Remote management method and apparatus for cloud server

Abstract

Provided in the present disclosure are a remote management method and apparatus for a cloud server. The method is applied to a cloud server that is created for a user on a cloud service end, wherein the user performs communication with the cloud server by means of a cloud service system. The method comprises: in response to a received remote management request that is sent by a user for a cloud server, generating an asymmetric key pair configured to perform encryption and decryption on privacy information in a remote management command; storing and maintaining the key pair in a secure storage space in the cloud server, and sending a public key in the key pair to the user by means of a cloud service system; and in response to the received remote management command that is sent by the user and is encrypted by means of the public key, using a private key, which corresponds to the public key, to decrypt the remote management command, and executing the decrypted remote management command, so as to perform remote management for the cloud server.

Description

A cloud server remote management method and device

[0001] Cross-reference

[0002] This disclosure claims priority to the Chinese patent application filed with the China Patent Office on July 25, 2023, with application number 202310923256.9 and application name “A Method and Device for Remote Management of Cloud Servers,” the entire contents of which are incorporated by reference into this disclosure. Technical Field

[0003] The embodiments of the present disclosure relate to the field of cloud computing technology. More specifically, the embodiments of the present disclosure relate to a cloud server remote management method and device. Background Art

[0004] With the development of cloud computing technology, renting cloud servers from cloud service providers has gradually become a mainstream option for enterprise users. Typically, after renting a cloud server from a cloud service provider, users can use the cloud service system to send commands to the cloud server to manage it. However, when users use the cloud service system to send commands containing private information to the cloud server, privacy and security concerns may arise.

[0005] Summary of the Invention

[0006] To overcome the problems existing in the related art, the present disclosure provides the following methods and devices.

[0007] In a first aspect of the embodiments of the present disclosure, a cloud server remote management method is provided, which is applied to a cloud server created for a user on a cloud service end, wherein the user communicates with the cloud server through a cloud service system; the method comprises:

[0008] In response to a received remote management request for the cloud server sent by a user, generating an asymmetric key pair configured to encrypt and decrypt private information in the remote management command;

[0009] Storing and maintaining the key pair in a secure storage space on the cloud server, and sending the public key in the key pair to the user via the cloud service system;

[0010] In response to receiving a remote management command sent by the user and encrypted by the public key, the remote management command is decrypted using a private key corresponding to the public key, and the decrypted remote management command is executed to remotely manage the cloud server.

[0011] In a second aspect of the embodiments of the present disclosure, a cloud server remote management device is provided, which is applied to a cloud server created for a user on a cloud service end, wherein the user communicates with the cloud server through a cloud service system; the device includes:

[0012] a key pair generating unit configured to generate, in response to a received remote management request for the cloud server sent by a user, an asymmetric key pair configured to encrypt and decrypt private information in the remote management command;

[0013] a public key sending unit, configured to store and maintain the key pair in a secure storage space on the cloud server, and send the public key in the key pair to the user via the cloud service system;

[0014] The remote management unit is configured to respond to a remote management command sent by the user and encrypted with the public key, decrypt the remote management command using a private key corresponding to the public key, and execute the decrypted remote management command to remotely manage the cloud server.

[0015] In a third aspect of the embodiments of the present disclosure, a storage medium is provided; the storage medium stores a computer program, which implements the steps of the above method when executed.

[0016] In a fourth aspect of the embodiments of the present disclosure, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above method when executing the program.

[0017] The above embodiments of the present disclosure have at least the following beneficial effects:

[0018] In the above technical solution, an asymmetric encryption and decryption key pair is maintained on the cloud server, and the public key is sent to the user so that the user can use the public key to encrypt the command containing private content. After receiving the encrypted command, the private key corresponding to the public key is used to decrypt and execute it. In the entire link of the command transmission, the cloud service provider cannot obtain the command content before encryption, thereby ensuring the security and credibility of the cloud service provider's services and ensuring the data security and privacy of users. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] To more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some of the embodiments described in the present disclosure, and those skilled in the art can also obtain other drawings based on these drawings.

[0020] FIG1 schematically shows an architecture diagram of a cloud server remote management method according to an embodiment of the present disclosure;

[0021] FIG2 schematically shows a flow chart of a cloud server remote management method according to an embodiment of the present disclosure;

[0022] FIG3 schematically shows an interactive flow chart of a cloud server remote management method according to an embodiment of the present disclosure;

[0023] FIG4 schematically shows an interactive diagram of a cloud server remote management method according to an embodiment of the present disclosure;

[0024] FIG5 schematically shows a block diagram of a cloud server remote management device according to an embodiment of the present disclosure;

[0025] FIG6 schematically shows a hardware structure diagram of a computer device in which a cloud server remote management method according to an embodiment of the present disclosure is located.

[0026] In the drawings, the same or corresponding reference numerals denote the same or corresponding parts. DETAILED DESCRIPTION

[0027] The principles and spirit of the present disclosure will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided to enable those skilled in the art to better understand and implement the present disclosure, and are not intended to limit the scope of the present disclosure in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0028] Those skilled in the art will appreciate that the embodiments of the present disclosure may be implemented as a system, apparatus, device, method, or computer program product. Therefore, the present disclosure may be implemented in the following forms: entirely in hardware, entirely in software (including firmware, resident software, microcode, etc.), or in a combination of hardware and software.

[0029] First, let’s introduce some related concepts that may be involved in the disclosure:

[0030] OpenAPI: refers to the API interface of cloud services provided by cloud vendors to users, generally provided to users via HTTP or HTTPS services.

[0031] Cloud Service Gateway: This refers to the cloud vendor's server responsible for receiving OpenAPI requests from users. Generally, the server requests APIs belonging to different products and then forwards the requests to the corresponding product's control server.

[0032] Cloud service system: refers to the system used by cloud vendors to process users' OpenAPI requests.

[0033] Cloud server: refers to a physical or virtual computer provided by a cloud provider to users; the server can be used by users to run computer programs.

[0034] Operation and maintenance agent program: refers to a computer program used to receive and execute user remote commands. It is generally developed and provided by cloud vendors and runs in cloud servers.

[0035] With the development of cloud computing technology, renting cloud servers from cloud service providers has gradually become a mainstream option for enterprise users. Cloud service providers can provide users with automated cloud server operation and maintenance capabilities by providing cloud service API interfaces corresponding to cloud servers. Users can use the cloud service system to send commands to cloud servers to manage them. Specifically, they can call the cloud gateway API interface to send commands with specified content to a designated cloud server. The control server will store the command and notify the cloud server to receive and execute the command. Typically, a proxy service is set up on the cloud server to be responsible for communication with users. Users manage the cloud server by calling the proxy service's cloud service API interface.

[0036] Cloud service providers can usually ensure the privacy and confidentiality of user data on cloud servers, such as adopting strict access control, data encryption, network isolation, and compliance certification measures.

[0037] However, when users send commands to cloud servers through the cloud service system, the transmission and storage of command content go through multiple links such as the cloud service gateway, management and control server, management and control database, and user cloud server. The command content can be recorded or viewed at each link. When the command content contains content that needs to be kept confidential, the user's information privacy and content security cannot be guaranteed.

[0038] To overcome the problems existing in the related art, the present disclosure provides the following embodiments.

[0039] The solution of the present disclosure is described in detail below with reference to the accompanying drawings.

[0040] Please refer to Figure 1, which is a schematic diagram of the architecture of an autonomous driving data processing system provided by an exemplary embodiment. As shown in Figure 1, the system may include a network 10, a server 11, and several electronic devices, such as computers 12, 13, and 14.

[0041] Server 11 may be a physical server containing a standalone host, or it may be a virtual server hosted by a host cluster, a cloud server, or the like. Computers 12-14 are just one type of electronic device that a user may use. In practice, users may also use electronic devices such as tablets, mobile phones, PDAs (Personal Digital Assistants), and wearable devices (such as smart glasses and smart watches), but one or at least one embodiment of the present disclosure is not limited thereto. Network 10 may include various types of wired or wireless networks.

[0042] In one embodiment, server 11 can cooperate with computers 12-14; computers 12-14 can accept user operations and upload the received commands and files to server 11 via network 10, and server 11 can then process the files based on the solution of the present disclosure. In another embodiment, computers 12-14 can independently implement the solution of the present disclosure; computers 12-14 can accept user operations and process the received commands and files based on the solution of the present disclosure to achieve remote management of cloud servers.

[0043] Please refer to FIG. 2 , which is a flowchart of a cloud server remote management method provided by an exemplary embodiment. The method is applied to a processing device, which may be the server 11 or computers 12 - 14 shown in FIG. 1 .

[0044] The method may include the following steps:

[0045] Step 202: In response to a received remote management request sent by a user to the cloud server, an asymmetric key pair is generated for encrypting and decrypting private information in the remote management command.

[0046] When a user rents a cloud server created for the user on a cloud service end provided by a cloud service provider, the user communicates with the cloud server through the cloud service system and sends remote management commands to manage the cloud server.

[0047] When remote management commands contain private information that needs to be kept confidential, such as passwords, confidential data, etc., there may be privacy and security issues if the remote management commands are transmitted directly through the cloud service system.

[0048] The private information in the remote command can be encrypted and sent to the cloud server. However, the decryption key is also private information and cannot be sent directly.

[0049] To solve this problem, asymmetric encryption methods can be used to encrypt private information in remote management commands. The public key set for encryption can be transmitted in plain text, while the decryption key is only used on the cloud server side.

[0050] Therefore, asymmetric key pairs should be generated and maintained on the cloud server.

[0051] When a user needs to send a remote management command containing private information to the cloud server, he or she may send a remote management request instead of directly sending the remote management instruction.

[0052] Upon receiving the remote management request through the cloud service system, the cloud server may generate an asymmetric key pair corresponding to the remote management request. The asymmetric key pair includes a corresponding public key and a corresponding private key, with the public key configured to encrypt the private information in the remote management command and the private key configured to decrypt the private information in the remote management command.

[0053] Step 204: The key pair is stored and maintained in a secure storage space on the cloud server, and the public key in the key pair is sent to the user via the cloud service system.

[0054] After generating the asymmetric key pair, you can store and maintain it in a secure storage space on the cloud server. The private key in the key pair is used for decryption. If the private key is leaked, the security of the private information cannot be guaranteed.

[0055] The public key in the key pair is only used for encryption and can be transmitted in plain text. The public key can be returned to the user through the cloud service system as a response to the above remote management request, so that the user can use the public key to encrypt the remote management command.

[0056] After receiving the public key returned by the cloud server, the user can use it to encrypt the private content in the remote management command. Remote management commands encrypted with this public key can only be decrypted using the corresponding private key. Therefore, users can send remote management commands encrypted with the public key to the cloud server through the cloud service system.

[0057] Although the encrypted remote management command can be obtained in each link of the transmission and storage, it cannot be decrypted due to the lack of the corresponding private key. Therefore, the transmission process is safe.

[0058] Step 206: In response to receiving the remote management command encrypted by the public key sent by the user, decrypt the remote management command using the private key corresponding to the public key, and execute the decrypted remote management command to remotely manage the cloud server.

[0059] When the cloud server receives the remote management command encrypted by the public key from user Dasong, it can use the private key corresponding to the public key to decrypt the encrypted private content in the remote management command to obtain the decrypted remote management command.

[0060] After obtaining the decrypted remote management command, you can use it to remotely manage the cloud server. When the remote command is executed, the command execution result can also be sent to the user.

[0061] In the above embodiment, an asymmetric encryption and decryption key pair is maintained on the cloud server, and a public key is sent to the user so that the user can use the public key to encrypt a command containing private content. After receiving the encrypted command, the private key corresponding to the public key is used to decrypt and execute it. In the entire link of the command transmission, the cloud service provider cannot obtain the command content before encryption, thereby ensuring the security and credibility of the cloud service provider's services and ensuring the data security and privacy of users.

[0062] Please refer to FIG3 , which schematically shows an interactive flow chart of a cloud server remote management method according to an embodiment of the present disclosure.

[0063] The overall process of the cloud server remote management method is described below with reference to FIG3 .

[0064] As shown in Figure 3, the cloud server remote management method disclosed herein involves three main entities: user 31, cloud service system 32, and cloud server 33. All communications between the user and the cloud server must pass through the cloud service system. Therefore, the cloud service system can access all content during the communication process between the user and the cloud server.

[0065] This remote management method can be broken down into the following steps:

[0066] 301. The user sends a remote management request to the cloud server;

[0067] 302. Generate a key pair on the cloud server;

[0068] 303. The cloud server sends the public key to the user;

[0069] 304. The user uses the public key to encrypt the remote management command;

[0070] 305. The user sends a public key encrypted remote management command to the cloud server;

[0071] 306. The cloud server decrypts the remote management command using the private key corresponding to the public key;

[0072] 307. The cloud server executes remote management commands.

[0073] As shown in Figure 3, in each of the above steps, the cloud service system can obtain information including: the remote management request obtained in step 301, the public key obtained in step 303, and the public-key-encrypted remote management request obtained in step 305. However, the remote management request, the public key, and the public-key-encrypted remote management request cannot reveal private information in the remote management request.

[0074] In an illustrative embodiment shown in the present disclosure, the remote management request sent by the user may also include key generation parameters, and the cloud server may generate an asymmetric key based on the key management parameters.

[0075] Key generation parameters can include:

[0076] Key algorithm: indicates the algorithm used to generate the asymmetric key pair, such as RSA (Rivest-Shamir-Adleman) algorithm, Elliptic Curve Cryptography (ECC) algorithm, DSA (Digital Signature Algorithm) algorithm, or ECDSA (Elliptic Curve Digital Signature Algorithm) algorithm;

[0077] Key Length: Indicates the length of the public key in the generated asymmetric key pair, for example, 1024 bits, 2048 bits, etc. The length of the public key is generally related to the length of the plaintext to be encrypted, the encryption and decryption time, and the difficulty of cracking the encryption. Generally, longer plaintext requires a larger minimum key length. A longer key length increases the encryption and decryption time and the difficulty of cracking the encryption. Users can select an appropriate key length based on their needs.

[0078] Key validity period: Indicates the validity period of the key. Decryption is possible only within the validity period. The key will be invalidated after the validity period. The key validity period can be set according to the duration required for encryption and communication. For example, the key validity period can be set to 60 seconds, 120 seconds, 300 seconds, etc.

[0079] Key Usage Times: Indicates the maximum number of times a key can be used. If the number of times is exceeded, the key will be invalidated. For example, it can be set to 1 time, 2 times, etc.

[0080] The present disclosure does not specifically limit the specific settings and expressions of the key generation parameters.

[0081] For example, the key generation parameters for a remote management request can be expressed as follows:

[0082] --algorithm=rsa--time-to-live=60--max-access-times=1;

[0083] The above key generation parameters indicate that the key pair to be generated is an asymmetric key pair with the RSA algorithm, a validity period of 60 seconds, and a maximum usage of 1 time.

[0084] In addition, you can also set default values ​​or default values ​​for key generation parameters. When no key generation parameters are specified, the preset default values ​​can be used as key generation parameters.

[0085] In an illustrative embodiment of the present disclosure, a cloud server can simultaneously manage and maintain multiple key pairs. A cloud server can be managed by multiple user accounts, and the same user account can send multiple remote management commands to remotely manage one or more programs on the cloud server. Therefore, the cloud server can simultaneously manage and maintain multiple key pairs to encrypt and decrypt different remote management commands.

[0086] Specifically, when a key pair is generated, a unique key number can be assigned to the generated key pair as identification information for the key. The key number can be used to determine the corresponding key pair. Typically, the key number can be a number or a string; it can be generated randomly or according to a preset generation algorithm, and this description does not specify this.

[0087] When maintaining key pairs in the cloud server, they are associated with their key numbers. When a remote management request is received from a user, the key number and public key corresponding to the key pair are sent to the user. The user encrypts the remote management command using the public key and then sends the encrypted command along with the key number. When the cloud server receives the encrypted remote management command, it uses the key number to determine the private key in the key pair that encrypted the remote management command and decrypts it.

[0088] In an exemplary embodiment of the present disclosure, a dedicated key number may not be set, and the public key of the key pair may be used as the key number. When the user sends an encrypted remote management command, the public key may be sent together so that the cloud server can determine the corresponding private key based on the public key.

[0089] Please refer to FIG4 , which schematically shows an interactive diagram of a cloud server remote management method according to an embodiment of the present disclosure.

[0090] Typically, a cloud server deploys an agent service. This agent service is typically a standard service provided by the cloud service provider, and is configured to provide users with an API interface for communicating with the cloud server. Users communicate with the cloud server by calling the API interface corresponding to the agent service. The agent service must remain running continuously to ensure effective communication.

[0091] The remote management requests and remote management commands sent by users to the cloud server are all sent to the proxy service through the API interface, and the proxy service returns the public key or the execution result of the remote management command.

[0092] The proxy service can also authenticate information sent to the cloud server to ensure security. For example, remote management requests and remote management commands sent by users must be authenticated by the proxy service before they can be transmitted to the cloud server for execution.

[0093] The cloud server also deploys a key management service configured to manage key pairs. This key management service can also be a standard service provided by the cloud service provider.

[0094] The Key Management Service is responsible for generating key pairs and their corresponding key numbers, and for maintaining and managing them. To ensure the security of key pairs, especially private keys, they can be stored in the memory space associated with the Key Management Service. The private key in a key pair is always maintained only within the Key Management Service and is not exported in any form to ensure security.

[0095] After receiving the remote management command encrypted by the public key, the key management service uses the private key corresponding to the public key to decrypt the private information in the remote management service.

[0096] The key management service can generate a key pair based on the key pair generation parameters in the remote management request, and associate the key generation parameters such as the key validity period and the number of times the key can be used with the key pair and store them.

[0097] For example, the key pair management service can maintain key pairs in the following form:

[0098] The validity period is expressed in the form of a timestamp or natural time.

[0099] Each time the key management service completes decryption of the remote management service to enable it to execute, it can update the remaining usage count corresponding to the private key set for decryption and delete the key pair with a remaining usage count of 0, and no longer maintain and manage it.

[0100] You can also compare the current time with the validity period of the key pair to determine whether the key pairs under maintenance and management have exceeded their validity period, and delete the key pairs that have exceeded their validity period and no longer maintain and manage them.

[0101] In addition, when no key pair is maintained or managed in the key management service, the key management service may be terminated until a new remote management request is received.

[0102] The following describes a specific implementation of the cloud server remote management method in conjunction with FIG4 .

[0103] The user 40 calls the API interface corresponding to the proxy service 42 through the cloud service system 41 to achieve communication with the cloud server.

[0104] The cloud server remote management method may specifically include the following process.

[0105] 401. The user invokes the API interface corresponding to the proxy service and sends a remote management request to the target cloud server. The specific content of the remote management request may include: starting the remote management service 44 to request the public key and key number of the new key from the key management service based on the given key generation parameters.

[0106] 402. The cloud service system verifies the legitimacy of the remote management request, including verifying the identity of the user and the legitimacy of the request content. After verification, the remote management request is sent to the proxy service corresponding to the target cloud server.

[0107] 403. After receiving the remote management request, the proxy service creates and executes a new script, remote management request script 43;

[0108] 404. The remote management request script starts the remote management service so that it requests the public key and key number of the new key from the key management service;

[0109] 405. The remote management service searches for the actual process corresponding to the key management service and sends a key pair generation request and key generation parameters to the key management service through inter-process communication.

[0110] 406. The key management service receives the request from the remote management service and generates an asymmetric key based on the key generation parameters and a corresponding key number. The key generation parameters, including the public key and private key in the generated asymmetric key, the corresponding key number, and the corresponding key validity period and number of times the key can be used, are maintained in the memory space corresponding to the key management service. The public key in the generated key pair and the corresponding key number are sent to the remote management service via inter-process communication.

[0111] 407. After receiving the public key and key number, the remote management service prints them to standard output to return the remote management request script;

[0112] 408. The remote management request script prints the public key and secret key number of the remote management service to standard output for output;

[0113] 409. The proxy service submits the execution result and output of the remote management request script to the cloud service system; the cloud service system may submit the public key and key number to the output of the remote management request script;

[0114] 410. The user can obtain the output of the remote management request script corresponding to the remote management request from the cloud service system, and can obtain the public key and key number from it;

[0115] 411. The user uses the public key to encrypt the private content in the remote management command, and calls the corresponding API interface of the proxy service to send the encrypted remote management command to the target cloud server; the remote management command carries the key number;

[0116] 412. The cloud service system verifies the legitimacy of the remote management command, including verifying the identity of the user and the legitimacy of the command content; after passing the verification, the remote management command is sent to the proxy service corresponding to the target cloud server;

[0117] 413. After receiving the remote management request, the proxy service creates and executes a new script, the remote management command script 46;

[0118] 414. The remote management request script starts the remote management service so that it requests the key management service to decrypt the encrypted remote management command;

[0119] 415. The remote management service searches for the actual process corresponding to the key management service and sends the request for decrypting the encrypted remote management command, the encrypted private content, and the key number to the key management service through inter-process communication.

[0120] 416. The key management service receives the request from the remote management service, searches for the private key in the key pair corresponding to the key number, decrypts the encrypted private content using the private key, and sends the decrypted private content to the remote management service via inter-process communication.

[0121] 417. The remote management service obtains the decrypted private content and prints it to the standard output; and executes the remote management command based on the decrypted private content in the standard output to manage the cloud server;

[0122] 418. The remote management command script outputs the execution results of the remote management command;

[0123] 419. The proxy service submits the execution results and output of the remote management command script to the cloud service system;

[0124] 420. Users can obtain the execution results and output of the remote management command script corresponding to the remote management command from the cloud service system.

[0125] In an exemplary embodiment shown in this specification, the decrypted private content is represented in the form of a variable, and the value of the variable, i.e., the plain text of the private information, is stored in the memory space corresponding to the remote management command script or remote management service;

[0126] The remote management service can call the privacy information through the above variables to execute remote management commands and remotely manage the cloud server.

[0127] When the remote management command is executed and the execution results and output are returned and submitted to the cloud service system, the remote service script and remote management service can terminate their operation, the corresponding memory space is released, and the plaintext of the privacy information in the remote management command is deleted.

[0128] In cloud server management, the sub-accounts of users with cloud server management permissions may also view and audit the content of remote management commands. Through the above method, the private information in remote management commands is always represented in the form of ciphertext or variables, and is never stored in plaintext. It is only maintained in memory space. After the memory space is released, it cannot be viewed in any form. Therefore, through the above method, no one (including cloud service providers and users themselves) can obtain the private key or the plaintext of the private information in the remote management command. Therefore, no one can view or decrypt the original private information, and the possibility of private information leakage is completely eliminated from a technical perspective.

[0129] Since key management services usually require continuous maintenance of key pairs and need to be kept running, and in cloud servers, the proxy service also needs to be kept running, the key management service can be made a sub-service of the proxy service, and all key management service functions can be integrated into the proxy service.

[0130] In an exemplary embodiment shown in this specification, the remote management command can be set to modify the password of the target program on the cloud server based on the new password; the privacy information in the remote management command can include the new password.

[0131] By changing the password of the target program on the cloud server in this way, the password security can be guaranteed.

[0132] In an exemplary embodiment of the present disclosure, a cloud server remote management device is also provided. Please refer to Figure 5, which is a block diagram of the cloud server remote management device according to an embodiment of the present disclosure.

[0133] The device may include the following components:

[0134] A key pair generating unit 510 is configured to generate an asymmetric key pair configured to encrypt and decrypt private information in a remote management command in response to a remote management request sent by a user to the cloud server;

[0135] The public key sending unit 520 is configured to store and maintain the key pair in a secure storage space on the cloud server, and send the public key in the key pair to the user via the cloud service system;

[0136] The remote management unit 530 is configured to respond to the remote management command sent by the user and encrypted by the public key, decrypt the remote management command using the private key corresponding to the public key, and execute the decrypted remote management command to remotely manage the cloud server.

[0137] Optionally, the remote management request includes key generation parameters;

[0138] The key generation parameters include at least one of the following:

[0139] Key algorithm, key length, key validity period, and number of times the key can be used;

[0140] The key pair generating unit 510 is specifically configured to:

[0141] Based on the key generation parameters, an asymmetric key pair configured to encrypt and decrypt private information in the remote management command is generated.

[0142] The key pair generating unit 510 is specifically configured to:

[0143] Generate an asymmetric key pair configured to encrypt and decrypt private information in remote management commands, and a corresponding key number;

[0144] The public key sending unit 520 is specifically configured to:

[0145] Sending the public key in the key pair and the key number corresponding to the key pair to the user through the cloud service system;

[0146] The remote management command encrypted by the public key carries the key number.

[0147] Optionally, a proxy service corresponding to the cloud server is deployed on the cloud server; the proxy service is configured to provide the user with an API interface for communicating with the cloud server;

[0148] The key pair generating unit 510 is specifically configured to:

[0149] responding to a remote management request received from a user sent to the proxy service via the cloud service system;

[0150] The public key sending unit 520 is specifically configured to:

[0151] The proxy service sends the public key in the key pair to the user via the cloud service system;

[0152] The remote management unit 530 is specifically configured to:

[0153] In response to a received remote management command encrypted by the public key and sent by the user to the proxy service through the cloud service system.

[0154] Optionally, a key management service configured to manage key pairs is also deployed on the cloud server;

[0155] The asymmetric key pair configured to encrypt and decrypt private information in remote management commands is generated and managed by the key management service;

[0156] The key pair is maintained by the key management service in a memory space corresponding to the key management service.

[0157] Optionally, the key management service is a subservice of the proxy service.

[0158] Optionally, the key pair generating unit 510 and the public key sending unit 520 are specifically configured as follows:

[0159] In response to a received remote management request for the cloud server sent by a user, creating and executing a remote management request script;

[0160] Wherein, the remote management request script is set to:

[0161] Sending a key generation request to the key pair management service, so that the key pair management service generates an asymmetric key pair configured to encrypt and decrypt private information in the remote management command, maintains the key pair in an isolated memory corresponding to the key pair management service, and returns the public key in the key pair to the remote management request script;

[0162] In response to receiving the public key, the public key is sent to the user via the cloud service system as a response to the remote management request.

[0163] Optionally, the key pair generating unit 510 and the public key sending unit 520 are specifically configured as follows:

[0164] In response to a received remote management command sent by the user and encrypted by the public key, creating and executing a remote management command script;

[0165] The remote management command script is set as:

[0166] Sending a decryption request to the key pair management service, so that the key pair management service uses the private key corresponding to the public key to decrypt the remote management command, and returns the decrypted remote management command to the remote management command script;

[0167] The decrypted remote management command is executed to remotely manage the cloud server.

[0168] Optionally, the decrypted remote management command is output as a program standard output, wherein the private information is represented in the form of a variable, and the value of the variable is stored in a memory space corresponding to the remote management command script;

[0169] The remote management unit 530 is specifically configured to:

[0170] The private information in the memory space is called through the variables in the program standard output to execute the decrypted remote management command to perform remote management on the cloud server.

[0171] Optionally, the device further includes an invalid key deleting unit 540, configured to:

[0172] Determine whether there are any key pairs under maintenance whose usable times are 0 or invalid key pairs whose validity period has expired;

[0173] If the invalid key pair exists, delete the invalid key pair.

[0174] Optionally, the device further includes a service termination unit 550, configured to:

[0175] Determine whether there is a key pair under maintenance;

[0176] If there is no key pair under maintenance, the key management service is terminated.

[0177] Optionally, the remote management command is configured to modify the password of a target program on the cloud server based on the new password;

[0178] The private information includes the new password;

[0179] The remote management of the cloud server includes modifying the password of the target program based on the new password.

[0180] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0181] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on at least one network unit. Some or all of the units may be selected according to actual needs to achieve the purpose of the disclosed solution. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0182] In an exemplary embodiment of the present disclosure, an embodiment of a device and a terminal to which the device is applied is also provided.

[0183] The embodiments of the apparatus disclosed herein can be applied to computer devices, such as servers or terminal devices. The apparatus embodiments can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor in which it is located reading the corresponding computer program instructions in the non-volatile memory into the memory for execution. From a hardware perspective, as shown in FIG6 , FIG6 is a hardware structure diagram of a computer device 60 in which an apparatus of an embodiment of the present disclosure is located. In addition to the processor 610, memory 630, network interface 620, and non-volatile memory 640 shown in FIG6 , the server or electronic device in which the apparatus is located in the embodiment may also include other hardware, usually according to the actual function of the computer device, which will not be described in detail.

[0184] In exemplary embodiments of the present disclosure, a computer-readable storage medium is further provided, on which a program product capable of implementing the above-mentioned method of the present disclosure is stored. In some possible embodiments, various aspects of the present disclosure may also be implemented in the form of a program product, which includes program code. When the program product is executed on a terminal device, the program code is configured to cause the terminal device to perform the steps described in the "Exemplary Method" section of the present disclosure according to various exemplary embodiments of the present disclosure.

[0185] According to an embodiment of the present disclosure, a program product configured to implement the above-described method may be a portable compact disc read-only memory (CD-ROM) and include program code, and may be run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto. In this document, a readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0186] The program product may employ any combination of one or at least one readable medium. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection having one or at least one wire, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0187] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transfer a program configured for use by or in conjunction with an instruction execution system, apparatus, or device.

[0188] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0189] Program code configured to perform the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, and the like, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0190] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0191] Although the present disclosure includes many specific implementation details, these should not be interpreted as limiting the scope of any invention or the scope of protection claimed, but are primarily used to describe the features of specific embodiments of particular inventions. Certain features described in at least one embodiment of the present disclosure may also be implemented in combination in a single embodiment. On the other hand, the various features described in a single embodiment may also be implemented separately in at least one embodiment or in any suitable sub-combination. In addition, although features may function in certain combinations as described above and even initially claimed as such, one or at least one feature from the claimed combination may be removed from the combination in some cases, and the claimed combination may point to a sub-combination or a variation of the sub-combination.

[0192] Similarly, although operations are depicted in a particular order in the accompanying drawings, this should not be understood as requiring that these operations be performed in the particular order shown or performed sequentially, or that all illustrated operations be performed to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. In addition, the separation of various system units and components in the above-described embodiments should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product, or packaged into at least one software product.

[0193] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the particular order shown or sequential sequence to achieve the desired results. In some implementations, multitasking and parallel processing may be advantageous.

[0194] The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present disclosure should be included in the scope of protection of the present disclosure. Industrial Applicability

[0195] The disclosed embodiments propose a method and apparatus for remote management of a cloud server. By maintaining an asymmetric encryption and decryption key pair on the cloud server, the public key is sent to the user, allowing the user to use the public key to encrypt commands containing private content. After receiving the encrypted command, the private key corresponding to the public key is used to decrypt and execute the command. In all aspects of command transmission, the cloud service provider cannot obtain the command content before encryption, thereby ensuring the security and reliability of the cloud service provider's services and the data security and privacy of users.

Claims

1. A cloud server remote management method, applied to a cloud server created for a user on a cloud service end, wherein the user communicates with the cloud server through a cloud service system; the method comprises: In response to a received remote management request sent by a user to the cloud server, generating an asymmetric key pair configured to encrypt and decrypt private information in the remote management command; Storing and maintaining the key pair in a secure storage space on the cloud server, and sending the public key in the key pair to the user through the cloud service system; In response to receiving a remote management command sent by the user and encrypted by the public key, the remote management command is decrypted using a private key corresponding to the public key, and the decrypted remote management command is executed to remotely manage the cloud server.

2. The method according to claim 1, wherein: The remote management request includes key generation parameters; The key generation parameters include at least one of the following: Key algorithm, key length, key validity period, and number of times the key can be used; The generating of an asymmetric key pair configured to encrypt and decrypt private information in a remote management command includes: Based on the key generation parameters, an asymmetric key pair configured to encrypt and decrypt private information in the remote management command is generated.

3. The method according to claim 1, wherein: The generating of an asymmetric key pair configured to encrypt and decrypt private information in a remote management command includes: Generate an asymmetric key pair configured to encrypt and decrypt private information in a remote management command, and a key number corresponding thereto; The sending the public key in the key pair to the user through the cloud service system includes: Sending the public key in the key pair and the key number corresponding to the key pair to the user through the cloud service system; The remote management command encrypted by the public key carries the key number.

4. The method according to claim 1, wherein: A proxy service corresponding to the cloud server is deployed on the cloud server; the proxy service is configured to provide the user with an API interface for communicating with the cloud server; The responding to the remote management request for the cloud server sent by the user includes: Responding to a remote management request received from a user sent to the proxy service via the cloud service system; The sending the public key in the key pair to the user through the cloud service system includes: The proxy service sends the public key in the key pair to the user through the cloud service system; The response to the received remote management command sent by the user and encrypted by the public key comprises: In response to a received remote management command encrypted by the public key and sent by the user to the proxy service through the cloud service system.

5. The method according to claim 4, wherein: The cloud server is also deployed with a key management service configured to manage key pairs; The asymmetric key pair configured to encrypt and decrypt private information in the remote management command is generated and managed by the key management service; The key pair is maintained by the key management service in a memory space corresponding to the key management service.

6. The method according to claim 5, wherein: The key management service is a sub-service of the proxy service.

7. The method according to claim 5, wherein: In response to a received remote management request sent by a user to the cloud server, generating an asymmetric key pair configured to encrypt and decrypt private information in the remote management command; Storing and maintaining the key pair in a secure storage space on the cloud server, and sending the public key in the key pair to the user through the cloud service system, includes: In response to a received remote management request sent by a user to the cloud server, creating and executing a remote management request script; Wherein, the remote management request script is set as: Send a key generation request to the key pair management service, so that the key pair management service generates an asymmetric key pair configured to encrypt and decrypt private information in the remote management command, maintains the key pair in an isolated memory corresponding to the key pair management service, and returns a public key in the key pair to the remote management request script; In response to receiving the public key, the public key is sent to the user via the cloud service system as a response to the remote management request.

8. The method according to claim 5, wherein: The step of decrypting the remote management command encrypted by the public key using the private key corresponding to the public key in response to the received remote management command sent by the user, and executing the decrypted remote management command to remotely manage the cloud server includes: In response to receiving a remote management command sent by the user and encrypted by the public key, creating and executing a remote management command script; Wherein, the remote management command script is set as: Sending a decryption request to the key pair management service, so that the key pair management service uses the private key corresponding to the public key to decrypt the remote management command, and returns the decrypted remote management command to the remote management command script; The decrypted remote management command is executed to perform remote management on the cloud server.

9. The method according to claim 8, wherein: The decrypted remote management command is output as a program standard output, wherein the private information is represented in the form of a variable, and the value of the variable is stored in the memory space corresponding to the remote management command script; The executing the decrypted remote management command to remotely manage the cloud server includes: The private information in the memory space is called through the variables in the standard output of the program to execute the decrypted remote management command to perform remote management on the cloud server.

10. The method according to claim 5, wherein: After decrypting the remote management command using the private key corresponding to the public key, the method further includes: Determine whether there are any key pairs under maintenance whose usable times are 0 or invalid key pairs whose validity period has expired; If the invalid key pair exists, delete the invalid key pair.

11. The method according to claim 10, wherein: After deleting the invalid key pair, the method further includes: Determine whether there is a key pair under maintenance; If there is no key pair under maintenance, the key management service is terminated.

12. The method according to claim 1, wherein: The remote management command is configured to modify the password of the target program on the cloud server based on the new password; The private information includes the new password; The remote management of the cloud server includes modifying the password of the target program based on the new password.

13. A cloud server remote management device, applied to a cloud server created for a user on a cloud service end, wherein the user communicates with the cloud server through a cloud service system; the device comprises: A key pair generating unit, configured to generate an asymmetric key pair configured to encrypt and decrypt private information in a remote management command in response to a remote management request sent by a user to the cloud server; A public key sending unit, configured to store and maintain the key pair in a secure storage space on the cloud server, and send the public key in the key pair to the user through the cloud service system; The remote management unit is configured to respond to a remote management command sent by the user and encrypted by the public key, decrypt the remote management command using a private key corresponding to the public key, and execute the decrypted remote management command to remotely manage the cloud server.

14. A storage medium having a computer program stored thereon, which, when executed, implements the steps of the method according to any one of claims 1 to 12.

15. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the following method is implemented: wherein, when the processor executes the program, the method as claimed in any one of claims 1 to 12 is implemented.

Images