CN115904604A

CN115904604A - Access method, device and computer readable storage medium

Info

Publication number: CN115904604A
Application number: CN202110945111.XA
Authority: CN
Inventors: 李香林
Original assignee: Zhejiang Dahua Technology Co Ltd
Current assignee: Zhejiang Dahua Technology Co Ltd
Priority date: 2021-08-17
Filing date: 2021-08-17
Publication date: 2023-04-04

Abstract

The application discloses an access method, an access device and a computer readable storage medium, wherein the access method comprises the following steps: after a user logs in an access program in the springboard software, a client program in the springboard software sends the access program and an execution instruction to a target container where the target software is located, so that an auxiliary program in the target container starts the received access program according to the execution instruction after receiving the access program and the execution instruction; and after receiving the result that the auxiliary program successfully starts the received access program, the client program establishes connection with the access program received in the target container so that the user can log in the target software through the established connection. The access method provided by the application can improve the safety performance of access.

Description

Access method, device and computer readable storage medium

Technical Field

The present application relates to the field of communications technologies, and in particular, to an access method, an access device, and a computer-readable storage medium.

Background

In order to ensure the security of the basic software, a platform developer (i.e. a device manufacturer) may use a Container mode to run software (APP) developed by a third party developer inside a Container (Container), that is, the Container provides a running environment for the APP running. Meanwhile, due to the arrangement of the container, the isolation between the inside and the outside of the container can be realized, so that directories and files outside the container cannot be accessed in the container, and key data and other digital assets of a platform developer are guaranteed.

The inventor of the application finds that in the process of accessing the inside of the container by a third-party developer, the risk exists that digital assets, data and sensitive information stored in equipment by an equipment manufacturer are easy to obtain.

Disclosure of Invention

The application provides an access method, an access device and a computer readable storage medium, which can improve the security of a user for accessing target software.

A first aspect of an embodiment of the present application provides an access method, where the access method includes: after a user logs in an access program in springboard software, a client program in the springboard software sends the access program and an execution instruction to a target container where target software is located, so that after an auxiliary program in the target container receives the access program and the execution instruction, the received access program is started according to the execution instruction; and after receiving the result that the auxiliary program successfully starts the received access program, the client program establishes connection with the access program received in the target container so that the user logs in the target software through the established connection.

A second aspect of an embodiment of the present application provides an access method, where the access method includes: receiving an auxiliary program in a target container, and sending an access program and an execution instruction by a client program in springboard software after a user logs in the access program in the springboard software; the auxiliary program starts the received access program according to the execution instruction; and the auxiliary program sends feedback information to the springboard software, so that the client program establishes connection with the access program received in the target container after obtaining the result of the access program successfully started and received by the auxiliary program, and the user logs in the target software in the target container through the established connection.

A third aspect of an embodiment of the present application provides an access method, where the access method includes: after a user logs in an access program in the springboard software, a client program in the springboard software sends the access program and an execution instruction to a target container where target software is located; the auxiliary program in the target container receives the access program and the execution instruction, and starts the received access program according to the execution instruction; and the auxiliary program sends feedback information to the springboard software, so that the client program establishes connection with the access program received in the target container after obtaining the result of the access program successfully started and received by the auxiliary program, and the user logs in the target software through the established connection.

A fourth aspect of the embodiments of the present application provides an access device, where the access device includes a processor, a memory, and a communication circuit, where the processor is coupled to the memory and the communication circuit, respectively, and the memory stores program data, and the processor implements the steps in the foregoing method by executing the program data in the memory.

A fifth aspect of embodiments of the present application provides a computer-readable storage medium, which stores a computer program, the computer program being executable by a processor to implement the steps in the above method.

The beneficial effects are that: this application installation springboard software in equipment, utilize springboard software to make the user can log in to the target software, make at whole login process, the user can not be in the outside of container, consequently it can't obtain contents such as equipment manufacturer's data, asset, sensitive information, can protect equipment manufacturer, improve whole access process's security performance, in addition, from the equipment level, this application only need set up in equipment that a supply user visit springboard software the access entry can, all containers do not provide to the outside, also can guarantee security performance.

Drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the description of the embodiments are briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts. Wherein:

FIG. 1 is a schematic diagram of a prior art internal frame of a device;

FIG. 2 is a schematic view of the interior of a container according to the prior art;

FIG. 3 is a schematic diagram of a process for a third party developer to access the interior of a container in a prior art application scenario;

FIG. 4 is a schematic diagram of a process for a third party developer to access the interior of a container in another application scenario of the prior art;

FIG. 5 is a schematic flow chart diagram of one embodiment of an access method of the present application;

FIG. 6 is a process diagram corresponding to the method of FIG. 5;

FIG. 7 is a schematic flow chart diagram of another embodiment of an access method of the present application;

FIG. 8 is a process diagram corresponding to the method of FIG. 7;

FIG. 9 is a schematic flow chart diagram of another embodiment of an access method of the present application;

FIG. 10 is a process diagram corresponding to the method of FIG. 9;

FIG. 11 is a schematic diagram of an embodiment of an access device according to the present application;

FIG. 12 is a schematic diagram of the structure of another embodiment of the access device of the present application;

FIG. 13 is a schematic block diagram of another embodiment of an access device according to the present application;

FIG. 14 is a schematic diagram of the structure of another embodiment of the access device of the present application;

FIG. 15 is a schematic structural diagram of an embodiment of a computer-readable storage medium of the present application.

Detailed Description

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments in the present application without making any creative effort belong to the protection scope of the present application.

Before describing the access method of the present application, some background will first be described.

Referring to fig. 1, in order to ensure the security of the basic software, a platform developer (i.e., a device manufacturer) uses a Container method to operate software (APP) developed by a third party developer inside a Container (Container), that is, the Container provides an operating environment for APP operation. Meanwhile, due to the arrangement of the container, the isolation between the inside and the outside of the container can be realized, so that directories and files outside the container cannot be accessed in the container, and key data and other digital assets of a platform developer are guaranteed.

In conjunction with fig. 2, in addition to the software (denoted by reference numeral 10), a supporting auxiliary program (denoted by reference numeral 20, which may also be referred to as a background auxiliary process, and abbreviated as ca.d) is also running in the container, and the auxiliary program is used for managing the container.

For the access inside the container, there are two methods in the prior art, the first method is to adopt a mode of step 1+ step 2 as shown in fig. 3, that is, step 1 is executed first, and then step 2 is executed to enter the corresponding container, and since step 1 is executed, the entered environment is the environment of the device operating system level, and is outside the container, there is a risk that digital assets and sensitive information on the device by the device manufacturer are easily acquired by a third party developer, so that there is a safety hazard in this method.

The second way is to adopt the way shown in fig. 4, which is that the third party developer directly enters the corresponding container, but the premise of adopting this way is that each container is provided outside, and from the equipment level, there are multiple entrances, and since the more entrances, the greater the security risk, there are also many potential safety hazards.

In order to avoid the potential safety hazard in the prior art, the following scheme is adopted in the application, which can be specifically referred to as follows.

With reference to fig. 5 to 6, in an embodiment of the present application, an access method includes:

s110: after the user logs in the access program in the springboard software, the client program in the springboard software sends the access program and the execution instruction to the target container where the target software is located.

First, the springboard software is on the same device as the target software. In fig. 6, a Container in which springboard software (springboard) is located is denoted as Container G, and a target Container in which target software (Customer App) is located is denoted as Container Tn.

The springboard software comprises an Access program (RAC.d) and a client program (RAC.client), wherein the RAC.d (remote Access and Control Daemon) is used for providing network Access Control services, and specifically comprises remote Access Control services, and common Access services comprise telnet services and ssh services; client and RAC.d are matched clients.

When a user logs in an access program in the springboard software (the user can remotely log in the access program in the springboard element), the user is in a Container G operated by the springboard software, then the user can issue an instruction for logging in target software according to a login requirement, then a client program in the springboard software correspondingly generates an execution instruction, and the execution instruction and the access program in the springboard software are sent to a target Container together.

S120: and the auxiliary program in the target container receives the access program and the execution instruction, and starts the received access program according to the execution instruction.

After the auxiliary program CA.d in the target container receives the access program and the execution instruction, the auxiliary program stores the access program in the target container, and then starts the received access program according to the execution instruction. In this case, the access program stored in the target container is outside the target software, and both are stored in parallel in the target container.

The method comprises the steps that a client program in springboard software sends an access program to a target container, specifically, the client program sends a file/folder including the access program to the target container for storage, and then an auxiliary program modifies the attribute of the file/folder stored in the target container into the attribute of readable and writable execution of the target container, or the client program adopts a mounting mode to mount the file/folder including the access program to the target container.

In an application scenario, in order to improve security performance, before receiving an access program and an execution instruction, an auxiliary program in a target container authenticates a client program in the springboard software, and only when the client program passes the authentication, the springboard software is determined to be authenticated and qualified software, and the auxiliary program receives the access program and the execution instruction sent by the client program, otherwise, the auxiliary program ignores the access program and the execution instruction sent by the client program.

In an application scenario, the step of the auxiliary program authenticating the client program comprises: identifying whether the client program has the authority to share the file and the authority to execute the command in the target container; if the client program is authenticated to have the authority of sharing the file and the authority of executing the command in the target container, determining that the client program passes the authentication; otherwise, determining that the authentication of the client program is not passed.

In other application scenarios, when authenticating a client program, only whether the client program has the authority to share a file or whether the client program has the authority to execute a command in a target container may be authenticated.

S130: the auxiliary program sends feedback information to the springboard software, so that the client program establishes connection with the access program received in the target container after obtaining the result that the auxiliary program successfully starts the received access program, and a user logs in the target software through the established connection.

The feedback information carries the result of whether the auxiliary program successfully starts the received access program, when the client program obtains the result of whether the auxiliary program successfully starts the received access program, the client program establishes connection with the access program in the target container, at this time, the user can remotely log in the target software through the connected connection to achieve the purpose of accessing the target software, and then the working environment of the user is switched to the target container environment where the target software is located, and the user can also execute various operations according to the needs, for example: debugging, operation and maintenance and the like.

In the scheme of the application, the springboard software is installed in the equipment, and the springboard software is utilized to enable a user to log in the target software, so that the user is not outside the container in the whole login process, the user cannot acquire the data, assets, sensitive information and other contents of equipment manufacturers, the equipment manufacturers can be protected, and the safety performance of the whole access process is improved.

Continuing with fig. 6, when the user logs out from the target software, the access program received in the target container will disconnect from the client program in the springboard software, at this time, the user returns to the springboard software, then the client program sends an end instruction to the target container, and the auxiliary program in the target container closes and deletes the access program received in the target container after receiving the end instruction.

And then the user is in the container environment where the springboard software is located, and can repeatedly enter and exit different target software, and meanwhile, the user directly exits the access control of the equipment after exiting the springboard software.

In another embodiment, after the user logs out from the target software and the access program received in the target container is disconnected from the client program in the springboard software, the client program may not immediately send the end instruction to the target container, at this time, the client program may store the related information of the target software that has already established connection (establishing connection with the target software means establishing connection with the access program in the target software), and when the client program inquires that the user wants to log in the target software that has previously established connection again, the client program in the springboard software may directly establish connection with the access program received in the target container, that is, the client program and the execution instruction do not need to be sent again, so as to improve the login speed. And then only when the user exits the springboard software, the client program in the springboard software sends an ending instruction to the target container which establishes the connection.

Referring to fig. 7 and 8, in another embodiment of the present application, an access method includes:

s210: after a user logs in an access program in the springboard software, a client program in the springboard software sends an access request at least carrying the access program, an execution instruction and target software to a management center.

S220: and the management center receives the access request, and sends the access program and the execution instruction to the target container after analyzing the access request.

S230: and the auxiliary program in the target container receives the access program and the execution instruction, and starts the received access program according to the execution instruction.

S240: the auxiliary program sends feedback information to the management center.

S250: and the management center receives the feedback information, and sends a result to the client program after analyzing the result to obtain the result of the access program which is successfully started and received by the auxiliary program.

S260: and after the client program obtains the result that the auxiliary program successfully starts the received access program, establishing connection with the access program received in the target container, and enabling the user to log in the target software through the established connection.

Unlike the above embodiments, in the present embodiment, A Management Center (AMC) is provided in the device, the Management Center is configured to manage each software, and is configured to parse an access request sent by the springboard software and then send an access program and an execution instruction to a corresponding target container after receiving the access request, and the Management Center is further configured to parse the feedback information sent by the client program and send a result to the client program after parsing a result that the received access program is successfully started by the auxiliary program.

If the management center analyzes the feedback information to obtain a result that the auxiliary program fails to start the received access program, in one application scene, the management center also sends the analysis result to the client program so that the client program can remind the user, in another application scene, the management center does not send the analysis result to the client program, and then if the client program fails to receive the feedback result within the set time, the management center automatically determines that the auxiliary program fails to start the received access program.

In order to improve the security performance, the management center authenticates the client program before sending the access program and the execution instruction to the target container, and only when the authentication is passed, the management center sends the access program and the execution instruction to the target container, otherwise, the management center ignores the access request sent by the client program.

The process of authenticating the client by the management center is the same as the process of authenticating the client by the auxiliary program in the above embodiment, and is described in detail in the above, and is not described herein again.

Meanwhile, in the embodiment, when the user quits from the target software, the access program received in the target container is disconnected from the client program in the springboard software, at the moment, the user returns to the springboard software, and then the client program sends an end notification at least carrying an end instruction and the target software to the management center; the management center receives the end notice and sends an end instruction to the target container; and the auxiliary program in the target container receives the ending instruction, and closes and deletes the access program received in the target container. That is, the end command is also sent from the management center to the target container, as in the access program and the execution command described above.

In other embodiments, the ending instruction may also be sent directly to the auxiliary program in the target container by the client program in the springboard software, i.e., not through the management center.

Similar to the above embodiment, after the user exits from the target software, it is in the springboard software and can repeatedly enter and exit different target software, while after the user exits the springboard software, the user directly exits the access control of the device.

Similarly to the above embodiment, after the user logs out from the target software and the access program received in the target container is disconnected from the client program in the springboard software, the client program may not immediately send an end notification to the management center, at this time, the client program may store the related information of the target software that has already established a connection, and after that, if the client program queries that the user wants to log in the target software again, the client program in the springboard software may directly establish a connection with the access program received in the target container, that is, without sending the access program and executing the instruction again. And then only when the user exits the springboard software, the client program in the springboard software sends an end notification to the management center, and then the management center sends an end instruction to the corresponding target container.

Referring to fig. 9, in another embodiment of the present application, an access method includes:

s310: after a user logs in an access program in the springboard software, a client program in the springboard software sends the access program and an execution instruction to a target container where the target software is located, so that after an auxiliary program in the target container receives the access program and the execution instruction, the received access program is started according to the execution instruction.

S320: and after receiving the result that the auxiliary program successfully starts the received access program, the client program establishes connection with the access program received in the target container so that the user can log in the target software through the established connection.

In this embodiment, the main execution body of the steps of the whole method is the client program in the springboard software, and the steps of the whole method are the same as the steps of the method executed by the client program in any one of the above embodiments, which can be referred to in detail in the above embodiments, and are not described herein again.

Referring to fig. 10, in still another embodiment of the present application, an access method includes:

s410: and receiving the access program and the execution instruction by the auxiliary program in the target container, and sending the access program and the execution instruction by the client program in the springboard software after the user logs in the access program in the springboard software.

S420: the auxiliary program starts the received access program according to the execution instruction.

S430: the auxiliary program sends feedback information to the springboard software, so that the client program establishes connection with the access program received in the target container after obtaining the result that the auxiliary program successfully starts the received access program, and further, a user logs in the target software in the target container through the established connection.

In this embodiment, the main body of the whole method steps is the auxiliary program in the target container, and the whole method steps are the same as the method steps executed by the auxiliary program in any of the above embodiments, and reference may be made to the above embodiments for details, which are not described herein again.

Referring to fig. 11, fig. 11 is a schematic structural diagram of an embodiment of the access device of the present application. The access device 500 includes a processor 510, a memory 520, and a communication circuit 530, wherein the processor 510 is coupled to the memory 520 and the communication circuit 530, respectively, the memory 520 stores program data, and the processor 510 executes the program data in the memory 520 to implement the steps in the method according to any of the above embodiments, and the detailed steps may refer to the above embodiments and are not described herein again.

The access device 500 may be any device that can be installed with software, such as a tablet computer, a mobile phone, and the like, which is not limited herein.

Referring to fig. 12, fig. 12 is a schematic structural diagram of another embodiment of the access device of the present application. The access device 600 includes a first control module 610 and a second control module 620.

The first control module 610 is configured to control, after a user logs in an access program in the springboard software, a client program in the springboard software to send the access program and an execution instruction to a target container where the target software is located, so that an auxiliary program in the target container starts a received access program according to the execution instruction after receiving the access program and the execution instruction;

the second control module 620 is connected to the first control module 610, and configured to control the client program to establish a connection with the access program received in the target container after the client program receives a result that the auxiliary program successfully starts the received access program, so that the user logs in the target software through the established connection.

The access device 600 may be any device that can be installed with software, such as a tablet computer, a mobile phone, and the like, which is not limited herein.

Referring to fig. 13, fig. 13 is a schematic structural diagram of another embodiment of the access device of the present application. The access device 700 includes a third control module 710, a fourth control module 720, and a fifth control module 730.

The third control module 710 is configured to control receiving of an auxiliary program in a target container, and after a user logs in an access program in the springboard software, a client program in the springboard software sends the access program and an execution instruction.

The fourth control module 720 is connected to the third control module 710, and is configured to control the auxiliary program to start the received access program according to the execution instruction.

The fifth control module 730 is connected to the fourth control module 720, and is configured to control the auxiliary program to send feedback information to the springboard software, so that after a result that the auxiliary program successfully starts the received access program is obtained, the client program establishes a connection with the access program received in the target container, and the user logs in the target software in the target container through the established connection.

The access device 700 may be any device that can be installed with software, such as a tablet computer, a mobile phone, and the like, which is not limited herein.

Referring to fig. 14, fig. 14 is a schematic structural diagram of another embodiment of the access device of the present application. The access device 800 includes a sixth control module 810, a seventh control module 820, and an eighth control module 830.

The sixth control module 810 is configured to, after the user logs in the access program in the springboard software, control the client program in the springboard software to send the access program and the execution instruction to the target container where the target software is located.

The seventh control module 820 is connected to the sixth control module 810, and is configured to control the auxiliary program in the target container to receive the access program and the execution instruction, and start the received access program according to the execution instruction.

The eighth control module 830 is connected to the seventh control module 820, and is configured to control the assistant program to send feedback information to the springboard software, so that after a result that the assistant program successfully starts the received access program is obtained, the client program establishes a connection with the access program received in the target container, and thus, the user logs in the target software through the established connection.

The access device 800 may be any device that can be installed with software, such as a tablet computer and a mobile phone, which is not limited herein.

Referring to fig. 15, fig. 15 is a schematic structural diagram of an embodiment of a computer-readable storage medium according to the present application. The computer-readable storage medium 900 stores a computer program 910, the computer program 910 being executable by a processor to implement the steps of any of the methods described above.

The computer-readable storage medium 900 may be a device that can store the computer program 910, such as a usb disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk, or an optical disk, or may be a server that stores the computer program 910, and the server may send the stored computer program 910 to another device for operation, or may run the stored computer program 910 by itself.

The above description is only for the purpose of illustrating embodiments of the present application and is not intended to limit the scope of the present application, and all modifications of equivalent structures and equivalent processes, which are made by the contents of the specification and the drawings of the present application or are directly or indirectly applied to other related technical fields, are also included in the scope of the present application.

Claims

1. An access method, the method comprising:

after a user logs in an access program in springboard software, a client program in the springboard software sends the access program and an execution instruction to a target container where target software is located, so that an auxiliary program in the target container starts the received access program according to the execution instruction after receiving the access program and the execution instruction;

and after receiving the result that the auxiliary program successfully starts the received access program, the client program establishes connection with the access program received in the target container so that the user logs in the target software through the established connection.

2. The method of claim 1, wherein the step of sending, by the client program in the springboard software, the access program and the execution instruction to the target container in which the target software is located includes:

and the client program sends an access request at least carrying the access program, the execution instruction and the target software to a management center, so that the management center sends the access program and the execution instruction to the target container after receiving and analyzing the access request.

3. The method of claim 1, further comprising:

and after the user exits the target software, the client program sends an end instruction to the target container, so that the auxiliary program in the target container closes and deletes the access program received in the target container after receiving the end instruction.

4. The method according to claim 3, wherein the step of the client program sending an end instruction to the target container comprises:

and the client program sends an end notification at least carrying the end instruction and the target software to a management center, so that the management center sends the end instruction to the target container after receiving and analyzing the end notification.

5. An access method, the method comprising:

receiving an auxiliary program in a target container, and sending an access program and an execution instruction by a client program in springboard software after a user logs in the access program in the springboard software;

the auxiliary program starts the received access program according to the execution instruction;

and the auxiliary program sends feedback information to the springboard software, so that the client program establishes connection with the access program received in the target container after obtaining a result that the auxiliary program successfully starts the received access program, and the user logs in the target software in the target container through the established connection.

6. The method of claim 5, further comprising:

the auxiliary program receives an ending instruction sent by the client program after the user quits the target software;

and the auxiliary program closes and deletes the access program received in the target container according to the ending instruction.

7. The method of claim 5, wherein the step of the helper program receiving the access program and the execution instructions sent by the client program comprises:

the auxiliary program authenticates the client program;

and the auxiliary program receives the access program and the execution instruction after the client program passes the authentication.

8. An access method, the method comprising:

after a user logs in an access program in the springboard software, a client program in the springboard software sends the access program and an execution instruction to a target container where target software is located;

the auxiliary program in the target container receives the access program and the execution instruction, and starts the received access program according to the execution instruction;

and the auxiliary program sends feedback information to the springboard software, so that the client program establishes connection with the access program received in the target container after obtaining the result of the access program successfully started and received by the auxiliary program, and the user logs in the target software through the established connection.

9. The method of claim 8, wherein the step of sending the access program and the execution instruction to the target container where the target software is located by the client program in the springboard software comprises:

the client program sends an access request at least carrying the access program, the execution instruction and the target software to a management center;

and the management center receives the access request, and sends the access program and the execution instruction to the target container after analyzing the access request.

10. The method of claim 9, wherein the step of sending the access program and the execution instruction to the target container comprises:

the management center authenticates the client program;

and the management center sends the access program and the execution instruction to the target container after the client program passes the authentication.

11. The method of claim 10, wherein the step of authenticating the client program by the management center comprises:

the management center identifies whether the client program has the authority to share files and the authority to execute commands in the target container;

if the client program is authenticated to have the authority of sharing the file and the authority of executing the command in the target container, determining that the client program passes the authentication;

otherwise, determining that the authentication of the client program is not passed.

12. The method of claim 9, further comprising:

when the user quits the target software, the client program sends an end notification carrying at least an end instruction and the target software to the management center;

the management center receives the end notification and sends the end instruction to the target container after analyzing the end notification;

and the auxiliary program in the target container receives the ending instruction, and closes and deletes the access program received in the target container according to the ending instruction.

13. The method of claim 9, wherein the step of the auxiliary program sending feedback information to the springboard software comprises:

and the auxiliary program sends the feedback information to the management center, so that the management center sends a result of the access program to the client program after analyzing the feedback information and obtaining the result of the access program successfully started and received by the auxiliary program.

14. The method of claim 8, wherein the step of receiving the access program and the execution instruction by the auxiliary program in the target container comprises:

the auxiliary program authenticates the client program;

15. An access device, comprising a processor, a memory and a communication circuit, wherein the processor is coupled to the memory and the communication circuit respectively, the memory stores program data, and the processor executes the program data in the memory to realize the steps of the method according to any one of claims 1-14.

16. A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program which is executable by a processor to implement the steps in the method according to any of claims 1-14.