[0103] Fifth, please refer to Figure 6 The present invention further provides an electronic device, comprising: a memory 21 for storing a computer program; a processor 22 for implementing the steps of the device access method described in any of the above embodiments when executing the computer program.

[0104] The electronic device also includes an input interface 23, which is connected to the processor 22 via a communication bus 26 and is used to obtain externally imported computer programs, parameters and instructions, and save them in the memory 21 under the control of the processor 22. The input interface can be connected to an input device to receive parameters or instructions manually input by the visitor. The input device can be a touch layer covered on the display screen, or a key, trackball or touchpad set on the terminal housing.

[0105] The display unit 24 is connected to the processor 22 via the communication bus 26 and is used to display the data sent by the processor 22. The display unit can be a liquid crystal display or an electronic ink display.

[0106] The network port 25 is connected to the processor 22 via the communication bus 26, and is used to communicate with various external terminal devices. The communication technology used in the communication connection can be a wired communication technology or a wireless communication technology, such as mobile high-definition link technology, universal serial bus, high-definition multimedia interface, wireless fidelity technology, Bluetooth communication technology, low-power Bluetooth communication technology, communication technology based on IEEE802.11s, etc.

[0107] For an introduction to an electronic device provided by the present invention, please refer to the above embodiments, and the present invention will not be described in detail here.

[0108] The electronic device provided by the present invention has the same beneficial effects as the above-mentioned device access method.

[0109] For the sixth aspect, please refer to Figure 7 The present invention further provides a computer-readable storage medium 30, on which a computer program 31 is stored. When the computer program 31 is executed by a processor, the steps of the device access method described in any of the above embodiments are implemented.

[0110] The computer-readable storage medium 30 may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0111] For an introduction to a computer-readable storage medium provided by the present invention, please refer to the above embodiments, and the present invention will not be described in detail here.

[0112] A computer-readable storage medium provided by the present invention has the same beneficial effects as the above-mentioned device access method.

[0113] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0114] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A device access method, characterized in that: Applied to a server, the device access method includes: In response to receiving an authentication request from a visitor for an in-band trust domain established in an operating system of a server, performing identity authentication on the visitor; When the identity authentication is passed, the current access request is output to the target access interface of the server management device through the in-band trust domain, so that the server management device returns feedback information based on the current access request in response to the received current access request satisfying the authentication-free condition; receiving the feedback information returned by the server management device; In response to receiving an authentication request from a visitor for an in-band trust domain established in an operating system of a server, a process of authenticating the visitor includes: Receive an authentication request including identity authentication information input by the access party; the identity authentication information includes one of the access party's user name and password, digital certificate, public-private key pair, and preset authentication token; comparing the identity verification information with authentication data stored in the in-band trust domain; If the comparison is consistent, it is determined that the identity authentication of the accessing party is successful; If the comparison is inconsistent, it is determined that the identity authentication of the access party has failed.

2. The device access method according to claim 1, characterized in that: The process in which the server management device returns feedback information based on the current access request in response to the current access request meeting the authentication-free condition includes: The server management device determines whether the uniform resource locator corresponding to the received current access request is in a preset access control list; If so, it is determined that the current access request satisfies the authentication-free condition, and feedback information is returned based on the current access request.

3. The device access method according to claim 2, characterized in that: The process of the server management device determining whether the uniform resource locator corresponding to the received current access request is in a preset access control list includes: The server management device determines whether the issuing channel of the current access request is an in-band management channel corresponding to the in-band system; If the issuing channel is the in-band management channel, it is determined whether the uniform resource locator corresponding to the current access request is in a preset access control list.

4. The device access method according to claim 3, characterized in that: The process of outputting the current access request to the target access interface of the server management device through the in-band trust domain includes: Outputting a current access request with characteristic information to a target access interface of the server management device through the in-band trust domain; the characteristic information is information encrypted based on an encryption mode pre-shared by the in-band trust domain and the server management device; If the delivery channel is the in-band management channel, the process of determining whether the uniform resource locator corresponding to the current access request is in a preset access control list includes: If the issuing channel is the in-band management channel, determining whether the current access request is a valid current access request based on the characteristic information; If so, determine whether the uniform resource locator corresponding to the current access request is in a preset access control list.

5. The device access method according to claim 4, characterized in that: The process of judging whether the current access request is a valid current access request based on the characteristic information includes: Decrypting the characteristic information according to the encryption mode to obtain decrypted characteristic information; Performing validity verification on the decrypted feature information; If the verification passes, the current access request is determined to be a valid current access request.

6. The device access method according to claim 1, characterized in that: The process of establishing an in-band trust domain in the server's operating system includes: Creating a container in the operating system of the server as an in-band trust domain; or, A virtual machine is created in the operating system of the server as an in-band trust domain.

7. The device access method according to claim 1, characterized in that: The device access method further includes: The server management device distributes the current access request to a corresponding request method in response to receiving the current access request; The process of returning feedback information based on the current access request includes: Determine feedback information corresponding to the current access request according to the request method and return it.

8. The device access method according to claim 1, characterized in that: The device access method further includes: In response to the received current access request not satisfying the authentication-free condition, the server management device performs authentication access on the current access request according to a standard protocol authentication method.

9. The device access method according to claim 1, characterized in that: The device access method further includes: Receive the access log recorded by the server management device; the access log includes one or more of access time, client identification, request content, and feedback information.

10. The device access method according to any one of claims 1 to 9, characterized in that: After establishing the in-band trust domain in the operating system of the server, the device access method further includes: The computing resources, memory resources and storage resources in the server are allocated to the in-band trust domain; the computing resources, the memory resources and the storage resources are adjusted based on the actual running state of the management tool or application running in the in-band trust domain.

11. A device access method, characterized in that: Applied to a server management device, the device access method includes: When receiving a current access request, determining whether the current access request satisfies an authentication-free condition; the current access request includes a current access request output based on the in-band trust domain established in the operating system of the server after the access party passes the identity authentication of the in-band trust domain; If so, returning feedback information based on the current access request; If not, perform authentication access according to the standard protocol authentication method for the current access request; The device access method further includes: The process of determining whether the access party has passed the identity authentication of the in-band trust domain established in the server's operating system includes: Receive an authentication request including identity authentication information input by the access party; the identity authentication information includes one of the access party's user name and password, digital certificate, public-private key pair, and preset authentication token; comparing the identity verification information with authentication data stored in the in-band trust domain; If the comparison is consistent, it is determined that the identity authentication of the accessing party is successful; If the comparison is inconsistent, it is determined that the identity authentication of the access party has failed.

12. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the device access method as described in any one of claims 1 to 11 are implemented.

13. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the device access method according to any one of claims 1 to 11 when executing the computer program.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the device access method according to any one of claims 1 to 11 are implemented.

Images