User operation recording method and device, electronic equipment and readable storage medium
By establishing two-way authentication and session between the client and server, and using fingerprint digests to record user operations, the problem of the inability to record user operations in detail in existing technologies is solved, enabling fine-grained traceability of server user operations and improving management efficiency.
Patent Information
- Application Number
- CN202511481712.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-16
- Publication Date
- 2026-01-13
AI Technical Summary
In existing technologies, server user operation records lack granularity and cannot accurately locate the specific user's operation, resulting in the inability to trace back to the specific user when backtracking the logs.
By obtaining the fingerprint digest of the current user on the client side and performing two-way authentication using a remote authentication key protocol, a session is established and user operations are recorded. The server obtains the target operation table based on the fingerprint digest, thus achieving detailed recording of user operations.
It enables detailed recording and tracing of server user operations, improves the traceability of user operations, and ensures the stability and management efficiency of the server cluster.
Smart Images
Figure CN121333685A_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to the field of computer technology, and more particularly to the fields of artificial intelligence, such as large models and deep learning. It provides a method, apparatus, electronic device, and readable storage medium for recording user operations. Background Technology
[0002] Driven by the demand for computing power, the number of servers in data centers is increasing daily. In today's world, the training of large models is often carried out in parallel by multiple servers in the data center, which means that any failure of any server will affect the use of the entire server cluster.
[0003] In existing technologies, servers or baseboard management controllers within servers only record the clients that send commands to them. This results in the ability to trace back the data based on the logs, where only a specific client can be located, but not which user on that client performed the operation on the server. Therefore, improving the granularity of user operation recording has become a pressing technical problem to be solved. Summary of the Invention
[0004] According to a first aspect of this disclosure, a method for recording user operations is provided, executed in a client, comprising: obtaining a target fingerprint digest of the current user based on the current user's login information; sending the target fingerprint digest to a server for the server to perform session authentication with the client based on the target fingerprint digest, establishing a session with the client, wherein the target fingerprint digest is also used by the server to obtain a target operation table corresponding to the current user; and sending a command to be executed issued by the current user to the server through the session, so that the server records the operation information of the command to be executed in the target operation table.
[0005] According to a second aspect of this disclosure, a method for recording user operations is provided, executed in a server, comprising: receiving a target fingerprint digest sent by a client; performing session authentication with the client based on the target fingerprint digest; in response to determining that the session authentication is successful, establishing a session with the client and obtaining a target operation table corresponding to the target fingerprint digest; executing a command to be executed sent by the client through the session, and recording the operation information of the command to be executed in the target operation table.
[0006] According to a third aspect of this disclosure, a user operation recording device is provided, located on a client, comprising: a processing unit, configured to obtain a target fingerprint digest of the current user based on the current user's login information; a first sending unit, configured to send the target fingerprint digest to a server, so that the server can perform session authentication with the client based on the target fingerprint digest and establish a session with the client, wherein the target fingerprint digest is also used by the server to obtain a target operation table corresponding to the current user; and a second sending unit, configured to send a command to be executed issued by the current user to the server through the session, so that the server can record the operation information of the command to be executed into the target operation table.
[0007] According to a fourth aspect of this disclosure, a user operation recording device is provided, located on a server, comprising: a receiving unit, configured to receive a target fingerprint digest sent by a client, and perform session authentication with the client based on the target fingerprint digest; a response unit, configured to, in response to determining that session authentication is successful, establish a session with the client and obtain a target operation table corresponding to the target fingerprint digest; and an execution unit, configured to execute a pending command sent by the client through the session, and record the operation information of the pending command in the target operation table.
[0008] According to a fifth aspect of this disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method as described above.
[0009] According to a sixth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions, wherein the computer instructions are used to cause the computer to perform the method described above.
[0010] According to a seventh aspect of this disclosure, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the method described above.
[0011] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description
[0012] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:
[0013] Figure 1This is a schematic diagram based on the first embodiment of the present disclosure;
[0014] Figure 2 This is a schematic diagram according to the second embodiment of the present disclosure;
[0015] Figure 3 This is a schematic diagram according to the third embodiment of the present disclosure;
[0016] Figure 4 This is a schematic diagram according to the fourth embodiment of the present disclosure;
[0017] Figure 5 This is a schematic diagram according to the fifth embodiment of the present disclosure;
[0018] Figure 6 This is a block diagram of an electronic device used to implement the user operation recording method of the embodiments of this disclosure. Detailed Implementation
[0019] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and mechanisms are omitted in the following description.
[0020] Figure 1 This is a schematic diagram based on the first embodiment of this disclosure. (See diagram below.) Figure 1 As shown, the user operation recording method in this embodiment is executed on the client and specifically includes the following steps:
[0021] S101. Obtain the target fingerprint digest of the current user based on the current user's login information;
[0022] S102. The target fingerprint digest is sent to the server so that the server can perform session authentication with the client based on the target fingerprint digest and establish a session with the client. The target fingerprint digest is also used by the server to obtain the target operation table corresponding to the current user.
[0023] S103. The command to be executed issued by the current user is sent to the server through the session, so that the server can record the operation information of the command to be executed into the target operation table.
[0024] The user operation recording method in this embodiment is executed by a client (which can also be a control machine or a console). The client first obtains the target fingerprint digest corresponding to the current user based on the current user's login information, and then sends the target fingerprint digest to the server to establish a session with the server. Finally, the command to be executed issued by the current user is sent to the server through this session. Since the client in this embodiment sends the target fingerprint digest corresponding to the current user to the server, the server can perform session authentication with the client based on the target fingerprint digest, and can also obtain the target operation table based on the target fingerprint digest. After the server executes the command to be executed issued by the client, it can record the corresponding operation information in the target operation table, thereby achieving the purpose of recording the operations performed by different users through different operation tables, effectively solving the problem in the prior art that it is impossible to trace the actual user of the server operation.
[0025] In this embodiment, the server is located in a data center, and the client (control unit or console) is used to remotely operate and maintain the server in the data center. The server in the data center can be used to train large models. The client can operate and maintain the server by sending commands directly to the server, or by sending commands to the BMC (Baseboard Management Controller) in the server.
[0026] In this embodiment, the BMC is an independent microcomputer embedded in the server, used to monitor, manage and control the server's hardware status. Even if the server completely crashes, the BMC located in the server can still work.
[0027] In this embodiment, when the client executes S101, it can first obtain a preset fingerprint digest table, which includes different login information and fingerprint digests corresponding to different login information. Different login information corresponds to different users. Then, it obtains the fingerprint digest in the fingerprint digest table that corresponds to the login information of the current user as the target fingerprint digest.
[0028] In other words, the client in this embodiment can obtain the target fingerprint digest corresponding to the current user based on the preset fingerprint digest table, which can improve the speed of obtaining the target fingerprint digest.
[0029] In this embodiment, the fingerprint digest table can be pre-generated in the following way: A user list is obtained, containing users who are daily maintenance personnel. Different maintenance personnel correspond to different login information. In this embodiment, the login information can be the maintenance personnel's username or a combination of the username and email address. For each user in the user list, a preset digital signature algorithm is used to obtain the user's fingerprint based on the user's login information. A hash algorithm is used to convert each user's fingerprint into a fingerprint digest of a preset length. Based on each user's login information and each user's fingerprint digest, a fingerprint digest table is obtained.
[0030] The preset digital signature algorithm in this embodiment is the Ed25519 algorithm. The Ed25519 algorithm is used to sign the input string to obtain a digital signature with a length of 256 bytes. The Ed25519 algorithm has higher security and faster signing and verification speed. The user fingerprint obtained in this embodiment is the 256-byte digital signature obtained by the Ed25519 algorithm.
[0031] It is understood that the preset digital signature algorithm can also be ECDSA-256 or RSA-4096. This embodiment does not limit the type of preset digital signature algorithm.
[0032] In this embodiment, the preset length is 16 bytes, that is, the hash algorithm is used to convert the 256-byte user fingerprint into a 16-byte digest, and the conversion result is used as the fingerprint digest for different users.
[0033] When the client in this embodiment executes S101, it may also include the following: in response to determining that there is no fingerprint digest in the fingerprint digest table corresponding to the login information of the current user, the client generates the user fingerprint of the current user based on the login information using a preset digital signature algorithm; the client converts the user fingerprint of the current user into a fingerprint digest of a preset length using a hash algorithm, and uses the conversion result as the target fingerprint digest.
[0034] In other words, after determining that there is no fingerprint digest corresponding to the current user in the fingerprint digest table, this embodiment generates the target fingerprint digest in real time based on the current user's login information, thus avoiding the problem of not being able to obtain the target fingerprint digest.
[0035] If the client in this embodiment generates a target fingerprint digest corresponding to the current user in real time when executing S101, the login information of the current user and the generated target fingerprint digest can be recorded in the fingerprint digest table, thereby avoiding the need for the current user to generate a fingerprint digest in real time the next time they log in.
[0036] In this embodiment, after the client executes S101 to obtain the target fingerprint digest of the current user, it executes S102 to send the obtained target fingerprint digest to the server so that the server can perform session authentication with the client based on the target fingerprint digest and establish a session with the client; wherein, the client sends the command to be executed issued by the current user to the server through the session.
[0037] In this embodiment, the target fingerprint digest of the current user is used for session authentication between the server and the client, and after authentication, the server uses the target fingerprint digest to obtain the target operation table corresponding to the current user.
[0038] In this embodiment, the session authentication method between the client and the server is a two-way authentication based on RAKP (Remote Attestation Key Protocol), which ensures that the client and the server (or BMC) can verify each other's identities and prevent man-in-the-middle attacks, forged BMCs, or brute-force attacks.
[0039] In this embodiment, the RAKP-based two-way authentication includes four stages: RAKP Stage 1, RAKP Stage 2, RAKP Stage 3, and RAKP Stage 4.
[0040] In the first phase of RAKP, the client sends its client session ID, a 16-byte random number generated by the client, and control permissions to the server (or BMC) to initialize the key exchange process between the client and the server (or BMC). In the second phase, the server (or BMC) sends its client session ID, a 16-byte random number generated by the server (or BMC), the server's (or BMC's) GUID (corresponding to a globally unique identifier for the server or BMC), and an HMAC-SHA1 authentication code to the client to prove that the server (or BMC) knows the password and provides the server's (or BMC's) identity credentials. In the third phase, the client sends its client session ID, the server's (or BMC's) session ID, and the HMAC-SHA1 authentication code to the server (or BMC) to prove that the client knows the password. In the fourth phase, the server (or BMC) sends its client session ID and the HMAC-SHA1 authentication code to the client, thus completing the two-way authentication between the server and the client, and the session between them is formally established.
[0041] In order to synchronize the client's user information to the server (or BMC), in this embodiment, when executing S102, the target fingerprint digest sent to the server (or BMC) is used as a 16-byte random number sent by the client to the server (or BMC) in the first phase of RAKP. The client no longer generates a 16-byte random number, so that the server (or BMC) can complete the session authentication of the first phase of RAKP based on the target fingerprint digest sent by the client.
[0042] Since the target fingerprint digest obtained in S101 of this embodiment is 16 bytes long, the target fingerprint digest sent by the client in S102 can seamlessly replace the originally generated 16-byte random number, thereby improving the speed of session authentication between the client and the server (or BMC).
[0043] After the client in this embodiment sends the target fingerprint digest to the server in S102, it executes S103 to send the command to be executed issued by the current user to the server through the session, so that the server can record the operation information of the command to be executed into the target operation table.
[0044] In this embodiment, the commands to be executed sent by the current user to the server through the client are IPMI (Intelligent Platform Management Interface) commands, including remote power-on commands, remote power-off commands, status viewing commands, remote restart commands, log viewing commands, user management commands, etc.
[0045] In this embodiment, IPMI commands are a set of instructions for out-of-band management of the server using the IPMI protocol. The current user can use the IPMITool in the client to send IPMI commands to the server (or BMC).
[0046] It is understood that in this embodiment, the communication channel used by the client and the server (or BMC) for the session is a LAN (Local Area Network) channel, that is, the client sends IPMI commands to the server (or BMC) through the session established in the LAN channel.
[0047] In this embodiment, after the server (or BMC) completes session authentication with the client, it will also obtain the corresponding target operation table based on the target fingerprint digest sent by the client. The target operation table obtained by the server corresponds to the current user. Therefore, all operations performed by the current user on the server (or BMC) will be recorded in the target operation table, which facilitates user tracing based on the operation table in subsequent processes.
[0048] In addition, after the client in this embodiment executes S103 to send the command to be executed issued by the current user to the server through the session, it may also include the following: obtaining target operation information, which in this embodiment may be target operation time or target operation command word. The target operation time may be the time corresponding to a specific command (e.g., abnormal server shutdown or abnormal restart) or the time selected or entered by the corresponding user; sending the obtained target operation information to the server so that the server can determine the candidate fingerprint digest based on the received target operation information. The client may send the target operation information to the server through the LAN channel between the client and the server; receiving the candidate fingerprint digest sent by the server and determining the target user based on the received candidate fingerprint digest. The client may receive the candidate fingerprint digest sent by the server through the LAN channel between the client and the server.
[0049] In other words, the client in this embodiment can also confirm the target user based on the obtained target operation information and the user operation table set in the server (or BMC), thereby achieving the purpose of tracing the user who actually performs the operation on the server.
[0050] In this embodiment, when the client determines the target user based on the received candidate fingerprint digest, it can match the candidate fingerprint digest in the fingerprint digest table to obtain the candidate login information that matches the candidate fingerprint digest in the fingerprint digest table, and then determine the user corresponding to the candidate login information as the target user. In this way, the confirmation of the actual user who caused the specific event can be completed.
[0051] Figure 2 This is a schematic diagram according to the second embodiment of this disclosure. (See diagram below.) Figure 2 As shown in the figure, the user operation recording method in this embodiment is executed on the server and specifically includes the following steps:
[0052] S201. Receive the target fingerprint digest sent by the client, and perform session authentication with the client based on the target fingerprint digest;
[0053] S202. In response to confirming that the session authentication is successful, establish a session with the client and obtain the target operation table corresponding to the target fingerprint digest;
[0054] S203. Execute the command to be executed sent by the client through the session, and record the operation information of the command to be executed in the target operation table.
[0055] The user operation recording method in this embodiment is executed by a server or a BMC within the server. After receiving the target fingerprint digest sent by the client, the server first performs session authentication with the client based on the target fingerprint digest. Then, if the session authentication is successful, it establishes a session with the client and obtains the target operation table corresponding to the target fingerprint digest. Finally, it executes the command to be executed sent by the client and records the operation information of the command to be executed in the target operation table. In this embodiment, the server can perform session authentication based on the target fingerprint digest sent by the client and obtain the target operation table based on the target fingerprint digest. This allows the server to record the operation information of the command to be executed in the target operation table, thereby achieving the purpose of recording the operations performed by different users through different operation tables. This effectively solves the problem in the prior art that it is impossible to trace the actual user of the server's operation.
[0056] When the server (or BMC) in this embodiment executes S201, it can receive the target fingerprint digest sent by the client through the LAN channel between the server and the client, and then perform session authentication with the client based on the received target fingerprint digest.
[0057] In this embodiment, when the server (or BMC) and the client perform two-way authentication based on the RAKP protocol, only the 16-byte random number sent by the client to the server (or BMC) in the first stage of RAKP is changed. That is, the server (or BMC) uses the target fingerprint digest (16 bytes in length) sent by the client to perform the first stage of RAKP authentication. No improvements have been made to the other authentication stages.
[0058] In this embodiment, after executing S201 to perform session authentication with the client based on the target fingerprint digest, the server (or BMC) executes S202 in response to confirming that the session authentication is successful, establishes a session with the client, and obtains the target operation table corresponding to the target fingerprint digest.
[0059] In this embodiment, if the server (or BMC) determines in S202 that the session authentication with the client is successful, the session with the client is successfully established, and then the target operation table corresponding to the target fingerprint digest is obtained. The obtained target operation table corresponds to the current user of the client.
[0060] It is understood that before executing S202, the server (or BMC) in this embodiment may temporarily store the target fingerprint digest, for example, by storing it in a temporary fingerprint digest table in the server (or BMC); if the session authentication between the server and the client is successful, the target fingerprint digest is obtained from the temporary fingerprint digest table, and then the target operation table corresponding to the target fingerprint digest is obtained.
[0061] In this embodiment, when the server (or BMC) executes S202 to obtain the target operation table corresponding to the target fingerprint digest, the implementation method can be as follows: obtain a user operation table set, which includes fingerprint digests and their corresponding user operation tables, with different fingerprint digests corresponding to different user operation tables; obtain the user operation table in the user operation table set that corresponds to the target fingerprint digest, as the target operation table, which records the operation information of the current user on the server (or BMC).
[0062] When the server (or BMC) of this embodiment executes S202, it may further include the following: in response to determining that there is no user operation table in the user operation table set corresponding to the target fingerprint digest, creating a user operation table in the user operation table set corresponding to the target fingerprint digest; and using the created user operation table as the target operation table.
[0063] In this embodiment, the user operation table includes multiple rows of information. Each row records the operation information when a user operates the server once. The operation information includes the operation command word (i.e., the command type to perform the operation), the operation time (i.e., the time when the operation is performed), and the operation result. This achieves the purpose of recording the operations performed by different users on the server (or BMC) through user operation tables corresponding to different users.
[0064] In this embodiment, after the server (or BMC) executes S202 to establish a session with the client and obtain the target operation table corresponding to the target fingerprint digest, it executes S203 to execute the command to be executed sent by the client through the session and records the operation information of the command to be executed into the target operation table.
[0065] When the server (or BMC) of this embodiment executes S203, it first determines the IPMI command that actually needs to be executed based on the payload in the command to be executed sent by the client, then executes the determined IPMI command, and then records the operation command word, operation time and operation result corresponding to the IPMI command as operation information corresponding to the command to be executed into the acquired target operation table.
[0066] Therefore, in this embodiment, after each time the server (or BMC) receives a command to be executed from the client via the LAN channel, it records the operation information corresponding to the command in the corresponding user operation table, so that the user who actually performs the operation can be identified in the future.
[0067] In addition, after executing S203, the server (or BMC) in this embodiment may also include the following: receiving target operation information sent by the client; obtaining a user operation table including the target operation information as a candidate operation table, that is, matching the target operation information with the operation information in each user operation table of the user operation table set, and using the matched user operation table as a candidate operation table; obtaining a fingerprint digest corresponding to the candidate operation table as a candidate fingerprint digest; and sending the obtained candidate fingerprint digest to the client so that the client can determine the target user based on the candidate fingerprint digest.
[0068] In other words, the server (or BMC) in this embodiment can also determine the candidate fingerprint digest based on the target operation information sent by the client, and then the client can confirm the target user based on the determined candidate fingerprint digest, thereby achieving the purpose of tracing the user who actually performed the operation after a problem occurs.
[0069] Figure 3 This is a schematic diagram according to the third embodiment of this disclosure. (See diagram below.) Figure 3 As shown in the diagram, this embodiment illustrates a flowchart of the process of recording user operations between the client and server. This embodiment uses the client sending a command to the BMC in the server as an example: S301, the client obtains the target fingerprint digest of the current user based on the current user's login information; S302, the client sends the target fingerprint digest to the BMC; S303, the BMC performs session authentication with the client based on the target fingerprint digest; S304, in response to confirming successful session authentication, a session is established between the client and the BMC; S305, the BMC obtains the target operation table corresponding to the target fingerprint digest; S306, the client sends a command to be executed to the BMC through the established session; S307, after executing the command to be executed, the BMC records the operation information in the target operation table; S308, the client sends the target operation time to the BMC; S309, the BMC determines the candidate fingerprint digest based on the target operation time; S310, the BMC sends the candidate fingerprint digest to the client; S311, the client determines the target user based on the candidate fingerprint digest.
[0070] In other words, in this embodiment, the client sends the target fingerprint digest corresponding to the current user to the BMC, so that the BMC can record the current user's operation information into the target operation table corresponding to the target fingerprint digest. Thus, when tracing the actual user in the future, the server can determine the fingerprint digest of the actual user based on the corresponding operation information, and then the client can determine the target user based on the determined fingerprint digest, thereby achieving the purpose of tracing the client user who actually issued the command.
[0071] Figure 4 This is a schematic diagram according to the fourth embodiment of this disclosure. (See diagram below.) Figure 4 As shown, the user operation recording device 400 in this embodiment is located on the client side and includes:
[0072] Processing unit 401 is used to obtain the target fingerprint digest of the current user based on the current user's login information;
[0073] The first sending unit 402 is used to send the target fingerprint digest to the server, so that the server can perform session authentication with the client based on the target fingerprint digest and establish a session with the client. The target fingerprint digest is also used by the server to obtain the target operation table corresponding to the current user.
[0074] The second sending unit 403 is used to send the command to be executed issued by the current user to the server through the session, so that the server can record the operation information of the command to be executed into the target operation table.
[0075] The processing unit 401 can first obtain a preset fingerprint digest table, which includes different login information and fingerprint digests corresponding to different login information. Different login information corresponds to different users. Then, it can obtain the fingerprint digest in the fingerprint digest table that corresponds to the login information of the current user as the target fingerprint digest.
[0076] In other words, the processing unit 401 can obtain the target fingerprint digest corresponding to the current user according to the preset fingerprint digest table, which can improve the acquisition speed of the target fingerprint digest.
[0077] In this embodiment, the fingerprint digest table used by the processing unit 401 can be pre-generated in the following manner: obtaining a user list; for each user in the user list, using a preset digital signature algorithm, obtaining the user fingerprint of the user based on the user's login information; using a hash algorithm, converting the user fingerprint of each user into a fingerprint digest of a preset length; and obtaining a fingerprint digest table based on the login information of each user and the fingerprint digest of each user.
[0078] The preset digital signature algorithm in this embodiment is the Ed25519 algorithm. The Ed25519 algorithm is used to sign the input string to obtain a digital signature with a length of 256 bytes. The Ed25519 algorithm has higher security and faster signing and verification speed. The user fingerprint obtained in this embodiment is the 256-byte digital signature obtained by the Ed25519 algorithm.
[0079] It is understood that the preset digital signature algorithm can also be ECDSA-256 or RSA-4096. This embodiment does not limit the type of preset digital signature algorithm.
[0080] In this embodiment, the preset length is 16 bytes. That is, the processing unit 401 uses a hash algorithm to convert the 256-byte user fingerprint into a 16-byte digest, and uses the conversion result as the fingerprint digest for different users.
[0081] The processing unit 401 may further include the following: in response to determining that there is no fingerprint digest in the fingerprint digest table corresponding to the login information of the current user, generating the user fingerprint of the current user based on the login information using a preset digital signature algorithm; converting the user fingerprint of the current user into a digest of a preset length using a hash algorithm, and using the conversion result as the target fingerprint digest.
[0082] In other words, after determining that there is no fingerprint digest corresponding to the current user in the fingerprint digest table, the processing unit 401 generates the target fingerprint digest in real time based on the current user's login information, thus avoiding the problem of not being able to obtain the target fingerprint digest.
[0083] If the processing unit 401 generates a target fingerprint digest corresponding to the current user in real time, it can also record the current user's login information and the generated target fingerprint digest in the fingerprint digest table to avoid the current user needing to generate a fingerprint digest in real time the next time they log in.
[0084] In this embodiment, after the processing unit 401 obtains the target fingerprint digest of the current user, the first sending unit 402 sends the obtained target fingerprint digest to the server so that the server can perform session authentication with the client based on the target fingerprint digest and establish a session with the client; wherein, the client sends the command to be executed issued by the current user to the server through the session.
[0085] In this embodiment, the target fingerprint digest of the current user is used for session authentication between the server and the client, and after authentication, the server uses the target fingerprint digest to obtain the target operation table corresponding to the current user.
[0086] In this embodiment, the session authentication method between the client and the server is a two-way authentication based on RAKP (Remote Attestation Key Protocol), which ensures that the client and the server (or BMC) can verify each other's identities and prevent man-in-the-middle attacks, forged BMCs, or brute-force attacks.
[0087] In order to synchronize the client's user information to the server (or BMC), the first sending unit 402 sends the target fingerprint digest to the server (or BMC) as a 16-byte random number sent by the client to the server (or BMC) in the first phase of RAKP. The client no longer generates a 16-byte random number, so that the server (or BMC) can complete the session authentication of the first phase of RAKP based on the target fingerprint digest sent by the client.
[0088] Since the target fingerprint digest obtained by the processing unit 401 in this embodiment is 16 bytes long, the target fingerprint digest sent by the first sending unit 402 can seamlessly replace the originally generated 16-byte random number, thereby improving the speed of session authentication between the client and the server (or BMC).
[0089] In this embodiment, after the first sending unit 402 sends the target fingerprint digest to the server, the second sending unit sends the command to be executed issued by the current user to the server through the session, so that the server can record the operation information of the command to be executed into the target operation table.
[0090] In this embodiment, the commands to be executed sent by the current user to the server through the client are IPMI (Intelligent Platform Management Interface) commands, including remote power-on commands, remote power-off commands, status viewing commands, remote restart commands, log viewing commands, user management commands, etc.
[0091] In this embodiment, IPMI commands are a set of instructions for out-of-band management of the server using the IPMI protocol. The current user can use the IPMITool in the client to send IPMI commands to the server (or BMC).
[0092] It is understood that in this embodiment, the communication channel used by the client to conduct a session with the server (or BMC) is a LAN (Local Area Network) channel, that is, the client sends IPMI commands to the server (or BMC) through a session established in the LAN channel.
[0093] In this embodiment, after the server (or BMC) completes session authentication with the client, it will also obtain the corresponding target operation table based on the target fingerprint digest sent by the client. The target operation table obtained by the server corresponds to the current user. Therefore, all operations performed by the current user on the server (or BMC) will be recorded in the target operation table, which will facilitate user tracing based on the operation table in the subsequent process.
[0094] In addition, the user operation recording device 400 in this embodiment may also include a first tracing unit 404, which is used to perform the following: acquire target operation information; send the acquired target operation information to a server so that the server can determine a candidate fingerprint digest based on the received target operation information; receive the candidate fingerprint digest sent by the server and determine the target user based on the received candidate fingerprint digest.
[0095] In other words, the client in this embodiment can also confirm the target user based on the obtained target operation information and the user operation table set in the server (or BMC), thereby achieving the purpose of tracing the user who actually performs the operation on the server.
[0096] When the first tracing unit 404 determines the target user based on the received candidate fingerprint digest, it can match the candidate fingerprint digest in the fingerprint digest table to obtain the candidate login information that matches the candidate fingerprint digest in the fingerprint digest table, and then determine the user corresponding to the candidate login information as the target user. In this way, the confirmation of the actual user who caused the specific event can be completed.
[0097] Figure 5 This is a schematic diagram according to the fifth embodiment of this disclosure. (See diagram below.) Figure 5 As shown in the illustration, the user operation recording device 500 of this embodiment is located on a server and includes:
[0098] The receiving unit 501 is used to receive a target fingerprint digest sent by the client and perform session authentication with the client based on the target fingerprint digest;
[0099] Response unit 502 is used to establish a session with the client in response to determining that the session authentication is successful, and to obtain a target operation table corresponding to the target fingerprint digest;
[0100] The execution unit 503 is used to execute the command to be executed sent by the client through the session, and record the operation information of the command to be executed in the target operation table.
[0101] The receiving unit 501 can receive the target fingerprint digest sent by the client through the LAN channel between the receiving unit and the client, and then perform session authentication with the client based on the received target fingerprint digest.
[0102] In this embodiment, when the server (or BMC) and the client perform two-way authentication based on the RAKP protocol, only the 16-byte random number sent by the client to the server (or BMC) in the first stage of RAKP is changed. That is, the server (or BMC) uses the target fingerprint digest (16 bytes in length) sent by the client to perform the first stage of RAKP authentication. No improvements have been made to the other authentication stages.
[0103] In this embodiment, after the receiving unit 501 performs session authentication with the client based on the target fingerprint digest, the response unit 502, in response to confirming that the session authentication is successful, establishes a session with the client and obtains the target operation table corresponding to the target fingerprint digest.
[0104] If the response unit 502 determines that the session authentication with the client is successful, the session with the client is successfully established, and then the target operation table corresponding to the target fingerprint digest is obtained. The obtained target operation table corresponds to the current user of the client.
[0105] It is understood that the response unit 502 can temporarily store the target fingerprint digest, for example, in a temporary fingerprint digest table in the server (or BMC); if the session authentication between the server and the client is successful, the response unit 502 retrieves the target fingerprint digest from the temporary fingerprint digest table, and then retrieves the target operation table corresponding to the target fingerprint digest.
[0106] When the response unit 502 obtains the target operation table corresponding to the target fingerprint digest, it can adopt the following implementation method: obtain a user operation table set, which includes fingerprint digests and their corresponding user operation tables, with different fingerprint digests corresponding to different user operation tables; obtain the user operation table in the user operation table set that corresponds to the target fingerprint digest, as the target operation table, which records the operation information of the current user on the server (or BMC).
[0107] The response unit 502 may also perform the following: in response to determining that there is no user operation table in the user operation table set corresponding to the target fingerprint digest, create a user operation table in the user operation table set corresponding to the target fingerprint digest; and use the created user operation table as the target operation table.
[0108] In this embodiment, the user operation table includes multiple rows of information. Each row records the operation information when a user operates the server once. The operation information includes the operation command, operation time, and operation result, thereby achieving the purpose of recording the operations performed by different users on the server (or BMC) through user operation tables corresponding to different users.
[0109] In this embodiment, after the response unit 502 establishes a session with the client and obtains the target operation table corresponding to the target fingerprint digest, the execution unit 503 executes the command to be executed sent by the client through the session and records the operation information of the command to be executed into the target operation table.
[0110] The execution unit 503 first determines the IPMI command to be executed based on the payload in the command to be executed sent by the client, then executes the determined IPMI command, and then records the operation command word, operation time and operation result corresponding to the IPMI command as the operation information corresponding to the command to be executed into the acquired target operation table.
[0111] Therefore, in this embodiment, after each time the server (or BMC) receives a command to be executed from the client via the LAN channel, it records the operation information corresponding to the command in the corresponding user operation table, so that the user who actually performs the operation can be identified in the future.
[0112] In addition, the user operation recording device 500 of this embodiment may also include a second tracing unit 504, which is used to perform the following: receiving target operation information sent by the client; obtaining a user operation table including the target operation information as a candidate operation table, that is, matching the target operation information with the operation information in each user operation table of the user operation table set, and using the matched user operation table as a candidate operation table; obtaining a fingerprint digest corresponding to the candidate operation table as a candidate fingerprint digest; and sending the obtained candidate fingerprint digest to the client so that the client can determine the target user based on the candidate fingerprint digest.
[0113] In other words, the second tracing unit 504 can also determine the candidate fingerprint digest based on the target operation information sent by the client, and then the client can confirm the target user based on the determined candidate fingerprint digest, thereby achieving the purpose of tracing the user who actually performed the operation after a problem occurs.
[0114] The acquisition, storage, and application of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.
[0115] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.
[0116] like Figure 6 The diagram shown is a block diagram of an electronic device for recording a user operation method according to an embodiment of the present disclosure. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.
[0117] like Figure 6 As shown, device 600 includes a computing unit 601, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 602 or a computer program loaded from storage unit 608 into random access memory (RAM) 603. RAM 603 may also store various programs and data required for the operation of device 600. The computing unit 601, ROM 602, and RAM 603 are interconnected via bus 604. Input / output (I / O) interface 605 is also connected to bus 604.
[0118] Multiple components in device 600 are connected to I / O interface 605, including: input unit 606, such as keyboard, mouse, etc.; output unit 607, such as various types of displays, speakers, etc.; storage unit 608, such as disk, optical disk, etc.; and communication unit 609, such as network card, modem, wireless transceiver, etc. Communication unit 609 allows device 600 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.
[0119] The computing unit 601 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 601 performs the various methods and processes described above, such as the method of recording user operations. For example, in some embodiments, the method of recording user operations may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 608.
[0120] In some embodiments, part or all of the computer program may be loaded and / or installed onto the device 600 via ROM 602 and / or communication unit 609. When the computer program is loaded into RAM 603 and executed by computing unit 601, one or more steps of the user operation recording method described above may be performed. Alternatively, in other embodiments, computing unit 601 may be configured to perform the user operation recording method by any other suitable means (e.g., by means of firmware).
[0121] Various implementations of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transferring data and instructions to the storage system, the at least one input device, and the at least one output device.
[0122] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to the processor or controller of a general-purpose computer, special-purpose computer, or other programmable user-operated recording device, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.
[0123] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.
[0124] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for showing information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).
[0125] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.
[0126] Computer systems can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is established by computer programs running on the respective computers and having a client-server relationship with each other. A server can be a cloud server, also known as a cloud computing server or cloud host, a hosting product within the cloud computing service ecosystem, addressing the shortcomings of traditional physical hosts and VPS (Virtual Private Server, or simply "VPS") services, such as high management difficulty and weak business scalability. Servers can also be servers for distributed systems or servers incorporating blockchain technology.
[0127] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.
[0128] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.
Claims
1. A method for recording user actions, executed on a client, comprising: Based on the current user's login information, obtain the target fingerprint digest of the current user; The target fingerprint digest is sent to the server for the server to perform session authentication with the client based on the target fingerprint digest and establish a session with the client. The target fingerprint digest is also used by the server to obtain the target operation table corresponding to the current user. The command to be executed issued by the current user is sent to the server through the session, so that the server can record the operation information of the command to be executed into the target operation table.
2. The method according to claim 1, wherein, The step of obtaining the target fingerprint digest of the current user based on the current user's login information includes: Obtain the fingerprint digest table; Obtain the fingerprint digest corresponding to the login information of the current user from the fingerprint digest table, and use it as the target fingerprint digest.
3. The method according to claim 2, further comprising: Get the user list; For each user in the user list, a preset digital signature algorithm is used to obtain the user's fingerprint based on the user's login information; A hash algorithm is used to convert each user's fingerprint into a fingerprint digest of a preset length. The fingerprint digest table is obtained based on each user's login information and each user's fingerprint digest.
4. The method according to claim 2, further comprising: In response to determining that there is no fingerprint digest in the fingerprint digest table that corresponds to the login information of the current user, a preset digital signature algorithm is used to generate the user fingerprint of the current user based on the login information; Using a hash algorithm, the current user's fingerprint is converted into a fingerprint digest of a preset length, and the conversion result is used as the target fingerprint digest.
5. The method according to claim 1, wherein, The target fingerprint digest is used for the first phase of the Remote Authentication Key Protocol (RAKP) session authentication between the server and the client.
6. The method according to claim 1, further comprising: Obtain target operation information; The target operation information is sent to the server so that the server can determine the candidate fingerprint digest based on the target operation information; The system receives the candidate fingerprint digest sent by the server and determines the target user based on the candidate fingerprint digest.
7. A method for recording user actions, executed on a server, comprising: Receive the target fingerprint digest sent by the client, and perform session authentication with the client based on the target fingerprint digest; In response to confirming successful session authentication, a session is established with the client, and a target operation table corresponding to the target fingerprint digest is obtained; Execute the command to be executed sent by the client through the session, and record the operation information of the command to be executed in the target operation table.
8. The method according to claim 7, wherein, The step of performing session authentication with the client based on the target fingerprint digest includes: Using the target fingerprint digest, perform the first phase of the Remote Proof Key Protocol (RAKP) session authentication with the client.
9. The method according to claim 7, wherein, The target operation table for obtaining the corresponding target fingerprint digest includes: Get the user operation table set; Obtain the user operation table corresponding to the target fingerprint digest from the user operation table set, and use it as the target operation table.
10. The method of claim 9, further comprising: In response to determining that there is no user operation table in the user operation table set that corresponds to the target fingerprint digest, a user operation table corresponding to the target fingerprint digest is created in the user operation table set. The created user operation table will be used as the target operation table.
11. The method of claim 7, further comprising: Receive the target operation information sent by the client; Obtain a user operation table including the target operation information as a candidate operation table; Obtain the fingerprint digest corresponding to the candidate operation table, and use it as the candidate fingerprint digest; The candidate fingerprint digest is sent to the client so that the client can determine the target user based on the candidate fingerprint digest.
12. A user operation recording device, located on a client side, comprising: The processing unit is used to obtain the target fingerprint digest of the current user based on the current user's login information; The first sending unit is used to send the target fingerprint digest to the server, so that the server can perform session authentication with the client based on the target fingerprint digest and establish a session with the client. The target fingerprint digest is also used by the server to obtain the target operation table corresponding to the current user. The second sending unit is used to send the command to be executed issued by the current user to the server through the session, so that the server can record the operation information of the command to be executed into the target operation table.
13. A user operation recording device, located on a server, comprising: A receiving unit is configured to receive a target fingerprint digest sent by a client and perform session authentication with the client based on the target fingerprint digest. A response unit is configured to, in response to the determination that session authentication is successful, establish a session with the client and obtain a target operation table corresponding to the target fingerprint digest; The execution unit is used to execute the command to be executed sent by the client through the session and record the operation information of the command to be executed in the target operation table.
14. An electronic device, comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-11.
15. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-11.
16. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1-11.