Service request method in computer system, and management end

Abstract

Provided in the present application are a service request method in a computer system, and a management end. The method comprises: when a client is started, a management end generating and recording an authentication certificate of the client; the management end receiving a service request sent by the client, wherein the service request is used for requesting a serving end to provide a service for the client, and the service request comprises a first authentication certificate; when the first authentication certificate is consistent with the authentication certificate of the client that is recorded by the management end, the management end forwarding the service request to the serving end, such that the serving end provides the service for the client on the basis of the service request; and when the first authentication certificate is inconsistent with the authentication certificate of the client that is recorded by the management end, the management end refusing to forward the service request to the serving end, wherein the client may be an untrusted computing instance and may also be a first trusted computing instance, and the serving end is a second trusted computing instance. The method can prevent illegitimate access to a serving end.

Description

A service request method and management terminal in a computer system

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on April 2, 2024, with application number 202410400164.7 and application name “A service request method and management terminal in a computer system”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of computer technology, and in particular to a service request method and a management terminal in a computer system. Background Art

[0003] In a trusted execution environment (TEE) architecture, multiple untrusted computing instances and multiple trusted computing instances can be deployed. Some trusted computing instances can provide related services, such as encryption and decryption services, for untrusted computing instances and other trusted computing instances. In this scenario, the trusted computing instance that provides services can be called the server, and the untrusted computing instance and other trusted computing instances can be called the client. To prevent unauthorized access to services, an authentication mechanism is used to allow authorized clients to access the server and prohibit unauthorized clients from accessing the server. The current authentication mechanism is as follows.

[0004] The client registers with the server, which stores the client's identity information. The client then requests to log in to the server, which authenticates the client. If the client passes the server's authentication, the server sends an authentication credential to the client. The client then uses this authentication credential to access the server.

[0005] This authentication mechanism presents security risks. Specifically, a client's identity information could be misappropriated by an unauthorized compute instance. This could allow an unauthorized compute instance to authenticate itself using the misappropriated identity information and obtain authentication credentials, allowing it to access the server. Furthermore, a client's authentication credentials could be misappropriated by an unauthorized compute instance. This could allow an unauthorized compute instance to misappropriate the authentication credentials of another compute instance and access the server through the misappropriated credentials. Summary of the Invention

[0006] The present application provides a service request method and a management terminal in a computer system, which can avoid illegal access to the service terminal.

[0007] In a first aspect, a service request method in a computer system is provided, wherein the computer system includes a client, a management end, and a server end, and the method includes: when the client starts, the management end generates and records the authentication credentials of the client; the management end receives a service request sent by the client, the service request is used to request the server end to provide services to the client, and the service request includes a first authentication credential; when the first authentication credential is consistent with the authentication credential of the client recorded by the management end, the management end forwards the service request to the server end, so that the server end provides services to the client based on the service request. When the first authentication credential is inconsistent with the authentication credential of the client recorded by the management end, the management end refuses to forward the service request to the server end. The client can be an untrusted computing instance or a first trusted computing instance. The server end is a second trusted computing instance.

[0008] In this method, the management end records authentication credentials, and service requests sent to the server must be verified against the client's authentication credentials. The management end assigns each client a unique authentication credential, which varies from client to client. Even if an unauthorized client steals another client's authentication credentials, the stolen credentials will be different from those recorded by the management end. This prevents the unauthorized client from using the stolen credentials to pass authentication, thus preventing unauthorized access to the server.

[0009] The management side is trustworthy and can maintain the client's authentication credentials in the client's program context, eliminating the risk of authentication credentials being misused. This prevents unauthorized access caused by a client misappropriating another client's authentication credentials, improving security.

[0010] In one possible implementation, the server provides services to the client based on the service request, including: when the client is a serviceable object of the server, the server provides services to the client based on the service request; before the management end receives the service request sent by the client, the method also includes: the management end receives a login request sent by the client, and the login request includes a second authentication credential; when the second authentication credential is consistent with the authentication credential of the client recorded by the management end, the management end forwards the login request to the server, so that the server treats the client as a serviceable object based on the login request.

[0011] In this implementation, the login request sent to the server needs to be verified by the client's authentication credentials. An illegal client using stolen authentication credentials cannot pass the authentication verification, making it impossible for the illegal client to log in to the server, thereby avoiding illegal access to the server.

[0012] In one possible implementation, the server records the first hash value and the first random information of the client, and the login request includes the second random information. The method also includes: the management end generates a hash value for the client to obtain a second hash value; when the second authentication credential is consistent with the authentication credential of the client recorded by the management end, the management end sends the second hash value and the second random information to the server; wherein the server is used to: when the first hash value and the second hash value are consistent, and the first random information and the second random information are consistent, add the client as a serviceable object of the server based on the login request.

[0013] In this implementation, when the client logs in to the server, a double-factor authentication of hash value and random information is used to improve login security.

[0014] In the second aspect, a management end is provided. The computer system where the management end is located also includes a client and a server. The management end includes: a generation module, which is used to generate and record the client's authentication credentials when the client is started; a receiving module, which is used to receive a service request sent by the client, and the service request is used to request the server to provide services to the client, and the service request includes a first authentication credential; a sending module, which is used to forward the service request to the server when the first authentication credential is consistent with the authentication credential of the client recorded by the management end, so that the server provides services to the client based on the service request.

[0015] In one possible implementation, the server provides services to the client based on the service request, including: when the client is a serviceable object of the server, the server provides services to the client based on the service request; the receiving module is also used to: receive a login request sent by the client, the login request includes a second authentication credential; the sending module is also used to: when the second authentication credential is consistent with the authentication credential of the client recorded by the management end, forward the login request to the server, so that the server treats the client as a serviceable object based on the login request.

[0016] In one possible implementation, the server records the first hash value and the first random information of the client, and the login request includes the second random information; the generation module is also used to: generate a hash value for the client to obtain a second hash value; the sending module is also used to: when the second authentication credential is consistent with the authentication credential of the client recorded by the management end, send the second hash value and the second random information to the server; wherein the server is used to: when the first hash value and the second hash value are consistent, and the first random information and the second random information are consistent, add the client as a serviceable object of the server based on the login request.

[0017] In a possible implementation, the sending module is further configured to: when the first authentication credential is inconsistent with the authentication credential of the client recorded by the management end, refuse to forward the service request to the service end.

[0018] In a possible implementation, the client is an untrusted computing instance or a first trusted computing instance, and the server is a second trusted computing instance.

[0019] In a third aspect, a computing device is provided, comprising: a memory for storing an executable program; and a processor for executing the method provided in the first aspect by running the executable program.

[0020] In a fourth aspect, a computer-readable storage medium is provided, comprising computer program instructions. When the computer program instructions are executed by a computing device, the computing device executes the method provided in the first aspect.

[0021] In a fifth aspect, a computer program product comprising instructions is provided, which, when executed by a computing device, causes the computing device to execute the method provided in the first aspect.

[0022] Among them, the beneficial effects of the second to fifth aspects can be found in the above description of the beneficial effects of the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] FIG1 is a schematic diagram of the structure of a computing system provided in an embodiment of the present application;

[0024] FIG2 is a schematic diagram of the structure of a computing system provided in an embodiment of the present application;

[0025] FIG3 is a schematic diagram of the structure of a computing system provided in an embodiment of the present application;

[0026] FIG4 is a flow chart of a service request method provided in an embodiment of the present application;

[0027] FIG5 is a schematic diagram of the structure of a computing system provided in an embodiment of the present application;

[0028] FIG6 is a flowchart of a service request method provided in an embodiment of the present application;

[0029] FIG7 is a schematic diagram of the structure of a computing system provided in an embodiment of the present application;

[0030] FIG8 is a flowchart of a service request method provided in an embodiment of the present application;

[0031] FIG9 is a schematic diagram of the structure of a management terminal provided in an embodiment of the present application;

[0032] FIG10 is a schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0033] The following describes the solutions provided by the embodiments of the present application in conjunction with the accompanying drawings. In the embodiments of the present application, "plurality" refers to two or more, and "multiple" refers to two or more. Terms such as "first" and "second" are used only to distinguish similar objects and do not necessarily describe a specific order or quantity of objects.

[0034] To facilitate understanding of the solutions provided by the embodiments of the present application, the technical terms that may be involved in the embodiments of the present application are first introduced.

[0035] A compute instance, also known as a virtual computing device or virtual computing instance, is a complete computer system with a complete hardware system simulated by software, running in a completely isolated environment. The hardware system of a compute instance is a virtualized version of physical hardware. A complete compute instance has an independent virtual computer system and virtual disks. Compute instances that need to communicate with the outside world also have independent virtual network interfaces. Typical compute instances include virtual machines and containers.

[0036] Session: represents a communication process between a client and a server, which can be continuous or intermittent. When a session is opened, the server creates a session object to save the client's state. The essence of a session object is an area in memory that is used to store contextual information such as the client's state. Typically, when a client accesses the server for the first time, the server creates a session object. The session has a session identifier (ID), which the server sends to the client. The client's subsequent access to the server will carry the session identifier. Based on the session identifier, the server can query the client's corresponding session object, thereby obtaining the context of the current communication process between the client and the server.

[0037] Trusted Execution Environment (TEE) architecture: This architecture is used by processors in computing platforms to implement isolation between a normal execution environment and a secure execution environment. Within a TEE architecture, one or more secure program execution environments can be isolated. The secure execution environment protects the confidentiality and integrity of program code and data loaded into it.

[0038] Trusted computing instance: Also known as a secure execution environment instance, it is a computing instance used to run protected programs. Enclaves, secure partitions (SPs), and trusted domains (TDs) are typical trusted computing instances.

[0039] Untrusted computing instance: also known as a normal execution environment instance, used to provide an untrusted or normal running environment for the program.

[0040] In the client-server service architecture, an authentication mechanism is used to allow authorized clients to access the server and prohibit unauthorized clients from accessing the server.

[0041] In one solution, the client uses the client's hash value to register on the server, so that the server saves the client's hash value. Then, the client uses the client's hash value to request to log in to the server. When the hash value used by the client is consistent with the hash value saved by the server, the server sends a token to the client. Subsequently, the client uses the token as an authentication credential to access the server. In this solution, the client can be cloned to obtain a hash value identical to the client's hash value, thereby stealing the client's hash value and bypassing authentication. Moreover, in this solution, the client's token can be stolen through network attacks and other means, thereby using the token to illegally access the server. In addition, in this solution, operations such as login are required in each session, resulting in low access efficiency.

[0042] An embodiment of the present application provides a service request method in a computer system. In this method, whenever a client is started, the management end generates and records the authentication credentials of the client. When a client needs a service provided by the server, a service request including the authentication credentials is sent to the management end. When the authentication credentials included in the service request are consistent with the authentication credentials recorded by the management end, the management end forwards the service request to the server, so that the server provides services to the client based on the service request. When the authentication credentials included in the service request are inconsistent with the authentication credentials recorded by the management end, the management end refuses to forward the service request to the server, so as to prevent the server from providing services to the client based on the service request.

[0043] In this way, every time a client is started, the management end generates and records the authentication credentials of the client, and the authentication credentials generated by the management end for different clients are different. When a client needs the service provided by the server, the management end determines whether the authentication credentials included in the service request sent by the client are consistent with the authentication credentials recorded by the management end. Since the authentication credentials generated by the management end for different clients are different, if the service request is a service request sent by the client using other clients, that is, if the authentication credentials in the service request are the authentication credentials of other clients, the management end can identify that the authentication credentials in the service request are inconsistent with the authentication credentials of the management end, and thus refuse to forward the service request to the server, thereby avoiding illegal access to the server.

[0044] Next, the service request method provided in the embodiment of the present application is described in detail.

[0045] FIG1 illustrates a computer system 100 that can be used to implement the service request method provided in an embodiment of the present application. As shown in FIG1 , the computer system includes hardware (HV) and a management terminal 110 running on the hardware, at least one client such as a client 121, and at least one server such as a server 130. In some embodiments, the at least one client also includes a client 122.

[0046] In the following description, when there is no special distinction between the client and the server, they may be referred to as computing instances. When there is no special distinction between the client 121 and the client 122, they may be referred to as clients.

[0047] The hardware includes hardware resources such as physical processors and physical memory. These hardware resources can support the operation of the management terminal 110, the client, and the server. The physical processor can be a physical CPU. The physical memory can be static random-access memory (SRAM) or dynamic random-access memory (DRAM).

[0048] In some embodiments, as shown in FIG2 , the computer system 100 includes a hard disk (e.g., a flash memory). The management terminal 110, the client, and the server are stored in the hard disk in the form of image files. When the computer system 100 is started, the management terminal 110, the client, and the server can be loaded from the hard disk into the memory of the computer system 100. In the memory, the management terminal 110, the client, and the server are stored in the form of program code. During the operation phase of the computer system 100, the processor of the computer system can load and execute instructions of the management terminal 110, the client, and the server from the memory, thereby realizing corresponding functions or services.

[0049] The client and server are computing instances. The client can be either an untrusted or trusted computing instance. For example, client 121 is an untrusted computing instance, and client 122 is a trusted computing instance. Server 130 is a trusted computing instance. For example, the trusted computing instance can be an enclave.

[0050] The management terminal 110 is used to manage the computing instances in the computer system 100, that is, the management terminal 110 is used to manage the client and the server. Specifically, the management terminal 110 is used to implement life cycle management such as installation, startup, shutdown, and uninstallation of the computing instance. The management terminal 110 is also used to allocate processor resources, memory resources, etc. to the computing instance. The management terminal 110 can virtualize hardware resources to obtain virtual resources and allocate virtual resources to the computing instance. In some embodiments, as shown in Figure 1, the management terminal 110 may include an operating system (OS), a virtual machine manager (VM), and a hypervisor (HV) of the computer system 100.

[0051] The management terminal 110 is a trusted component in the computer system 100 and is trusted by the client and the server.

[0052] In some embodiments, as shown in Figure 3, the management terminal 110 may include a lifecycle management module. The lifecycle management module is used to implement lifecycle management such as installation, startup, shutdown, and uninstallation of computing instances.

[0053] The management terminal 110 may include a hash value calculation module. The hash value calculation module is used to calculate a hash value for each computing instance managed by the management terminal 110. When the computing instance is a client, the hash value of the computing instance may be referred to as a client hash value. The management terminal 110 may perform a hash calculation on the binary file of the computing instance to obtain the hash value of the computing instance. The binary file of the computing instance is a file that includes the code and data of the computing instance. The hash value of the computing instance belongs to the identity (ID) information of the computing instance. The management terminal 110 may send the hash value of the computing instance to the computing instance, and the computing instance saves its hash value.

[0054] The management terminal 110 may include a random information generation module. The random information generation module is used to generate random information for each computing instance managed by the management terminal 110. Random information can also be called a random ID, which is also the identity information of the computing instance. The random information of different computing instances managed by the management terminal 110 is different. In one example, the random information of the computing instance can be a hash value obtained by hashing the name and password of the computing instance. In one example, the random information can be a random number. In one example, the random information can be a universally unique identifier (UUID). The management terminal 110 can send the random information of the computing instance to the computing instance, and the computing instance saves its random information.

[0055] The management terminal 110 may further include an interface for registering the authentication information of the client managed by the management terminal 110 with the server 130. Accordingly, the server 130 includes an authentication information maintenance module for maintaining the authentication information of the client.

[0056] This interface is used by clients managed by the management terminal 110 to log in to the server terminal 130, allowing the server terminal 130 to service the client. Accordingly, the server terminal 130 includes a login verification module that verifies the legitimacy of the client's login request. If the client's login request is legitimate, the module makes the client available for service by the server terminal 130.

[0057] This interface is also used by clients managed by management terminal 110 to send service requests to server terminal 130, enabling server terminal 130 to provide services to the clients based on the service requests. Accordingly, server terminal 130 includes a credential verification module that verifies the legitimacy of the client's service request. If the client's service request is legitimate, server terminal 130 provides services to the client.

[0058] The management terminal 110 further includes an authentication credential management module, which is used to allocate authentication credentials to the client allocated by the management terminal 110 and control the client's access to the service terminal 130 through the authentication credentials.

[0059] Through the above functional modules, the management terminal 110 can execute the service request method provided by this application. Next, the method is described in detail with reference to FIG4 .

[0060] The client's authentication information can be registered with the server 130. The client's authentication information includes the client's hash value A1 and the client's random information B1. The client's hash value A1 is obtained by hashing the client's binary file. The client binary file is a file that contains the client's code and data. The client's random information B1 is also the client's identity information. The random information of different clients managed by the management terminal 110 is different. In one example, the client's random information can be a hash value obtained by hashing the client's name and password. In one example, the random information can be a random number. In one example, the random information can be a UUID.

[0061] In some embodiments, the authentication information of the client is registered with the server 130 via the management end. As shown in Figure 4, step 401 is to install the client. The lifecycle management module of the management end 110 can control the installation of the client. During the client installation process or at the end of the installation, the hash value calculation module in the management end 110 can calculate the hash value A1 of the client in step 402. The hash calculation module can perform hash calculation on the binary file of the client to obtain the hash value of the client. The random information generation module in the management end 110 can generate random information B1 for the client in step 403, or import the random information B1 of the client. In 404b, the random information generation module can send the random information B1 of the client to the client, and the client records its random information B1. The management end 110 executes step 404a through the interface, and sends a registration request to the server 130 for the installed client to register the authentication information of the client with the server 130.

[0062] In some embodiments, the authentication information of the client may be registered with the server 130 in advance, for example, by registering the authentication information of the client with the server 130 in an offline manner.

[0063] After registering the authentication information of the client to the server 130, the client can log in to the server 130, as follows.

[0064] In step 405, the client is started. The lifecycle management module of the management terminal 110 can control the client startup. Upon client startup, the authentication credential management module of the management terminal 110 can execute step 406 to generate an authentication credential A1 for the client. An authentication credential can also be referred to as a unique ID or a globally unique ID. Different clients in the computer system 100 have different authentication credentials.

[0065] The authentication credential management module can record the authentication credential C1 of the client, maintain the authentication credential C1 of the client in the program context of the client, and send the authentication credential C1 of the client to the client in step 407.

[0066] In an embodiment of the present application, the client in the computing system 100 needs to log in to the server 130 through the management terminal 110, that is, send a login request to the server 130 through the management terminal 110. As shown in Figure 4, in step 408, the client can send a login request to the management terminal 110, and the login request includes the authentication credential C1' and the random information B1'. The authentication credential management module of the management terminal 110 can obtain the login request, and in step 409, verify the authentication credential (that is, the authentication credential C1') in the login request. Specifically, the authentication credential management module can determine whether the authentication credential C1' and the authentication credential C1 maintained by the authentication credential management module in the program context of the client are consistent. If they are consistent, it is confirmed that the authentication credential in the login request has passed the verification. If they are inconsistent, it is confirmed that the authentication credential in the login request has not passed the verification.

[0067] If the authentication credentials in the login request fail verification, that is, if authentication credential C1' is inconsistent with the client's authentication credential C1 recorded by management terminal 110, management terminal 110 refuses to forward the login request to server 130. The inconsistency between authentication credential C1' and the client's authentication credential C1 recorded by management terminal 110 indicates that the login request is illegal, and the illegal login request is refused to be sent to server 130, thereby preventing illegal logins to server 130.

[0068] If the authentication credentials in the login request pass the verification, that is, when the authentication credentials C1' is consistent with the authentication credentials C1 of the client recorded by the management terminal 110, the hash value calculation module in the management terminal 110 calculates the hash value of the client in step 410. In step 410, the hash value calculation module performs hash calculation on the binary file of the client to obtain the hash value of the client. Among them, the hash value of the client calculated in step 410 can be called hash value A1'. The management terminal 110 can combine the hash value A1', the random information B1' and the authentication credentials C1 as the client's identity proof. In step 411, the management terminal 110 sends the login request and identity proof to the service terminal 130 through the interface.

[0069] Upon receiving the login request and identity verification, server 130 may proceed to step 412 to perform login verification. Server 130 determines whether the authentication information recorded by server 130 is consistent with the identity verification. If they are consistent, the client is deemed to have passed login verification. If they are inconsistent, the client is deemed to have failed login verification.

[0070] Specifically, the server 130 determines whether the hash value A1 in the authentication information is consistent with the hash value A1' in the identity certificate, and determines whether the random information B1 in the authentication information is consistent with the random information B1' in the identity certificate. If the hash value A1 in the authentication information is consistent with the hash value A1' in the identity certificate, and the random information B1 in the authentication information is consistent with the random information B1' in the identity certificate, then the authentication information is confirmed to be consistent with the identity certificate. If the hash value A1 in the authentication information is inconsistent with the hash value A1' in the identity certificate, and / or the random information B1 in the authentication information is inconsistent with the random information B1' in the identity certificate, then the authentication information is confirmed to be inconsistent with the identity certificate.

[0071] If the client passes the login verification, the server 130 executes step 413 and lists the client as a serviceable object. The authentication certificate C1 in the identity certificate can be added to the whitelist of the server 130 to record the client as a serviceable object.

[0072] After the server 130 has designated the client as a serviceable object, the client can send a service request to the server 130 to request services from the server 130. The service request sent to the server 130 must pass through the management terminal 110. Only after the management terminal 110 approves it can the service request be forwarded to the server 130. The details are as follows.

[0073] The client sends a service request in step 414, and the service request includes an authentication credential. The authentication credential included in the service request can be referred to as authentication credential C1", that is, the service request includes authentication credential C1". The authentication credential module of the management terminal 110 can receive the service request and verify the authentication credential in the service request (that is, authentication credential C1") in step 415. Specifically, the authentication credential management module can determine whether the authentication credential C1" is consistent with the authentication credential C1 maintained by the authentication credential management module in the program context of the client. If they are consistent, it is confirmed that the authentication credential in the service request has passed the verification. If they are inconsistent, it is confirmed that the authentication credential in the service request has not passed the verification.

[0074] If the authentication credentials in the service request fail to pass the verification, that is, when the authentication credentials C1" are inconsistent with the authentication credentials C1 of the client recorded by the management end 110, the management end 110 refuses to forward the service request to the server 130. The inconsistency between the authentication credentials C1" and the authentication credentials C1 of the client recorded by the management end 110 indicates that the service request is illegal, and the illegal service request is refused to be sent to the server 130, thereby preventing the server 130 from providing services based on the illegal service request.

[0075] If the authentication credential in the service request passes the verification, that is, when the authentication credential C1″ ​​is consistent with the authentication credential C1 of the client recorded by the management terminal 110, the management terminal 110 forwards the service request to the service terminal 130 through the interface in step 416.

[0076] The server 130 may provide a service to the client based on the service request. For example, if the service request is a request for encryption and decryption services, the server 130 may respond to the service request and provide encryption and decryption services to the client.

[0077] In some embodiments, when the service request is received, the server 130 executes step 417 to determine whether the client issuing the service request is a serviceable object of the server 130. Specifically, in step 417, the server 130 can determine whether the authentication credential C1" in the service request is in the whitelist, that is, determine whether the authentication credential C1" is consistent with the authentication credential C1 in the whitelist. If the authentication credential C1" is in the whitelist, that is, the authentication credential C1" is consistent with the authentication credential C1 in the whitelist, then it is confirmed that the client issuing the service request is a serviceable object. Then, in step 418, the server 130 provides services to the client.

[0078] In some embodiments, when the client is shut down, the client destroys its recorded authentication credentials, and the management terminal 110 also cancels its recorded authentication credentials for the client. When the client is restarted, according to steps 405 to 418, a new authentication credential is assigned to the client, and the new authentication credential is used for login request verification, service request verification, etc.

[0079] In summary, through the method provided by the present application, the trusted management end records and maintains the client's authentication credentials in the context of the client, and the service requests and login requests sent to the service end all need to be verified by the client's authentication credentials. The management end assigns authentication credentials to each client, and the authentication credentials of different clients are different. Even if an illegal client steals the authentication credentials of other clients, since the stolen authentication credentials and the authentication credentials of the illegal client recorded by the management end are different, the illegal client cannot pass the authentication verification with the stolen authentication credentials. In addition, the management end is trusted, and the management end maintains the authentication credentials of the client in the context of the client, avoiding the risk of the authentication credentials being stolen. In this way, illegal access caused by the client stealing the authentication credentials of other clients is avoided, and security is improved. In addition, the authentication information includes a hash value and random information. The hash value and random information serve as two-factor authentication information, which improves the security of authentication. Furthermore, authentication credentials are assigned to the client upon startup and deleted upon shutdown, ensuring that the lifecycle of the client's authentication credentials is consistent with the client's lifecycle, further mitigating the risk of credential theft. Furthermore, authentication is not required for every session, reducing computational overhead and increasing client-server efficiency.

[0080] In some embodiments, as shown in FIG5 , the client 121 is a virtual machine, the client 122 and the server 130 are both secure partitions, and the management terminal 110 includes a secure partition manager (SPM) and a virtual machine monitor.

[0081] The secure partition manager is used to manage secure partitions such as client 122 and server 130. As shown in Figure 5, the secure partition manager in the management terminal 110 includes an SP lifecycle management module, an SP hash value calculation module, an SP random information generation module, an SP interface, and an SP authentication credential management module. The SP lifecycle management module implements lifecycle management for SPs such as client 122, including installation, startup, shutdown, and uninstallation. The SP hash value calculation module calculates hash values ​​for SPs such as client 122. The SP random information generation module generates random information for SPs such as client 122. The SP interface registers the authentication information of SPs managed by the secure partition manager, such as client 122, with server 130. The SP interface allows SPs managed by the secure partition manager, such as client 122, to log in to server 130, allowing server 130 to service the client. The SP interface also allows SPs managed by the secure partition manager, such as client 122, to send service requests to server 130, enabling server 130 to provide services to client 122 based on the service requests. The SP authentication credential management module is used to allocate authentication credentials to clients managed by the security partition manager, such as the client 122, and control the client's access to the server 130 through the authentication credentials.

[0082] Through the above functional modules, the management terminal 110 can execute the service request method provided by this application for the client 122. Please refer to the above introduction for details and will not repeat them here.

[0083] The virtual machine monitor is used to manage client 121. As shown in Figure 5, the virtual machine monitor in management terminal 110 includes a VM lifecycle management module, a VM hash value calculation module, a VM random information generation module, a VM interface, and a VM authentication credential management module. The VM lifecycle management module is used to implement lifecycle management of VMs such as client 121, including installation, startup, shutdown, and uninstallation. The VM hash value calculation module is used to calculate hash values ​​for VMs such as client 121. The VM random information generation module is used to generate random information for VMs such as client 121. The VM interface is used to register the authentication information of VMs managed by the virtual machine monitor, such as client 121, with server 130. The VM interface is used for VMs managed by the virtual machine monitor, such as client 121, to log in to server 130, allowing server 130 to treat the client as a serviceable object. The VM interface is also used for VMs managed by the virtual machine monitor, such as client 121, to send service requests to server 130, allowing server 130 to provide services to client 121 based on the service requests. The VM authentication credential management module is used to allocate authentication credentials to clients managed by the virtual machine monitor, such as the client 121 , and control the client's access to the server 130 through the authentication credentials.

[0084] Through the above functional modules, the management terminal 110 can execute the service request method provided by this application for the client 121. For details, please refer to the method steps described above or shown in Figure 6.

[0085] In step 601, the virtual machine monitor may install client 121. Upon installing client 121, the virtual machine monitor may execute step 602 to generate authentication information for client 121. This authentication information includes a hash value of client 121 and random information about the client. The hash value of client 121 generated in step 602 may be referred to as hash value A1, and the random information generated may be referred to as random information B1. Through steps 603 and 604, the virtual machine monitor may register client 121's authentication information with server 130 via the SP interface in the secure partition manager.

[0086] At step 605 , the virtual machine monitor may start the client 121 . At step 606 , the virtual machine monitor generates and records the authentication credential C1 for the client 121 . The virtual machine monitor maintains the authentication credential C1 in the context of the client 121 .

[0087] In step 607, client 121 may issue a login request destined for server 130. The login request includes the client's authentication credential C1' and random information B1'. The virtual machine monitor may perform authentication credential verification on the login request in step 608. If the authentication credential C1' included in the login request matches the authentication credential C1 of client 121 recorded by the virtual machine monitor, the login request is deemed to have passed authentication credential verification.

[0088] If the login request passes the authentication credential verification, the virtual machine monitor executes step 609 to calculate a hash value A1' for client 121. Then, through steps 610 and 611, the login request and the identity proof of client 121 are sent to server 130. The identity proof of client 121 includes the hash value A1', random information B1', and authentication credential C1, which together form the client's identity proof.

[0089] The server 130 executes step 612 to perform login verification. The server 130 determines whether the authentication information recorded by the server 130 is consistent with the identity certificate. If they are consistent, the client is confirmed to have passed the login verification. If they are inconsistent, the client is confirmed to have failed the login verification.

[0090] Specifically, the server 130 determines whether the hash value A1 in the authentication information is consistent with the hash value A1' in the identity certificate, and determines whether the random information B1 in the authentication information is consistent with the random information B1' in the identity certificate. If the hash value A1 in the authentication information is consistent with the hash value A1' in the identity certificate, and the random information B1 in the authentication information is consistent with the random information B1' in the identity certificate, then the authentication information is confirmed to be consistent with the identity certificate. If the hash value A1 in the authentication information is inconsistent with the hash value A1' in the identity certificate, and / or the random information B1 in the authentication information is inconsistent with the random information B1' in the identity certificate, then the authentication information is confirmed to be inconsistent with the identity certificate.

[0091] If the client 121 passes the login verification, the server 130 executes step 613 and treats the client 121 as a serviceable object. The authentication certificate C1 in the identity certificate can be added to the whitelist of the server 130 to record the client 121 as a serviceable object.

[0092] After the server 130 takes the client 121 as a serviceable object, the client can send a service request to the server 130 to request the service of the server 130. The details are as follows.

[0093] The client 121 issues a service request in step 614, and the service request includes an authentication credential. The authentication credential included in the service request can be referred to as authentication credential C1", that is, the service request includes authentication credential C1". The virtual machine monitor can receive the service request and verify the authentication credential in the service request (that is, authentication credential C1") in step 615. Specifically, it can be determined whether the authentication credential C1" and the authentication credential C1 maintained by the virtual machine monitor in the program context of the client 121 are consistent. If they are consistent, it is confirmed that the authentication credential in the service request has passed the verification. If they are inconsistent, it is confirmed that the authentication credential in the service request has not passed the verification.

[0094] If the authentication credential in the service request passes the verification, that is, when the authentication credential C1″ ​​is consistent with the authentication credential C1 of the client recorded by the virtual machine monitor, the virtual machine monitor forwards the service request to the server 130 through the secure partition manager in steps 616 and 617.

[0095] The server 130 may provide a service to the client based on the service request. For example, if the service request is a request for encryption and decryption services, the server 130 may respond to the service request and provide encryption and decryption services to the client.

[0096] In some embodiments, when the service request is received, the server 130 executes step 618 to determine whether the client issuing the service request is a serviceable object of the server 130. Specifically, in step 618, the server 130 can determine whether the authentication credential C1" in the service request is in the whitelist, that is, determine whether the authentication credential C1" is consistent with the authentication credential C1 in the whitelist. If the authentication credential C1" is in the whitelist, that is, the authentication credential C1" is consistent with the authentication credential C1 in the whitelist, then it is confirmed that the client issuing the service request is a serviceable object. Then, in step 619, the server 130 provides services to the client.

[0097] In some embodiments, when client 121 shuts down, client 121 destroys its recorded authentication credentials, and the virtual machine monitor also cancels its recorded authentication credentials for client 121. When client 121 restarts, new authentication credentials are assigned to the client according to steps 605 to 619, and the new authentication credentials are used for login request verification, service request verification, etc.

[0098] Therefore, the method shown in FIG6 avoids illegal access caused by a client stealing the authentication credentials of other clients, thereby improving security.

[0099] In some embodiments, as shown in FIG7 , the client 121 is a virtual machine, the client 122 and the server 130 are both trusted domains (TD), and the management terminal 110 includes a Trust Domain Extensions (TDX) module and a virtual machine manager.

[0100] The trusted domain extension module is used to manage trusted domains such as client 122 and server 130. As shown in Figure 7, the trusted domain extension module in the management terminal 110 includes a TD lifecycle management module, a TD hash value calculation module, a TD random information generation module, a TD interface, and a TD authentication credential management module. The TD lifecycle management module is used to implement lifecycle management, including installation, startup, shutdown, and uninstallation, for TDs such as client 122. The TD hash value calculation module is used to calculate hash values ​​for TDs such as client 122. The TD random information generation module is used to generate random information for TDs such as client 122. The TD interface is used to register the authentication information of clients managed by the trusted domain extension module, such as client 122, with the server 130. The TD interface is used to enable SPs managed by the trusted domain extension module, such as client 122, to log in to the server 130, allowing the server 130 to treat the client as a serviceable object. The TD interface is also used by TDs managed by the trusted domain extension module, such as client 122, to send service requests to the server 130, allowing the server 130 to provide services to the client 122 based on the service requests. The TD authentication credential management module is used to allocate authentication credentials to clients managed by the security partition manager, such as the client 122, and control the client's access to the server 130 through the authentication credentials.

[0101] Through the above functional modules, the management terminal 110 can execute the service request method provided by this application for the client 122. Please refer to the above introduction to the method embodiment shown in Figure 4 for details, which will not be repeated here.

[0102] The virtual machine manager is used to manage client 121. As shown in Figure 5, the virtual machine manager in management terminal 110 includes a VM lifecycle management module, a VM hash value calculation module, a VM random information generation module, a VM interface, and a VM authentication credential management module. The VM lifecycle management module is used to implement lifecycle management of VMs such as client 121, including installation, startup, shutdown, and uninstallation. The VM hash value calculation module is used to calculate hash values ​​for VMs such as client 121. The VM random information generation module is used to generate random information for VMs such as client 121. The VM interface is used to register the authentication information of VMs managed by the virtual machine manager, such as client 121, with server 130. The VM interface is used for VMs managed by the virtual machine manager, such as client 121, to log in to server 130, allowing server 130 to treat the client as a serviceable object. The VM interface is also used for VMs managed by the virtual machine manager, such as client 121, to send service requests to server 130, allowing server 130 to provide services to client 121 based on the service requests. The authentication credential management module is used to allocate authentication credentials to clients managed by the virtual machine manager, such as the client 121 , and control the client's access to the server 130 through the authentication credentials.

[0103] Through the above functional modules, the manager 110 executes the service request method provided by the present application for the client 121 , and specifically refers to the introduction of the method embodiment shown in FIG. 4 .

[0104] In summary, the embodiment of the present application further provides a service request method, which is executed by the management terminal 110 in the computer system 100. As shown in FIG8 , the method includes the following steps.

[0105] Step 801: When the client starts, the management terminal 110 generates and records the authentication certificate C1 of the client. For details, please refer to the above description of steps 405 to 407 in Figure 4, which will not be repeated here.

[0106] In step 802, the management terminal 110 receives a service request sent by the client, wherein the service request is used to request the server to provide a service to the client, and the service request includes an authentication certificate C1. For details, please refer to the above description of step 414 in FIG. 4 and will not be repeated here.

[0107] In step 803, when the authentication credential C1 is consistent with the authentication credential C1 of the client recorded by the management terminal 110, the management terminal 110 forwards the login request to the server 130, so that the server 130 provides services to the client based on the service request. For details, please refer to the above description of steps 415 to 418 in Figure 4, which will not be repeated here.

[0108] In some embodiments, the server 130 provides services to the client based on the service request, including: when the client is a serviceable object of the server 130, the server 130 provides services to the client based on the service request. Before the management terminal receives the service request sent by the client, the method also includes: the management terminal 130 receives a login request sent by the client, and the login request includes an authentication credential C1'; when the authentication credential C1' is consistent with the authentication credential C1 of the client recorded by the management terminal 110, the management terminal 110 forwards the login request to the server 130, so that the server 130 uses the client as a serviceable object based on the login request. For details, please refer to the above introduction to steps 408-413 in Figure 4, which will not be repeated here.

[0109] In an example of this embodiment, the server 130 records the hash value A1 of the client and the random information B1 of the client, and the login request includes the random information B1'. The method also includes: the management end 130 generates a hash value for the client to obtain a hash value A1'; when the authentication credential C1' is consistent with the authentication credential C1 of the client recorded by the management end 130, the management end sends the hash value A1' and the random information B1' to the server; wherein, the server 130 is used to: when the hash value A1 is consistent with the hash value A1', and the random information B1 is consistent with the random information B1', add the client as a serviceable object of the server based on the login request.

[0110] In some embodiments, the method further includes: when the authentication credential C1″ ​​is inconsistent with the authentication credential C1 of the client recorded by the management end, the management end 130 refuses to forward the service request to the service end 130.

[0111] In some embodiments, the client is an untrusted computing instance or a first trusted computing instance, and the server is a second trusted computing instance.

[0112] Through the method provided by the present application, the management end records the authentication credentials, and the service requests and login requests sent to the service end all need to be verified by the client's authentication credentials. The management end allocates authentication credentials to each client, and the authentication credentials of different clients are different. Even if an illegal client steals the authentication credentials of other clients, since the stolen authentication credentials and the authentication credentials of the illegal client recorded by the management end are different, the illegal client cannot pass the authentication verification with the stolen authentication credentials. In addition, the management end is trustworthy, and the management end maintains the authentication credentials of the client in the context of the client, avoiding the risk of the authentication credentials being stolen. In this way, illegal access caused by the client stealing the authentication credentials of other clients is avoided, thereby improving security.

[0113] The present application also provides a management terminal 900. The computer system where the management terminal 900 resides also includes a client and a server. As shown in FIG9 , the management terminal 900 includes:

[0114] A generating module 910 is configured to generate and record an authentication credential of the client when the client is started;

[0115] A receiving module 920 is configured to receive a service request sent by the client, wherein the service request is used to request the server to provide a service to the client, and the service request includes a first authentication credential;

[0116] The sending module 930 is configured to forward the service request to the server when the first authentication credential is consistent with the authentication credential of the client recorded by the management end, so that the server provides services to the client based on the service request.

[0117] In some embodiments, the server provides services to the client based on the service request, including: when the client is a serviceable object of the server, the server provides services to the client based on the service request; the receiving module 920 is also used to: receive a login request sent by the client, the login request including a second authentication credential; the sending module 930 is also used to: when the second authentication credential is consistent with the authentication credential of the client recorded by the management end, forward the login request to the server, so that the server treats the client as a serviceable object based on the login request.

[0118] In an example of this embodiment, the server records the first hash value of the client and the first random information of the client, and the login request includes second random information; the generation module 910 is also used to: generate a hash value for the client to obtain a second hash value; the sending module 930 is also used to: when the second authentication credential and the authentication credential of the client recorded by the management end are consistent, send the second hash value and the second random information to the server; wherein, the server is used to: when the first hash value and the second hash value are consistent, and the first random information and the second random information are consistent, add the client as a serviceable object of the server based on the login request.

[0119] In some embodiments, the sending module 930 is further configured to: when the first authentication credential is inconsistent with the authentication credential of the client recorded by the management end, refuse to forward the service request to the service end.

[0120] In some embodiments, the client is an untrusted computing instance or a first trusted computing instance, and the server is a second trusted computing instance.

[0121] The functions of each module in the management terminal 900 can also be implemented by referring to the above description of the method embodiments shown in Figure 8, and will not be repeated here.

[0122] An embodiment of the present application provides a computing device 1000. As shown in FIG10 , computing device 1000 includes a processor 1010 and a memory 1020. Memory 1020 is configured to store executable programs. Processor 1010 is configured to execute the executable programs stored in memory 1020, enabling computing device 1000 to perform the method shown in FIG8 above.

[0123] The processor 1010 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP) or a digital signal processor (DSP), an ASIC, an FPGA, a CPLD, an NPU, a SoC, etc.

[0124] Memory 1020 may include volatile memory, such as random access memory (RAM). Memory 1020 may also include non-volatile memory, such as read-only memory (ROM), flash memory, a hard disk drive (HDD), or a solid state drive (SSD). In addition, memory 1020 may also be implemented using storage class memory (SCM), phase change memory (PCM), or other types of storage media.

[0125] It is worth noting that the same type of storage medium can be configured in the same computing device to realize the function of memory 1020, or two or more types of storage media can be configured to realize the function of memory 1020. This application does not limit this.

[0126] The present application also provides a computer program product comprising instructions. The computer program product may be software or a program product comprising instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on a computing device, the computing device executes the method shown in FIG8 .

[0127] The present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center that contains one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the method shown in FIG8.

[0128] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A service request method in a computer system, characterized in that: The computer system includes a client, a management terminal, and a server, and the method includes: When the client is started, the management terminal generates and records the authentication certificate of the client; The management end receives a service request sent by the client, where the service request is used to request the server end to provide a service to the client, and the service request includes a first authentication credential; When the first authentication credential is consistent with the authentication credential of the client recorded by the management end, the management end forwards the service request to the service end, so that the service end provides the client with a service based on the service request.

2. The method according to claim 1, characterized in that The server provides a service to the client based on the service request, including: when the client is a serviceable object of the server, the server provides a service to the client based on the service request; Before the management terminal receives the service request sent by the client, the method further includes: The management end receives a login request sent by the client, wherein the login request includes a second authentication credential; When the second authentication credential is consistent with the authentication credential of the client recorded by the management end, the management end forwards the login request to the service end, so that the service end uses the client as a serviceable object based on the login request.

3. The method according to claim 2, characterized in that The server records the first hash value of the client and the first random information of the client, the login request includes second random information, and the method further includes: The management end generates a hash value for the client to obtain a second hash value; When the second authentication credential is consistent with the authentication credential of the client recorded by the management end, the management end sends the second hash value and the second random information to the server end; The server is configured to add the client as a serviceable object of the server based on the login request when the first hash value and the second hash value are consistent and the first random information and the second random information are consistent.

4. The method according to any one of claims 1 to 3, characterized in that The method further includes: when the first authentication credential is inconsistent with the authentication credential of the client recorded by the management end, the management end refuses to forward the service request to the service end.

5. The method according to any one of claims 1 to 4, characterized in that The client is an untrusted computing instance or a first trusted computing instance, and the server is a second trusted computing instance.

6. A management terminal, characterized in that: The computer system where the management terminal is located also includes a client and a server, and the management terminal includes: A generating module, configured to enable the management terminal to generate and record the authentication credentials of the client when the client is started; A receiving module, configured to receive a service request sent by the client, wherein the service request is used to request the server to provide a service to the client, and the service request includes a first authentication credential; The sending module is used to forward the service request to the server when the first authentication credential is consistent with the authentication credential of the client recorded by the management end, so that the server provides service to the client based on the service request.

7. The management terminal according to claim 6, characterized in that: The server provides a service to the client based on the service request, including: when the client is a serviceable object of the server, the server provides a service to the client based on the service request; The receiving module is further configured to: receive a login request sent by the client, wherein the login request includes a second authentication credential; The sending module is further configured to forward the login request to the server when the second authentication credential is consistent with the authentication credential of the client recorded by the management end, so that the server uses the client as a serviceable object based on the login request.

8. The management terminal according to claim 7, characterized in that: The server records the first hash value of the client and the first random information of the client, and the login request includes the second random information; The generating module is further configured to: generate a hash value for the client to obtain a second hash value; The sending module is further configured to: when the second authentication credential is consistent with the authentication credential of the client recorded by the management end, send the second hash value and the second random information to the server end; The server is configured to add the client as a serviceable object of the server based on the login request when the first hash value and the second hash value are consistent and the first random information and the second random information are consistent.

9. The management terminal according to any one of claims 6 to 8, characterized in that: The sending module is further configured to refuse to forward the service request to the server when the first authentication credential is inconsistent with the authentication credential of the client recorded by the management end.

10. The management terminal according to any one of claims 6 to 9, characterized in that: The client is an untrusted computing instance or a first trusted computing instance, and the server is a second trusted computing instance.

11. A computing device, characterized in that include: a memory for storing executable programs; A processor, configured to execute the method according to any one of claims 1 to 5 by running the executable program.

12. A computer-readable storage medium, characterized in that The method comprises computer program instructions, and when the computer program instructions are executed by a computing device, the computing device performs the method according to any one of claims 1 to 5.

13. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device, the computing device is caused to perform the method according to any one of claims 1 to 5.

Images