Substrate management controller access control method and system

Abstract

The invention discloses a substrate management controller access control method and system, and relates to the technical field of networks, and the method comprises the steps: receiving a user request, obtaining request parameter information related to the user request, and extracting one or more pieces of key information in the request parameter information; mapping the key information to a constructed fuzzy set to obtain a membership degree of the one or more pieces of key information; and in combination with the one or more pieces of key information and the membership degree of the key information, calculating a risk assessment value of the user request, and when the risk assessment value meets a preset condition, executing a preset adjustment operation. According to the method and the device, the security of the access request can be comprehensively evaluated, and the uncertainty and fuzziness information existing in the access request can be analyzed through the fuzzy control algorithm, so that the risk of the access request can be more accurately evaluated, and the security of the system can be ensured.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a baseboard management controller access control method and system. Background Art

[0002] BMC (Baseboard Management Controller) is the core component of the server management system defined by the Intelligent Platform Management Interface. It is a hardware manager integrated in servers, network devices or other computer systems. It can monitor the hardware status of the device, perform remote management operations, and provide monitoring and control functions for the device. It can be independent of the server operating system and the main processor's microcontroller, and can also be built into the motherboard of a server, network device or other complex electronic system.

[0003] In some related technologies, when controlling access from the outside, it is found that the current security control technology can resist illegal external intrusion to a certain extent, but the following problems still exist. In the related technology, characteristic values ​​are used to confirm whether the identity security verification has been passed, but there are still illegal processes that do not meet the characteristic values ​​but bypass the characteristic value confirmation stage to directly access, which brings hidden dangers to the stable operation of the system; it also includes deploying plug-ins for each device terminal to implement different file-level access restrictions. Although this method requires the server to actively connect to the terminal device, if there is a virus or vulnerability in the terminal device, it will affect the normal use of the server and seriously affect the data security in the server. Summary of the invention

[0004] In order to solve at least one of the problems mentioned in the above background technology, the present application provides a baseboard management controller access control method and system, which can comprehensively evaluate the security of access requests, and improve the analysis of uncertainty and fuzzy information in access requests through fuzzy control algorithms, thereby more accurately evaluating the risks of access requests and ensuring the security of the system.

[0005] The specific technical solutions provided by the embodiments of this application are as follows:

[0006] In a first aspect, a baseboard management controller access control method is provided, which is applied to a baseboard management controller, and the method includes:

[0007] Receive a user request, obtain request parameter information associated with the user request, and extract one or more key information in the request parameter information;

[0008] Mapping the key information to the constructed fuzzy set to obtain the membership degree of the one or more key information;

[0009] The risk assessment value requested by the user is calculated by combining the one or more key information and the degree of membership of the key information, and when the risk assessment value meets a preset condition, a preset adjustment operation is performed.

[0010] In a specific embodiment, the key information includes at least any of the following information: user IP address, port number, access time, encryption suite carried in user request, and access times;

[0011] The fuzzy set includes at least any one of the following information: IP address credibility, access time anomaly, port number relevance, and encryption suite legitimacy.

[0012] In a specific embodiment, the key information is mapped to the constructed fuzzy set to obtain the membership of the one or more key information, specifically including: configuring the one or more key information to be associated with at least one of the fuzzy sets so that the key information is mapped to the fuzzy set; dividing the elements in the fuzzy set into at least two attribute levels, each of the attribute levels corresponds to a membership parameter value, and the membership parameter value satisfies the threshold range of the membership, wherein the membership parameter value of one attribute level is close to the minimum value of the threshold range of the membership, and the membership parameter value of the other attribute level is close to the maximum value of the threshold range of the membership; obtaining the key features of the key information associated with the fuzzy set, and analyzing the attribute level to which the key features belong; reading the membership parameter value corresponding to the attribute level, and setting the membership parameter value to the membership of the key information.

[0013] In a specific embodiment, the method further includes: configuring the one or more key information to have a weight coefficient, calculating the product of each one or more of the weight coefficients and the degree of membership of the key information; calculating the sum of the products of the weight coefficients of the one or more key information and the degree of membership of the key information to obtain the risk assessment value requested by the user.

[0014] In a specific embodiment, the method also includes: obtaining the target task requested by the user, sorting the key information in the user request according to the target task information to form a key information queue; configuring the weight coefficient values ​​of the key information in sequence according to the order in the key information queue, and confirming that there are at least two different weight coefficient values.

[0015] In a specific embodiment, when the risk assessment value meets the preset conditions, a preset adjustment operation is performed, specifically including: when the risk assessment value meets the first threshold, the risk level is set to low, and the user request is recorded through a log; when the risk assessment value meets the second threshold, the risk level is set to medium, the unit identification light is turned on, and an early warning is issued; when the risk assessment value meets the third threshold, the risk level is set to high, the user request is blocked, and the user IP address of the user request is added to a blacklist.

[0016] In a specific embodiment, after executing the preset adjustment operation, the method further includes: obtaining the operating state of the baseboard management controller after executing the preset adjustment operation; and adjusting the membership calculation parameters of the fuzzy set and the key information according to the operating state of the baseboard management controller.

[0017] In a second aspect, a baseboard management controller access control system is provided, which is used to implement the baseboard management controller access control method as described above, and the system includes:

[0018] an acquiring unit, configured to, in response to receiving a user request, acquire request parameter information associated with the user request, and extract one or more key information in the request parameter information;

[0019] An evaluation unit, used for mapping key information to the constructed fuzzy set to obtain the membership degree of the one or more key information;

[0020] An execution unit is used to calculate the risk assessment value requested by the user by combining the one or more key information and the membership degree of the key information, and execute a preset adjustment operation when the risk assessment value meets a preset condition.

[0021] In a third aspect, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the following steps are implemented:

[0022] Step A: receiving a user request, obtaining request parameter information associated with the user request, and extracting one or more key information in the request parameter information;

[0023] Step B: mapping the key information to the constructed fuzzy set to obtain the membership degree of the one or more key information;

[0024] Step C: combining the one or more key information and the degree of membership of the key information, calculating the risk assessment value requested by the user, and performing a preset adjustment operation when the risk assessment value meets a preset condition.

[0025] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0026] Step A: receiving a user request, obtaining request parameter information associated with the user request, and extracting one or more key information in the request parameter information;

[0027] Step B: mapping the key information to the constructed fuzzy set to obtain the membership degree of the one or more key information;

[0028] Step C: combining the one or more key information and the degree of membership of the key information, calculating the risk assessment value requested by the user, and performing a preset adjustment operation when the risk assessment value meets a preset condition.

[0029] The embodiments of the present application have the following beneficial effects:

[0030] 1. The baseboard management controller access control method provided in the embodiment of the present application, wherein multiple key information in the user request is obtained by extracting the user request, the membership of the key information is calculated by the association relationship between each key information and the fuzzy set it is mapped to, and the risk assessment value is obtained by combining the membership of all key information. Various parameter information in the user access process is analyzed by combining the fuzzy control algorithm to obtain various uncertainties and fuzzy information that may be contained in the access request, so as to more accurately assess the risk of the access request.

[0031] 2. In this embodiment, different attribute levels are formulated for each fuzzy combination. By combining the specific state parameters of the system operation and the system's own performance characteristics, different attribute levels are designed to consider the specific information and various access-related parameters during the access process, so as to comprehensively evaluate the security of the access request. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0033] Figure 1 A schematic diagram showing an application environment according to the present application;

[0034] Figure 2 A schematic diagram of a baseboard management controller access control method according to the present application is shown;

[0035] Figure 3A schematic diagram showing the risk level assessment according to the present application;

[0036] Figure 4 A schematic diagram of a baseboard management controller access control system according to the present application is shown;

[0037] Figure 5 A schematic diagram showing a computer device according to the present application. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0039] The baseboard management controller access control method provided in this application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. A baseboard management controller is configured in the terminal 102 to analyze the user request when the user accesses it to obtain the risk assessment value of the user request. When the risk assessment value meets the preset condition, the preset adjustment operation is performed to improve the safety of the system operation. Among them, the terminal 102 can be but not limited to various personal computers, laptops, smart phones, tablet computers and portable wearable devices, and the server 104 can be implemented by an independent server or a server cluster composed of multiple servers.

[0040] In one embodiment, Figure 2 As shown, a baseboard management controller access control method is provided, and the method is applied to Figure 1 The baseboard management controller in the terminal in the example is used to illustrate, including the following steps:

[0041] Step 101: Receive a user request, obtain request parameter information associated with the user request, and extract one or more key information in the request parameter information.

[0042] In this embodiment, the baseboard management controller is the core control component of the system in the terminal, which can monitor access requests from the outside, collect specific information associated with the access requests and pass it to other components, so as to monitor the process of users accessing the baseboard management controller to avoid the risks of the user request itself and the risks it brings to the system operation. When receiving a user request, the baseboard management controller reads the request parameter information and parses multiple key information in the request parameter information; wherein the key information includes the user IP address, port number, access time, encryption suite carried by the user request, and access times.

[0043] By obtaining information such as the user's IP address, port number, access time, encryption suite carried in the user request, and number of accesses in the user request, we can prepare for subsequent risk assessment.

[0044] Step 102: Map the key information to the constructed fuzzy set to obtain the membership degree of the one or more key information.

[0045] In this embodiment, the key information is mapped to the constructed fuzzy set to obtain the membership of each key information, specifically including: the fuzzy set at least includes IP address credibility, access time anomaly, port number relevance and encryption suite legitimacy; each key information is configured to be associated with at least one fuzzy set so that the key information is mapped to the fuzzy set; the elements in the fuzzy set are divided into at least two attribute levels, each attribute level corresponds to a membership parameter value, and the membership parameter value satisfies the threshold range of the membership; the membership parameter value of one attribute level is close to the minimum value of the threshold range of the membership, and the membership parameter value of the other attribute level is close to the maximum value of the threshold range of the membership; the key features of the key information associated with the fuzzy set are obtained, and the attribute level to which the key features belong is analyzed; the membership parameter value corresponding to the attribute level is read, and the membership parameter value is set as the membership of the key information.

[0046] The constructed fuzzy set is obtained by collecting the fault information occurring during operation in the system and conducting a comprehensive analysis based on the functional characteristics of the system itself. The fuzzy set includes IP address credibility, access time anomaly, port number relevance, and encryption suite legitimacy. The above four fuzzy sets are used to perform correlation analysis with the key information in user requests.

[0047] Exemplarily, in this embodiment, the membership is calculated by a membership function, wherein the threshold range of the membership is "0-1". Specifically, the IP address credibility in the fuzzy set is divided into three attribute levels, including low IP address credibility, medium IP address credibility, and high IP address credibility, and the membership parameter value corresponding to the low IP address credibility is set to 0.9, the membership parameter value corresponding to the medium IP address credibility is set to 0.5, and the membership parameter value corresponding to the high IP address credibility is set to 0.1.

[0048] Read the key features of the key information associated with the user request. For example, if the IP address belongs to a known malicious IP list or appears frequently, the IP address credibility is low; if the IP address comes from an untrusted network segment but has no attack record, the IP address credibility is medium, and the range of the subordinate parameter value is "0 to middle value", where the middle value is a value in the range of "0 to 1"; if the IP address comes from a trusted network segment or a known friendly user, the IP address credibility is high.

[0049] Furthermore, the access time abnormality in the fuzzy set is divided into three attribute levels, including normal access time, suspicious access time and abnormal access time; and the membership parameter value corresponding to normal access time is set to 0, the membership parameter value corresponding to suspicious access time is set to 0.4, and the membership parameter value corresponding to abnormal access time is set to 0.9. At the same time, the attribute level of the key information is confirmed according to the key information content. If the access time conforms to the regular working time mode or the legal access period preset by the user, the access time is normal; if the access time deviates from the regular mode but is within an acceptable range, the access time is suspicious; if the access time is obviously not in line with the norm, the access time is abnormal.

[0050] In this embodiment, the port number correlation is divided into three attribute levels, including low port number correlation, medium port number correlation and high port number correlation, wherein the subordinate parameter value corresponding to the low port number correlation is 0.9, the subordinate parameter value corresponding to the medium port number correlation is 0.5, and the subordinate parameter value corresponding to the high port number correlation is 0.3. At the same time, the attribute level of the port number belonging to the key information is confirmed. If the accessed port number is not related to common services, the port number correlation is low; if the accessed port number is related to some services but not to key services, the port number correlation is medium; if the accessed port number is related to key services, the port number correlation is high.

[0051] In a specific embodiment, the legality of the encryption suite is divided into three levels according to the attribute level, including high legality of the encryption suite, medium legality of the encryption suite and low legality of the encryption suite. The membership parameter value corresponding to the high legality of the encryption suite is 0.1, the membership parameter value corresponding to the medium legality of the encryption suite is 0.3, and the membership parameter value corresponding to the low legality of the encryption suite is 0.8; and the attribute level of the legality of the encryption suite is judged in combination with the key information. If the encryption suite belongs to an asymmetric encryption algorithm, it belongs to the encryption suite with high legality; if the encryption suite belongs to a symmetric encryption algorithm, it belongs to the encryption suite with medium legality; if the encryption suite belongs to other encryption algorithms, it belongs to the encryption suite with low legality.

[0052] Through the above process, the membership degree of the parsed key information is calculated to achieve a comprehensive assessment of the specific parameter information in the user request, and the risk of the user request is further judged in combination with the above membership degree.

[0053] Step 103: Calculate the risk assessment value requested by the user by combining the one or more key information and the degree of membership of the key information, and perform a preset adjustment operation when the risk assessment value meets a preset condition.

[0054] In a specific embodiment, each key information is configured with a weight coefficient, and the product of each weight coefficient and the membership degree of the key information is calculated; the sum of the products of the weight coefficients of all the key information and the membership degree of the key information is calculated to obtain the risk assessment value requested by the user.

[0055] Exemplarily, a weight algorithm is used to configure different weight coefficients for key features in each key information, and the weight coefficients and the degree of membership are combined for calculation; wherein the key information user IP address, port number, access time, and encryption suite carried in the user request correspond to the first weight coefficient, the second weight coefficient, the third weight coefficient, and the fourth weight coefficient, respectively, and the calculation formula (1) of the risk assessment value is as follows:

[0056]

[0057] Among them, π represents the risk assessment value; Indicates the membership of the user's IP address; represents the degree of membership of the port number; α represents the degree of membership of the access time; β represents the degree of membership of the encryption suite carried by the user request; a represents the first weight coefficient; b represents the second weight coefficient; c represents the third weight coefficient; and d represents the fourth weight coefficient.

[0058] For example, the first weight coefficient of the key information in the user request is configured to be 0.5, the second weight coefficient is 0.2, the third weight coefficient is 0.1, and the fourth weight coefficient is 0.2; at the same time, the credibility of the IP address of the user request is 0.9; the access time abnormality is 0.9; the port number relevance is 0.3 and the encryption suite legitimacy is 0.3, then the risk assessment value calculated by formula (2) is 0.72:

[0059] 0.5*0.9+0.2*0.9+0.1*0.3+0.2*0.3=0.72(2)

[0060] In this embodiment, in order to ensure further strict risk assessment for the types of different requests and the purpose of the target tasks corresponding to the requests, it also includes obtaining the target task of the user request, sorting the key information in the user request according to the target task information to form a key information queue; configuring the weight coefficient values ​​of the key information in sequence according to the order in the key information queue, and confirming that there are at least two different weight coefficient values.

[0061] Exemplarily, the key information queue in the user request is the user IP address, the encryption suite carried in the user request, the port number and the access time, and the corresponding weight coefficients are set to 0.6, 0.2, 0.1 and 0.1 respectively.

[0062] In a specific embodiment, in order to have different risk level requirements for user requests for access requests and specific function operations, the corresponding assessment strategy needs to be redefined. Specifically,

[0063] like Figure 3 As shown, in a specific embodiment, when the risk assessment value meets the preset conditions, a preset adjustment operation is performed, specifically including: when the risk assessment value meets the first threshold, the risk level is set to low, and the user request is recorded through a log; when the risk assessment value meets the second threshold, the risk level is set to medium, the unit identification light is turned on, and an early warning is issued; when the risk assessment value meets the third threshold, the risk level is set to high, the user request is blocked, and the user IP address of the user request is added to the blacklist.

[0064] It should be noted that the first threshold, the second threshold, and the third threshold in this embodiment increase in sequence. When it is determined that the risk level of the user request is high, the baseboard management controller sets the user IP address to be blocked and set to be permanently blocked, and at the same time sets the server operating system as the NFS server client of the baseboard management controller, sets the baseboard management controller as the main NFS server, synchronizes the data of the baseboard management controller to the operating system; and manages and closes the service ports for login access such as SSH of the baseboard management controller.

[0065] In a specific embodiment, after executing the preset adjustment operation, the method further includes: obtaining the operating state of the baseboard management controller after executing the preset adjustment operation; and adjusting the membership calculation parameters of the fuzzy set and the key information according to the operating state of the baseboard management controller.

[0066] Furthermore, after executing the preset adjustment operation, the system starts running for a preset time, obtains the protection effect and false alarm information obtained by the system through this control method within the preset period, queries the associated historical user requests and the historical fuzzy set associated with the previous user requests based on the false alarm information; deletes the attribute level corresponding to the highest membership parameter value in the historical fuzzy set, and resets the attribute level in the historical fuzzy set and its corresponding membership parameter value; so as to reduce the probability of erroneous operation of the system due to risk factor assessment operations.

[0067] In this embodiment, the user interaction interface will allow the administrator to view the system status, configure firewall rules, fuzzy rule base, manage IP blacklists, manage server unit identification lights, set up data backup baseboard management controllers and operating system NFS servers, etc., and during the entire access process, the system will record all invading user IPs, request times, port numbers, encryption suites, specific operations and other information.

[0068] In this embodiment, different attribute levels are formulated for each fuzzy combination. Different attribute levels are designed by combining the specific state parameters of the system operation and the performance characteristics of the system itself to consider the specific information in the access process and various access-related parameters, so as to comprehensively evaluate the security of the access request; and the fuzzy control algorithm is used to improve the analysis of uncertainty and ambiguity in the access request, so as to more accurately evaluate the risk of the access request and ensure the security of the system.

[0069] Embodiment 2

[0070] Corresponding to the above embodiment, the present application provides a baseboard management controller access control system, which is used to implement the baseboard management controller access control method as described above, such as Figure 4 As shown, the system comprises:

[0071] an acquiring unit, configured to, in response to receiving a user request, acquire request parameter information associated with the user request, and extract one or more key information in the request parameter information;

[0072] An evaluation unit, used for mapping key information to the constructed fuzzy set to obtain the membership degree of the one or more key information;

[0073] An execution unit is used to calculate the risk assessment value requested by the user by combining the one or more key information and the membership degree of the key information, and execute a preset adjustment operation when the risk assessment value meets a preset condition.

[0074] In a specific embodiment, the key information includes at least any one of the following information: user IP address, port number, access time, encryption suite carried in the user request, and number of accesses;.

[0075] In a specific embodiment, the fuzzy set includes at least any one of the following information: IP address credibility, access time anomaly, port number relevance, and encryption suite legitimacy.

[0076] In a specific embodiment, the evaluation unit is specifically used to configure the one or more key information to be associated with at least one of the fuzzy sets so that the key information is mapped to the fuzzy set; divide the elements in the fuzzy set into at least two attribute levels, each of the attribute levels corresponds to a membership parameter value, and the membership parameter value satisfies the threshold range of the membership degree, wherein the membership parameter value of one attribute level is close to the minimum value of the threshold range of the membership degree, and the membership parameter value of the other attribute level is close to the maximum value of the threshold range of the membership degree; obtain the key features of the key information associated with the fuzzy set, and analyze the attribute level to which the key features belong; read the membership parameter value corresponding to the attribute level, and set the membership parameter value to the membership degree of the key information.

[0077] In a specific embodiment, the execution unit is also used to configure the one or more key information with weight coefficients, calculate the product of the one or more weight coefficients and the membership degree of the key information; calculate the sum of the products of the weight coefficients of the one or more key information and the membership degree of the key information to obtain the risk assessment value requested by the user.

[0078] In a specific embodiment, the execution unit is also used to obtain the target task requested by the user, sort the key information in the user request according to the target task information to form a key information queue; configure the weight coefficient values ​​of the key information in sequence according to the order in the key information queue, and confirm that there are at least two different weight coefficient values.

[0079] In a specific embodiment, the execution unit is specifically used to set the risk level to low and record the user request through a log when the risk assessment value meets the first threshold; when the risk assessment value meets the second threshold, the risk level is set to medium, the unit identification light is turned on, and an early warning is issued; when the risk assessment value meets the third threshold, the risk level is set to high, the user request access is blocked, and the user IP address of the user request is added to a blacklist.

[0080] In a specific embodiment, the execution unit is further used to obtain the operating state of the baseboard management controller after executing the preset adjustment operation; and adjust the membership calculation parameters of the fuzzy set and the key information according to the operating state of the baseboard management controller.

[0081] Embodiment 3

[0082] A computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0083] Step 201: receiving a user request, obtaining request parameter information associated with the user request, and extracting one or more key information in the request parameter information;

[0084] Step 202: Map the key information to the constructed fuzzy set to obtain the membership degree of the one or more key information;

[0085] Step 203: Calculate the risk assessment value requested by the user by combining the one or more key information and the degree of membership of the key information, and perform a preset adjustment operation when the risk assessment value meets a preset condition.

[0086] In one embodiment,

[0087] The key information includes at least any of the following information: user IP address, port number, access time, encryption suite carried in user request, and access times;

[0088] The fuzzy set includes at least any one of the following information: IP address credibility, access time anomaly, port number relevance, and encryption suite legitimacy.

[0089] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0090] The key information is mapped to the constructed fuzzy set to obtain the membership of the one or more key information, specifically including: configuring each of the key information to be associated with at least one of the fuzzy sets so that the key information is mapped to the fuzzy set; dividing the elements in the fuzzy set into at least two attribute levels, each of the attribute levels corresponds to a membership parameter value, and the membership parameter value satisfies the threshold range of the membership, wherein the membership parameter value of one attribute level is close to the minimum value of the threshold range of the membership, and the membership parameter value of the other attribute level is close to the maximum value of the threshold range of the membership; obtaining the key features of the key information associated with the fuzzy set, and analyzing the attribute level to which the key features belong; reading the membership parameter value corresponding to the attribute level, and setting the membership parameter value as the membership of the key information.

[0091] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0092] The one or more key information are configured with weight coefficients, and the product of each weight coefficient and the membership degree of the key information is calculated; the sum of the products of the weight coefficients of the one or more key information and the membership degree of the key information is calculated to obtain the risk assessment value requested by the user.

[0093] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0094] Obtain the target task requested by the user, sort the key information in the user request according to the target task information to form a key information queue; configure the weight coefficient values ​​of the key information in sequence according to the order in the key information queue, and confirm that at least two of the weight coefficient values ​​are different.

[0095] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0096] When the risk assessment value meets the preset conditions, a preset adjustment operation is performed, specifically including: when the risk assessment value meets the first threshold, the risk level is set to low, and the user request is recorded through a log; when the risk assessment value meets the second threshold, the risk level is set to medium, the unit identification light is turned on, and an early warning is issued; when the risk assessment value meets the third threshold, the risk level is set to high, the user request is blocked, and the user IP address of the user request is added to a blacklist.

[0097] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0098] The operating state of the baseboard management controller after the preset adjustment operation is performed is obtained; and the membership calculation parameters of the fuzzy set and the key information are adjusted according to the operating state of the baseboard management controller.

[0099] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 5 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store fuzzy set data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a baseboard management controller access control method is implemented.

[0100] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0101] Embodiment 4

[0102] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0103] Step 301: receiving a user request, obtaining request parameter information associated with the user request, and extracting one or more key information in the request parameter information;

[0104] Step 302: Map the key information to the constructed fuzzy set to obtain the membership degree of the one or more key information;

[0105] Step 303: Calculate the risk assessment value requested by the user by combining the one or more key information and the degree of membership of the key information, and perform a preset adjustment operation when the risk assessment value meets a preset condition.

[0106] In one embodiment, the key information includes at least any of the following information: user IP address, port number, access time, encryption suite carried in user request, and access times;

[0107] The fuzzy set includes at least any one of the following information: IP address credibility, access time anomaly, port number relevance, and encryption suite legitimacy.

[0108] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0109] The configured one or more key information is associated with at least one of the fuzzy sets so that the key information is mapped to the fuzzy set; the elements in the fuzzy set are divided into at least two attribute levels, each of the attribute levels corresponds to a membership parameter value, and the membership parameter value satisfies the threshold range of the membership degree, wherein the membership parameter value of one attribute level is close to the minimum value of the threshold range of the membership degree, and the membership parameter value of the other attribute level is close to the maximum value of the threshold range of the membership degree; the key features of the key information associated with the fuzzy set are obtained, and the attribute level to which the key features belong is analyzed; the membership parameter value corresponding to the attribute level is read, and the membership parameter value is set as the membership degree of the key information.

[0110] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0111] Configure the one or more key information with weight coefficients, and calculate the product of the one or more weight coefficients and the membership degree of the key information; calculate the sum of the products of the weight coefficients of the one or more key information and the membership degree of the key information to obtain the risk assessment value requested by the user.

[0112] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0113] Obtain the target task requested by the user, sort the key information in the user request according to the target task information to form a key information queue; configure the weight coefficient values ​​of the key information in sequence according to the order in the key information queue, and confirm that at least two of the weight coefficient values ​​are different.

[0114] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0115] When the risk assessment value meets the preset conditions, a preset adjustment operation is performed, specifically including: when the risk assessment value meets the first threshold, the risk level is set to low, and the user request is recorded through a log; when the risk assessment value meets the second threshold, the risk level is set to medium, the unit identification light is turned on, and an early warning is issued; when the risk assessment value meets the third threshold, the risk level is set to high, the user request is blocked, and the user IP address of the user request is added to a blacklist.

[0116] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0117] The operating state of the baseboard management controller after the preset adjustment operation is performed is obtained; and the membership calculation parameters of the fuzzy set and the key information are adjusted according to the operating state of the baseboard management controller.

[0118] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0119] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the embodiments of the present application.

[0120] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A baseboard management controller access control method, characterized in that: Applied to a baseboard management controller, the method comprises: Receive a user request, obtain request parameter information associated with the user request, and extract one or more key information in the request parameter information; Mapping the key information to the constructed fuzzy set to obtain the membership degree of the one or more key information; The risk assessment value requested by the user is calculated by combining the one or more key information and the degree of membership of the key information, and when the risk assessment value meets a preset condition, a preset adjustment operation is performed.

2. The baseboard management controller access control method according to claim 1, characterized in that: The key information includes at least any of the following information: user IP address, port number, access time, encryption suite carried in user request, and access times; The fuzzy set includes at least any one of the following information: IP address credibility, access time anomaly, port number relevance, and encryption suite legitimacy.

3. The baseboard management controller access control method according to claim 1 or 2, characterized in that: Mapping the key information to the constructed fuzzy set to obtain the membership degree of the one or more key information specifically includes: configuring the one or more key information to be associated with at least one of the fuzzy sets so that the key information is mapped into the fuzzy set; Dividing the elements in the fuzzy set into at least two attribute levels, each of the attribute levels corresponds to a membership parameter value, and the membership parameter value satisfies the threshold range of the membership degree, wherein the membership parameter value of one attribute level is close to the minimum value of the threshold range of the membership degree, and the membership parameter value of the other attribute level is close to the maximum value of the threshold range of the membership degree; Acquire key features of the key information associated with the fuzzy set, and analyze the attribute level to which the key features belong; The membership parameter value corresponding to the attribute level is read, and the membership parameter value is set as the membership degree of the key information.

4. The baseboard management controller access control method according to claim 3, characterized in that: The method further comprises: Configuring the one or more key information to have a weight coefficient, and calculating the product of the one or more weight coefficients and the degree of membership of the key information; The sum of the product of the weight coefficient of the one or more key information and the degree of membership of the key information is calculated to obtain the risk assessment value requested by the user.

5. The baseboard management controller access control method according to claim 4, characterized in that: The method further comprises: Acquire the target task requested by the user, and sort the key information in the user request according to the target task information to form a key information queue; The weight coefficient values ​​of the key information are sequentially configured according to the order in the key information queue, and at least two weight coefficient values ​​are confirmed to be different.

6. The baseboard management controller access control method according to claim 1 or 2, characterized in that: When the risk assessment value meets the preset conditions, a preset adjustment operation is performed, specifically including: When the risk assessment value meets a first threshold, the risk level is set to low, and the user request is recorded in a log; When the risk assessment value meets the second threshold, the risk level is set to medium, the unit identification light is turned on, and an early warning is issued; When the risk assessment value meets the third threshold, the risk level is set to high, the user request for access is blocked, and the user IP address of the user request is added to a blacklist.

7. The baseboard management controller access control method according to claim 6, characterized in that: After the preset adjustment operation is performed, the method further includes: Acquiring the operating state of the baseboard management controller after executing the preset adjustment operation; The membership calculation parameters of the fuzzy set and the key information are adjusted according to the operating status of the baseboard management controller.

8. A baseboard management controller access control system, characterized in that: A system for implementing a baseboard management controller access control method according to any one of claims 1 to 7, comprising: an acquiring unit, configured to, in response to receiving a user request, acquire request parameter information associated with the user request, and extract one or more key information from the request parameter information; An evaluation unit, used for mapping the key information to the constructed fuzzy set to obtain the membership degree of each key information; The execution unit is used to combine all the key information and the membership degree of the key information to calculate the risk assessment value requested by the user, and when the risk assessment value meets the preset condition, execute the preset adjustment operation.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images