Desktop display control method and device, storage medium and electronic equipment

Abstract

The invention discloses a desktop display control method and device, a storage medium and electronic equipment. The method comprises the following steps: when a target client is set to be managed through a substrate management controller and the target client enters a preset type interface, obtaining operation information and connection information, and sending a screen shielding instruction to the substrate management controller based on the operation information and the connection information, a non-operator display picture is interrupted through the substrate management controller, the non-operator represents other operators except the operator in the target client, the target client quits the preset type interface in response to the target client, a shielding picture removing instruction is sent to the substrate management controller, and the shielding picture is removed from the substrate management controller. And a non-operator display picture is recovered through the substrate management controller. The technical problems that sensitive information is easy to leak and the security is relatively low in the prior art are solved.

Description

Technical Field

[0001] The present application relates to the field of computers, and in particular to a method and device for controlling desktop display, a storage medium, and an electronic device. Background Art

[0002] Currently, on a server configured with a virtual desktop system, you can simultaneously enable the KVM (Kernel-based Virtual Machine, system virtualization module) remote virtual desktop on the BMC (Baseboard Management Controller) side and connect the physical VGA (Video Graphics Array, video signal) interface through a monitor. Whenever the remote virtual desktop and the VGA interface are started at the same time, the system desktop is shared. If one of the users is viewing or entering sensitive information, there is a risk of screen peeking, resulting in sensitive information leakage.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a desktop display control method and device, a storage medium, and an electronic device to at least solve the technical problems in related technologies of easy leakage of sensitive information and low security.

[0005] According to one aspect of an embodiment of the present application, a method for controlling desktop display is provided, comprising: when a target client is set to be managed through a baseboard management controller and the target client enters a preset type interface, obtaining operation information and connection information, wherein the target client is set to allow display through a physical display screen and a virtual display screen, the operation information is used to indicate the operator type of the operator who performs the target operation, the target operation represents the operation corresponding to entering the preset type interface, and the connection information is used to indicate whether the target client is displayed through the physical display screen; based on the operation information and the connection information, a screen shielding instruction is sent to the baseboard management controller, and a display screen of a non-operator is interrupted through the baseboard management controller, wherein the non-operator represents other operators in the target client except the operator; in response to the target client exiting the preset type interface, a screen unshielding instruction is sent to the baseboard management controller, and the display screen of the non-operator is restored through the baseboard management controller.

[0006] According to another aspect of an embodiment of the present application, a control device for desktop display is also provided, including: an acquisition module, used to acquire operation information and connection information when a target client is set to be managed through a baseboard management controller and the target client enters a preset type interface, wherein the target client is set to allow display through a physical display screen and a virtual display screen, the operation information is used to indicate the operator type of the operator who performs the target operation, the target operation represents the operation corresponding to entering the preset type interface, and the connection information is used to indicate whether the target client is displayed through the physical display screen; an interruption module, used to send a shielding screen instruction to the baseboard management controller based on the operation information and the connection information, and interrupt the display screen of a non-operator through the baseboard management controller, wherein the non-operator represents other operators in the target client except the operator; a recovery module, used to send a unshielding screen instruction to the baseboard management controller in response to the target client exiting the preset type interface, and restore the display screen of the non-operator through the baseboard management controller.

[0007] In an exemplary embodiment, the device is used to send a screen shielding instruction to the baseboard management controller based on the operation information and the connection information in the following manner, so as to interrupt the display screen of the non-operator through the baseboard management controller: determine the device type of the control device that initiates the target operation based on the operation information, wherein the device type includes a physical control device and a virtual control device; when the device type represents the physical control device, determine whether the target client is displayed through the physical display screen based on the connection information; when the target client is displayed through the physical display screen, send the screen shielding instruction to the baseboard management controller, so as to interrupt the display screen of the non-operator through the baseboard management controller.

[0008] In an exemplary embodiment, the device is used to send the shielding screen instruction to the baseboard management controller in the following manner when the target client displays through the physical display screen, and interrupt the display screen of the non-operator through the baseboard management controller: when the target client displays through the physical display screen, determine the operator type as a host operator based on the operation information, and generate a first shielding screen instruction, wherein the first shielding screen instruction is used to shield the virtual display screen associated with the target client; send the first shielding screen instruction to the baseboard management controller, and in response to the baseboard management controller receiving the first shielding screen instruction, disconnect the connection between the virtual display screen and the target client.

[0009] In an exemplary embodiment, the device is also used for: when the device type represents the physical control device, after determining whether the target client is displayed through the physical display screen based on the connection information, when the target client is not displayed through the physical display screen, determining the operator type as a virtual operator based on the operation information, and generating a second shielding screen instruction, wherein the second shielding screen instruction is used to shield the physical display screen associated with the target client; sending the second shielding screen instruction to the baseboard management controller, and in response to the baseboard management controller receiving the second shielding screen instruction, disconnecting the connection between the physical display screen and the target client; determining whether there are multiple virtual sessions for the target client, and if there are multiple virtual sessions, determining the operator from the multiple sessions, and disconnecting the connection between the virtual display screen not associated with the operator and the target client based on the operator.

[0010] In an exemplary embodiment, the device is used to send a shielding screen instruction to the baseboard management controller based on the operation information and the connection information in the following manner, and interrupt the display screen of the non-operator through the baseboard management controller: determine the device type of the control device that initiates the target operation based on the operation information, wherein the device type includes a physical control device and a virtual control device; when the device type represents the virtual control device, determine the operator type as a virtual operator based on the operation information, and generate a third shielding screen instruction, wherein the third shielding screen instruction is used to shield the physical display screen associated with the target client; send the third shielding screen instruction to the baseboard management controller, and in response to the baseboard management controller receiving the third shielding screen instruction, disconnect the connection between the physical display screen and the target client; determine whether there are multiple virtual sessions for the target client, and if there are multiple virtual sessions, determine the operator from the multiple sessions, and disconnect the connection between the virtual display screen associated with the non-operator and the target client based on the operator.

[0011] In an exemplary embodiment, the device is used to determine whether there are multiple virtual sessions on the target client in the following manner; if the multiple virtual sessions exist, determine the operator from the multiple sessions, and disconnect the connection between the virtual display screen associated with the non-operator and the target client based on the operator: determine whether there are multiple virtual sessions on the target client; if the multiple sessions exist on the target client, obtain the current screen frame of the target client; determine the operator based on the current screen frame; disconnect the connection between the virtual display screen associated with the non-operator and the target client based on the operator.

[0012] In an exemplary embodiment, the device is used to send a screen unblocking instruction to the baseboard management controller in response to the target client exiting the preset type interface in the following manner, and restore the non-operator display screen through the baseboard management controller: in response to the target client exiting the preset type interface, generate the screen unblocking instruction; in response to the baseboard management controller receiving the screen unblocking instruction, restore the connection between each of the physical display screen and each of the virtual display screen through the baseboard management controller.

[0013] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned desktop display control method when running.

[0014] According to another aspect of the embodiment of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes a computer instruction, and the computer instruction is stored in a computer-readable storage medium. A processor of a computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the control method of the desktop display as described above.

[0015] According to another aspect of the embodiments of the present application, there is also provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above-mentioned desktop display control method through the computer program.

[0016] In the embodiment of the present application, the operator of the sensitive information interface is identified, and when the target client enters a preset type interface containing sensitive information, the display screen of non-operators (i.e., operators other than the operator) is automatically shielded according to the operator type and the connection status of the physical VGA interface. When the target client exits the preset type interface, the system automatically sends an instruction to unblock the screen to the BMC to restore the display screen of the non-operator, thereby achieving the technical effect of protecting sensitive information from being peeped by unauthorized users, enhancing the security and flexibility of the system, and further solving the technical problem of easy leakage of sensitive information and low security in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a schematic diagram of an application environment of an optional desktop display control method according to an embodiment of the present application;

[0019] Figure 2 is a flowchart of an optional method for controlling desktop display according to an embodiment of the present application;

[0020] Figure 3 is an interactive block diagram of an optional desktop display control method according to an embodiment of the present application;

[0021] Figure 4 is an event flow chart of an optional desktop display control method according to an embodiment of the present application;

[0022] Figure 5 is a main flow chart of an optional desktop display control method according to an embodiment of the present application;

[0023] Figure 6 is a specific flow chart of an optional method for controlling desktop display according to an embodiment of the present application;

[0024] Figure 7 is a schematic structural diagram of an optional desktop display control device according to an embodiment of the present application;

[0025] Figure 8 is a structural schematic diagram of an optional desktop display control product according to an embodiment of the present application;

[0026] Fig. 9 It is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] In order to more clearly understand the technical solution provided by the embodiments of the present application, the key terms involved in the embodiments of the present application are first introduced here:

[0030] BMC is the core component in the server management system, responsible for monitoring and managing the hardware status of the server.

[0031] KVM is an open source hardware virtualization technology based on the Linux kernel.

[0032] VGA is an analog signal interface that transmits video signals. It usually has 15 pins, divided into 3 rows, with 5 holes in each row. It is the most widely used interface type on graphics cards.

[0033] The present application is described below in conjunction with embodiments:

[0034] According to one aspect of an embodiment of the present application, a method for controlling desktop display is provided. Optionally, in this embodiment, the above-mentioned method for controlling desktop display can be applied to: Figure 1 In the hardware environment composed of the server 101 and the terminal device 103 shown in FIG. Figure 1As shown, the server 101 is connected to the terminal 103 via a network, and can be used to provide services for the terminal device or an application 107 installed on the terminal device. The application can be a video application, an instant messaging application, a browser application, an educational application, a game application, etc. A database 105 may be set up on the server or independently of the server to provide data storage services for the server 101, for example, a game data storage server. The above-mentioned network may include, but is not limited to, a wired network and a wireless network, wherein the wired network includes, a local area network, a metropolitan area network and a wide area network; the wireless network includes, Bluetooth, WIFI and other networks that implement wireless communication; the terminal device 103 may be a terminal configured with an application, and may include, but is not limited to, at least one of the following: a mobile phone (such as an Android phone, an iOS phone, etc.), a laptop computer, a tablet computer, a PDA, a MID (Mobile Internet Devices), a PAD, a desktop computer, a smart TV, an intelligent voice interaction device, a smart home appliance, a vehicle-mounted terminal, an aircraft, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a mixed reality (MR) terminal and other computer devices; the above-mentioned server may be a single server, a server cluster consisting of multiple servers, or a cloud server.

[0035] Combination Figure 1 As shown, the above-mentioned desktop display control method can be executed by an electronic device, which can be a terminal device or a server. The above-mentioned desktop display control method can be implemented by the terminal device or the server separately, or by the terminal device and the server together.

[0036] The above is only an example and is not specifically limited in this embodiment.

[0037] Optionally, as an optional implementation, as Figure 2 As shown, the above desktop display control method includes:

[0038] When the target client is set to be managed by the baseboard management controller and the target client enters a preset type interface, operation information and connection information are obtained, wherein the target client is set to allow display through both a physical display screen and a virtual display screen, the operation information is used to indicate the operator type of the operator who performs the target operation, the target operation indicates the operation corresponding to entering the preset type interface, and the connection information is used to indicate whether the target client is displayed through the physical display screen;

[0039] Sending a screen shielding instruction to the baseboard management controller based on the operation information and the connection information, interrupting the display screen of the non-operator through the baseboard management controller, wherein the non-operator refers to other operators in the target client except the operator;

[0040] In response to the target client exiting the preset type interface, a screen shielding removal instruction is sent to the baseboard management controller, and the display screen for non-operators is restored through the baseboard management controller.

[0041] Optionally, in an embodiment of the present application, the above-mentioned target client refers to a server or communication storage device that needs to protect sensitive information. These devices are equipped with BMC and BIOS systems and can be remotely managed and operated through BMC. This includes but is not limited to network devices such as servers, switches, routers, etc., which play an important role in data processing and storage and may involve the processing of sensitive information. The above-mentioned preset type interface refers to a specific operating interface in the system that contains sensitive information, such as a financial transaction interface, a user data management interface, or a system configuration interface. The information contained in these interfaces is critical to security and privacy protection, so special protection measures are required to prevent unauthorized access or peeping.

[0042] It should be noted that the target client can be a variety of types of devices, which is not limited in this application. These devices include not only traditional tower servers and rack servers, but also portable computers, notebook computers, industrial computers, etc., all of which can be equipped with BMC to achieve remote management. The operating system of the target client can also be diverse, including but not limited to Windows, Linux, Unix, etc., all of which may involve the display and protection of sensitive information.

[0043] Optionally, in an embodiment of the present application, the above-mentioned operation information refers to information used to identify the identity and type of the operator currently performing the target operation in the embodiment of the present application. This includes but is not limited to the operator's login credentials, operation history, and the operator's interaction with the system. The acquisition of operation information can be achieved by monitoring the log files of the system, audit tracking, or real-time monitoring of user activities. Connection information refers to status information indicating whether the target client is displayed through a physical display screen. This includes but is not limited to the connection status of the VGA interface, the connection status of the USB interface, and the network connection status. The acquisition of connection information can be achieved through the interface detection mechanism inside the system or the hardware status monitoring function of the BMC.

[0044] Optionally, in an embodiment of the present application, the above-mentioned non-operator in the embodiment of the present application refers to other operators other than the operator currently performing the target operation, who may attempt to access the target client physically or virtually. Non-operators may include other authorized users, unauthorized users or system administrators, who may accidentally or intentionally attempt to access sensitive information. The screen shielding instruction refers to an instruction sent by the system to the BMC, which is used to interrupt the display screen of the non-operator to protect sensitive information from being leaked. This instruction can determine when the non-operator's screen needs to be shielded based on the operation information and connection information, ensuring that the shielding is only triggered when the operator enters the interface containing sensitive information.

[0045] It should be noted that there may be multiple ways to obtain operation information, which is not limited in this application. In addition to the log files and audit trails of the monitoring system, the identity and operation type of the operator can be further confirmed through behavioral analysis technology and biometric technology (such as fingerprint and iris recognition). In addition, the operation information may also include personal characteristic information such as the operator's operating habits and commonly used shortcut key combinations. The detection mechanism of connection information may also have multiple implementation methods, which is not limited in this application. In addition to detecting the connection status of the VGA interface and the USB interface, the connection status of other interfaces such as HDMI, DP, and wireless display technology (such as Wi-Fi Display, Miracast) can also be detected. The connection information may also include the type of network connection (wired or wireless), the stability and speed of the connection, etc.

[0046] Optionally, in the embodiment of the present application, the above-mentioned unblocking screen instruction refers to the instruction sent by the system to the BMC after the target client exits the preset type interface, which is used to restore the display screen of the non-operator. This instruction ensures that when the sensitive information is no longer displayed, other users can regain access to the target client, thereby maintaining the normal operation process.

[0047] It should be noted that the sending and execution of the shielding screen instruction may vary according to different scenarios and needs, and this application does not limit this. For example, in high-security level operations, the shielding instruction may require multiple verifications, including secondary identity authentication of the operator. In a multi-user environment, the shielding instruction may need to distinguish the permission levels of different users to ensure that only authorized users can unblock. In addition, the execution of the shielding instruction can also be combined with timestamp information to ensure that the shielding is blocked or unblocked within a specific time period. The sending of the unblocking screen instruction can also be adjusted according to different operating environments and security policies, and this application does not limit this. For example, in some cases, unblocking may require additional confirmation from the operator, or it may need to be executed after a certain time delay after the operator exits the sensitive interface. In addition, the unblocking instruction can also be combined with environmental monitoring information, such as whether the operator is still within the monitoring range of the camera to ensure the security of sensitive information.

[0048] For example, consider a server in a bank data center, which is configured to be managed by a baseboard management controller (BMC) and is used to process sensitive financial transaction information of customers.

[0049] S1: When the server in the bank data center detects that the user logs in and enters the preset type interface of financial transactions, the system starts to obtain operation information and connection information. The operation information includes the user's authentication data and operation history, which are used to determine the operator type of the current operator. The connection information includes the connection status of the physical VGA interface and the active status of the virtual KVM session, indicating whether the server outputs the screen through the physical display and the virtual display at the same time.

[0050] S2: Based on the acquired operation information and connection information, the system determines the target operation currently being performed by the current operator and confirms whether the server is connected to a physical display. If the operator type is a bank-authorized trader and the physical VGA interface is connected to a display, the system identifies the operator as a physical host operator.

[0051] S3: The system sends a screen shielding command to the BMC. The command contains the operator ID and type, instructing the BMC to interrupt the display screen of non-operators. After receiving the command, the BMC stops sending VGA screen frames to the KVM session of non-operators according to the operator type, and displays the privacy interface on the KVM client. Please wait patiently for the screen to be restored.

[0052] S4: If the server is still connected to other non-operator KVM sessions, the BMC will disconnect the screen output of the physical VGA interface, record the KVM session of the initiator of the keyboard and mouse events of the current screen frame, identify it as the current operator, and stop data transmission to the non-operator KVM session.

[0053] S5: When the target client exits the preset type interface, that is, the bank trader completes the transaction operation and exits the financial transaction interface, the system sends a command to unblock the screen to the BMC. After receiving the unblocking command, the BMC resumes the websocket transmission of all KVM sessions and the screen transmission of the physical VGA interface, so that other users can access the server display screen again.

[0054] The embodiment of the present application achieves the purpose of automatically protecting sensitive information from being peeped by unauthorized users when the target client enters a preset type interface containing sensitive information. This process not only improves the security of the data center in handling sensitive operations, but also reduces the risk of information leakage due to human negligence. In addition, the process supports the identification of multiple operator types and connection states, has good adaptability and scalability, and can adapt to different operating environments and security requirements. When a non-operator attempts to access sensitive information, the system can respond in time and interrupt its display screen, effectively preventing the leakage of sensitive information. When the operator exits the sensitive interface, the system can quickly restore the non-operator's display screen, ensuring the continuity of the business process and user experience.

[0055] Through the embodiments of the present application, the operator of the sensitive information interface is identified, and when the target client enters a preset type interface containing sensitive information, the display screen of non-operators (i.e., operators other than the operator) is automatically shielded according to the operator type and the connection status of the physical VGA interface. When the target client exits the preset type interface, the system automatically sends an instruction to unblock the screen to the BMC to restore the display screen of the non-operator, thereby achieving the technical effect of protecting sensitive information from being peeped by unauthorized users, enhancing the security and flexibility of the system, and further solving the technical problem of easy leakage of sensitive information and low security in related technologies.

[0056] As an optional solution, a screen shielding instruction is sent to a baseboard management controller based on the operation information and the connection information, and the display screen of a non-operator is interrupted by the baseboard management controller, including:

[0057] Determine, based on the operation information, a device type of a control device that initiates a target operation, wherein the device type includes a physical control device and a virtual control device;

[0058] In the case where the device type indicates a physical control device, determining whether the target client is displayed through a physical display screen based on the connection information;

[0059] When the target client is displaying through the physical display screen, a screen shielding instruction is sent to the baseboard management controller, and the display screen of the non-operator is interrupted through the baseboard management controller.

[0060] Optionally, in an embodiment of the present application, the above-mentioned control device refers to an input device that initiates the target operation, including a physical control device and a virtual control device. A physical control device refers to a hardware input device directly connected to the target client, such as a physical keyboard, a mouse, a touch screen, etc., which communicate with the target client through a physical connection (such as a USB, PS / 2 interface). A virtual control device refers to an input device implemented by software simulation or network connection, such as a virtual keyboard, a mouse and keyboard in a remote desktop session, etc., which interact with the target client through a software interface or a network protocol to implement a remote control function.

[0061] Optionally, in an embodiment of the present application, when the device type represents a physical control device, it refers to an input device directly connected to the target client through a physical interface. For example, when a user uses a keyboard and mouse directly connected to a server to operate, these input devices are physical control devices. In this case, the system needs to determine whether the target client is displayed through a physical display screen, so that when the user enters an interface containing sensitive information, timely measures can be taken to protect sensitive information from being accessed by unauthorized users. The physical display screen may include but is not limited to a display, projector or other display device connected to the server, which is connected to the server through interfaces such as VGA, HDMI, DVI, etc.

[0062] It should be noted that the acquisition of operation information can rely on a variety of technologies and methods, which are not limited in this application. Operation information can be determined by monitoring the user's login credentials, operation logs, real-time monitoring of the user's behavior, or analyzing the user's operation mode. This information can be collected from the operating system's security log, the application's event log, or a dedicated security information and event management (SIEM) system. In addition, the operation information can also include the user's biometric data, such as fingerprint or facial recognition data, which can provide more accurate operator identity authentication.

[0063] In the case where the device type represents a physical control device, the determination of the connection information can be achieved in a variety of ways, which are not limited in this application. The connection information can be determined by checking the status of the physical interface, monitoring the connection quality of the cable, or identifying the model and resolution of the connected display device. For example, the system can obtain information about the connected physical display by querying the hardware abstraction layer (HAL) of the operating system, or by directly exchanging EDID (Extended Display Identification Data) data with the display to verify the existence of the physical connection.

[0064] In the case where the target client is displayed through a physical display screen, there are multiple implementation methods for sending a shielding screen instruction to the baseboard management controller, which is not limited in this application. The shielding screen instruction can be sent through the IPMI (Intelligent Platform Management Interface) protocol, or it can be implemented through the BMC's dedicated API or system call. The content of the shielding instruction may include the operator's identity authentication information, the specific screen area to be shielded, or the duration of the shielding operation. In addition, the shielding instruction may also include an alternative screen for non-operator display content, such as a static image, a black screen, or a customized information prompt, to ensure that while protecting sensitive information, appropriate feedback is provided to non-operators.

[0065] In the case where the target client is displayed through a physical display screen, the system needs to send a shield screen command to the baseboard management controller. The purpose of this command is to interrupt the display screen of non-operators to ensure that sensitive information is not viewed by unauthorized users. Non-operators may refer to other users who do not directly perform operations on the physical control device. They may connect to the target client through a virtual control device such as a remote desktop. After receiving the shield screen command, the baseboard management controller will interrupt the display screen of these non-operators until the user exits the interface containing sensitive information. This process ensures that only authorized operators can view the relevant display content when processing sensitive information, thereby improving the security of the system.

[0066] As an optional solution, when the target client is displaying through a physical display screen, a screen shielding instruction is sent to a baseboard management controller, and the display screen of a non-operator is interrupted through the baseboard management controller, including:

[0067] In the case where the target client is displayed through a physical display screen, determining the operator type as a host operator based on the operation information, and generating a first shielding screen instruction, wherein the first shielding screen instruction is used to shield the virtual display screen associated with the target client;

[0068] A first shielding screen instruction is sent to the baseboard management controller, and in response to the baseboard management controller receiving the first shielding screen instruction, a connection between the virtual display screen and the target client is disconnected.

[0069] Optionally, in an embodiment of the present application, the above operator type may include but is not limited to the user's identity category, permission level, and interaction method with the target client. Including but not limited to, the operator may be an authenticated system administrator, an ordinary user, or an auditor with specific permissions. For example, in an enterprise environment, a system administrator may have the highest authority and be able to perform system configuration and maintenance operations; an ordinary user may only be able to perform daily business operations; an auditor may be authorized to access specific audit information, but is not allowed to modify system settings. The determination of the operator type can be achieved by analyzing the user's login credentials, access control lists (ACLs), and role-based access control (RBAC) policies.

[0070] Optionally, in an embodiment of the present application, the first shielding screen instruction may include, but is not limited to, one or more commands for controlling display output, which can instruct a baseboard management controller (BMC) to take specific actions to protect sensitive information. Including but not limited to, these instructions can be specific API calls, system commands, or control messages sent via IPMI. For example, the first shielding screen instruction may include a command code that instructs the BMC to suspend sending video data to all virtual console sessions of non-host operators, or to change the video output settings to blur or completely turn off the screen display of unauthorized users. In addition, the first shielding screen instruction may also include timestamp information to ensure that the shielding operation is only performed within a specific time window, or include a specific user session identifier to accurately control which sessions need to be shielded.

[0071] Optionally, in an embodiment of the present application, the virtual display screen may include but is not limited to a remote desktop provided by KVM technology, a console access interface of a virtual machine, or a desktop sharing screen transmitted over a network. Including but not limited to, the virtual display screen may be the desktop view seen by remote IT support personnel when they connect to the server for maintenance via VPN, or the user interface in Desktop as a Service (DaaS) provided by a cloud service. The disconnection of the virtual display screen can be achieved through a variety of technologies. For example, the BMC can send a signal to the virtualization layer, requesting it to pause or terminate the sending of video streams to a specific session, or directly interrupt the transmission of related data packets at the network level, thereby shielding the virtual display screen.

[0072] It should be noted that the determination of operation information is not limited to the user's identity verification data, and this application does not limit this. The determination of operation information may involve the user's biometric information, such as fingerprint, facial recognition or iris scan data, which provides biometric proof of the operator's identity. In addition, operation information may also include the user's behavior pattern, such as keyboard input speed, mouse movement habits, etc. These behavioral characteristics can be used to assist in identifying the operator. The user's geographic location information can also be combined to determine the operator's location through IP address positioning or GPS data to further confirm the operator type.

[0073] When generating the first shielding screen instruction, the content and format of the instruction can be diversified, and this application does not limit this. The first shielding screen instruction can be an encrypted data packet to ensure security and integrity during transmission. The instruction can include the operator's authentication information to ensure that only authorized operators can trigger the shielding operation. It can also include a specific timestamp to record the exact time of the shielding operation and the possible shielding duration to control the automatic release of the shielding state. In addition, the instruction can also include a specific user session ID so that operations can be performed precisely on a specific virtual display session.

[0074] After sending the first shielding screen instruction to the baseboard management controller, the response operation of the BMC can also be implemented in a variety of ways, which is not limited in this application. The BMC can immediately execute the disconnection operation, or it can delay the execution after verifying the validity of the instruction. The BMC can also record a detailed log of each shielding operation for post-audit and monitoring. When disconnecting the connection between the virtual display screen and the target client, the BMC can adopt different technical means, such as closing the remote access port of the virtual desktop, or blocking related data flows at the network level. In addition, the BMC can also send a notification to the manager or user of the virtual display screen to inform the occurrence of the shielding operation, as well as the possible shielding reasons and the expected recovery time.

[0075] For example, a server is used to process sensitive financial data of customers, and the server is configured with a baseboard management controller (BMC) to enable remote monitoring and management.

[0076] S1: When the bank's IT administrator logs into the server through a physical console (such as a directly connected keyboard and mouse) and enters the interface containing sensitive financial data, the system begins to analyze the operation information to determine the operator type. The operation information includes the administrator's login credentials, the physical device information used, and the login timestamp. The system determines that the operator is a host operator based on this information because the operator is operating through a directly connected physical device.

[0077] S2: Once the operator is confirmed to be a host operator, the system generates a first screen shielding instruction. The instruction includes the operator's session identifier, the target client identifier, and specific requirements for shielding the virtual display screen. For example, the instruction may instruct the BMC to shield all virtual display sessions in subsequent operations to protect sensitive financial data from being accessed by remote users.

[0078] S3: The system sends a first screen shielding instruction to the BMC. The instruction is sent through IPMI or other management interfaces to ensure the security and timely delivery of the instruction.

[0079] S4: After receiving the first screen shielding instruction, the BMC executes an operation of disconnecting the virtual display screen from the target client, which may involve terminating all active KVM sessions, closing the remote access port of the virtual desktop, or blocking related data flows at the network level.

[0080] S5: When disconnecting, the BMC may also record a log for subsequent auditing and monitoring. The log may include the time of disconnection, the operator's identification, and the reason for disconnection.

[0081] S6: In addition, the BMC may also send a notification to the system administrator to confirm that the blocking operation has been performed and provide details of the blocking operation. This can be achieved via email, SMS, or instant messaging in the management console.

[0082] S7: In some cases, if the server is configured with multiple virtual display outputs, the BMC also needs to identify and differentiate between these outputs to ensure that only the virtual display associated with the target client is blocked. This may involve analyzing network traffic, checking system logs, or using specialized virtualization management tools.

[0083] The embodiments of the present application achieve the protection of sensitive information in a physical operating environment. By shielding the virtual display screen, unauthorized remote users are prevented from accessing sensitive financial data. This method is not only applicable to a single physical management scenario, but can also be extended to complex environments with multiple users and multiple sessions, providing a flexible and effective sensitive information protection mechanism. In addition, the process can also adapt to different network environments and security policies, providing enterprises with a powerful security tool to protect their critical data from threats. Through timely response and precise control, the process ensures that only authorized operators can access the system when processing sensitive information, thereby enhancing the security and reliability of the system.

[0084] As an optional solution, in the case where the device type indicates a physical control device, after determining whether the target client is displayed through a physical display screen based on the connection information, the method further includes:

[0085] In the case where the target client is not displayed through the physical display screen, determining the operator type as a virtual operator based on the operation information, and generating a second shielding screen instruction, wherein the second shielding screen instruction is used to shield the physical display screen associated with the target client;

[0086] Sending a second shielding screen instruction to the baseboard management controller, and disconnecting the connection between the physical display screen and the target client in response to the baseboard management controller receiving the second shielding screen instruction;

[0087] It is determined whether a target client has multiple virtual sessions. If multiple virtual sessions exist, an operator is determined from the multiple sessions, and a connection between a virtual display screen not associated with the operator and the target client is disconnected based on the operator.

[0088] Optionally, in an embodiment of the present application, the above-mentioned virtual operators may include but are not limited to users who access the target client through remote desktop protocol, virtual network computing or cloud services, including but not limited to remote technical support personnel, remote office employees or system administrators. For example, a virtual operator may refer to an employee who connects to the company's internal network through a VPN to work remotely, or a developer who accesses server resources through a cloud service platform. Although these users do not operate directly in front of the physical device, they interact with the target client through a virtual control device to perform various operations.

[0089] Optionally, in an embodiment of the present application, the second shielding screen instruction may include but is not limited to a series of commands for controlling the physical display output, which can instruct the baseboard management controller (BMC) to take specific actions to restrict unauthorized users from accessing the physical display screen. Including but not limited to, the second shielding screen instruction can be a specific signal or data packet, which contains sufficient information to identify the target client and the physical display device to be shielded, as well as specific parameters of the shielding operation, such as the duration of the shielding or an instruction to automatically lift the shielding under specific conditions. Such instructions can be sent to the BMC via IPMI or other management interfaces to ensure that the physical display screen is not accessed by unauthorized users during sensitive operations.

[0090] Optionally, in an embodiment of the present application, multiple virtual sessions may include, but are not limited to, multiple concurrent remote desktop sessions, virtual machine console sessions, or multiple independent user sessions established over a network. Including but not limited to, in a data center environment, there may be multiple system administrators who simultaneously connect to the same server through a KVM system to perform maintenance operations, and each connection represents a virtual session. In this case, the system needs to be able to identify and distinguish these sessions to determine which session is controlled by the operator, thereby only disconnecting the connection between the virtual display screen that is not associated with the operator and the target client. This can be achieved by analyzing the creation time, activity status, user authentication information, or interaction data of the session.

[0091] It should be noted that there may be many situations in which the target client is not displayed through a physical display screen, and this application does not limit this. This situation may include scenarios in which the target client is operated only through a virtual control device, such as remote desktop connection, wireless screen projection technology, or cloud desktop service. For example, the operator may access server resources through a web-based interface, or use a remote management application on a mobile device to control the server. In these scenarios, the physical display is not directly connected to the target client, but a virtual display is achieved through a network connection.

[0092] When generating the second shielding screen instruction, the instruction may contain a variety of information to ensure precise control, which is not limited in this application. The second shielding screen instruction may include the operator's authentication information, the identifier of the target client, the interface information of the physical display, and the specific requirements for shielding. For example, the instruction may contain a specific operator ID to verify the identity of the operator; or contain the IP address of the target client to determine the device that needs to be shielded. In addition, the instruction may also contain a timestamp to record the execution time of the shielding operation, as well as the possible shielding duration, for automatically lifting the shielding after a specific time.

[0093] After sending the second shielding screen instruction to the baseboard management controller, the BMC's response may involve a variety of technical operations, which are not limited in this application. The BMC may disconnect the physical display screen from the target client by changing the hardware settings, for example, by adjusting the output settings of the VGA or HDMI interface, or disabling the physical display output through software commands. The BMC may also record detailed logs of the shielding operation for auditing and monitoring purposes. In addition, the BMC can also send a notification to the system administrator before performing the shielding operation to confirm the legality of the operation.

[0094] When determining whether there are multiple virtual sessions on the target client, there may be multiple methods to identify and distinguish these sessions, which are not limited in this application. These methods may include analyzing network traffic, checking system logs, or using specialized session management tools. For example, the system can monitor network connections entering the server to identify active remote desktop sessions. Alternatively, the system can check the operating system's session logs to determine which users are currently accessing the server. In addition, the system can also use specialized session management software that provides a real-time view of user activity and allows system administrators to control access rights for each session. In the presence of multiple virtual sessions, the system can determine the operator from them and disconnect the virtual display screen associated with the non-operator from the target client based on the operator, which may involve analyzing the activity status of the session, the user's permission level, or the creation time of the session.

[0095] For example, consider a server management scenario in an enterprise data center, where a server is configured with a baseboard management controller (BMC) to implement remote management functions.

[0096] S1: When the server detects a remote user connected to the system through a virtual private network (VPN) and logs in, the system begins to analyze the operation information to determine the operator type. In this scenario, the operation information includes the user's login credentials, IP address, and login timestamp. The system determines that the operator is a virtual operator based on this information because the operator is connected through a VPN rather than directly in front of the physical control device.

[0097] S2: Once the operator is confirmed to be a virtual operator, the system generates a second screen shielding instruction. The instruction includes the operator's session identifier, the target client identifier, and specific requirements for shielding the physical display screen. For example, the instruction may instruct the BMC to shield all physical display connections that have not passed verification in the next operation.

[0098] S3: The system sends a second shielding screen instruction to the BMC. The instruction is sent through IPMI or other management interfaces to ensure the security and timely delivery of the instruction.

[0099] S4: After receiving the second screen shielding instruction, the BMC executes an operation of disconnecting the physical display screen from the target client, which may involve disabling the VGA output or switching the input signal source of the physical display to a blank signal to ensure that the physical display screen cannot display sensitive information.

[0100] S5: Next, the system needs to determine whether there are multiple virtual sessions. This can be done by checking the currently active network connections and system logs. For example, the system may find that in addition to the current operator, there are two other users accessing the server through different VPN connections.

[0101] S6: In the case of multiple virtual sessions, the system determines the operator from the multiple sessions. This can be achieved by analyzing the activity data, user permissions, and operation history of the sessions. The system may identify that one session belongs to the system administrator and another belongs to a normal user.

[0102] S7: Based on the identity of the operator, the system disconnects the virtual display screen that is not associated with the operator from the target client. For example, if the system administrator is the operator, the session of the ordinary user will be disconnected. This can be achieved by closing the corresponding network connection or terminating the remote desktop session.

[0103] Through the embodiments of the present application, the protection of sensitive information in a remote operation environment is achieved. By shielding the physical display screen, unauthorized physical visitors are prevented from viewing sensitive information. At the same time, by managing multiple virtual sessions, it is ensured that only authorized operators can continue to access the system, thereby enhancing the security of the system. This method is not only applicable to a single remote management scenario, but can also be extended to complex environments with multiple users and multiple sessions, providing a flexible and effective sensitive information protection mechanism. In addition, the process can also adapt to different network environments and security policies, providing enterprises with a powerful security tool to protect their critical data from threats.

[0104] As an optional solution, a screen shielding instruction is sent to a baseboard management controller based on the operation information and the connection information, and the display screen of a non-operator is interrupted by the baseboard management controller, including:

[0105] Determine, based on the operation information, a device type of a control device that initiates a target operation, wherein the device type includes a physical control device and a virtual control device;

[0106] In the case where the device type indicates a virtual control device, determining the operator type as a virtual operator based on the operation information, and generating a third shielding screen instruction, wherein the third shielding screen instruction is used to shield a physical display screen associated with the target client;

[0107] Sending a third shielding screen instruction to the baseboard management controller, and disconnecting the connection between the physical display screen and the target client in response to the baseboard management controller receiving the third shielding screen instruction;

[0108] It is determined whether a target client has multiple virtual sessions. If multiple virtual sessions exist, an operator is determined from the multiple sessions, and a connection between a virtual display screen not associated with the operator and the target client is disconnected based on the operator.

[0109] Optionally, in an embodiment of the present application, the above-mentioned control device may include but is not limited to various types of input devices for performing target operations, including physical control devices and virtual control devices. Physical control devices refer to hardware devices directly connected to the target client, such as keyboards, mice, touch screens, etc., which communicate with the target client through physical interfaces (such as USB, PS / 2, HDMI). Virtual control devices refer to input devices implemented by software simulation or network connection, such as virtual keyboards and mice in remote desktop sessions, cloud-based virtual machine consoles, or input devices connected by wireless technology (such as Bluetooth, Wi-Fi). For example, a virtual control device can be remote control software connected to the target client via a network, or a control interface of a virtual machine provided by virtualization technology.

[0110] Optionally, in an embodiment of the present application, a virtual operator may include, but is not limited to, a user who remotely accesses a target client through a virtual control device. These users may be located in different geographical locations and connected to the target client through the Internet or a private network. Virtual operators may include remote employees, outsourcing service providers, or partners who access enterprise resources through cloud services. For example, a virtual operator may be a software developer working from home who accesses the company's internal server through the network to develop code; or a technical support staff of a third-party service provider who remotely assists in solving server problems.

[0111] Optionally, in an embodiment of the present application, the third screen shielding instruction may include but is not limited to a series of instructions for controlling the display output of the target client, which are specifically designed to shield the physical display screen associated with the virtual operator. The third screen shielding instruction may include the operator's authentication information, the identification of the target client, the information of the physical display device to be shielded, and the specific parameters of the shielding operation. For example, the third screen shielding instruction can be a data packet containing a specific operator session ID and the target client MAC address, which is used to instruct the BMC to only shield the physical display output associated with the session.

[0112] Optionally, in an embodiment of the present application, multiple virtual sessions may include but are not limited to multiple remote access sessions established with the target client at the same time. These sessions may be initiated by different users, and each session has an independent user identity and access rights. The existence of multiple virtual sessions means that the operator of each session needs to be accurately identified and distinguished in order to correctly implement the shielding operation. For example, multiple virtual sessions may be three different system administrators connecting to the same server through remote desktop at the same time to perform maintenance work, and each administrator's session needs to be identified and managed separately. In this case, the system needs to be able to track the activities of each session, determine which session is controlled by the operator, and disconnect the virtual display screen associated with the non-operator from the target client accordingly.

[0113] It should be noted that the device type of the control device is diverse, and this application does not limit this. The device type can be determined based on the operation information, including but not limited to physical control devices and virtual control devices. The physical control device can be an input device directly connected to the target client, such as a USB keyboard, a PS / 2 mouse, a serial port console, etc., which communicate with the target client through a physical line. The virtual control device may include a remote input device connected via a network protocol, such as an IP-based KVM system, a wireless keyboard and mouse pairing, or a remote desktop session connected via a VPN. These device types can be distinguished by their interface type, connection protocol, or user authentication method, and each device type has its unique identification and verification mechanism.

[0114] In the case where the device type represents a virtual control device, the analysis of the operation information can be multi-dimensional, and this application does not limit this. The operation information can determine that the operator type is a virtual operator based on the user's login credentials, the source IP address of the network connection, the port number used, or the session identifier. For example, if the operator's authentication information comes from a VPN connection, or the operator's IP address does not match the IP address range of the internal network, the system can infer that the operator is operating through a virtual control device. In addition, the operation information can also include the type of application used by the operator, the operator's operating habits or behavior patterns, which can be used to further confirm the identity and type of the operator.

[0115] After sending the third shielding screen instruction to the baseboard management controller, the BMC's response can be implemented in a variety of ways, which are not limited in this application. The BMC can perform the disconnection operation immediately, or it can delay the execution after verifying the validity of the instruction. For example, the BMC may need to confirm whether the sender of the instruction has the right to send the shielding instruction, or whether the instruction complies with the preset security policy. The BMC can also record a detailed log of the shielding operation for post-auditing and monitoring. When disconnecting the physical display screen from the target client, the BMC can take different technical measures, such as turning off the VGA output or switching the input signal source of the physical display to a blank signal to ensure that the physical display screen cannot display sensitive information.

[0116] When determining whether there are multiple virtual sessions on the target client, the system can use a variety of methods to identify and distinguish these sessions, which is not limited by this application. These methods may include analyzing network traffic, checking system logs, or using specialized session management tools. For example, the system can monitor network connections entering the server to identify active remote desktop sessions. Alternatively, the system can check the operating system's session logs to determine which users are currently accessing the server. In addition, the system can also use specialized session management software that provides a real-time view of user activity and allows system administrators to control access rights for each session. In the presence of multiple virtual sessions, the system can determine the operator from them and disconnect the virtual display screen associated with the non-operator from the target client based on the operator, which may involve analyzing the activity status of the session, the user's permission level, or the creation time of the session.

[0117] As an optional solution, determining whether a target client has multiple virtual sessions, and if multiple virtual sessions exist, determining an operator from the multiple sessions, and disconnecting a virtual display screen not associated with the operator from the target client based on the operator, includes:

[0118] Determine whether multiple virtual sessions exist on the target client;

[0119] When there are multiple sessions on the target client, obtain the current screen frame of the target client;

[0120] Determine the operator based on the current picture frame;

[0121] The connection between the virtual display screen not associated with the operator and the target client is disconnected based on the operator.

[0122] Optionally, in an embodiment of the present application, the above-mentioned multiple virtual sessions may include but are not limited to multiple remote desktop sessions, multiple virtual machine console sessions, or multiple independent user sessions established through the network. These sessions may be initiated by different users in different geographical locations, and each session has an independent user identity and access rights. For example, in a data center of a large enterprise, there may be multiple system administrators who simultaneously connect to the same server through the KVM system to perform maintenance operations, and each connection represents a virtual session; or in an environment of a cloud service provider, multiple customers may simultaneously rent virtual machines on the same physical server, and each customer has his own virtual session.

[0123] Optionally, in the case where there are multiple sessions on the target client, obtaining the current screen frame of the target client may include but is not limited to capturing the image data currently displayed on the screen, obtaining the log information of the operation being performed, or recording the real-time data of the user interaction. This may involve taking a screenshot of the graphical interface of the operating system, capturing the console output of the virtual machine, or analyzing the real-time data packets transmitted over the network. For example, on a server of a video conferencing platform, the current screen frame may be the video stream of all participants in the conference room; on an online game server, the current screen frame may be the real-time action and position information of all players in the game. Determining the operator based on the current screen frame may include but is not limited to analyzing the user interface elements in the screen frame, identifying the user's behavior pattern, or matching the preset operator characteristics. This may involve using image recognition technology to identify specific user interface elements, such as login names, operation buttons, or specific icons; or determining the operator by analyzing the user's behavior pattern, such as the speed and path of mouse movement, and the rhythm of keyboard input. For example, in a bank's trading system, the current screen frame may display the trader's trading operations, and the operator can be determined by identifying the trader's specific operating mode; in an online education platform, the current screen frame may contain the teacher's blackboard writing, and the operator can be determined by identifying the style and content of the blackboard writing. Disconnecting the connection between the virtual display screen associated with the non-operator and the target client based on the operator may include but is not limited to terminating the non-operator's remote desktop session, closing the non-operator's virtual machine console, or disconnecting the connection established by the non-operator through the network. This may involve sending a specific command to the target client to close the non-operator's session; or modifying the network routing rules to prevent the non-operator's data packets from reaching the target client. For example, in a multi-user collaboration platform, when the system determines that a user is performing sensitive operations, it can automatically disconnect other users' sessions to protect sensitive information from being leaked; in a cloud service platform, when the system administrator is performing system maintenance, the virtual machine console connection of other users can be automatically disconnected to prevent the maintenance operation from being interfered with.

[0124] It should be noted that when determining whether there are multiple virtual sessions on the target client, a variety of technologies and methods can be used, and this application does not limit this. This process may involve monitoring network connections, analyzing system logs, checking session management databases, or monitoring user activities in real time. For example, the system can identify different virtual sessions by analyzing network traffic, confirm the number of users logging in remotely by checking VPN connection records, or obtain a list of currently active sessions by querying the session management system. In addition, the system can also infer whether there are multiple virtual sessions by monitoring the user's operating behavior, such as login time, operation frequency, and resource access patterns.

[0125] In the case where there are multiple sessions on the target client, there are multiple ways to obtain the current screen frame of the target client, which is not limited in this application. This may include calling the screenshot function of the operating system, capturing desktop sharing data through a network protocol, or obtaining the display output of the virtual machine through a virtualization management interface. For example, the system can use the API provided by the operating system to capture the screen content of the current user, or use a special screen capture tool to obtain high-resolution screen frames. In a virtualized environment, the system can obtain the current screen frame of the virtual machine through the management interface provided by the virtualization platform, which may involve interaction with the virtualization hypervisor.

[0126] The process of determining the operator based on the current picture frame may involve a variety of image processing and pattern recognition technologies, which are not limited in this application. This may include using image recognition algorithms to analyze specific signs, user interface elements, or user behavior patterns in the picture frame. For example, the system can determine the operator by identifying the login user name, open application windows, or the user's ongoing operations in the picture frame. In more advanced applications, the system can also use machine learning models to analyze the user's behavior patterns, such as mouse movement trajectories, keyboard input habits, or the way users interact with interface elements, so as to more accurately determine the operator.

[0127] When the operator disconnects the connection between the virtual display screen associated with the non-operator and the target client, a variety of measures can be taken, which are not limited in this application. This may include sending a specific disconnect command to the virtualization management platform, modifying the network routing rules, or terminating the non-operator session at the session management level. For example, the system can send instructions to the virtualization platform to close the non-operator's virtual desktop session, or block the non-operator's data flow through the network management tool. At the session management level, the system can mark the non-operator's session, and after determining the operator, automatically terminate these sessions to ensure that only authorized operators can continue to access the target client. These measures can ensure that when handling sensitive information, only verified operators can access the virtual display screen of the target client.

[0128] For example, a server is used to process sensitive data and can be accessed remotely in a variety of ways.

[0129] S1: The system first needs to determine whether there are multiple virtual sessions for the target client. This can be achieved by checking VPN connection logs, analyzing network session information, or querying a session management database. For example, the system may find that there are three different VPN connection records, each corresponding to a different remote user, indicating that there are multiple virtual sessions.

[0130] S2: After confirming that the target client has multiple sessions, the system needs to obtain the current screen frame of the target client. This can be achieved in many ways. For example, the system can use the screen capture function of the server to obtain the current active screen image, or obtain the screenshot of the virtual machine through the API of the virtualization management software. For example, the system may capture a screen image containing multiple windows, one of which displays a financial report and another window displays a system management interface.

[0131] S3: Determine the operator based on the current screen frame. The system can determine the operator by analyzing specific elements in the screen image. For example, the system may recognize the user login information in the financial report window, or detect the administrator's operation traces in the system management interface. For example, the system may find that the editing record of a specific user is displayed in the financial report window, and thus determine that the user is the current operator.

[0132] S4: Once the operator is determined, the system will disconnect the virtual display screen associated with the non-operator from the target client based on the operator. This can be achieved through a variety of technologies. For example, the system can send instructions to the virtualization management software to terminate the remote desktop session of the non-operator. The system may send instructions to the VPN server to disconnect all remote user connections except the current operator.

[0133] The embodiments of the present application realize the protection of sensitive data in a multi-user environment. By determining the existence of multiple virtual sessions, the system is able to identify all users who may have access to sensitive information. Acquiring the current screen frame enables the system to intuitively understand the current status of the server and determine the operator based on this information. Finally, by disconnecting non-operators, the system ensures that only verified operators can continue to access sensitive data, thereby preventing unauthorized access and potential data leaks. This approach improves the security of the data center, ensures the privacy of sensitive operations, and can adapt to different network environments and security requirements, providing enterprises with a powerful security tool to protect their critical data.

[0134] As an optional solution, in response to the target client exiting the preset type interface, sending a screen unblocking instruction to the baseboard management controller, and restoring the non-operator display screen through the baseboard management controller, including:

[0135] In response to the target client exiting the preset type interface, generating a screen unblocking instruction;

[0136] In response to the baseboard management controller receiving the screen-unshielding instruction, the baseboard management controller restores the connection with each physical display screen and each virtual display screen.

[0137] Optionally, in an embodiment of the present application, the above-mentioned unshielding screen instruction may include but is not limited to a series of operation instructions, which are used to instruct the baseboard management controller (BMC) to cancel the previously implemented shielding measures and restore the normal connection between the target client and the display screen. The specific content of the unshielding screen instruction may include an instruction code, a target client identifier, an operator identity authentication information, and a specific identifier of the shielded session. For example, the unshielding screen instruction can be a specific data packet, which contains the IP address of the target client, the operator's authentication token, and an action code indicating the unshielding. Such an instruction can be sent to the BMC via IPMI or other management interfaces to ensure that the shielding state is correctly lifted. The unshielding screen instruction may also include a timestamp to record the exact time when the shielding is lifted, as well as possible audit trail information for post-audit and security analysis.

[0138] It should be noted that the above-mentioned response to the baseboard management controller receiving the instruction to unblock the screen, the baseboard management controller is used to restore the connection with each physical display screen and each virtual display screen. This process involves multiple technical operations, which are not limited in this application. The operation of restoring the connection may include reactivating the previously interrupted VGA or HDMI signal, reestablishing the KVM session, or resending the desktop sharing data over the network. For example, if the physical display was previously blocked, the BMC may send a signal to the display to instruct it to receive the video signal from the target client again. For the virtual display screen, the BMC may restart the previously suspended remote desktop service or reconnect to the console of the virtual machine. In addition, the BMC may also need to update the network routing table to ensure that the data packet can flow to the correct destination again. In a cloud environment or a virtualized environment, the BMC may also need to collaborate with the virtualization management platform to ensure that the display output of the virtual machine can be accessed by remote users again. These operations can ensure that after the sensitive operation is completed, the display screens of all legitimate users can be quickly and seamlessly restored, thereby maintaining business continuity and user work efficiency.

[0139] The following is a further explanation of this application with reference to specific examples:

[0140] This application is based on the automatic identification of the current operator control authority by the BMC end. When the host system or the BMC end identifies that the customer is entering the screen for operating sensitive information content (sensitive information identification is not within the technical scope of this patent, and this proposal does not specify the specific technical identification method), it can automatically block the VGA or KVM screen display of other users who are not operators. After exiting the sensitive information content screen, the VGA or KVM screen display of other users is restored. This application is applicable to server devices whose host systems share a BMC VGA graphics card, and the BMC can directly control the VGA output terminal.

[0141] Figure 3 is an interactive block diagram of an optional desktop display control method according to an embodiment of the present application, such as Figure 3 As shown, KVM1 and KVM2 are connected to the BMC, KVM1 and KVM2 represent different KVM sessions, the BMC is connected to the display through a VGA interface, and is connected to the host CPU through a USB interface, and the host CPU is connected to a physical keyboard and a physical mouse through a USB.

[0142] Figure 4 is an event flow chart of an optional desktop display control method according to an embodiment of the present application, such as Figure 4As shown, by capturing JS (JSON) events, the KVM client sends event data to the BMC through Websocket, and the BMC sends USB keyboard and mouse driver messages to the host to guide the interface changes of the virtual desktop. After the host generates an interface display instruction, it is displayed on the monitor through the VGA interface through the BMC and sent to the corresponding KVM session through the BMC.

[0143] Figure 5 is a main flow chart of an optional desktop display control method according to an embodiment of the present application, such as Figure 5 As shown, including:

[0144] S1, automatic identification of operators;

[0145] S2, enter the privacy interface and send a shielding command to the BMC;

[0146] S3, shielding non-operator screens;

[0147] S4, exit the privacy interface and send an exit shielding command to the BMC;

[0148] S5, the non-operator screen is restored.

[0149] Figure 6 is a specific flow chart of an optional desktop display control method according to an embodiment of the present application, such as Figure 6 As shown, including:

[0150] S1, the application determines whether to enter or exit the privacy interface. If it is to enter the privacy interface, it enters S2; if it is to exit the privacy interface, it enters S4.

[0151] S2, when entering the privacy interface, obtain the USB BUSID corresponding to the mouse and keyboard event before entering the privacy interface from the bottom layer of the operating system and whether the physical VGA interface is connected to the monitor. If the BUS ID is the USBBUS ID corresponding to the physical keyboard and mouse, and the physical VGA interface is detected to be connected to the monitor, the operator is determined to be the system host operator, otherwise it is determined to be the BMC KVM operator, and enter S3. Taking the Linux system as an example, the corresponding USB Bus source can be obtained from the / proc / bus / input / devices information (because the BMC KVM is a virtual keyboard and mouse, it is uniformly connected to the USB embedded in the BMC chip, and the BUS number is different from the physical mouse and keyboard).

[0152] S3, the application encapsulates and shields the VGA screen command and sends it to the BMC.

[0153] Command format: type: 1 (1: block non-operator VGA screen; 2: unblock VGA screen) + operator ID: 1 / 2 (1: host operator; 2: BMC KVM operator).

[0154] S4, the application encapsulates the command to unblock the VGA screen and sends it to the BMC. The command format is type: 2 (unblock the VGA screen).

[0155] S5, after receiving the screen shielding instruction, the BMC KVM module obtains type, if it is 1 (shielding non-operator VGA screen), it enters S6; if type is 2 (unshielding VGA screen), it enters S10.

[0156] S6, BMC obtains the operator type from the instruction. If the operator type is a host operator, the process proceeds to S7; if the operator is a BMC KVM operator, the process proceeds to S8.

[0157] S7: The BMC KVM module stops obtaining VGA data from the bottom layer and stops sending VGA frames to the KVM client. It also prompts "Entering the privacy interface, please wait patiently for the image to be restored."

[0158] In S8, the BMC first disconnects the image output to the physical VGA interface, and then determines whether there are multiple KVM sessions. If there are multiple KVM sessions, the process proceeds to S9.

[0159] S9, record the KVM session of the initiator of the keyboard and mouse events of the current screen frame, identify it as the current operator, and stop the data transmission to the non-operator KVM session, such as Figure 3 As shown, just stop the websocket transmission of the corresponding session.

[0160] S10, when the BMC receives a command type of 2 (unblocking screen command), it resumes all KVM session websocket transmissions and physical VGA interface screen transmissions.

[0161] This application does not require additional hardware costs or host OS version updates. It can be implemented by registering relevant interfaces on the host application side, and has strong scalability. By automatically identifying the current VGA screen frame keyboard input and mouse tapping USB device source, when the device source is a physical keyboard and mouse, and the physical VGA interface is detected to be connected to the display, the operator is judged to be the system host operator, and the others are judged to be BMC KVM operators. When the BMC receives the instruction to shield the VGA screen, the screen output of non-operators (including the physical display and KVM) is disconnected. When the BMC receives the instruction to exit the privacy interface, other user screens are automatically restored. In case of multiple KVM sessions, the initiating session of the mouse and keyboard events of the current frame is recorded. When the BMC receives the instruction to shield the VGA screen, the session is identified as the current operator.

[0162] It is understandable that in the specific implementation of this application, related data such as user information is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0163] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0164] According to another aspect of the embodiment of the present application, a desktop display control device for implementing the above desktop display control method is also provided. Figure 7 As shown, the device comprises:

[0165] The acquisition module 702 is used to acquire operation information and connection information when the target client is set to be managed by the baseboard management controller and the target client enters a preset type interface, wherein the target client is set to allow display through both a physical display screen and a virtual display screen, the operation information is used to indicate the operator type of the operator who performs the target operation, the target operation indicates the operation corresponding to entering the preset type interface, and the connection information is used to indicate whether the target client is displayed through the physical display screen;

[0166] The interruption module 704 is used to send a screen shielding instruction to the baseboard management controller based on the operation information and the connection information, and interrupt the display screen of the non-operator through the baseboard management controller, wherein the non-operator refers to other operators in the target client except the operator;

[0167] The recovery module 706 is used for sending a screen-unshielding instruction to the baseboard management controller in response to the target client exiting the preset type interface, so as to restore the display screen for non-operators through the baseboard management controller.

[0168] As an optional solution, the above-mentioned device is used to send a screen shielding instruction to the baseboard management controller based on the operation information and the connection information in the following manner, so as to interrupt the display screen of the non-operator through the baseboard management controller: determine the device type of the control device that initiates the target operation based on the operation information, wherein the device type includes a physical control device and a virtual control device; when the device type indicates a physical control device, determine whether the target client is displayed through the physical display screen based on the connection information; when the target client is displayed through the physical display screen, send a screen shielding instruction to the baseboard management controller, so as to interrupt the display screen of the non-operator through the baseboard management controller.

[0169] As an optional solution, the above-mentioned device is used to send a screen shielding instruction to the baseboard management controller when the target client is displayed through a physical display screen, so as to interrupt the display screen of the non-operator through the baseboard management controller in the following manner: when the target client is displayed through a physical display screen, determine the operator type as a host operator based on operation information, and generate a first screen shielding instruction, wherein the first screen shielding instruction is used to shield the virtual display screen associated with the target client; send the first screen shielding instruction to the baseboard management controller, and in response to the baseboard management controller receiving the first screen shielding instruction, disconnect the connection between the virtual display screen and the target client.

[0170] As an optional scheme, the above-mentioned device is also used for: when the device type represents a physical control device, after determining whether the target client is displayed through the physical display screen based on the connection information, if the target client is not displayed through the physical display screen, determining the operator type as a virtual operator based on the operation information, and generating a second shielding screen instruction, wherein the second shielding screen instruction is used to shield the physical display screen associated with the target client; sending the second shielding screen instruction to the baseboard management controller, and disconnecting the connection between the physical display screen and the target client in response to the baseboard management controller receiving the second shielding screen instruction; determining whether there are multiple virtual sessions for the target client, and if there are multiple virtual sessions, determining the operator from the multiple sessions, and disconnecting the connection between the virtual display screen not associated with the operator and the target client based on the operator.

[0171] As an optional solution, the above-mentioned device is used to send a shielding screen instruction to a baseboard management controller based on operation information and connection information in the following manner, and interrupt the display screen of the non-operator through the baseboard management controller: determine the device type of the control device that initiates the target operation based on the operation information, wherein the device type includes a physical control device and a virtual control device; when the device type represents a virtual control device, determine the operator type as a virtual operator based on the operation information, and generate a third shielding screen instruction, wherein the third shielding screen instruction is used to shield the physical display screen associated with the target client; send the third shielding screen instruction to the baseboard management controller, and in response to the baseboard management controller receiving the third shielding screen instruction, disconnect the connection between the physical display screen and the target client; determine whether there are multiple virtual sessions for the target client, and if there are multiple virtual sessions, determine the operator from the multiple sessions, and disconnect the connection between the virtual display screen associated with the non-operator and the target client based on the operator.

[0172] As an optional solution, the above-mentioned device is used to determine whether there are multiple virtual sessions on the target client in the following manner. If there are multiple virtual sessions, determine the operator from the multiple sessions, and disconnect the connection between the virtual display screen not associated with the operator and the target client based on the operator: determine whether there are multiple virtual sessions on the target client; if there are multiple sessions on the target client, obtain the current screen frame of the target client; determine the operator based on the current screen frame; disconnect the connection between the virtual display screen not associated with the operator and the target client based on the operator.

[0173] As an optional solution, the above-mentioned device is used to send a screen unblocking instruction to the baseboard management controller in response to the target client exiting the preset type interface in the following manner, and restore the non-operator display screen through the baseboard management controller: in response to the target client exiting the preset type interface, generate a screen unblocking instruction; in response to the baseboard management controller receiving the screen unblocking instruction, restore the connection between each physical display screen and each virtual display screen through the baseboard management controller.

[0174] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0175] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0176] According to one aspect of the present application, a computer program product is provided. The computer program product includes a computer program.

[0177] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0178] Figure 8 The structure block diagram of a computer system for implementing an electronic device according to an embodiment of the present application is schematically shown.

[0179] It should be noted that Figure 8 The computer system 800 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0180] like Figure 8 As shown, the computer system 800 includes a central processing unit 801 (CPU), which can perform various appropriate actions and processes according to the program stored in the read-only memory 802 (ROM) or the program loaded from the storage part 808 to the random access memory 803 (RAM). Various programs and data required for system operation are also stored in the random access memory 803. The central processing unit 801, the read-only memory 802 and the random access memory 803 are connected to each other through a bus 804. The input / output interface 805 (Input / Output interface, i.e., I / O interface) is also connected to the bus 804.

[0181] The following components are connected to the input / output interface 805: an input section 806 including a keyboard, a mouse, etc.; an output section 807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a local area network card, a modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the input / output interface 805 as needed. A removable medium 811, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 810 as needed so that a computer program read therefrom is installed into the storage section 808 as needed.

[0182] In particular, according to an embodiment of the present application, the process described in each method flow chart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer readable medium, and the computer program contains a program code for executing the method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 809, and / or installed from the removable medium 811. When the computer program is executed by the central processor 801, various functions defined in the system of the present application are executed.

[0183] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 809, and / or installed from the removable medium 811. When the computer program is executed by the central processor 801, various functions provided by the embodiment of the present application are performed.

[0184] According to another aspect of the embodiment of the present application, an electronic device for implementing the above-mentioned desktop display control method is also provided. The electronic device may be Figure 1 The terminal device or server shown in the figure. This embodiment is described by taking the electronic device as a terminal device as an example. Fig. 9 As shown, the electronic device includes a memory 902 and a processor 904. The memory 902 stores a computer program, and the processor 904 is configured to execute the steps in any of the above method embodiments through the computer program.

[0185] Optionally, in this embodiment, the electronic device may be located in at least one network device among a plurality of network devices of a computer network.

[0186] Optionally, in this embodiment, the above-mentioned processor can be configured to execute the methods in each embodiment of the present application through a computer program.

[0187] Alternatively, a person skilled in the art may understand that: Fig. 9 The structure shown is for illustration only. Fig. 9 The structure of the electronic device is not limited. Fig. 9 More or fewer components (such as network interfaces, etc.) as shown in, or with Fig. 9 Different configurations shown.

[0188] Among them, the memory 902 can be used to store software programs and modules, such as the program instructions / modules corresponding to the desktop display control method and device in the embodiment of the present application. The processor 904 executes various functional applications and data processing by running the software programs and modules stored in the memory 902, that is, realizing the above-mentioned desktop display control method. The memory 902 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 902 may further include a memory remotely located relative to the processor 904, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. Among them, the memory 902 can be specifically, but not limited to, used to store information such as video data. As an example, such as Fig. 9 As shown, the memory 902 may include but is not limited to the acquisition module 702, interruption module 704 and recovery module 706 in the control device for desktop display. In addition, it may also include but is not limited to other module units in the control device for desktop display, which will not be repeated in this example.

[0189] Optionally, the transmission device 906 is used to receive or send data via a network. Specific examples of the above-mentioned network may include a wired network and a wireless network. In one example, the transmission device 906 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices and routers via a network cable so as to communicate with the Internet or a local area network. In one example, the transmission device 906 is a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0190] In addition, the electronic device further includes: a display 908 for displaying the video data; and a connection bus 910 for connecting various module components in the electronic device.

[0191] In other embodiments, the terminal device or server may be a node in a distributed system, wherein the distributed system may be a blockchain system, and the blockchain system may be a distributed system formed by connecting the multiple nodes through network communication. The nodes may form a peer-to-peer network, and any form of computing device, such as a server, terminal or other electronic device, may become a node in the blockchain system by joining the peer-to-peer network.

[0192] According to one aspect of the present application, a computer-readable storage medium is provided, and a processor of an electronic device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the electronic device executes the desktop display control method provided in various optional implementations of the above-mentioned desktop display control aspects.

[0193] Optionally, in this embodiment, the above-mentioned computer-readable storage medium can be configured to store data for executing the methods in various embodiments of the present application.

[0194] Optionally, in this embodiment, a person of ordinary skill in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing hardware related to the terminal device through a program, and the program may be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0195] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0196] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for one or more electronic devices to execute all or part of the steps of the methods described in each embodiment of the present application.

[0197] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0198] In the several embodiments provided in the present application, it should be understood that the disclosed application can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0199] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0200] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0201] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for controlling desktop display, characterized in that: include: When the target client is configured to be managed by a baseboard management controller and the target client enters a preset type interface, obtaining operation information and connection information, wherein the target client is configured to allow display through a physical display screen and a virtual display screen, the operation information is used to indicate the operator type of the operator who performs the target operation, the target operation indicates the operation corresponding to entering the preset type interface, and the connection information is used to indicate whether the target client is displayed through the physical display screen; Sending a screen shielding instruction to the baseboard management controller based on the operation information and the connection information, interrupting the display screen of a non-operator through the baseboard management controller, wherein the non-operator refers to other operators in the target client except the operator; In response to the target client exiting the preset type interface, a screen unblocking instruction is sent to the baseboard management controller, and the baseboard management controller restores the display screen of the non-operator.

2. The method according to claim 1, characterized in that The step of sending a screen shielding instruction to the baseboard management controller based on the operation information and the connection information, and interrupting the display screen of the non-operator through the baseboard management controller, comprises: Determine, based on the operation information, a device type of a control device that initiates the target operation, wherein the device type includes a physical control device and a virtual control device; In a case where the device type indicates the physical control device, determining whether the target client is displayed through the physical display screen based on the connection information; In the case where the target client is displaying through the physical display screen, the screen shielding instruction is sent to the baseboard management controller, and the display screen of the non-operator is interrupted through the baseboard management controller.

3. The method according to claim 2, characterized in that When the target client displays the screen through the physical display screen, sending the screen shielding instruction to the baseboard management controller to interrupt the display screen of the non-operator through the baseboard management controller includes: In the case where the target client is displayed through the physical display screen, determining the operator type as a host operator based on the operation information, and generating a first shielding screen instruction, wherein the first shielding screen instruction is used to shield the virtual display screen associated with the target client; The first shielding screen instruction is sent to the baseboard management controller, and in response to the baseboard management controller receiving the first shielding screen instruction, the connection between the virtual display screen and the target client is disconnected.

4. The method according to claim 2, characterized in that: In the case where the device type indicates the physical control device, after determining whether the target client is displayed through the physical display screen based on the connection information, the method further includes: In the case where the target client is not displayed through the physical display screen, determining the operator type as a virtual operator based on the operation information, and generating a second shielding screen instruction, wherein the second shielding screen instruction is used to shield the physical display screen associated with the target client; sending the second shielding screen instruction to the baseboard management controller, and disconnecting the connection between the physical display screen and the target client in response to the baseboard management controller receiving the second shielding screen instruction; Determine whether the target client has multiple virtual sessions, and if the multiple virtual sessions exist, determine the operator from the multiple sessions, and disconnect the connection between the virtual display screen associated with the non-operator and the target client based on the operator.

5. The method according to claim 1, characterized in that The step of sending a screen shielding instruction to the baseboard management controller based on the operation information and the connection information, and interrupting the display screen of the non-operator through the baseboard management controller, comprises: Determine, based on the operation information, a device type of a control device that initiates the target operation, wherein the device type includes a physical control device and a virtual control device; In the case where the device type represents the virtual control device, determining the operator type as a virtual operator based on the operation information, and generating a third shielding screen instruction, wherein the third shielding screen instruction is used to shield the physical display screen associated with the target client; Sending the third shielding screen instruction to the baseboard management controller, and disconnecting the connection between the physical display screen and the target client in response to the baseboard management controller receiving the third shielding screen instruction; Determine whether the target client has multiple virtual sessions, and if the multiple virtual sessions exist, determine the operator from the multiple sessions, and disconnect the connection between the virtual display screen associated with the non-operator and the target client based on the operator.

6. The method according to claim 4 or 5, characterized in that: The determining whether there are multiple virtual sessions for the target client, determining the operator from the multiple sessions if the multiple virtual sessions exist, and disconnecting the connection between the virtual display screen not associated with the operator and the target client based on the operator, comprises: Determining whether there are multiple virtual sessions for the target client; In the case that the target client has the multiple sessions, acquiring a current picture frame of the target client; Determining the operator based on the current picture frame; The connection between the virtual display screen associated with the non-operator and the target client is disconnected based on the operator.

7. The method according to claim 1, characterized in that In response to the target client exiting the preset type interface, sending a screen unblocking instruction to the baseboard management controller, and restoring the non-operator display screen through the baseboard management controller, includes: In response to the target client exiting the preset type interface, generating the instruction to remove the shielding screen; In response to the baseboard management controller receiving the screen masking release instruction, the baseboard management controller restores the connection with each of the physical display screens and each of the virtual display screens.

8. A control device for desktop display, characterized in that: include: an acquisition module, configured to acquire operation information and connection information when a target client is configured to be managed by a baseboard management controller and the target client enters a preset type interface, wherein the target client is configured to allow display through both a physical display screen and a virtual display screen, the operation information is used to indicate an operator type of an operator who performs a target operation, the target operation indicates an operation corresponding to entering the preset type interface, and the connection information is used to indicate whether the target client is displayed through the physical display screen; An interruption module, configured to send a screen shielding instruction to the baseboard management controller based on the operation information and the connection information, and interrupt the display screen of a non-operator through the baseboard management controller, wherein the non-operator refers to other operators in the target client except the operator; The recovery module is used for sending a screen-unshielding instruction to the baseboard management controller in response to the target client exiting the preset type interface, so as to restore the display screen of the non-operator through the baseboard management controller.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein the program is executed by a processor to perform the method described in any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 7 are implemented.

11. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to execute the method according to any one of claims 1 to 7 through the computer program.

Images