BMC login method, system and device and computer readable storage medium

Abstract

The invention discloses a BMC login method, system and device and a computer readable storage medium. The BMC login method comprises the steps that a user name, a login password and a client certificate uploaded by a login terminal are received; verifying whether the user name, the login password and the client certificate are all valid or not, and obtaining a verification result; and if the verification result is all valid, allowing the login terminal to log in the BMC system. According to the BMC login method provided by the embodiment of the invention, the login terminal is allowed to log in the BMC system only by verifying that the user name, the login password and the client certificate are all valid, and compared with the prior art that login is allowed only after the user name is verified to be matched with the password, a process of verifying the client certificate is added during login, so that the login efficiency is improved, and the user experience is improved. Meanwhile, compared with an operation mode of verifying login by using a user name, a password and a dynamic code, the method disclosed by the invention is simpler and more convenient, and login can be carried out without downloading and installing an identity verifier by the login terminal.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to a BMC login method, system, device, and computer-readable storage medium. Background Technology

[0002] Information security systems in a network environment are crucial for ensuring information security. These include secure computer operating systems, various security protocols and mechanisms, and even the entire security system; any security vulnerability can threaten overall security. Servers store diverse information and data from various industries, so server security is a primary consideration. The Baseboard Management Controller (BMC) allows for a range of server control operations, such as firmware upgrades and monitoring of equipment, even when the machine is powered off.

[0003] In related technologies, logging into the BMC system typically involves authentication via username and password. However, passwords are easily leaked and can be modified for unauthorized operations, resulting in a relatively low level of security. An enhanced login authentication method involves displaying a dynamic code verification box after successful username and password login. This requires obtaining a dynamic code for the BMC management system from the login terminal authenticator, entering the dynamic code in the verification box, and only after successful verification can the user log in to the BMC system.

[0004] However, when logging into BMC using password verification, if the user's username and password are leaked, stolen, or cracked by an attacker, the attacker can use the user's username and password to log into BMC, thereby threatening BMC's security. In other words, the existing password verification method for logging into BMC has low security.

[0005] Another login verification method adds dynamic code verification to the username and password. While this improves login security, it requires an authenticator to be installed on the login terminal. The authenticator scans the QR code generated by the dynamic code generator on the BMC system and stores it in the authenticator. If the dynamic code generator in the BMC system is disabled and then re-enabled, the authenticator on the login terminal needs to rescan the QR code generated by the dynamic code generator on the BMC system to ensure that the QR code information stored in the authenticator is updated in a timely manner. Without this step, the dynamic code generated by the authenticator on the login terminal cannot verify login to the BMC system. Furthermore, if the authenticator on the login terminal is uninstalled or the login terminal is changed, it will be impossible to obtain a dynamic code to log in to the BMC system.

[0006] In summary, ensuring the security and ease of operation of the BMC login method is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0007] The purpose of this application is to provide a BMC login method that can, to a certain extent, solve the technical problem of how to improve the security and convenience of BMC login methods. This application also provides a BMC login system, device, and computer-readable storage medium.

[0008] To achieve the above objectives, in a first aspect, embodiments of the present invention provide a BMC login method, comprising:

[0009] Receive the username, login password, and client certificate uploaded by the login terminal;

[0010] Verify that the username, login password, and client certificate are all valid, and obtain the verification result;

[0011] If the verification results are all valid, the login terminal is allowed to log in to the BMC system.

[0012] Furthermore, after obtaining the verification result, the method further includes:

[0013] If the verification result is invalid, the login terminal is not allowed to log in to the BMC system;

[0014] If at least one of the username, login password, and client certificate is invalid, the verification result is invalid.

[0015] Further, verifying the validity of the username includes:

[0016] The system checks if the username exists in the preset login information list; if it does, the username verification is valid; otherwise, the username verification is invalid.

[0017] The login information list contains all usernames with login privileges.

[0018] Further, verifying the validity of the login password includes:

[0019] Retrieve the password corresponding to the username from the preset login information list;

[0020] Determine whether the login password matches the user password; if yes, the login password verification is valid; otherwise, the login password verification is invalid.

[0021] The login information list contains all usernames with login privileges and the corresponding passwords for each username.

[0022] Further, verifying the validity of the client certificate includes:

[0023] Obtain the CA root certificate corresponding to the client certificate;

[0024] The system queries the preset list of CA root certificates to see if the CA root certificate exists. If it does, the system obtains the first characteristic information of the client certificate.

[0025] Retrieve the second feature information bound to the username from the preset login information list;

[0026] Determine whether the first feature information and the second feature information are consistent; if yes, the client certificate verification is valid; if no, the client certificate verification is invalid.

[0027] The login information list includes all usernames with login privileges and second feature information bound to each username with login privileges.

[0028] Furthermore, each of the second feature information is bound to only one of the usernames.

[0029] Furthermore, both the first feature information and the second feature information are hash values ​​of the client certificate.

[0030] Secondly, embodiments of the present invention also provide a BMC login system, comprising:

[0031] The receiving module is used to receive the username, login password, and client certificate uploaded by the login terminal.

[0032] The verification module is used to verify whether the username, login password and client certificate are all valid and to obtain the verification result.

[0033] The login module is used to allow the login terminal to log in to the BMC system if the verification results are all valid.

[0034] Thirdly, embodiments of the present invention also provide a BMC login device, comprising:

[0035] Memory, used to store computer programs;

[0036] A processor for executing the computer program to implement the steps of the BMC login method as described in the first aspect.

[0037] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the BMC login method as described in the first aspect.

[0038] Beneficial effects:

[0039] The BMC login method provided in this application requires verification of the username, login password, and client certificate before allowing the login terminal to log in to the BMC system. Compared with the prior art, which only allows login after verifying that the username and password match, this method adds an extra step of verifying the client certificate during login, ensuring the security of logging into the BMC system and avoiding the risk of unauthorized login due to known or cracked passwords. This improves the security of BMC login to a certain extent. At the same time, the BMC login method provided in this application is simpler than the operation method of verifying login using username, password, and dynamic code, as it does not require the login terminal to download and install an authenticator.

[0040] The BMC login system, device, and computer-readable storage medium provided in this application also solve the corresponding technical problems. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0042] Figure 1 A first flowchart of a BMC login method provided in an embodiment of this application;

[0043] Figure 2 A second flowchart of a BMC login method provided in an embodiment of this application;

[0044] Figure 3 This application provides a schematic diagram of the structure of a BMC login system according to an embodiment of the present application.

[0045] Figure 4 This is a schematic diagram of the structure of a BMC login device provided in an embodiment of this application. Detailed Implementation

[0046] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0047] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0048] In this application, the terms "upper," "lower," "left," "right," "front," "rear," "top," "bottom," "inner," "outer," "middle," "vertical," "horizontal," "lateral," and "longitudinal" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. These terms are primarily for the purpose of better describing this application and its embodiments, and are not intended to limit the indicated device, element, or component to having a specific orientation, or to be constructed and operated in a specific orientation.

[0049] Furthermore, in addition to indicating location or positional relationship, some of the aforementioned terms may also have other meanings. For example, the term "above" may also be used in some cases to indicate a certain dependency or connection relationship. Those skilled in the art can understand the specific meaning of these terms in this application based on the specific circumstances.

[0050] Furthermore, the terms "installation," "setup," "equipped with," "connection," "linking," and "socketing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral structure; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium, or an internal connection between two devices, components, or parts. Those skilled in the art can understand the specific meaning of these terms in this application based on the specific circumstances.

[0051] Among related technologies, there are two methods to ensure secure login to the BMC:

[0052] The first method involves logging into the BMC using password verification. The BMC server receives the user's username and password, verifies if they match, and allows the user to log in if they do. However, with password verification, if an attacker steals or deciphers the user's username and password, they can use this information to log into the BMC, thus threatening its security. In other words, the existing password verification method for logging into the BMC has relatively low security.

[0053] The second method adds dynamic code verification to the username and password. Although the login security level is improved, an authenticator needs to be installed on the login terminal. If the authenticator is uninstalled, the user changes the login terminal, or the dynamic code generator function in the BMC system is restarted, the user will not be able to obtain a dynamic code to log in to the BMC system. This makes the BMC login method more complicated and inconvenient.

[0054] The BMC login method provided in this application embodiment can ensure the security of BMC login while also ensuring the convenience of users logging into the BMC system.

[0055] Please see Figure 1 , Figure 1 This is a first flowchart illustrating a BMC login method provided in an embodiment of this application. The BMC login method provided in this embodiment can be applied to a server BMC and may include the following steps:

[0056] Step S101: Receive the username, login password and client certificate uploaded by the login terminal.

[0057] It is understood that the username, login password, and client certificate described in the embodiments of this application refer to the username, login password, and client certificate used to log in to the BMC system. The username can also be referred to as a user account or username. In practical applications, the username and login password are set according to BMC's login rules. Generally, the specific content and format of the username and login password can be determined by BMC's login rules and external settings. In special cases, the username and login password can be allocated and determined independently by BMC.

[0058] In specific application scenarios, users can log in to the BMC system through a login terminal. The login terminal runs a client with a visual login interface. After the user enters the username, login password and selects the corresponding client certificate on the client, the client uploads them to the server BMC. The server BMC can then receive the username, login password and client certificate uploaded by the user through the client.

[0059] For example, the login terminal can be a mobile terminal, such as a smartphone, tablet, laptop, wearable device, in-vehicle smart terminal, etc.; the login terminal can also be a fixed terminal, such as a desktop computer.

[0060] The client certificate, stored in the login terminal, is a digital certificate used to verify the client's identity. It is submitted when establishing a secure connection with the server (BMC) to verify the client's legitimacy. For example, the client certificate can be a certificate generated from a CA root certificate. The CA root certificate is a digital certificate issued by a Certificate Authority (CA) and serves as the starting point of the certificate trust chain. It contains the CA's public key, identity information, and a self-signature used to verify the legitimacy of lower-level certificates.

[0061] In practical applications, server administrators can first upload one or more CA root certificates to the certificate management module of the BMC system, and then compile a list of all uploaded CA root certificates. When uploading a CA root certificate, the BMC system checks whether the uploaded certificate is indeed a CA root certificate before uploading it. The BMC system can verify certificates by calling relevant open-source software libraries and toolkits with certificate management functions. For example, the OpenSSL tool can be used to check whether the uploaded certificate contains the information "CA:TRUE"; if so, it is a CA root certificate.

[0062] The client certificate does not contain username information and can be bound to any username. Users with login privileges need to bind their username and client certificate in the BMC system first. The administrator first uploads the client certificates bound to each username to the BMC system. The BMC system then uses open-source software libraries and toolkits with certificate management functions to obtain the CA root certificate corresponding to each client certificate, for example, using the OpenSSL tool. Next, it checks if the CA root certificate corresponding to each client certificate exists in the CA root certificate list. If the CA root certificate of a bound client certificate exists in the CA root certificate list, the CA root certificate status of the client certificate corresponding to this username is marked as valid, and the feature value of this client certificate is recorded and stored as the second feature information in the login information list. The binding of the username and client certificate is then completed in the BMC system. If the CA root certificate corresponding to a client certificate does not exist in the CA root certificate list, the CA root certificate status of the client certificate bound to this username is marked as invalid, and the second feature information of this client certificate is set to empty. In this way, when a user logs in and verifies the client certificate, it is only necessary to first check whether the CA root certificate under the username is valid, without having to verify again whether the client certificate has a CA root certificate.

[0063] It is understandable that a username is bound to only one client certificate, but a client certificate can be bound to one or more usernames. In this embodiment, to ensure the uniqueness between the client certificate and the username and to improve the verification security level, a client certificate is bound to only one username. That is, in the BMC system, a second feature is bound to only one username.

[0064] Step S102: Verify that the username, login password and client certificate are all valid and obtain the verification result.

[0065] In practical applications, the BMC system pre-stores a list of login information, which contains all usernames with login permissions and the corresponding login passwords and client certificate secondary characteristics.

[0066] For example, the method for verifying whether the username is valid is as follows: query a preset login information list to confirm whether the username exists; if yes, the username verification is valid; if no, the username verification is invalid.

[0067] Understandably, to reduce verification steps and avoid wasting resources on invalid verification steps, the verification process only proceeds to verify the login password if the username verification is valid. Only after the login password verification is valid will the client certificate verification proceed. In other words, if the username verification is invalid, subsequent login password and client certificate verifications will not be performed; if the username verification is valid but the login password verification is invalid, the client certificate verification will not proceed. Please refer to the detailed verification process. Figure 2 The flowchart shown is shown.

[0068] The login information list on the BMC system stores the correspondence between each username and its corresponding login password. The BMC can use this correspondence to find the login password corresponding to the username transmitted by the login terminal, and verify whether the found login password matches the login password transmitted by the login terminal. If they match, the username and password transmitted by the login terminal are verified to be a match; if they do not match, the username and password transmitted by the login terminal are verified to be a mismatch. For example, the username and login password can be one or a combination of numbers, letters, Chinese characters, symbols, etc.

[0069] Once the BMC system verifies that the username and password transmitted by the login terminal match, it means that the username is a legitimate user. At this point, in order to further ensure the security of BMC login, it is also necessary to verify the validity of the client certificate.

[0070] Similarly, as mentioned earlier, the login information list on the BMC system also stores the correspondence between each username and its corresponding client certificate's second feature information. The client certificate verification process is as follows: When the BMC system receives the client certificate transmitted by the user through the login terminal, it first obtains the value of the previously verified "CA root certificate status is valid" or "root certificate status is invalid" identifier at the corresponding position of the username in the BMC system. If the identifier shows validity, it then calls the corresponding open-source software library and toolkit with certificate management functions to obtain the first feature information corresponding to the client certificate, and compares the first feature information with the second feature information of the client certificate corresponding to the username stored in the BMC system. If the comparison matches, the client certificate is verified as valid.

[0071] Understandably, if the identifier is invalid, the client certificate verification will fail, and the client will be unable to log in to the BMC system.

[0072] In this embodiment, both the first feature information and the second feature information are hash values ​​of the client certificate. The hash value represents the encrypted uniqueness of the certificate and is used as an anti-counterfeiting fingerprint identifier for the client certificate.

[0073] Step S103: In response to the verification results being all valid, the login terminal is allowed to log in to the BMC system.

[0074] In this embodiment, a valid verification result means that the username, login password, and client certificate are all verified as valid. If any one of them fails, the verification result is invalid. It's easy to understand that even if an unauthorized user obtains a valid username and password for the BMC system, they lack the client certificate associated with that username. In this case, the unauthorized user cannot upload the correct client certificate to BMC. That is, even if the username and password entered by the unauthorized user match, they still cannot log in to BMC. Using a client certificate further ensures the security of logging into BMC.

[0075] Client certificate files are stored in the login terminal, and a single login terminal can store multiple client certificate files. In practical applications, when a user wants to log in to the BMC system through the client, they need to enter the corresponding username and password in the corresponding login input box on the client, and select to upload the client certificate bound to that username. After entering all the required information, clicking the corresponding function key on the client will send the username, password, and client certificate to the BMC system.

[0076] If the username, password, and client certificate are all valid, the BMC system allows the login terminal to log in, and the user can access the BMC system through the client on the login terminal. Conversely, if any one of the username, password, or client certificate is invalid, the BMC system will not allow the login terminal to log in, thus preventing the user from accessing the BMC system through the client on the login terminal, thereby ensuring BMC system login security.

[0077] Since the client certificate file is stored in the login terminal, a legitimate user with login privileges can simply copy the client certificate file to the new login terminal after changing to a new login terminal. Then, they can use the client on the new login terminal to log in to the BMC system. The login terminal does not need to download an authenticator, and the client's login operation will not be affected after the BMC system restarts.

[0078] In summary, the BMC login method provided in this application requires verification of the validity of the username, login password, and client certificate before allowing the login terminal to log in to the BMC system. Compared with the prior art, which only allows login after verifying that the username and password match, this method adds an extra step of verifying the client certificate during login, ensuring the security of logging into the BMC system and avoiding the risk of unauthorized login due to known or cracked passwords. This improves the security of BMC login to a certain extent. At the same time, the BMC login method provided in this application is simpler than the operation method of verifying login using username, password, and dynamic code, as it does not require the login terminal to download and install an authenticator.

[0079] Based on the same inventive concept as the BMC login method provided in the first aspect, in the second aspect, embodiments of this application also provide a BMC login system. For example... Figure 3 As shown, the BMC login system includes:

[0080] The receiving module 101 is used to receive the username, login password and client certificate uploaded by the login terminal;

[0081] Verification module 102 is used to verify whether the username, login password and client certificate are all valid and to obtain the verification result;

[0082] The login module 103 is configured to allow the login terminal to log in to the BMC system if the verification result is entirely valid, or to disallow the login terminal to log in to the BMC system if the verification result is invalid.

[0083] Based on the same inventive concept as the BMC login method provided in the first aspect, in a third aspect, embodiments of this application also provide a BMC login device. For example... Figure 4As shown, the BMC login device may include one or more processors 201, one or more input devices 202, one or more output devices 203, and a memory 204. The processors 201, input devices 202, output devices 203, and memory 204 are interconnected via a bus 205. The memory 204 stores a computer program, which includes program instructions. The processor 201 is configured to invoke the program instructions to execute the method steps described in the BMC login method embodiment.

[0084] It should be understood that, in the embodiments of the present invention, the processor 201 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0085] Input device 202 may include a keyboard, etc., and output device 203 may include a display (LCD, etc.), a speaker, etc.

[0086] The memory 204 may include read-only memory and random access memory, and provides instructions and data to the processor 201. A portion of the memory 204 may also include non-volatile random access memory. For example, the memory 204 may also store device type information.

[0087] It should be noted that the specific workflow of the BMC login device can be found in the aforementioned method implementation section, and will not be repeated here.

[0088] Furthermore, in a fourth aspect, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the BMC login method as described in the first aspect.

[0089] The computer-readable storage medium can be an internal storage unit of the backend server described in the foregoing embodiments, such as the system's hard drive or memory. The computer-readable storage medium can also be an external storage device of the system, such as a plug-in hard drive, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card equipped on the system. Furthermore, the computer-readable storage medium can include both internal storage units and external storage devices. The computer-readable storage medium is used to store the computer program and other programs and data required by the system. The computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0090] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0091] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0092] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0093] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A BMC login method, characterized in that, include: Receive the username, login password, and client certificate uploaded by the login terminal; Verify that the username, login password, and client certificate are all valid, and obtain the verification result; If the verification results are all valid, the login terminal is allowed to log in to the BMC system.

2. The BMC login method as described in claim 1, characterized in that, After obtaining the verification result, the method further includes: If the verification result is invalid, the login terminal is not allowed to log in to the BMC system; If at least one of the username, login password, and client certificate is invalid, the verification result is invalid.

3. The BMC login method as described in claim 1, characterized in that, Verifying the validity of the username includes: The system checks if the username exists in the preset login information list; if it does, the username verification is valid; otherwise, the username verification is invalid. The login information list contains all usernames with login privileges.

4. The BMC login method as described in claim 1, characterized in that, Verifying the validity of the login password includes: Retrieve the password corresponding to the username from the preset login information list; Determine whether the login password matches the user password; if yes, the login password verification is valid; otherwise, the login password verification is invalid. The login information list contains all usernames with login privileges and the corresponding passwords for each username.

5. The BMC login method as described in claim 1, characterized in that, Verifying the validity of the client certificate includes: Obtain the CA root certificate corresponding to the client certificate; The system queries the preset list of CA root certificates to see if the CA root certificate exists. If it does, it retrieves the first characteristic information of the client certificate. Retrieve the second feature information bound to the username from the preset login information list; Determine whether the first feature information and the second feature information are consistent; if yes, the client certificate verification is valid; if no, the client certificate verification is invalid. The login information list includes all usernames with login privileges and second feature information bound to each username with login privileges.

6. The BMC login method as described in claim 5, characterized in that, Each of the second feature information is bound to only one of the usernames.

7. The BMC login method as described in claim 5, characterized in that, Both the first feature information and the second feature information are hash values ​​of the client certificate.

8. A BMC login system, characterized in that, include: The receiving module is used to receive the username, login password, and client certificate uploaded by the login terminal. The verification module is used to verify whether the username, login password and client certificate are all valid and to obtain the verification result. The login module is used to allow the login terminal to log in to the BMC system if the verification results are all valid.

9. A BMC login device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the BMC login method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the BMC login method as described in any one of claims 1 to 7.

Images