KR20180022437A - Managment server for cloud system - Google Patents

Abstract

The present invention relates to a cloud management server which is to allow compatibility between various types of bring your own devices (BYODs) on a cloud system, comprising: a connection broker for performing a user authentication and license verification providing function for confirming validity for a user terminal and a software to connect a software and hardware terminal of the user to a virtual desktop; a profile manager for performing a user allocation to allow the integrated connection setting with an active directory and a radius server; a setting manager for restoring a runtime, status monitoring, an instance allocation, and the like related to the license connection setting and a cloud terminal device (BYOD); and a hardware bus for supporting the sharing between different resources with a stub device in order to prevent a collision due to the resource sharing between connected various devices. According to the present invention, interworking and compatibility suitable therefor can be secured through user interworking between BYODs.

Description

{MANAGMENT SERVER FOR CLOUD SYSTEM}

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a cloud management server, and more particularly, to a cloud management server that enables compatibility between various types of BYODs on a cloud system.

Recently, the resources of cloud computing are continuously changing, and the performance, form, and location of PC are rapidly changing. As a result, there is a need for a platform that can efficiently manage diversified environments and safely use by users.

Particularly, in the cloud environment, BYOD (Bring Your Own Device) and VM (Virtual Machine) should be able to exchange data with each other by connecting the devices to each other and provide services through them. The cloud environment should be provided so that it can (a) share resources among various devices, (b) be able to provide data visibility so that each identification information can be easily identified, It should be implemented to be compatible and interoperable between cloud systems.

Korean Patent Laid-Open No. 10-2015-0053513 discloses a technique in which a cloud service broker device matches a plurality of cloud services according to a user's use environment (requirement) to provide a cloud service.

However, in the disclosed prior art, basically matching a cloud service according to a service type has a problem in that interoperability between servers and devices can not be ensured.

Korean Patent Publication No. 10-2015-0053513

SUMMARY OF THE INVENTION It is an object of the present invention to provide a cloud management server that interoperates with each other through user interworking between BYODs (Bounded Own Devices) and ensures compatibility therebetween.

In addition, the present invention provides a cloud management server that provides call completion between respective protocols in driving a heterogeneous thin client, a zero client, a tablet, a PC, a hand phone, and a web browser.

According to an aspect of the present invention for achieving the above object, the present invention provides a computer system including a user terminal and a hardware (hardware) terminal, A connection broker for performing authentication and license verification functions; A profile manager that performs user assignment so that an integrated connection can be established with the Active Directory and the Radius server; A configuration manager for restoring runtime, status monitoring and instance assignments with respect to license connection settings and cloud terminal devices (BYOD); And a hardware bus that supports sharing among different resources in a stub device in order to prevent collision caused by resource sharing among various connected devices.

At this time, the connection broker may perform a monitoring function for measuring a management function of a virtual machine assigned to a user terminal and an activity level of the virtual machine.

The connection broker may also perform a protocol coordination function for confirming the protocol of the terminal and converting the protocol to a standard protocol so that the same protocol is used between the terminal and the server.

In addition, the connection broker may communicate a plurality of different Message Queue Telemetry Transport (MQTT) channels.

The profile manager may set a protocol and a user control assignment to set a restriction according to a device group policy.

The profile manager may further include: 1) providing configuration information of an operating system and an application of the resource; 2) It is possible to assign the profile by transmitting information about the configuration of the hardware (hardware), or to apply authentication through LDAP and authentication.

The configuration manager may perform control according to release, authentication, and encryption.

Also, the control of the setting manager may be performed through a connection of a device, a control through login and logout, an authentication through a Fast Identity Online (FIDO) and an authentication using an authentication method (Advance Encryption System 256 bits and encryption through Transport Layer Security.

The hardware bus generates a bus driver as a virtual bus driver to share a device connected to a client on a server at a remote location and generates a kernel level of the terminal by creating a bus driver as a virtual bus driver, Or the like.

In addition, the hardware bus generates a USB-related packet and a serial-related packet as an IP packet through a bus driver to transfer a device connected to the client to a remote server, To the server.

The hardware bus applies a frame scheduling scheme according to a USB device transmission type (Control, Interrupt, Bulk, Isochronous); Ⓑ Change the settings according to HCD (Host Controller Driver), USB Core Driver, and PDD (Per Device Driver); Ⓒ For I / O transaction processed by USB packet, connection of I / O connected to the client can be established to convert the scheduling method constituted by the server.

In the cloud management server according to the present invention as described above, the following effects can be expected.

That is, according to the present invention, it is possible to perform FIDO, AES 256 and TLS (SSL) based communication while performing Restful API based communication (HTTPs Post, Push, Get), USB-IP and SERIAL-IP redirection are enabled .

In addition, the present invention provides a universal protocol for communicating with a virtual machine, a smart phone, and an IOT device, real-time messaging is enabled by communicating each endpoint in the form of POST, GET, and PULL, (1) the start of VDI, (2) information retrieval of smart phone, and (3) the protocol of on / off type of IoT sensor can be transmitted and received between server and client.

BRIEF DESCRIPTION OF THE DRAWINGS Figure 1 is an overview of a prior art cloud service broker.
2 is a diagram illustrating a cloud service configuration including a cloud management server according to an embodiment of the present invention;
FIG. 3 is an exemplary diagram showing an LDAP-based control relationship applied to the present invention; FIG.
FIG. 4 is an exemplary diagram illustrating a cloud VM and BYOD device access through FIDO, AES 256, and TLS applied to the present invention; FIG.
5 is a block diagram showing a configuration of a management server according to the present invention;

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features and advantages of the present invention will be more apparent from the following detailed description taken in conjunction with the accompanying drawings, in which: FIG. The present invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. Is provided to fully convey the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims.

In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail. , Which may vary depending on the intention or custom of the user, the operator, and the like. Therefore, the definition should be based on the contents throughout this specification.

Each block of the accompanying block diagrams and combinations of steps of the flowcharts may be performed by computer program instructions (execution engines), which may be stored in a general-purpose computer, special purpose computer, or other processor of a programmable data processing apparatus The instructions that are executed through the processor of the computer or other programmable data processing equipment will generate means for performing the functions described in each block or flowchart of the block diagram.

These computer program instructions may also be stored in a computer usable or computer readable memory capable of directing a computer or other programmable data processing apparatus to implement the functionality in a particular manner so that the computer usable or computer readable memory It is also possible for the instructions stored in the block diagram to produce an article of manufacture containing instruction means for performing the functions described in each block or flowchart of the flowchart.

And computer program instructions may be loaded onto a computer or other programmable data processing equipment so that a series of operating steps may be performed on a computer or other programmable data processing equipment to create a computer- It is also possible that the instructions that perform the data processing equipment provide the steps for executing the functions described in each block of the block diagram and at each step of the flowchart.

Also, each block or step may represent a portion of a module, segment, or code that includes one or more executable instructions for executing the specified logical functions, and in some alternative embodiments, It is also possible for functions to occur out of order.

That is, it is also possible that the two blocks or steps shown are actually concurrently performed, and that the blocks or steps are performed in the reverse order of the function as required.

Hereinafter, a cloud management server 100 according to a specific embodiment of the present invention will be described with reference to the accompanying drawings.

As shown in FIG. 2, the management server 100 according to the present invention allows various BODs (Bring Your Own Device) of a plurality of users to interwork with various cloud systems.

At this time, BYOD refers to various types of endpoint terminals that can be connected to a cloud system such as a thick client, a zero client, and a mobile phone.

The management server 100 according to the present invention provides a MQTT Telemetry-based Cloud Management Server 100 (Connection Broker) for a Bring Your Own Device, , And Group Policy related 'open standard'.

In the Cloud era, a large number of objects are required to manage and control each object by simply communicating with each other using IDs. Therefore, especially considering the number of small devices that are increasing exponentially in the future, It is inefficient and unrealistic to develop an application in-house.

Accordingly, as shown in FIG. 3, the management server 100 according to the present invention is configured such that (1) UUID-based devices are mapped to each other to enable mutual communication, (2) authentication access ), User privileges, and security settings for objects. (3) Provide LDAP (authentication) based trust and control, and (4) allocate resources (on- -list>, and it is configured to set restrictions according to the group policy for the related devices through the setting of the Profile and the Group Policy.

Meanwhile, the management server 100 according to the present invention is configured to implement secure communication of FIDO, AES 256, and TLS (SSL) encryption in a cloud environment.

That is, the management server 100 according to the present invention is configured to enable device-to-device authentication, key authentication management, and access control in order to block objects such as camouflage objects, camouflage VMs, do.

4, the management server 100 according to the present invention performs authentication between devices through biometric authentication such as fingerprint authentication and iris authentication, which are difficult to easily take through FIDO (Fast Identity Online) As shown in FIG.

In addition, the management server 100 according to the present invention is configured to be able to share resources in Device Redirection in a Cloud environment.

As cloud computing continues to evolve, Bring Your Own Device and myriad of virtual machines are organically connected to each other and data is exchanged. Various types of service models are provided based on this, so cloud environment To share devices and make the most of IT resources.

5, the management server 100 according to the present invention includes a connection broker 110, a profile manager 120, a configuration manager 130, And a hardware bus (140).

The connection broker 110 determines whether (1) authenticate, (2) get-resource, and (3) allocate-resource transmission are smoothly performed so that connection settings with a plurality of clients are stably maintained through xml.

To this end, the connection broker 110 transmits and receives related messages based on the related server API library (MQTT) based on the server side application cascade and the related server adapter library.

Accordingly, the connection broker 110 can perform mutual communication between (1) UUID-based devices, (2) authenticate the object through the connection broker 110, , User rights and security settings for objects. (3) Resources (allocations) can be provided as on-demand <authentication-password> and <resource-list>.

As described above, the connection broker 110 allows a user's software and a hardware terminal to be connected to a virtual desktop.

To this end, the connection broker 110 provides user authentication and license verification to check the validity of the software with the user terminal.

The connection broker 110 performs a monitoring function for measuring a management function of a virtual machine and an activity level of the virtual machine allocated to the user terminal.

In addition, the connection broker 110 performs a coordination function of a protocol that allows the same protocol to be used between the terminal and the server.

The connection broker 110 is configured to communicate a plurality of mutually different Message Queue Telemetry Transport (MQTT) channels. For this purpose, the connection broker 110 is preferably configured as Resful-based xml in the form of Post, Get, and Put.

Meanwhile, the profile manager 120 is connected and configured to integrate with the Active Directory and the Radius server, and sets up (1) protocol and (2) user control assignment.

Accordingly, the profile manager 120 performs enterprise provisioning according to the type of data written in the device protocol related to the BYOD (Bring Your Own Device), sets the profile and the group policy for the device, It is possible to set a constraint according to the policy.

Meanwhile, the profile manager 120 provides configuration information of an operating system and an application of a resource, transmits information about the configuration of the hardware, allocates a profile, or applies authentication through LDAP or authentication.

Also, the profile manager 120 updates the user profile in a pool of profiles, such as a user profile, through user authentication.

At this time, the profile manager 120 is made up of a Server-Client model, the related modules are configured based on a Java Servlet, and the client is also configured based on a Java Servlet.

Meanwhile, the configuration manager 130 performs connection establishment by a license, runtime of the Bring Your Own Device of the Cloud, status monitoring, and restoration of instance assignment. The configuration manager 130 performs the following operations: (1) Relationship.

Accordingly, the setting manager 130 can perform authentication through connection and login and logout of the device, (2) Fast Identity Online (FIDO), authentication through authentication and authentication, (3) 256-bit Advance Encryption System and Transport Layer Security You can manage your Bring Your Own Device through encryption.

At this time, when the setting manager 130 performs various setting operations based on the Smart Card and other security cards, the setting manager 130 may also include redirection related functions such as a biometric device.

Meanwhile, the hardware bus 140 enables resource sharing between different resources in a stub device in order to solve a problem caused by diversity of connected devices and resource sharing between devices.

To this end, the hardware bus 140 provides redirection based on USB_IP, redirection based on SERIAL_IP, and printer and webcam redirection.

At this time, the hardware bus 140 creates a bus driver as a virtual bus driver to share a device connected to the client on a remote server, and mounts the bus driver at the kernel level of the terminal.

In order to transfer the device connected to the client to the remote server, the Virtual Bus Driver converts the USB and Serial related packets into IP packets through the bus driver and transmits them to the server through the network.

Accordingly, the hardware bus 140 can apply a frame scheduling scheme according to a USB device transfer type (Control, Interrupt, Bulk, Isochronous).

In addition, the hardware bus 140 may change settings according to a HCD (Host Controller Driver), a USB Core Driver, a PDD (Per Device Driver), a Configuration Descriptor, or a Device Descriptor.

Meanwhile, the hardware bus 140 allows a USB packet to be transmitted to the server by applying a scheduling scheme configured as a server to an I / O transaction processed as a USB packet, and the I / .

According to the cloud management server 100 of the present invention as described above, the present invention can interoperate with each other and ensure compatibility with the Bound Through Own Device (BOD).

That is, the present invention can confirm the user attempting connection and the function of the endpoint, manage the client itself, manage the active session, and recover the broken application.

In addition, the present invention makes it possible to ensure security of an activated virtual desktop of an endpoint and to identify a user who tries to remotely, and virtual hard device redirection between endpoints becomes possible.

In addition, the present invention provides call completion between different protocols in running different types of thin clients, zero clients, tablets, PCs, hand phones, and Web browsers, Message Queue Telemetry Transport, which performs Relay (Push / Pull) of the message queue, is also possible.

This enables relaying between various virtualization platform devices.

It is to be understood that the invention is not limited to the disclosed embodiment, but is capable of many modifications and variations within the scope of the appended claims. It is self-evident.

The present invention relates to a cloud management server that enables compatible compatibility between various types of BYODs on a cloud system, and the present invention provides a cloud management server capable of ensuring interoperability and compatibility with users through user interaction between BYODs (Bring Your Own Device) It is effective.

100: management server 110: connection broker
120: Profile manager 130: Configuration manager
140: Hardware bus

Claims (11)

A connection broker performing a user authentication and a license verification function for verifying the validity of the user terminal and the software so that the user's software and hardware terminals are connected to the virtual desktop;
A profile manager that performs user assignment so that an integrated connection can be established with the Active Directory and the Radius server;
A configuration manager for restoring runtime, status monitoring and instance assignments with respect to license connection settings and cloud terminal devices (BYOD); And
And a hardware bus that supports sharing among different resources in a stub device in order to prevent a conflict caused by resource sharing among various devices connected to the cloud management server.
The method according to claim 1,
The connection broker comprises:
And a monitoring function for measuring a management function of a virtual machine assigned to a user terminal and an activity level of the virtual machine.
3. The method of claim 2,
The connection broker comprises:
A protocol coordination function for confirming a protocol of the terminal and converting the protocol to a standard protocol so that the same protocol is used between the terminal and the server.
The method of claim 3,
The connection broker comprises:
Wherein a plurality of different Message Queue Telemetry Transport (MQTT) channels are communicated with each other.
The method according to claim 1,
The profile manager comprising:
And setting a restriction according to a device group policy by setting a protocol and a user control assignment.
6. The method of claim 5,
The profile manager,
1) provide the operating system of the resource and configuration information of the application;
2) A cloud management server characterized in that information is transmitted to a configuration of the hardware to allocate a profile or apply authentication through LDAP and authentication.
The method according to claim 1,
The setting manager,
And performs control according to release, authentication, and encryption of the cloud management server.
8. The method of claim 7,
Wherein the control of the setting manager comprises:
Ⓐ Authentication through connection, login and logout of devices ⓑ Authentication through FIDO (Fast Identity Online) and LDAP ⓒ Advance Encryption System 256bit and Encryption via Transport Layer Security encryption of the cloud management server.
9. The method according to any one of claims 1 to 8,
The hardware bus comprises:
A bus driver is created as a virtual bus driver and mounted on a kernel level of the terminal in order to share a device connected to the client on a remote server. Cloud management server.
10. The method of claim 9,
The hardware bus comprises:
In order to transfer the device connected to the client to the server at the remote site, USB and Serial related packets are generated as an IP packet through one bus driver and transmitted to the server through the network Cloud management server.
12. The method of claim 11,
The hardware bus comprises:
Ⓐ apply frame scheduling scheme according to USB device transmission type (Control, Interrupt, Bulk, Isochronous);
Ⓑ Change the settings according to HCD (Host Controller Driver), USB Core Driver, and PDD (Per Device Driver);
Ⓒ Establishes connection of I / O connected to client to convert scheduling method constituted by server for I / O transaction processed by USB packet.

Images