Account control and isolated access system and method for computing power resources

Abstract

The invention relates to the technical field of computing power resource management and control, and discloses an account management and control and isolated access system and method for computing power resources. The method comprises the following steps: generating an account resource allocation record according to an account resource allocation request, and establishing a corresponding container isolation access channel or a virtual machine remote desktop access channel based on a target resource type; driving a physical machine dimension account life cycle control and container isolation access channel and a virtual machine remote desktop access channel to execute establishment and recovery based on the starting and ending time of the account resource allocation record; and when the connection request is initiated, performing comparison verification, if the current moment is in the start-stop time interval, releasing the connection request, otherwise, blocking the connection request. According to the method, the technical problems that in the prior art, three resource form account management and control systems are split, time window fine control is lacked, and isolation access channels are not uniform are solved, and safety isolation and compliance management and control in a multi-user concurrent use scene are effectively guaranteed.

Description

Technical Field

[0001] This invention relates to the field of computing power resource management technology, and in particular to an account management and isolation access system and method for computing power resources. Background Technology

[0002] In the field of computing resource management, physical machines, containers, and virtual machines are the three mainstream forms of computing resources. In existing technologies, each of these three resource forms relies on an independent account management system: physical machines rely on administrators to manually execute operating system user creation and deletion commands, containers rely on pre-configured user settings within the image, and virtual machines rely on VNC clients for point-to-point independent connection management. There is no unified account abstraction layer or lifecycle control mechanism among the three.

[0003] At the resource allocation and management level, existing technologies lack fine-grained access control capabilities based on time windows. Administrators cannot achieve timely allocation and automatic reclamation of computing resources, and accounts remain in the operating system long after the resource usage period expires, leading to persistent security risks. Furthermore, for multiple allocation requests on the same physical host, existing technologies lack effective time interval conflict detection mechanisms, posing a risk of duplicate resource allocation. At the isolated access level, the three access channels—physical machine SSH protocol, container Web Terminal protocol, and virtual machine VNC protocol—are fragmented, lacking a unified isolated access control entry point. In multi-user concurrent usage scenarios, unified time-sensitivity control of access sessions cannot be achieved at the platform level, and security isolation cannot be guaranteed. Summary of the Invention

[0004] The main objective of this invention is to provide an account management and isolation access system and method for computing resources. This invention solves the technical problems of fragmented account management systems for three types of resources, lack of fine-grained control of time windows, and inconsistent isolation access channels in the prior art, and effectively ensures security isolation and compliance management in multi-user concurrent usage scenarios.

[0005] To achieve the above objectives, this invention provides a method for account management and isolated access to computing resources, comprising the following steps: Generate account resource allocation records based on account resource allocation requests, and establish corresponding container isolation access channels or virtual machine remote desktop access channels based on the target resource type; Based on the start and end times of the account resource allocation records, the system drives the physical machine dimension account lifecycle management and the establishment and recycling of the container isolation access channel and the virtual machine remote desktop access channel. When a connection request is initiated, the current time of the connection request is compared and verified with the start and end times. If the current time is within the start and end time interval, the connection request is allowed; otherwise, the connection request is blocked.

[0006] Optionally, in a first implementation of the first aspect of the present invention, the step of generating an account resource allocation record based on the account resource allocation request and establishing a corresponding container isolation access channel or virtual machine remote desktop access channel based on the target resource type includes: Perform overlap detection between all valid allocation records of the target physical host and the account resource allocation request to generate an account resource allocation record; Based on the account resource allocation records, a container isolation access channel and a virtual machine remote desktop access channel are established.

[0007] Optionally, in a second implementation of the first aspect of the present invention, after performing overlap detection on all valid allocation records of the target physical host and account resource allocation requests to generate account resource allocation records, the method further includes: An SSH channel is established based on the administrator username and the AES-decrypted administrator password of the target physical host. A Linux system account creation command is sent to the target physical host through the SSH channel, and a Linux system account with the account name as the identifier and its home directory are created in the operating system of the target physical host. The account password, decrypted by AES, from the account resource allocation record is written into the authentication configuration of the Linux system account through the SSH channel; When the expiration time of the account resource allocation record arrives, a Linux system account deletion command is sent to the target physical host through the SSH channel to delete the Linux system account and its home directory from the operating system of the target physical host.

[0008] Optionally, in a third implementation of the first aspect of the present invention, establishing a container isolation access channel and a virtual machine remote desktop access channel based on the account resource allocation record includes: Based on the account resource allocation record, an exec creation request is initiated to the container resource, and the WebSocket message stream of the user's browser is bidirectionally bound to the standard input and output stream of the bash process within the container resource to establish a container isolation access channel. Based on the account resource allocation record, the system receives the WebSocket connection initiated by the user's browser, converts the WebSocket connection into a VNC data stream, routes it to the VNC port of the virtual machine resource, and establishes a virtual machine remote desktop access channel.

[0009] Optionally, in a fourth implementation of the first aspect of the present invention, the step of initiating an exec creation request to the container resource based on the account resource allocation record and bidirectionally binding the WebSocket message stream of the user's browser with the standard input / output stream of the bash process within the container resource to establish a container-isolated access channel includes: An exec creation request is initiated to the container resource via the Docker Exec API, AttachStdin, AttachStdout, and AttachStderr are all enabled and Tty is set to true, thereby obtaining a pseudo-terminal exec session bound to the bash process within the container resource. The WebSocket message stream sent by the user's browser is written into the standard input stream of the pseudo-terminal exec session, and the standard output stream and standard error stream of the pseudo-terminal exec session are sent back to the xterm.js terminal interface of the user's browser via WebSocket for rendering, thus establishing a container-isolated access channel.

[0010] Optionally, in a fifth implementation of the first aspect of the present invention, the step of receiving a WebSocket connection initiated by the user's browser based on the account resource allocation record, converting the WebSocket connection into a VNC data stream and routing it to the VNC port of the virtual machine resource to establish a virtual machine remote desktop access channel includes: The noVNC proxy service receives WebSocket connections initiated by the user's browser and converts the WebSocket connections into VNC data streams. The VNC data stream is routed to the VNC port of the virtual machine resource corresponding to the account resource allocation record. The graphical desktop frame buffer data of the virtual machine resource is rendered in the noVNC client interface of the user's browser to establish a virtual machine remote desktop access channel.

[0011] Optionally, in the sixth implementation of the first aspect of the present invention, the step of driving the physical machine-level account lifecycle management and the establishment and reclamation of the container isolation access channel and the virtual machine remote desktop access channel based on the start and end time of the account resource allocation record includes: Register to start a task and delete a task upon expiration; When the start time of the account resource allocation record arrives, the task triggers the Linux system account creation instruction at the physical machine level, the establishment of the container isolation access channel, or the establishment of the virtual machine remote desktop access channel. When the expiration deletion task reaches the termination time of the account resource allocation record, it triggers the Linux system account deletion command, the recycling of the container isolation access channel, or the recycling of the virtual machine remote desktop access channel.

[0012] Optionally, in a seventh implementation of the first aspect of the present invention, it further includes: Concatenate the account identifier, the IP address of the target physical host, and the start time of the account resource allocation record into a unique key, and submit the start task and the expiration deletion task to the scheduler. When the trigger delay of the start task is less than or equal to zero and the trigger delay of the expired deletion task is greater than zero, the delay scheduling of the start task is skipped, and the Linux system account creation instruction at the physical machine level, the establishment of the container isolation access channel, or the establishment of the virtual machine remote desktop access channel is directly triggered, and the expired deletion task is only registered with the scheduler.

[0013] Optionally, in the eighth implementation of the first aspect of the present invention, when the triggering delay of the start task is less than or equal to zero and the triggering delay of the expired deletion task is greater than zero, the delay scheduling of the start task is skipped, and the Linux system account creation instruction at the physical machine level, the establishment of the container isolation access channel, or the establishment of the virtual machine remote desktop access channel is directly triggered, and the expired deletion task is registered only with the scheduler, including: When the trigger delay of the start task is less than or equal to zero, it is determined that the current time of the connection request is within the start and end time interval of the account resource allocation record, and the Linux system account creation instruction at the physical machine level, the establishment of the container isolation access channel, or the establishment of the virtual machine remote desktop access channel are executed synchronously. The trigger delay is determined based on the termination time. Only expired deletion tasks are registered with the scheduler. When the trigger delay arrives, the Linux system account deletion command, the container isolation access channel recycling, or the virtual machine remote desktop access channel recycling are executed.

[0014] This invention also provides an account management and isolated access system for computing resources, comprising: The channel establishment module is used to generate account resource allocation records based on account resource allocation requests, and to establish corresponding container isolation access channels or virtual machine remote desktop access channels based on the target resource type. The management module is used to drive the physical machine dimension account lifecycle management and the establishment and reclamation of the container isolation access channel and the virtual machine remote desktop access channel based on the start and end time of the account resource allocation record; The comparison and verification module is used to compare and verify the current time of the connection request with the start and end time when the connection request is initiated. If the current time is within the start and end time interval, the connection request is allowed; otherwise, the connection request is blocked.

[0015] In summary, this invention solves the technical problems of fragmented account management systems for three resource types, lack of fine-grained time window control, and inconsistent isolation access channels in existing technologies, resulting in the following beneficial effects: For physical machine resources, the creation and deletion of Linux system accounts are precisely executed at the operating system level through SSH channels. The existence period of the account is strictly limited at the operating system level to the start and end time interval of the allocation record, completely eliminating the security risks of unauthorized access caused by account residue; For container resources, Docker Exec... The API uses a pseudo-terminal mode to bidirectionally bind the WebSocket message stream to the bash process within the container, allowing users to achieve isolated access without installing any local client. Access sessions for different users are independent at the container level. For virtual machine resources, the noVNC proxy service converts WebSocket connections according to the RFB protocol and routes them to the virtual machine's VNC port, achieving graphical desktop isolation access without a local VNC client. At the unified timeliness management level, by registering start and expiration tasks with the scheduler, resource accounts are automatically created and reclaimed at corresponding times. Real-time timeliness verification is performed with each connection request, forming a dual timeliness protection mechanism of automatic reclamation by the scheduling engine and proactive interception of connection requests. This ensures that resource account access permissions are strictly limited to the time window boundaries defined by the allocation record, effectively guaranteeing secure isolation and compliance management in multi-user concurrent usage scenarios. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the steps of an account management and isolated access method for computing resources in one embodiment of the present invention; Figure 2 This is a schematic diagram illustrating the generation of account resource allocation records in an embodiment of the present invention; Figure 3 This is a schematic diagram of overlap detection in an embodiment of the present invention; Figure 4 This is a schematic diagram illustrating the establishment of a container isolation access channel and a virtual machine remote desktop access channel in an embodiment of the present invention; Figure 5 This is a schematic diagram illustrating channel establishment and retrieval in an embodiment of the present invention; Figure 6 This is a schematic diagram illustrating the lifecycle management of account at the physical machine level in an embodiment of the present invention; Figure 7This is a structural block diagram of an account management and isolated access system for computing resources according to an embodiment of the present invention.

[0017] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0019] Reference Figure 1 This embodiment provides a method for account management and isolated access to computing resources, including the following steps: S1, Generate account resource allocation records based on account resource allocation requests, and establish corresponding container isolation access channels or virtual machine remote desktop access channels based on the target resource type; S2, based on the start and end times of account resource allocation records, drives the physical machine dimension account lifecycle management and the establishment and reclamation of container isolation access channels and virtual machine remote desktop access channels; S3: When a connection request is initiated, the current time of the connection request is compared and verified with the start and end times. If the current time is within the start and end time interval, the connection request is allowed; otherwise, the connection request is blocked.

[0020] In one example, such as Figure 2 Based on the account resource allocation request, an account resource allocation record is generated, and a corresponding container isolation access channel or virtual machine remote desktop access channel is established based on the target resource type, including: S21, perform overlap detection on all valid allocation records of the target physical host and the account resource allocation request, and generate account resource allocation records; S22, based on account resource allocation records, establish corresponding container isolation access channels or virtual machine remote desktop access channels.

[0021] In this embodiment of the invention, a legality analysis is performed based on the target physical host identifier, account name, user identifier, start time, and end time in the account resource allocation request, thereby locating the host object and account object corresponding to the target physical host. Using the target physical host as the search scope, all valid allocation records with a deletion flag of 0 are filtered from the resource allocation table. A deletion flag value of 0 indicates that the record is still valid, and only these records enter the overlap detection process. At the time processing level, the start and end timestamps in the account resource allocation request are uniformly converted into standard time objects, and then combined with duplicate rule information to generate a set of time periods to be detected. The new time period corresponding to the account resource allocation request is expanded into several time periods to be compared. Simultaneously, the original time period corresponding to each existing valid allocation record is also converted into a set of comparable time periods. If an existing allocation record does not have a duplicate rule, the start and end times of that record are directly used as the original time period; if an existing allocation record has an associated duplicate rule identifier, the duplicate type, duplicate day array, daily duplicate start time, and daily duplicate end time are read, and the existing valid allocation record is expanded into multiple original time periods. For each new time period corresponding to an account resource allocation request, a pairwise overlap comparison is performed with each original time period corresponding to all existing valid allocation records. If any overlap is found, it is determined that the target physical host is already occupied within the requested time window, and an allocation failure result is returned directly. Only when all comparisons are completed and no overlap is found, a new account resource allocation record is created. The account identifier, physical host identifier, resource allocation start time, resource allocation end time, deletion flag, creation time, and update time are written into the account resource allocation record. The deletion flag is set to 0, indicating that the account resource allocation record has entered a valid controlled state. For scenarios that support periodic allocation, a repetition rule record is written, where the repetition type is "DAILY" or "WEEKLY", the repetition day array element value ranges from 1 to 7, corresponding to Monday to Sunday, respectively, and the daily repetition start time and daily repetition end time are in the format "HH:mm". The account resource allocation record is used as the direct driving basis for establishing access channels, thereby establishing isolated access paths for container resources and virtual machine resources that match the account resource allocation record.For container resources, after locating the corresponding container instance based on the account resource allocation record, an exec creation request is initiated to the container resource. The standard input attach switch, standard output attach switch, and standard error attach switch are all enabled in the exec creation parameters. Simultaneously, the pseudo-terminal attribute is set to true, obtaining a pseudo-terminal exec session bound to the container's internal bash process. WebSocket message streams initiated by the user's browser are written to the standard input stream of the pseudo-terminal exec session, and the standard output and standard error streams of the pseudo-terminal exec session are transmitted back to the user's browser's terminal rendering interface in real time via WebSocket. This establishes a bidirectional data path between the browser and the container's bash process, completing the establishment of the container's isolated access channel. For virtual machine resources, the corresponding virtual machine instance and VNC port are determined based on the account resource allocation record. After the user's browser initiates a WebSocket connection, the noVNC proxy service receives the WebSocket connection, converts it into a VNC data stream, and routes the VNC data stream to the VNC port of the virtual machine resource bound to the account resource allocation record. This ensures that the virtual machine's graphical desktop framebuffer data can be continuously returned to the noVNC client interface on the browser side for rendering, thus forming a virtual machine remote desktop access channel.

[0022] In one example, such as Figure 3 After performing overlap detection on all valid allocation records of the target physical host and account resource allocation requests to generate account resource allocation records, it also includes: S31. Establish an SSH tunnel based on the administrator username and the AES-decrypted administrator password of the target physical host. Send a Linux system account creation command to the target physical host through the SSH tunnel. Create a Linux system account with the account name as the identifier and its home directory in the operating system of the target physical host. S32 writes the AES-decrypted account password from the account resource allocation record into the Linux system account authentication configuration via the SSH channel; S33, when the expiration time of the account resource allocation record arrives, sends a Linux system account deletion command to the target physical host via the SSH channel, deleting the Linux system account and its home directory from the target physical host's operating system.

[0023] In this embodiment of the invention, the target physical host object is read based on the target physical host identifier associated with the account resource allocation record. The IP address, SSH management port, administrator username, and encrypted administrator password are extracted from the target physical host object. The default value for the SSH management port is set to 22, which is the standard management port value for the SSH protocol. The AES decryption processing logic is invoked to decrypt the encrypted administrator password, obtaining the plaintext administrator password. An SSH channel to the target physical host is established based on the administrator username, plaintext administrator password, target physical host IP address, and SSH management port. The administrator password is stored using AES encryption and decryption is performed using the AESUtil utility class in actual read / write scenarios. This ensures that the password is stored in encrypted form on the database side and restored to plaintext for SSH authentication when establishing a remote control link, balancing remote operability and storage security. The account name stored in the account resource allocation record is used as the Linux system account identifier. A Linux system account creation command is sent to the target physical host via the SSH channel, causing the target physical host to create the corresponding user at the operating system level and simultaneously create a home directory matching the user. By mapping the account resource allocation records on the platform side to real user entities in the target physical host operating system, accounts no longer reside at the business system database layer but are transformed into locally identifiable, authenticated, and auditable Linux system accounts on the target physical host, achieving physical machine-level account lifecycle control. This creation action is constrained by the resource allocation start time; when the start task trigger latency is greater than zero, the scheduler triggers creation upon the start time. When the start task trigger latency is less than or equal to zero and the current moment is already within the start and end time interval of the account resource allocation record, the Linux system account creation command is executed synchronously without waiting for delayed scheduling, preventing accounts already in the effective time window from being unable to be created in time due to scheduling queues. The encrypted account password stored in the account resource allocation record is read and decrypted using the same AES decryption method as the administrator password to obtain the plaintext account password. This plaintext password is then written into the authentication configuration of the Linux system account via the established SSH channel, enabling the Linux system account to have actual login capability. This means that the password at the physical host operating system level is updated by executing the command `echo "{accountName}:{newPlainPassword}" | chpasswd` through the SSH pipe. Here, `accountName` represents the Linux system account name, and `newPlainPassword` represents the plaintext account password after AES decryption.Based on this implementation, a consistent writing mechanism is used during the password writing phase after initial account creation. The username and the AES-decrypted password are concatenated and sent to the `chpasswd` command, establishing a one-to-one correspondence between the encrypted username and password stored in the database and the login authentication password in the target physical host's operating system. The plaintext username and password only exist briefly within the controlled window from AES decryption to the completion of the SSH command issuance, while remaining in the database as AES-encrypted text. After successful writing, the platform database record is consistent with the account authentication configuration in the target physical host's operating system. Before sending the authentication configuration write command, the target physical host's online status field is verified. Only when the host's online status value is 1 will the password write command be sent via the SSH channel. A value of 1 indicates the host is currently online and connectable, while a value of 0 indicates the host is currently offline. The termination time in the account resource allocation record is used as the trigger for account deletion. When the account resource allocation record is generated, the account identifier, the target physical host IP address, and the start time of the account resource allocation record are concatenated into a unique key and submitted to the scheduler, which then registers the expiration deletion task. When the expiration time arrives, the scheduler triggers the corresponding expired deletion task. It reads the target physical host object again, re-establishes the SSH channel using the administrator username and the AES-decrypted administrator password, and then sends a Linux system account deletion command to the target physical host, completely removing the Linux system account and its home directory from the target physical host operating system. Specifically, the deletion command is executed using the JSch library after establishing an SSH pipe. Here, `accountName` represents the name of the Linux system account to be deleted, and the `-r` parameter recursively deletes all data files under the home directory ` / home / {accountName}` while deleting the system user entry. This removes all traces of the account at the target physical host operating system level, strictly limiting the account's existence to the start and end times of the account resource allocation record.

[0024] In one example, such as Figure 4 Based on account resource allocation records, establish container isolation access channels and virtual machine remote desktop access channels, including: S41, based on the account resource allocation record, initiates an exec creation request to the container resource and bidirectionally binds the WebSocket message stream of the user's browser with the standard input and output stream of the bash process in the container resource to establish a container isolation access channel; S42, based on the account resource allocation record, receives the WebSocket connection initiated by the user's browser, converts the WebSocket connection into a VNC data stream, routes it to the VNC port of the virtual machine resource, and establishes a virtual machine remote desktop access channel.

[0025] In this embodiment of the invention, the corresponding container resource instance is located based on the resource identifier, account identifier, and start and end time information in the account resource allocation record. A timeliness check is performed on the current connection request. Only if the current time falls within the valid time interval corresponding to the account resource allocation record will the container isolation access channel establishment process continue. An exec creation request is initiated to the container resource via the Docker Exec API. In the exec creation parameters, the standard input attachment switch AttachStdin, the standard output attachment switch AttachStdout, and the standard error attachment switch AttachStderr are all set to enabled. Simultaneously, the terminal pseudo-terminal attribute Tty is set to true, resulting in a pseudo-terminal exec session directly bound to the bash process inside the container resource. Setting Tty to true enables the bash process to have interactive terminal capabilities, allowing commands entered by the user in the browser terminal interface to be received and echoed in real time in a near-local terminal manner. Enabling the three attachment switches simultaneously ensures that the user input link, command output link, and exception information output link are all included within the same session control scope. After the pseudo-terminal exec session is successfully established, it continues to receive WebSocket message streams from the user's browser terminal interface and writes these WebSocket message streams frame by frame into the standard input stream of the pseudo-terminal exec session. This allows characters, control commands, and Enter events input from the browser to be directly transmitted to the bash process inside the container resource. Simultaneously, the standard output and standard error streams generated by the bash process are transmitted back to the user's browser's xterm.js terminal interface in real time via WebSocket for rendering, forming a two-way closed-loop channel of "browser input—WebSocket transmission—container bash execution—result transmission and rendering," achieving isolated access to container resources. Since different users' Web Terminal sessions correspond to independent Docker Exec instances and are each bound to an independent container instance or an independent network namespace environment, terminal sessions between different users remain isolated at the access level, preventing input / output stream crosstalk and eliminating the need for additional SSH client tools to be installed on the user's local machine. The system uses account resource allocation records as the basis for access target resolution. It determines the target virtual machine instance and the VNC port currently being listened to by the target virtual machine instance based on the virtual machine resource identifier in the account resource allocation record. When the user's browser initiates a remote desktop access request, the noVNC proxy service deployed on the backend receives the WebSocket connection.Unlike the character terminal interaction method of container resources, virtual machine resources need to transmit graphical desktop framebuffer data and keyboard and mouse interaction events. Therefore, after receiving the WebSocket connection, the WebSocket connection is converted into a standard VNC protocol data stream according to the RFB protocol specification. The converted VNC data stream is then routed to the VNC port of the virtual machine resource corresponding to the account resource allocation record. This allows the graphical desktop output of the target virtual machine to be continuously returned to the noVNC client interface on the browser side in the form of framebuffer data. Meanwhile, the user's mouse movement, mouse clicks, and keyboard input actions in the browser can also be sent back to the virtual machine resource along the reverse link, thereby establishing a virtual machine remote desktop access channel. Since the virtual machine resources themselves run in the hardware virtualization environment provided by QEMU / KVM Hypervisor, they have independent virtual central processing unit execution environments, independent virtual memory address spaces, independent virtual disks, and independent virtual network cards. Combined with the noVNC agent service for session routing based on the independent VNC ports of different virtual machine instances, the remote desktop access sessions have strong isolation under the conditions that different virtual machine instances run independently, VNC ports are independently bound, and access requests are constrained by account resource allocation records. This avoids the problem of cross-access between graphical interfaces of users and also enables the browser to obtain graphical access capabilities without installing local VNC client software.

[0026] In one example, based on the account resource allocation record, an exec creation request is initiated to the container resource, and the user's browser's WebSocket message stream is bidirectionally bound to the standard input / output streams of the bash process within the container resource, establishing a container-isolated access channel, including: By sending an exec creation request to the container resource through the Docker Exec API, setting AttachStdin, AttachStdout, and AttachStderr to the enabled state and Tty to true, a pseudo-terminal exec session bound to the bash process inside the container resource is obtained. The WebSocket message stream sent by the user's browser is written to the standard input stream of the pseudo-terminal exec session, and the standard output stream and standard error stream of the pseudo-terminal exec session are sent back to the user's browser's xterm.js terminal interface for rendering via WebSocket, thus establishing a container-isolated access channel.

[0027] In this embodiment of the invention, upon receiving an access request for container resources, the corresponding container resource identifier, account identifier, and access time window to which the current connection request belongs are parsed from the account resource allocation record. A pre-verification is performed between the current time and the start and end times in the account resource allocation record. If the current time falls within the valid time interval, an exec creation request is initiated to the container resource. During the creation process, the backend service calls the Docker Exec API, explicitly setting the execution command to / bin / bash, and setting the AttachStdin, AttachStdout, and AttachStderr parameters to true, as well as the Tty parameter to true, thereby generating a pseudo-terminal exec session directly bound to the bash process within the container resource. Enabling AttachStdin allows character streams input from the user's browser to be written to the standard input channel of the bash process within the container resource. Enabling AttachStdout allows normal echoes generated after the bash process executes commands to be read in real time. Enabling AttachStderr allows error messages generated during command execution to also enter the same return path. Setting Tty to true puts the bash process in pseudo-terminal interactive mode, making the handling of input, echo, backspace, newline, and terminal control characters closer to the local command-line environment, thus ensuring that the browser terminal access experience is consistent with a real terminal session. The combined effect of these parameters results in a persistent, interactive pseudo-terminal exec session capable of real-time data transmission and reception and supporting complete terminal behavior. After the pseudo-terminal exec session is created, the WebSocket long connection between the user's browser and the backend service is maintained. The WebSocket message stream sent by the user's browser is parsed frame by frame into terminal input data and then written directly to the standard input stream of the pseudo-terminal exec session in the order of arrival. This ensures that command characters, direction control characters, and Enter signals entered by the user in the xterm.js terminal interface are transmitted to the bash process within the container resource in real time. After receiving this input, the bash process executes the corresponding shell commands inside the container resources, outputs the execution results from the standard output stream, and outputs the exception information from the standard error stream. The backend service then reads the data content from the standard output stream and the standard error stream respectively, and sends it back to the user's browser's xterm.js terminal interface for rendering via the same WebSocket channel.Accordingly, an interactive web terminal interface is formed on the user's browser side, which is in real-time linked with the bash process inside the container resource. Every input on the browser side affects the shell environment inside the container resource, and every normal or abnormal output from inside the container resource is immediately fed back to the xterm.js terminal interface, forming a complete closed-loop chain of "browser input—WebSocket transmission—standard input writing—bash execution—standard output and standard error reading—WebSocket postback—xterm.js rendering". Since different users' web terminal sessions correspond to independent Docker Exec instances, and the container instances rely on the namespace mechanism at the Linux kernel level to isolate resources such as network, processes, and mount points, the terminal access sessions between different users remain isolated at the access level, and there will be no problems such as mixed command input, output streaming, or mutual interference between execution environments. At the same time, users do not need to install any SSH client tools locally; they can complete controlled access to container resources solely through a browser and the xterm.js terminal interface.

[0028] In one example, based on the account resource allocation record, a WebSocket connection initiated by the user's browser is received, converted into a VNC data stream, and routed to the VNC port of the virtual machine resource to establish a virtual machine remote desktop access channel, including: The noVNC proxy service receives WebSocket connections initiated by the user's browser and converts the WebSocket connections into VNC data streams. The VNC data stream is routed to the VNC port of the virtual machine resource corresponding to the account resource allocation record. The graphical desktop frame buffer data of the virtual machine resource is rendered in the noVNC client interface of the user's browser to establish a remote desktop access channel for the virtual machine.

[0029] In this embodiment of the invention, the virtual machine resource instance to which the target session belongs is determined based on the virtual machine resource identifier, account identifier, and valid start and end time of the resource in the account resource allocation record. When the user's browser initiates a remote desktop access request, a pre-verification is performed between the current time and the start and end times in the account resource allocation record. Only when the current time is within the valid time interval is the virtual machine remote desktop access channel establishment process allowed. The noVNC proxy service deployed on the backend listens to the preset WebSocket access port and receives WebSocket connections initiated by the user's browser. After the request arrives, the noVNC proxy service performs protocol adaptation on the data carried by the WebSocket according to the RFB protocol specification, converting the WebSocket connection on the browser side into a standard VNC data stream, so that the interactive requests in the browser environment can be reconstructed into remote framebuffer communication data that the virtual machine resource can recognize. After protocol conversion, based on the virtual machine resource information already bound in the account resource allocation record, the VNC port currently being listened to by the virtual machine resource is located, and the converted VNC data stream is routed to the corresponding VNC port. This allows the target virtual machine resource's graphical desktop output to continuously provide framebuffer data through this port, while keyboard input events and mouse operation events generated on the user's browser side can be sent to the target virtual machine resource via the reverse link, thus establishing a bidirectional graphical interaction link between the browser and the virtual machine resource. When the VNC data stream reaches the target virtual machine resource's VNC port, the graphical desktop framebuffer data output by the target virtual machine resource is sent back to the user's browser's noVNC client interface. The noVNC client interface then parses and renders the received framebuffer data, presenting the real-time desktop screen of the target virtual machine resource on the browser page. This allows users to directly access the graphical remote desktop within their browser without installing local VNC client software. Since the noVNC sessions of different users are routed to independent VNC ports corresponding to different virtual machine resource instances, and the virtual machine resources themselves run in the hardware virtualization isolation environment provided by QEMU / KVM Hypervisor, with independent virtual central processing unit execution environments, virtual memory address spaces, virtual disks, and virtual network cards, the remote desktop access sessions between different users remain isolated at both the protocol access layer and the resource bearing layer, thereby avoiding desktop crosstalk and unauthorized access issues in multi-user concurrent scenarios.

[0030] In one example, such as Figure 5 Based on the start and end times of account resource allocation records, the system drives the establishment and reclamation of account lifecycle management at the physical machine level, as well as container isolation access channels and virtual machine remote desktop access channels. This includes: S51, Register to start a task and delete a task upon expiration; S52, when the start time of the account resource allocation record arrives, triggers the Linux system account creation command at the physical machine level, the establishment of the container isolation access channel, or the establishment of the virtual machine remote desktop access channel. S53, when the expiration deletion task reaches the termination time of the account resource allocation record, triggers the Linux system account deletion command, the recycling of the container isolation access channel, or the recycling of the virtual machine remote desktop access channel.

[0031] In this embodiment of the invention, the account identifier, target physical host IP address, start time, and end time are read from the account resource allocation record. The account identifier, target physical host IP address, and start time are concatenated to form a unique task key. The unique key for starting a task can be appended with a "start" identifier, and the unique key for deleting an expired task can be appended with a "del" identifier. This ensures that two scheduled tasks corresponding to the same account resource allocation record are uniquely distinguishable within the scheduler. The start time and end time in the account resource allocation record are converted into corresponding instantaneous time values, and the trigger delays for starting and deleting expired tasks are calculated. The calculation relationship for the start task trigger delay is the millisecond timestamp corresponding to the start time minus the current system millisecond timestamp; the calculation relationship for the expiration task trigger delay is the millisecond timestamp corresponding to the end time minus the current system millisecond timestamp. Both delay values ​​are in milliseconds as the scheduling unit and are submitted to the scheduler's `schedule()` method to generate corresponding scheduled task objects. These objects are then written to an in-memory task mapping table using the unique task key as an index for tracking and management. The start task is triggered by the scheduler when the start time of the account resource allocation record arrives. The specific execution content of the start task is branched according to the resource type corresponding to the account resource allocation record. When the target resource is a physical machine, the start task triggers the Linux system account creation command at the physical machine level. It creates a Linux system account with the account name as the identifier in the target physical host operating system through the SSH channel, and simultaneously establishes the corresponding home directory and authentication configuration, so that the physical machine resource has an independent account that can actually be logged in and audited at the operating system level. When the target resource is a container, the start task triggers the establishment of the container isolation access channel, calls the container-side establishment logic, and makes the WebSocket message stream sent by the user's browser bidirectionally bound to the standard input stream, standard output stream, and standard error stream of the bash process inside the container resource, thereby establishing an interactive terminal access link. When the target resource is a virtual machine, the start task triggers the establishment of the virtual machine remote desktop access channel, receives the WebSocket connection from the browser side and converts it into a VNC data stream through the noVNC proxy service, and then routes it to the VNC port of the virtual machine resource corresponding to the account resource allocation record, so that the browser side can render the graphical desktop framebuffer data of the virtual machine resource in real time. The essential function of starting a task is not simply to trigger a unified action, but to selectively trigger the establishment of a physical machine account, container channel, or virtual machine desktop channel based on the target resource type determined in the account resource allocation record, so that the resource availability status is strictly consistent with the start time of the account resource allocation record.For scenarios where the current moment falls within the allocation time window—that is, when the trigger delay of the start task is less than or equal to zero and the trigger delay of the expired deletion task is greater than zero—the delay scheduling of the start task is skipped. The Linux system account creation command at the physical machine level, the establishment of the container isolation access channel, or the establishment of the virtual machine remote desktop access channel are executed synchronously. Only the expired deletion task is registered with the scheduler, thus avoiding the problem of resources not being established in time due to the task registration time being later than the start time. This ensures that once the account resource allocation record enters the valid time window, the target resource can immediately become accessible. The expired deletion task is automatically triggered by the scheduler when the termination time of the account resource allocation record arrives, revoking the access capabilities of resources that have reached the termination time boundary, thereby completing the closed-loop recycling of the account lifecycle or access channel lifecycle. When the target resource is a physical machine, the expiration deletion task triggers a Linux system account deletion command. This command is executed via the SSH channel within the target physical host operating system, deleting the Linux system account and its home directory, thus rendering the account completely invalid at the operating system level. When the target resource is a container, the expiration deletion task triggers the reclamation of the container isolation access channel. In this embodiment, the container isolation access channel is bound to the runtime of the corresponding container instance. The container stop and delete methods are called, stopping and deleting the corresponding container instance via the Docker interface, thereby eliminating the terminal access environment established based on the container instance. When the target resource is a virtual machine, the expiration deletion task triggers the reclamation of the virtual machine remote desktop access channel. In this embodiment, the virtual machine remote desktop access channel is bound to the runtime of the corresponding KVM virtual machine instance. The virtual machine shutdown method is called, shutting down the corresponding KVM virtual machine instance via the virtualization interface. Since the VNC server depends on the virtual machine instance for operation, the corresponding remote desktop access channel also becomes invalid after the virtual machine is shut down.

[0032] In one example, it also includes: Concatenate the account identifier, the IP address of the target physical host, and the start time of the account resource allocation record into a unique key, and submit the start task and the expiration deletion task to the scheduler; When the trigger delay of the start task is less than or equal to zero and the trigger delay of the expired deletion task is greater than zero, the delay scheduling of the start task is skipped, and the Linux system account creation command, container isolation access channel establishment, or virtual machine remote desktop access channel establishment at the physical machine level is directly triggered, and the expired deletion task is only registered with the scheduler.

[0033] In this embodiment of the invention, the account identifier, the IP address of the target physical host, and the resource allocation start time are extracted from the account resource allocation record. A unique task key is generated according to a preset concatenation rule to uniquely identify the start task and the expired deletion task corresponding to the current account resource allocation record within the scheduler. The unique key for the start task is constructed as "account identifier + target physical host IP address + start time + start", and the unique key for the expired deletion task is constructed as "account identifier + target physical host IP address + start time + del". The same account may have different allocation records on different physical hosts, and the same physical host may be repeatedly requested by the same account within different time windows. Therefore, using only a single field cannot accurately distinguish different scheduling instances. By combining the three core identifiers as the primary key and adding a task category tag, the start task and the expired deletion task can have a one-to-one correspondence and non-confusing identification capability within the scheduler. The trigger delays for starting and deleting tasks are calculated based on the start and end times in the account resource allocation records. The start and end times are first converted to their corresponding instantaneous values, then subtracted from the current millisecond timestamp to obtain two delay values. The start task trigger delay represents how many milliseconds remain before the resource should take effect, while the deleting task trigger delay represents how many milliseconds remain before the resource should be reclaimed. Specifically, the start task delay is calculated as startInstant.toEpochMilli() - System.currentTimeMillis(), and the deleting task delay is calculated as endInstant.toEpochMilli() - System.currentTimeMillis(). These delay values, uniformly in milliseconds, are submitted to the schedule() method of the ScheduledExecutorService scheduler. A corresponding ScheduledFuture object is generated and then written to a ConcurrentHashMap in-memory task mapping table (taskMap) using the task's unique key for tracking and management.When the trigger delay of the start task is greater than zero, it means that the current time has not yet reached the resource allocation start time. In this case, according to the normal scheduled process, both the start task and the expired deletion task are submitted to the scheduler simultaneously. The start task triggers the resource creation action when the start time arrives, and the expired deletion task triggers the resource reclamation action when the end time arrives. When the trigger delay of the start task is less than or equal to zero and the trigger delay of the expired deletion task is greater than zero, it means that the current time has passed the start time but has not yet reached the end time. That is, the current connection request has actually fallen within the valid time window of the account resource allocation record. In this scenario, the delayed scheduling of the start task is skipped, and the Linux system account creation command, the establishment of the container isolation access channel, or the establishment of the virtual machine remote desktop access channel at the physical machine level are directly triggered. Only the expired deletion task is registered with the scheduler. At this time, the "resource taking effect" is no longer delegated to a future time for triggering, but is regarded as a current action that should be realized immediately. The resource availability state is established synchronously, and only the future reclamation control logic is retained, so that the resource can immediately enter the accessible state at the current time. During the direct trigger execution phase, the appropriate establishment method is selected based on the resource type bound to the account resource allocation record: When the target resource is a physical machine, the physical machine account creation logic is immediately invoked, an SSH channel is established using the administrator username and the AES-decrypted administrator password, and a Linux system account and its home directory are created in the target physical host operating system with the account name as the identifier. At the same time, authentication configuration is written, enabling the account to immediately have login capabilities; When the target resource is a container, the container isolation access channel establishment logic is immediately invoked, a pseudo-terminal exec creation request is initiated through the Docker Exec API, and the browser-side WebSocket message stream is bidirectionally bound to the standard input and output streams of the bash process inside the container, enabling the container interaction session to be established directly at the current moment; When the target resource is a virtual machine, the virtual machine remote desktop access channel establishment logic is immediately invoked, the WebSocket connection initiated by the browser is received through the noVNC proxy service, the WebSocket connection is converted into a VNC data stream and routed to the VNC port of the corresponding virtual machine resource, enabling the browser to immediately render the graphical desktop of the target virtual machine.

[0034] In one example, such as Figure 6 When the trigger delay of the start task is less than or equal to zero and the trigger delay of the expired deletion task is greater than zero, the delay scheduling of the start task is skipped, and the Linux system account creation command at the physical machine level, the establishment of the container isolation access channel, or the establishment of the virtual machine remote desktop access channel are directly triggered. Only expired deletion tasks are registered with the scheduler, including: S61, when the trigger delay of the start task is less than or equal to zero and the trigger delay of the expired deletion task is greater than zero, determine that the current time of the connection request is within the start and end time interval of the account resource allocation record and synchronously execute the Linux system account creation command at the physical machine level, the establishment of the container isolation access channel, or the establishment of the virtual machine remote desktop access channel. S62 determines the trigger delay based on the termination time, registers only expired deletion tasks with the scheduler, and executes Linux system account deletion instructions, container isolation access channel reclamation, or virtual machine remote desktop access channel reclamation when the trigger delay arrives.

[0035] In this embodiment of the invention, the start and end times in the account resource allocation record are converted into corresponding instantaneous time values, and then the difference between these values ​​and the current time is calculated to obtain the trigger delay of the start task and the trigger delay of the expired deletion task. The trigger delay of the start task represents the amount of time remaining before the resource should take effect, and the trigger delay of the expired deletion task represents the amount of time remaining before the resource should end and be recycled. When the trigger delay of the start task is less than or equal to zero, it indicates that the current time has reached or exceeded the start time boundary of the account resource allocation record. At the same time, combined with the condition that the expired deletion task still has a positive delay, it is determined that the current time of the connection request is actually within the start and end time interval defined by the account resource allocation record. Therefore, the resource establishment action is transferred to the synchronous execution process. At this point, if the target resource is a physical machine, the Linux system account creation logic at the physical machine level is immediately invoked. An SSH channel is established using the administrator username and the administrator password decrypted by AES. A Linux system account with the account name as its identifier and its home directory are created in the target physical host operating system. At the same time, authentication configuration is written, enabling the account to log in immediately. If the target resource is a container, the container isolation access channel establishment logic is immediately executed. This establishes a two-way binding between the WebSocket message stream on the user's browser side and the standard input, standard output, and standard error streams of the bash process inside the container resource, thus enabling the container interaction session to directly enter a usable state at this moment. If the target resource is a virtual machine, the virtual machine remote desktop access channel establishment logic is immediately executed. The WebSocket connection initiated by the browser is received through the noVNC proxy service. The WebSocket connection is converted into a VNC data stream and routed to the VNC port of the corresponding virtual machine resource, enabling the browser side to directly display the graphical desktop of the target virtual machine. The termination time is converted into a termination instantaneous value, and the trigger delay for the expired deletion task is obtained by subtracting the current millisecond timestamp from the termination instantaneous value. The trigger delay, in milliseconds, is submitted to the scheduler's `schedule()` method to generate a corresponding scheduled task object. A unique key, formed by concatenating the account identifier, target physical host IP address, start time, and deletion task identifier, is then written into the task mapping table for tracking and management. When the trigger delay arrives, the scheduler automatically triggers the corresponding resource reclamation action: if the target resource is a physical machine, a Linux system account deletion command is executed, deleting the Linux system account and its home directory from the target physical host operating system, thus completely invalidating the account at the operating system level; if the target resource is a container, the container isolation access channel is reclaimed by stopping and deleting the container instance; if the target resource is a virtual machine, the virtual machine remote desktop access channel is reclaimed by shutting down the virtual machine instance, causing the relevant VNC access link to become synchronously invalid.

[0036] Reference Figure 7 This embodiment provides an account management and isolated access system for computing resources, including: Channel establishment module 1 is used to generate account resource allocation records based on account resource allocation requests, and establish corresponding container isolation access channels or virtual machine remote desktop access channels based on the target resource type. The management module 2 is used to drive the establishment and reclamation of account lifecycle management at the physical machine level and container isolation access channels and virtual machine remote desktop access channels based on the start and end time of account resource allocation records. The comparison and verification module 3 is used to compare and verify the current time of the connection request with the start and end times when the connection request is initiated. If the current time is within the start and end time interval, the connection request is allowed; otherwise, the connection request is blocked.

[0037] In this embodiment, the specific implementation of each unit in the above system embodiment is described in the above method embodiment, and will not be repeated here.

[0038] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, system, article, or method that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, system, article, or method. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, system, article, or method that includes that element.

[0039] The above description is only a preferred embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A method for account management and isolated access to computing resources, characterized in that, include: Generate account resource allocation records based on account resource allocation requests, and establish corresponding container isolation access channels or virtual machine remote desktop access channels based on the target resource type; Based on the start and end times of the account resource allocation records, the system drives the physical machine dimension account lifecycle management and the establishment and recycling of the container isolation access channel and the virtual machine remote desktop access channel. When a connection request is initiated, the current time of the connection request is compared and verified with the start and end times. If the current time is within the start and end time interval, the connection request is allowed; otherwise, the connection request is blocked.

2. The method for account management and isolated access to computing resources according to claim 1, characterized in that, The step of generating an account resource allocation record based on the account resource allocation request and establishing a corresponding container isolation access channel or virtual machine remote desktop access channel based on the target resource type includes: Perform overlap detection between all valid allocation records of the target physical host and the account resource allocation request to generate an account resource allocation record; Based on the account resource allocation records, a container isolation access channel and a virtual machine remote desktop access channel are established.

3. The method for account management and isolated access to computing resources according to claim 2, characterized in that, After performing overlap detection on all valid allocation records of the target physical host and account resource allocation requests to generate account resource allocation records, the method further includes: An SSH channel is established based on the administrator username and the AES-decrypted administrator password of the target physical host. A Linux system account creation command is sent to the target physical host through the SSH channel, and a Linux system account with the account name as the identifier and its home directory are created in the operating system of the target physical host. The account password, decrypted by AES, from the account resource allocation record is written into the authentication configuration of the Linux system account through the SSH channel; When the expiration time of the account resource allocation record arrives, a Linux system account deletion command is sent to the target physical host through the SSH channel to delete the Linux system account and its home directory from the operating system of the target physical host.

4. The method for account management and isolated access to computing resources according to claim 3, characterized in that, The establishment of container isolation access channels and virtual machine remote desktop access channels based on the account resource allocation records includes: Based on the account resource allocation record, an exec creation request is initiated to the container resource, and the WebSocket message stream of the user's browser is bidirectionally bound to the standard input and output stream of the bash process within the container resource to establish a container isolation access channel. Based on the account resource allocation record, the system receives the WebSocket connection initiated by the user's browser, converts the WebSocket connection into a VNC data stream, routes it to the VNC port of the virtual machine resource, and establishes a virtual machine remote desktop access channel.

5. The method for account management and isolated access to computing resources according to claim 4, characterized in that, The step of initiating an exec creation request to the container resource based on the account resource allocation record and bidirectionally binding the WebSocket message stream of the user's browser with the standard input / output stream of the bash process within the container resource to establish a container-isolated access channel includes: An exec creation request is initiated to the container resource via the Docker Exec API, AttachStdin, AttachStdout, and AttachStderr are all enabled and Tty is set to true, thereby obtaining a pseudo-terminal exec session bound to the bash process within the container resource. The WebSocket message stream sent by the user's browser is written into the standard input stream of the pseudo-terminal exec session, and the standard output stream and standard error stream of the pseudo-terminal exec session are sent back to the xterm.js terminal interface of the user's browser via WebSocket for rendering, thus establishing a container-isolated access channel.

6. The method for account management and isolated access to computing resources according to claim 5, characterized in that, The process of receiving a WebSocket connection initiated by the user's browser based on the account resource allocation record, converting the WebSocket connection into a VNC data stream, and routing it to the VNC port of the virtual machine resource to establish a virtual machine remote desktop access channel includes: The noVNC proxy service receives WebSocket connections initiated by the user's browser and converts the WebSocket connections into VNC data streams. The VNC data stream is routed to the VNC port of the virtual machine resource corresponding to the account resource allocation record. The graphical desktop frame buffer data of the virtual machine resource is rendered in the noVNC client interface of the user's browser to establish a virtual machine remote desktop access channel.

7. The method for account management and isolated access to computing resources according to claim 1, characterized in that, The process of driving physical machine-level account lifecycle management and establishing and reclaiming the container isolation access channel and the virtual machine remote desktop access channel based on the start and end times of the account resource allocation records includes: Register to start a task and delete a task upon expiration; When the start time of the account resource allocation record arrives, the task triggers the Linux system account creation instruction at the physical machine level, the establishment of the container isolation access channel, or the establishment of the virtual machine remote desktop access channel. When the expiration deletion task reaches the termination time of the account resource allocation record, it triggers the Linux system account deletion command, the recycling of the container isolation access channel, or the recycling of the virtual machine remote desktop access channel.

8. The method for account management and isolated access to computing resources according to claim 7, characterized in that, Also includes: Concatenate the account identifier, the IP address of the target physical host, and the start time of the account resource allocation record into a unique key, and submit the start task and the expiration deletion task to the scheduler. When the trigger delay of the start task is less than or equal to zero and the trigger delay of the expired deletion task is greater than zero, the delay scheduling of the start task is skipped, and the Linux system account creation instruction at the physical machine level, the establishment of the container isolation access channel, or the establishment of the virtual machine remote desktop access channel is directly triggered, and the expired deletion task is only registered with the scheduler.

9. The method for account management and isolated access to computing resources according to claim 8, characterized in that, When the trigger delay of the start task is less than or equal to zero and the trigger delay of the expired deletion task is greater than zero, the delay scheduling of the start task is skipped, and the Linux system account creation instruction at the physical machine level, the establishment of the container isolation access channel, or the establishment of the virtual machine remote desktop access channel is directly triggered, and the expired deletion task is only registered with the scheduler, including: When the trigger delay of the start task is less than or equal to zero, it is determined that the current time of the connection request is within the start and end time interval of the account resource allocation record, and the Linux system account creation instruction at the physical machine level, the establishment of the container isolation access channel, or the establishment of the virtual machine remote desktop access channel are executed synchronously. The trigger delay is determined based on the termination time. Only expired deletion tasks are registered with the scheduler. When the trigger delay arrives, the Linux system account deletion command, the container isolation access channel recycling, or the virtual machine remote desktop access channel recycling are executed.

10. A system for account management and isolated access to computing resources, characterized in that, The steps for implementing the account management and isolated access method for computing resources according to any one of claims 1 to 9 include: The channel establishment module is used to generate account resource allocation records based on account resource allocation requests, and to establish corresponding container isolation access channels or virtual machine remote desktop access channels based on the target resource type. The management module is used to drive the physical machine dimension account lifecycle management and the establishment and reclamation of the container isolation access channel and the virtual machine remote desktop access channel based on the start and end time of the account resource allocation record; The comparison and verification module is used to compare and verify the current time of the connection request with the start and end time when the connection request is initiated. If the current time is within the start and end time interval, the connection request is allowed; otherwise, the connection request is blocked.

Images