Equipment authentication method and device based on digital certificate, equipment, medium and product

Abstract

The invention discloses an equipment authentication method and device based on a digital certificate, equipment, a medium and a product, and relates to the field of information security. The method comprises the following steps: logging in a management platform in response to a first platform account, and displaying a plurality of server options in the management platform, the plurality of server options being corresponding servers in a permission range of the first platform account; in response to the received selection operation of the first platform account on the first server option in the plurality of server options, a first certificate is signed and issued to the first server through the management platform, the first server is a server corresponding to the first server option, and the first certificate is used for authorizing the first server to log in the first data account; the first data account and the first platform account have a corresponding relationship, and the first data account is used for accessing first data in the first server; after the first server logs in the first data account based on the first certificate, the first data is acquired from the first server, so that the user behavior auditing capability can be enhanced.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular to a device authentication method, apparatus, equipment, medium and product based on digital certificates. Background Art

[0002] In the current information security field, all systems with level 3 protection and above need to meet the two-factor authentication requirements in the host security category when logging into the server, that is, users need to provide at least two of the three types of credentials: known, held, and all.

[0003] In the related art, when a user logs into a server, in addition to being required to provide a user name and password, the user is required to additionally enter a one-time password (OTP) to confirm two authentication factors that the user knows and possesses.

[0004] However, server authentication can only identify that the user has the correct username, password and OTP, but cannot infer the user's identity or confirm whether the user has an authorized login device, which has defects in auditing. Summary of the invention

[0005] The embodiments of the present application provide a device authentication method, apparatus, device, medium and product based on digital certificates, which can enhance the user behavior audit capability. The technical solution is as follows.

[0006] In one aspect, a device authentication method based on a digital certificate is provided, the method comprising:

[0007] In response to the first platform account logging into the management platform, a plurality of server options are displayed in the management platform, and the servers corresponding to the plurality of server options are servers corresponding to the authority scope of the first platform account;

[0008] In response to receiving a selection operation of the first platform account on a first server option from among the multiple server options, issuing a first certificate to a first server through the management platform, the first server being a server corresponding to the first server option, the first certificate being used to authorize the first server to log in to a first data account, the first data account corresponding to the first platform account, and the first data account being used to access first data in the first server;

[0009] After the first server logs in to the first data account based on the first certificate, the first data is obtained from the first server.

[0010] On the other hand, a device authentication apparatus based on a digital certificate is provided, the apparatus comprising:

[0011] a platform display module, configured to display a plurality of server options in the management platform in response to the first platform account logging into the management platform, wherein the plurality of server options are servers corresponding to the authority scope of the first platform account;

[0012] a certificate issuing module, configured to issue a first certificate to a first server through the management platform in response to receiving a selection operation of the first platform account on a first server option from among the multiple server options, the first server being a server corresponding to the first server option, the first certificate being used to authorize the first server to log in to a first data account, the first data account corresponding to the first platform account, and the first data account being used to access first data in the first server;

[0013] The data acquisition module is used to acquire the first data from the first server after the first server logs in to the first data account based on the first certificate.

[0014] On the other hand, a computer device is provided, comprising a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement a device authentication method based on a digital certificate as described in any of the above-mentioned embodiments of the present application.

[0015] On the other hand, a computer-readable storage medium is provided, in which at least one instruction, at least one program, a code set or an instruction set is stored, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by a processor to implement a device authentication method based on a digital certificate as described in any of the above-mentioned embodiments of the present application.

[0016] On the other hand, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the device authentication method based on a digital certificate described in any of the above embodiments.

[0017] The beneficial effects brought by the technical solution provided by the embodiment of the present application include at least:

[0018] In response to the first platform account logging into the management platform, multiple server options are displayed in the management platform, wherein the servers corresponding to the multiple server options are servers corresponding to the authority of the first platform account, and in response to receiving the first platform account's selection operation on the first server option from the multiple server options, a first certificate is issued to the first server through the management platform, wherein the first server is the server corresponding to the first server option, the first certificate is used to authorize the first server to log in to the first data account, there is a corresponding relationship between the first data account and the first platform account, the first data account is used to access the first data in the first server, and after the first server logs in to the first data account based on the first certificate, the first data is obtained from the first server, which enables the first server to authorize the login to the first data account based on the first certificate, so that the first server knows that the user identity corresponds to the first platform account and the first platform account has the authorization to access the first server, thereby enhancing the audit capability of user behavior.

[0019] On the other hand, under the premise of meeting the requirements of Level 3 two-factor authentication for security protection, when a user needs to access multiple servers at the same time, the first certificate is issued to the first server based on the management platform. The user does not need to repeatedly enter the authentication credentials, but only needs to select the server to be accessed through the management platform. This shortens the operation time required for users to access multiple servers and improves the efficiency of human-computer interaction. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 It is a schematic diagram of an implementation environment provided by an exemplary embodiment of the present application;

[0022] Figure 2 is a flow chart of a device authentication method based on a digital certificate provided by an exemplary embodiment of the present application;

[0023] Figure 3 is a flow chart of an account creation method provided by an exemplary embodiment of the present application;

[0024] Figure 4 is a schematic diagram of a device authentication interaction process provided by an exemplary embodiment of the present application;

[0025] Figure 5 is a structural block diagram of a device authentication apparatus based on a digital certificate provided by an exemplary embodiment of the present application;

[0026] Figure 6 is a structural block diagram of a device authentication device module based on a digital certificate provided by an exemplary embodiment of the present application;

[0027] Figure 7 It is a structural block diagram of a terminal provided by an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0029] It should be understood that although the terms first, second, etc. may be used in the present disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present disclosure, the first parameter may also be referred to as the second parameter, and similarly, the second parameter may also be referred to as the first parameter. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0030] In the current information security field, all systems with level 3 protection and above need to meet the two-factor authentication requirements in the host security category when logging into the server, that is, users need to provide at least two of the three types of credentials: known, held, and all. In the related art, when a user logs into the server, in addition to being required to provide a username and password, the user needs to additionally enter an OTP to confirm the two authentication factors known and held by the user. However, server authentication can only identify that the user holds the correct username, password, and OTP, and cannot infer the user's identity, nor can it confirm whether the user has an authorized login device, and there are defects in the audit aspect.

[0031] The device authentication method based on digital certificates provided in the embodiment of the present application, in response to a first platform account logging into a management platform, displays multiple server options in the management platform, wherein the servers corresponding to the multiple server options are servers corresponding to the authority of the first platform account, and in response to receiving a selection operation of the first platform account on the first server option among the multiple server options, issues a first certificate to the first server through the management platform, wherein the first server is the server corresponding to the first server option, the first certificate is used to authorize the first server to log into the first data account, there is a corresponding relationship between the first data account and the first platform account, the first data account is used to access the first data in the first server, after the first server logs in to the first data account based on the first certificate, obtains the first data from the first server, enables the first server to authorize the login to the first data account based on the first certificate, so that the first server knows that the user identity corresponds to the first platform account and the first platform account has the authorization to access the first server, thereby enhancing the audit capability of user behavior.

[0032] On the other hand, under the premise of meeting the requirements of Level 3 two-factor authentication for security protection, when a user needs to access multiple servers at the same time, the first certificate is issued to the first server based on the management platform. The user does not need to repeatedly enter the authentication credentials, but only needs to select the server to be accessed through the management platform. This shortens the operation time required for users to access multiple servers and improves the efficiency of human-computer interaction.

[0033] First, let's introduce the implementation environment of this application. Figure 1 , which shows a schematic diagram of an implementation environment provided by an exemplary embodiment of the present application, and the implementation environment includes: a terminal 110 and a server 120.

[0034] A management platform is deployed in the terminal 110, which is used to proxy the connection relationship between the terminal 110 and the server 120. After the connection relationship between the terminal 110 and the server 120 is established through the management platform agent, the terminal 110 and the server 120 can transmit data through the connection relationship.

[0035] In some embodiments, a first platform account is logged in to the terminal 110, and the server 120 is implemented as a first server, wherein the first server is a corresponding server within the authority scope of the first platform account, that is, the first server is a server with which the terminal 110 can establish a connection relationship and perform data transmission through a management platform agent based on the first platform account.

[0036] Optionally, the authority scope of the first platform account may be pre-configured based on the management platform.

[0037] In some embodiments, after establishing the connection relationship, the terminal 110 logs in to the first data account through the first server to access the first data, wherein there is a corresponding relationship between the first data account and the first platform account, and the first data is the corresponding data within the authority scope of the first data account in the first server.

[0038] In some embodiments, terminal 110 displays multiple server options in the management platform in response to the first platform account logging into the management platform, wherein the servers corresponding to the multiple server options are corresponding servers within the authority scope of the first platform account, and in response to receiving the first platform account's selection operation for the first server option among multiple servers, a first certificate is issued to the first server through the management platform, the first server is the server corresponding to the first server option, the first certificate is used to authorize the first server to log in to the first data account, the first data account is used to access the first data in the first server, and after the first server logs in to the first data account based on the first certificate, the first data is obtained from the first server.

[0039] In some embodiments, the process of issuing the first certificate to the first server and obtaining the first data from the first server is implemented based on a connection relationship. Optionally, the connection relationship can be implemented as a Secure Shell (SSH) connection.

[0040] The above-mentioned terminal is optional. The terminal can be a desktop computer, a laptop computer, a mobile phone, a tablet computer, an e-book reader, a Moving Picture Experts Group Audio Layer III (MP3) player, a Moving Picture Experts Group Audio Layer IV (MP4) player, a smart TV, a smart car, and other forms of terminal devices, which are not limited to the embodiments of the present application.

[0041] It is worth noting that the above-mentioned servers can be independent physical servers, or they can be server clusters or distributed systems composed of multiple physical servers. They can also be cloud servers that provide basic cloud computing services such as cloud services, cloud security, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), as well as big data and artificial intelligence platforms.

[0042] Among them, cloud technology refers to a hosting technology that unifies hardware, software, network and other resources within a wide area network or local area network to achieve data computing, storage, processing and sharing.

[0043] In some embodiments, the above server can also be implemented as a node in a blockchain system.

[0044] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant regions. For example, the account information involved in this application is obtained with full authorization.

[0045] To further explain, before collecting relevant user data (for example, account information, operation data, etc. involved in this application) and during the process of collecting relevant user data, this application can display a prompt interface, pop-up window or output voice prompt information, and the prompt interface, pop-up window or voice prompt information is used to prompt the user that its relevant data is currently being collected, so that this application only starts to execute the relevant steps of obtaining user-related data after obtaining the user's confirmation operation on the prompt interface or pop-up window, otherwise (that is, when the user's confirmation operation on the prompt interface or pop-up window is not obtained), the relevant steps of obtaining user-related data are terminated, that is, the user's relevant data is not obtained. In other words, all user data collected by this application are collected with the user's consent and authorization, and the collection, use and processing of relevant user data need to comply with relevant laws, regulations and standards in the relevant regions.

[0046] For illustration, please refer to Figure 2 , which shows a flowchart of a device authentication method based on a digital certificate provided by an exemplary embodiment of the present application. The method can be applied to a terminal, a server, or both. The present application embodiment takes the method applied to a terminal as an example for explanation. Figure 2 As shown, the method comprises the following steps:

[0047] Step 210, in response to the first platform account logging into the management platform, multiple server options are displayed in the management platform.

[0048] The servers corresponding to the multiple server options are servers within the authority scope of the first platform account.

[0049] In some embodiments, the first platform account is a pre-created platform account, and the authority scope of the first platform account is pre-configured based on the management platform.

[0050] Optionally, the first platform account can be implemented as a common platform account, that is, the first platform account does not have management authority over the management platform, and the authority scope of the first platform account can be configured by the platform management account or preset by the management platform; the first platform account can also be implemented as a platform management account for performing management operations on the management platform, and the authority scope of the first platform account can be preset by the management platform or obtained based on the management operations of the platform management account.

[0051] It is worth noting that the above-mentioned permission scope is used to indicate the servers that the first platform account can apply to access, that is, the above-mentioned permission scope refers to the access rights of the first platform account, rather than the operation rights of the first platform account in the management platform, for example, whether the first platform account is a platform management account, whether it can perform management operations, etc., the embodiments of the present application do not limit this.

[0052] In some embodiments, the management platform is used to establish a connection relationship between the terminal where the first platform account is located and the first server, and the terminal and the first server transmit data through the connection relationship. That is, the management platform is used to manage the terminal's access application to the server, wherein the access application refers to the terminal's request to access data in the server.

[0053] Optionally, the management platform is also used to implement functions such as user identity authentication, configuration projects, project-related servers, and user-related authorizations. Among them, user identity authentication is used to log in to the first platform account. For example, the first platform account corresponds to the first user, and the management platform authorizes the first user to log in to the first platform account by verifying the login credentials provided by the first user. Among them, the verification method adopts two-factor authentication, and the login credentials can include at least two of the user password, OTP, Bluetooth token, mobile phone software push, face recognition, and fingerprint recognition; configuring a project refers to creating a project in the management platform and configuring the server and user to which the project belongs. For example, project Y is created in the management platform, and the server to which project Y belongs is configured as server B. The users responsible for project Y include user a, user b, and user c, which correspond to platform account 1, platform account 2, and platform account 3, respectively. Schematically, user a logs in to platform account 1 in the management platform and then applies for access to server B to process the data corresponding to project Y; authorization related to the server and user to which the project belongs refers to the data permissions of the server to which the project belongs, as well as the user's access rights. For example, assuming that there are multiple servers, namely server A, server B, and server C, and the server to which project Y belongs is server B, server B can be configured to access the data corresponding to project Y in server B through data account b, and user a can apply for access to server B, server C, etc. based on platform account 1.

[0054] In some embodiments, the plurality of server options are used to receive a selection operation of the first platform account, and based on the selection operation, make an access request to a server corresponding to the selected server option.

[0055] In some embodiments, the plurality of server options may be displayed directly after the first platform account logs into the management platform, or may be displayed in response to receiving a display operation after the first platform account logs into the management platform.

[0056] In some embodiments, multiple server options may indicate their corresponding servers through elements such as server identification, server project identification, and server physical address.

[0057] Step 220: In response to receiving a selection operation of the first platform account on a first server option among a plurality of server options, a first certificate is issued to the first server through the management platform.

[0058] Among them, the first server is the server corresponding to the first server option, the first certificate is used to authorize the first server to log in to the first data account, the first data account and the first platform account have a corresponding relationship, and the first data account is used to access the first data in the first server.

[0059] In some embodiments, the first data account and the first platform account are in a one-to-one correspondence, that is, one first platform account corresponds to one first data account.

[0060] In some embodiments, the first certificate is a digital certificate issued by the management platform based on a first private key, wherein the first private key is a private key corresponding to the first server.

[0061] Optionally, the first certificate includes indication information for indicating the data account to which the first platform account applies to access.

[0062] Optionally, the indication information may be implemented as account information of the first platform account, account information of the first data account, information of the project to which access is requested, etc. Among them, based on the correspondence between the first platform account and the first data account, the data account to which the first platform account applies for access may be indirectly determined based on the account information of the first platform account; the account information of the first data account may directly determine the data account to which the first platform account applies for access; based on the configuration between the project and the server and user to which it belongs, the project information to which access is requested may determine the project to which the data to which the first platform account applies for access belongs, thereby indirectly determining the data account for accessing the corresponding data of the project based on the project.

[0063] In some embodiments, multiple servers managed by the management platform each have their own corresponding key pair, including a private key and a public key, which are used to implement the encryption and decryption process during data transmission.

[0064] Optionally, the management platform stores key pairs corresponding to multiple servers respectively.

[0065] Taking the first private key corresponding to the first server stored in the management platform as an example, in some embodiments, agent software is installed in the first server, and the agent software is used to configure the first server to receive the first certificate, then step 220 can be implemented as the following three steps:

[0066] first step , in response to the first platform account selecting the first server option, obtaining a first private key corresponding to the first server.

[0067] Optionally, a key list is stored in the management platform, and the key list includes a correspondence between the first server and the first private key.

[0068] In some embodiments, in response to the first platform account selecting the first server option, the management platform retrieves the first private key from the key list based on the corresponding relationship between the first server and the first private key.

[0069] Step 2 , generating a first certificate based on the first private key through the management platform.

[0070] In some embodiments, the management platform generates a short-term digital certificate based on a private key corresponding to a server. During the validity period, the management platform can establish a connection relationship with the corresponding server based on the digital certificate for data transmission. Optionally, the digital certificate is one-time, that is, the management platform can only establish a connection relationship once based on the digital certificate. If multiple connection relationships need to be established, the corresponding digital certificate needs to be regenerated.

[0071] Illustratively, the management platform generates a first certificate Z valid for 3 minutes based on the first private key a of the first server A. Within 3 minutes after generating the first certificate Z, the management platform can establish a connection relationship with the first server A based on the first certificate Z to perform data transmission.

[0072] Step 3 , sending the first certificate to the first server through the management platform.

[0073] In some embodiments, the management platform initiates a connection with the first server and sends a first certificate to the first server. The first server retrieves the authorization information in the first certificate. If the local configuration of the first server matches the authorization information, the first server logs in to the first data account, successfully establishes the connection, and data can be transmitted. If the local configuration of the first server does not match the authorization information, the first server refuses to log in to the first data account, the connection fails to be established, and data transmission cannot be performed. The authorization information can be implemented as account information of the first platform account, such as an account identifier, or as account information of the first data account, or can indicate indication information of the first data account, etc. The local configuration of the server includes the created data account locally recorded by the server.

[0074] Illustratively, assuming that the first certificate includes authorization information implemented as an account identifier of the first platform account, and the connection agent in the first server is configured with a correspondence between the authorization information in the first certificate and the first data account in the first server, then after the management platform initiates a connection with the first server and sends the first certificate to the first server, the first server retrieves the authorization information in the first certificate, retrieves the first data account created in the local configuration of the first server, and finds that the first platform account indicated in the authorization information meets the correspondence, instructs the first server to log in to the first data account, successfully establishes a connection, and data transmission can be performed.

[0075] Optionally, the agent software may also perform functions such as creating data accounts, freezing data accounts, deleting data accounts, assigning account groups, scanning suspicious accounts based on baselines, recording account creation behavior, reporting information, and updating platform preset public keys.

[0076] Taking the first server as an example, creating a data account means that the first server creates the first data account based on the creation operation of the first platform account by the management platform; freezing a data account means that the first server freezes the first data account based on the freezing operation of the first platform account by the management platform. When the first data account is frozen, you can still log in to the management platform based on the first platform account, but you cannot log in to the first data account through the management platform based on the first platform account; deleting a data account means that the first server deletes the first data account based on the deletion operation of the first platform account by the management platform; allocating an account group means grouping and managing multiple data accounts in the first server. Data accounts in the same group can share data. For example, the first server includes data account a and data account b. Data account a is only used to access data set A in the first server, and data account b is only used to access data set B in the first server. Assuming that data account a and data account b are set to the same account group, data account a and data account b According to account b, both data set A and data set b can be accessed; scanning suspicious accounts according to the baseline refers to scanning data accounts that have no corresponding relationship with platform accounts. For example, a relationship list is stored in the first server, which includes the corresponding relationships between multiple data accounts and multiple platform accounts. All data accounts in the first server are compared with the relationship list, and data accounts not recorded in the relationship list are regarded as suspicious accounts; recording account creation behavior refers to recording the above account creation behavior when the first server creates the first data account based on the creation operation of the first platform account by the management platform; information reporting refers to reporting the data status of the first server to the management platform; updating the platform preset public key refers to synchronously updating the preset public key stored in the first server based on the update operation of the preset public key by the management platform, wherein the preset public key is used to identify the communication request of the management platform, that is, the first server can only receive the communication request of the management platform based on the preset public key, to ensure that the first server can only be accessed through the management platform.

[0077] In some embodiments, the agent software performs the above functions by obtaining control instructions from the management system.

[0078] Illustratively, when the management platform creates the first platform account based on the received account creation operation, it sends an account creation instruction to the agent software of the first server, instructing the first server to create the first data account.

[0079] Step 230 , after the first server logs into the first data account based on the first certificate, the first data is obtained from the first server.

[0080] In some embodiments, after the first server logs in to the first data account based on the first certificate, the management platform initiates a connection between the terminal where the first platform account is located and the first server, obtains the first data through the link relationship, and transmits the first data to a browsing interface of the terminal.

[0081] Illustratively, taking the management platform implemented as a certain group's equipment authentication platform as an example, the management platform is used to manage multiple servers of the group. The management platform confirms the identity of the maintenance personnel through two-factor authentication. The maintenance personnel can log in to the first platform account. In response to the first platform account logging in to the management platform, multiple server options are displayed. In response to the first platform account selecting the first server option from the multiple server options, an SSH connection to the first server is created through the management platform, and a first certificate with a validity period of 2 minutes is used as the SSH login credential. After the first server logs in to the first data account based on the first certificate, an SSH connection to the first server is successfully created. The management platform connects the input / output channel of the SSH connection to the maintenance personnel's browser through two-way communication (WebSocket), that is, obtains the first data from the first server through the SSH connection, and transmits the first data to the browsing interface of the terminal, and allows the maintenance personnel to operate the first server in the same way as using the local terminal (Terminal), that is, the maintenance personnel can remotely operate the first server at the terminal.

[0082] In summary, the method provided in the embodiment of the present application displays multiple server options in the management platform in response to the first platform account logging into the management platform, wherein the servers corresponding to the multiple server options are the corresponding servers within the authority scope of the first platform account, and in response to receiving the first platform account's selection operation on the first server option among the multiple server options, issues a first certificate to the first server through the management platform, wherein the first server is the server corresponding to the first server option, the first certificate is used to authorize the first server to log in to the first data account, there is a corresponding relationship between the first data account and the first platform account, the first data account is used to access the first data in the first server, and after the first server logs in to the first data account based on the first certificate, the first data is obtained from the first server, which enables the first server to authorize the login to the first data account based on the first certificate, so that the first server knows that the user identity corresponds to the first platform account and the first platform account has the authorization to access the first server, thereby enhancing the audit capability of user behavior.

[0083] On the other hand, under the premise of meeting the requirements of Level 3 two-factor authentication for security protection, when a user needs to access multiple servers at the same time, the first certificate is issued to the first server based on the management platform. The user does not need to repeatedly enter the authentication credentials, but only needs to select the server to be accessed through the management platform. This shortens the operation time required for users to access multiple servers and improves the efficiency of human-computer interaction.

[0084] The method provided in the embodiment of the present application obtains a first private key corresponding to the first server in response to a selection operation of a first platform account on a first server option, generates a first certificate based on the first private key through a management platform, sends the first certificate to the first server through the management platform, and authorizes the first server to log in to the first data account by the first certificate. The device authentication process is implemented at the bottom layer of the management platform, which simplifies the authentication operation when the user accesses the server and improves the efficiency of human-computer interaction.

[0085] In some embodiments, the first platform account in the embodiment of the present application can be implemented as a platform management account, and the platform management account is used to perform management operations on the management platform. Please refer to Figure 3 , Figure 3 is a flow chart of an account creation method provided by an exemplary embodiment of the present application. Figure 3 As shown, the method comprises the following steps:

[0086] Step 310: Create a second platform account in response to the account creation operation of the first platform account in the management platform.

[0087] In some embodiments, in response to a management trigger operation of the first platform account, a management operation interface in the management platform is displayed, wherein the management operation interface is used to receive management operations of the first platform account on the management platform.

[0088] Optionally, the management operation interface may receive an account creation operation, where the account creation operation is used to create other platform accounts.

[0089] Illustratively, assume that the management platform is implemented as a device authentication platform of a certain group, and the first platform account is held by an administrator in the group. The management platform is used to manage multiple servers of the group. Multiple servers need to be maintained by maintenance personnel in the group. The administrator uses the first platform account to log in to the management platform, performs an account creation operation in the management platform, and creates a second platform account for the maintenance personnel, so that the maintenance personnel can use the second platform account to log in to the management platform, and then maintain the servers within the scope of authority through the management platform.

[0090] Step 320: Send an account creation instruction to the second server.

[0091] Among them, the second server is the corresponding server within the authority scope of the second platform account, and the account creation instruction is used to instruct the second server to create a second data account corresponding to the second platform account, and the second data account is used to access the second data in the second server.

[0092] In some embodiments, when the management platform receives the account creation operation, the management platform actively and synchronously sends the account creation instruction to the second server.

[0093] In some embodiments, agent software is installed in the second server, and the agent software can obtain operation data in the management platform in real time. When the agent software detects that the management platform receives an account creation operation, the agent software automatically generates an account creation instruction based on the operation data corresponding to the account creation operation.

[0094] In some embodiments, after the management platform creates the second platform account, it also includes a permission configuration process. Optionally, the permission configuration process can be implemented by configuring the permission scope of the second platform account in response to the permission configuration operation of the first platform account in the management platform, wherein the permission scope of the second platform account is used to indicate the second server.

[0095] In some embodiments, the second server obtains a permission configuration instruction based on a permission configuration operation in the management platform, and configures the permission range of the second data account based on the permission configuration instruction, wherein the permission range of the second data account is used to indicate the second data.

[0096] Illustratively, assuming that maintenance personnel A participates in the execution of project a, and the servers to which project a belongs include server Y and server Z, after the administrator uses the first platform account to create a second platform account for maintenance personnel A, the authority scope of the second platform account is configured to be server Y and server Z, that is, the second platform account can apply for access to server Y and server Z through the management platform, server Y creates a second data account y corresponding to the second platform account based on the account creation operation, server Z creates a second data account z corresponding to the second platform account based on the account creation operation, server Y obtains permission configuration instructions based on permission configuration operations, and configures the second data account y to be able to access the second data a1 corresponding to project a in server Y, and server Z obtains permission configuration instructions based on permission configuration operations, and configures the second data account z to be able to access the second data a2 corresponding to project a in server Z.

[0097] In some embodiments, after the account is created, an account freezing process and an account deletion process are also included.

[0098] Optionally, the account freezing process can be implemented by freezing the second platform account in response to the first platform account performing an account freezing operation on the second platform account in the management platform, and sending an account freezing instruction to the second server, wherein the account freezing instruction is used to instruct the second server to freeze the second data account.

[0099] Illustratively, assuming that the server to which project a belongs is the second server, and maintenance personnel A temporarily leaves project a, to ensure the data security of project a, the second platform account can be frozen according to a preset duration, that is, the second platform account of maintenance personnel A is retained, but during the account freezing period, maintenance personnel A cannot log in to the second platform account, or, maintenance personnel A can log in to the second platform account but cannot apply for access to the second server through the management platform based on the second platform account.

[0100] Optionally, the account deletion process can be implemented by, in response to the first platform account's account deletion operation on the second platform account in the management platform, deleting the second platform account and sending an account deletion instruction to the second server, wherein the account deletion instruction is used to instruct the second server to delete the second data account.

[0101] For example, taking the management platform implemented as a certain group's equipment authentication platform as an example, assuming that maintenance personnel A resigns from the group, to ensure the security of the group's data, maintenance personnel A's second platform account can be deleted, and the corresponding second data account can be deleted simultaneously, that is, maintenance personnel A cannot use the second platform account to log in to the management platform, nor can he use the second data account to log in to the second server.

[0102] In some embodiments, the first platform account can also implement a server configuration process based on the management platform. Optionally, the server configuration process can be implemented by configuring the data account permissions of the second server in response to the server configuration operation of the first platform account in the management platform. The data account permissions are used to indicate the permission of the second server to log in to the second data account based on the second certificate. The second certificate is a digital certificate issued by the management platform based on the access application of the second platform account to the second server.

[0103] In some embodiments, based on the server configuration operation, all servers corresponding to the specified project are configured to accept certificates signed by a private key associated with the specified project.

[0104] The private key associated with the specified project may be the same private key, or may be different private keys preset based on different servers.

[0105] Illustratively, assuming that the servers to which project a belongs are server A, server B, and server C, and the private key associated with project a is set to z, and the platform account participating in project a is a second platform account, when the second platform account applies to access server A, server B, or server C, the management platform uses private key z to issue a second certificate Z to the server to which the second platform account applies to access. That is, server A, server B, and server C access the data corresponding to project a based on the same second certificate Z.

[0106] Optionally, multiple servers may be configured to recognize the same certificate, or may be configured to recognize their own exclusive certificates respectively.

[0107] In summary, the method provided in the embodiment of the present application clarifies the account creation method, creates a data account in the corresponding server while creating a platform account, ensures the correspondence between the platform account and the data account, and provides a basis for the implementation of the device authentication method.

[0108] The method provided in the embodiment of the present application clarifies the permission configuration method, determines the second server that the second platform account can apply to access by configuring the permission range of the second platform account, simplifies the permission management process, and reduces the workload of the administrator during the device authentication process.

[0109] The method provided in the embodiment of the present application clarifies the account management method, including an account freezing method and an account deletion method, and can simultaneously freeze or delete a data account based on the freezing operation or deletion operation of a platform account, thereby simplifying the account management process and reducing the workload of administrators when managing user accounts.

[0110] The method provided in the embodiment of the present application clarifies the server configuration operation. By configuring the data account permissions of the server, it indicates that the server can log in to the corresponding data account based on the received digital certificate, thereby accessing the corresponding data, providing a basis for the implementation of the device authentication method.

[0111] For illustration, please refer to Figure 4 , Figure 4 FIG. 1 is a schematic diagram of a device authentication interaction process provided by an exemplary embodiment of the present application. Figure 4 As shown, the execution entities in the device authentication interaction process include a management platform 410 and a first server 420 , wherein the management platform 410 includes a management system 411 , a key management part 412 and a connection proxy part 413 .

[0112] Optionally, the device authentication interaction process can be implemented as the following process: after the management platform 410 creates a first platform account for the first user, the first user is authorized through the management system 411, that is, the management system 411 performs two-factor authentication on the first user, logs in to the first platform account, displays multiple server options, and in response to the first platform account's selection operation of the first server option among the multiple server options, obtains the first user's proxy authorization for the connection agent part 413, retrieves the first private key corresponding to the first server through the key management part 412, generates a first certificate based on the first private key, forwards the first certificate to the connection agent part 413, and the connection agent part 413 initiates a connection to the first server 420 and sends the first certificate. The first server 420 logs in to the first data account based on the received first certificate and accepts the connection, and successfully establishes a connection relationship with the connection agent part 413, so that the first user can remotely connect and manage the first server 420 based on the connection agent part 413, that is, can access the first data through the first data account logged in by the first server 420.

[0113] To sum up, the method provided in the embodiment of the present application realizes two-factor authentication of users through the management platform, which is no longer limited to username and password and OTP, and can adopt multiple authentication methods supported by the platform; after the user is authenticated once, he can log in to any server corresponding to the authority of the platform account multiple times during the validity period of the platform, that is, when the first user logs in to the management platform through the first platform account, he can apply for access to any server by selecting the server option corresponding to any server, without having to repeatedly enter login credentials such as OTP for device authentication.

[0114] Figure 5 is a structural block diagram of a device authentication apparatus based on a digital certificate provided by an exemplary embodiment of the present application, such as Figure 5 As shown, the device includes the following parts:

[0115] A platform display module 510 is used to display a plurality of server options in the management platform in response to the first platform account logging into the management platform, wherein the plurality of server options are servers corresponding to the authority range of the first platform account;

[0116] a certificate issuing module 520, configured to issue a first certificate to a first server through the management platform in response to receiving a selection operation of the first platform account on a first server option from among the multiple server options, the first server being a server corresponding to the first server option, the first certificate being used to authorize the first server to log in to a first data account, the first data account corresponding to the first platform account, and the first data account being used to access first data in the first server;

[0117] The data acquisition module 530 is configured to acquire the first data from the first server after the first server logs into the first data account based on the first certificate.

[0118] Please refer to Figure 6 , Figure 6 is a structural block diagram of a device authentication device module based on a digital certificate provided by an exemplary embodiment of the present application, such as Figure 6 As shown, in some embodiments, the management platform stores a first private key corresponding to the first server, and the first server is installed with agent software, and the agent software is used to configure the first server to receive the first certificate; the certificate issuance module 520 includes:

[0119] A private key acquisition unit 521 is configured to acquire a first private key corresponding to the first server in response to the first platform account selecting the first server option;

[0120] A certificate generating unit 522, configured to generate the first certificate based on the first private key through the management platform;

[0121] The certificate sending unit 523 is used to send the first certificate to the first server through the management platform.

[0122] In some embodiments, the first platform account is a platform management account, and the platform management account is used to perform management operations on the management platform; the device also includes an account management module 540, which is used to receive management operations on the management platform.

[0123] In some embodiments, the account management module 540 includes an account creation unit 541, and the account creation unit 541 is used to:

[0124] In response to the account creation operation of the first platform account in the management platform, creating a second platform account;

[0125] An account creation instruction is sent to a second server, where the second server is a server corresponding to the authority scope of the second platform account, and the account creation instruction is used to instruct the second server to create a second data account corresponding to the second platform account, and the second data account is used to access the second data in the second server.

[0126] In some embodiments, the account management module 540 further includes a permission configuration unit 542 for configuring the permission scope of the second platform account in response to the permission configuration operation of the first platform account in the management platform, and the permission scope of the second platform account is used to indicate the second server.

[0127] In some embodiments, the account management module 540 further includes an account management unit 543, which is used to:

[0128] In response to the first platform account freezing operation on the second platform account in the management platform, freezing the second platform account and sending an account freezing instruction to the second server, wherein the account freezing instruction is used to instruct the second server to freeze the second data account; or

[0129] In response to the account deletion operation of the first platform account on the second platform account in the management platform, the second platform account is deleted, and an account deletion instruction is sent to the second server, where the account deletion instruction is used to instruct the second server to delete the second data account.

[0130] In some embodiments, the device also includes a server configuration module 560, which is used to configure data account permissions of the second server in response to the server configuration operation of the first platform account in the management platform, and the data account permissions are used to indicate the authority of the second server to log in to the second data account based on a second certificate. The second certificate is a digital certificate issued by the management platform based on the access application of the second platform account to the second server.

[0131] In summary, the device provided in the embodiment of the present application displays multiple server options in the management platform in response to the first platform account logging into the management platform, wherein the servers corresponding to the multiple server options are the corresponding servers within the authority scope of the first platform account, and in response to receiving the first platform account's selection operation on the first server option among the multiple server options, issues a first certificate to the first server through the management platform, wherein the first server is the server corresponding to the first server option, the first certificate is used to authorize the first server to log in to the first data account, there is a corresponding relationship between the first data account and the first platform account, the first data account is used to access the first data in the first server, and after the first server logs in to the first data account based on the first certificate, the first data is obtained from the first server, which enables the first server to authorize the login to the first data account based on the first certificate, so that the first server knows that the user identity corresponds to the first platform account and the first platform account has the authorization to access the first server, thereby enhancing the audit capability of user behavior.

[0132] On the other hand, under the premise of meeting the requirements of Level 3 two-factor authentication for security protection, when a user needs to access multiple servers at the same time, the first certificate is issued to the first server based on the management platform. The user does not need to repeatedly enter the authentication credentials, but only needs to select the server to be accessed through the management platform. This shortens the operation time required for users to access multiple servers and improves the efficiency of human-computer interaction.

[0133] It should be noted that the device authentication apparatus based on digital certificates provided in the above embodiment is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0134] Figure 7 The structure block diagram of a terminal 700 provided by an exemplary embodiment of the present application is shown. The terminal 700 may be: a smart phone, a tablet computer, an MP3 player, an MP4 player, a notebook computer or a desktop computer. The terminal 700 may also be called a user equipment, a portable terminal, a laptop terminal, a desktop terminal or other names.

[0135] Typically, the terminal 700 includes a processor 701 and a memory 702 .

[0136] The processor 701 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 701 may be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 701 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 701 may be integrated with a graphics processing unit (GPU), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 701 may also include an artificial intelligence (AI) processor, which is used to process computing operations related to machine learning.

[0137] The memory 702 may include one or more computer-readable storage media, which may be non-transitory. The memory 702 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory 702 is used to store at least one instruction, which is used to be executed by the processor 701 to implement the device authentication method based on a digital certificate provided in the method embodiment of the present application.

[0138] In some embodiments, the terminal 700 also includes other components, which can be understood by those skilled in the art. Figure 7 The structure shown in the figure does not constitute a limitation on the terminal 700, and the terminal 700 may include more or less components than those shown in the figure, or combine some components, or adopt a different component arrangement.

[0139] The embodiment of the present application also provides a computer device, which can be implemented as follows: Figure 1 The computer device includes a processor and a memory, wherein at least one instruction, at least one program, code set or instruction set is stored in the memory, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by the processor to implement the device authentication method based on digital certificate provided by the above-mentioned method embodiments.

[0140] An embodiment of the present application also provides a computer-readable storage medium, on which is stored at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the digital certificate-based device authentication method provided in the above-mentioned method embodiments.

[0141] The embodiments of the present application also provide a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the device authentication method based on the digital certificate provided by the above-mentioned method embodiments.

[0142] Optionally, the computer readable storage medium may include: Read Only Memory (ROM), Random Access Memory (RAM), Solid State Drives (SSD) or optical disks, etc. Among them, the random access memory may include resistance random access memory (ReRAM) and dynamic random access memory (DRAM). The serial numbers of the above embodiments of the present application are only for description and do not represent the advantages and disadvantages of the embodiments.

[0143] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0144] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A device authentication method based on digital certificates, characterized in that: The method comprises: In response to the first platform account logging into the management platform, a plurality of server options are displayed in the management platform, and the servers corresponding to the plurality of server options are servers corresponding to the authority scope of the first platform account; In response to receiving a selection operation of the first platform account on a first server option from among the multiple server options, issuing a first certificate to a first server through the management platform, the first server being a server corresponding to the first server option, the first certificate being used to authorize the first server to log in to a first data account, the first data account corresponding to the first platform account, and the first data account being used to access first data in the first server; After the first server logs in to the first data account based on the first certificate, the first data is obtained from the first server.

2. The method according to claim 1, characterized in that The management platform stores a first private key corresponding to the first server, and the first server is installed with agent software, the agent software is used to configure the first server to receive the first certificate; In response to receiving a selection operation of the first platform account on a first server option among the multiple server options, issuing a first certificate to the first server through the management platform includes: In response to the first platform account selecting the first server option, obtaining a first private key corresponding to the first server; Generate the first certificate based on the first private key through the management platform; The first certificate is sent to the first server through the management platform.

3. The method according to claim 1, characterized in that The first platform account is a platform management account, and the platform management account is used to perform management operations on the management platform; The method further comprises: In response to the account creation operation of the first platform account in the management platform, creating a second platform account; An account creation instruction is sent to a second server, where the second server is a server corresponding to the authority scope of the second platform account, and the account creation instruction is used to instruct the second server to create a second data account corresponding to the second platform account, and the second data account is used to access the second data in the second server.

4. The method according to claim 3, characterized in that After creating the second platform account in response to the account creation operation of the first platform account in the management platform, the method further includes: In response to the permission configuration operation of the first platform account in the management platform, the permission range of the second platform account is configured, and the permission range of the second platform account is used to indicate the second server.

5. The method according to claim 3, characterized in that: After sending the account creation instruction to the second server, the method further includes: In response to the account freezing operation of the first platform account on the second platform account in the management platform, freezing the second platform account and sending an account freezing instruction to the second server, wherein the account freezing instruction is used to instruct the second server to freeze the second data account; or In response to the account deletion operation of the first platform account on the second platform account in the management platform, the second platform account is deleted, and an account deletion instruction is sent to the second server, where the account deletion instruction is used to instruct the second server to delete the second data account.

6. The method according to claim 3, characterized in that The method further comprises: In response to the server configuration operation of the first platform account in the management platform, data account permissions of the second server are configured, and the data account permissions are used to indicate the permission of the second server to log in to the second data account based on a second certificate. The second certificate is a digital certificate issued by the management platform based on the access application of the second platform account to the second server.

7. A device authentication device based on digital certificates, characterized in that: The device comprises: a platform display module, configured to display a plurality of server options in the management platform in response to the first platform account logging into the management platform, wherein the plurality of server options are servers corresponding to the authority scope of the first platform account; a certificate issuing module, configured to issue a first certificate to a first server through the management platform in response to receiving a selection operation of the first platform account on a first server option from among the multiple server options, the first server being a server corresponding to the first server option, the first certificate being used to authorize the first server to log in to a first data account, the first data account corresponding to the first platform account, and the first data account being used to access first data in the first server; The data acquisition module is used to acquire the first data from the first server after the first server logs in to the first data account based on the first certificate.

8. A computer device, characterized in that: The computer device includes a processor and a memory, wherein the memory stores at least one program, and the at least one program is loaded and executed by the processor to implement the device authentication method based on a digital certificate as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The storage medium stores at least one program, and the at least one program is loaded and executed by the processor to implement the device authentication method based on digital certificates as described in any one of claims 1 to 6.

10. A computer program product, characterized in that It comprises a computer program, which, when executed by a processor, implements the device authentication method based on a digital certificate as claimed in any one of claims 1 to 6.

Images