WO2018010146A1 - 一种虚拟网络计算认证中应答的方法、装置、系统和代理服务器 - Google Patents

一种虚拟网络计算认证中应答的方法、装置、系统和代理服务器 Download PDF

Info

Publication number
WO2018010146A1
WO2018010146A1 PCT/CN2016/090058 CN2016090058W WO2018010146A1 WO 2018010146 A1 WO2018010146 A1 WO 2018010146A1 CN 2016090058 W CN2016090058 W CN 2016090058W WO 2018010146 A1 WO2018010146 A1 WO 2018010146A1
Authority
WO
WIPO (PCT)
Prior art keywords
server
proxy server
client
response value
authentication
Prior art date
Application number
PCT/CN2016/090058
Other languages
English (en)
French (fr)
Inventor
王显雷
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP16890125.4A priority Critical patent/EP3300331B1/en
Priority to PCT/CN2016/090058 priority patent/WO2018010146A1/zh
Priority to CN201680004718.5A priority patent/CN107113319B/zh
Priority to US15/845,631 priority patent/US11140162B2/en
Publication of WO2018010146A1 publication Critical patent/WO2018010146A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0281—Proxies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/105—Multiple levels of security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/08—Protocols specially adapted for terminal emulation, e.g. Telnet
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/14—Digital output to display device ; Cooperation and interconnection of the display device with other functional units
    • G06F3/1454—Digital output to display device ; Cooperation and interconnection of the display device with other functional units involving copying of the display data of a local workstation or window to a remote workstation or window so that an actual copy of the data is displayed simultaneously on two or more displays, e.g. teledisplay
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Definitions

  • the present invention relates to the field of computer technologies, and in particular, to a method, an apparatus, a system, and a proxy server for virtual network computing authentication.
  • VNC Virtual Network Computing
  • RFB Remote Frame Buffer
  • the VNC is composed of a client, a proxy server and a server.
  • the client is generally a browser or a VNC connection tool.
  • the server is the destination of the VNC connection request, and the proxy server implements centralized management and control of the VNC service.
  • the packet between the client and the server is relayed by the proxy server.
  • both the client and the server need to negotiate to determine the version of the RFB protocol and the type of security authentication used by the VNC connection request.
  • the security authentication type includes invalid (Invalid) and no authentication (None).
  • VNC certification During the VNC authentication process, the client needs to encrypt and determine the response value according to the user's password and the challenge information generated by the server based on the VNC authentication.
  • the response value is sent to the server through the proxy server, and the server will respond to the user's password and challenge information.
  • Another response value is determined according to the same encryption algorithm as the client. If the response value determined by the server is the same as the response value sent by the client, the VNC authentication succeeds. However, as the VNC application scenario becomes more and more extensive, users can access the server through any client, and the device where the client resides usually belongs to the network environment of the untrusted domain. At this time, the client sends the challenge to the server.
  • the response process of the information needs to transfer the user's sensitive data password from the trust domain to the network environment of the untrusted domain, and store it in the client of the untrusted domain, causing the sensitive data to be leaked or violently cracked. Security during the VNC certification process.
  • the invention provides a method, a device, a system and a proxy server for answering in a virtual network computing authentication, and the proxy server replaces the client to complete the response process in the virtual network computing authentication, and solves the problem that the virtual network is completed by the client in the prior art.
  • the problem of calculating authentication and causing user sensitive data to be leaked or violently cracked improves the security of the virtual network computing authentication process.
  • a method for responding in Virtual Network Computing (VNC) authentication comprising:
  • the proxy server receives the password sent by the controller
  • the proxy server receives the challenge information sent by the server, where the challenge information is generated by the server based on the virtual network calculation authentication;
  • the proxy server sends the first response value to the server.
  • the challenge information is a 16-byte random number
  • the proxy server determines a response value according to the password and the challenge information according to the predefined data encryption algorithm, and sends the response value to the server to complete the virtual network calculation authentication. The response process.
  • the proxy server may determine the first response value according to the password and the challenge information, and send the first response value to the server.
  • the response process in the virtual network computing authentication is completed.
  • the proxy server replaces the client to complete the response process in the virtual network computing authentication, thereby avoiding sensitive data transmission to the network environment of the untrusted domain and causing sensitive data.
  • the issue of disclosure or brute force has improved the security of the virtual network computing authentication process.
  • the method before the proxy server sends the first response value to the server, the method further includes:
  • the proxy server replaces the second response value in the response message with the first response value
  • the proxy server sends the response message to the server.
  • the second response value is the challenge information.
  • the client does not process the challenge information, and directly sends the challenge information as a response value to the proxy server in the form of a response message.
  • the proxy server may also send the challenge information to the client, and the client does not process the challenge information directly as a response value, and sends the challenge message to the proxy server in the form of a response message.
  • the response value in the response message is replaced by the proxy server, and sent to the server to complete the response process in the virtual network calculation authentication, compared with the prior art,
  • the user sensitive data password needs to be transmitted to the untrusted domain, and the response process in the virtual network computing authentication can be completed in the trusted domain network environment, thereby avoiding the transmission of the password to the untrusted domain in the prior art, resulting in leakage of sensitive data or violence.
  • the problem of cracking thereby improving the security in the virtual network authentication process.
  • the client still receives the challenge information and returns the response value, which reduces the impact on the RFB protocol processing in the prior art and improves the VNC. Information security during the certification process.
  • RFB Remote Frame Buffer
  • the method further includes:
  • the server receives the password sent by the controller
  • the server determines a third response value according to the password and the challenge information
  • the VNC authentication is successful.
  • the server determines a third response value according to the same predefined data encryption algorithm as the proxy server according to the password and the challenge information, and compares the first response value and the third response value when receiving the first response value, if two The same, the VNC certification is successful.
  • controller generates a password for each server in the initialization phase as the VNC login password and sends the password to the server to determine whether the response value sent by the proxy server is successful.
  • the method before the proxy server receives the password sent by the controller, the method further includes:
  • the proxy server receives a connection request from a client
  • the proxy server acquires a token in the connection request of the client
  • the proxy server sends the token to the controller to cause the controller to authenticate the token
  • the proxy server receives the password sent by the controller, specifically:
  • the proxy server receives an authentication success message from the controller, where the authentication success message carries the IP address, the port number, and the password of the server.
  • the method further includes:
  • the proxy server establishes a connection with the server according to the IP address of the server and the port number;
  • the proxy server receives the second protocol version information sent by the client, where the second version information is not higher than the first protocol version information and is the highest protocol version supported by the client;
  • the proxy server sends the second protocol version information to the server, so that the server determines, according to the second protocol version information, a protocol version used for communication with the client and the server.
  • the method further includes:
  • proxy server sends the second security authentication type to the server, so that the server determines the security authentication type of the client and the server according to the second security authentication type.
  • the first security authentication type is only used to identify the type of security authentication that the server sends to the proxy server, and does not represent the number.
  • the server and the client complete the security authentication according to the VNC authentication type; if the server determines that the negotiated security authentication type does not require authentication, the client and the server No authentication is required; if the server determines that the negotiated security authentication type is illegal, the VNC session between the client and the server ends.
  • the security authentication type is usually specified by the server, that is, the first security authentication type sent by the server is the specified security authentication type, and if the client returns the second type. If the security authentication type is different from the first security authentication type, the process of negotiating the security authentication type fails, and the VNC connection request is terminated.
  • the server and the client negotiate to determine the association of the VNC connection request.
  • the version and security authentication type when receiving the challenge information generated by the VNC authentication, use the challenge information and password to complete the response process in VNC authentication.
  • the proxy server can replace the client to complete the server and the server.
  • the response process in VNC authentication avoids the problem of information leakage or brute force caused by the transmission of sensitive data from users to non-trusted domains, and improves the security in the VNC authentication process.
  • the proxy server replaces the client to complete the response process in the VNC authentication, compared with the prior art, does not need to transmit the user's sensitive data password to the network environment of the untrusted domain
  • the response process in the VNC authentication can be completed, thereby avoiding the problem that the sensitive data in the prior art is stored in the untrusted domain network environment and the sensitive data is leaked or violently cracked, thereby improving Security during the VNC certification process.
  • the client still receives the challenge information and returns the response value, which reduces the impact on the RFB protocol processing in the prior art and improves the information security in the VNC authentication process.
  • a system for responding in a virtual network computing authentication comprising a controller, a client, a proxy server, and a server:
  • the client is configured to send a connection request to the proxy server
  • the proxy server is configured to acquire a token in the connection request, and send the token to the controller for authentication;
  • the controller is configured to authenticate the client according to the token, and if the authentication succeeds, send an authentication success message to the proxy server, where the authentication success message carries the server IP, port number, password;
  • the proxy server is further configured to receive the authentication success message sent by the controller, and establish a connection with the server according to the IP and the port number;
  • the server is configured to generate challenge information based on the virtual network authentication, and send the challenge information to a proxy server;
  • the proxy server is further configured to receive the challenge information, determine a first response value according to the password and the challenge information, and send the first response value to the server.
  • the proxy server may determine the first response value according to the password and the challenge information, and send the first response value to the server to complete the VNC.
  • the response process in certification, compared with the prior art, by generation
  • the server replaces the client to complete the response process in VNC authentication, avoiding the problem that sensitive data is transmitted to the network environment of the untrusted domain and causing sensitive data to be leaked or violently cracked, thereby improving the security in the VNC authentication process.
  • the proxy server is further configured to send the first response value to the client before sending the first response value to the server Sending the challenge information; receiving a response message sent by the client, where the response message includes a second response value, the second response value is the challenge information; and the second of the response message is The response value is replaced with the first response value;
  • the server is further configured to receive the password sent by the controller And determining, according to the password and the challenge information, a third response value; if it is determined that the first response value and the third response value are the same, the virtual network calculates that the authentication is successful.
  • controller generates a password for each server as the VNC login password in the initial stage, and sends the password to the server to determine whether the response value sent by the proxy server is successful.
  • the controller is further configured to receive a virtual network computing connection request from the client, and calculate a connection according to the virtual network of the client Requesting to obtain virtual network computing connection information, where the virtual network computing connection information includes a uniform resource locator of the proxy server, an IP of the server, the port number, a token, and the password; and sending the password to the client
  • the virtual network calculates a uniform resource locator and the token of the proxy server in the connection information
  • the client is further configured to establish a connection with the proxy server according to the uniform resource locator of the proxy server and the token.
  • the port number is a port number of the virtual network computing service in the server.
  • the proxy server replaces the client to complete the response in the VNC authentication, and does not need to transmit the user sensitive data password to the network environment of the untrusted domain as compared with the prior art, thereby avoiding the existing In the technology, the password is transmitted to the network environment of the untrusted domain, which causes the leakage of sensitive data or violent cracking, thereby improving the security in the VNC authentication process.
  • the client still receives the challenge information and returns the response value. The process reduces the impact on the RFB protocol processing in the prior art and improves the information security in the VNC authentication process.
  • a proxy server in a third aspect, includes a receiving unit, an encryption unit, and a sending unit;
  • the receiving unit is configured to receive a password sent by the controller, and receive challenge information sent by the server, where the challenge information is generated by the server based on the virtual network calculation authentication;
  • the encryption unit is configured to determine a first response value according to the password and the challenge information received by the receiving unit;
  • the sending unit is configured to send the first response value determined by the encryption unit to the server.
  • the proxy server in the embodiment of the present invention may be implemented by an Application Specific Integrated Circuit (ASIC) or a Programmable Logic Device (PLD), and the PLD may be a complex program logic device ( Complex Programmable Logic Device (CPLD), Field-Programmable Gate Array (FPGA), Generic Array Logic (GAL), or any combination thereof.
  • the proxy server and its various modules may also be software modules when the method of implementing the VNC authentication response shown in the first aspect or other possible implementations of the first aspect is implemented by software.
  • the challenge information is a 16-bit random number
  • the proxy server encrypts the challenge information according to the password and the challenge information according to the predefined data encryption algorithm to determine the first response value, and sends the challenge value to the server, thereby completing the virtual
  • the network processes the response process in authentication.
  • the predefined data encryption algorithm may be a Secure Hash Algorithm (SHA) or other data encryption algorithm such as Data Encryption Standard (DES), which is not limited in the present invention.
  • SHA Secure Hash Algorithm
  • DES Data Encryption Standard
  • the proxy server can replace the client to complete the response process in the VNC authentication, and avoids the need to transfer the user sensitive data to the network environment of the untrusted domain when the client completes the response process compared with the prior art.
  • the problem of sensitive data being vented or brute-forced increases the security of the VNC certification process.
  • the proxy server further includes a replacement unit
  • the sending unit is further configured to send the challenge information to the client before sending the first response value determined by the encryption unit to the server;
  • the receiving unit is further configured to receive a response message sent by the client, where the response message includes a second response value, and the second response value is the challenge information;
  • the replacing unit is configured to replace the second response value in the response message with the first response value
  • the second response value is the challenge information.
  • the client does not process the challenge information, and directly sends the challenge information as a response value to the proxy server in the form of a response message.
  • the proxy server replaces the second response value in the response message with the first response value, and sends the response value to the server.
  • the server determines the third response value according to the same predefined encryption data algorithm as the proxy server according to the password and the challenge information.
  • the first response value and the third response value are compared. If the two are the same, the VNC authentication succeeds; if the two are different, the VNC authentication fails, and the VNC connection request is terminated.
  • controller generates a password for each server in the initialization phase as the VNC login password and sends the password to the server to determine whether the response value sent by the proxy server is successful.
  • the proxy server further includes a processing unit
  • the receiving unit is further configured to receive a connection request from the client before receiving the password sent by the controller;
  • the processing unit is configured to acquire a token in a connection request of the client;
  • the sending unit is further configured to send the token to the controller
  • the receiving unit receives the password sent by the controller, specifically:
  • the authentication success message carries an IP, a port number, and the password of the server.
  • the authentication success message is sent to the proxy server, where the authentication success message carries the IP address, port number, and password of the server, where the port number is the VNC service. Port number; if the controller fails to authenticate the token, the VNC is terminated. Connection request.
  • the IP address of the server is the IP address of the server where the virtual machine is located
  • the port number is the port uniquely assigned to the server where the virtual machine is located. number.
  • the processing unit is further configured to establish a connection with the server according to the IP address of the server and the port number in the authentication success message received by the receiving unit;
  • the receiving unit is further configured to receive first protocol version information sent by the server, where the first protocol version information is a highest protocol version supported by the server;
  • the sending unit is further configured to send, to the client, the first protocol version information received by the receiving unit;
  • the receiving unit is further configured to receive second protocol version information that is sent by the client, where the second version information is not higher than the first protocol version information and is the highest protocol supported by the client. version;
  • the sending unit is further configured to send the second protocol version information to the server.
  • the receiving unit is further configured to: receive a first security authentication type sent by the server, the first security The authentication type includes all types of security authentication supported by the server;
  • the sending unit is further configured to: send the first security authentication type to the client;
  • the receiving unit is further configured to: receive, by the client, a second security authentication type that is received by the receiving unit, where the second security authentication type is supported by the client in the first security authentication type.
  • the sending unit is further configured to: send the second security authentication type to the server.
  • the first security authentication type is only used to identify the type of security authentication that the server sends to the proxy server, and does not represent the number.
  • the server and the client complete the security authentication according to the VNC authentication type; if the server determines that the negotiated security authentication type does not require authentication, the client and the server No authentication is required; if the server determines that the negotiated security authentication type is illegal, the VNC session between the client and the server ends.
  • the server in order to ensure system security, the server usually specifies the security.
  • the full authentication type that is, the first security authentication type sent by the server is the specified security authentication type. If the second security authentication type returned by the client is different from the first security authentication type, the process of negotiating the security authentication type fails. This VNC connection request.
  • the server and the client negotiate to determine the protocol version and the security authentication type of the VNC connection request, and use the challenge information and the password to complete the VNC authentication when the receiving server performs the challenge information generated by the VNC authentication.
  • the proxy server is no longer only used to transfer the data packets between the server and the client, and can replace the response process in the client and the VNC authentication of the server, thereby avoiding user sensitivity.
  • the problem of information leakage or brute force caused by data transmission to non-trusted domains improves the security of the VNC authentication process.
  • the proxy server replaces the client to complete the response process in the VNC authentication, and the user sensitive data password is not required to be transmitted to the network environment of the untrusted domain, that is, compared with the prior art, that is, The response process in the VNC authentication can be completed, and the problem that the password is transmitted to the untrusted domain in the prior art and the sensitive data is leaked or violently cracked is avoided, thereby improving the security in the VNC authentication process.
  • the client still receives the challenge information and returns the response value, which reduces the impact on the RFB protocol processing in the prior art and improves the information security in the VNC authentication process.
  • a proxy server includes a processor, a memory, a communication interface, and a bus, and the processor, the memory, and the communication interface are connected by a bus and complete communication with each other.
  • the processor executing the computer execution instructions in the memory to perform the first aspect, the first aspect of the first aspect, using hardware resources in the proxy server.
  • the proxy server can complete the response process of the challenge information sent by the server instead of the client, and avoid transmitting and storing the user sensitive data in the untrusted domain compared with the prior art.
  • the resulting data leakage or brute force attacks have improved the security of the virtual network computing certification process.
  • a computer readable medium for storing a computer program, the computer program comprising: a first aspect, a first possible implementation of the first aspect, a first aspect Three possible implementations to the instructions of the method of the possible implementations of any of the fifth possible implementations of the first aspect.
  • a method, a device, a system, and a proxy server for responding in a virtual network computing authentication replace a client with a proxy server to complete a response process in VNC authentication, which is avoided compared with the prior art.
  • the issue of sensitive data leakage or brute force caused by the transmission and storage of user sensitive data in untrusted domains improves the security of the VNC certification process.
  • FIG. 1 is a schematic diagram of a network architecture of a virtual network computing system according to an embodiment of the present disclosure
  • FIG. 2 is a schematic flowchart of a method for responding in a virtual network calculation authentication according to an embodiment of the present invention
  • FIG. 3 is a schematic flowchart of another method for responding in virtual network computing authentication according to an embodiment of the present disclosure
  • FIG. 4 is a schematic flowchart of another method for responding in virtual network computing authentication according to an embodiment of the present disclosure
  • FIG. 5 is a schematic flowchart of another method for responding in virtual network computing authentication according to an embodiment of the present disclosure
  • FIG. 6 is a schematic diagram of a response system in virtual network computing authentication according to an embodiment of the present invention.
  • FIG. 7 is a schematic diagram of a proxy server according to an embodiment of the present invention.
  • FIG. 8 is a schematic diagram of another proxy server according to an embodiment of the present invention.
  • the network architecture includes a client, a proxy server, a server, and a controller, and the client may
  • the client may
  • the client can be deployed in a server, a computer (Personal Computer, PC), or can be deployed in a mobile device, wherein the mobile device can be a portable computer, or can be a mobile phone, an iPad, etc.
  • the invention is not limited.
  • the server is the destination of VNC remote access, which can be a server or a virtual machine on the server.
  • the data packet transmitted between the client and the server needs to be transited through the proxy server, that is, the server first sends the data packet to the proxy server, and the proxy server sends the data packet to the client.
  • the controller is used to manage the proxy server and the server, and is responsible for determining the Uniform Resource Locator (URL) of the proxy server, the IP address of the server, the port number, the token, and the password according to the VNC connection request from the client. And other VNC connection information, wherein the port number is the port number of the VNC service in the server; the token is used in the VNC connection process to authenticate the client, determine the validity of the client; the password is the VNC login password, The controller is managed uniformly.
  • URL Uniform Resource Locator
  • the server is a virtual machine, it is generated when the virtual machine is created.
  • the controller sends the password to the server where the virtual machine is located.
  • the server is updated.
  • the controller first establishes a connection with the server, the controller generates a password that is sent to the server and is updated when the server is restarted or the password has been used.
  • the proxy server can be deployed in a single server according to the requirements of the business scenario, or can be deployed in the controller or server, that is, the proxy server is a software module in the controller or server.
  • the invention is not limited.
  • a security system between an internal network and an external network is constructed through network devices such as switches and firewalls, and data transmitted or restricted is allowed to pass according to specific rules.
  • the network inside the security system is divided into trust domains, and the network outside the security system is divided into non-trust domains.
  • the security of data transmission in the trust domain is high, and sensitive data of users is not stolen; There is no rule that limits the transmission of data. The security of sensitive data is not guaranteed.
  • a VNC service based on a Secure Sockets Layer (SSL) network socket (WebSoket) protocol, such as noVNC may be provided.
  • the controller can be a Nova component
  • the server is a computing node in the OpenStack system
  • the client is a user browser
  • the Nova-noVNCProxy is used as a proxy server.
  • the user can establish a VNC connection with a virtual machine or a computing node in the computing node through a browser.
  • the Nova-Api in the Nova component is responsible for calling the Nova-Compute to collect the VNC connection information of the VNC connection request
  • the VNC connection information includes a Uniform Resource Locator (URL) of the proxy server, an IP of the server, Port number, token, password
  • Nova-Consoleauth is responsible for storing the VNC connection information and authenticating the client based on the token.
  • URL Uniform Resource Locator
  • the network environment where the client is located belongs to the untrusted domain
  • the network environment between Nova-Api, Nova-Consoleauth, Nova-compute, noVNCProxy, and compute nodes belongs to the trust domain.
  • the controller when a VNC connection request is established between the client and the server, the controller sends the URL, token, and password of the proxy server in the VNC connection information to the client.
  • the client stores the password locally to complete the VNC authentication response in the Remote Frame Buffer (RFB) protocol with the server, but the password belongs to the user's sensitive data when the client's network belongs to the untrusted domain.
  • RFID Remote Frame Buffer
  • the method for responding in the VNC authentication is that the proxy server replaces the client to complete the response in the VNC authentication, and no longer sends the password to the client, thereby avoiding the user sensitive data between the untrusted domain and the trusted domain.
  • the transmission, and the client's leakage of sensitive data in untrusted domains, or the violent cracking of sensitive data, improves the security of the VNC authentication process.
  • the communication connection between the client and the server needs to be transited by the proxy server.
  • the client Before VNC authentication, the client needs to obtain VNC connection information from the controller and establish a connection with the corresponding proxy server.
  • the proxy server needs to determine the server information to be connected by the client through the controller, and establish a connection with the server.
  • the specific process is as shown in FIG. 2, and the method includes:
  • the controller receives the VNC connection request sent by the client.
  • the user sends a VNC connection request to the controller through a browser or a VNC connection tool.
  • the connection request includes the target server information.
  • the controller acquires VNC connection information according to the VNC connection request.
  • the VNC connection information includes a Uniform Resource Locator URL of the proxy server, an IP address of the server, a port number, a token, and a password, where the port number is a port number of the VNC service in the server.
  • the IP address of the server is the IP address of the server where the virtual machine is located
  • the port number is the port uniquely assigned to the server where the virtual machine is located. number.
  • the Nova-Api when the Nova-Api receives the VNC connection request of step S201, it calls the Nova-Compute to obtain the VNC connection information of the VNC connection request, and then calls Nova-Consoleauth to store the VNC information in the memory.
  • the client receives the uniform resource locator URL and the token of the proxy server in the VNC connection information sent by the controller.
  • the controller sends the following form of information to the client:
  • the IP is the port number of the proxy server's IP and the port in the VNC connection information is the Hypertext Transfer Protocol over Secure Socket Layer (HTTPS) service.
  • HTTPS Hypertext Transfer Protocol over Secure Socket Layer
  • the client establishes a connection with the proxy server by using a uniform resource locator URL and a token of the proxy server.
  • the client may be a browser, and establish a connection with the proxy server by using the URL and token information in the form received in step S203;
  • the proxy server acquires the token.
  • the token is a token in the connection request of the client in step S204, so that the controller authenticates the client according to the token, and confirms whether the client can connect to the server through the proxy server.
  • the token_id in the connection request is as follows:
  • the proxy server sends a token to the controller.
  • the client sends the token acquired in step S205 to the controller.
  • the controller authenticates the client according to the token.
  • the proxy server receives an authentication success message sent by the controller, where the authentication success message carries the IP address, port number, and password of the server.
  • the controller sends an authentication success message to the proxy server, where the authentication success message carries the IP address, port number and password of the server, where the port number is the port number of the VNC service; When it fails, this VNC connection request is terminated.
  • the proxy server establishes a connection with the server by using the IP address and the port number of the server.
  • the IP address and port number of the server are the IP address and port number of the server carried in the authentication success message in step S208.
  • step S201 to step S209 if the controller successfully authenticates the client according to the token, the password is sent to the proxy server, and further, the proxy server replaces the client to complete the response process in the VNC authentication, and the existing Compared with the process of transmitting the user sensitive data password to the client, the technology avoids the process of transmitting sensitive data between the trusted domain and the non-trusted domain; on the other hand, it solves the problem that the untrusted domain stores sensitive data in the prior art and causes sensitive data. Leakage or brute force issues improve the security of the VNC certification process.
  • the client, the proxy server, and the server have established a communication connection. Further, the server and the client negotiate the protocol version and the security authentication type used in the VNC connection request according to the RFB protocol. As shown in 3, the method includes:
  • the server sends the first protocol version information to the proxy server.
  • the first protocol version information is a protocol version of the highest version of the RFB supported by the server.
  • the server For example, if the server supports three protocol versions of 3.3, 3.7, and 3.8, where 3.8 is the highest version, the first protocol version information sent by the server to the proxy server is 3.8.
  • the server sends a packet containing the following format to the proxy server:
  • Protocol Version message Packet of content for RFB 003.008 ⁇ n (hex 52 46 42 20 30 30 33 2e 30 30 38 0a).
  • the proxy server may monitor the data packet sent by the server, and determine, according to the keyword, that the client and the server in the VNC connection request start to negotiate the protocol version and the security authentication type of the RFB.
  • the proxy server can process multiple sets of VNC sessions of the server and the client at the same time, and the proxy server needs to determine the start of each set of sessions to identify the challenge information sent by the server according to the keyword.
  • the proxy server monitors the data packet sent by the server to include a keyword in the format of RFB***.*** ⁇ n, it is determined that the current VNC session begins.
  • the proxy server sends the first protocol version information to the client.
  • the client sends the second protocol version information to the proxy server.
  • the second protocol version information is a protocol version that is not higher than the first protocol version information and is the highest RFB supported by the client.
  • the client supports the RFB protocol of versions 3.8 and 3.7, and the first protocol version information sent by the receiving proxy server is 3.8, the client supports no higher than the first protocol version information and the highest supported by the client.
  • the protocol version is 3.8, that is, the second protocol version information sent by the client to the proxy server is 3.8.
  • the proxy server sends the second protocol version information to the server.
  • the server determines, according to the second protocol version information, a protocol version used for communication with the client.
  • the server determines the protocol version of the current VNC connection request according to the second protocol version information of the client sent by the proxy.
  • the protocol version of the VNC connection request is 3.8.
  • the server and the client continue to negotiate the security authentication type of the VNC connection request.
  • the specific security authentication type determining process is as follows. :
  • the server sends the first security authentication type to the proxy server.
  • the security authentication type and the authentication process supported by different protocol versions are different, and the first security authentication type includes all security authentication types supported by the server in the determined protocol version information.
  • the first security authentication type is only used to identify the type of security authentication that the server sends to the proxy server, and does not represent the number.
  • the first security authentication type includes the above three types of security authentication. .
  • the proxy server sends the first security authentication type to the client.
  • the client sends a second security authentication type to the proxy server.
  • the second security authentication type is the most supported by the client in the first security authentication type.
  • a high level of security certification type is the most supported by the client in the first security authentication type.
  • the second security authentication type is the VNC authentication mode with the highest security level, that is, the challenge/answer authentication mode.
  • the proxy server sends a second security authentication type to the server.
  • the server determines a security authentication type of the server and the client according to the second security authentication type.
  • the server and the client complete the security authentication according to the VNC authentication type; if the server determines that the negotiated security authentication type does not require authentication, the client and the server No authentication is required; if the server determines that the negotiated security authentication type is illegal, the VNC session between the client and the server ends.
  • the security authentication type is usually specified by the server, that is, the first security authentication type sent by the server in step S306 is the specified security authentication type, if the client If the returned second security authentication type is different from the first security authentication type, the process of negotiating the security authentication type fails, and the current VNC connection request is terminated.
  • the server and the client negotiate to determine the protocol version and the security authentication type of the current VNC connection request. Further, the proxy server uses the challenge information when receiving the challenge information generated by the server according to the VNC authentication. And the password completes the response process in VNC authentication. Compared with the prior art, the proxy server is no longer only used to transfer the data packets between the server and the client, and can also replace the client to complete the VNC authentication with the server. The response process avoids the problem that sensitive data is transmitted to the untrusted domain and causes sensitive data to be leaked or violently cracked, which improves the security in the VNC authentication process.
  • the proxy server may replace the client to complete the VNC authentication, and the specific method. As shown in FIG. 4, the method includes:
  • the controller sends a password to the proxy server.
  • the password is carried in the authentication success message sent by the controller to the proxy server in step S208, and details are not described herein.
  • the proxy server receives challenge information sent by the controller, where the challenge information is virtual-based.
  • Network computing authentication generation
  • the server generates challenge information according to the VNC authentication type and sends the challenge information to the proxy server, where the challenge information is a 16-bit random number.
  • the proxy server determines the first response value according to the password and the challenge information.
  • the proxy server encrypts the challenge information according to the password and challenge information according to the predefined data encryption algorithm to determine the first response value.
  • the predefined data encryption algorithm may be a Secure Hash Algorithm (SHA) or other data encryption algorithm such as Data Encryption Standard (DES), which is not limited in the present invention.
  • SHA Secure Hash Algorithm
  • DES Data Encryption Standard
  • the proxy server encrypts the password and challenge information in accordance with the SHA256 data encryption algorithm to determine the first response value.
  • the proxy server sends the first response value to the server.
  • the server determines a third response value according to the same predefined data encryption algorithm as the proxy server according to the password and challenge information sent by the controller, and compares the first response value with the third response when receiving the first response value. If the two are the same, the VNC authentication succeeds. If the two are different, the VNC authentication fails, and the VNC connection request is terminated.
  • the controller generates a password for each server in the initial stage. As the VNC login password, the controller sends the password to the server to determine whether the response value sent by the proxy server is successful.
  • the proxy server may determine the first response value according to the password and the challenge information, and send the first response value to the server.
  • the response process in the VNC authentication is completed.
  • the proxy server replaces the client to complete the response process in the VNC authentication, thereby preventing the sensitive data from being transmitted to the network environment of the untrusted domain and causing the sensitive data to be leaked or suffered.
  • the issue of brute force has improved the security of the VNC certification process.
  • the response process in the VNC authentication may also be implemented by the method shown in FIG. 5, the method includes:
  • the server sends challenge information to the proxy server.
  • the server sends the challenge information to the proxy server according to the security authentication type determined in negotiation in FIG. 3.
  • the proxy server sends challenge information to the client.
  • the proxy server resends the challenge information received in step S501 to the client.
  • the proxy server determines the first response value according to the password and the challenge information.
  • step S503 is the same as that of step S403, and details are not described herein again.
  • the client sends a response message to the proxy server, where the response message includes a second response value.
  • the second response value is the challenge information.
  • the client does not process the challenge information, and directly sends the challenge information as a response value to the proxy server in the form of a response message.
  • the proxy server replaces the second response value in the response message with the first response value.
  • the proxy server sends a response message to the server.
  • the server determines the third response value according to the same predefined data encryption algorithm as the proxy server according to the password and challenge information sent by the controller, and compares the first response value with the third response value when receiving the first response value.
  • the response value if the two are the same, the VNC authentication succeeds; if the two are different, the VNC authentication fails, and the VNC connection request is terminated.
  • the controller generates a password for each server in the initial stage. As the VNC login password, the controller sends the password to the server to determine whether the response value sent by the proxy server is successful.
  • the proxy server may also send the challenge information to the client, and the client does not process the challenge information directly as the response value, and sends the challenge message to the response message.
  • the proxy server replaces the response value in the response message by the proxy server, and sends the response to the response process in the virtual network calculation authentication.
  • the user sensitive data password is not required to be transmitted to the untrusted domain.
  • the response process in the virtual network computing authentication can be completed, and the problem that the password is transmitted to the untrusted domain in the prior art and the sensitive data is leaked or violently cracked is avoided, thereby improving the virtual network authentication process. Security in the middle.
  • the client still receives the challenge information and returns the response value, which reduces the impact on the RFB protocol processing in the prior art and improves the information security in the VNC authentication process.
  • FIG. 6 is a schematic diagram of a system 600 for responding in virtual network computing authentication according to an embodiment of the present invention.
  • the virtual network calculates a system 600 for responding in authentication.
  • the client 602 is configured to send a connection request to the proxy server 603.
  • the proxy server 603 is configured to acquire a token in the connection request, and send the token to the controller 601 for authentication;
  • the controller 601 is configured to perform authentication on the client 604 according to the token; if the authentication succeeds, send an authentication success message to the proxy server 603, where the authentication success message carries The IP address, port number, and password of the server 604;
  • the proxy server 603 is further configured to receive the authentication success message sent by the controller 601, and establish a connection with the server 604 according to the IP of the server 604 and the port number;
  • the server 604 is configured to calculate authentication generation challenge information based on the virtual network, and send the challenge information to the proxy server 603;
  • the proxy server 603 is further configured to receive the challenge information, determine a first response value according to the password and the challenge information, and send the first response value to the server 604.
  • the challenge information is a 16-bit random number
  • the proxy server encrypts the challenge information according to the password and the challenge information according to the predefined data encryption algorithm to determine the first response value.
  • the predefined data encryption algorithm may be a Secure Hash Algorithm (SHA) or other data encryption algorithm such as Data Encryption Standard (DES), which is not limited in the present invention.
  • SHA Secure Hash Algorithm
  • DES Data Encryption Standard
  • the description of the system 600 for answering the authentication in the virtual network is performed.
  • the proxy server may determine the first response value according to the password and the challenge information, and the first response value. Sending to the server to complete the response process in VNC authentication.
  • the proxy server replaces the client to complete the response process in VNC authentication, thereby avoiding sensitive data transmission to the network environment of the untrusted domain and causing sensitivity. Data breaches or brute force issues improve security in the VNC certification process.
  • the proxy server 603 is further configured to send the challenge information to the client 602 before sending the first response value to the server 604; and receive the response sent by the client 602. a message, the response message includes a second response value, the second response value is the challenge information, and the second response value in the response message is replaced with the first response value;
  • the proxy server 603 sends the first response value to the server 604, which is specifically:
  • the response message is sent to the server 604.
  • the second response value is the challenge information, specifically, the client 602 does not enter the challenge information.
  • the line processing directly sends the challenge information as a response value and sends it to the proxy server 603 in the form of a response message.
  • the server 604 is further configured to receive the password sent by the controller 601, determine a third response value according to the password and the challenge information, and determine the first response value and location If the third response value is the same, the virtual network calculates that the authentication is successful.
  • the server 604 determines a third response value according to the same predefined data encryption algorithm as the proxy server 603 according to the password and the challenge information, and compares the first response value and the third response value when receiving the first response value. If the two are the same, the VNC authentication succeeds; if the two are different, the VNC authentication fails, and the VNC connection request is terminated.
  • controller 601 generates a password for each server 604 in the initialization phase as a VNC login password and sends it to the server 604 for determining whether the response value sent by the proxy server 603 is successfully authenticated.
  • the controller 601 is further configured to receive a virtual network computing connection request from the client 602, and obtain virtual network computing connection information according to the VNC connection request of the client 602, where the virtual network calculates a connection.
  • the information includes a uniform resource locator of the proxy server 603, an IP of the server 604, the port number, a token, and the password; and the proxy in the VNC connection information is sent to the client 602. a uniform resource locator of the server 603 and the token,
  • the client 602 is further configured to establish a connection with the proxy server 603 according to the uniform resource locator of the proxy server 603 and the token.
  • the port number is a port number of the virtual network computing service in the server 604.
  • the controller obtains the VNC connection information according to the VNC connection request from the client, and does not send the password in the VNC connection information to the client, but sends the password to the proxy server, and the password is saved by the proxy server. Ensure that the password is transmitted and stored in the trust domain.
  • the user sensitive data password is transmitted to the client, and sensitive data leakage or violence caused by the transmission of sensitive data between the trusted domain and the untrusted domain is avoided. Crack the problem.
  • the proxy server replaces the client to complete the response in the VNC authentication, and does not need to transmit the user sensitive data password to the untrusted domain, compared with the prior art.
  • the problem of transmitting sensitive passwords to non-trusted domains in the prior art leads to leakage of sensitive data or violent cracking, thereby improving the security in the VNC authentication process.
  • the client still receives the challenge information and returns the response value, which reduces the impact on the RFB protocol processing in the prior art and improves the VNC authentication. Information security in the process.
  • FIG. 7 to FIG. The virtual network calculates VNC-certified devices and proxy servers.
  • FIG. 7 is a schematic diagram of a proxy server 700 according to the present invention.
  • the proxy server 700 includes a receiving unit 701, an encryption unit 702, and a sending unit 703.
  • the receiving unit 701 is configured to receive a password sent by the controller, and receive challenge information sent by the server, where the challenge information is generated by the server based on the virtual network calculation authentication;
  • the encryption unit 702 is configured to determine a first response value according to the password and the challenge information received by the receiving unit 701;
  • the sending unit 703 is configured to send the first response value determined by the encryption unit 702 to the server.
  • the proxy server 700 of the embodiment of the present invention may be implemented by an Application Specific Integrated Circuit (ASIC) or a Programmable Logic Device (PLD), and the PLD may be a complex program logic device.
  • ASIC Application Specific Integrated Circuit
  • PLD Programmable Logic Device
  • the PLD may be a complex program logic device.
  • CPLD Complex Programmable Logic Device
  • FPGA Field-Programmable Gate Array
  • GAL Generic Array Logic
  • the proxy server 700 and its respective modules may also be software modules.
  • the challenge information is a 16-bit random number
  • the proxy server encrypts the challenge information according to the password and the challenge information according to the predefined data encryption algorithm to determine the first response value.
  • the predefined data encryption algorithm may be a Secure Hash Algorithm (SHA) or other data encryption algorithm such as Data Encryption Standard (DES), which is not limited in the present invention.
  • SHA Secure Hash Algorithm
  • DES Data Encryption Standard
  • the proxy server 700 can replace the client to complete the response process in the VNC authentication, and avoids the need to transmit the user sensitive data to the network environment of the untrusted domain when the client completes the response process, compared with the prior art.
  • the problem of leaking sensitive data or being violently cracked has improved the security of the VNC certification process.
  • the proxy server further includes a replacement unit 704;
  • the sending unit 703 is further configured to: determine, by the encryption unit 702, the first response Sending the challenge information to the client before sending the value to the server;
  • the receiving unit 701 is further configured to receive a response message sent by the client, where the response message includes a second response value, and the second response value is the challenge information;
  • the replacing unit 704 is configured to replace the second response value in the response message with the first response value
  • the sending unit 703 sends the first response value determined by the encryption unit 702 to the server, specifically:
  • the second response value is the challenge information.
  • the client does not process the challenge information, and directly sends the challenge information as a response value to the proxy server in the form of a response message.
  • the proxy server replaces the second response value in the response message with the first response value, and sends the response value to the server.
  • the server determines the third response value according to the same predefined data encryption algorithm as the proxy server according to the password and the challenge information.
  • the first response value and the third response value are compared. If the two are the same, the VNC authentication succeeds; if the two are different, the VNC authentication fails, and the VNC connection request is terminated.
  • controller generates a password for each server in the initialization phase as the VNC login password and sends the password to the server to determine whether the response value sent by the proxy server is successful.
  • the proxy server further includes a processing unit 705;
  • the receiving unit 701 is further configured to receive a connection request from the client before receiving the password sent by the controller;
  • the processing unit 705 is configured to acquire a token in the connection request of the client;
  • the sending unit 703 is further configured to send the token to the controller
  • the receiving unit 701 receives the password sent by the controller, specifically:
  • the authentication success message carries an IP, a port number, and the password of the server.
  • the controller sends an authentication success message to the proxy server, where the authentication success message carries the IP address, port number, and password of the server, where the port number is the port number of the VNC service; If it fails, the VNC connection request is terminated.
  • the IP address of the server is the IP address of the server where the virtual machine is located, and the port number is assigned to the server where the virtual machine is located. The port number that uniquely identifies the virtual machine VNC service.
  • processing unit 705 is further configured to establish a connection with the server according to the IP address of the server and the port number in the authentication success message received by the receiving unit 701.
  • the receiving unit 701 is further configured to receive first protocol version information sent by the server, where the first protocol version information is a highest protocol version supported by the server;
  • the sending unit 703 is further configured to send, to the client, the first protocol version information received by the receiving unit;
  • the receiving unit 701 is further configured to receive second protocol version information that is sent by the client, where the second version information is not higher than the first protocol version information and is the highest supported by the client. Protocol version;
  • the sending unit 703 is further configured to send, to the server, the second protocol version information received by the receiving unit 701.
  • the server and the client continue to negotiate the security authentication type of the VNC connection request.
  • the specific security authentication type determining process is as follows. :
  • the receiving unit 701 is further configured to receive a first security authentication type that is sent by the server, where the first security authentication type includes all security authentication types supported by the server;
  • the sending unit 703 is further configured to send, to the client, the first security authentication type received by the receiving unit 701;
  • the receiving unit 701 is further configured to receive a second security authentication type sent by the client, where the second security authentication type is a highest level of security supported by the client in the first security authentication type.
  • Type of certification
  • the sending unit 703 is further configured to send, to the server, the second security authentication type received by the receiving unit 701.
  • the first security authentication type is only used to identify the type of security authentication that the server sends to the proxy server, and does not represent the number.
  • the server and the client complete the security authentication according to the VNC authentication type; if the server determines that the negotiated security authentication type does not require authentication, the client and the server No authentication is required; if the server determines that the negotiated security authentication type is illegal, the VNC session between the client and the server ends.
  • the security authentication type is usually specified by the server, that is, the first security authentication type sent by the server is the specified security authentication type, and if the client returns the second type. If the security authentication type is different from the first security authentication type, the process of negotiating the security authentication type fails, and the VNC connection request is terminated.
  • the server and the client negotiate to determine the protocol version and the security authentication type of the VNC connection request.
  • the proxy server completes the VNC by using the challenge information and the password.
  • the proxy server can replace the client to complete the response process in the VNC authentication with the server, and avoid the problem of information leakage or brute force caused by the transmission of sensitive data to the untrusted domain. Security during the VNC certification process.
  • the proxy server 700 after receiving the challenge information by the proxy server 700, the proxy server replaces the client to complete the response process in the VNC authentication.
  • the user sensitive data password does not need to be transmitted to the untrusted domain.
  • the response process in the VNC authentication can be completed, which avoids the problem that the prior art transmits the password to the untrusted domain, causing the sensitive data to be leaked or violently cracked, thereby improving the security in the VNC authentication process.
  • the client still receives the challenge information and returns the response value, which reduces the impact on the RFB protocol processing in the prior art and improves the information security in the VNC authentication process.
  • FIG. 8 is a schematic diagram of a proxy server 800 according to the present invention.
  • the proxy server 800 includes a processor 801, a memory 802, a communication interface 803, a bus 804, the processor 801, a memory 802, and a communication.
  • the interfaces 803 are connected and communicate with each other via a bus 804 for storing computer execution instructions.
  • the processor 801 executes computer execution instructions in the memory 802. To perform the following operations by utilizing hardware resources in the proxy server 800:
  • the proxy server 800 in accordance with an embodiment of the present invention may correspond to performing the methods described in the embodiments of the present invention, and the above and other operations and/or functions of the various units in the proxy server 800 In order to implement the corresponding processes of the respective methods in FIG. 2 to FIG. 5, for brevity, details are not described herein again.
  • the proxy server 800 can complete the response process of the challenge information sent by the server instead of the client, and avoid the user sensitive data in the untrusted domain compared with the prior art.
  • the problem of data leakage or brute force caused by transmission and storage improves the security of the virtual network computing authentication process.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product. Based on such understanding, the technical solution of the present invention is essentially or a part contributing to the prior art or a part of the technical solution.
  • the points may be embodied in the form of a software product stored in a storage medium, including instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform various embodiments of the present invention All or part of the steps of the method.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本发明实施例涉及一种虚拟网络计算认证中应答的方法、装置、系统和代理服务器。该方法包括代理服务器接收控制器发送的口令；接收服务端发送的挑战信息，所述挑战信息为所述服务端基于所述虚拟网络计算认证生成；根据所述口令和所述挑战信息确定第一应答值；将所述第一应答值发送给所述服务端，以此解决现有技术中由客户端完成虚拟网络计算认证中应答过程而导致用户敏感数据泄露或遭到暴力破解的问题，提高了虚拟网络计算认证过程中的安全性。

Description

一种虚拟网络计算认证中应答的方法、装置、系统和代理服务器 技术领域
本发明涉及计算机技术领域，尤其涉及一种虚拟网络计算认证的方法、装置、系统和代理服务器。
背景技术
虚拟网络计算(Virtual Network Computing，VNC)是一种基于远程帧缓冲(Remote Frame Buffer，RFB)协议来远程控制另一台计算机的图形桌面共享系统，为用户提供了一种远程管理虚拟机或服务器的通道。
现有技术中，VNC由客户端、代理服务器和服务端组成，客户端一般为浏览器或VNC连接工具，服务端为VNC连接请求的目的端，代理服务器实现VNC服务的集中管理和控制，所有客户端和服务端之间的数据包由代理服务器进行中转。在每次VNC连接请求中，客户端和服务端都需要协商确定本次VNC连接请求所使用的RFB协议版本和安全认证类型，其中，安全认证类型包括非法(Invalid)、不需要认证(None)、VNC认证。在VNC认证过程中，客户端需要根据用户的口令和服务端基于VNC认证生成的挑战信息进行加密确定应答值，该应答值经由代理服务器发送给服务端，服务端会根据用户的口令和挑战信息按照与客户端相同的加密算法确定另一个应答值，如果服务端确定的应答值与客户端发送的应答值相同，则VNC认证成功。但是，随着VNC应用场景越来越广泛，用户可以通过任意客户端访问服务端，而客户端所在设备通常属于非信任域的网络环境中，此时，由客户端完成对服务端发送的挑战信息的应答过程，需要将用户的敏感数据口令从信任域传输到非信任域的网络环境中，并存储在非信任域的客户端中，导致敏感数据存在泄露或遭到暴力破解的问题，影响VNC认证过程中的安全性。
发明内容
本发明提供了一种虚拟网络计算认证中应答的方法、装置、系统和代理服务器，由代理服务器替代客户端完成虚拟网络计算认证中的应答过程，解决了现有技术中由客户端完成虚拟网络计算认证而导致用户敏感数据泄露或遭到暴力破解的问题，提高了虚拟网络计算认证过程中的安全性。
第一方面，提供了一种虚拟网络计算(Virtual Network Computing，VNC)认证中应答的方法，该方法包括：
代理服务器接收控制器发送的口令；
所述代理服务器接收服务端发送的挑战信息，所述挑战信息为所述服务端基于所述虚拟网络计算认证生成；
所述代理服务器根据所述口令和所述挑战信息确定第一应答值；
所述代理服务器将所述第一应答值发送给所述服务端。
具体地，挑战信息为16位字节的随机数，代理服务器会根据口令和挑战信息按照预定义数据加密算法确定一个应答值，并将该应答值发送给服务端，以完成虚拟网络计算认证中的应答过程。
通过上述内容的描述，在虚拟网络计算认证应答过程中，代理服务器接收到服务端发送的挑战信息后，可以根据口令和挑战信息确定第一应答值，并将第一应答值发送给服务端，完成虚拟网络计算认证中的应答过程，与现有技术相比，由代理服务器替代客户端完成虚拟网络计算认证中的应答过程，避免了用户敏感数据传输到非信任域的网络环境而导致敏感数据泄露或遭到暴力破解的问题，提高了虚拟网络计算认证过程中的安全性。
结合第一方面，在第一方面的第一种可能的实现方式中，在所述代理服务器将所述第一应答值发送给所述服务端之前，所述方法还包括：
所述代理服务器向客户端发送所述挑战信息；
所述代理服务器接收所述客户端发送的应答消息，所述应答消息中包括第二应答值，所述第二应答值为所述挑战信息；
所述代理服务器将所述应答消息中的所述第二应答值替换为所述第一应答值；
则所述代理服务器将所述第一应答值发送给所述服务端具体为：
所述代理服务器将所述应答消息发送给所述服务端。
具体地，第二应答值即为挑战信息，具体为客户端未对挑战信息进行处理，直接将挑战信息作为应答值，以应答消息形式发送给代理服务器。
通过上述内容的描述，代理服务器在接收到挑战信息时，也可以将该挑战信息发送给客户端，而客户端不进行处理直接将该挑战信息作为应答值，以应答消息形式发送给代理服务器，由代理服务器替换应答消息中的应答值，并发送给服务端完成虚拟网络计算认证中的应答过程，与现有技术相比，不 需要将用户敏感数据口令传输到非信任域，在信任域网络环境中即可完成虚拟网络计算认证中的应答过程，避免现有技术中将口令传输到非信任域导致敏感数据泄露或遭到暴力破解的问题，由此，提高了虚拟网络认证过程中的安全性。另一方面，按照远程帧缓冲(Remote Frame Buffer，RFB)协议处理过程，客户端仍然接收挑战信息并返回应答值的过程，减少了对现有技术中的RFB协议处理过程的影响，提高了VNC认证过程中的信息安全。
结合第一方面及第一方面第一种可能实现方式中任一种可能实现方式，在第一方面的第二种可能的实现方式中，所述方法还包括：
所述服务端接收所述控制器发送的所述口令；
所述服务端根据所述口令和所述挑战信息确定第三应答值；
若所述服务端确定所述第一应答值和所述第三应答值相同，则所述VNC认证成功。
具体地，服务端会根据口令和挑战信息按照与代理服务器相同的预定义数据加密算法确定第三应答值，当接收到第一应答值时，比较第一应答值和第三应答值，若二者相同，则VNC认证成功。
值得说明的是，控制器在初始化阶段会为每个服务端生成一个口令，作为VNC登陆密码，并将该口令发送给服务端，用于确定代理服务器发送的应答值是否认证成功。
结合第一方面的可能实现方式，在第一方面的第三种可能的实现方式中，在所述代理服务器接收控制器发送的口令之前，所述方法还包括：
所述代理服务器接收来自客户端的连接请求；
所述代理服务器获取所述客户端的连接请求中的令牌；
所述代理服务器向所述控制器发送所述令牌，以使得所述控制器对所述令牌进行鉴权；
则所述代理服务器接收控制器发送的口令具体为:
所述代理服务器接收来自所述控制器的鉴权成功消息，所述鉴权成功消息中携带所述服务端的IP、端口号、及所述口令。
结合第一方面的第三种可能的实现方式，在第一方面的第四种可能的实现方式中，在所述代理服务器接收控制器发送的口令之后，所述方法还包括：
所述代理服务器根据所述服务端的IP和所述端口号与所述服务端建立连接；
所述代理服务器接收所述服务端发送的第一协议版本信息，所述第一协议版本信息为所述服务端所支持的最高的协议版本；
所述代理服务器向所述客户端发送所述第一协议版本信息；
所述代理服务器接收所述客户端发送的第二协议版本信息，所述第二版本信息为不高于所述第一协议版本信息且为所述客户端所支持的最高的协议版本；
所述代理服务器向所述服务端发送所述第二协议版本信息，以使得所述服务端根据所述第二协议版本信息确定用于与所述客户端和所述服务端通信的协议版本。
结合第一方面的第四种可能实现方式，在第一方面的第五种可能实现方式中，所述方法还包括：
所述代理服务器接收所述服务端发送的第一安全认证类型，所述第一安全认证类型中包括所述服务端所支持的所有安全认证类型；
所述代理服务器向所述客户端发送所述第一安全认证类型；
所述代理服务器接收所述客户端发送的第二安全认证类型，所述第二安全认证类型为在所述第一安全认证类型中所述客户端所支持的最高级别的安全认证类型；
所述代理服务器向所述服务端发送所述第二安全认证类型，以使得所述服务端根据所述第二安全认证类型确定所述客户端和所述服务端的安全认证类型。
值得说明的是，第一安全认证类型仅用于标识服务端向代理服务器发送的安全认证类型，并不代表数量。
具体地，若服务端确定的安全认证类型为VNC认证，则服务端和客户端按照VNC认证类型完成安全认证；若服务端确定协商的安全认证类型为不需要认证，则客户端和服务端之间无需认证；若服务端确定协商的安全认证类型为非法，则客户端和服务端之间的VNC会话结束。
可选地，在具体实施过程中，为保证系统安全性，通常由服务端指定安全认证类型，即服务端发送的第一安全认证类型为所指定的安全认证类型，若客户端返回的第二安全认证类型与第一安全认证类型不同，则协商安全认证类型的过程失败，终止本次VNC连接请求。
通过上述内容的描述，服务端和客户端协商确定本次VNC连接请求的协 议版本和安全认证类型，在接收服务端根据VNC认证生成的挑战信息时，利用挑战信息和口令完成VNC认证中的应答过程，与现有技术相比，代理服务器可以替代客户端完成与服务端的VNC认证中的应答过程，避免了用户敏感数据传输到非信任域造成信息泄露或暴力破解的问题，提高了VNC认证过程中的安全性。
综上所述，通过上述内容的描述，由代理服务器替代客户端完成VNC认证中的应答过程，与现有技术相比，不需要将用户的敏感数据口令传输到非信任域的网络环境中，在信任域的网络环境中即可完成VNC认证中的应答过程，避免了现有技术中敏感数据在非信任域网络环境中存储而导致敏感数据泄露或遭到暴力破解的问题，由此，提高了VNC认证过程中的安全性。另一方面，按照RFB协议处理过程，客户端仍然接收挑战信息并返回应答值的过程，减少了对现有技术中的RFB协议处理过程的影响，提高了VNC认证过程中的信息安全。
第二方面，提供了一种虚拟网络计算认证中应答的系统，所述系统包括控制器、客户端、代理服务器和服务端：
所述客户端，用于向所述代理服务器发送连接请求；
所述代理服务器，用于获取所述连接请求中的令牌；将所述令牌发送给所述控制器进行鉴权；
所述控制器，用于根据所述令牌对所述客户端进行鉴权，若鉴权成功，则向所述代理服务器发送鉴权成功消息，所述鉴权成功消息中携带所述服务端的IP、端口号、口令；
所述代理服务器，还用于接收所述控制器发送的所述鉴权成功消息；根据所述IP和所述端口号与所述服务端建立连接；
所述服务端，用于基于所述虚拟网络认证生成挑战信息，并将所述挑战信息发送给代理服务器；
所述代理服务器，还用于接收所述挑战信息；根据所述口令和所述挑战信息确定第一应答值；将所述第一应答值发送给所述服务端。
通过上述内容的描述，在VNC认证应答过程中，代理服务器接收到服务端发送的挑战信息后，可以根据口令和挑战信息确定第一应答值，并将第一应答值发送给服务端，完成VNC认证中的应答过程，与现有技术相比，由代 理服务器替代客户端完成VNC认证中的应答过程，避免了用户敏感数据传输到非信任域的网络环境而导致敏感数据泄露或遭到暴力破解的问题，提高了VNC认证过程中的安全性。
结合第二方面的可能实现方式，在在二方面的第一种可能实现方式中，所述代理服务器，还用于在将所述第一应答值发送给所述服务端之前向所述客户端发送所述挑战信息；接收所述客户端发送的应答消息，所述应答消息中包括第二应答值，所述第二应答值为所述挑战信息；将所述应答消息中的所述第二应答值替换为所述第一应答值；
则所述代理服务器将所述第一应答值发送给所述服务端具体为：
将所述应答消息发送给所述服务端。
结合第二方面及第二方面第一种中任一可能的实现方式，在第二方面的第二种可能实现方式中，所述服务端，还用于接收所述控制器发送的所述口令；根据所述口令和所述挑战信息确定第三应答值；若确定所述第一应答值和所述第三应答值相同，则所述虚拟网络计算认证成功。
值得说明的是，控制器在初始阶段会为每个服务端生成一个口令，作为VNC登陆密码，并将该口令发送给服务端，用于确定代理服务器发送的应答值是否认证成功。
结合第二方面的可能实现方式，在第二方面第三种可能实现方式中，所述控制器，还用于接收来自所述客户端的虚拟网络计算连接请求；根据所述客户端的虚拟网络计算连接请求获取虚拟网络计算连接信息，所述虚拟网络计算连接信息包括所述代理服务器的统一资源定位符、所述服务端的IP、所述端口号、令牌和所述口令；向所述客户端发送所述虚拟网络计算连接信息中的所述代理服务器的统一资源定位符和所述令牌；
所述客户端，还用于根据所述代理服务器的统一资源定位符和所述令牌与所述代理服务器建立连接。
其中，所述端口号为所述服务端中虚拟网络计算服务的端口号
综上所述，在上述系统中，代理服务器替代客户端完成VNC认证中的应答，与现有技术相比，不需要将用户敏感数据口令传输到非信任域的网络环境中，避免了现有技术中将口令传输到非信任域的网络环境中而导致敏感数据泄露或遭到暴力破解的问题，由此，提高了VNC认证过程中的安全性。另一方面，按照RFB协议处理过程，客户端仍然接收挑战信息并返回应答值的 过程，减少了对现有技术中的RFB协议处理过程的影响，提高了VNC认证过程中的信息安全。
第三方面，提供一种代理服务器，所述代理服务器包括接收单元、加密单元、发送单元；其中
所述接收单元，用于接收控制器发送的口令；接收服务端发送的挑战信息，所述挑战信息为所述服务端基于虚拟网络计算认证生成；
所述加密单元，用于根据所述接收单元接收的所述口令和所述挑战信息确定第一应答值；
所述发送单元，用于将所述加密单元确定的所述第一应答值发送给所述服务端。
值得说明的是，本发明实施例的代理服务器可以通过专用集成电路(Application Specific Integrated Circuit，ASIC)实现，或可编程逻辑器件(Programmable Logic Device，PLD)实现，上述PLD可以是复杂程序逻辑器件(Complex Programmable Logic Device，CPLD)，现场可编程门阵列(Field－Programmable Gate Array，FPGA)，通用阵列逻辑(Generic Array Logic，GAL)或其任意组合。通过软件实现第一方面或第一方面其他可能实现方式所示的VNC认证应答的方法时，代理服务器及其各个模块也可以为软件模块。
具体地，挑战信息为16位字节的随机数，代理服务器根据口令和挑战信息按照预定义数据加密算法对挑战信息进行加密确定第一应答值，并将其发送给服务端，由此完成虚拟网络计算认证中的应答过程。
值得说明的是，预定义数据加密算法可以为安全哈希算法(Secure Hash Algorithm，SHA)，也可以按照数据加密标准(Data Encryption Standard，DES)等其他数据加密算法进行加密，本发明不作限制。
通过上述代理服务器的描述，代理服务器可以替代客户端完成VNC认证中的应答过程，与现有技术相比，避免了客户端完成应答过程时需将用户敏感数据传输到非信任域的网络环境而导致敏感数据泄或遭到暴力破解的问题，提高了VNC认证过程中的安全性。
结合第三方面的可能实现方式，在第三方面第一种可能实现方式中，所述代理服务器还包括替换单元；
所述发送单元，还用于在将所述加密单元确定的所述第一应答值发送给所述服务端之前向客户端发送所述挑战信息；
所述接收单元，还用于接收所述客户端发送的应答消息，所述应答消息中包括第二应答值，所述第二应答值为所述挑战信息；
所述替换单元，用于将所述应答消息中的所述第二应答值替换为所述第一应答值；
则所述发送单元将所述加密单元确定的所述第一应答值发送给所述服务端具体为：
将所述应答消息发送给所述服务端。
具体地，第二应答值即为挑战信息，具体为客户端未对挑战信息进行处理，直接将挑战信息作为应答值，以应答消息形式发送给代理服务器。代理服务器会将应答消息中的第二应答值替换为第一应答值，并发送给服务端，服务端会根据口令和挑战信息按照与代理服务器相同的预定义加密数据算法确定第三应答值，当接收到第一应答值时，比较第一应答值和第三应答值，若二者相同，则VNC认证成功；若二者不同，则VNC认证失败，终止本次VNC连接请求。
值得说明的是，控制器在初始化阶段会为每个服务端生成一个口令，作为VNC登陆密码，并将该口令发送给服务端，用于确定代理服务器发送的应答值是否认证成功。
结合第三方面的可能实现方式，在第三方面的第二种可能的实现方式中，所述代理服务器还包括处理单元；
所述接收单元，还用于在接收所述控制器发送的口令之前接收来自客户端的连接请求；
所述处理单元，用于获取所述客户端的连接请求中的令牌；
所述发送单元，还用于向所述控制器发送所述令牌；
则所述接收单元接收所述控制器发送的口令具体为：
接收来自所述控制器的鉴权成功消息，所述鉴权成功消息中携带所述服务端的IP、端口号、及所述口令。
具体地，若控制器根据该令牌对客户端鉴权成功，则向代理服务器发送鉴权成功消息，该鉴权成功消息中携带服务端的IP、端口号和口令，其中，端口号为VNC服务的端口号；若控制器对所述令牌鉴权失败，则终止本次VNC 连接请求。
值得说明的是，若客户端请求建立VNC连接的目标服务端为虚拟机，则服务端的IP为虚拟机所在服务器的IP，端口号为虚拟机所在服务器分配的唯一标识该虚拟机VNC服务的端口号。
结合第三方面的第二种可能实现方式，在第三方面的第三种可能实现方式中，
所述处理单元，还用于根据所述接收单元接收的所述鉴权成功消息中的所述服务端的IP和所述端口号与所述服务端建立连接；
所述接收单元，还用于接收所述服务端发送的第一协议版本信息，所述第一协议版本信息为所述服务端所支持的最高的协议版本；
所述发送单元，还用于向所述客户端发送所述接收单元接收的所述第一协议版本信息；
所述接收单元，还用于接收所述客户端发送的第二协议版本信息，所述第二版本信息为不高于所述第一协议版本信息且为所述客户端所支持的最高的协议版本；
所述发送单元，还用于向所述服务端发送所述第二协议版本信息。
结合第三方面第三种可能实现方式，在第三方面第四种可能实现方式中，所述接收单元，还用于：接收所述服务端发送的第一安全认证类型，所述第一安全认证类型中包括所述服务端所支持的所有安全认证类型；
所述发送单元，还用于：向所述客户端发送所述第一安全认证类型；
所述接收单元，还用于：接收所述客户端发送所述接收单元接收的第二安全认证类型，所述第二安全认证类型为在所述第一安全认证类型中所述客户端所支持的最高级别的安全认证类型；
所述发送单元，还用于：向所述服务端发送所述第二安全认证类型。
值得说明的是，第一安全认证类型仅用于标识服务端向代理服务器发送的安全认证类型，并不代表数量。
具体地，若服务端确定的安全认证类型为VNC认证，则服务端和客户端按照VNC认证类型完成安全认证；若服务端确定协商的安全认证类型为不需要认证，则客户端和服务端之间无需认证；若服务端确定协商的安全认证类型为非法，则客户端和服务端之间的VNC会话结束。
可选地，在具体实施过程中，为保证系统安全性，通常由服务端指定安 全认证类型，即服务端发送的第一安全认证类型为所指定的安全认证类型，若客户端返回的第二安全认证类型与第一安全认证类型不同，则协商安全认证类型的过程失败，终止本次VNC连接请求。
通过上述代理服务器的描述，服务端和客户端协商确定本次VNC连接请求的协议版本和安全认证类型，在接收服务端根据VNC认证生成的挑战信息时，利用挑战信息和口令完成VNC认证中的应答过程，与现有技术相比，代理服务器不再仅用于对服务端和客户端之间的数据包进行中转，可以替代客户端完成与服务端的VNC认证中的应答过程，避免了用户敏感数据传输到非信任域造成信息泄露或暴力破解的问题，提高了VNC认证过程中的安全性。
综上所述，通过上述内容的描述，由代理服务器替代客户端完成VNC认证中的应答过程，与现有技术相比，不需要将用户敏感数据口令传输到非信任域的网络环境中，即可完成VNC认证中的应答过程，避免了现有技术中将口令传输到非信任域导致敏感数据泄露或遭到暴力破解的问题，由此，提高了VNC认证过程中的安全性。另一方面，按照RFB协议处理过程，客户端仍然接收挑战信息并返回应答值的过程，减少了对现有技术中的RFB协议处理过程的影响，提高了VNC认证过程中的信息安全。
第四方面，提供一种代理服务器，所述代理服务器包括处理器、存储器、通信接口、总线，所述处理器、存储器和通信接口之间通过总线连接并完成相互间的通信，所述存储器中用于存储计算机执行指令，所述代理服务器运行时，所述处理器执行所述存储器中的计算机执行指令以利用所述代理服务器中的硬件资源执行第一方面、第一方面第一种可能实现方式、第一方面第三种可能实现方式至第一方面第五种可能实现方式中任一可能实现方式中方法。
通过上述代理服务器，在虚拟网络计算认证中，代理服务器可以代替客户端完成对服务端发送的挑战信息的应答过程，与现有技术相比，避免将用户敏感数据在非信任域中传输和存储而导致的数据泄露或遭到暴力破解的问题，提升了虚拟网络计算认证过程中的安全性。
第五方面，提供了一种计算机可读介质，用于存储计算机程序，该计算机程序包括用于执行第一方面、第一方面第一种可能实现方式、第一方面第 三种可能实现方式至第一方面第五种可能实现方式中任一中可能实现方式中的方法的指令。
基于上述技术方案，本发明实施例的一种虚拟网络计算认证中应答的方法、装置、系统和代理服务器，通过代理服务器替代客户端完成VNC认证中的应答过程，与现有技术相比，避免将用户敏感数据在非信任域中传输和存储而导致的敏感数据泄露或遭到暴力破解的问题，提高了VNC认证过程中的安全性。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对本发明实施例中所需要使用的附图作简单地介绍，显而易见地，下面所描述的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的一种虚拟网络计算系统的网络架构示意图；
图2为本发明实施例提供的一种虚拟网络计算认证中应答的方法的示意性流程图；
图3为本发明实施例提供的另一种虚拟网络计算认证中应答的方法的示意性流程图；
图4为本发明实施例提供的另一种虚拟网络计算认证中应答的方法的示意性流程图；
图5为本发明实施例提供的另一种虚拟网络计算认证中应答的方法的示意性流程图；
图6为本发明实施例提供的一种虚拟网络计算认证中应答系统的示意图；
图7为本发明实施例提供的一种代理服务器的示意图；
图8为本发明实施例提供的另一种代理服务器的示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明的一部分实施例，而不是全部实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动的前提下所获得的所有其他实施例，都应属于本发明保护的范围。
图1为本发明提供的一种虚拟网络计算(Virtual Network Computing，VNC)系统的网络架构示意图，如图所示，该网络架构中包括客户端、代理服务器、服务端和控制器，客户端可以为浏览器或VNC连接工具，客户端可以部署在服务器、计算机(Personal Computer，PC)中，也可以部署在移动设备中，其中，移动设备可以为便携式计算机，也可以为手机、iPad等，本发明不作限制。服务端为VNC远程访问的目的端，可以是服务器，也可以是服务器上的虚拟机。客户端和服务端之间传输的数据包需要通过代理服务器进行中转，即服务器会先将数据包发送给代理服务器，代理服务器再将该数据包发送给客户端。控制器用于管理代理服务器和服务端，负责根据来自客户端的VNC连接请求确定代理服务器的统一资源定位符(Uniform Resource Locator，URL)、服务端的IP、端口号、令牌(token)、口令(password)等VNC连接信息，其中，端口号为服务端中VNC服务的端口号；令牌用于VNC连接过程中控制器对客户端进行鉴权，确定客户端的合法性；口令为VNC登陆密码，由控制器统一管理，若服务端为虚拟机，则在虚拟机创建时生成，控制器会将口令发送给虚拟机所在服务器，当虚拟机重启或口令已被使用过时更新；若服务端为服务器本身，则在控制器与服务器首次建立连接时，控制器会生成一个口令，发送给服务器，当服务器重启或口令已经被使用时更新。
值得说明的是，具体实施过程中，代理服务器可以根据业务场景需求单独部署在一台服务器中，也可以部署在控制器或服务端中，即代理服务器为控制器或服务端中的一个软件模块，本发明不作限制。
还值得说明的是，图1所示网络架构中的客户端、代理服务器和服务端均可以有多个，不同用户可以通过不同客户端利用不同代理服务器分别访问目标服务端，同一代理服务器可同时处理多个不同客户端和服务端的VNC连接请求，在本发明的以下具体描述中，以图1所示网络架构中客户端、代理服务器和服务端均只有一个为例进行进一步详细描述。
本领域的技术人员应理解的是，在具体实施过程中，会通过交换机、防火墙等网络设备构建内部网络与外部网络之间的安全系统，依照特定的规则，允许或是限制传输的数据通过，其中，将安全系统内部的网络划分为信任域，安全系统外部的网络划分为非信任域，在信任域中数据的传输安全性高，用户敏感数据不会被窃取；而在非信任域中由于没有限定传输数据的规则，用 户敏感数据的安全性无法保障。
示例地，在开源的云计算管理平台OpenStack中，提供基于安全套接层(Secure Sockets Layer，SSL)的网络套接字(WebSoket)协议的VNC服务，如可以是noVNC。控制器可以是Nova组件，服务端为OpenStack系统中的计算节点，客户端为用户浏览器，Nova-noVNCProxy作为代理服务器，则用户可以通过浏览器与计算节点中的虚拟机或计算节点建立VNC连接请求，其中，Nova组件中的Nova-Api负责调用Nova-Compute收集所述VNC连接请求的VNC连接信息，VNC连接信息包括代理服务器的统一资源定位符(Uniform Resource Locator，URL)、服务端的IP、端口号、令牌(token)、口令；Nova-Consoleauth负责存储该VNC连接信息和根据令牌对客户端进行鉴权。在数据传输过程中，客户端所在网络环境属于非信任域，Nova-Api、Nova-Consoleauth、Nova-compute、noVNCProxy、计算节点之间的网络环境属于信任域。
结合图1所示的网络架构，现有技术中，客户端和服务端之间建立VNC连接请求时，控制器会将VNC连接信息中的代理服务器的URL、令牌、口令发送给客户端，客户端会在本地存储口令，以便完成与服务器之间的远程帧缓冲(Remote Frame Buffer，RFB)协议中VNC认证的应答，但口令属于用户的敏感数据，当客户端所在网络属于非信任域时，敏感数据存在泄露或暴力破解的问题，影响VNC认证过程中的安全性。而本发明所提供的一种VNC认证中应答的方法是由代理服务器替代客户端完成VNC认证中的应答，不再将口令发送给客户端，避免用户敏感数据在非信任域和信任域之间传输、以及客户端在非信任域存储敏感数据所导致泄露或敏感数据遭到暴力破解的问题，提高了VNC认证过程的安全性。
接下来，结合附图详细介绍本发明所提供的VNC认证中应答的方法。
本领域技术人员应理解是，客户端和服务端之间的通信连接需要由代理服务器进行中转，在VNC认证之前，客户端需要向控制器获取VNC连接信息，并与对应的代理服务器建立连接；而代理服务器则需要通过控制器确定客户端所要连接的服务端信息，与服务端建立连接，具体过程如图2所示，所述方法包括：
S201、控制器接收客户端发送的VNC连接请求。
具体地，用户通过浏览器或VNC连接工具向控制器发送VNC连接请求， 其中，连接请求中包含目标服务端信息。
S202、控制器根据VNC连接请求获取VNC连接信息。
具体地，所述VNC连接信息包括代理服务器的统一资源定位符URL、服务端的IP、端口号、令牌和口令，其中，端口号为服务端中VNC服务的端口号。
值得说明的是，若客户端请求建立VNC连接的目标服务端为虚拟机，则服务端的IP为虚拟机所在服务器的IP，端口号为虚拟机所在服务器分配的唯一标识该虚拟机VNC服务的端口号。
示例地，在OpenStack系统中，Nova-Api接收到步骤S201的VNC连接请求时，调用Nova-Compute获取该VNC连接请求的VNC连接信息，然后再调用Nova-Consoleauth将该VNC信息存储到内存中。
S203、客户端接收控制器发送的VNC连接信息中的代理服务器的统一资源定位符URL、令牌。
示例地，控制器将如下形式的信息发送给客户端：
https://IP:Port/vnc_auto.html？token＝token_id
其中，IP为VNC连接信息中的代理服务器的IP、Port为基于SSL的超文本传输协议(Hyper Text Transfer Protocol over Secure Socket Layer，HTTPS)的服务的端口号。
S204、客户端利用代理服务器的统一资源定位符URL、令牌与代理服务器建立连接。
示例地，客户端可以为浏览器，利用步骤S203中接收的如下形式的URL和令牌信息与代理服务器建立连接；
https://IP:Port/vnc_auto.html？token＝token_id
S205、代理服务器获取令牌。
具体地，令牌为步骤S204中客户端的连接请求中的令牌，以便控制器根据令牌对客户端进行鉴权，确认客户端是否能够通过该代理服务器连接服务端。例如如下连接请求中的token_id：
https://IP:Port/vnc_auto.html？token＝token_id
S206、代理服务器向控制器发送令牌。
具体地，客户端将步骤S205中获取的令牌发送给控制器。
S207、控制器根据令牌对客户端进行鉴权。
S208、当鉴权成功时，代理服务器接收控制器发送的鉴权成功消息，该鉴权成功消息中携带服务端的IP、端口号和口令。
具体地，当鉴权成时，控制器向代理服务器发送鉴权成功消息，该鉴权成功消息中携带服务端的IP、端口号和口令，其中，端口号为VNC服务的端口号；当鉴权失败时，终止本次VNC连接请求。
S209、代理服务器利用服务端的IP和端口号与服务端建立连接。
具体地，服务端的IP和端口号为步骤S208中鉴权成功消息中携带的服务端的IP和端口号。
通过步骤S201至步骤S209的描述，若控制器根据令牌对客户端鉴权成功，则将口令发送给代理服务器，进一步地，由代理服务器替代客户端完成VNC认证中的应答过程，与现有技术中将用户敏感数据口令传输给客户端相比，避免了用户敏感数据在信任域和非信任域间传输的过程；另一方面，解决了现有技术中非信任域存储敏感数据导致敏感数据泄露或暴力破解的问题，提高了VNC认证过程的安全性。
结合上述描述内容，客户端、代理服务器和服务端已经建立通信连接，进一步地，服务端和客户端会根据RFB协议协商本次VNC连接请求中使用的协议版本和安全认证类型，具体过程如图3所示，所述方法包括：
S301、服务端向代理服务器发送第一协议版本信息。
具体地，第一协议版本信息为服务端所支持最高版本的RFB的协议版本。
示例地，若服务端支持3.3、3.7、3.8三个协议版本，其中3.8为最高版本，则服务端向代理服务器发送的第一协议版本信息即为3.8。其中，服务端向代理服务器发送包含如下格式的数据包：
Protocol Version message：RFB 003.008\n(hex 52 46 42 20 30 30 33 2e 30 30 38 0a)内容的数据包。
可选地、代理服务器可以监测服务端发送的数据包，根据关键字确定一组VNC连接请求中的客户端和服务端开始协商RFB的协议版本和安全认证类型。
具体地，代理服务器可以同时处理多组服务端和客户端的VNC会话，代理服务器需要确定每组会话的开始，以便根据关键字识别服务端发送的挑战信息。
示例地，若代理服务器监测服务端发送的数据包中包含如RFB***.***\n格式的关键字，则确定本组VNC会话开始。
S302、代理服务器向客户端发送第一协议版本信息。
S303、客户端向代理服务器发送第二协议版本信息。
具体地，第二协议版本信息为不高于第一协议版本信息且为客户端所支持的最高的RFB的协议版本。
示例地，若客户端支持3.8和3.7版本的RFB协议，且接收代理服务器发送的第一协议版本信息为3.8，则客户端所支持的不高于第一协议版本信息且为其所支持的最高的协议版本为3.8，即客户端向代理服务器发送的第二协议版本信息为3.8。
S304、代理服务器向服务端发送第二协议版本信息。
S305、服务端根据第二协议版本信息确定用于与客户端通信的协议版本。
具体地，服务端根据代理发送的客户端的第二协议版本信息确定本次VNC连接请求的协议版本。
示例地，若第二协议版本信息为3.8，且服务端支持此版本的协议，则本次VNC连接请求的协议版本为3.8。
进一步地，在RFB协议的握手阶段，服务端和客户端确定本次VNC连接请求的协议版本后，会继续协商本次VNC连接请求的安全认证类型，具体安全认证类型确定过程的方法如下所述：
S306、服务端向代理服务器发送第一安全认证类型。
具体地，根据步骤S305中确定的协议版本信息，不同协议版本支持的安全认证类型和认证过程不同，第一安全认证类型包括服务器在确定的协议版本信息中所支持的所有安全认证类型。
值得说明的是，第一安全认证类型仅用于标识服务端向代理服务器发送的安全认证类型，并不代表数量。
示例地，若服务端支持非法(Invalid)、不需要认证(None)、VNC认证(即挑战/应答认证，Challenge/Response)三种类型，则第一安全认证类型中包括以上三种安全认证类型。
S307、代理服务器向客户端发送第一安全认证类型。
S308、客户端向代理服务器发送第二安全认证类型。
具体地，第二安全认证类型为在第一安全认证类型中客户端所支持的最 高级别的安全认证类型。
示例地，若客户端接收的第一安全认证类型包括非法(Invalid)、不需要认证(None)、VNC认证(即挑战/应答认证，Challenge/Response)三种，而客户端也支持以上三种类型，则第二安全认证类型为安全级别最高的VNC认证方式，即挑战/应答认证方式。
S309、代理服务器向服务端发送第二安全认证类型。
S310、服务端根据第二安全认证类型确定服务端和客户端的安全认证类型。
具体地，若服务端确定的安全认证类型为VNC认证，则服务端和客户端按照VNC认证类型完成安全认证；若服务端确定协商的安全认证类型为不需要认证，则客户端和服务端之间无需认证；若服务端确定协商的安全认证类型为非法，则客户端和服务端之间的VNC会话结束。
可选地，在具体实施过程中，为保证系统安全性，通常由服务端指定安全认证类型，即在步骤S306中服务端发送的第一安全认证类型为所指定的安全认证类型，若客户端返回的第二安全认证类型与第一安全认证类型不同，则协商安全认证类型的过程失败，终止本次VNC连接请求。
通过上述步骤S301至S310的描述，服务端和客户端协商确定本次VNC连接请求的协议版本和安全认证类型，进一步地，代理服务器在接收服务端根据VNC认证生成的挑战信息时，利用挑战信息和口令完成VNC认证中的应答过程，与现有技术相比，代理服务器不再仅用于对服务端和客户端之间的数据包进行中转，也可以替代客户端完成与服务端的VNC认证中的应答过程，避免了用户敏感数据传输到非信任域造成敏感数据泄露或遭到暴力破解的问题，提高了VNC认证过程中的安全性。
结合上述内容的描述，在本发明的一个可能的实施例中，服务端和客户端若确认安全认证类型为VNC认证，即挑战/应答认证，则代理服务器可以替代客户端完成VNC认证，具体方法如图4所示，所述方法包括：
S401、控制器向代理服务器发送口令。
具体地，口令为步骤S208中控制器发送给代理服务器的鉴权成功消息中携带的，在此不再赘述。
S402、代理服务器接收控制器发送的挑战信息，该挑战信息为基于虚拟 网络计算认证生成。
具体地，服务端会根据VNC认证类型生成挑战信息，并发送给代理服务器，其中，该挑战信息为16位字节的随机数。
S403、代理服务器根据口令和挑战信息确定第一应答值。
具体地，代理服务器根据口令和挑战信息按照预定义数据加密算法对挑战信息进行加密确定第一应答值。
值得说明的是，预定义数据加密算法可以为安全哈希算法(Secure Hash Algorithm，SHA)，也可以按照数据加密标准(Data Encryption Standard，DES)等其他数据加密算法进行加密，本发明不作限制。
示例地，代理服务器按照SHA256数据加密算法对口令和挑战信息进行加密确定第一应答值。
S404、代理服务器将第一应答值发送给服务端。
具体地，服务端会根据控制器发送的口令和挑战信息按照与代理服务器相同的预定义数据加密算法确定第三应答值，当接收到第一应答值时，比较第一应答值和第三应答值，若二者相同，则VNC认证成功；若二者不同，则VNC认证失败，终止本次VNC连接请求。
值得说明的是，控制器在初始阶段会为每个服务端生成一个口令，作为VNC登陆密码，控制器会将口令发送给服务端，用于确定代理服务器发送的应答值是否认证成功。
通过步骤S401至步骤S404的描述，在VNC认证应答过程中，代理服务器接收到服务端发送的挑战信息后，可以根据口令和挑战信息确定第一应答值，并将第一应答值发送给服务端，完成VNC认证中的应答过程，与现有技术相比，由代理服务器替代客户端完成VNC认证中的应答过程，避免了用户敏感数据传输到非信任域的网络环境而导致敏感数据泄露或遭到暴力破解的问题，提高了VNC认证过程中的安全性。
在本发明的另一个可能的实施例中，为减少对RFB协议的影响，VNC认证中的应答过程也可以通过如图5所示方法实现，所述方法包括：
S501、服务端向代理服务器发送挑战信息。
具体地，服务器根据图3中协商确定的安全认证类型，向代理服务器发送挑战信息。
S502、代理服务器向客户端发送挑战信息。
具体地，代理服务器将步骤S501中接收的挑战信息再发送给客户端。
S503、代理服务器根据口令和挑战信息确定第一应答值。
具体地，步骤S503的实现过程与步骤S403相同，在此不再赘述。
S504、客户端向代理服务器发送应答消息，该应答消息中包括第二应答值。
具体地，第二应答值即为挑战信息，具体为客户端未对挑战信息进行处理，直接将挑战信息作为应答值，以应答消息形式发送给代理服务器。
S505、代理服务器将该应答消息中的第二应答值替换为第一应答值。
S506、代理服务器向服务端发送应答消息。
可选地，服务端会根据控制器发送的口令和挑战信息按照与代理服务器相同的预定义数据加密算法确定第三应答值，当接收到第一应答值时，比较第一应答值和第三应答值，若二者相同，则VNC认证成功；若二者不同，则VNC认证失败，终止本次VNC连接请求。
值得说明的是，控制器在初始阶段会为每个服务端生成一个口令，作为VNC登陆密码，控制器会将口令发送给服务端，用于确定代理服务器发送的应答值是否认证成功。
通过步骤S501至步骤S506的描述，代理服务器在接收到挑战信息时，也可以将该挑战信息发送给客户端，而客户端不进行处理直接将该挑战信息作为应答值，以应答消息形式发送给代理服务器，由代理服务器替换应答消息中的应答值，并发送给服务端完成虚拟网络计算认证中的应答过程，与现有技术相比，不需要将用户敏感数据口令传输到非信任域，在信任域网络环境中即可完成虚拟网络计算认证中的应答过程，避免现有技术中将口令传输到非信任域导致敏感数据泄露或遭到暴力破解的问题，由此，提高了虚拟网络认证过程中的安全性。另一方面，按照RFB协议处理过程，客户端仍然接收挑战信息并返回应答值的过程，减少了对现有技术中的RFB协议处理过程的影响，提高了VNC认证过程中的信息安全。
在本发明的一个可能的实施例中，图6为本发明实施例中提供的一种虚拟网络计算认证中应答的系统600的示意图，如图所示，该虚拟网络计算认证中应答的系统600包括控制器601、客户端602、代理服务器603和服务 端604：
所述客户端602，用于向所述代理服务器603发送连接请求；
所述代理服务器603，用于获取所述连接请求中的令牌；将所述令牌发送给所述控制器601进行鉴权；
所述控制器601，用于根据所述令牌对所述客户端604进行鉴权；若鉴权成功，则向所述代理服务器603发送鉴权成功消息，所述鉴权成功消息中携带所述服务端604的IP、端口号、口令；
所述代理服务器603，还用于接收所述控制器601发送的所述鉴权成功消息；根据所述服务端604的IP和所述端口号与所述服务端604建立连接；
所述服务端604，用于基于所述虚拟网络计算认证生成挑战信息，并将所述挑战信息发送给代理服务器603；
所述代理服务器603，还用于接收所述挑战信息；根据所述口令和所述挑战信息确定第一应答值；将所述第一应答值发送给所述服务端604。
具体地，挑战信息为16位字节的随机数，代理服务器根据口令和挑战信息按照预定义数据加密算法对挑战信息进行加密确定第一应答值。
值得说明的是，预定义数据加密算法可以为安全哈希算法(Secure Hash Algorithm，SHA)，也可以按照数据加密标准(Data Encryption Standard，DES)等其他数据加密算法进行加密，本发明不作限制。
通过上述虚拟网络计算认证中应答的系统600的描述，在VNC认证应答过程中，代理服务器接收服务端发送的挑战信息后，可以根据口令和挑战信息确定第一应答值，并将第一应答值发送给服务端，完成VNC认证中的应答过程，与现有技术相比，由代理服务器替代客户端完成VNC认证中的应答过程，避免了用户敏感数据传输到非信任域的网络环境而导致敏感数据泄露或遭到暴力破解的问题，提高了VNC认证过程中的安全性。
可选地，所述代理服务器603，还用于在将所述第一应答值发送给所述服务端604之前向所述客户端602发送所述挑战信息；接收所述客户端602发送的应答消息，所述应答消息中包括第二应答值，所述第二应答值为所述挑战信息；将所述应答消息中的所述第二应答值替换为所述第一应答值；
则所述代理服务器603将所述第一应答值发送给所述服务端604具体为：
将所述应答消息发送给所述服务端604。
具体地，第二应答值即为挑战信息，具体为客户端602未对挑战信息进 行处理，直接将挑战信息作为应答值，以应答消息形式发送给代理服务器603。
可选地，所述服务端604，还用于接收所述控制器601发送的所述口令；根据所述口令和所述挑战信息确定第三应答值；若确定所述第一应答值和所述第三应答值相同，则所述虚拟网络计算认证成功。
具体地，服务端604会根据口令和挑战信息按照与代理服务器603相同的预定义数据加密算法确定第三应答值，当接收到第一应答值时，比较第一应答值和第三应答值，若二者相同，则VNC认证成功；若二者不同，则VNC认证失败，终止本次VNC连接请求。
值得说明的是，控制器601在初始化阶段会为每个服务端604生成一个口令，作为VNC登陆密码，并发送给服务端604，用于确定代理服务器603发送的应答值是否认证成功。
可选地，所述控制器601，还用于接收来自所述客户端602的虚拟网络计算连接请求；根据所述客户端602的VNC连接请求获取虚拟网络计算连接信息，所述虚拟网络计算连接信息包括所述代理服务器603的统一资源定位符、所述服务端604的IP、所述端口号、令牌和所述口令；向所述客户端602发送所述VNC连接信息中的所述代理服务器603的统一资源定位符和所述令牌，
所述客户端602，还用于根据所述代理服务器603的统一资源定位符和所述令牌与所述代理服务器603建立连接。
其中，所述端口号为所述服务端604中虚拟网络计算服务的端口号
通过上述过程的描述，控制器根据来自客户端的VNC连接请求获取VNC连接信息，不会再将VNC连接信息中的口令发送给客户端，而是发送给代理服务器，由代理服务器保存口令，由此保证口令在信任域中传输和存储，与现有技术中将用户敏感数据口令传输给客户端相比，避免了用户敏感数据在信任域和非信任域间传输导致的敏感数据泄露或遭到暴力破解的问题。
综上所述，在上述虚拟网络计算认证中应答的系统600中，代理服务器替代客户端完成VNC认证中的应答，与现有技术相比，不需要将用户敏感数据口令传输到非信任域，避免了现有技术中将口令传输到非信任域导致敏感数据泄露或遭到暴力破解的问题，由此，提高了VNC认证过程中的安全性。另一方面，按照RFB协议处理过程，客户端仍然接收挑战信息并返回应答值的过程，减少了对现有技术中的RFB协议处理过程的影响，提高了VNC认证 过程中的信息安全。
上文中结合图1至图6，详细描述了根据本发明实施例所提供的一种虚拟网络计算VNC认证中应答的方法，下面将结合图7至图8，描述根据本发明实施例所提供的虚拟网络计算VNC认证的装置和代理服务器。
图7为本发明提供的一种代理服务器700的示意图，如图所示，所述代理服务器700包括接收单元701、加密单元702和发送单元703；其中
所述接收单元701，用于接收控制器发送的口令；接收服务端发送的挑战信息，所述挑战信息为所述服务端基于虚拟网络计算认证生成；
所述加密单元702，用于根据所述接收单元701接收的所述口令和所述挑战信息确定第一应答值；
所述发送单元703，用于将所述加密单元702确定的所述第一应答值发送给所述服务端。
值得说明的是，本发明实施例的代理服务器700可以通过专用集成电路(Application Specific Integrated Circuit，ASIC)实现，或可编程逻辑器件(Programmable Logic Device，PLD)实现，上述PLD可以是复杂程序逻辑器件(Complex Programmable Logic Device，CPLD)，现场可编程门阵列(Field－Programmable Gate Array，FPGA)，通用阵列逻辑(Generic Array Logic，GAL)或其任意组合。通过软件实现图4所示的VNC认证中应答的方法时，代理服务器700及其各个模块也可以为软件模块。
具体地，挑战信息为16位字节的随机数，代理服务器根据口令和挑战信息按照预定义数据加密算法对挑战信息进行加密确定第一应答值。
值得说明的是，预定义数据加密算法可以为安全哈希算法(Secure Hash Algorithm，SHA)，也可以按照数据加密标准(Data Encryption Standard，DES)等其他数据加密算法进行加密，本发明不作限制。
通过上述代理服务器700的描述，代理服务器可以替代客户端完成VNC认证中的应答过程，与现有技术相比，避免了客户端完成应答过程时需将用户敏感数据传输到非信任域的网络环境而导致敏感数据泄露或遭到暴力破解的问题，提高了VNC认证过程中的安全性。
可选地，所述代理服务器还包括替换单元704；
所述发送单元703，还用于在将所述加密单元702确定的所述第一应答 值发送给所述服务端之前向客户端发送所述挑战信息；
所述接收单元701，还用于接收所述客户端发送的应答消息，所述应答消息中包括第二应答值，所述第二应答值为所述挑战信息；
所述替换单元704，用于将所述应答消息中的所述第二应答值替换为所述第一应答值；
则所述发送单元703将所述加密单元702确定的所述第一应答值发送给所述服务端具体为：
将所述应答消息发送给所述服务端。
具体地，第二应答值即为挑战信息，具体为客户端未对挑战信息进行处理，直接将挑战信息作为应答值，以应答消息形式发送给代理服务器。而代理服务器会将应答消息中的第二应答值替换为第一应答值，并发送给服务端，服务端会根据口令和挑战信息按照与代理服务器相同的预定义数据加密算法确定第三应答值，当接收到第一应答值时，比较第一应答值和第三应答值，若二者相同，则VNC认证成功；若二者不同，则VNC认证失败，终止本次VNC连接请求。
值得说明的是，控制器在初始化阶段会为每个服务端生成一个口令，作为VNC登陆密码，并将该口令发送给服务端，用于确定代理服务器发送的应答值是否认证成功。
可选地，所述代理服务器还包括处理单元705；
所述接收单元701，还用于在接收所述控制器发送的口令之前接收来自客户端的连接请求；
所述处理单元705，用于获取所述客户端的连接请求中的令牌；
所述发送单元703，还用于向所述控制器发送所述令牌；
则所述接收单元701接收所述控制器发送的口令具体为：
接收来自所述控制器的鉴权成功消息，所述鉴权成功消息中携带所述服务端的IP、端口号、及所述口令。
具体地，若鉴权成功，则控制器向代理服务器发送鉴权成功消息，该鉴权成功消息中携带服务端的IP、端口号和口令，其中，端口号为VNC服务的端口号；若鉴权失败，则终止本次VNC连接请求。
值得说明的是，若客户端请求建立VNC连接的目标服务端为虚拟机，则服务端的IP为虚拟机所在服务器的IP，端口号为虚拟机所在服务器分配的 唯一标识该虚拟机VNC服务的端口号。
可选地，所述处理单元705，还用于根据所述接收单元701接收的所述鉴权成功消息中的所述服务端的IP和所述端口号与所述服务端建立连接；
所述接收单元701，还用于接收所述服务端发送的第一协议版本信息，所述第一协议版本信息为所述服务端所支持的最高的协议版本；
所述发送单元703，还用于向所述客户端发送所述接收单元接收的所述第一协议版本信息；
所述接收单元701，还用于接收所述客户端发送的第二协议版本信息，所述第二版本信息为不高于所述第一协议版本信息且为所述客户端所支持的最高的协议版本；
所述发送单元703，还用于向所述服务端发送所述接收单元701接收的所述第二协议版本信息。
进一步地，在RFB协议的握手阶段，服务端和客户端确定本次VNC连接请求的协议版本后，会继续协商本次VNC连接请求的安全认证类型，具体安全认证类型确定过程的方法如下所述：
可选地，所述接收单元701，还用于接收所述服务端发送的第一安全认证类型，所述第一安全认证类型中包括所述服务端所支持的所有安全认证类型；
所述发送单元703，还用于向所述客户端发送所述接收单元701接收的所述第一安全认证类型；
所述接收单元701，还用于接收所述客户端发送的第二安全认证类型，所述第二安全认证类型为在所述第一安全认证类型中所述客户端所支持的最高级别的安全认证类型；
所述发送单元703，还用于向所述服务端发送所述接收单元701接收的所述第二安全认证类型。
值得说明的是，第一安全认证类型仅用于标识服务端向代理服务器发送的安全认证类型，并不代表数量。
具体地，若服务端确定的安全认证类型为VNC认证，则服务端和客户端按照VNC认证类型完成安全认证；若服务端确定协商的安全认证类型为不需要认证，则客户端和服务端之间无需认证；若服务端确定协商的安全认证类型为非法，则客户端和服务端之间的VNC会话结束。
可选地，在具体实施过程中，为保证系统安全性，通常由服务端指定安全认证类型，即服务端发送的第一安全认证类型为所指定的安全认证类型，若客户端返回的第二安全认证类型与第一安全认证类型不同，则协商安全认证类型的过程失败，终止本次VNC连接请求。
通过上述代理服务器700的描述，服务端和客户端协商确定本次VNC连接请求的协议版本和安全认证类型，在接收服务端根据VNC认证生成的挑战信息时，代理服务器利用挑战信息和口令完成VNC认证中的应答过程，与现有技术相比，代理服务器可以替代客户端完成与服务端的VNC认证中的应答过程，避免了用户敏感数据传输到非信任域造成信息泄露或暴力破解的问题，提高了VNC认证过程中的安全性。
综上所述，通过上述代理服务器700接收到挑战信息后，由代理服务器替代客户端完成VNC认证中的应答过程，与现有技术相比，不需要将用户敏感数据口令传输到非信任域，即可完成VNC认证中的应答过程，避免了现有技术中将口令传输到非信任域导致敏感数据泄露或遭到暴力破解的问题，由此，提高了VNC认证过程中的安全性。另一方面，按照RFB协议处理过程，客户端仍然接收挑战信息并返回应答值的过程，减少了对现有技术中的RFB协议处理过程的影响，提高了VNC认证过程中的信息安全。
图8为本发明提供的一种代理服务器800的示意图，如图所示，所述代理服务器800包括处理器801、存储器802、通信接口803、总线804，所述处理器801、存储器802和通信接口803之间通过总线804连接并完成相互间的通信，所述存储器802中用于存储计算机执行指令，所述代理服务器800运行时，所述处理器801执行所述存储器802中的计算机执行指令以利用所述代理服务器800中的硬件资源执行以下操作：
接收控制器发送的口令；
接收服务端发送的挑战信息，所述挑战信息为所述服务端基于所述VNC认证生成；
根据所述口令和所述挑战信息确定第一应答值；
将所述第一应答值发送给所述服务端。
根据本发明实施例的代理服务器800可对应于执行本发明实施例中描述的方法，并且代理服务器800中的各个单元的上述和其它操作和/或功能 分别为了实现图2至图5中的各个方法的相应流程，为了简洁，在此不再赘述。
通过上述代理服务器800的描述，在VNC认证应答过程中，代理服务器800可以代替客户端完成对服务端发送的挑战信息的应答过程，与现有技术相比，避免将用户敏感数据在非信任域中传输和存储而导致的数据泄露或遭到暴力破解的问题，提升了虚拟网络计算认证过程中的安全性。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部 分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应所述以权利要求的保护范围为准。

Claims (16)

  1. 一种虚拟网络计算认证中应答的方法，其特征在于，所述方法包括：
    代理服务器接收控制器发送的口令；
    所述代理服务器接收服务端发送的挑战信息，所述挑战信息为所述服务端基于所述虚拟网络计算认证生成；
    所述代理服务器根据所述口令和所述挑战信息确定第一应答值；
    所述代理服务器将所述第一应答值发送给所述服务端。
  2. 根据权利要求1所述方法，其特征在于，在所述代理服务器将所述第一应答值发送给所述服务端之前，所述方法还包括：
    所述代理服务器向客户端发送所述挑战信息；
    所述代理服务器接收所述客户端发送的应答消息，所述应答消息中包括第二应答值，所述第二应答值为所述挑战信息；
    所述代理服务器将所述应答消息中的所述第二应答值替换为所述第一应答值；
    则所述代理服务器将所述第一应答值发送给所述服务端具体为：
    将所述应答消息发送给所述服务端。
  3. 根据权利要求1至2中任一项所述方法，其特征在于，所述方法还包括：
    所述服务端接收所述控制器发送的所述口令；
    所述服务端根据所述口令和所述挑战信息确定第三应答值；
    若所述服务端确定所述第一应答值和所述第三应答值相同，则所述虚拟网络计算认证成功。
  4. 根据权利要求1所述方法，其特征在于，在所述代理服务器接收控制器发送的口令之前，所述方法还包括：
    所述代理服务器接收来自客户端的连接请求；
    所述代理服务器获取所述客户端的连接请求中的令牌；
    所述代理服务器向所述控制器发送所述令牌，以使得所述控制器根据所述令牌对所述客户端进行鉴权；
    则所述代理服务器接收控制器发送的口令具体为:
    所述代理服务器接收来自所述控制器的鉴权成功消息，所述鉴权成功消息中携带所述服务端的IP、端口号、及所述口令。
  5. 根据权利要求4所述方法，其特征在于，在所述代理服务器接收控制器发送的口令之后，所述方法还包括：
    所述代理服务器根据所述服务端的IP和所述端口号与所述服务端建立连接；
    所述代理服务器接收所述服务端发送的第一协议版本信息，所述第一协议版本信息为所述服务端所支持的最高的协议版本；
    所述代理服务器向所述客户端发送所述第一协议版本信息；
    所述代理服务器接收所述客户端发送的第二协议版本信息，所述第二版本信息为不高于所述第一协议版本信息且为所述客户端所支持的最高的协议版本；
    所述代理服务器向所述服务端发送所述第二协议版本信息，以使得所述服务端根据所述第二协议版本信息确定用于与所述客户端通信的协议版本。
  6. 根据权利要求5所述方法，其特征在于，所述方法还包括：
    所述代理服务器接收所述服务端发送的第一安全认证类型，所述第一安全认证类型中包括所述服务端所支持的所有安全认证类型；
    所述代理服务器向所述客户端发送所述第一安全认证类型；
    所述代理服务器接收所述客户端发送的第二安全认证类型，所述第二安全认证类型为在所述第一安全认证类型中所述客户端所支持的最高级别的安全认证类型；
    所述代理服务器向所述服务端发送所述第二安全认证类型，以使得所述服务端根据所述第二安全认证类型确定所述客户端和所述服务端的安全认证类型。
  7. 一种虚拟网络计算认证中应答的系统，其特征在于，所述系统包括控制器、客户端、代理服务器和服务端；
    所述客户端，用于向所述代理服务器发送连接请求；
    所述代理服务器，用于获取所述连接请求中的令牌；将所述令牌发送给所述控制器进行鉴权；
    所述控制器，用于根据所述令牌对所述客户端进行鉴权；若鉴权成功，则向所述代理服务器发送鉴权成功消息，所述鉴权成功消息中携带所述服务端的IP、端口号、口令；
    所述代理服务器，还用于接收所述控制器发送的所述鉴权成功消息；根 据所述服务端的IP和所述端口号与所述服务端建立连接；
    所述服务端，用于基于所述虚拟网络认证生成挑战信息,并将所述挑战信息发送给所述代理服务器；
    所述代理服务器，还用于接收所述挑战信息；根据所述口令和所述挑战信息确定第一应答值；将所述第一应答值发送给所述服务端。
  8. 根据权利要求7所述系统，其特征在于，
    所述代理服务器，还用于在将所述第一应答值发送给所述服务端之前向所述客户端发送所述挑战信息；接收所述客户端发送的应答消息，所述应答消息中包括第二应答值，所述第二应答值为所述挑战信息；将所述应答消息中的所述第二应答值替换为所述第一应答值；
    则所述代理服务器将所述第一应答值发送给所述服务端具体为：
    将所述应答消息发送给所述服务端。
  9. 根据权利要求7和8中任一所述系统，其特征在于，
    所述服务端，还用于接收所述控制器发送的所述口令；根据所述口令和所述挑战信息确定第三应答值；若确定所述第一应答值和所述第三应答值相同，则所述虚拟网络计算认证成功。
  10. 根据权利要求7所述系统，其特征在于，
    所述控制器，还用于接收来自所述客户端的虚拟网络计算连接请求；根据所述虚拟网络计算连接请求获取虚拟网络计算连接信息，所述虚拟网络计算连接信息包括所述代理服务器的统一资源定位符、所述服务端的IP、所述端口号、令牌和所述口令；向所述客户端发送所述虚拟网络计算连接信息中的所述代理服务器的统一资源定位符和所述令牌；
    所述客户端，还用于根据所述代理服务器的统一资源定位符和所述令牌与所述代理服务器建立连接。
  11. 一种代理服务器，其特征在于，所述代理服务器包括接收单元、加密单元、发送单元；其中
    所述接收单元，用于接收控制器发送的口令；接收服务端发送的挑战信息，所述挑战信息为所述服务端基于虚拟网络计算认证生成；
    所述加密单元，用于根据所述接收单元接收的所述口令和所述挑战信息确定第一应答值；
    所述发送单元，用于将所述加密单元确定的所述第一应答值发送给所述 服务端。
  12. 根据权利要求11所述代理服务器，其特征在于，所述代理服务器还包括替换单元；
    所述发送单元，还用于在将所述加密单元确定的所述第一应答值发送给所述服务端之前向客户端发送所述挑战信息；
    所述接收单元，还用于接收所述客户端发送的应答消息，所述应答消息中包括第二应答值，所述第二应答值为所述挑战信息；
    所述替换单元，用于将所述应答消息中的所述第二应答值替换为所述第一应答值；
    则所述发送单元将所述加密单元确定的所述第一应答值发送给所述服务端具体为：
    将所述应答消息发送给所述服务端。
  13. 根据权利要求11所述代理服务器，其特征在于，所述代理服务器还包括处理单元；
    所述接收单元，还用于在接收所述控制器发送的口令之前接收来自客户端的连接请求；
    所述处理单元，用于获取所述客户端的连接请求中的令牌；
    所述发送单元，还用于向所述控制器发送所述令牌；
    则所述接收单元接收所述控制器发送的口令具体为：
    接收来自所述控制器的鉴权成功消息，所述鉴权成功消息中携带所述服务端的IP、端口号、及所述口令。
  14. 根据权利要求13所述代理服务器，其特征在于，
    所述处理单元，还用于根据所述接收单元接收的所述鉴权成功消息中的所述服务端的IP和所述端口号与所述服务端建立连接；
    所述接收单元，还用于接收所述服务端发送的第一协议版本信息，所述第一协议版本信息为所述服务端所支持的最高的协议版本；
    所述发送单元，还用于向所述客户端发送所述第一协议版本信息；
    所述接收单元，还用于接收所述客户端发送的第二协议版本信息，所述第二版本信息为不高于所述第一协议版本信息且为所述客户端所支持的最高的协议版本；
    所述发送单元，还用于向所述服务端发送所述第二协议版本信息。
  15. 根据权利要求14所述代理服务器，其特征在于，
    所述接收单元，还用于接收所述服务端发送的第一安全认证类型，所述第一安全认证类型中包括所述服务端所支持的所有安全认证类型；
    所述发送单元，还用于向所述客户端发送所述第一安全认证类型；
    所述接收单元，还用于接收所述客户端发送的第二安全认证类型，所述第二安全认证类型为在所述第一安全认证类型中所述客户端所支持的最高级别的安全认证类型；
    所述发送单元，还用于向所述服务端发送所述第二安全认证类型。
  16. 一种代理服务器，其特征在于，所述代理服务器包括处理器、存储器、通信接口、总线，所述处理器、存储器和通信接口之间通过总线连接并完成相互间的通信，所述存储器中用于存储计算机执行指令，所述代理服务器运行时，所述处理器执行所述存储器中的计算机执行指令以利用所述代理服务器中的硬件资源执行权利要求1、2、4至6中任一所述的方法。
PCT/CN2016/090058 2016-07-14 2016-07-14 一种虚拟网络计算认证中应答的方法、装置、系统和代理服务器 WO2018010146A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP16890125.4A EP3300331B1 (en) 2016-07-14 2016-07-14 Response method, apparatus and system in virtual network computing authentication, and proxy server
PCT/CN2016/090058 WO2018010146A1 (zh) 2016-07-14 2016-07-14 一种虚拟网络计算认证中应答的方法、装置、系统和代理服务器
CN201680004718.5A CN107113319B (zh) 2016-07-14 2016-07-14 一种虚拟网络计算认证中应答的方法、装置、系统和代理服务器
US15/845,631 US11140162B2 (en) 2016-07-14 2017-12-18 Response method and system in virtual network computing authentication, and proxy server

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/090058 WO2018010146A1 (zh) 2016-07-14 2016-07-14 一种虚拟网络计算认证中应答的方法、装置、系统和代理服务器

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/845,631 Continuation US11140162B2 (en) 2016-07-14 2017-12-18 Response method and system in virtual network computing authentication, and proxy server

Publications (1)

Publication Number Publication Date
WO2018010146A1 true WO2018010146A1 (zh) 2018-01-18

Family

ID=59676323

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/090058 WO2018010146A1 (zh) 2016-07-14 2016-07-14 一种虚拟网络计算认证中应答的方法、装置、系统和代理服务器

Country Status (4)

Country Link
US (1) US11140162B2 (zh)
EP (1) EP3300331B1 (zh)
CN (1) CN107113319B (zh)
WO (1) WO2018010146A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110072074A (zh) * 2019-06-05 2019-07-30 黑龙江航天信息有限公司 一种一键呼叫咨询服务及远程协助的系统及其方法
CN114619462A (zh) * 2022-02-21 2022-06-14 达而观信息科技（上海）有限公司 一种基于机器人流程自动化的远程桌面控制方法

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109471713B (zh) * 2017-09-07 2022-11-08 北京京东尚科信息技术有限公司 用于查询信息的方法和装置
PL3782058T3 (pl) * 2018-04-20 2024-07-29 Vishal Gupta Zdecentralizowany silnik weryfikacji dokumentów i jednostek
CN108786115B (zh) * 2018-05-03 2021-06-01 南京赛宁信息技术有限公司 基于透明代理生成CTF动态Flag的方法及系统
US20200026742A1 (en) * 2018-05-28 2020-01-23 Open Invention Network Llc Integrating communications into a social graph
CN110032414B (zh) * 2019-03-06 2023-06-06 联想企业解决方案(新加坡)有限公司 远程控制台模式下安全的用户认证的装置和方法
US11876798B2 (en) * 2019-05-20 2024-01-16 Citrix Systems, Inc. Virtual delivery appliance and system with remote authentication and related methods
US20210092107A1 (en) * 2019-09-23 2021-03-25 Fisher-Rosemount Systems, Inc. Secure off-premises access of process control data by a mobile device
US11900138B2 (en) * 2020-01-17 2024-02-13 Vmware, Inc. Remote access control of VM console located in cloud from on-premises computer device
US11063979B1 (en) * 2020-05-18 2021-07-13 Capital One Services, Llc Enabling communications between applications in a mobile operating system
CN111984958B (zh) * 2020-08-06 2024-02-02 成都安恒信息技术有限公司 一种支持vnc双因子的认证方法
CN112104614B (zh) * 2020-08-24 2023-02-28 广州江南科友科技股份有限公司 密码机可代理监控方法、装置、设备及存储介质
JP2022186165A (ja) * 2021-06-04 2022-12-15 キヤノン株式会社 情報処理システム、情報処理装置とその制御方法及びプログラム
CN116132422B (zh) * 2023-04-19 2023-06-27 天津卓朗昆仑云软件技术有限公司 输入设备的权限控制方法、装置、服务器及可读存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101645775A (zh) * 2008-08-05 2010-02-10 北京灵创科新科技有限公司 基于空中下载的动态口令身份认证系统
CN102523207A (zh) * 2011-12-06 2012-06-27 北京航空航天大学 基于虚拟网络计算机的远程资源访问方法及代理设备
US20140310787A1 (en) * 2013-04-10 2014-10-16 Realvnc Ltd Method and Apparatus for Remote Connection
CN105359486A (zh) * 2013-05-03 2016-02-24 思杰系统有限公司 使用代理安全访问资源

Family Cites Families (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6606663B1 (en) * 1998-09-29 2003-08-12 Openwave Systems Inc. Method and apparatus for caching credentials in proxy servers for wireless user agents
US7088720B1 (en) * 2000-08-07 2006-08-08 Sbc Technology Resources, Inc. Multiservice use of network connection capability under user-to-network interface signaling
DE10296675T5 (de) 2001-04-20 2004-04-22 Egenera Inc., Marlboro Virtuelles Vernetzungssystem und -verfahren in einem Verarbeitungssystem
US7984157B2 (en) * 2002-02-26 2011-07-19 Citrix Systems, Inc. Persistent and reliable session securely traversing network components using an encapsulating protocol
US20040123144A1 (en) * 2002-12-19 2004-06-24 International Business Machines Corporation Method and system for authentication using forms-based single-sign-on operations
US8074259B1 (en) * 2005-04-28 2011-12-06 Sonicwall, Inc. Authentication mark-up data of multiple local area networks
US20060269066A1 (en) * 2005-05-06 2006-11-30 Schweitzer Engineering Laboratories, Inc. System and method for converting serial data into secure data packets configured for wireless transmission in a power system
US8527774B2 (en) * 2009-05-28 2013-09-03 Kaazing Corporation System and methods for providing stateless security management for web applications using non-HTTP communications protocols
US8910245B2 (en) * 2010-11-05 2014-12-09 Citrix Systems, Inc. Systems and methods for managing domain name system security (DNSSEC)
WO2012162843A1 (en) * 2011-06-03 2012-12-06 Research In Motion Limted System and method for accessing private networks
US9154479B1 (en) * 2012-09-14 2015-10-06 Amazon Technologies, Inc. Secure proxy
US9325687B2 (en) * 2013-10-31 2016-04-26 Cellco Partnership Remote authentication using mobile single sign on credentials
EP3080948B1 (en) * 2013-12-12 2019-03-20 BlackBerry Limited Secure communication channels
JP6190538B2 (ja) * 2014-09-01 2017-08-30 パスロジ株式会社 ユーザ認証方法及びこれを実現するためのシステム
US10277578B2 (en) * 2015-01-05 2019-04-30 Citrix Systems, Inc. Securing network activity managed by operating systems
JP6350302B2 (ja) * 2015-01-22 2018-07-04 オムロン株式会社 プログラマブル表示器
CN104639562B (zh) * 2015-02-27 2018-03-13 飞天诚信科技股份有限公司 一种推送认证的系统和设备的工作方法
CN105071941B (zh) * 2015-07-31 2019-01-18 华为技术有限公司 分布式系统节点身份认证方法及装置
US10404663B1 (en) * 2016-02-29 2019-09-03 Parallels International Gmbh File sharing over secure connections

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101645775A (zh) * 2008-08-05 2010-02-10 北京灵创科新科技有限公司 基于空中下载的动态口令身份认证系统
CN102523207A (zh) * 2011-12-06 2012-06-27 北京航空航天大学 基于虚拟网络计算机的远程资源访问方法及代理设备
US20140310787A1 (en) * 2013-04-10 2014-10-16 Realvnc Ltd Method and Apparatus for Remote Connection
CN105359486A (zh) * 2013-05-03 2016-02-24 思杰系统有限公司 使用代理安全访问资源

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3300331A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110072074A (zh) * 2019-06-05 2019-07-30 黑龙江航天信息有限公司 一种一键呼叫咨询服务及远程协助的系统及其方法
CN114619462A (zh) * 2022-02-21 2022-06-14 达而观信息科技（上海）有限公司 一种基于机器人流程自动化的远程桌面控制方法

Also Published As

Publication number Publication date
EP3300331B1 (en) 2019-11-20
US11140162B2 (en) 2021-10-05
EP3300331A4 (en) 2018-05-16
CN107113319B (zh) 2020-09-25
CN107113319A (zh) 2017-08-29
EP3300331A1 (en) 2018-03-28
US20180124051A1 (en) 2018-05-03

Similar Documents

Publication Publication Date Title
WO2018010146A1 (zh) 一种虚拟网络计算认证中应答的方法、装置、系统和代理服务器
US11546309B2 (en) Secure session capability using public-key cryptography without access to the private key
JP7457173B2 (ja) モノのインターネット（ｉｏｔ）デバイスの管理
US10893031B2 (en) Dynamically serving digital certificates based on secure session properties
RU2439692C2 (ru) Управляемое политиками делегирование учетных данных для единой регистрации в сети и защищенного доступа к сетевым ресурсам
US20150188779A1 (en) Split-application infrastructure
CN112714053B (zh) 通信连接方法及装置
US20170111269A1 (en) Secure, anonymous networking
CN111226418A (zh) 针对跨网络周边防火墙的设备使能零接触引导
US11784993B2 (en) Cross site request forgery (CSRF) protection for web browsers
KR20150058220A (ko) 웹 서비스를 안전하게 액세스하기 위한 방법 및 디바이스
JP2024525557A (ja) アクセス制御方法、アクセス制御システム、および関連デバイス
US8676998B2 (en) Reverse network authentication for nonstandard threat profiles
CN114301968B (zh) 服务端的访问方法、系统、设备及存储介质
US11888898B2 (en) Network configuration security using encrypted transport
US11924286B2 (en) Encrypted communication processing apparatus, encrypted communication processing system, and non-transitory recording medium
CN118057762A (zh) 数据采集方法、装置、相关设备和程序产品

Legal Events

Date Code Title Description
REEP Request for entry into the european phase

Ref document number: 2016890125

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2016890125

Country of ref document: EP

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16890125

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE