CN106549976B - A user identity authentication method and system configuration method suitable for transparent computing systems - Google Patents

Abstract

The invention discloses a user identity authentication method and a system configuration method suitable for a transparent computing system. The authentication method includes that when the user starts up and logs in, the client sends login request information to the authentication server, and the authentication server queries the background database to obtain user information. The list of operating system permissions to start is sent to the client; the user selects an operating system and initiates a remote loading request to the storage server; the storage server authenticates the user name and password of the client, and checks the configuration file of the user’s operating system image after the authentication is passed. The client's IP and the IP setting of the operating system image to be started determine whether the authentication is successful or not. The system configuration method is used to configure a transparent computing system using the user identity authentication method. The present invention realizes user authority management, can provide some personalized services, and improves user experience.

Description

A User Identity Authentication Method and System Configuration Applicable to Transparent Computing System method

technical field

The invention relates to the field of transparent computing systems, in particular to a user identity authentication method suitable for a transparent computing system and a configuration method of a transparent computing system using the user identity authentication method.

Background technique

Transparent computing is a kind of user does not need to perceive the specific location of the computer operating system, middleware, application program and communication network, but only needs to use the network from various clients (including fixed, mobile, and home) according to their own needs. The computing mode that selects and uses corresponding services (such as computing, telephone, TV, Internet access and entertainment, etc.) The characteristics of the transparent computing system mainly include the following points:

Ⅰ. Separation of storage and computing. The transparent computing system is divided into two parts: the client and the server. The client used by the user does not need to install any operating system and application software in advance, and all software resources are uniformly stored in the server. When a user accesses a transparent computing server, software resources are loaded on-demand and executed and computed locally.

Ⅱ. Cross-terminal and cross-operating system platform support. Users can access the transparent computing server on any terminal to obtain the required services, and select the operating system platform according to their needs. For the client, there is no need or minimal installation and configuration of the client before use to improve user experience.

Ⅲ. The instruction and data are transmitted in block format between the client and the server. When the client loads the operating system remotely, it does not need to download the entire operating system to run locally, but divides the data stored in the server into data blocks of the same size. The client only downloads the required part of the data blocks, and all data blocks are Transmission in the form of data stream.

However, the current identity authentication of transparent computing has the following disadvantages:

(1) The traditional static password authentication technology, which only identifies users by username and password, is no longer suitable for the new transparent computing model. Transparent computing provides the operating system as a service to users, and the storage server responsible for storing the operating system image and the authentication server responsible for user rights management are separated from each other. Simply verifying one of them cannot guarantee the security of user data. If an illegal user If you know the address of the operating system image, you can bypass the authentication server and directly start the operating system image of the storage server, causing security issues such as user data leakage.

(2) New identity authentication technologies such as SMS passwords and dynamic passwords need to be completed with the assistance of a third party. Using this method will inevitably share the user's personal information with the third party, which is not what the user wants to see.

(3) Transparent computing is playing an increasingly important role in fields such as medical care and education, and these fields have a common feature: Intranets are all assigned IP addresses in a static IP manner. The advantage of IP is that the intranet user IP will not conflict, and it is easy to locate faults, and a dedicated network administrator is responsible for IP management. However, the transparent computing system still adopts the method of dynamically obtaining IP. When end users run the instance operating system, it is impossible to identify the user's identity in real time, which is not conducive to fault location and troubleshooting.

Contents of the invention

The purpose of the present invention is to provide a user identity authentication method suitable for a transparent computing system and a configuration method of a transparent computing system using the user identity authentication method, so as to solve the problem that the current single identity authentication of transparent computing easily causes user data leakage and requires assistance from a third party And technical problems that cannot identify users in real time.

In order to achieve the above object, the present invention provides a user identity authentication method suitable for a transparent computing system, which includes performing the following authentication steps when the user logs in after powering on the computer:

S1: The client obtains the IP in a static manner, and the DHCP server statically assigns the IP according to the configuration file bound to the MAC and IP;

S2: The client sends login request information to the authentication server, and the login request information includes the address of the authentication server, user name and password;

S3: The authentication server queries the background database, obtains the user-startable operating system permission list, writes text information and sends it to the client, and the text information includes user ID, operating system number and operating system name;

S4: The user selects the operating system to be remotely loaded through the client, and initiates a remote loading request to the storage server. The loading request information includes the user name, password, storage server address and the unique identifier of the remote operating system image;

S5: The storage server authenticates the user name and password from the client that initiates the remote loading request, checks the configuration file of the user's operating system image after the authentication is passed, and confirms whether the IP of the client is consistent with the IP setting of the operating system image to be started, such as If they are consistent, it is determined that the user identity authentication is successful.

As a further improvement of the user identity authentication method of the present invention:

In steps S2 and S3, the client communicates with the authentication server using the http protocol; in steps S4 and S5, the client communicates with the storage server using the iSCSI protocol.

As a general technical idea, the present invention also provides a system configuration method for a transparent computing system using the above-mentioned user identity authentication method suitable for a transparent computing system, including the following steps:

1) Add network configuration and user identity authentication policy code to the network boot program NBP source code, and recompile to generate the NBP boot program;

2) Erase the main boot partition MBR in BIOS mode on the client's hard disk, and replace the original main boot partition MBR with the compiled NBP boot program;

3) Configure the MySQL and Tomcat services of the authentication server, and deploy the identity authentication daemon on Tomcat;

4) Configure the iSCSI service of the storage server, bind the user operating system image to the user name and password, modify the access rights of the operating system image, and set the IP address that can be accessed;

5) Modify the configuration file of the DHCP server, assign IP in a static manner, and bind the physical address of the client applying the transparent computing system to the IP;

6) Create a remote-loaded user operating system image, modify the network configuration file of each operating system kernel, and store the created operating system image in the location specified in the iSCSI configuration file.

The present invention has the following beneficial effects:

1. The user identity authentication method applicable to the transparent computing system of the present invention combines the user client MAC address, IP address and user identity. When the user obtains the service, it needs to perform multiple authentications to the authentication server and the storage server, and the authentication server is responsible for For user rights management, the storage server is not only responsible for user operating system image storage, but also authenticates user identities based on user identity authentication and IP address-based authorization. The security and reliability of the transparent computing system are enhanced, and for intranet users such as hospitals and schools, it is easier to troubleshoot and locate when the operating system on the client side fails. In addition, the web authentication server of the transparent computing system realizes user rights management, which can not only provide unified services for all users, but also provide some personalized services for users with different rights. For example, each user has a different bootable The operating system list, etc., improve the user experience.

2. The system configuration method of the transparent computing system using the aforementioned user identity authentication method of the present invention is simple and easy to implement; the user authentication strategy is modularized, which reduces the difficulty of transplantation and expands the scope of application.

In addition to the objects, features and advantages described above, the present invention has other objects, features and advantages. The present invention will be described in further detail below with reference to the accompanying drawings.

Description of drawings

The accompanying drawings constituting a part of this application are used to provide further understanding of the present invention, and the schematic embodiments and descriptions of the present invention are used to explain the present invention, and do not constitute an improper limitation of the present invention. In the attached picture:

Fig. 1 is the overall structural block diagram of the transparent computing system of preferred embodiment 1 of the present invention;

FIG. 2 is a schematic flow diagram of a user identity authentication method applicable to a transparent computing system according to preferred embodiment 1 of the present invention;

Fig. 3 is a schematic diagram of the data format of the login request information sent by the client to the authentication server in preferred embodiment 1 of the present invention;

Fig. 4 is a schematic diagram of the data format of the authentication server responding to the text information of the client in the preferred embodiment 1 of the present invention;

5 is a schematic flowchart of a user identity authentication method applicable to a transparent computing system according to preferred embodiment 2 of the present invention;

Fig. 6 is a flow chart of the system configuration method of the transparent computing system using the user identity authentication method of the present invention according to the preferred embodiment 3 of the present invention.

Detailed ways

The embodiments of the present invention will be described in detail below with reference to the accompanying drawings, but the present invention can be implemented in many different ways defined and covered by the claims.

Example 1:

Fig. 1 shows the overall structural block diagram of the transparent computing system of the present embodiment, and the client hardware platform is the mobile panel of x86 structure, and its hard disk burns the network boot program NBP (according to the network boot program written by open source project) in advance; The end consists of two parts: the authentication server responsible for user rights information management (that is, the Web authentication server) and the storage server responsible for user operating system image storage. The storage server needs to be configured with iSCSI service and DHCP service, and the web authentication server needs to be configured with MySQL service and Tomcat service (see Example 3).

Referring to Fig. 2, the user identity authentication method applicable to the transparent computing system of the present embodiment includes the following steps:

S201: The client is powered on and logged in, and first performs network configuration to obtain an IP address in a static manner, and the DHCP server statically assigns an IP according to a configuration file bound with MAC and IP.

S202: The client sends login request information to the authentication server, and the terminal boot program sends the login request information composed of the URL address of the Web authentication server, user name and password information (the data format of the login request information is shown in Figure 3) to The web authentication server performs authentication.

S203: The web authentication server queries the background MySQL database according to the received client user name and password information, and obtains the operating system authority list of the user.

S204: The web authentication server program writes the query results including user permission information (that is, which operating systems are available for users to remotely load) into text information according to the data format shown in Figure 4, and the text information includes user identification (Access field) , operating system number (Count field), operating system name (OS_name field) and terminator (Flag field), and send them to the client through the http protocol.

S205: The client searches the memory for the text data returned by the web authentication server, and parses out user permission information such as the user ID (Access field), the number of operating systems (Count field), and the name of the operating system (OS_name field).

S206: Present user permission information (that is, a list of operating systems to choose) on the client screen for the user to choose, and initiate a remote loading request to the storage server according to the operating system selected by the user, that is, the client sends a loading request to the storage server Request information, loading request information includes user name, password, storage server address and unique identifier of the remote operating system image. The authentication server is responsible for user rights management (whether the user exists in the database, which operating systems the user has available for remote loading), and the storage server also configures the user name and password in the configuration file for each operating system image, which is used for storage server End-based user authentication. In this step, no matter whether the user exists or not, a feedback is required. The user ID determines whether the user exists, and the non-existing user cannot perform subsequent authentication. There is at least one system for the user to choose, and the name of the system will be displayed back to the client.

S207: The storage server authenticates the user name and password of the client that initiates the remote loading request.

S208: storing the server's request for passing the authentication of the user name and password, querying the access rights configuration file, and verifying whether the IP address of the requesting client is allowed to load the operating system image.

S209: The IP address authentication is passed, the terminal loads the remote operating system to run locally as required, and the data is transmitted in stream blocks.

With static allocation of IP, the DHCP server will bind MAC and IP, and the storage server is equipped with user name password and IP restrictions. Therefore, the storage server configuration file must be consistent with the DHCP server configuration file. The client has a username, password, and MAC address, the DHCP server has a MAC address, and IP address, and the storage server has a username, password, and IP address. The configurations of these three parts must be consistent, otherwise the authentication will not succeed. Because the binding of MAC and IP is a static distribution mode provided by DHCP, the present invention mainly combines IP authorization, and then combines MAC.

Example 2:

Referring to Fig. 5, the user identity authentication method applicable to the transparent computing system of the present embodiment includes the following steps:

When the user boots up and logs in, the following authentication steps are performed:

S1: The client sends a login request packet to the authentication server. The login request information (see FIG. 3 ) includes the authentication server address, user name and password.

S2: The authentication server queries the background database, obtains the operating system permission list that the user can start, writes text information and sends it to the client, and the text information (see Figure 4) includes user ID, operating system number, operating system name and terminator.

S3: The user selects the operating system to be remotely loaded through the client, and initiates a remote loading request to the storage server. The loading request information includes the user name, password, storage server address, and the unique identifier of the remote operating system image.

S4: The storage server authenticates the user name and password from the client that initiates the remote loading request, checks the configuration file of the user operating system image after the authentication is passed, and confirms whether the IP of the client is consistent with the IP setting of the operating system image to be started, such as If they are consistent, it is determined that the user identity authentication is successful.

After the user authentication is successful, the operating system image instance is remotely loaded to the client to run, and the current user is set to be online.

To sum up, the user identity authentication method applicable to the transparent computing system of the present invention no longer simply uses the user name and password, but binds the user operating system image with the IP address of the client used by the user, and uses statically allocated IP addresses. Only when the IP address, MAC address, and username and password are correct can the operating system image instance be remotely loaded and run locally, which enhances the security and reliability of the transparent computing system, and is suitable for intranet users such as hospitals and schools, and customers When the operating system running on the terminal fails, it is easier to troubleshoot and locate.

In addition, the web authentication server of the transparent computing system realizes user rights management, which can not only provide unified services for all users, but also provide some personalized services for users with different rights. For example, each user has a different bootable The operating system list, etc., improve the user experience.

Example 3:

Referring to Fig. 6, the system configuration method of the transparent computing system using the user identity authentication method of embodiment 1 or embodiment 2 includes the following steps:

1) Add network configuration and user authentication policy codes to the bootloader NBP source code, and recompile to generate the NBP bootloader;

2) Erase the main boot partition MBR in BIOS mode on the client's hard disk, and burn the compiled NBP boot program to the original main boot partition MBR location;

3) Configure the MySQL and Tomcat services of the authentication server, and deploy the identity authentication background program on the Tomcat of the Web authentication server;

4) Configure the iSCSI service of the storage server, bind the user operating system image to the user name and password, modify the access rights of the operating system image, and set the IP address that can be accessed;

5) Modify the configuration file of the DHCP server, assign IP in a static manner, and bind the physical address of the client applying the transparent computing system to the IP;

6) Create a remote-loaded user operating system image, modify the network configuration file of each operating system kernel, and store the created operating system image in the specified location in the iSCSI configuration file.

The above system configuration method is simple and easy to implement; the user authentication strategy is modularized, which reduces the difficulty of transplantation and expands the scope of application.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (3)

1. a kind of method for authenticating user identity suitable for transparent computing system, which is characterized in that including being logged in when user is switched on When, execute following authenticating step:

S1: client obtains IP, the configuration file static allocation IP that Dynamic Host Configuration Protocol server is bound according to MAC and IP in a static manner；

S2: client send landing request information to certificate server, the landing request information include address of the authentication server, Username and password；

S3: certificate server inquires background data base, obtains the bootable operating system permissions list of the user and text is written This information is sent to client, and the text information includes user identifier, operating system quantity and OS name；

S4: user selects to want the operating system of remote loading by client, initiates remote loading request to storage server, The load request information includes user name, password, storage server address and remote operating system mirror image unique identification；

S5: storage server authenticates the username and password from the client for initiating remote loading request, and certification is logical Later check the configuration file of operating system of user mirror image, and confirm client IP whether with by operating system mirror to be started The IP setting of picture is consistent, such as consistent, then determines user identity authentication success.

2. the method for authenticating user identity according to claim 1 suitable for transparent computing system, which is characterized in that described In step S2 and S3, the client is communicated with the certificate server using http agreement；In the step S4 and S5, The client is communicated with the storage server using iSCSI protocol.

3. a kind of using as claimed in claim 1 or 2 suitable for the transparent of the method for authenticating user identity of transparent computing system The ' In System Reconfiguration Method of computing system, which comprises the following steps:

1) network configuration, user identity authentication pol-icy code are added in network boot NBP source code, and recompilate generation NBP bootstrap；

2) the main boot subregion MBR under the BIOS mode on the hard disk of client is wiped, is replaced with the NBP bootstrap that compiling generates Change former main boot subregion MBR；

3) MySQL and the Tomcat service of certificate server are configured, and authentication background program is deployed on Tomcat；

4) iSCSI service for configuring storage server, by operating system of user mirror image and user name and cryptographic binding, modification operation The access authority of system image, and the IP address being able to access that is set；

5) configuration file for modifying Dynamic Host Configuration Protocol server, distributes IP in a static manner, by the client of application transparent computing system Physical address and IP are bound；

6) the operating system of user mirror image for making remote loading, modifies the network profile of each operating system nucleus, will make The position that the operating system mirrored storage performed is specified in iSCSI configuration file.