Server management method, device and equipment and computer readable storage medium

Abstract

The invention discloses a server management method, a server management device, server management equipment and a computer readable storage medium, belongs to the field of servers, and considers that a digital certificate signed and issued through a root certificate can verify the reliability of an opposite party in a communication process, and the two-way certificate verification can ensure the security of the two parties. Therefore, the BMC can respond to the communication request of the client side and send the server side digital certificate of the BMC to the client side, so that the client side sends the client side digital certificate after verifying that the server side digital certificate is legal through the root certificate, validity verification can be carried out on the client side digital certificate sent by the client side through the root certificate, and the user experience is improved. According to the technical scheme, communication with the client can be carried out under the legal condition, the digital certificate issued by the root certificate can ensure the reliability of the communication party, so that the client and the BMC can ensure the reliability of the party communicating with the client and the BMC through verification of the digital certificate, and the communication safety between the client and the BMC is improved.

Description

Technical Field

[0001] The present invention relates to the field of servers, and in particular to a server management method, apparatus, device and computer-readable storage medium. Background Art

[0002] The client can manage the server by communicating with the server's Baseboard Management Controller (BMC). However, the related art lacks a mature server management method. As a result, during the communication process between the BMC and the client, both parties cannot ensure the reliability of each other, resulting in poor communication security.

[0003] Therefore, how to provide a solution to the above technical problems is a problem that those skilled in the art need to solve at present. Summary of the Invention

[0004] The purpose of the present invention is to provide a server management method, device, equipment and computer-readable storage medium. The BMC in the present invention can respond to the communication request of the client and send its own server digital certificate to the client, so that the client can send the client digital certificate after verifying the legitimacy of the server digital certificate through the root certificate. The legitimacy of the client digital certificate sent by the client can be verified by the root certificate. If it is legal, communication can be carried out with the client. The digital certificate issued by the root certificate can ensure the reliability of the communicating party. Therefore, both the client and the BMC can ensure the reliability of the party communicating with themselves through the verification of the digital certificate, thereby improving the communication security between the client and the BMC.

[0005] To solve the above technical problems, the present invention provides a server management method, which is applied to a baseboard management controller of a server, comprising:

[0006] In response to the client's communication request, the server sends its own server digital certificate to the client, so that the client can verify the legitimacy of the server digital certificate through the root certificate and then send the client digital certificate;

[0007] Get the client digital certificate sent by the client;

[0008] Verify the legitimacy of the client digital certificate through the root certificate;

[0009] If it is legal, it communicates with the client.

[0010] On the other hand, communicating with the client includes:

[0011] Obtain the ciphertext of the symmetric key sent by the client, wherein the ciphertext of the symmetric key sent by the client is encrypted using the server's public key, which is extracted by the client from the server's digital certificate using the root certificate;

[0012] Decrypt the ciphertext of the symmetric key using its own server private key to obtain the symmetric key;

[0013] Communicates with the client via symmetric keys.

[0014] On the other hand, the obtaining of the ciphertext of the symmetric key sent by the client includes:

[0015] Obtaining a symmetric encryption rule sent by the client, wherein the symmetric encryption rule is: a to-be-filled field including a plurality of information filling bits, and the symmetric encryption rule is encrypted using a public key of the server;

[0016] Decrypt the symmetric encryption rules using its own server private key;

[0017] Filling its own second filling information into the symmetric encryption rule;

[0018] Encrypting the symmetric encryption rule with the second padding information using the client public key;

[0019] Sending the symmetric encryption rule encrypted by the client public key to the client, so that the client obtains a symmetric key according to the second filling information and the first filling information of the client, and encrypting the symmetric key by the server public key;

[0020] Get the ciphertext of the symmetric key sent by the client;

[0021] After obtaining the client digital certificate sent by the client, the server management method further includes:

[0022] The client public key is extracted from the client digital certificate through a root certificate.

[0023] On the other hand, after obtaining the client digital certificate sent by the client and before communicating with the client, the server management method further includes:

[0024] Calculate the hash value of the client digital certificate signature using a preset hash algorithm;

[0025] Determine whether the hash value of the certificate signature in the client digital certificate is consistent with the hash calculation value;

[0026] The communicating with the client includes:

[0027] If the client digital certificate is valid and the hash value of the certificate signature is consistent with the hash calculation value, communication is performed with the client.

[0028] On the other hand, before sending its own server digital certificate to the client in response to the client's communication request, the server management method further includes:

[0029] Generate a certificate request file including a preset first access control policy and a server private key;

[0030] Sending the certificate request file and the server private key to the configuration terminal, so that the configuration terminal issues a server digital certificate including the first access control policy for the baseboard management controller through the root certificate based on the certificate request file and the server private key;

[0031] Receiving the server digital certificate;

[0032] The communicating with the client includes:

[0033] Before receiving information sent by the client, determining whether the client satisfies the first access control policy in its own server digital certificate;

[0034] If satisfied, the information sent by the client is received.

[0035] To solve the above technical problems, the present invention further provides a server management method, which is applied to a client and includes:

[0036] Send a communication request to the baseboard management controller so that the baseboard management controller sends its own server digital certificate to the client;

[0037] Verify the legitimacy of the server-side digital certificate through the root certificate;

[0038] If it is legitimate, the client digital certificate is sent to the baseboard management controller so that the baseboard management controller can communicate with the client after verifying the legitimacy of the client digital certificate through the root certificate.

[0039] On the other hand, before sending the communication request to the baseboard management controller, the server management method further includes:

[0040] Generate a certificate request file including a preset second access control policy and a client private key;

[0041] Sending the certificate request file and the client private key to the configuration terminal, so that the configuration terminal issues a client digital certificate including the second access control policy to the client through the root certificate based on the certificate request file and the client private key;

[0042] Receiving the client digital certificate;

[0043] After sending its own client digital certificate to the baseboard management controller, the server management method further includes:

[0044] Before receiving the information sent by the baseboard management controller, determining whether the baseboard management controller satisfies the second access control policy in its own client digital certificate;

[0045] If the conditions are met, the information sent by the baseboard management controller is received.

[0046] To solve the above technical problems, the present invention further provides a server management device, which is applied to a baseboard management controller of a server and includes:

[0047] The first sending module is used to send its own server digital certificate to the client in response to the communication request of the client, so that the client can send the client digital certificate after verifying the legitimacy of the server digital certificate through the root certificate;

[0048] A first acquisition module is used to acquire a client digital certificate sent by the client;

[0049] A first verification module is used to verify whether the client digital certificate is legal through a root certificate, and if so, trigger the first communication module;

[0050] The first communication module is used to communicate with the client.

[0051] To solve the above technical problems, the present invention further provides a server management device, comprising:

[0052] memory for storing computer programs;

[0053] A processor is used to implement the steps of the server management method described above when executing the computer program.

[0054] To solve the above technical problems, the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the server management method described above are implemented.

[0055] Beneficial effect: The present invention provides a server management method. Considering that the digital certificate issued by the root certificate can verify the reliability of the other party during the communication process, and the two-way certificate verification can ensure the security of both parties, the BMC in the present invention can respond to the communication request of the client and send its own server digital certificate to the client, so that the client can send the client digital certificate after verifying the legitimacy of the server digital certificate through the root certificate, and can verify the legitimacy of the client digital certificate sent by the client through the root certificate. If it is legal, communication can be carried out with the client. The digital certificate issued by the root certificate can ensure the reliability of the communicating party. Therefore, both the client and the BMC can ensure the reliability of the party communicating with themselves through the verification of the digital certificate, thereby improving the communication security between the client and the BMC.

[0056] The present invention also provides a server management device, equipment and computer-readable storage medium, which have the same beneficial effects as the above server management method. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the relevant technologies and the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0058] Figure 1 A schematic flow chart of the first server management method provided by the present invention;

[0059] Figure 2 A schematic diagram of a flow chart of a two-way certificate authentication process provided by the present invention;

[0060] Figure 3 A schematic diagram of a process for agreeing on a symmetric key provided by the present invention;

[0061] Figure 4 A schematic flow chart of a second server management method provided by the present invention;

[0062] Figure 5 A schematic structural diagram of a server management device provided by the present invention;

[0063] Figure 6 A schematic structural diagram of a server management device provided by the present invention;

[0064] Figure 7 A schematic structural diagram of a computer-readable storage medium provided by the present invention. DETAILED DESCRIPTION

[0065] The core of the present invention is to provide a server management method, device, equipment and computer-readable storage medium. The BMC in the present invention can respond to the communication request of the client and send its own server digital certificate to the client, so that the client can send the client digital certificate after verifying the legitimacy of the server digital certificate through the root certificate. The legitimacy of the client digital certificate sent by the client can be verified through the root certificate. If it is legal, communication can be carried out with the client. The digital certificate issued by the root certificate can ensure the reliability of the communicating party. Therefore, both the client and the BMC can ensure the reliability of the party communicating with themselves through the verification of the digital certificate, thereby improving the communication security between the client and the BMC.

[0066] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0067] Please refer to Figure 1 , Figure 1 This is a flow chart of a first server management method provided by the present invention, which is applied to a baseboard management controller of a server, including:

[0068] S101: In response to a communication request from a client, the server sends its own server digital certificate to the client, so that the client verifies the legitimacy of the server digital certificate through the root certificate and then sends the client digital certificate;

[0069] Specifically, considering the technical problems in the above background technology, and considering that (1) the digital certificate issued by the root certificate can verify the reliability of the other party during the communication process, and (2) the two-way certificate verification can ensure the security of both parties, the embodiment of the present invention intends to perform two-way digital certificate verification during the communication process between the client and the BMC, so that both the client and the BMC can ensure that the other party of the communication is reliable, thereby improving the communication security; since the communication request between the BMC and the client is usually initiated by the client, in this step, the BMC can first respond to the client's communication request and send its own server digital certificate to the client, so that the client can send the client digital certificate after verifying the legitimacy of the server digital certificate through the root certificate.

[0070] The client may be of various types, for example, a northbound Redfish management node, etc., which is not limited in the embodiment of the present invention.

[0071] S102: Obtain the client digital certificate sent by the client;

[0072] Specifically, when the BMC's server digital certificate is verified to be legitimate by the client, the BMC will also receive the client digital certificate sent by the client. Therefore, the client digital certificate sent by the client can be obtained in this step and used as the data basis for subsequent steps.

[0073] S103: Verify the legitimacy of the client digital certificate through the root certificate;

[0074] Specifically, the legitimacy of the client's digital certificate can be verified to determine whether the client is reliable. Digital certificates are usually issued by a unified root certificate. Therefore, this step can verify the legitimacy of the client's digital certificate through the root certificate, thereby triggering subsequent steps.

[0075] There are many ways to obtain the root certificate and the root certificate private key. For example, they can be generated using the OpenSSL (OpenSecure Sockets Layer) tool or obtained from a third-party CA (Certificate Authority).

[0076] S104: If legal, communicate with the client.

[0077] If the verification is legal, it indicates that the client is reliable, so communication with the client can be carried out.

[0078] To better illustrate the embodiments of the present invention, please refer to Figure 2 , Figure 2 This is a flow chart of a two-way certificate authentication process provided by the present invention. In the figure, the client first sends a communication request, then the BMC sends the server digital certificate. The client can verify the legitimacy and integrity of the server digital certificate, and then sends the client digital certificate, which is verified by the BMC.

[0079] The present invention provides a server management method. Considering that the digital certificate issued by the root certificate can verify the reliability of the other party during the communication process, and the two-way certificate verification can ensure the security of both parties, the BMC in the present invention can respond to the communication request of the client and send its own server digital certificate to the client, so that the client can send the client digital certificate after verifying the legitimacy of the server digital certificate through the root certificate, and can verify the legitimacy of the client digital certificate sent by the client through the root certificate. If it is legal, communication can be carried out with the client. The digital certificate issued by the root certificate can ensure the reliability of the communicating party. Therefore, both the client and the BMC can ensure the reliability of the party communicating with themselves through the verification of the digital certificate, thereby improving the communication security between the client and the BMC.

[0080] Based on the above embodiment:

[0081] As an optional embodiment, communicating with the client includes:

[0082] Obtain the ciphertext of the symmetric key sent by the client. The ciphertext of the symmetric key sent by the client is encrypted using the server's public key. The server's public key is extracted from the server's digital certificate by the client using the root certificate.

[0083] Decrypt the ciphertext of the symmetric key using its own server private key to obtain the symmetric key;

[0084] Communicates with the client via symmetric keys.

[0085] Specifically, even if two-way digital certificate verification is passed, the transmitted content may be maliciously intercepted during the subsequent communication process, posing a security risk. The method of "encrypting the transmitted content using a symmetric key" can ensure the security of the transmitted content and is relatively simple for both parties in communication. Therefore, in an embodiment of the present invention, the BMC can obtain the ciphertext of the symmetric key sent by the client (encrypted using the server public key to ensure that the symmetric key is not stolen during transmission), and then decrypt the ciphertext of the symmetric key using its own server private key to obtain the symmetric key, and finally communicate with the client based on the symmetric key.

[0086] Among them, the server public key in the embodiment of the present invention may refer to the public key in the server digital certificate, and the server private key decrypts the "content encrypted by the server public key"; the client public key may refer to the public key in the client digital certificate, and the client private key decrypts the "content encrypted by the client public key".

[0087] As an optional embodiment, obtaining the ciphertext of the symmetric key sent by the client includes:

[0088] Obtain the symmetric encryption rule sent by the client, where the symmetric encryption rule is: a to-be-filled field including multiple information filling bits, and the symmetric encryption rule is encrypted using the server's public key;

[0089] Decrypt the symmetric encryption rules using its own server private key;

[0090] Fill its own second filling information into the symmetric encryption rule;

[0091] Encrypting the symmetric encryption rule with the second padding information using the client public key;

[0092] Sending the symmetric encryption rule encrypted by the client public key to the client, so that the client obtains the symmetric key according to the second filling information and the first filling information of the client, and encrypting the symmetric key by the server public key;

[0093] Get the ciphertext of the symmetric key sent by the client;

[0094] After obtaining the client digital certificate sent by the client, the server management method further includes:

[0095] Extract the client public key from the client digital certificate through the root certificate.

[0096] To better illustrate the embodiments of the present invention, please refer to Figure 3 , Figure 3 This is a schematic diagram of the process of agreeing on a symmetric key provided by the present invention. In the figure, the client first sends the symmetric encryption rule encrypted by the server public key, then the BMC fills the second filling information into the symmetric encryption rule, and sends it after encryption using the client public key. The client fills the first filling information into the symmetric encryption rule, obtains the symmetric key according to the symmetric encryption rule, and then sends the symmetric key encrypted by the server public key and the hash value of the symmetric key. The BMC decrypts the symmetric key to obtain the symmetric key and verifies the integrity. Finally, communication can be carried out based on the symmetric key.

[0097] Specifically, considering that if the client alone determines the symmetric key, the security will be general, while the symmetric key jointly formed by the client and the BMC will greatly improve the security, the embodiment of the present invention can first obtain the symmetric encryption rule sent by the client. The symmetric encryption rule is "a field to be filled including multiple information filling bits". The symmetric encryption rule can also limit the "combination form of each piece of information to be filled". For example, the symmetric encryption rule can limit the combination form of each piece of information to be filled to a spliced form.

[0098] Specifically, after obtaining the symmetric encryption rule and decrypting the symmetric encryption rule through its own server private key, it can fill its own second filling information into the symmetric encryption rule, and then encrypt the symmetric encryption rule with the second filling information through the client public key and send it to the client, so that after the client fills the first filling information into the symmetric encryption rule, the first filling information and the second filling information combined by the "combination form specified by the symmetric encryption rule" are used as the symmetric key; then, the BMC can obtain the ciphertext of the symmetric key sent by the client.

[0099] Among them, in addition to the splicing form, the "combination form of each filled information" specified by the symmetric encryption rule can also be other types, which are not limited in the embodiment of the present invention.

[0100] In addition, as an optional embodiment, the first filling information includes a first random number generated by the client through a preset encryption algorithm;

[0101] In response to the client's communication request, sending its own server digital certificate to the client includes:

[0102] Receive a communication request sent by a client, wherein the communication request includes a secure socket layer protocol version of the client and a preset encryption algorithm for generating a random number;

[0103] Determine whether the client's Secure Sockets Layer protocol version and preset encryption algorithm are consistent with its own Secure Sockets Layer protocol version and preset encryption algorithm;

[0104] If they are consistent, the server's digital certificate will be sent to the client;

[0105] Filling its own second filling information into the symmetric encryption rule includes:

[0106] Generate a second random number using a preset encryption algorithm;

[0107] Get the hardware ID of the server where it is located;

[0108] The second random number and the hardware identifier are used together as second filling information and filled into the symmetric encryption rule.

[0109] Specifically, considering that the random number generated by the preset encryption algorithm can further increase the complexity and decryption difficulty of the symmetric key, the first filling information and the second filling information in the embodiment of the present invention both include random numbers generated by the preset encryption algorithm. The difference is that the first random number in the first filling information is generated by the client according to the preset encryption algorithm, while the first random number in the second filling information is generated by the BMC according to the preset encryption algorithm. Therefore, this requires the BMC and the client to mutually confirm the preset encryption algorithm in the early stage. Therefore, in the embodiment of the present invention, the client can add the client's secure sockets layer protocol version and the preset encryption algorithm for generating random numbers in the communication request, and the BMC can respectively detect the "consistency of the secure sockets layer protocol version" and the "consistency of the preset encryption algorithm". If both consistencies are met, the subsequent steps of verifying the digital certificate can be executed. Otherwise, an error can be reported and the communication can be terminated.

[0110] The preset encryption algorithm may be of various types, for example, an asymmetric encryption algorithm such as RSA (Rivest-Shamir-Adleman) or SM2 (National Encryption Algorithm), etc., which is not limited in the embodiment of the present invention.

[0111] In addition, considering that by adding the hardware identification of the server where the BMC is located to the symmetric encryption rules, the complexity and decryption difficulty of the symmetric key can be further improved, the second filling information in the embodiment of the present invention can also include the hardware identification of the server where the BMC is located.

[0112] The hardware identifier of the server where the BMC is located may be of various types, such as a motherboard component number, etc., which is not limited in this embodiment of the present invention.

[0113] As an optional embodiment, after obtaining the client digital certificate sent by the client and before communicating with the client, the server management method further includes:

[0114] Calculate the hash value of the client digital certificate signature using a preset hash algorithm;

[0115] Determine whether the hash value of the certificate signature in the client digital certificate is consistent with the hash value calculated;

[0116] Communicating with the client includes:

[0117] If the client digital certificate is valid and the hash value of the certificate signature is consistent with the hash value, communication with the client is carried out.

[0118] Specifically, in order to prevent the damage of the transmitted client digital certificate during the transmission process, the embodiment of the present invention can also use a preset hash algorithm to calculate the hash calculation value of the certificate signature of the client digital certificate, and then judge whether the hash value of the certificate signature in the client digital certificate is consistent with the hash calculation value, so as to judge the integrity of the client digital certificate. That is, if they are consistent, it means that the client digital certificate is complete, and if they are inconsistent, it means that the client digital certificate is incomplete. Accordingly, communication with the client can be carried out when the conditions of the client digital certificate being legal and the client digital certificate being complete are met at the same time.

[0119] Among them, the means of integrity verification through hash values can also be extended to other transmitted content in the embodiments of the present invention. For example, in the process of transmitting symmetric encryption rules, the BMC and the client can calculate the hash value before sending the symmetric encryption rules and send the hash value along with the symmetric encryption rules, so that the communicating party can verify the integrity of the symmetric encryption rules through the "hash value received at the same time" after receiving the symmetric encryption rules.

[0120] As an optional embodiment, in response to the communication request of the client, before sending the server digital certificate to the client, the server management method further includes:

[0121] Generate a certificate request file including a preset first access control policy and a server private key;

[0122] Sending the certificate request file and the server private key to the configuration terminal, so that the configuration terminal issues a server digital certificate including the first access control policy for the baseboard management controller through the root certificate based on the certificate request file and the server private key;

[0123] Receive the server digital certificate;

[0124] Communicating with the client includes:

[0125] Before receiving information sent by the client, determine whether the client satisfies the first access control policy in its own server digital certificate;

[0126] If satisfied, the information sent by the client is received.

[0127] Specifically, considering that if a "custom access control policy" can be added to the certificate request file during the digital certificate application stage, then access control can be performed through the access control policy in the digital certificate during the communication process with other parties, and this setting method is relatively flexible, and even batch setting of access control policies for a large number of servers can be achieved. Therefore, in an embodiment of the present invention, the BMC can also generate a certificate request file including a preset first access control policy and a server private key, and then send the certificate request file and the server private key to the configuration terminal, so that the configuration terminal can issue a server digital certificate including the first access control policy for the baseboard management controller through the root certificate based on the certificate request file and the server private key, and then receive the issued server digital certificate.

[0128] Specifically, based on the server digital certificate "including the first access control policy", when visited by the client, before receiving the information sent by the client, it can determine whether the client meets the first access control policy in its own server digital certificate. If it meets the requirement, it can be received; otherwise, it can be not received, thereby realizing access control.

[0129] Among them, the first access control policy can be independently defined, for example, a whitelist and / or blacklist can be set for the "specified parameters", and the specified parameters can be of various types, such as IP (Internet Protocol) address, MAC (Media Access Control Address) address and domain name, etc., which are not limited in the embodiments of the present invention.

[0130] There are many ways to generate the certificate request file, such as by using the OpenSSL tool, or filling in the certificate request template of a third-party CA organization, etc., which is not limited in this embodiment of the present invention.

[0131] Please refer to Figure 4 , Figure 4 This is a flow chart of a second server management method provided by the present invention, which is applied to a client and includes:

[0132] S201: Sending a communication request to a baseboard management controller so that the baseboard management controller sends its own server digital certificate to the client;

[0133] S202: Verify the legitimacy of the server digital certificate through the root certificate;

[0134] S203: If the certificate is valid, the client digital certificate is sent to the baseboard management controller, so that the baseboard management controller can communicate with the client after verifying the validity of the client digital certificate through the root certificate.

[0135] Specifically, the embodiment of the present invention introduces the process of two-way authentication of digital certificates between the client and the BMC from the perspective of the client.

[0136] Based on the above embodiment:

[0137] As an optional embodiment, before sending the communication request to the baseboard management controller, the server management method further includes:

[0138] Generate a certificate request file including a preset second access control policy and a client private key;

[0139] Sending the certificate request file and the client private key to the configuration terminal, so that the configuration terminal issues a client digital certificate including the second access control policy to the client through the root certificate based on the certificate request file and the client private key;

[0140] Receive client digital certificate;

[0141] After sending its own client digital certificate to the baseboard management controller, the server management method further includes:

[0142] Before receiving the information sent by the baseboard management controller, determining whether the baseboard management controller satisfies the second access control policy in its own client digital certificate;

[0143] If the conditions are met, the information sent by the baseboard management controller is received.

[0144] Specifically, considering that a preset access control policy can also be added to the client digital certificate to implement access control through the digital certificate, in an embodiment of the present invention, the client can generate a certificate request file including a preset second access control policy and a client private key, and send the certificate request file and the client private key to the configuration terminal so that the configuration terminal can issue a client digital certificate including the second access control policy for the client through the root certificate based on the certificate request file and the client private key. Then, after receiving the client digital certificate, when receiving a visit from the BMC, it can be determined whether the BMC satisfies the second access control policy in its own client digital certificate, and if so, accept the information sent by the BMC.

[0145] The second access control policy can also be flexibly set. The setting idea can refer to the setting idea of the first access control policy, which is not limited in the embodiment of the present invention.

[0146] Please refer to Figure 5 , Figure 5 This is a structural diagram of a server management device provided by the present invention, which is applied to a baseboard management controller of a server, including:

[0147] The first sending module 51 is used to send its own server digital certificate to the client in response to the communication request of the client, so that the client can send the client digital certificate after verifying the legitimacy of the server digital certificate through the root certificate;

[0148] A first obtaining module 52 is used to obtain a client digital certificate sent by the client;

[0149] The first verification module 53 is used to verify whether the client digital certificate is legal through the root certificate, and if it is legal, trigger the first communication module 54;

[0150] The first communication module 54 is configured to communicate with a client.

[0151] Based on the above embodiment:

[0152] As an optional embodiment, the first communication module 54 includes:

[0153] The second acquisition module is used to obtain the ciphertext of the symmetric key sent by the client, wherein the ciphertext of the symmetric key sent by the client is encrypted by the server public key, and the server public key is: the client extracts the server digital certificate from the server digital certificate through the root certificate;

[0154] The first decryption module is used to decrypt the ciphertext of the symmetric key using its own server private key to obtain the symmetric key;

[0155] The second communication module is used to communicate with the client through a symmetric key.

[0156] As an optional embodiment, the second acquisition module includes:

[0157] A third acquisition module is configured to acquire a symmetric encryption rule sent by the client, wherein the symmetric encryption rule is a to-be-filled field including a plurality of information filling bits, and the symmetric encryption rule is encrypted using a public key of the server;

[0158] The second decryption module is used to decrypt the symmetric encryption rules using its own server private key;

[0159] A first filling module is used to fill its own second filling information into the symmetric encryption rule;

[0160] A first encryption module is used to encrypt the symmetric encryption rule with the second filling information using the client public key;

[0161] A second sending module is used to send the symmetric encryption rule encrypted by the client public key to the client, so that the client obtains the symmetric key according to the second filling information and the first filling information of the client, and encrypts the symmetric key by the server public key;

[0162] The fourth acquisition module is used to obtain the ciphertext of the symmetric key sent by the client;

[0163] The server management device also includes:

[0164] The fifth acquisition module is used to extract the client public key from the client digital certificate through the root certificate.

[0165] As an optional embodiment, the server management device further includes:

[0166] A first calculation module is used to calculate a hash value of the certificate signature of the client digital certificate by using a preset hash algorithm;

[0167] The first judgment module is used to judge whether the hash value of the certificate signature in the client digital certificate is consistent with the hash calculation value;

[0168] The first communication module 54 is specifically configured to:

[0169] If the client digital certificate is valid and the hash value of the certificate signature is consistent with the hash value, communication with the client is carried out.

[0170] As an optional embodiment, the server management device further includes:

[0171] A first generating module, configured to generate a certificate request file including a preset first access control policy and a server private key;

[0172] A third sending module is configured to send the certificate request file and the server private key to the configuration terminal, so that the configuration terminal issues a server digital certificate including the first access control policy for the baseboard management controller through the root certificate based on the certificate request file and the server private key;

[0173] A first receiving module, configured to receive a server digital certificate;

[0174] The first communication module 54 includes:

[0175] The second judgment module is used to judge whether the client satisfies the first access control policy in its own server digital certificate before receiving the information sent by the client, and if so, trigger the second receiving module;

[0176] The receiving module is used to receive information sent by the client.

[0177] For an introduction to the server management device provided by an embodiment of the present invention, please refer to the aforementioned embodiment of the server management method, and the embodiment of the present invention will not be described in detail here.

[0178] Please refer to Figure 6 , Figure 6A schematic diagram of the structure of a server management device provided by the present invention, the server management device comprising:

[0179] Memory 61, for storing computer programs;

[0180] The processor 62 is configured to implement the steps of the server management method in the aforementioned embodiment when executing a computer program.

[0181] For an introduction to the server management device provided by an embodiment of the present invention, please refer to the aforementioned embodiment of the server management method, and the embodiment of the present invention will not be described in detail here.

[0182] Please refer to Figure 7 , Figure 7 This is a structural diagram of a computer-readable storage medium provided by the present invention. A computer program 72 is stored on the computer-readable storage medium 71. When the computer program 72 is executed by the processor, the steps of the server management method in the aforementioned embodiment are implemented.

[0183] For an introduction to the computer-readable storage medium provided in an embodiment of the present invention, please refer to the aforementioned embodiment of the server management method, and the embodiment of the present invention will not be described in detail here.

[0184] The present invention also provides a computer program product, comprising a computer program / instruction, which implements the steps of the server management method in the aforementioned embodiment when executed by a processor.

[0185] For an introduction to the computer program product provided by the embodiment of the present invention, please refer to the aforementioned embodiment of the server management method, and the embodiment of the present invention will not be described in detail here.

[0186] In this specification, the various embodiments are described in a progressive manner, with each embodiment focusing on the differences from the other embodiments. Similar or identical parts between the various embodiments may be referred to in conjunction with each other. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and for relevant parts, reference may be made to the method description. It should also be noted that, in this specification, relational terms such as first and second, etc., are used solely to distinguish one entity or operation from another, and do not necessarily require or imply any actual relationship or order between these entities or operations. Furthermore, the terms "comprise," "include," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprises a..." does not exclude the presence of other identical elements in the process, method, article, or device comprising that element.

[0187] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A server management method, characterized in that: Baseboard management controller for servers, including: In response to the client's communication request, the server sends its own server digital certificate to the client, so that the client can verify the legitimacy of the server digital certificate through the root certificate and then send the client digital certificate; Get the client digital certificate sent by the client; Verify the legitimacy of the client digital certificate through the root certificate; If it is legal, it communicates with the client.

2. The server management method according to claim 1, wherein: The communicating with the client includes: Obtain the ciphertext of the symmetric key sent by the client, wherein the ciphertext of the symmetric key sent by the client is encrypted using the server's public key, which is extracted by the client from the server's digital certificate using the root certificate; Decrypt the ciphertext of the symmetric key using its own server private key to obtain the symmetric key; Communicates with the client via symmetric keys.

3. The server management method according to claim 2, wherein: The ciphertext of the symmetric key sent by the client is obtained including: Obtaining a symmetric encryption rule sent by the client, wherein the symmetric encryption rule is: a to-be-filled field including a plurality of information filling bits, and the symmetric encryption rule is encrypted using a public key of the server; Decrypt the symmetric encryption rules using its own server private key; Filling its own second filling information into the symmetric encryption rule; Encrypting the symmetric encryption rule with the second padding information using the client public key; Sending the symmetric encryption rule encrypted by the client public key to the client, so that the client obtains a symmetric key according to the second filling information and the first filling information of the client, and encrypting the symmetric key by the server public key; Get the ciphertext of the symmetric key sent by the client; After obtaining the client digital certificate sent by the client, the server management method further includes: The client public key is extracted from the client digital certificate through a root certificate.

4. The server management method according to claim 1, wherein: After obtaining the client digital certificate sent by the client and before communicating with the client, the server management method further includes: Calculate the hash value of the client digital certificate signature using a preset hash algorithm; Determine whether the hash value of the certificate signature in the client digital certificate is consistent with the hash calculation value; The communicating with the client includes: If the client digital certificate is valid and the hash value of the certificate signature is consistent with the hash calculation value, communication is performed with the client.

5. The server management method according to any one of claims 1 to 4, characterized in that: Before sending the server digital certificate to the client in response to the client's communication request, the server management method further includes: Generate a certificate request file including a preset first access control policy and a server private key; Sending the certificate request file and the server private key to the configuration terminal, so that the configuration terminal issues a server digital certificate including the first access control policy for the baseboard management controller through the root certificate based on the certificate request file and the server private key; Receiving the server digital certificate; The communicating with the client includes: Before receiving information sent by the client, determining whether the client satisfies the first access control policy in its own server digital certificate; If satisfied, the information sent by the client is received.

6. A server management method, characterized in that: Applied to the client, including: Send a communication request to the baseboard management controller so that the baseboard management controller sends its own server digital certificate to the client; Verify the legitimacy of the server-side digital certificate through the root certificate; If it is legitimate, the client digital certificate is sent to the baseboard management controller so that the baseboard management controller can communicate with the client after verifying the legitimacy of the client digital certificate through the root certificate.

7. The server management method according to claim 6, wherein: Before sending the communication request to the baseboard management controller, the server management method further includes: Generate a certificate request file including a preset second access control policy and a client private key; Sending the certificate request file and the client private key to the configuration terminal, so that the configuration terminal issues a client digital certificate including the second access control policy to the client through the root certificate based on the certificate request file and the client private key; Receiving the client digital certificate; After sending its own client digital certificate to the baseboard management controller, the server management method further includes: Before receiving the information sent by the baseboard management controller, determining whether the baseboard management controller satisfies the second access control policy in its own client digital certificate; If the conditions are met, the information sent by the baseboard management controller is received.

8. A server management device, characterized in that: Baseboard management controller for servers, including: The first sending module is used to send its own server digital certificate to the client in response to the communication request of the client, so that the client can send the client digital certificate after verifying the legitimacy of the server digital certificate through the root certificate; A first acquisition module is used to acquire a client digital certificate sent by the client; A first verification module is used to verify whether the client digital certificate is legal through a root certificate, and if so, trigger the first communication module; The first communication module is used to communicate with the client.

9. A server management device, characterized in that: include: memory for storing computer programs; A processor, configured to implement the steps of the server management method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the server management method according to any one of claims 1 to 7.

Images