TWI805537B - Method for controlling multiple computers - Google Patents

Abstract

The present invention provides a method for controlling multiple computers. Firstly, a switching system comprising a first module electrically connected to at least one input device, a plurality of second modules respectively electrically connected to a first computer and a second computer, and a management device electrically coupled to the first module and the plurality of second modules is provided. Then, the first module obtains a first private key corresponding to the first computer, and transmits an authorizing request to the management device. Finally, the management device performs an authorization process with the first module, wherein if it is successfully authorized, a second private key stored in the management device is utilized to perform an automatic authorization process with the first computer. If the automatic authorization process is successfully conducted, the input device is allowed to directly control the first computer through the first module.

Description

multi-computer control method

The invention relates to a multi-computer control technology, in particular to a multi-computer control method for management authentication.

Please refer to Fig. 1, which is a schematic diagram of a conventional multi-computer control switching system. The multi-computer system 1 includes a plurality of receiving modules 10-10b, a management computer 12 and a plurality of transmitting modules 13-13b. Each receiving module 10-10b is connected with a control terminal device 11 including a display, a keyboard, and a mouse. Each transmission module 13-13b is connected to a remote computer 14-14b. The management computer 12, the receiving modules 10-10b and the transmitting modules 13-13b are electrically connected together via the network 90, so that the multi-computer control switching system constitutes a network KVM architecture (KVM over IP). The management computer 12 has management control software, which is used to control the authority of each computer 14-14b via each user who logs in from the receiving module 10-10b.

In the conventional technology, for example, the user uses the console device 11 to log in to the management control software in the management computer 12 through the receiving modules 10-10b. The management control software will present multiple transmission modules 13-13b for the user to select, and the user then selects one of the transmission modules 13-13b to control the corresponding computer 14-14b. For example: after the user selects the transmission module 13a, the user enters the account number and password that can log in to the selected computer 14a through the control device 11, and logs in to the computer 14a through the receiving module 10a and the transmission module 13a to operate the selected computer 14a application.

Please refer to Fig. 2, in the prior art, the security protection method for the account password is to insert the authentication device 15 with the security key into the local computer 16, and then the operating system of the local computer 16 will detect After inserting the authentication device 15, the operating system of the near-end computer 16 will authenticate with the cloud authentication server 17, and then the cloud authentication server 17 returns random information (nonce), and the user decrypts the information (for example: fingerprint or password) ) unlock the private key locked in the authentication device 15, and use the private key to sign random information. Then, the signed random information will be sent back to the cloud authentication server 17, and the cloud authentication server 17 will use the public key corresponding to the private key to verify the signed authentication information. Access rights to the local computer 16 .

If the mechanism of Fig. 2 is applied to the multi-computer system of Fig. 1, although the security effect of encryption and decryption can be achieved, it must be verified twice in fact, the first verification is the authentication of the management computer 12, and the second authentication is the authentication of the selected computer 14~14b. Although such a cumbersome program can achieve the security function, the user must log in again every time he logs in, and re-authenticate twice, which causes inconvenience in use. .

To sum up the above, therefore a kind of multi-computer control method is needed to solve the problems of the conventional technology.

The purpose of the present invention is to provide a multi-computer control method, which can implement encryption and decryption and simplify the procedures of authentication and login into the multi-computer system.

In one embodiment, the present invention provides a multi-computer control method. First, a switching system is provided, which includes a first module electrically connected to at least one input device, and a first computer and a second computer respectively. A plurality of second modules electrically connected, a management device electrically connected with the first module and the plurality of second modules. Then, make the first module obtain the first private key information corresponding to the first computer and transmit the authentication request to the management device. Finally, the management device performs an authentication procedure with the first module according to the authentication request. If the authentication is successful, the automatic authentication procedure is performed with the first computer through the second private key information stored in the management device. If the automatic authentication procedure is successful, then The input device is allowed to directly control the first computer via the first module.

In one embodiment, the first private key information is stored in the authentication device, the authentication device is electrically connected to the first module, and the first module obtains the first private key information through biometric features or passwords, wherein the authentication procedure It further includes the following steps: first, the management device returns random information to the first module. Then, the first module uses the first private key information to sign the random information and send it back to the management device. Then it is judged whether the management device successfully decrypts the signed random information with a public key information corresponding to the first computer, and if successful, the authentication device is authenticated with an external authentication server. Finally, if the authentication with the external authentication server is successful, the first module directly controls the first computer corresponding to the private key information.

In one embodiment, the first private key information is stored in the first module, and the account number and password are input through the input device to obtain the private key information. Wherein, the authentication procedure further includes the following steps: first, the management device returns random information to the first module. Then, the first module uses the first private key information to sign the random information and send it back to the management device. Then it is judged whether the management device successfully decrypts the signed random information with a public key information corresponding to the first computer, and if successful, the authentication device is authenticated with an external authentication server. Finally, if the authentication with the external authentication server is successful, the first module directly controls the first computer corresponding to the private key information.

Therefore, by using the aforementioned multi-computer control method of the present invention, in a structure with a management device and multiple controlled computers, the authentication procedure can be established through the management device and an external authentication server, which eliminates the need for the user in the conventional technology to perform an authentication process on the management device. As well as the cumbersome procedures of authentication for the accused computer, it achieves the effect of taking into account the convenience of operation and safety.

The advantages and features of the present invention and methods for achieving them will be more easily understood by describing in more detail with reference to exemplary embodiments and accompanying drawings. However, the invention may be embodied in different forms and should not be construed as limited to the embodiments set forth herein. On the contrary, for those skilled in the art, these embodiments provided will make this disclosure more thorough, comprehensive and completely convey the scope of the present invention, and the present invention will only be the appended claims defined. Throughout the specification, some different reference numerals may refer to the same component. Specific structural and functional details disclosed herein are representative only and are for purposes of describing example embodiments of the invention. This invention may, however, be embodied in many alternative forms and should not be construed as limited to only the embodiments set forth herein.

Unless otherwise defined, all terms (including technical and scientific terms) used hereinafter have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. It will be more understandable that, for example, those terms defined in commonly used dictionaries should be understood as having a meaning consistent with the content of the relevant field, and unless clearly defined in the following, it will be understood by those with ordinary knowledge in the technical field understood in the general sense understood.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the exemplary embodiments. As used herein, the singular forms "a", "an" and "an" are also intended to include the plural unless the context clearly dictates otherwise. It should also be understood that the term "comprises" and/or "comprises" as used herein specifies the presence of stated features, integers, steps, operations, units and/or components and does not exclude the presence or addition of one or more Other features, integers, steps, operations, units, components and/or combinations thereof.

Please refer to FIG. 3 and FIG. 4 , wherein FIG. 3 is a flow diagram of the multi-computer control method of the present invention; FIG. 4 is a schematic diagram of the switching system architecture of the present invention. The computer control method 3 includes a step 30 of providing a switching system 2 . In an embodiment of the switching system 2, as shown in FIG. 4, it is a network KVM (KVM over IP) architecture. The switching system 2 includes a first module 20 - 20 b , a second module 22 - 22 b and a management device 23 . Each of the first modules 20-20b is electrically connected to the network 90 respectively, for example: by conforming to the Internet Group Management Protocol (Internet Group Management Protocol, IGMP), which is responsible for the IP multicast in the TCP/IP protocol suite The LAN switch 26 (LAN switch) of the protocol managed by the member is connected to the Internet, and is electrically connected to the input device 201, such as a keyboard and a mouse. It should be noted that the network switch 26 is not limited to the aforementioned embodiments, and the user can select an appropriate network switch 26 according to requirements.

Each second module 22~22b is electrically connected to the network 90, for example: connected to the Internet through the network switch 26, and through the network 90 and the management device 23 and each first module 20~20b is electrically connected connect. Each second module 22~22b is electrically connected to computers 21~21b, wherein the second module 22 is electrically connected to the first computer 21, the second module 22a is electrically connected to the second computer 21b, and the second module 22 is electrically connected to the second computer 21b. The group 22b is electrically connected with the third computer 21c. The management device 23 is electrically connected to the network 90 . The management device 23 can be a computer or a server.

Then proceed to step 31 to enable the first module to obtain the first private key information and transmit the authentication request to the management device. In one embodiment of this step, the first module 20 controls the first computer 21a as an example for illustration. In this embodiment, the first module 20 obtains the first private key information through symmetric authentication. In an embodiment of symmetric authentication, the first private key information is stored in an external authentication device 24, and the user inserts the authentication device 24 into the first module 20, so that the first module 20 can pass through biometric features, such as : Obtain the first private key information stored in the authentication device 24 by way of fingerprint, human face or pupil feature. In addition to using biometric features, in another embodiment, the user can also input a password through the input device to obtain the first private key information in the authentication device 24 .

In this embodiment, the authentication device 24 is a USB flash drive, but it is not limited thereto. The first private key information is private key information conforming to the FIDO2 security protocol, but not limited by FIDO2. The first private key information is corresponding to the computer that the user wants to control and manipulate. In this embodiment, the first computer 21a is taken as an example. In addition, in another embodiment of symmetric authentication, the first private key information is stored in the first module 20 , and the user obtains the first private key information by inputting the account number and password associated with the first private key information. In other embodiments, the user can also directly insert the flash drive storing the first private key information to retrieve the first private key information without using biometric features or inputting account passwords.

After step 31 , proceed to step 32 , where the management device 23 performs an authentication procedure with the first module 20 according to the authentication request sent by the first module 20 . Please refer to FIG. 4 and FIG. 5 , wherein FIG. 5 is a schematic flowchart of an embodiment of the authentication procedure of the present invention. In this embodiment, the embodiment of step 32 belongs to the procedure of asymmetric authentication, that is, the private key information is used for encryption, and the corresponding public key information is used for decryption. The authentication procedure in step 32 may further include step 321 , after receiving the authentication request, the management device 23 returns random information (nonce) conforming to the same authentication protocol to the first module 20 . Then proceed to step 322 , the first module 20 uses the obtained first private key information to encrypt (encrypt) sign the random information and send it back to the management device 23 . Then proceed to step 323 , judging whether the management device 23 has successfully decrypted the signed random information returned by the first module 20 with the public key information corresponding to the first computer 21 a.

In an embodiment of the judging procedure, the management device 23 internally stores public key information corresponding to each controlled computer 21a-21c, and uses each public key information to decrypt the encrypted random information in the preceding steps, If the decryption is successful, it means that the first module 20 can control the computer corresponding to the public key information to decrypt the encrypted random information. After the authentication procedure between the authentication device 24 and the management device 23 is completed, the flow returns to step 33 of FIG. 3 , otherwise, if there is no public key information that can unlock the aforementioned encrypted random information, proceed to step 324 to deny access The first module 20 accesses the computers 21 a - 21 c connected to the management device 23 .

After step 32, proceed to step 33 to perform an automatic authentication procedure through the second private key information stored in the management device 23 . In an embodiment of step 33 , the operating system of the management device 23 will authenticate with the cloud authentication server 25 . The cloud authentication server 25 in this embodiment is an identity authentication server of FIDO2, which is an authentication server corresponding to the operating system of the controlled first computer 21a. For example: if the operating system of the first computer 21a is Microsoft WINDOWS, then the cloud authentication server 25 is an authentication server of Microsoft AZURE, but it is not limited thereto. Then the cloud authentication server 25 returns random information (nonce) to the management device 23, and the management device 23 uses the second private key information to encrypt and sign the random information, and returns the encrypted second private key information to the cloud authentication server. device 25. Then, the cloud authentication server 25 uses the public key information corresponding to the second private key information to decrypt the encrypted and signed authentication information. If decrypted, it means that the management device 24 has passed the authentication. On the contrary, it means that the authentication is not passed, and then go to step 34 to deny the first module 20 from accessing the remote computer.

After successful authentication, go to step 35. In this step, the user can obtain the control right of the first computer 21a through the first module 20, and pass the content input by the input device 21 through the first module 20 through the first module 20. The second module 22 connects to the first computer 21a to directly control the first computer 21a. In an embodiment of the operation, the user generates an input or manipulation signal through the input device 201, such as: the coordinates of the mouse cursor movement, the single-click or double-click of the mouse, or the input content of the keyboard keys, etc., through the first The module 20 is packaged into a network packet, and then transmitted to the second module 22 through the network 90 to unpack the packet, and then transmitted to the first computer 21a; at the same time, the first computer 21a outputs the corresponding video signal through the second module 22 is packaged into a network packet, and transmitted to the first module 20 via the network 90, and then the first module 20 unpacks the network packet to form image information, and displays it on the display.

To sum up the above, the multi-computer control method of the present invention can establish an authentication program through the management device and the external authentication server, so the user only needs to enter the account number and password once at most to successfully log in to the computer electrically connected to the second module. In this way, the cumbersome procedures for the user to authenticate both the management device and the controlled computer in the conventional technology can be avoided, and the effect of both operation convenience and safety can be achieved.

The above description is only a description of the preferred implementation or examples of the technical means used to solve the problems in the present invention, and is not intended to limit the scope of the patent implementation of the present invention. That is, all equivalent changes and modifications that are consistent with the scope of the patent application of the present invention, or made according to the scope of the patent of the present invention, are covered by the scope of the patent of the present invention.

1: Multi-computer system 10~10b: Receiving module 12: Manage computer 13~13b: Transmission module 11: Control device 14~14b: Computer 15: Authentication device 16: near-end computer 17:Authentication server 2: switch system 20~20b: The first module 201: input device 202: display 21a: First computer 21b: Second computer 21c: Third computer 22~22b: Second module 23: Management device 24: Authentication device 25: Authentication server 26:Switcher 90: Internet 3: Multi-computer control method 30~35: steps 321~324: Steps

The included drawings are used to provide a further understanding of the embodiments of the present application, which constitute a part of the specification, are used to illustrate the implementation of the present application, and explain the principle of the present application together with the text description. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can obtain other drawings based on these drawings without creative efforts. In the schema: Fig. 1 is the multi-computer control switching system schematic diagram of conventional technology; Figure 2 is a schematic diagram of the encryption and decryption authentication architecture of the conventional technology; Fig. 3 is the schematic flow chart of multi-computer control method of the present invention; FIG. 4 is a schematic diagram of the architecture of the switching system of the present invention; and FIG. 5 is a schematic flowchart of an embodiment of the authentication procedure of the present invention.

3: Multi-computer control method

30~35: steps

Claims (9)

A multi-computer control method, comprising: A switching system is provided, which includes a first module electrically connected to at least one input device, a plurality of second modules electrically connected to a first computer and a second computer respectively, and the first module a management device electrically connected to the group and the plurality of second modules; making the first module obtain a first private key information and transmit an authentication request to the management device, wherein the first private key information corresponds to the first computer; and The management device performs an authentication procedure with the first module according to the authentication request. If the authentication is successful, an automatic authentication procedure is performed through a second private key information stored in the management device. If the automatic authentication procedure authentication is successful , then allow the input device to directly control the first computer via the first module. The multi-computer control method as described in Claim 1, wherein the first private key information is stored in an authentication device, the authentication device is electrically connected to the first module, and the first module is enabled through a biometric feature or a password A module obtains the first private key information. The multi-computer control method as described in Claim 2, wherein the authentication device is a USB flash drive. The multi-computer control method as described in Claim 2, wherein the authentication program further includes the following steps: The management device returns a random message to the first module; The first module uses the first private key information to sign the random information and send it back to the management device; judging whether the management device successfully decrypts the signed random information with a public key information corresponding to the first computer; and If it is successfully unlocked, the management device is made to perform the automatic authentication procedure with an external server through the second private key information. The multi-computer control method as described in claim 4, wherein the external server is an identity authentication server of FIDO2. The multi-computer control method as described in Claim 1, wherein the first private key information is stored in the first module, and an account number and password are input through the input device to obtain the first private key information. The multi-computer control method as described in Claim 6, wherein the authentication program further includes the following steps: The management device returns a random message to the first module; fetching the first private key information from the authentication device with a biometric feature; The first module uses the first private key information to sign the random information and send it back to the management device; judging whether the management device successfully decrypts the signed random information with a public key information corresponding to the first computer; and If it is successfully unlocked, the management device is made to perform the automatic authentication procedure with an external server through the second private key information. The multi-computer control method as described in claim 7, wherein the external authentication server is an identity authentication server of FIDO2. The multi-computer control method as described in Claim 1 further includes a network switch electrically connected to the first module, the second module and the management device respectively.

Images