WO2015192582A1 - 虚拟桌面登录验证方法和装置 - Google Patents

虚拟桌面登录验证方法和装置 Download PDF

Info

Publication number
WO2015192582A1
WO2015192582A1 PCT/CN2014/089712 CN2014089712W WO2015192582A1 WO 2015192582 A1 WO2015192582 A1 WO 2015192582A1 CN 2014089712 W CN2014089712 W CN 2014089712W WO 2015192582 A1 WO2015192582 A1 WO 2015192582A1
Authority
WO
WIPO (PCT)
Prior art keywords
login
authentication information
virtual desktop
authentication
component
Prior art date
Application number
PCT/CN2014/089712
Other languages
English (en)
French (fr)
Inventor
吴馨
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2015192582A1 publication Critical patent/WO2015192582A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present invention relates to the field of communications, and in particular to a virtual desktop login verification method and apparatus.
  • a virtual desktop is a service that runs an operating system on a server or a virtual machine on a server and sends the desktop of the virtual machine to a remote client over the network.
  • the virtual desktop system component can be logically divided into a server system component and a client system component, and the client system component requests and establishes a remote desktop service based on the Simple Protocol for Independent Computing Environment (SPICE) protocol. End of the connection, the Remote Desktop Server system component responds to the connection request from the virtual desktop client and establishes a connection to the desktop experience service of the virtual desktop client.
  • SPICE Simple Protocol for Independent Computing Environment
  • VDI Virtual Desktop Infrastructure
  • the Virtual Desktop Infrastructure (VDI) in the SPICE protocol is mainly used to provide a data transfer channel for the guest operating system (Guest OS) of the client and the virtual machine, and the display configuration control data is transmitted through the data transfer channel. , clipboard data, and disk mapping control data.
  • the user enters the user name, password, and other information in the login portal of the terminal (PC or thin terminal) (such as the 110 module in Figure 1).
  • the server IP information is sent to the SPICE.
  • the client (such as the 120 module in Figure 1) connects to the desktop server through the client.
  • the user sees the login interface of the virtual desktop (such as the 140 module in Figure 1). You need to enter the user name and password information again to succeed.
  • Embodiments of the present invention provide a virtual desktop login verification method and apparatus to solve at least the above problems.
  • a virtual desktop login verification method including: a login component obtains authentication information from a virtual desktop proxy, where the authentication information is authentication information input by a user at a login portal; The login component requests virtual desktop login according to the authentication information request.
  • the authentication information is obtained by the SPICE server from the SPICE client through the SPICE main channel, and sent to the virtual desktop agent.
  • the obtaining, by the login component, the authentication information from the virtual desktop agent comprises: the login component creating a memory mapping file for acquiring the authentication information, wherein the memory mapping file is used for receiving The authentication information written by the virtual desktop agent; the login component acquires the authentication information by using the memory mapping file.
  • the obtaining, by the login component, the authentication information from the virtual desktop proxy further includes: the login component, when invoked, creating a separate thread that interacts with the virtual desktop proxy, where The login component is invoked when the user logs in to the virtual desktop; the login component creates the memory mapping file for obtaining the authentication information; and the login component is triggered if the virtual desktop login event is triggered The authentication information is obtained in the memory mapping file.
  • the login component requests the virtual desktop login according to the authentication information, and the login component submits the obtained authentication information to the virtual desktop login authentication module for authentication.
  • the login component requests the virtual desktop login according to the authentication information, including: the login component is configured according to The obtained authentication information determines the authentication information of the virtual desktop.
  • the login component submits the authentication information of the virtual desktop to the virtual desktop login authentication module for authentication.
  • the authentication information includes: a username, a password, and domain information.
  • a virtual desktop login verification apparatus comprising: an obtaining module, configured to obtain authentication information from a virtual desktop agent, wherein the authentication information is input by a user at a login portal Authentication information; the requesting module is configured to perform virtual desktop login according to the authentication information request.
  • the obtaining module includes: a creating unit, configured to create a memory mapping file for acquiring the authentication information, where the memory mapping file is configured to receive the template written by the virtual desktop agent And an obtaining unit configured to acquire the authentication information by using the memory mapping file.
  • the creating unit is further configured to, when invoked, create a separate thread that interacts with the virtual desktop agent, wherein the creating unit is invoked when the user logs in to the virtual desktop; the obtaining unit And being further configured to obtain the authentication information from the memory mapping file if the virtual desktop login event is triggered.
  • the requesting module is further configured to submit the obtained authentication information to the virtual desktop login authentication module for authentication.
  • the login component is used to obtain the authentication information from the virtual desktop agent, where the authentication information is the authentication information input by the user in the login portal; the login component requests the virtual desktop login according to the authentication information, and the solution is solved.
  • the virtual desktop login process multiple cumbersome processes caused by user login information are required to improve the user experience.
  • FIG. 1 is a schematic flowchart of a virtual desktop login according to the related art
  • FIG. 2 is a schematic flowchart of a virtual desktop login verification method according to an embodiment of the present invention
  • FIG. 3 is a schematic structural diagram of a virtual desktop login verification apparatus according to an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of a preferred structure of a virtual desktop login verification apparatus according to an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of a basic framework networking of a method for single sign-on a virtual desktop according to a preferred embodiment of the present invention
  • FIG. 6 is a schematic flowchart of processing of a terminal according to a preferred embodiment of the present invention.
  • FIG. 7 is a schematic diagram of a process flow of a virtual desktop agent according to a preferred embodiment of the present invention.
  • FIG. 8 is a flow chart showing the processing of an automatic login component in accordance with a preferred embodiment of the present invention.
  • FIG. 2 is a schematic flowchart of a virtual desktop login verification method according to an embodiment of the present invention. As shown in FIG. 2, the method includes the following steps:
  • Step S202 the login component obtains the authentication information from the virtual desktop agent, where the authentication information is the authentication information input by the user at the login portal;
  • Step S204 the login component requests virtual desktop login according to the authentication information request.
  • the login component obtains the authentication information input by the user in the login portal, and automatically uses the authentication information to request the virtual desktop login mode, thereby preventing the user from inputting the authentication in the login portal when logging in to the virtual machine client.
  • the information and the repeated input caused by the user inputting the authentication information again in the case of performing the virtual desktop login thereby solving the cumbersome process caused by the need to input the user login information multiple times during the virtual desktop login process, and improving the problem. user experience.
  • the foregoing method may further include: determining that the authentication information is legal authentication information. If the authentication information is invalid, the step S204 may not be performed, but the virtual desktop login of the user is directly ended, and the information that the authentication fails is returned.
  • the login component may be configured according to the saved authentication information of the login virtual machine client and the authentication information of the login virtual desktop.
  • the relationship determines the authentication information of the login virtual desktop, and requests the virtual desktop login according to the authentication information.
  • the foregoing authentication information is obtained by the SPICE server from the SPICE client through the SPICE main channel, and sent to the virtual desktop agent.
  • the SPICE main channel for transmitting information such as display configuration control data, clipboard data, and disk mapping control data is multiplexed.
  • the authentication information is transmitted by encrypting the message.
  • the login component and the virtual desktop agent are located on the virtual machine server.
  • step S202 the login component creates a memory mapping file for obtaining the authentication information; the virtual desktop proxy writes the authentication information into the memory mapping file; and the login component obtains the written authentication information by using the memory mapping file.
  • step S202 is further implemented by: invoking a login component when the user logs in to the virtual desktop; and when the login component is invoked, creating a separate thread that interacts with the virtual desktop proxy;
  • the memory mapping file is used to obtain the authentication information; the login component obtains the authentication information from the memory mapping file when the virtual desktop login event is triggered.
  • the case that the virtual desktop login event is triggered may include: the authentication result of the authentication information is legal authentication information.
  • step S204 the login component submits the obtained authentication information to the virtual desktop login authentication module for authentication, and automatically logs in to the virtual desktop if the authentication succeeds.
  • the authentication information of the login portal (referred to as first authentication information) and the authentication information of the login virtual desktop (referred to as second authentication information) may use different two authentication information.
  • the login component may determine the second authentication information according to the first authentication information, for example, if the mapping relationship between the first authentication information and the second authentication information is saved in the virtual desktop proxy, the login component And requesting the second authentication information from the virtual desktop proxy according to the first authentication information, and submitting the second authentication information obtained by the request to the virtual desktop login authentication module for authentication, where the authentication succeeds, automatically Log in to the virtual desktop.
  • the login component directly determines the second authentication information according to the first authentication information, and completes the automatic login request.
  • the authentication information includes: a username, a password, and domain information.
  • a virtual desktop login verification apparatus is provided in the embodiment, and the apparatus is used to implement the virtual desktop login verification method.
  • the virtual desktop login verification apparatus described in the system embodiment corresponds to the foregoing virtual desktop login verification method embodiment, and the structure of a specific module or unit in the system may not be well known, but those skilled in the art may The well-known technology and the technical contents disclosed in the embodiment are easily implemented.
  • FIG. 3 is a schematic structural diagram of a virtual desktop login verification apparatus according to an embodiment of the present invention.
  • the apparatus includes: an obtaining module 32 and a requesting module 34, wherein the obtaining module 32 is configured to obtain from a virtual desktop agent.
  • the authentication information wherein the authentication information is authentication information input by the user in the login portal; the requesting module 34 is coupled to the obtaining module 32, and configured to perform virtual desktop login according to the authentication information request.
  • the modules and units involved in the embodiments of the present invention may be implemented by software or by hardware.
  • the described modules and units in this embodiment may also be disposed in a processor.
  • it may be described as a processor including an obtaining module 32 and a requesting module 34.
  • the names of these modules do not constitute a limitation on the module itself in some cases.
  • the obtaining module 32 may also be described as "a module that is set to obtain authentication information from a virtual desktop agent.”
  • FIG. 4 is a schematic diagram of a preferred structure of a virtual desktop login verification apparatus according to an embodiment of the present invention.
  • the obtaining module 32 may include: a creating unit 322, configured to create a memory mapping file for obtaining authentication information, where The memory mapped file is used to receive the authentication information written by the virtual desktop agent; the obtaining unit 324 is coupled to the creating unit 322 and configured to obtain the authentication information through the memory mapping file.
  • the creating unit 322 is further configured to, when invoked, create a separate thread that interacts with the virtual desktop agent, wherein the creating unit is invoked when the user logs in to the virtual desktop; the obtaining unit 324 is further configured to be virtual When the desktop login event is triggered, the authentication information is obtained from the memory mapping file.
  • the requesting module 34 is further configured to submit the obtained authentication information to the virtual desktop login authentication module for authentication.
  • the requesting module 34 is further configured to: when the authentication information input from the login portal is inconsistent with the authentication information of the login virtual desktop, determine, according to the obtained authentication information, authentication information of the login virtual desktop, and The authentication information of the login virtual desktop is submitted to the virtual desktop login authentication module for authentication.
  • the authentication information includes: a username, a password, and domain information.
  • the method for single sign-on virtual desktop provided by the preferred embodiment relates to the field of cloud computing server stand-alone virtualization technology, in particular, the single sign-on function of the virtual desktop.
  • the preferred embodiment proposes a method for single sign-on virtual desktop.
  • the client logs the user login information based on the SPICE protocol (equivalent to the above).
  • the authentication information including the username, password, and domain information, is sent to the virtual desktop proxy component through the SPICE main channel, and the virtual desktop proxy component passes the user information to the automatic login component (the equivalent of the above login component) in the virtual machine. ), the automatic login component submits user information for verification, thereby implementing virtual desktop single sign-on.
  • the preferred embodiment relates to the development and modification of the client, the virtual desktop agent, and the self-login component. After the transformation, the user experience can be quickly improved and the deployment is convenient.
  • the components on the terminal include a SPICE client, a user login portal (including an ActiveX login control), and the like.
  • the ActiveX login control adds a user information processing flow. After the user enters the login information in the login portal, the ActiveX login control obtains the login information (including the username, password, and domain information), encrypts the login information, and transmits the SPICE client.
  • the login information including the username, password, and domain information
  • the SPICE client parses the newly added command line parameters to obtain login information such as user name, password, and domain; adds a login message to the virtual desktop agent, and establishes a main channel between the SPICE client and the SPICE server, and the SPICE client.
  • the terminal transmits the login information to the SPICE server through the main channel, and the SPICE server forwards the user information to the virtual desktop agent.
  • the virtual machine server component includes a virtual desktop agent, an automatic login component, and the like.
  • the virtual desktop agent adds a login message processing flow.
  • the virtual desktop agent accepts the user login message sent by the SPICE client, parses the user name, password, and domain information, and sends the login information to the automatic login component in the virtual machine through the memory file mapping manner.
  • the automatic login component is a new module in the virtual machine, and the memory mapping file is created from the login component, the user login information sent by the virtual desktop agent is obtained, the login information is parsed, and the automatic login is implemented.
  • the user only needs to input the login information such as the user name and password once to complete the client verification and the virtual desktop internal verification, thereby greatly improving the efficiency and enhancing the user experience.
  • Network diagram of the basic framework of the single sign-on virtual desktop The functions of the network elements in the network diagram of the framework are as follows:
  • 210 is a user login portal page, including ActiveX controls, etc., responsible for transforming the acquisition of user information and encrypting the delivery client.
  • SPICE Client running on a terminal device (PC or thin terminal) for accessing each virtual desktop, realizing the resolution of user login information and sending a virtual desktop agent transformation.
  • 230 is the main channel for communication between the SPICE client and the SPICE server, and implements the transformation of the new user login information transmission.
  • SPICE Server is a component running on the virtualization hypervisor, which implements the transformation of the SPICE client user login message to the virtual desktop agent.
  • 250 is a virtual machine server, including various drivers, virtual desktop agents, automatic login components and other modules.
  • the 260 is a virtual desktop agent, which mainly accepts and processes the client messages forwarded by the SPICE server, and forwards the internal messages of the virtual machine to the SPICE client.
  • the module needs to implement the function of accepting and processing the user login information.
  • the module is an automatic login component.
  • the module is a new module, which is set to accept the user login information forwarded by the virtual desktop agent, and implements an automatic login function for the LogonUI process call in the Guest OS.
  • FIG. 6 is a block diagram of the terminal processing flow. The functions of each component are described as follows:
  • 310 is an ActiveX control, which is responsible for modifying the user name, password and other information acquisition, and encrypting the user password and passing it to the SPICE client in the form of command line parameters.
  • the module parses a message sent by a client to a virtual machine, and forwards a message to be processed in the virtual machine to the client.
  • the modification function is as follows:
  • 410 is a parsing module that newly parses the user login information sent by the SPICE client to the virtual desktop proxy, and sets a trigger login event.
  • 420 is a timer triggering module. After the virtual machine processes the winlogon desktop and the login event is triggered, the login timer is set.
  • 430 is a user login message forwarding module. After the login timer is triggered, the user login message is obtained and written into the memory mapped file.
  • 440 is a memory mapped file that passes the message channel for the virtual desktop agent and the automatic login component, created by the automatic login component.
  • FIG. 8 is a block diagram of the automatic login component processing flow.
  • the automatic login component is a new module, belonging to the Credential Provider, which is called by the operating system LogonUI process to implement the internal user verification function of the virtual machine.
  • the related transformation of the module is as follows:
  • the LogonUI process starts and invokes the automatic login component, at which point a separate thread interacting with the virtual desktop agent is created, blocking the waiting for login event to occur.
  • 520 creates a memory mapping file, which is used to obtain user login information delivered by the virtual desktop agent, including user name, password, domain, and the like.
  • 530 is to read the user name, password, domain, and the like from the memory mapping file when the login event is triggered.
  • the method according to the embodiment and the preferred embodiment of the present invention can simplify the user login process, and the user login information is encrypted and transmitted, and the user can input the password once to implement the client user verification, the virtual machine internal verification, and the like, saving The login time is used to enhance the user experience; at the same time, the encrypted information is transmitted to ensure the security of the user information.
  • the login component is used to obtain the authentication information from the virtual desktop agent, where the authentication information is the authentication information input by the user in the login portal; the login component requests the virtual desktop login according to the authentication information, and the solution is solved.
  • the virtual desktop login process multiple cumbersome processes caused by user login information are required to improve the user experience.
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, such that they may be stored in a storage device by a computing device, or they may be fabricated into individual integrated circuit modules, or Multiple modules or steps are made into a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

Abstract

一种虚拟桌面登录验证方法和装置，其中，该方法包括：登录组件从虚拟桌面代理获取鉴权信息，其中，鉴权信息是用户在登录门户输入的鉴权信息；登录组件根据鉴权信息请求进行虚拟桌面登录。通过上述技术方案，解决了虚拟桌面登录过程中需要多次输入用户登录信息所导致的流程繁琐的问题，提高了用户体验。

Description

虚拟桌面登录验证方法和装置 技术领域
本发明涉及通信领域，具体而言，涉及一种虚拟桌面登录验证方法和装置。
背景技术
虚拟桌面是将操作系统运行在服务器或者服务器上的虚拟机中，并将虚拟机的桌面通过网络发送给远程的客户端的一种服务。
虚拟桌面系统组件，从逻辑上可以划分为服务端系统组件和客户端系统组件，客户端系统组件基于独立计算环境简单协议(Simple Protocol for Independent Computing Environment，简称为SPICE)协议请求建立与远程桌面服务端的连接，远程桌面服务端系统组件响应来自虚拟桌面客户端的连接请求，并建立与虚拟桌面客户端的桌面体验服务连接。
SPICE协议中使用虚拟桌面基础架构(Virtual Desktop Infrastructure，简称为VDI)主要用来在客户端和虚拟机的客人操作系统(Guest OS)提供一个数据传递通道，通过这个数据传递通道传递显示器配置控制数据、剪贴板数据以及磁盘映射控制数据等。
虚拟桌面登录流程，用户在终端(PC机或瘦终端)的登录门户(如图1的110模块)输入用户名、密码等信息，用户信息经验证无误后，将服务端IP等信息发送给SPICE客户端(如图1的120模块)，通过客户端连接到桌面服务端，此时用户看到虚拟桌面的登录界面(如图1的140模块)，需要再输入一次用户名、密码信息才能成功登录虚拟桌面，并进行应用程序的相关操作。
针对相关技术中虚拟桌面登录过程中需要多次输入用户登录信息所导致的流程繁琐的问题，目前尚未提出有效的解决方案。
发明内容
本发明实施例提供了一种虚拟桌面登录验证方法和装置，以至少解决上述问题。
根据本发明实施例的一个方面，提供了一种虚拟桌面登录验证方法，包括：登录组件从虚拟桌面代理获取鉴权信息，其中，所述鉴权信息是用户在登录门户输入的鉴权信息；所述登录组件根据所述鉴权信息请求进行虚拟桌面登录。
可选地，其中，所述鉴权信息是由SPICE服务端通过SPICE主通道从SPICE客户端获取，并发送给所述虚拟桌面代理的。
可选地，所述登录组件从所述虚拟桌面代理获取所述鉴权信息包括：所述登录组件创建用于获取所述鉴权信息的内存映射文件，其中，所述内存映射文件用于接收所述虚拟桌面代理写入的所述鉴权信息；所述登录组件通过所述内存映射文件获取所述鉴权信息。
可选地，所述登录组件从所述虚拟桌面代理获取所述鉴权信息还包括：所述登录组件在被调用的情况下，创建与所述虚拟桌面代理交互的单独线程，其中，所述登录组件在用户登录虚拟桌面时被调用；所述登录组件创建用于获取所述鉴权信息的所述内存映射文件；所述登录组件在所述虚拟桌面登录事件被触发的情况下，从所述内存映射文件中获取所述鉴权信息。
可选地，所述登录组件根据所述鉴权信息请求进行虚拟桌面登录包括：所述登录组件将获取的所述鉴权信息提交到虚拟桌面登录鉴权模块进行鉴权。
可选地，在从登录门户输入的所述鉴权信息与登录虚拟桌面的鉴权信息不一致的情况下，所述登录组件根据所述鉴权信息请求进行虚拟桌面登录包括：所述登录组件根据获取的所述鉴权信息，确定登录所述虚拟桌面的鉴权信息；所述登录组件将登录所述虚拟桌面的鉴权信息提交到虚拟桌面登录鉴权模块进行鉴权。
可选地，所述鉴权信息包括：用户名、密码、域信息。
根据本发明实施例的另一个方面，还提供了一种虚拟桌面登录验证装置，包括：获取模块，设置为从虚拟桌面代理获取鉴权信息，其中，所述鉴权信息是用户在登录门户输入的鉴权信息；请求模块，设置为根据所述鉴权信息请求进行虚拟桌面登录。
可选地，所述获取模块包括：创建单元，设置为创建用于获取所述鉴权信息的内存映射文件，其中，所述内存映射文件用于接收所述虚拟桌面代理写入的所述鉴权信息；获取单元，设置为通过所述内存映射文件获取所述鉴权信息。
可选地，所述创建单元，还设置为在被调用的情况下，创建与所述虚拟桌面代理交互的单独线程，其中，所述创建单元在用户登录虚拟桌面时被调用；所述获取单元，还设置为在所述虚拟桌面登录事件被触发的情况下，从所述内存映射文件中获取所述鉴权信息。
可选地，所述请求模块，还设置为将获取的所述鉴权信息提交到虚拟桌面登录鉴权模块进行鉴权。
通过本发明实施例，采用登录组件从虚拟桌面代理获取鉴权信息，其中，鉴权信息是用户在登录门户输入的鉴权信息；登录组件根据鉴权信息请求进行虚拟桌面登录的方式，解决了虚拟桌面登录过程中需要多次输入用户登录信息所导致的流程繁琐的问题，提高了用户体验。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是根据相关技术的虚拟桌面登录的流程示意图；
图2是根据本发明实施例的虚拟桌面登录验证方法的流程示意图；
图3是根据本发明实施例的虚拟桌面登录验证装置的结构示意图；
图4是根据本发明实施例的虚拟桌面登录验证装置的优选结构示意图；
图5是根据本发明优选实施例的单点登录虚拟桌面的方法的基本框架组网示意图；
图6是根据本发明优选实施例的终端的处理流程示意图；
图7是根据本发明优选实施例的虚拟桌面代理的处理流程示意图；
图8是根据本发明优选实施例的自动登录组件的处理流程示意图。
具体实施方式
需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。下面将参考附图并结合实施例来详细说明本发明。
在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行，并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
本实施例提供了一种虚拟桌面登录验证方法，图2是根据本发明实施例的虚拟桌面登录验证方法的流程示意图，如图2所示，包括如下的步骤：
步骤S202，登录组件从虚拟桌面代理获取鉴权信息，其中，鉴权信息是用户在登录门户输入的鉴权信息；
步骤S204，登录组件根据鉴权信息请求进行虚拟桌面登录。
通过上述步骤，由登录组件获取用户在登录门户输入的鉴权信息，并自动使用该鉴权信息请求进行虚拟桌面登录的方式，避免了用户在登录虚拟机客户端时需要在登录门户输入鉴权信息，以及用户还需要在进行虚拟桌面登录的情况下再次输入鉴权信息所导致的重复输入，从而解决了虚拟桌面登录过程中需要多次输入用户登录信息所导致的流程繁琐的问题，提高了用户体验。
可选地，在步骤S204之前，上述方法还可以包括：确定所述鉴权信息为合法的鉴权信息。其中，在鉴权信息不合法的情况下，可以不再执行步骤S204，而是直接结束用户的虚拟桌面登录，并返回鉴权未通过的信息。
可选地，在登录虚拟机客户端的鉴权信息与登录虚拟桌面的鉴权信息不同的情况下，登录组件可以根据保存的登录虚拟机客户端的鉴权信息与登录虚拟桌面的鉴权信息的映射关系，确定登录虚拟桌面的鉴权信息，并根据该鉴权信息请求进行虚拟桌面登录。
可选地，上述的鉴权信息是由SPICE服务端通过SPICE主通道从SPICE客户端获取，并发送给虚拟桌面代理的。通过该方式，复用了用于传递显示器配置控制数据、剪贴板数据以及磁盘映射控制数据等信息的SPICE主通道。
可选地，鉴权信息通过加密消息的方式进行传输。
可选地，登录组件和虚拟桌面代理位于虚拟机服务端。
可选地，步骤S202中，登录组件创建用于获取鉴权信息的内存映射文件；虚拟桌面代理向内存映射文件中写入鉴权信息；登录组件通过内存映射文件获取写入的鉴权信息。
可选地，步骤S202还可以采用如下方式实现：在用户登录虚拟桌面时调用登录组件；登录组件在被调用的情况下，创建与虚拟桌面代理交互的单独线程；登录组件创 建用于获取鉴权信息的内存映射文件；登录组件在虚拟桌面登录事件被触发的情况下，从内存映射文件中获取鉴权信息。
可选地，虚拟桌面登录事件被触发的情况可以包括：鉴权信息的鉴权结果为合法的鉴权信息。
可选地，在步骤S204中，登录组件将获取的鉴权信息提交到虚拟桌面登录鉴权模块进行鉴权，在鉴权通过的情况下，自动登录该虚拟桌面。
可选的，在一些情况下，登录门户的鉴权信息(称为第一鉴权信息)与登录虚拟桌面的鉴权信息(称为第二鉴权信息)可以使用不同的两个鉴权信息，在这种情况下，登录组件可以根据第一鉴权信息确定第二鉴权信息，例如第一鉴权信息和第二鉴权信息的映射关系保存在虚拟桌面代理中的情况下，登录组件根据第一鉴权信息向虚拟桌面代理请求对应的第二鉴权信息，并将请求得到的第二鉴权信息提交到虚拟桌面登录鉴权模块进行鉴权，在鉴权通过的情况下，自动登录该虚拟桌面。又例如第一鉴权信息和第二鉴权信息的映射关系保存在登录组件中的情况下，登录组件直接根据第一鉴权信息确定第二鉴权信息，并完成自动登录请求。
可选地，鉴权信息包括：用户名、密码、域信息。
为了实现上述方法，在本实施例中提供了一种虚拟桌面登录验证装置，该装置用于实现上述虚拟桌面登录验证方法。需要说明的是，系统实施例中描述的虚拟桌面登录验证装置对应于上述的虚拟桌面登录验证方法实施例，其系统中具体的模块或单元的结构可能并不是公知的，但是本领域技术人员可以参照公知的技术以及本实施例中披露的技术内容得以轻松实现。
图3是根据本发明实施例的虚拟桌面登录验证装置的结构示意图，如图3所示，该装置包括：获取模块32和请求模块34，其中，该获取模块32，设置为从虚拟桌面代理获取鉴权信息，其中，鉴权信息是用户在登录门户输入的鉴权信息；请求模块34耦合至获取模块32，设置为根据鉴权信息请求进行虚拟桌面登录。
本发明的实施例中所涉及到的模块、单元可以通过软件的方式实现，也可以通过硬件的方式来实现。本实施例中的所描述的模块、单元也可以设置在处理器中，例如，可以描述为：一种处理器包括获取模块32和请求模块34。其中，这些模块的名称在某种情况下并不构成对该模块本身的限定，例如，获取模块32还可以被描述为“设置为从虚拟桌面代理获取鉴权信息的模块”。
图4是根据本发明实施例的虚拟桌面登录验证装置的优选结构示意图，如图4所示，获取模块32可以包括：创建单元322，设置为创建用于获取鉴权信息的内存映射文件，其中，内存映射文件用于接收虚拟桌面代理写入的鉴权信息；获取单元324耦合至创建单元322，设置为通过内存映射文件获取鉴权信息。
可选地，创建单元322，还设置为在被调用的情况下，创建与虚拟桌面代理交互的单独线程，其中，创建单元在用户登录虚拟桌面时被调用；获取单元324，还设置为在虚拟桌面登录事件被触发的情况下，从内存映射文件中获取鉴权信息。
可选地，请求模块34，还设置为将获取的鉴权信息提交到虚拟桌面登录鉴权模块进行鉴权。
可选地，请求模块34，还设置为在从登录门户输入的鉴权信息与登录虚拟桌面的鉴权信息不一致的情况下，根据获取的鉴权信息确定登录虚拟桌面的鉴权信息，并将登录虚拟桌面的鉴权信息提交到虚拟桌面登录鉴权模块进行鉴权。
可选地，鉴权信息包括：用户名、密码、域信息。
为了使本发明的技术方案和实现方法更加清楚，下面将结合优选的实施例对其实现过程进行详细描述。
本优选实施例提供的一种单点登录虚拟桌面的方法涉及云计算服务器单机虚拟化技术领域，尤其是虚拟桌面的单点登录功能。
针对虚拟桌面登录流程繁琐，需要多次输入用户登录信息的问题，本优选实施例提出了一种单点登录虚拟桌面的方法，该方法中客户端基于SPICE协议将用户登录信息(相当于上述的鉴权信息)，包括用户名、密码、域信息通过SPICE主通道发送到虚拟桌面代理组件，虚拟桌面代理组件将用户信息传递给虚拟机中的自动登录组件(credential provider，相当于上述的登录组件)，自动登录组件将用户信息提交验证，从而实现虚拟桌面单点登录功能。
本优选实施例涉及客户端、虚拟桌面代理、自登录组件开发和改造，改造后可以迅速提升用户体验，部署便捷。
其中，终端上组件包括SPICE客户端、用户登录门户(包括ActiveX登录控件)等。
ActiveX登录控件新增用户信息处理流程。用户在登录门户中输入登录信息后，ActiveX登录控件获取登录信息(包括用户名、密码、域信息)、加密登录信息、传送SPICE客户端。
SPICE客户端对新增的命令行参数进行解析，得到用户名、密码、域等登录信息；与虚拟桌面代理之间新增登录消息，在SPICE客户端与SPICE服务端建立主通道后，SPICE客户端将登录信息通过主通道传递给SPICE服务端，SPICE服务端转发用户信息给虚拟桌面代理。
虚拟机服务端组件包括虚拟桌面代理、自动登录组件等。
虚拟桌面代理新增登录消息处理流程。虚拟桌面代理接受SPICE客户端发送过来的用户登录消息，解析出用户名、密码、域信息，通过内存文件映射方式将登录信息发送给虚拟机中的自动登录组件。
在本优选实施例中，自动登录组件为虚拟机中新增模块，自登录组件创建内存映射文件，获取虚拟桌面代理发送过来的用户登录信息，解析登录信息并实现自动登录。
可见，通过该方法用户只需要输入一次用户名、密码等登录信息，即可完成客户端验证、虚拟桌面内部验证，极大地提高效率，增强用户体验。
下面结合附图进行说明。
本发明优选实施例所述的一种单点登录虚拟桌面的方法的基本框架组网可见图5：单点登录虚拟桌面基本框架组网图，框架组网图中各网元的功能介绍如下：
210是用户登录门户页面，包括ActiveX控件等，负责改造用户信息的获取并加密传送客户端。
220是SPICE的客户端(SPICE Client)，运行在终端设备(PC机或者瘦终端)上，用于接入每个虚拟桌面，实现解析用户登录信息并发送虚拟桌面代理的改造。
230是SPICE客户端与SPICE服务端之间通信的主通道，实现新增用户登录信息传递的改造。
240是SPICE服务端(SPICE Server)，是运行于虚拟化hypervisor之上的组件，实现转发SPICE客户端用户登录消息到虚拟桌面代理的改造。
250是虚机服务端，包括各种驱动、虚拟桌面代理、自动登录组件等模块。
260是虚拟桌面代理，主要接受并处理SPICE服务端转发过来的客户端消息、转发虚拟机内部消息到SPICE客户端等功能，该模块需要实现接受并处理用户登录信息功能的改造。
270是自动登录组件，该模块为新增模块，设置为接受虚拟桌面代理转发过来的用户登录信息，为Guest OS中LogonUI进程调用实现自动登录功能。
图6为终端处理流程框图，各组件功能说明如下：
310是ActiveX控件，该模块负责改造用户名、密码等信息获取，并将用户密码加密，以命令行参数形式传递给SPICE客户端。
320是SPICE客户端，该模块改造流程说明如下：
1)改造解析参数流程，解析出用户登录信息，包括用户名、密码、域等信息。
2)新增用户登录消息类型，将解析出来的用户登录信息封装为此消息类型的spice消息。
3)将SPICE消息通过主通道发送给SPICE服务端，SPICE服务端解密用户信息并转发给虚拟桌面代理。
图7是虚拟桌面代理处理流程框图，该模块解析处理客户端发送到虚拟机中的消息、将虚拟机中的需要处理的消息转发给客户端，改造功能说明如下：
410是解析模块，新增解析SPICE客户端发送到虚拟桌面代理的用户登录信息，设置触发登录事件。
420是定时器触发模块，在虚拟机处理winlogon桌面且登录事件触发后，设置登录定时器。
430是用户登录消息转发模块，登录定时器触发后，获取用户登录消息并写入内存映射文件。
440是内存映射文件，为虚拟桌面代理与自动登录组件传递消息通道，由自动登录组件创建。
图8是自动登录组件处理流程框图。自动登录组件为新增模块，属于Credential Provider,由操作系统LogonUI进程调用，实现虚拟机内部用户验证功能，该模块的相关改造说明如下：
510创建与虚拟桌面代理交互线程。例如，用户按下Ctrl+Alt+Del时，LogonUI进程启动并调用自动登录组件，此时创建与虚拟桌面代理交互的单独线程，阻塞等待登录事件发生。
520创建内存映射文件，用于获取虚拟桌面代理传递的用户登录信息，包括用户名、密码、域等信息。
530是当登录事件被触发后，从内存映射文件中读取用户名、以密码、域等信息。
540将从内存映射文件获取到的用户信息提交验证，从而实现自动登录。
综上所述，根据本发明实施例和优选实施例所提出的方法可以简化用户登录流程，用户登录信息加密传输，用户输入一次密码即可实现客户端用户验证、虚拟机内部验证等流程，节省登录时间，提升用户使用体验；同时通过加密传输，保证用户信息的安全性。
工业实用性
通过本发明实施例，采用登录组件从虚拟桌面代理获取鉴权信息，其中，鉴权信息是用户在登录门户输入的鉴权信息；登录组件根据鉴权信息请求进行虚拟桌面登录的方式，解决了虚拟桌面登录过程中需要多次输入用户登录信息所导致的流程繁琐的问题，提高了用户体验。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (11)

  1. 一种虚拟桌面登录验证方法，包括：
    登录组件从虚拟桌面代理获取鉴权信息，其中，所述鉴权信息是用户在登录门户输入的鉴权信息；
    所述登录组件根据所述鉴权信息请求进行虚拟桌面登录。
  2. 根据权利要求1所述的方法，其中，所述鉴权信息是由SPICE服务端通过SPICE主通道从SPICE客户端获取，并发送给所述虚拟桌面代理的。
  3. 根据权利要求2所述的方法，其中，所述登录组件从所述虚拟桌面代理获取所述鉴权信息包括：
    所述登录组件创建用于获取所述鉴权信息的内存映射文件，其中，所述内存映射文件用于接收所述虚拟桌面代理写入的所述鉴权信息；
    所述登录组件通过所述内存映射文件获取所述鉴权信息。
  4. 根据权利要求3所述的方法，其中，所述登录组件从所述虚拟桌面代理获取所述鉴权信息还包括：
    所述登录组件在被调用的情况下，创建与所述虚拟桌面代理交互的单独线程，其中，所述登录组件在用户登录虚拟桌面时被调用；
    所述登录组件创建用于获取所述鉴权信息的所述内存映射文件；
    所述登录组件在所述虚拟桌面登录事件被触发的情况下，从所述内存映射文件中获取所述鉴权信息。
  5. 根据权利要求1至4中任一项所述的方法，其中，所述登录组件根据所述鉴权信息请求进行虚拟桌面登录包括：
    所述登录组件将获取的所述鉴权信息提交到虚拟桌面登录鉴权模块进行鉴权。
  6. 根据权利要求1至4中任一项所述的方法，其中，在从登录门户输入的所述鉴权信息与登录虚拟桌面的鉴权信息不一致的情况下，所述登录组件根据所述鉴权信息请求进行虚拟桌面登录包括：
    所述登录组件根据获取的所述鉴权信息，确定登录所述虚拟桌面的鉴权信息；
    所述登录组件将登录所述虚拟桌面的鉴权信息提交到虚拟桌面登录鉴权模块进行鉴权。
  7. 根据权利要求1至4中任一项所述的方法，其中，所述鉴权信息包括：用户名、密码、域信息。
  8. 一种虚拟桌面登录验证装置，包括：
    获取模块，设置为从虚拟桌面代理获取鉴权信息，其中，所述鉴权信息是用户在登录门户输入的鉴权信息；
    请求模块，设置为根据所述鉴权信息请求进行虚拟桌面登录。
  9. 根据权利要求8所述的装置，其中，所述获取模块包括：
    创建单元，设置为创建用于获取所述鉴权信息的内存映射文件，其中，所述内存映射文件用于接收所述虚拟桌面代理写入的所述鉴权信息；
    获取单元，设置为通过所述内存映射文件获取所述鉴权信息。
  10. 根据权利要求9所述的装置，其中，
    所述创建单元，还设置为在被调用的情况下，创建与所述虚拟桌面代理交互的单独线程，其中，所述创建单元在用户登录虚拟桌面时被调用；
    所述获取单元，还设置为在所述虚拟桌面登录事件被触发的情况下，从所述内存映射文件中获取所述鉴权信息。
  11. 根据权利要求8至10中任一项所述的装置，其中，
    所述请求模块，还设置为将获取的所述鉴权信息提交到虚拟桌面登录鉴权模块进行鉴权。
PCT/CN2014/089712 2014-06-18 2014-10-28 虚拟桌面登录验证方法和装置 WO2015192582A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410273195.7A CN105282095A (zh) 2014-06-18 2014-06-18 虚拟桌面登录验证方法和装置
CN201410273195.7 2014-06-18

Publications (1)

Publication Number Publication Date
WO2015192582A1 true WO2015192582A1 (zh) 2015-12-23

Family

ID=54934805

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/089712 WO2015192582A1 (zh) 2014-06-18 2014-10-28 虚拟桌面登录验证方法和装置

Country Status (2)

Country Link
CN (1) CN105282095A (zh)
WO (1) WO2015192582A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110601969A (zh) * 2019-09-18 2019-12-20 神州云端(深圳)科技有限公司 一种通用的远程桌面网关实现
CN112162926A (zh) * 2020-09-30 2021-01-01 新华三大数据技术有限公司 一种自动化测试方法及装置
CN114124433A (zh) * 2021-09-26 2022-03-01 多益网络有限公司 基于远程桌面网关的控制方法、装置、设备以及存储介质
CN116074307A (zh) * 2023-01-28 2023-05-05 中科方德软件有限公司 传输方法、装置、电子设备和介质

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105872019B (zh) * 2016-03-23 2019-01-25 北京搜狐新媒体信息技术有限公司 一种Web端登录Docker容器的方法和装置
CN106060035B (zh) * 2016-05-26 2019-09-06 新华三技术有限公司 一种虚拟桌面的解锁方法及装置
CN110768993B (zh) * 2019-10-30 2022-03-11 北京天融信网络安全技术有限公司 一种基于rdp协议的校验方法及装置
CN113535312A (zh) * 2021-07-29 2021-10-22 辽宁向日葵教育科技有限公司 一种远程桌面的交互方法
CN115001808A (zh) * 2022-05-31 2022-09-02 中国银行股份有限公司 一种域用户登录方法、装置、设备和介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102404314A (zh) * 2010-09-30 2012-04-04 微软公司 远程资源单点登录
CN102638475A (zh) * 2011-02-11 2012-08-15 运软网络科技(上海)有限公司 多维智能服务点虚拟桌面方法及基础架构
US20130227668A1 (en) * 2012-02-28 2013-08-29 Citrix Systems, Inc. Secure single sign-on
CN103312744A (zh) * 2012-03-12 2013-09-18 中国移动通信集团黑龙江有限公司 一种基于云桌面的业务办理方法、平台及系统
CN103532966A (zh) * 2013-10-23 2014-01-22 成都卫士通信息产业股份有限公司 一种支持基于usb key单点登录虚拟桌面的装置及方法

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8281377B1 (en) * 2008-04-15 2012-10-02 Desktone, Inc. Remote access manager for virtual computing services
US8869300B2 (en) * 2010-05-10 2014-10-21 Citrix Sytems, Inc. Redirection of information from secure virtual machines to unsecure virtual machines
US8832686B2 (en) * 2010-10-29 2014-09-09 Microsoft Corporation Inherited product activation for virtual machines
CN103475726B (zh) * 2013-09-17 2017-03-15 北京京东尚科信息技术有限公司 一种虚拟桌面管理方法、服务器和客户端

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102404314A (zh) * 2010-09-30 2012-04-04 微软公司 远程资源单点登录
CN102638475A (zh) * 2011-02-11 2012-08-15 运软网络科技(上海)有限公司 多维智能服务点虚拟桌面方法及基础架构
US20130227668A1 (en) * 2012-02-28 2013-08-29 Citrix Systems, Inc. Secure single sign-on
CN103312744A (zh) * 2012-03-12 2013-09-18 中国移动通信集团黑龙江有限公司 一种基于云桌面的业务办理方法、平台及系统
CN103532966A (zh) * 2013-10-23 2014-01-22 成都卫士通信息产业股份有限公司 一种支持基于usb key单点登录虚拟桌面的装置及方法

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110601969A (zh) * 2019-09-18 2019-12-20 神州云端(深圳)科技有限公司 一种通用的远程桌面网关实现
CN112162926A (zh) * 2020-09-30 2021-01-01 新华三大数据技术有限公司 一种自动化测试方法及装置
CN114124433A (zh) * 2021-09-26 2022-03-01 多益网络有限公司 基于远程桌面网关的控制方法、装置、设备以及存储介质
CN114124433B (zh) * 2021-09-26 2023-09-26 多益网络有限公司 基于远程桌面网关的控制方法、装置、设备以及存储介质
CN116074307A (zh) * 2023-01-28 2023-05-05 中科方德软件有限公司 传输方法、装置、电子设备和介质

Also Published As

Publication number Publication date
CN105282095A (zh) 2016-01-27

Similar Documents

Publication Publication Date Title
WO2015192582A1 (zh) 虚拟桌面登录验证方法和装置
AU2019384472B2 (en) Dual factor authentication with active directory and one time password token combination
US10965772B2 (en) Interface invocation method and apparatus for hybrid cloud
CN108234448B (zh) 一种用于浏览器内应用的授权码流
WO2017067227A1 (zh) 一种第三方账号授权方法、设备、服务器及其系统
KR102282656B1 (ko) 컴퓨터 서브네트워크들 내의 프록시 서버들
US9276926B2 (en) Secure and automated credential information transfer mechanism
US9531714B2 (en) Enterprise authentication via third party authentication support
EP2963884B1 (en) Bidirectional authorization system, client and method
WO2019020034A1 (zh) 虚拟机密码重置方法、装置和系统
US10320771B2 (en) Single sign-on framework for browser-based applications and native applications
US20100043065A1 (en) Single sign-on for web applications
US9584615B2 (en) Redirecting access requests to an authorized server system for a cloud service
US10262146B2 (en) Application-to-application messaging over an insecure application programming interface
CN108243188B (zh) 一种接口访问、接口调用和接口验证处理方法及装置
CN115021991A (zh) 未经管理的移动设备的单点登录
CN110999260A (zh) 在基于代理的网络通信中的控制数据的传输
CN108712372B (zh) 一种客户端接入web第三方登录的方法及系统
US20150052256A1 (en) Transmission of network management data over an extensible scripting file format
US20150244704A1 (en) Techniques to authenticate user requests involving multiple applications
WO2019184206A1 (zh) 身份认证方法及装置
CN111193776B (zh) 云桌面环境下客户端自动登录方法、装置、设备和介质
KR102357697B1 (ko) 컴퓨터 서브네트워크들 내의 프록시 서버들
US11630682B2 (en) Remoting user credential information to a remote browser
JP2015191508A (ja) シングルサインオンシステム、シングルサインオン方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14895104

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14895104

Country of ref document: EP

Kind code of ref document: A1