Authentication management method of a server's BMC and related device

Abstract

The application relates to the field of communication technology, in particular to a BMC authentication management method of a server and related devices. The method comprises the following steps: in response to a login request of a target user to the BMC, calling a Kerberos module through a PAM framework, storing connection parameters of a KDC and a key of the BMC by the BMC; performing service identity authentication based on the key of the BMC, the connection parameters and the KDC; if the service identity authentication is successful, performing user identity authentication based on identity credentials and the KDC; if the user identity authentication is successful, obtaining and using a TGT to request an ST for accessing a directory service from the KDC; querying the directory service by using the ST to obtain group membership information of the target user; and determining access rights of the target user to the BMC according to the group membership information and a predefined mapping rule. The application integrates Kerberos based on the PAM framework, provides a two-way authentication function, and effectively improves security.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a method and apparatus for BMC authentication management of a server. Background Technology

[0002] In the context of the rapid development of artificial intelligence technology, servers, as the core devices supporting this explosive growth in computing power demand, have become more crucial than ever before. As the scale and complexity of AI models continue to increase, the demand for computing resources has reached new heights. This necessitates that servers not only possess powerful processing capabilities but also ensure extremely high security and reliability to protect sensitive data and maintain service continuity. As a key component for remote management and monitoring within the server, the Baseboard Management Controller (BMC) faces paramount security requirements.

[0003] Related technologies use external user servers such as Lightweight Directory Access Protocol (LDAP) or Active Directory (AD) for centralized authentication. This authentication method usually only verifies the user's identity and ignores the authenticity of the server-side BMC. This one-way authentication method makes man-in-the-middle attacks possible. Attackers can deceive users and steal credentials by forging the identity of the server. Summary of the Invention

[0004] To address the technical problem of low output current control accuracy in the dual-control structure of related technologies, embodiments of the present invention provide a power circuit control method, related devices, and a computer-readable storage medium.

[0005] The first aspect of this invention provides an authentication management method for a server's BMC, comprising:

[0006] In response to the target user's login request to the BMC, the Kerberos module is called through the PAM framework. The login request includes the identity credentials corresponding to the target user, and the BMC stores the connection parameters of the Kerberos key distribution center and the key of the BMC.

[0007] Service identity authentication is performed based on the BMC key, the connection parameters, and the Kerberos key distribution center;

[0008] If the service identity authentication is successful, user authentication is performed based on the identity credentials and the Kerberos key distribution center;

[0009] If the user's identity authentication is successful, the user obtains and uses the ticket grant ticket issued by the Kerberos Key Distribution Center to request a service ticket for accessing the directory service from the Kerberos Key Distribution Center.

[0010] Use the service ticket to query the directory service to obtain the target user's group member identity information;

[0011] The access rights of the target user to the BMC are determined based on the group member identity information and predefined mapping rules, wherein the mapping rules are the correspondence between the group member identity information and the access rights of the BMC.

[0012] A second aspect of this invention provides an authentication management device for a server's BMC, comprising:

[0013] The calling unit is used to respond to the login request of the target user to the BMC and call the Kerberos module through the PAM framework. The login request includes the identity credentials corresponding to the target user, and the BMC stores the connection parameters of the Kerberos key distribution center and the key of the BMC.

[0014] The service authentication unit is used to perform service authentication based on the BMC key, the connection parameters, and the Kerberos key distribution center.

[0015] The user authentication unit is used to perform user authentication based on the identity credentials and the Kerberos key distribution center if the service identity authentication is successful.

[0016] The request unit is used to obtain and use the ticket grant ticket issued by the Kerberos key distribution center to request a service ticket for accessing the directory service if the user authentication is successful.

[0017] The query unit is used to query the directory service using the service ticket to obtain the group member identity information of the target user;

[0018] The determining unit is configured to determine the access rights of the target user to the BMC based on the group member identity information and a predefined mapping rule, wherein the mapping rule is the correspondence between the group member identity information and the access rights of the BMC.

[0019] A third aspect of the present invention provides a computer device including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method described in the first aspect above.

[0020] A fourth aspect of the present invention provides a computer program product, including instructions, characterized in that, when executed by a processor, the instructions implement the steps of the method described in the first aspect above.

[0021] A fifth aspect of the present invention provides a computer-readable storage medium including instructions that, when executed on a computer, cause the computer to perform the steps of the method described in the first aspect.

[0022] Compared to related technologies, the BMC authentication management method of the server in this embodiment of the invention is based on the PAM framework and integrates Kerberos, providing two-way authentication functionality. It verifies the authenticity of the BMC based on the BMC's key, connection parameters, and the Kerberos key distribution center, and verifies the identity of the target user based on identity credentials and the Kerberos key distribution center, thereby effectively defending against man-in-the-middle attacks and other types of network eavesdropping. Simultaneously, it integrates with a directory service, granting a ticket request service ticket through a ticket obtained after user authentication to confirm the target user's access rights to the BMC, thus achieving user management and access control. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort, wherein:

[0024] Figure 1 A flowchart illustrating a power circuit control method provided in an embodiment of the present invention;

[0025] Figure 2 A timing diagram of the authentication management method of the server's BMC provided in an embodiment of the present invention;

[0026] Figure 3 A schematic diagram illustrating the contents of the PAM configuration file provided in an embodiment of the present invention;

[0027] Figure 4 This is a schematic diagram of the hardware structure of the server provided in an embodiment of this application. Detailed Implementation

[0028] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] It should be noted that, in the embodiments of the present invention, the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowcharts, in some cases the steps shown or described may be executed in a different order than that shown here.

[0030] First, some terms used in the embodiments of this invention will be explained:

[0031] BMC (Baseboard Management Controller): The baseboard management controller is responsible for server hardware monitoring and remote management.

[0032] PAM (Pluggable Authentication Modules): A framework for flexibly managing user authentication and authorization, supporting multiple authentication methods and improving system security.

[0033] LDAP (Lightweight Directory Access Protocol): An open standard application layer protocol used to access and maintain distributed directory information services.

[0034] Active Directory (AD): Active Directory is a directory service provided by Microsoft, primarily used for Windows domain networks. It enables administrators to manage a group of users and computers on a network and control their access permissions to network resources.

[0035] SID (Security Identifier): A security identifier is a unique number that identifies a user, group, and computer account. A unique SID is assigned to each account on the network when it is first created.

[0036] Keytab file: Used to authenticate principals (users or services) without requiring a password; stores Kerberos credentials.

[0037] KDC (Key Distribution Center): The key distribution center is the core component of the Kerberos system. It is responsible for managing the keys of all entities and issuing tickets. It consists of AS and TGS.

[0038] AS (Authentication Server): An authentication server that authenticates user identities and issues TGTs to them.

[0039] TGT (Ticket Granting Ticket): A ticket granting ticket that allows a user to obtain a ticket for a specific service from the TGS.

[0040] TGS (Ticket Granting Service): The ticket granting server, responsible for issuing STs.

[0041] ST (Server Ticket): Service ticket.

[0042] GSS-API (Generic Security Services Application Program Interface): A SASL mechanism that can rely on TGT for authentication.

[0043] The following explanation focuses on the authentication management method of the server's BMC from the perspective of the server's BMC authentication management device. The authentication management device of the server's BMC can be the server itself or a service unit within the server; no specific limitation is made.

[0044] Please see Figure 1 and Figure 2 ,in, Figure 1 This is a flowchart illustrating a server BMC authentication management method according to an embodiment of the present invention. Figure 2 A timing diagram of the authentication management method for the BMC of a server provided in an embodiment of the present invention. The authentication management method for the BMC of the server includes:

[0045] 101. Respond to the target user's login request to BMC by calling the Kerberos module through the PAM framework. The login request includes the identity credentials corresponding to the target user. BMC stores the connection parameters of the Kerberos Key Distribution Center (KDC) and the BMC's key (Keytab).

[0046] In this embodiment, the server's BMC authentication management device can respond to a target user's login request to the BMC by calling the Kerberos module through the PAM framework. The target user is someone intending to log in to the BMC and manage the server. The target user can enter their credentials on their user device through the BMC login interface and send a login request. The server's BMC authentication management device then calls the Kerberos module through the PAM framework to perform the authentication steps.

[0047] It is understood that the identity credentials may specifically be the target user's username and password, and the BMC's Keytab is the key generated by the KDC for the BMC.

[0048] The PAM framework is the security subsystem of the BMC operating system. It separates the services provided by the system from their authentication methods by providing dynamic link libraries and application programming interfaces (APIs). This allows system administrators to flexibly configure different authentication methods for different services as needed without modifying the applications, and also facilitates the addition of new authentication methods to the system. By integrating Kerberos into the PAM framework, the BMC's authentication management device on the server can call the Kerberos authentication module.

[0049] The Kerberos Authentication Entity comprises a Kerberos Configuration Module and a Kerberos Authentication Module. The Kerberos Configuration Module allows administrators to configure KDC connection parameters, such as the KDC server's address and domain name. This information is written to the BMC's local configuration file, informing the system of basic Kerberos domain information, such as in krb5.conf. The Kerberos Configuration Module also supports uploading the Keytab generated by the KDC for the BMC; this information is also saved to the BMC's local configuration file, such as krb5.conf.

[0050] The Kerberos configuration module also allows administrators to predefine mapping rules, which define the correspondence between group member identity information and BMC access permissions. These rules map user groups from the Kerberos domain to BMC access permissions, such as "read-only users" and "administrators," and save them to the local BMC configuration file, such as kerberos.conf.

[0051] It is understandable that the group member identity information can specifically be a SID or a group name identifier.

[0052] The Kerberos authentication module is developed based on the PAM framework, ensuring it can be invoked by the BMC login system. It supports Kerberos GSS-API service authentication, completing the Kerberos authentication process by calling GSS-API library functions. The Kerberos authentication module must implement PAM standard interfaces, including pam_sm_authenticate, pam_sm_open_session, and pam_sm_close_session, and integrate the relevant GSS-API dependencies to complete the authentication.

[0053] The `pam_sm_authenticate` interface is responsible for implementing user authentication logic. This interface completes the Kerberos authentication process using the connection parameters configured by the administrator, the Keytab file, and the identity credentials provided by the target user when logging into the BMC. It then obtains group member identity information and determines the target user's access permissions according to mapping rules. The `pam_sm_open_session` and `pam_sm_close_session` interfaces are two core interfaces in the PAM framework used to manage user sessions. They are called when a target user logs in after successful authentication and when the target user logs out, respectively. `pam_sm_open_session` handles session initialization, and `pam_sm_close_session` handles session cleanup. These two interfaces also handle logging to track user login and logout information.

[0054] By compiling the Kerberos configuration module and the Kerberos authentication module into a dynamic link library, the Kerberos authentication unit becomes a standalone "plugin" conforming to the PAM standard. The BMC system can flexibly load or unload this authentication method like replacing a part, without modifying other parts of the system. The dynamic link library is added to the existing PAM configuration via the PAM configuration file, and can then be loaded and used through the PAM framework.

[0055] The PAM configuration file is used to define the PAM authentication mechanism and authentication order, such as... Figure 3 As shown, pam_krb.so is a dynamic link library compiled from the Kerberos configuration module and the Kerberos authentication module. When a user logs into the BMC, the system will call the modules for verification in the order specified in the PAM configuration file.

[0056] In some embodiments, the authentication management method of the server's BMC further includes:

[0057] Receive and save connection parameters, BMC keys, and mapping rules.

[0058] 102. Service identity authentication is performed based on the BMC key (Keytab), connection parameters, and Kerberos Key Distribution Center (KDC).

[0059] In this embodiment, after receiving a login request from a target user, the server's BMC authentication management device loads the PAM configuration and performs authentication according to the PAM authentication mechanism and order defined in the PAM configuration file. The dynamic link libraries compiled from the Kerberos configuration module and the Kerberos authentication module have been added to the PAM configuration and will execute the Kerberos authentication process. The server's BMC authentication management device loads the PAM configuration file, obtains the KDC connection parameters, and can then send an authentication request to the KDC server based on the keytab and connection parameters.

[0060] The connection parameters specifically include the KDC's Realm, FQDN, SecretName, and port number. Service authentication is performed based on the BMC's Keytab, connection parameters, and the KDC, specifically including:

[0061] Send a service identity authentication request to the authentication server (AS). The service identity authentication request includes the subject information encrypted with BMC's Keytab and the BMC's identity information.

[0062] AS decrypts and verifies the service identity authentication request;

[0063] If the decryption verification passes, AS returns a TGT containing the main body information encrypted with the BMC Keytab.

[0064] The TGT is decrypted and verified using BMC's Keytab.

[0065] The main information can be a timestamp.

[0066] In some embodiments, the AS decrypts and verifies the service authentication request, specifically including:

[0067] Search the database for the Keytab that matches the BMC's identity information;

[0068] The BMC Keytab is used to decrypt and verify the subject information in the service authentication request.

[0069] Understandably, if the TGT decryption verification is successful after the above service identity authentication, it proves that the response obtained by the server's BMC authentication management device comes from the real BMC and KDC.

[0070] Understandably, in some embodiments, the PAM configuration file defines multiple authentication mechanisms. Based on their authentication order, a pre-authentication module can be set before the Kerberos module, and a post-authentication module can be set after it. When the server's BMC authentication management device receives a login request from a target user, it will execute the authentication process according to the PAM authentication order, such as... Figure 3As shown, the Kerberos module pam_krb.so has four preceding modules:

[0071] pam_nologin.so: Checks whether the system allows login;

[0072] pam_ipmi.so: IPMI interface module;

[0073] pam_ldap.so: LDAP module;

[0074] pam_ad.so: AD module.

[0075] 103. If the service identity authentication is successful, user authentication will be performed based on the identity credentials and the Kerberos Key Distribution Center (KDC).

[0076] In this embodiment, the server's BMC authentication management device verifies the KDC's identity and then performs user authentication based on the identity credentials and the KDC.

[0077] The identity credentials are the target user's username and password. User authentication is performed based on these credentials and the Kerberos key distribution center, specifically including:

[0078] Send a user authentication request to the AS. The user authentication request includes the subject information and username encrypted with the user's password.

[0079] AS decrypts and verifies the user's authentication request.

[0080] In some embodiments, the AS decrypts and verifies the user authentication request, specifically including:

[0081] Retrieve the user password that matches the username from the database;

[0082] The user's password is used to decrypt and verify the main information in the user authentication request.

[0083] Understandably, after the aforementioned user authentication, AS successfully decrypted the user authentication request, proving that the target user provided the correct username and password.

[0084] 104. If the user's identity authentication is successful, the user obtains and uses the Ticket Granting Ticket (TGT) issued by the Kerberos Key Distribution Center (KDC) to request a Service Ticket (ST) for accessing the directory service from the Kerberos Key Distribution Center (KDC).

[0085] In this embodiment, after the AS successfully decrypts the user authentication request, it returns a TGT encrypted with the TGS key. The TGT contains a login session key encrypted with the user's password. The server's BMC authentication management device uses the TGT to request a service ticket from the KDC for accessing the directory service, which can be LDAP or AD.

[0086] Obtain and use the TGT issued by the KDC to request the ST for accessing the directory service from the KDC, specifically including:

[0087] Send a directory service authentication request to the Ticket Granting Server (TGS). The directory service authentication request includes the TGT, username, and BMC identity information.

[0088] TGS decrypts and verifies TGT;

[0089] If decryption is successful, TGS returns an ST encrypted with the key of the directory service server, which contains a session key encrypted with the login key.

[0090] In some embodiments, the TGS performs decryption verification on the TGT, specifically including:

[0091] The TGT is decrypted and verified using the TGS key.

[0092] Understandably, the AS returns the TGT along with its expiration time, allowing the TGT to be cached locally on the BMC for use before its expiration time, reducing latency from repeated authentication. Each communication is encrypted using a unique session key. In some embodiments, the server's BMC authentication management method further includes:

[0093] The acquired TGT will be cached locally in the BMC.

[0094] 105. Use the service ticket (ST) used to access the directory service to query the directory service to obtain the target user's group membership information.

[0095] In this embodiment, the server's BMC authentication management device uses the ST query directory service to obtain the target user's group membership information. Utilizing the ST query directory service for accessing the directory service to obtain the target user's group membership information specifically includes:

[0096] ST establishes a connection to the directory service server using the Generic Security Services Application Programming Interface (GSS-API);

[0097] Send a query command to the directory service server to obtain the group membership information of the target user.

[0098] Understandably, since ST uses the directory service server's key for encryption, the directory service server decrypts ST upon receiving it, and a secure connection can be established once decryption is successful.

[0099] 106. Determine the target user's access permissions to the BMC based on the group member identity information and predefined mapping rules, wherein the mapping rules are the correspondence between group member identity information and BMC access permissions.

[0100] In this embodiment, after obtaining the group member identity information, the server's BMC authentication management device determines the target user's access permissions to the BMC based on the group member identity information and predefined mapping rules. Specifically, the group member identity information is compared with the mapping rules one by one. When the group member identity information matches the mapping rule entry successfully, the access permissions of the user group to which the target user belongs are confirmed, and the access permissions are granted to the target user.

[0101] Compared to related technologies, the BMC authentication management method of the server in this embodiment of the invention is based on the PAM framework and integrates Kerberos, providing two-way authentication functionality. It verifies the authenticity of the BMC based on the BMC's key, connection parameters, and the Kerberos key distribution center, and verifies the identity of the target user based on identity credentials and the Kerberos key distribution center, thereby effectively defending against man-in-the-middle attacks and other types of network eavesdropping. Simultaneously, it integrates with a directory service, granting a ticket request service ticket through a ticket obtained after user authentication to confirm the target user's access rights to the BMC, achieving flexible user management and access control.

[0102] Strong encryption algorithms are used in service authentication, user authentication, and directory service authentication requests, fully leveraging the powerful features of Kerberos to enhance security and ensure secure communication.

[0103] The present invention has been described above from the perspective of the authentication management method of the server's BMC. The following description focuses on the authentication management device of the server's BMC. Please refer to [link / reference]. Figure 3 This is a virtual structure diagram of the authentication management device 300 for a server's BMC provided in an embodiment of the present invention. The authentication management device 300 for the server's BMC includes:

[0104] Calling unit 301 is used to respond to the target user's login request to BMC. It calls the Kerberos module through the PAM framework. The login request includes the identity credentials corresponding to the target user. BMC stores the connection parameters of Kerberos Key Distribution Center (KDC) and the BMC key (Keytab).

[0105] Service authentication unit 302 is used for service authentication based on the BMC's key (Keytab), connection parameters, and the Kerberos Key Distribution Center (KDC).

[0106] User authentication unit 303 is used to perform user authentication based on identity credentials and Kerberos Key Distribution Center (KDC) if service authentication is successful;

[0107] Request unit 304 is used to obtain and use the Ticket Granting Ticket (TGT) issued by the Kerberos Key Distribution Center (KDC) to request a service ticket (ST) for accessing the directory service if the user authentication is successful.

[0108] The query unit 305 is used to query the directory service using the service ticket (ST) used to access the directory service in order to obtain the group membership information of the target user;

[0109] The determining unit 306 is used to determine the access rights of the target user to the BMC based on the group member identity information and a predefined mapping rule, wherein the mapping rule is the correspondence between the group member identity information and the access rights of the BMC.

[0110] In one possible design, the server's BMC authentication management device 300 also includes:

[0111] The storage unit is used to receive and save connection parameters, BMC keys, and mapping rules.

[0112] In one possible design, the connection parameters specifically include the KDC's Realm, FQDN, SecretName, and port number, and the service authentication unit 302 is specifically used for:

[0113] Send a service identity authentication request to the authentication server (AS). The service identity authentication request includes the subject information encrypted with BMC's Keytab and the BMC's identity information.

[0114] AS decrypts and verifies the service identity authentication request;

[0115] If the decryption verification passes, AS returns a TGT containing the main body information encrypted with the BMC Keytab.

[0116] The TGT is decrypted and verified using BMC's Keytab.

[0117] The main information can be a timestamp.

[0118] In one possible design, the service authentication unit 302 is also specifically used for:

[0119] Search the database for the Keytab that matches the BMC's identity information;

[0120] The BMC Keytab is used to decrypt and verify the subject information in the service authentication request.

[0121] In one possible design, the user authentication unit 303 is used for:

[0122] Send a user authentication request to the AS. The user authentication request includes the subject information and username encrypted with the user's password.

[0123] AS decrypts and verifies the user's authentication request.

[0124] In one possible design, the user authentication unit 303 is also specifically used for:

[0125] Retrieve the user password that matches the username from the database;

[0126] The user's password is used to decrypt and verify the main information in the user authentication request.

[0127] In one possible design, after the AS successfully decrypts the user authentication request, it returns a TGT encrypted with the TGS key. The TGT contains a session key encrypted with the user's password. Request unit 304 is specifically used for:

[0128] Send a directory service authentication request to the Ticket Granting Server (TGS). The directory service authentication request includes the TGT, username, and BMC identity information.

[0129] TGS decrypts and verifies TGT;

[0130] If decryption is successful, TGS returns an ST encrypted with the key of the directory service server, which contains a session key encrypted with the login key.

[0131] In one possible design, request unit 304 is further used for:

[0132] The TGT is decrypted and verified using the TGS key.

[0133] In one possible design, the storage unit is also used for:

[0134] The acquired TGT will be cached locally in the BMC.

[0135] In one possible design, query unit 305 is specifically used for:

[0136] ST establishes a connection to the directory service server using the Generic Security Services Application Programming Interface (GSS-API);

[0137] Send a query command to the directory service server to obtain the group membership information of the target user.

[0138] Figure 4 This is a schematic diagram of the server structure in this application, as shown below. Figure 4 As shown, the server 400 in this embodiment includes at least one processor 401, at least one network interface 404 or other user interface 403, a memory 405, and at least one communication bus 402. The server 400 may optionally include the user interface 403, including a display, keyboard, or clicking device. The memory 405 may include high-speed RAM, or it may also include non-volatile memory, such as at least one disk drive. The memory 405 stores execution instructions. When the server 400 is running, the processor 401 communicates with the memory 405, and the processor 401 calls the instructions stored in the memory 405 to execute the aforementioned method for determining the number of triangles in a disk-based data graph. The operating system 806 contains various programs for implementing various basic services and handling hardware-based tasks.

[0139] The server provided in this embodiment of the invention can execute the technical solution of the above-described server BMC authentication management method embodiment. Its implementation principle and technical effect are similar, and will not be repeated here.

[0140] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the BMC authentication management method of the above-mentioned server.

[0141] This invention also provides a computer program or a computer program product including a computer program, the computer program comprising instructions that, when executed on a computer, will cause the computer to implement the method flow related to the authentication management device of the server's BMC in any of the above method embodiments. Correspondingly, the computer can be the aforementioned authentication management device of the server's BMC.

[0142] This invention also provides a computer-readable storage medium storing a computer program thereon. When executed by a computer, this computer program implements the method flow related to the authentication management device of the server's BMC in any of the above method embodiments. Correspondingly, the computer can be the authentication management device of the server's BMC.

[0143] In the above Figure 1In the illustrated embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0144] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0145] It should be understood that the processor mentioned in this application can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0146] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A method for authentication management of a server's BMC, characterized in that, include: In response to the target user's login request to the BMC, the Kerberos module is called through the PAM framework. The login request includes the identity credentials corresponding to the target user. The BMC stores the connection parameters of the Kerberos key distribution center and the key of the BMC. The Kerberos module is a dynamic link library obtained by compiling the Kerberos authentication module and the Kerberos configuration module. The dynamic link library is added to the PAM configuration through the PAM configuration file. Service identity authentication is performed based on the BMC key, the connection parameters, and the Kerberos key distribution center; If the service identity authentication is successful, user authentication is performed based on the identity credentials and the Kerberos key distribution center; If the user's identity authentication is successful, the user obtains and uses the ticket grant ticket issued by the Kerberos Key Distribution Center to request a service ticket for accessing the directory service from the Kerberos Key Distribution Center. Use the service ticket to query the directory service to obtain the target user's group member identity information; The access rights of the target user to the BMC are determined based on the group member identity information and predefined mapping rules, wherein the mapping rules are the correspondence between the group member identity information and the access rights of the BMC.

2. The method according to claim 1, characterized in that, Also includes: The acquired ticket is granted to the ticket in the local cache of the BMC.

3. The method according to claim 2, characterized in that, The step of querying the directory service using the service ticket to obtain the target user's group membership information includes: A connection to the directory service server is established using the service ticket via the general security service application programming interface; Send a query command to the directory service server to obtain the group member identity information of the target user.

4. The method according to claim 2, characterized in that, The Kerberos module includes the pam_sm_authenticate interface, the pam_sm_open_session interface, and the pam_sm_close_session interface. The pam_sm_authenticate interface is used to perform the service authentication and the user authentication, the pam_sm_open_session interface is used to initialize the session, and the pam_sm_close_session interface is used to clean up the session.

5. The method according to claim 1, characterized in that, Also includes: Receive and save the connection parameters, the BMC key, and the mapping rules.

6. An authentication management device for a server's BMC, characterized in that, include: The calling unit is used to respond to the login request of the target user to the BMC, and calls the Kerberos module through the PAM framework. The login request includes the identity credentials corresponding to the target user. The BMC stores the connection parameters of the Kerberos key distribution center and the key of the BMC. The Kerberos module is a dynamic link library obtained by compiling the Kerberos authentication module and the Kerberos configuration module. The dynamic link library is added to the PAM configuration through the PAM configuration file. The service authentication unit is used to perform service authentication based on the BMC key, the connection parameters, and the Kerberos key distribution center. The user authentication unit is used to perform user authentication based on the identity credentials and the Kerberos key distribution center if the service identity authentication is successful. The request unit is used to obtain and use the ticket grant ticket issued by the Kerberos key distribution center to request a service ticket for accessing the directory service if the user authentication is successful. The query unit is used to query the directory service using the service ticket to obtain the group member identity information of the target user; The determining unit is configured to determine the access rights of the target user to the BMC based on the group member identity information and a predefined mapping rule, wherein the mapping rule is the correspondence between the group member identity information and the access rights of the BMC.

7. A computer device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the functional program corresponding to the authentication management method of the BMC of the server according to any one of claims 1 to 5.

8. A computer program product, comprising instructions, characterized in that, When executed by the processor, this instruction implements the authentication management method of the server's BMC as described in any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that, It includes instructions that, when executed on a computer, cause the computer to perform the authentication management method of the BMC of the server as described in any one of claims 1 to 5.

Images