A multi-cloud adaptation method and system for automatically managing a domestic information creation cloud desktop host

Abstract

The application provides a multi-cloud adaptive domestic information creation cloud desktop host automatic management method and system, constructs a unified open API service as the only entrance of cloud desktop host management; an application authorization and authentication mechanism is designed in the open API service, an API interface accessible by the application authorization is created for the application on the management platform, is called by the outside, is authenticated when calling, and forms a standardized request after authentication; a business logic implementation platform is set, is responsible for core businesses including terminal management, user management, policy management and task management, and converts the standardized request of the open API service into a management and control instruction of the cloud desktop host; the business logic implementation platform interacts with the proxy module deployed in the cloud desktop host through host heartbeat, and realizes the issuing and execution of the management and control instruction. The application solves the unified management of the cloud desktop host in the multi-cloud environment from the system architecture level, and ensures the access safety, auditability and excellent user experience.

Description

Technical Field

[0001] This invention belongs to the field of cloud desktop management technology, specifically relating to a method and system for automatic management of multi-cloud adapted domestic domestic cloud desktop hosts. Background Technology

[0002] Currently, many industries are deploying domestically developed cloud desktop systems on a large scale, involving multiple mainstream cloud desktop vendors such as Huawei Cloud, ZTE Cloud, and Unisplendour Cloud. Each vendor provides its own management interface, with different interface styles, data structures, and authentication methods. Existing terminal management systems are mainly designed for physical machines and mobile terminals, lacking unified management capabilities for cloud desktop hosts, leading to the following prominent problems: 1. Management silos: Each vendor's cloud desktop platform is independent of each other, and administrators need to log in to multiple consoles to manage hosts, which is cumbersome and inefficient.

[0003] 2. Duplicated development: Different cloud desktop hosts have different domain addition and user authentication methods, and application systems need to develop separate interface modules for each platform, resulting in high R&D costs and long development cycles.

[0004] 3. Security risks: The security strength of interfaces on different platforms varies, and there is a lack of unified identity identification and access control, making it difficult to trace the source of calls and posing risks of unauthorized access and data leakage.

[0005] 4. Lack of auditing: In a multi-cloud environment, API call records are scattered, making it impossible to form a unified audit log and thus difficult to meet compliance requirements.

[0006] 5. Disjointed user experience: After logging into the cloud desktop client, users still need to enter their password again to enter the operating system; after entering the operating system, they need to authenticate again to access third-party applications, resulting in a poor user experience. Summary of the Invention

[0007] The purpose of this invention is to provide a method and system for automatic management of domestically developed cloud desktop hosts that are adapted to multi-cloud environments. It solves the problem of unified management of cloud desktop hosts in multi-cloud environments from the system architecture level, and introduces application-level authorization and authentication mechanisms and two-level single sign-on to ensure secure access, auditability and excellent user experience.

[0008] To achieve the above objectives, the technical solution of the present invention is as follows: A method for automatically managing multi-cloud adapted domestic IT-based cloud desktop hosts includes: S1. Build a unified open API service as the sole entry point for managing cloud desktop hosts; S2. Design an application authorization and authentication mechanism in the open API service. When an application is created on the management platform, authorize the application to access API interfaces for external calls. Authentication is performed during the call, and a standardized request is formed after successful authentication. S3. Set up the business logic implementation platform, responsible for core businesses including terminal management, user management, policy management, and task management, and transform standardized requests for open API services into control commands for cloud desktop hosts; S4. Business Logic Implementation: The platform interacts with the agent module deployed in the cloud desktop host through the host heartbeat to realize the issuance and execution of control commands.

[0009] Furthermore, the open API service described in step S1, in addition to the application authorization and authentication mechanism, also includes: Routing function: Receives and parses external call requests, and distributes the requests according to the request path and HTTP method; Audit logs: asynchronously record detailed information for each external call request, including the application identifier, time, interface, and result of each API call, to achieve traceability and audit requirements; Forwarding function: After encapsulating the request parameters verified by the application authorization and authentication mechanism, it forwards them to the business logic implementation platform through the internal interface.

[0010] Furthermore, the application authorization and authentication mechanism described in step S2 includes: Application Management: Used to create, edit, enable / disable applications, and generate a unique identity for each application, including appid and appsecret; Permission configuration: Grant the application access permissions to API interfaces based on paths and HTTP methods; Authentication: Verify the validity of the appid and appsecret carried in the request before processing the request, and check whether the application has permission to access the current interface.

[0011] Furthermore, the policy management described in step S3 includes: The business logic implementation platform defines a unified strategy model, including login time period, IP restriction, password policy, script tasks, control panel, and security management; Dynamically bind policies to specified hosts, user groups, or organizations; The policy is sent to the cloud desktop host through the host heartbeat response, and the policy execution results of the cloud desktop host are received to achieve centralized management.

[0012] Furthermore, the agent module described in step S4 is deployed within the cloud desktop host. After the cloud desktop host is successfully issued, the cloud vendor platform transmits the address of the business logic implementation platform, the domain administrator account and password to the agent module. The agent module interacts with the business logic implementation platform, executes automatic domain addition of the cloud desktop host, receives and executes management and control instructions, and periodically reports the status of the cloud desktop host.

[0013] Furthermore, the agent module executes automatic domain addition for the cloud desktop host. It uses the pre-received domain administrator account and password to execute the automatic domain addition module. The automatic domain addition module interacts with the business logic implementation platform to add the cloud desktop host to the domain managed by the business logic implementation platform, making it a domain member and thus bringing the cloud desktop host under unified management.

[0014] Furthermore, the proxy module performs single sign-on; the single sign-on includes system-level single sign-on and application-level single sign-on; system-level single sign-on is implemented when the platform generates a temporary token based on the user's client login business logic, and the temporary token is used to encrypt the account and password and transmit them to the proxy module of the cloud desktop host for verification. After successful verification, the user directly enters the cloud desktop host; application-level single sign-on is implemented when the user accesses a third-party business system after entering the cloud desktop host, and the temporary token is used to verify the account and password and directly log in to the third-party business system.

[0015] In another aspect, this invention proposes an automatic management system for multi-cloud adapted domestic IT innovation cloud desktop hosts, comprising: Open API Service Layer: Construct a unified open API service as the sole entry point for cloud desktop host management; the open API service layer is designed with application authorization and authentication middleware, which authorizes accessible API interfaces for applications when they are created on the management platform, allowing external calls, and performs authentication during calls, forming standardized requests after successful authentication. Business logic implementation platform: Responsible for core business including terminal management, user management, policy management, and task management, it transforms standardized requests from open API services into control commands for cloud desktop hosts; the business logic implementation platform interacts with the agent module deployed in the cloud desktop host through host heartbeat to issue and execute control commands.

[0016] Furthermore, the open API service layer also includes: Routing layer: Receives and parses external call requests, and dispatches the requests according to the request path and HTTP method; Audit log module: Asynchronously records detailed information for each external call request, including the application identifier, time, interface, and result of each API call, to achieve traceability and audit requirements; Forwarding module: After encapsulating the request parameters verified by the application authorization and authentication mechanism, it forwards them to the business logic implementation platform through the internal interface.

[0017] Furthermore, the agent module is deployed within the cloud desktop host. After the cloud desktop host is successfully issued, the cloud vendor platform transmits the address of the business logic implementation platform, the domain administrator account and password to the agent module. The agent module interacts with the business logic implementation platform, executes automatic domain addition of the cloud desktop host, receives and executes management and control instructions, and periodically reports the status of the cloud desktop host.

[0018] Compared with the prior art, the present invention has the following beneficial effects: This invention integrates open API mode, application authorization and authentication mechanism, business logic implementation platform, host heartbeat distribution mechanism, automatic domain addition, and system-level and application-level two-level single sign-on into a complete system solution, solving the problem of unified management of cloud desktop hosts in a multi-cloud environment from the system architecture level.

[0019] This invention introduces an application-level authorization and authentication mechanism and a two-level single sign-on. It achieves traceability and security auditing of API calls through application-level identity identification, realizes centralized policy distribution through host heartbeat, and significantly improves user experience through two-level single sign-on, ensuring secure, auditable, and excellent user experience. Attached Figure Description

[0020] Figure 1 This is a flowchart of the method in Embodiment 1 of the present invention; Figure 2 This is a schematic diagram of the system structure of Embodiment 3 of the present invention. Detailed Implementation

[0021] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0022] First, let's explain the technical terms involved: Open API: A set of standardized interfaces provided to the outside world via HTTP / HTTPS protocols, which can be called by third-party systems to achieve function integration.

[0023] Cloud desktop platform: refers to the platform provided by cloud desktop service providers, such as Huawei Cloud, ZTE Cloud, and Unisplendour Cloud, which are responsible for the creation and management of cloud desktop hosts.

[0024] Multi-cloud adaptation: refers to the ability to achieve "one-time development, multi-cloud integration" by shielding the interface differences of different cloud vendors (such as Huawei Cloud, ZTE Cloud, and Unisplendour Cloud) through a unified abstraction layer.

[0025] Cloud desktop host management: Incorporate cloud desktop hosts (virtual machines) created in the cloud desktop platform into a unified management system (management platform) to achieve lifecycle management, policy distribution, monitoring and other operations.

[0026] Application: refers to a third-party system registered on the management platform (such as Huawei Cloud Platform, ZTE Cloud Platform). Each application has a unique appid and appsecret, which are used as identity identifiers for API calls.

[0027] Application authorization: The management platform assigns access permissions to API interfaces for applications, enabling fine-grained access control.

[0028] Business Logic Implementation Platform: The core business platform in this solution is responsible for terminal management (domain joining and leaving), user management (authentication and permissions), policy management (control policies), and task management (push messages and script distribution). The business logic implementation platform receives requests forwarded from the open API and interacts with the proxy module within the cloud desktop host via host heartbeat to distribute and execute policies and tasks.

[0029] Host heartbeat: A mechanism in which the agent module within the cloud desktop host periodically reports its status to the business logic implementation platform and retrieves the latest policies and tasks. The business logic implementation platform then sends control commands to the virtual machine through the heartbeat response.

[0030] Automatic domain addition: After a cloud desktop host is successfully issued, the automatic domain addition script is executed through the agent module within the host. This script interacts with the business logic implementation platform to add the host to the domain managed by the platform, enabling the host to be uniformly managed and controlled by the platform.

[0031] Single Sign-On (SSO): This refers to a user's ability to access multiple application systems after a single successful authentication, without needing to re-enter credentials. This solution includes two levels of SSO: system-level SSO, where after successful authentication on the cloud desktop client, the user can directly log in to the cloud desktop host's domestically developed OS without re-entering their account and password; this process requires calling the SDK provided by the domestically developed OS. Application-level SSO, where after entering the operating system, when accessing third-party business systems in a browser, authentication is automatically completed without re-entering the account and password, achieving seamless cross-system access.

[0032] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0033] Example 1: The automatic management method for multi-cloud adapted domestic IT innovation cloud desktop hosts described in this embodiment, such as Figure 1 As shown, it includes: S1. Build a unified open API service as the sole entry point for managing cloud desktop hosts; S2. Design an application authorization and authentication mechanism in the open API service. When an application is created on the management platform, authorize the application to access API interfaces for external calls. Authentication is performed during the call, and a standardized request is formed after successful authentication.

[0034] Steps S1 and S2 both describe the construction of the open API service. The unified open API service serves as the sole entry point for all cloud desktop platforms to access the management platform, providing standardized interfaces for host management, domain addition, authentication, and policy distribution.

[0035] The settings are as follows: Routing function: Receives and parses external call requests, and distributes the requests according to the request path and HTTP method; Audit logs: asynchronously record detailed information for each external call request, including the application identifier, time, interface, and result of each API call, to achieve traceability and audit requirements; Application authorization and authentication mechanism: This mechanism is mainly used to verify the identity (appid / appsecret) of the user calling the API, check the interface permissions, and record audit logs through the application authorization and authentication middleware; Forwarding function: After encapsulating the request parameters verified by the application authorization and authentication mechanism, it forwards them to the business logic implementation platform through the internal interface.

[0036] The application authorization and authentication mechanisms include: (1) Application Management: Used to create, edit, enable / disable applications, and generate a unique identity for each application, including appid and appsecret.

[0037] In this embodiment, the term "application," as explained in the preceding technical terminology descriptions, refers to a third-party system (such as Huawei Cloud Platform or ZTE Cloud Platform) registered on the management platform. Each application has a unique appid and appsecret, used for identity verification when making API calls. Administrators create applications on the management platform, with one application corresponding to each cloud vendor; they authorize accessible API interfaces for the applications; when cloud vendors call the API, they must include the appid and appsecret fields in the request header, representing the cloud vendor's identity ID and password.

[0038] (2) Permission configuration: Grant the application access permissions to API interfaces based on path and HTTP method.

[0039] This feature is used to provide fine-grained authorization for each cloud provider. When assigning permissions, it does not grant the same permissions to all applications indiscriminately, such as opening all APIs. Instead, it specifies which operation (HTTP method) to configure for which URL address (path), thereby granting different API call permissions to different applications and controlling access permissions.

[0040] (3) Authentication: Before processing the request, verify the validity of the appid and appsecret carried in the request, and check whether the application has permission to access the current interface.

[0041] This function is primarily used to perform authentication and permission checks on cloud vendor calls before they enter business processing.

[0042] S3. Set up the business logic implementation platform, responsible for core businesses including terminal management, user management, policy management, and task management, and transform standardized requests for open API services into control commands for cloud desktop hosts; S4. Business Logic Implementation: The platform interacts with the agent module deployed in the cloud desktop host through the host heartbeat to realize the issuance and execution of control commands.

[0043] The open API service will encapsulate the request parameters, which include authentication and permission checks, and send them to the business logic implementation platform. Steps S3 and S4 describe the operation of the business logic implementation platform.

[0044] The business logic implementation platform implements all business logic for managing cloud desktop hosts, including: Terminal management: domain joining, domain leaving, and status synchronization of cloud desktop hosts; User management: user authentication and permission allocation; Policy management: Define and issue login policies, security policies, etc.; Task management: push messages to the host, distribute scripts, and execute scheduled tasks.

[0045] The business logic implementation platform does not directly call the proprietary APIs of various cloud vendors. Instead, it interacts with the agent module deployed within the cloud desktop host through a host heartbeat mechanism. The agent module periodically reports the host status to the business logic implementation platform. The business logic implementation platform carries instructions such as policies and tasks to be executed in the heartbeat response. After receiving the instructions, the agent module executes them locally, thereby achieving unified management and control of the cloud desktop host.

[0046] The business logic implementation platform defines a unified strategy model, including login time period, IP restriction, password policy, script tasks, control panel, and security management; Dynamically bind policies to specified hosts, user groups, or organizations; The policy is sent to the cloud desktop host through the host heartbeat response, and the policy execution results of the cloud desktop host are received to achieve centralized management.

[0047] The agent module is deployed within the cloud desktop host. After the cloud desktop host is successfully issued, the cloud vendor platform transmits the address of the business logic implementation platform, the domain administrator account and password to the agent module. The agent module interacts with the business logic implementation platform, executes automatic domain addition of the cloud desktop host, receives and executes management and control instructions, and periodically reports the status of the cloud desktop host.

[0048] The agent module executes automatic domain addition for cloud desktop hosts. It uses the pre-received domain administrator account and password to execute the automatic domain addition module. The automatic domain addition module interacts with the business logic implementation platform to add the cloud desktop host to the domain managed by the business logic implementation platform, making it a domain member and thus bringing the cloud desktop host under unified management.

[0049] The proxy module performs single sign-on; the single sign-on includes system-level single sign-on and application-level single sign-on; system-level single sign-on is achieved when the user logs in through the client's business logic, the platform generates a temporary token, and the temporary token is used to encrypt the account and password and transmit them to the proxy module of the cloud desktop host. The proxy module verifies the account and password through the business logic platform, and after successful verification, the user directly enters the cloud desktop host; application-level single sign-on is achieved when the user accesses a third-party business system after entering the cloud desktop host, the temporary token is used to verify the account and password through the business logic platform, and after successful verification, the third-party business system allows direct login.

[0050] This embodiment addresses the issue of unified management of cloud desktop hosts in a multi-cloud environment from a system architecture perspective. It introduces application-level authorization and authentication mechanisms and a two-tier single sign-on system to ensure secure, auditable, and superior user experience.

[0051] Example 2: This embodiment is a specific application example of the method described in Embodiment 1.

[0052] In this embodiment, the process of automatic management is illustrated by taking the creation of a new cloud desktop host on the Huawei Cloud platform as an example. For example, the business logic implementation platform in the solution uses the Kylin Tianyu Security Domain Management Platform (hereinafter referred to as the Tianyu Platform) for operation.

[0053] I. The administrator creates and authorizes the application: Administrators create Huawei Cloud Platform applications through the open API service, filling in information such as the application name (e.g., "Huawei Cloud Platform"), description, and contact person.

[0054] The system generates a unique appid and appsecret (the appsecret is only displayed once and must be kept safe).

[0055] Administrators select accessible API interfaces for applications, such as: domain management interfaces: domain management verification, authentication, password modification, domain exit, etc.; policy interfaces: policy issuance, task push, etc.

[0056] After saving, the application configuration takes effect. Administrators can export the application authorization file and provide the appid and appsecret offline to the Huawei Cloud platform.

[0057] II. Huawei Cloud Platform Calling Open APIs: 1. Pre-configuration: Huawei Cloud Platform first configures the necessary information such as the Tianyu platform address, domain administrator account and password, and calls the open API's permission verification interface to complete two verifications: (1) Verify connectivity with the Tianyu platform; (2) Verify the validity of the domain administrator account and whether it has the permissions to join or leave the domain (this account will be used for subsequent automatic domain joining operations).

[0058] 2. Calling the Open API: When operations such as verifying domain management permissions and authentication are required, Huawei Cloud Platform sends an HTTP request to the Open API service. The request header includes: (1) X-App-Id: <appid>; (2)X-App-Secret: <appsecret>.

[0059] 3. Open API Authentication and Forwarding: Open API services are verified sequentially through application authorization and authentication middleware. (1) Does the appid exist and is in the enabled state? (2) Is the appsecret correct? (3) Whether the application has access to the requested interface.

[0060] After successful verification, the request is forwarded to the corresponding business module of the Tianyu platform for processing, and the processing result is returned to the caller via the open API.

[0061] 4. Audit Logs: The open API service asynchronously records call logs, including information such as appid, request time, interface path, and return status, to meet traceability and auditing requirements.

[0062] III. Automatic Management Process for Cloud Desktop Hosts: 1. Cloud Desktop Host Deployment: After Huawei Cloud Platform completes the deployment of cloud desktop hosts, it securely transmits the pre-configured Tianyu platform domain name, domain administrator account and password to the agent module within the cloud desktop host.

[0063] 2. Automatic Domain Joining: The agent module uses the pre-received domain administrator account and password to automatically join the domain, interacts with the Tianyu platform, and adds the virtual machine to the domain managed by the Tianyu platform, making it a domain member and thus bringing it under the unified management of the Tianyu platform.

[0064] 3. Heartbeat Establishment: After successful domain joining, the agent module establishes a heartbeat connection with the Tianyu platform and periodically reports the host status.

[0065] 4. Status Update and Policy Binding: After receiving the domain joining success status, the Tianyu platform updates the cloud desktop host status to "domain joined" and registers the host information to the unified management system. At the same time, according to the predefined policy template, the login policy, security policy, etc. are sent to the agent module through the next heartbeat response, and the agent module executes it on the local machine to realize policy control.

[0066] 5. Unified subsequent management and control: (1) User login and single sign-on: Subsequent user login and two-level single sign-on are completed by calling the Tianyu platform through the open API.

[0067] (2) Strategy and task distribution: The Tianyu platform distributes new strategies and tasks to the agent module through heartbeat response, and the agent module executes them on the host.

[0068] All operations are authenticated and authorized through the open API to ensure security and traceability.

[0069] IV. Audit Log: The open API service records audit information for each call, including: Invocation time, appid, request path and HTTP method, request parameters, response status code, processing time, and client IP.

[0070] Logs are centrally stored and can be retrieved by application, time, interface, and other dimensions to meet compliance audit requirements.

[0071] Through the above process, Huawei Cloud Platform's cloud desktop hosts achieve automatic management, API call traceability and security auditing through application-level identity identification, centralized policy distribution through host heartbeat, and significantly improved user experience through two-level single sign-on, ensuring secure, auditable, and excellent user experience.

[0072] Example 3: This embodiment proposes an automatic management system for multi-cloud adapted domestically developed cloud desktop hosts, such as... Figure 2 As shown, it includes: Open API Service Layer: Construct a unified open API service as the sole entry point for cloud desktop host management; the open API service layer is designed with application authorization and authentication middleware, which authorizes accessible API interfaces for applications when they are created on the management platform, allowing external calls, and performs authentication during calls, forming standardized requests after successful authentication. Business logic implementation platform: Responsible for core business including terminal management, user management, policy management, and task management, it transforms standardized requests from open API services into control commands for cloud desktop hosts; the business logic implementation platform interacts with the agent module deployed in the cloud desktop host through host heartbeat to issue and execute control commands.

[0073] The open API service layer also includes: Routing layer: Receives and parses external call requests, and dispatches the requests according to the request path and HTTP method; Audit log module: Asynchronously records detailed information for each external call request, including the application identifier, time, interface, and result of each API call, to achieve traceability and audit requirements; Forwarding module: After encapsulating the request parameters verified by the application authorization and authentication mechanism, it forwards them to the business logic implementation platform through the internal interface.

[0074] Application authorization and authentication middleware includes: Application Management: Used to create, edit, enable / disable applications, and generate a unique identity for each application, including appid and appsecret; Permission configuration: Grant the application access permissions to API interfaces based on paths and HTTP methods; Authentication: Verify the validity of the appid and appsecret carried in the request before processing the request, and check whether the application has permission to access the current interface.

[0075] The business logic implementation platform's strategy management includes: The business logic implementation platform defines a unified strategy model, including login time period, IP restriction, password policy, script tasks, control panel, and security management; Dynamically bind policies to specified hosts, user groups, or organizations; The policy is sent to the cloud desktop host through the host heartbeat response, and the policy execution results of the cloud desktop host are received to achieve centralized management.

[0076] The agent module is deployed within the cloud desktop host. After the cloud desktop host is successfully issued, the cloud vendor platform transmits the address of the business logic implementation platform, the domain administrator account and password to the agent module. The agent module interacts with the business logic implementation platform, executes automatic domain addition of the cloud desktop host, receives and executes management and control instructions, and periodically reports the status of the cloud desktop host.

[0077] The agent module executes automatic domain addition for cloud desktop hosts. It uses the pre-received domain administrator account and password to execute the automatic domain addition module. The automatic domain addition module interacts with the business logic implementation platform to add the cloud desktop host to the domain managed by the business logic implementation platform, making it a domain member and thus bringing the cloud desktop host under unified management.

[0078] The proxy module performs single sign-on; the single sign-on includes system-level single sign-on and application-level single sign-on; system-level single sign-on is implemented when the user logs in through the client's business logic, the platform generates a temporary token, and the account and password are encrypted and transmitted to the proxy module of the cloud desktop host for verification through the temporary token. After successful verification, the user directly enters the cloud desktop host; application-level single sign-on is implemented when the user accesses a third-party business system after entering the cloud desktop host, and the account and password are verified through the temporary token and the user directly logs in to the third-party business system.

[0079] The multi-cloud adapted domestic IT innovation cloud desktop host automatic management system proposed in this embodiment can realize the multi-cloud adapted domestic IT innovation cloud desktop host automatic management method described in Embodiments 1 and 2, and has the same technical effect.

[0080] The above-described embodiments are merely preferred embodiments of the present invention and are only used to help understand the method and core ideas of this application. The scope of protection of the present invention is not limited to the above embodiments, and all technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.< / appsecret> < / appid>

Claims

1. A method for automatically managing multi-cloud adapted domestic IT-based cloud desktop hosts, characterized in that, include: S1. Build a unified open API service as the sole entry point for managing cloud desktop hosts; S2. Design an application authorization and authentication mechanism in the open API service. When an application is created on the management platform, authorize the application to access API interfaces for external calls. Authentication is performed during the call, and a standardized request is formed after successful authentication. S3. Set up the business logic implementation platform, responsible for core businesses including terminal management, user management, policy management, and task management, and transform standardized requests for open API services into control commands for cloud desktop hosts; S4. Business Logic Implementation: The platform interacts with the agent module deployed in the cloud desktop host through the host heartbeat to realize the issuance and execution of control commands.

2. The method for automatic management of multi-cloud adapted domestic IT innovation cloud desktop hosts according to claim 1, characterized in that, The open API service described in step S1, in addition to the application authorization and authentication mechanism, also includes: Routing function: Receives and parses external call requests, and distributes the requests according to the request path and HTTP method; Audit logs: asynchronously record detailed information for each external call request, including the application identifier, time, interface, and result of each API call, to achieve traceability and audit requirements; Forwarding function: After encapsulating the request parameters verified by the application authorization and authentication mechanism, it forwards them to the business logic implementation platform through the internal interface.

3. The automatic management method for multi-cloud adapted domestic IT innovation cloud desktop hosts according to claim 1, characterized in that, The application authorization and authentication mechanism described in step S2 includes: Application Management: Used to create, edit, enable / disable applications, and generate a unique identity for each application, including appid and appsecret; Permission configuration: Grant the application access permissions to API interfaces based on paths and HTTP methods; Authentication: Verify the validity of the appid and appsecret carried in the request before processing the request, and check whether the application has permission to access the current interface.

4. The method for automatic management of multi-cloud adapted domestic IT innovation cloud desktop hosts according to claim 1, characterized in that, The policy management described in step S3 includes: The business logic implementation platform defines a unified strategy model, including login time period, IP restriction, password policy, script tasks, control panel, and security management; Dynamically bind policies to specified hosts, user groups, or organizations; The policy is sent to the cloud desktop host through the host heartbeat response, and the policy execution results of the cloud desktop host are received to achieve centralized management.

5. The method for automatic management of multi-cloud adapted domestic IT innovation cloud desktop hosts according to claim 1, characterized in that, The agent module described in step S4 is deployed within the cloud desktop host. After the cloud desktop host is successfully issued, the cloud vendor platform transmits the address of the business logic implementation platform, the domain administrator account and password to the agent module. The agent module interacts with the business logic implementation platform, executes automatic domain addition of the cloud desktop host, receives and executes management and control instructions, and periodically reports the status of the cloud desktop host.

6. The automatic management method for multi-cloud adapted domestic IT innovation cloud desktop hosts according to claim 5, characterized in that, The agent module executes automatic domain addition for cloud desktop hosts. It uses the pre-received domain administrator account and password to execute the automatic domain addition module. The automatic domain addition module interacts with the business logic implementation platform to add the cloud desktop host to the domain managed by the business logic implementation platform, making it a domain member and thus bringing the cloud desktop host under unified management.

7. The method for automatic management of multi-cloud adapted domestic IT innovation cloud desktop hosts according to claim 5, characterized in that, The proxy module performs single sign-on; the single sign-on includes system-level single sign-on and application-level single sign-on; system-level single sign-on is implemented when the user logs in through the client's business logic, the platform generates a temporary token, and the account and password are encrypted and transmitted to the proxy module of the cloud desktop host for verification through the temporary token. After successful verification, the user directly enters the cloud desktop host; application-level single sign-on is implemented when the user accesses a third-party business system after entering the cloud desktop host, and the account and password are verified through the temporary token and the user directly logs in to the third-party business system.

8. A multi-cloud adapted domestic IT innovation cloud desktop host automatic management system, characterized in that, include: Open API Service Layer: Build a unified open API service as the sole entry point for managing cloud desktop hosts; In the open API service layer, an application authorization and authentication middleware is designed. When an application is created on the management platform, the application is authorized to access API interfaces for external calls. Authentication is performed during the call, and a standardized request is formed after successful authentication. Business logic implementation platform: Responsible for core business including terminal management, user management, policy management, and task management, it transforms standardized requests from open API services into control commands for cloud desktop hosts; the business logic implementation platform interacts with the agent module deployed in the cloud desktop host through host heartbeat to issue and execute control commands.

9. The automatic management system for multi-cloud adapted domestic IT-innovative cloud desktop hosts according to claim 8, characterized in that, The open API service layer also includes: Routing layer: Receives and parses external call requests, and dispatches the requests according to the request path and HTTP method; Audit log module: Asynchronously records detailed information for each external call request, including the application identifier, time, interface, and result of each API call, to achieve traceability and audit requirements; Forwarding module: After encapsulating the request parameters verified by the application authorization and authentication mechanism, it forwards them to the business logic implementation platform through the internal interface.

10. The automatic management system for multi-cloud adapted domestic IT-innovative cloud desktop hosts according to claim 8, characterized in that, The agent module is deployed within the cloud desktop host. After the cloud desktop host is successfully issued, the cloud vendor platform transmits the address of the business logic implementation platform, the domain administrator account and password to the agent module. The agent module interacts with the business logic implementation platform, executes automatic domain addition of the cloud desktop host, receives and executes management and control instructions, and periodically reports the status of the cloud desktop host.

Images