Cloud server remote management method and device

Abstract

The invention provides a cloud server remote management method and device. The method is applied to a cloud server created for a user on a cloud server side, and the user communicates with the cloud server through a cloud service system. The method comprises the following steps: in response to a received remote management request which is sent by a user and aims at the cloud server, generating an asymmetric key pair for encrypting and decrypting privacy information in a remote management command; the key pair is stored and maintained in a secure storage space on the cloud server, and a public key in the key pair is sent to the user through the cloud service system; and in response to a received remote management command encrypted by the public key and sent by the user, decrypting the remote management command by using a private key corresponding to the public key, and executing the decrypted remote management command to perform remote management on the cloud server.

Description

Technical Field

[0001] The embodiments of the present specification relate to the field of cloud computing technology, and more specifically, the embodiments of the present specification relate to a cloud server remote management method and device. Background Art

[0002] With the development of cloud computing technology, renting cloud servers provided by cloud service providers has gradually become one of the mainstream choices for enterprise users. Usually, after users rent cloud servers provided by cloud service providers, they can use the cloud service system to send commands to the cloud servers to manage them. Among them, when users send commands containing private content to cloud servers through the cloud service system, there may be concerns about privacy security. Summary of the invention

[0003] To overcome the problems existing in the related art, this specification provides the following methods and devices.

[0004] In a first aspect of the embodiments of the present specification, a cloud server remote management method is provided, which is applied to a cloud server created for a user on a cloud service end, wherein the user communicates with the cloud server through a cloud service system; the method comprises:

[0005] In response to a received remote management request sent by a user to the cloud server, generating an asymmetric key pair for encrypting and decrypting private information in the remote management command;

[0006] Storing and maintaining the key pair in a secure storage space on the cloud server, and sending the public key in the key pair to the user through the cloud service system;

[0007] In response to receiving a remote management command sent by the user and encrypted by the public key, the remote management command is decrypted using a private key corresponding to the public key, and the decrypted remote management command is executed to remotely manage the cloud server.

[0008] In a second aspect of the embodiments of the present specification, a cloud server remote management device is provided, which is applied to a cloud server created for a user on a cloud service end, and the user communicates with the cloud server through a cloud service system; the device includes:

[0009] A key pair generating unit, configured to generate an asymmetric key pair for encrypting and decrypting private information in a remote management command in response to a remote management request for the cloud server sent by a received user;

[0010] A public key sending unit, configured to store and maintain the key pair in a secure storage space on the cloud server, and send the public key in the key pair to the user through the cloud service system;

[0011] The remote management unit is used to respond to the remote management command encrypted by the public key sent by the user, decrypt the remote management command using the private key corresponding to the public key, and execute the decrypted remote management command to remotely manage the cloud server.

[0012] In a third aspect of the embodiments of the present specification, a storage medium is provided; a computer program is stored on the storage medium, and the computer program implements the steps of the above method when executed.

[0013] In a fourth aspect of the embodiments of the present specification, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the above method is implemented when the processor executes the program.

[0014] The above embodiments of this specification have at least the following beneficial effects:

[0015] In the above technical scheme, an asymmetric encryption and decryption key pair is maintained on the cloud server, and the public key is sent to the user so that the user can use the public key to encrypt the command containing private content. After receiving the encrypted command, the private key corresponding to the public key is used to decrypt and execute it. In the entire link of command transmission, the cloud service provider cannot obtain the command content before encryption, thereby ensuring the security and reliability of the cloud service provider's services and ensuring the data security and privacy of users. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of this specification or the prior art, the drawings required for use in the embodiments or the prior art description are briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification, and those of ordinary skill in the art can also obtain other drawings based on these drawings.

[0017] Figure 1 The following schematically shows a schematic diagram of the architecture of a cloud server remote management method according to an embodiment of the present specification;

[0018] Figure 2 A flowchart of a cloud server remote management method according to an embodiment of the present specification is schematically shown;

[0019] Figure 3 The following schematically shows an interactive flow chart of a cloud server remote management method according to an embodiment of the present specification;

[0020] Figure 4 The following schematically shows an interactive diagram of a cloud server remote management method according to an embodiment of the present specification;

[0021] Figure 5 A block diagram schematically shows a cloud server remote management device according to an embodiment of the present specification;

[0022] Figure 6 A hardware structure diagram of a computer device in which an information retrieval method according to an embodiment of the present specification is located is schematically shown.

[0023] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts. DETAILED DESCRIPTION

[0024] The principles and spirit of this specification will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement this specification, and are not intended to limit the scope of this specification in any way. On the contrary, these embodiments are provided to make this specification more thorough and complete, and to fully convey the scope of this specification to those skilled in the art.

[0025] Those skilled in the art know that the embodiments of this specification can be implemented as a system, device, equipment, method or computer program product. Therefore, this specification can be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0026] First, let’s introduce some related concepts that may be involved in the manual:

[0027] OpenAPI: refers to the API interface of cloud services provided by cloud vendors to users, which is generally provided to users via HTTP or HTTPS services.

[0028] Cloud service gateway: refers to the cloud vendor's server that is responsible for receiving OpenAPI requests from users. Generally, the API requested by the server belongs to different products, and then forwards the request to the control server of the corresponding product.

[0029] Cloud service system: refers to the system that the cloud vendor actually uses to process users' OpenAPI requests.

[0030] Cloud server: refers to a physical or virtual computer provided by a cloud vendor to a user; the server can be used by the user to run computer programs.

[0031] Operation and maintenance Agent program: refers to a computer program used to receive and execute user remote commands, generally developed and provided by cloud vendors and running in cloud servers.

[0032] With the development of cloud computing technology, renting cloud servers provided by cloud service providers has gradually become one of the mainstream choices for enterprise users. Cloud service providers can provide users with automated operation and maintenance capabilities of cloud servers by providing cloud service API interfaces corresponding to cloud servers. Users can use the cloud service system to send commands to cloud servers to manage them. Specifically, they can call the API interface of the cloud gateway to send commands with specified content to the specified cloud server, and the control server will store the command and notify the cloud server to receive and execute the command. Usually, a proxy service can be set up on the cloud server to be responsible for communication with users. Users manage cloud servers by calling the cloud service API interface of the proxy service.

[0033] Cloud service providers can usually ensure the privacy and confidentiality of user data on cloud servers, such as adopting strict access control, data encryption, network isolation, and compliance certification.

[0034] However, in the process of users sending commands to cloud servers through the cloud service system, the transmission and storage of command content go through multiple links such as the cloud service gateway, management and control server, management and control database, and user cloud server. The command content can be recorded or viewed at each link. When the command content contains content that needs to be kept confidential, the user's information privacy and content security cannot be guaranteed.

[0035] To overcome the problems existing in the related art, this specification provides the following embodiments.

[0036] The scheme of this specification is described in detail below with reference to the accompanying drawings.

[0037] See also Figure 1 , Figure 1 FIG. 1 is a schematic diagram of the architecture of a cloud server remote management system provided by an exemplary embodiment. Figure 1 As shown, the system may include a network 10, a server 11, and several electronic devices, such as a computer 12, a computer 13, and a computer 14.

[0038] The server 11 may be a physical server including an independent host, or the server 11 may be a virtual server, a cloud server, etc. hosted by a host cluster. Computers 12-14 are just one type of electronic device that a user may use. In fact, a user may also use electronic devices such as tablet devices, mobile phones, PDAs (Personal Digital Assistants), wearable devices (such as smart glasses, smart watches, etc.), etc., and one or at least one embodiment of this specification does not limit this. The network 10 may include various types of wired or wireless networks.

[0039] In one embodiment, the server 11 can cooperate with the computers 12-14; wherein the computers 12-14 can accept user operations and upload the received commands and files to the server 11 through the network 10, and then the server 11 processes the files based on the scheme of this specification. In another embodiment, the computers 12-14 can independently implement the scheme of this specification; wherein the computers 12-14 accept user operations and process the received commands and files based on the scheme of this specification to realize remote management of cloud servers.

[0040] See also Figure 2 , Figure 2 is a flowchart of a cloud server remote management method provided by an exemplary embodiment, the method is applied to a processing device, and the processing device can be Figure 1 The server 11 or computers 12-14 etc. are shown.

[0041] The method may include the following steps:

[0042] Step 202: In response to a received remote management request sent by a user to the cloud server, an asymmetric key pair is generated for encrypting and decrypting private information in the remote management command.

[0043] When a user rents a cloud server created for the user on a cloud service end provided by a cloud service provider, the user communicates with the cloud server through a cloud service system and sends remote management commands to manage the cloud server.

[0044] When the remote management command contains private information that needs to be kept confidential, such as passwords, confidential data, etc., there may be privacy and security issues if the remote management command is transmitted directly through the cloud service system.

[0045] The private information in the remote command can be encrypted and sent to the cloud server. However, the decryption key is also private information and cannot be sent directly.

[0046] To solve this problem, asymmetric encryption methods can be used to encrypt private information in remote management commands, where the public key used for encryption can be transmitted in plain text, while the decryption key is only used on the cloud server.

[0047] Therefore, asymmetric key pairs should be generated and maintained on the cloud server.

[0048] When a user needs to send a remote management command containing privacy information to a cloud server, the user may send a remote management request instead of directly sending the remote management instruction.

[0049] After receiving the remote management request through the cloud service system, the cloud server can generate an asymmetric key pair corresponding to the remote management request. The public key and private key in the asymmetric key pair correspond to each other, the public key is used to encrypt the private information in the remote management command, and the private key is used to decrypt the private information in the remote management command.

[0050] Step 204: The key pair is stored and maintained in the secure storage space of the cloud server, and the public key in the key pair is sent to the user through the cloud service system.

[0051] After the above asymmetric key pair is generated, it can be stored and maintained in the secure storage space of the cloud server. The private key in the key pair is used for decryption. If the private key is leaked, the security of the privacy information cannot be guaranteed.

[0052] The public key in the key pair is only used for encryption and can be transmitted in plain text. The public key can be returned to the user through the cloud service system as a response to the above remote management request, so that the user can use the public key to encrypt the remote management command.

[0053] After the user receives the public key returned by the cloud server, he can use the public key to encrypt the private content in the remote management command. The remote management command encrypted by the public key can only be decrypted using the private key corresponding to the public key. Therefore, the user can send the remote management command encrypted by the public key to the cloud server through the cloud service system.

[0054] Although the encrypted remote management command can be obtained in each link of the transmission and storage, it cannot be decrypted due to the lack of the corresponding private key, so the transmission process is safe.

[0055] Step 206: In response to receiving the remote management command encrypted by the public key sent by the user, decrypt the remote management command using the private key corresponding to the public key, and execute the decrypted remote management command to remotely manage the cloud server.

[0056] When the cloud server receives the remote management command encrypted by the public key from user Dasong, it can use the private key corresponding to the public key to decrypt the encrypted private content in the remote management command to obtain the decrypted remote management command.

[0057] After obtaining the decrypted remote management command, you can use it to remotely manage the cloud server. When the remote command is executed, the command execution result can also be sent to the user.

[0058] In the above embodiment, an asymmetric encryption and decryption key pair is maintained on the cloud server, and a public key is sent to the user so that the user uses the public key to encrypt a command containing private content. After receiving the encrypted command, the private key corresponding to the public key is used to decrypt and execute it. In the entire link of the command transmission, the cloud service provider cannot obtain the command content before encryption, thereby ensuring the security and reliability of the cloud service provider's services and ensuring the data security and privacy of users.

[0059] See also Figure 3 , Figure 3 The interactive flow chart of a cloud server remote management method according to an implementation manner of this specification is schematically shown.

[0060] The following combination Figure 3 The overall process of the cloud server remote management method is described.

[0061] like Figure 3 As shown, in the cloud server remote management method in this specification, there are mainly three subjects, namely, user 31, cloud service system 32, and cloud server 33. All communications between the user and the cloud server must go through the cloud service system, and it can be considered that the cloud service system can obtain all contents in the communication process between the user and the cloud server.

[0062] The remote management method can be broken down into the following steps:

[0063] 301. The user sends a remote management request to the cloud server;

[0064] 302. Generate a key pair on the cloud server;

[0065] 303. The cloud server sends the public key to the user;

[0066] 304. The user uses the public key to encrypt the remote management command;

[0067] 305. The user sends a remote management command encrypted by a public key to the cloud server;

[0068] 306. The cloud server decrypts the remote management command using the private key corresponding to the public key;

[0069] 307. The cloud server executes remote management commands.

[0070] like Figure 3 As shown, in each of the above steps, the information that the cloud service system can obtain includes: the remote management request obtained in step 301, the public key obtained in step 303, and the remote management request encrypted by the public key obtained in step 305. However, the privacy content in the remote management request cannot be obtained through the remote management request, the public key, and the remote management request encrypted by the public key.

[0071] In an illustrative embodiment shown in this specification, the remote management request sent by the user may also include key generation parameters, and the cloud server may generate an asymmetric key based on the key management parameters.

[0072] Key generation parameters can include:

[0073] Key algorithm: indicates the algorithm used to generate an asymmetric key pair, such as RSA (Rivest-Shamir-Adleman) algorithm, Elliptic Curve Cryptography (ECC) algorithm, DSA (Digital Signature Algorithm) algorithm or ECDSA (Elliptic Curve Digital Signature Algorithm) algorithm, etc.

[0074] Key length: indicates the length of the public key of the generated asymmetric key pair, such as 1024 bits, 2048 bits, etc. The length of the public key is generally related to the length of the plaintext to be encrypted, the encryption and decryption time, and the difficulty of encryption cracking. Generally, the longer the plaintext to be encrypted, the larger the minimum key length required. The longer the key length, the longer the encryption and decryption time required, and the greater the difficulty of cracking. Users can select the appropriate key length according to their needs.

[0075] Key validity period: indicates the validity period of the key. Decryption can be performed only within the key validity period. If the key validity period is exceeded, the key will be invalid. The key validity period can be set according to the time required for encryption and communication. For example, the key validity period can be set to 60 seconds, 120 seconds, 300 seconds, etc.

[0076] Number of times a key can be used: indicates the maximum number of times a key can be used. If the number of times is exceeded, the key will be invalid. For example, it can be set to 1 time, 2 times, etc.

[0077] This specification does not specifically limit the specific settings and forms of expression of key generation parameters.

[0078] For example, the key generation parameters for a remote management request can be expressed as follows:

[0079] --algorithm=rsa--time-to-live=60--max-access-times=1;

[0080] The above key generation parameters indicate that the key pair to be generated is an asymmetric key pair with the key algorithm being the RSA algorithm, a validity period of 60 seconds, and a maximum number of uses being 1.

[0081] In addition, you can also set the default value or default value of the key generation parameter. When the key generation parameter is not specified, the preset default value can be used as the key generation parameter.

[0082] In an illustrative embodiment shown in this specification, multiple key pairs can be managed and maintained in the cloud server at the same time. The cloud server can be managed by multiple user accounts, and the same user account can also send multiple remote management commands to remotely manage one or more programs on the cloud server. Therefore, multiple key pairs can be managed and maintained in the cloud server at the same time to encrypt and decrypt different remote management commands.

[0083] Specifically, when a key pair is generated, a unique key number can be assigned to the generated key pair as identification information of the key, and the key pair corresponding to the key number can be determined according to the key number. Generally, the key number can be a number or a string; the key number can be randomly generated or generated according to a preset generation algorithm, and this description does not specifically limit it.

[0084] When the key pair is maintained in the cloud server, the key pair and its key number are associated and maintained. When a remote management request is received from a user, the key number corresponding to the key pair and the public key are sent to the user; after the user encrypts the remote management command with the public key, the key number and the encrypted remote management command are sent together; when the cloud server receives the encrypted remote management command, it can determine the private key in the key pair that encrypted the remote management command based on the key number and decrypt it.

[0085] In an exemplary embodiment shown in this specification, a dedicated key number may not be set, but the public key of the key pair may be used as the key number. When the user sends an encrypted remote management command, the public key may be sent together so that the cloud server can determine the corresponding private key based on the public key.

[0086] See also Figure 4 , Figure 4 The interactive diagram of a cloud server remote management method according to an implementation of the present specification is schematically shown.

[0087] Usually, an agent service can be deployed in the cloud server. The agent service is usually a standard service provided by the cloud service provider, which is used to provide the user with an API interface for communicating with the cloud server. When the user communicates with the cloud server, it is done by calling the API interface corresponding to the agent service. The agent service can keep running continuously to ensure the effectiveness of communication.

[0088] Specifically, the API interface can be provided by the cloud service provider, and the user can call the API through the cloud gateway connected to the user client to send remote management commands to the cloud server. The remote management commands sent by the user can pass through the cloud gateway, be stored by the cloud service management server, and notify the above-mentioned proxy service on the cloud server to receive and execute them.

[0089] The remote management requests and remote management commands sent by the user to the cloud server are all sent to the proxy service through the API interface, and the proxy service returns the public key or the execution result of the remote management command.

[0090] The proxy service can also authenticate the information sent to the cloud server to ensure security. For example, remote management requests and remote management commands sent by users must be authenticated by the proxy service before they can be transmitted to the cloud server for execution.

[0091] The cloud server also deploys a key management service for managing key pairs. This key management service can also be a standard service provided by the cloud service provider.

[0092] The key management service is responsible for generating key pairs and key numbers corresponding to the key pairs, and maintaining and managing them; to ensure the security of key pairs, especially private keys, key pairs can be maintained in the memory space corresponding to the above key management service. The private key in the key pair is always maintained only in the key management service and is not exported in any form to ensure security.

[0093] After receiving the remote management command encrypted by the public key, the key management service uses the private key corresponding to the public key to decrypt the privacy information in the remote management service.

[0094] The key management service can generate a key pair according to the key pair generation parameters in the remote management request, and associate the key generation parameters such as the key validity period and the number of times the key can be used with the key pair for storage.

[0095] For example, the key pair management service can maintain key pairs in the following form:

[0096] Key Number Public key content Private key content Validity period Remaining times 0x00a1 <Public Key 1> <Private Key 1> 1675309138 1 0x0a2c <Public key 2> <Private key 2> 1675308562 2

[0097] The validity period may be expressed in the form of a timestamp or in natural time.

[0098] Each time the key management service completes the decryption of the remote management service to enable it to be executed, it can update the remaining usage count corresponding to the private key used for decryption, and delete the key pair with a remaining usage count of 0, and no longer maintain and manage it.

[0099] You can also compare the current time with the validity period of the key pair to determine whether each key pair under maintenance and management has exceeded its validity period, and delete the key pairs that have exceeded their validity period and no longer maintain and manage them.

[0100] In addition, when the remaining usage counts of the key pairs maintained in the key management service are all 0, or have all exceeded their validity periods, the key management service can delete all key pairs in maintenance; at this time, the key management service no longer maintains any key pairs. When the key management service does not maintain any key pairs, the key management service can be terminated until a new remote management request is received to save resource overhead.

[0101] The following combination Figure 4 , introduces a specific implementation of the cloud server remote management method.

[0102] The user 40 calls the API interface corresponding to the proxy service 42 through the cloud service system 41 to achieve communication with the cloud server.

[0103] The cloud server remote management method may specifically include the following process.

[0104] 401. The user calls the API interface corresponding to the proxy service and sends a remote management request to the target cloud server. The specific content of the remote management request may include: starting the remote management service 44 to request the public key and key number of the new key from the key management service based on the given key generation parameters.

[0105] 402. The cloud service system verifies the legitimacy of the remote management request, including verifying the identity of the user and the legitimacy of the request content; after passing the verification, the remote management request is sent to the proxy service corresponding to the target cloud server;

[0106] 403. After receiving the remote management request, the proxy service creates and executes a new script, the remote management request script 43;

[0107] 404. The remote management request script starts the remote management service so that it requests the public key and key number of the new key from the key management service;

[0108] 405. The remote management service searches for the actual process corresponding to the key management service, and sends a request for generating a key pair and key generation parameters to the key management service through inter-process communication;

[0109] 406. The key management service receives the request from the remote management service, generates an asymmetric key according to the key generation parameters, and generates a corresponding key number; maintains the public key and private key in the generated asymmetric key, the corresponding key number, the corresponding key validity period, the number of times the key can be used, and other key generation parameters in the memory space corresponding to the key management service; and sends the public key in the generated key pair and the corresponding key number to the remote management service through inter-process communication;

[0110] 407. After receiving the public key and key number, the remote management service prints them as standard output to return the remote management request script;

[0111] 408. The remote management request script prints the public key and key number of the remote management service to standard output for output;

[0112] 409. The proxy service submits the execution result and output of the remote management request script to the cloud service system; the cloud service system may submit the public key and the key number to the output of the remote management request script;

[0113] 410. The user can obtain the output of the remote management request script corresponding to the remote management request from the cloud service system, and can obtain the public key and key number therefrom;

[0114] 411. The user uses the public key to encrypt the private content in the remote management command, and calls the API interface corresponding to the proxy service to send the encrypted remote management command to the target cloud server; the remote management command carries the key number;

[0115] 412. The cloud service system verifies the legitimacy of the remote management command, including verifying the identity of the user and the legitimacy of the command content; after verification, the remote management command is sent to the proxy service corresponding to the target cloud server;

[0116] 413. After receiving the remote management request, the proxy service creates and executes a new script, the remote management command script 46;

[0117] 414. The remote management request script starts the remote management service so that it requests the key management service to decrypt the encrypted remote management command;

[0118] 415. The remote management service searches for the actual process corresponding to the key management service, and sends the request for decrypting the encrypted remote management command, the encrypted private content, and the key number to the key management service through inter-process communication;

[0119] 416. The key management service receives the request from the remote management service, searches for the private key in the key pair corresponding to the key number, decrypts the encrypted private content using the private key, and sends the decrypted private content to the remote management service through inter-process communication;

[0120] 417. The remote management service obtains the decrypted private content and prints it to the standard output; and executes the remote management command according to the decrypted private content in the standard output to manage the cloud server;

[0121] 418. The remote management command script executes and outputs the remote management command;

[0122] 419. The proxy service submits the execution results and output of the remote management command script to the cloud service system;

[0123] 420. The user can obtain the execution results and outputs of the remote management command script corresponding to the remote management command from the cloud service system.

[0124] In an exemplary embodiment shown in this specification, the decrypted private content is represented in the form of a variable, and the value of the variable, i.e., the plain text of the private information, is stored in the memory space corresponding to the remote management command script or the remote management service;

[0125] The remote management service can call the privacy information through the above variables to execute remote management commands and perform remote management on the cloud server.

[0126] When the remote management command is executed and the execution results and output are returned and submitted to the cloud service system, the remote service script and remote management service can be terminated, the corresponding memory space is released, and the plain text of the privacy information in the remote management command is deleted.

[0127] In cloud server management, each sub-account of a user with cloud server management privileges may also view and audit the content of remote management commands. Through the above method, the private information in the remote management command is always represented in the form of ciphertext or variables, and is never stored in plain text. It is only maintained in the memory space. After the memory space is released, it cannot be viewed in any form. Therefore, through the above method, no one (including cloud service providers and users themselves) can obtain the private key or the plain text of the private information in the remote management command, so no one can view or decrypt the original private information, which completely eliminates the possibility of privacy information leakage from a technical point of view.

[0128] Since key management services usually need to maintain key pairs continuously and need to be kept running, and in cloud servers, proxy services also need to be kept running, the key management service can be used as a sub-service of the proxy service, and the functions of the key management service can be integrated into the proxy service.

[0129] The proxy service can provide the functions of the above-mentioned key management service, including generating key pairs, maintaining key pairs, and using the private key in the key pair to decrypt content encrypted by the public key.

[0130] Still with the above Figure 4 Taking the implementation method introduced in as an example, when the proxy service provides the function of the key management service, the remote management service started by the remote management request script can request the public key and key number of the new key from the proxy service;

[0131] The remote management service can find the actual process corresponding to the above proxy service, and send the request for generating a key pair and key generation parameters to the above proxy service through inter-process communication;

[0132] The proxy service receives a request from the remote management service and can generate an asymmetric key according to the key generation parameters and a corresponding key number; maintains the public key, private key, corresponding key number, corresponding key validity period, number of times the key can be used and other key generation parameters in the generated asymmetric key in the memory space corresponding to the proxy service; and sends the public key in the generated key pair and the corresponding key number to the remote management service through inter-process communication;

[0133] Correspondingly, the remote management service started by the remote management request script may request the proxy service to decrypt the encrypted remote management command;

[0134] The remote management service may search for the actual process corresponding to the proxy service, and send the request for decrypting the encrypted remote management command, the encrypted private content, and the key number to the proxy service through inter-process communication;

[0135] When the proxy service receives the request from the remote management service, it can search for the private key in the key pair corresponding to the key number, use the private key to decrypt the encrypted private content, and send the decrypted private content to the remote management service through inter-process communication. In an exemplary embodiment shown in this description, the remote management command can be used to modify the password of the target program on the cloud server based on the new password; the private information in the remote management command can include the new password.

[0136] By changing the password of the target program on the cloud server in this way, the security of the password can be guaranteed.

[0137] In an exemplary embodiment of this specification, a cloud server remote management device is also provided. Figure 5 , Figure 5 It is a block diagram of a cloud server remote management device according to an embodiment of the present specification.

[0138] The device may include the following components:

[0139] A key pair generating unit 510, configured to generate an asymmetric key pair for encrypting and decrypting private information in a remote management command in response to a remote management request for the cloud server sent by a received user;

[0140] A public key sending unit 520 is used to store and maintain the key pair in a secure storage space on the cloud server, and send the public key in the key pair to the user through the cloud service system;

[0141] The remote management unit 530 is used to respond to the remote management command encrypted by the public key sent by the user, decrypt the remote management command using the private key corresponding to the public key, and execute the decrypted remote management command to remotely manage the cloud server.

[0142] Optionally, the remote management request includes key generation parameters;

[0143] The key generation parameters include at least one of the following:

[0144] Key algorithm, key length, key validity period, and number of times the key can be used;

[0145] The key pair generating unit 510 is specifically used for:

[0146] Based on the key generation parameters, an asymmetric key pair is generated for encrypting and decrypting private information in the remote management command.

[0147] The key pair generating unit 510 is specifically used for:

[0148] Generate an asymmetric key pair for encrypting and decrypting private information in a remote management command, and a key number corresponding thereto;

[0149] The public key sending unit 520 is specifically used for:

[0150] Sending the public key in the key pair and the key number corresponding to the key pair to the user through the cloud service system;

[0151] The remote management command encrypted by the public key carries the key number.

[0152] Optionally, a proxy service corresponding to the cloud server is deployed on the cloud server; the proxy service is used to provide the user with an API interface for communicating with the cloud server;

[0153] The key pair generating unit 510 is specifically used for:

[0154] Responding to a remote management request received from a user sent to the proxy service via the cloud service system;

[0155] The public key sending unit 520 is specifically used for:

[0156] The proxy service sends the public key in the key pair to the user through the cloud service system;

[0157] The remote management unit 530 is specifically used for:

[0158] In response to a received remote management command encrypted by the public key and sent by the user to the proxy service through the cloud service system.

[0159] Optionally, a key management service for managing key pairs is also deployed on the cloud server;

[0160] The asymmetric key pair used to encrypt and decrypt the private information in the remote management command is generated and managed by the key management service;

[0161] The key pair is maintained by the key management service in a memory space corresponding to the key management service.

[0162] Optionally, the key management service is a subservice of the proxy service.

[0163] Optionally, the key pair generating unit 510 and the public key sending unit 520 are specifically used to:

[0164] In response to a received remote management request sent by a user to the cloud server, creating and executing a remote management request script;

[0165] Wherein, the remote management request script is used to:

[0166] Send a key generation request to the key pair management service, so that the key pair management service generates an asymmetric key pair for encrypting and decrypting private information in the remote management command, maintains the key pair in an isolated memory corresponding to the key pair management service, and returns the public key in the key pair to the remote management request script;

[0167] In response to receiving the public key, the public key is sent to the user via the cloud service system as a response to the remote management request.

[0168] Optionally, the key pair generating unit 510 and the public key sending unit 520 are specifically used to:

[0169] In response to receiving a remote management command sent by the user and encrypted by the public key, creating and executing a remote management command script;

[0170] Wherein, the remote management command script is used to:

[0171] Sending a decryption request to the key pair management service, so that the key pair management service uses the private key corresponding to the public key to decrypt the remote management command, and returns the decrypted remote management command to the remote management command script;

[0172] The decrypted remote management command is executed to perform remote management on the cloud server.

[0173] Optionally, the privacy information contained in the returned decrypted remote management command is represented in the form of a variable, and the value of the variable is stored in a memory space corresponding to the remote management command script;

[0174] The remote management unit 530 is specifically used for:

[0175] The private information in the memory space is called through the variable to execute the decrypted remote management command to perform remote management on the cloud server.

[0176] Optionally, the device further includes an invalid key deleting unit 540, configured to:

[0177] Determine whether there are any key pairs under maintenance whose usable times are 0 or invalid key pairs whose validity period has expired;

[0178] If the invalid key pair exists, delete the invalid key pair.

[0179] Optionally, the device further includes a service termination unit 550, configured to:

[0180] Determine whether there is a key pair under maintenance;

[0181] If there is no key pair under maintenance, the key management service is terminated.

[0182] Optionally, the remote management command is used to modify the password of a target program on the cloud server based on the new password;

[0183] The private information includes the new password;

[0184] The remote management of the cloud server includes modifying the password of the target program based on the new password.

[0185] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0186] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can refer to the partial description of the method embodiments. The device embodiments described above are only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on at least one network unit. Some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this specification. Ordinary technicians in this field can understand and implement it without paying creative work.

[0187] In an exemplary embodiment of the present specification, an embodiment of a device and a terminal to which the device is applied is also provided.

[0188] The embodiments of the device of this specification can be applied to computer devices, such as servers or terminal devices. The device embodiments can be implemented by software, hardware, or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor in which it is located reading the corresponding computer program instructions in the non-volatile memory into the memory and running them. From the hardware level, if Figure 6 As shown, Figure 6 A hardware structure diagram of a computer device 60 in which a device of an embodiment of this specification is located, except Figure 6In addition to the processor 610, memory 630, network interface 620, and non-volatile memory 640 shown, the server or electronic device where the device is located in the embodiment may also include other hardware according to the actual function of the computer device, which will not be described in detail.

[0189] In the exemplary embodiments of this specification, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of this specification is stored. In some possible embodiments, various aspects of this specification can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of this specification described in the above "Exemplary Method" section of this specification.

[0190] According to the embodiment of the present specification, the program product for implementing the above method can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present specification is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0191] The program product may adopt any combination of one or at least one readable medium. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or at least one wire, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0192] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0193] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0194] Program code for performing the operations of the present specification may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0195] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0196] Although this specification contains many specific implementation details, these should not be interpreted as limiting the scope of any invention or the scope of the claimed protection, but are mainly used to describe the features of the specific embodiments of specific inventions. Certain features described in at least one embodiment in this specification may also be implemented in combination in a single embodiment. On the other hand, the various features described in a single embodiment may also be implemented separately in at least one embodiment or in any suitable sub-combination. In addition, although the features may work in certain combinations as described above and even initially claim protection, one or at least one feature from the claimed combination may be removed from the combination in some cases, and the claimed combination may point to a sub-combination or a variation of a sub-combination.

[0197] Similarly, although operations are depicted in a particular order in the accompanying drawings, this should not be understood as requiring these operations to be performed in the particular order shown or to be performed sequentially, or requiring all illustrated operations to be performed to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. In addition, the separation of various system units and components in the above-described embodiments should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product, or packaged into at least one software product.

[0198] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the particular order or sequential order shown to achieve the desired results. In some implementations, multitasking and parallel processing may be advantageous.

[0199] The above description is only a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this specification should be included in the scope of protection of this specification.

Claims

1. A cloud server remote management method, applied to a cloud server created for a user on a cloud service end, wherein the user communicates with the cloud server through a cloud service system; the method comprises: In response to a received remote management request sent by a user to the cloud server, generating an asymmetric key pair for encrypting and decrypting private information in the remote management command; Storing and maintaining the key pair in a secure storage space on the cloud server, and sending the public key in the key pair to the user through the cloud service system; In response to receiving a remote management command sent by the user and encrypted by the public key, the remote management command is decrypted using a private key corresponding to the public key, and the decrypted remote management command is executed to remotely manage the cloud server.

2. The method according to claim 1, wherein: The remote management request includes key generation parameters; The key generation parameters include at least one of the following: Key algorithm, key length, key validity period, and number of times the key can be used; The generating of an asymmetric key pair for encrypting and decrypting private information in a remote management command includes: Based on the key generation parameters, an asymmetric key pair is generated for encrypting and decrypting private information in the remote management command.

3. The method according to claim 1, wherein: The generating of an asymmetric key pair for encrypting and decrypting private information in a remote management command includes: Generate an asymmetric key pair for encrypting and decrypting private information in a remote management command, and a key number corresponding thereto; The sending the public key in the key pair to the user through the cloud service system includes: Sending the public key in the key pair and the key number corresponding to the key pair to the user through the cloud service system; The remote management command encrypted by the public key carries the key number.

4. The method according to claim 1, wherein: A proxy service corresponding to the cloud server is deployed on the cloud server; the proxy service is used to provide the user with an API interface for communicating with the cloud server; The responding to the remote management request for the cloud server sent by the user includes: Responding to a remote management request received from a user sent to the proxy service via the cloud service system; The sending the public key in the key pair to the user through the cloud service system includes: The proxy service sends the public key in the key pair to the user through the cloud service system; The response to the received remote management command sent by the user and encrypted by the public key comprises: In response to a received remote management command encrypted by the public key and sent by the user to the proxy service through the cloud service system.

5. The method according to claim 4, wherein: A key management service for managing key pairs is also deployed on the cloud server; The asymmetric key pair used to encrypt and decrypt the private information in the remote management command is generated and managed by the key management service; The key pair is maintained by the key management service in a memory space corresponding to the key management service.

6. The method according to claim 5, wherein: The key management service is a sub-service of the proxy service.

7. The method according to claim 5, wherein: The step of generating, in response to a received remote management request for the cloud server sent by a user, an asymmetric key pair for encrypting and decrypting private information in the remote management command; Storing and maintaining the key pair in a secure storage space on the cloud server, and sending the public key in the key pair to the user through the cloud service system, includes: In response to a received remote management request sent by a user to the cloud server, creating and executing a remote management request script; Wherein, the remote management request script is used to: Send a key generation request to the key pair management service, so that the key pair management service generates an asymmetric key pair for encrypting and decrypting private information in the remote management command, maintains the key pair in an isolated memory corresponding to the key pair management service, and returns the public key in the key pair to the remote management request script; In response to receiving the public key, the public key is sent to the user via the cloud service system as a response to the remote management request.

8. The method according to claim 5, wherein: The step of decrypting the remote management command encrypted by the public key using the private key corresponding to the public key in response to the received remote management command sent by the user, and executing the decrypted remote management command to remotely manage the cloud server includes: In response to receiving a remote management command sent by the user and encrypted by the public key, creating and executing a remote management command script; Wherein, the remote management command script is used to: Sending a decryption request to the key pair management service, so that the key pair management service uses the private key corresponding to the public key to decrypt the remote management command, and returns the decrypted remote management command to the remote management command script; The decrypted remote management command is executed to perform remote management on the cloud server.

9. The method according to claim 8, wherein: The private information contained in the returned decrypted remote management command is represented in the form of a variable, and the value of the variable is stored in the memory space corresponding to the remote management command script; The executing the decrypted remote management command to remotely manage the cloud server includes: The private information in the memory space is called through the variable to execute the decrypted remote management command to perform remote management on the cloud server.

10. The method according to claim 5, wherein: After decrypting the remote management command using the private key corresponding to the public key, the method further includes: Determine whether there are any key pairs under maintenance whose usable times are 0 or invalid key pairs whose validity period has expired; If the invalid key pair exists, delete the invalid key pair.

11. The method according to claim 1, wherein: The remote management command is used to modify the password of the target program on the cloud server based on the new password; The private information includes the new password; The remote management of the cloud server includes modifying the password of the target program based on the new password.

12. A cloud server remote management device, applied to a cloud server created for a user on a cloud service end, wherein the user communicates with the cloud server through a cloud service system; the device comprises: A key pair generating unit, configured to generate an asymmetric key pair for encrypting and decrypting private information in a remote management command in response to a remote management request for the cloud server sent by a received user; A public key sending unit, configured to store and maintain the key pair in a secure storage space on the cloud server, and send the public key in the key pair to the user through the cloud service system; The remote management unit is used to respond to the remote management command encrypted by the public key sent by the user, decrypt the remote management command using the private key corresponding to the public key, and execute the decrypted remote management command to remotely manage the cloud server.

13. A storage medium having a computer program stored thereon, which, when executed, implements the steps of the method according to any one of claims 1 to 11.

14. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the following method is implemented: wherein, when the processor executes the program, the method as claimed in any one of claims 1 to 11 is implemented.

Images