TWI815523B - Remote login method - Google Patents

Abstract

A remote login method, executed by a baseboard management control unit of a computer device, comprising the following steps: (A) receiving a login request; (B) determining whether the login is successful according to the login request; (C) When it is determined that step (B) is positive, the baseboard management control unit resets a number of failed logins and a cumulative time of failed logins; (D) when it is determined that step (B) is negative, the baseboard management control unit determines whether the number of failed logins is greater than or equal to a preset value; (E) when it is determined that step (D) is negative, the baseboard management control unit updates the number of failed logins and the accumulated time of failed logins; (F) when it is determined that step (D) is positive, the baseboard management control unit determines whether the accumulated time of failed logins is less than or equal to t preset time; (G) when it is determined that step (F) is negative, the baseboard management control unit resets the number of failed logins and the accumulated time of failed logins; and (H) when it is determined that step (F) is positive, the baseboard management control unit locks the remote login.

Description

Remote login method

The present invention relates to a login method, in particular to a remote login method.

Existing information technology personnel often manage and control servers remotely through the Internet. However, because the servers are connected to the Internet, the servers are also exposed to hacker attacks. Among them, hackers most often use distributed blocking. Distributed denial-of-service attack (DDoS attack) uses a large number of legitimate or forged requests to occupy a large amount of network and system resources, causing the target server's network or system resources to be exhausted, and the service to be temporarily interrupted or stopped. , rendering the server inaccessible to users.

Since the session of the Baseboard Management Controller (BMC) in the server does not prevent multiple external devices from accessing the BMC at the same time, the BMC is potentially vulnerable to DDoS attacks.

According to the Payment Card Industry Alliance (PCI)/Product Security Standard (PIN Transaction Security, PTS) version 5 B10 specification, it is stipulated that only 120 ISO format 0 encrypted PINs can be obtained within an hour. BLOCK to prevent hackers from intercepting a large number of PIN BLOCK packets (packets encrypted with a fixed key) and parsing the key information to obtain the user's PIN CODE (unencrypted clear data) content.

Currently, BMC refers to the practice in the B10 specification. Each time a login fails, you must wait for a period of time to reduce the number of network attacks. Specifically, the current practice is to wait for 30 seconds after each remote login failure, so that a maximum of 120 logins can occur in an hour.

However, it is very inconvenient to have to wait 30 seconds after each failed login.

Therefore, the purpose of the present invention is to provide a remote login method that does not require waiting for repeated login and can prevent hacker attacks.

Therefore, the remote login method of the present invention is executed by a computer device. The computer device includes a communication unit, a storage unit and a base management control unit electrically connected to the communication unit and the storage unit. The communication unit passes through a communication network. Connected to a client, the storage unit stores an account and password information, a number of failed logins, and a cumulative failed login time. The method includes one step (A), one step (B), one step (C), and one step ( D), one step (E), one step (F), one step (G), and one step (H).

In the step (A), the baseboard management control unit receives a login request from the client including an account and password information through the communication unit.

In step (B), the baseboard management control unit determines whether the login is successful based on the account password information and the account password data of the login request.

In step (C), when it is determined that login is successful, the baseboard management control unit resets the number of login failures and the accumulated login failure time.

In step (D), when it is determined that login fails, the baseboard management control unit determines whether the number of failed logins is greater than or equal to a preset value.

In step (E), when it is determined that the number of failed logins is less than the preset value, the baseboard management control unit updates the number of failed logins and the accumulated time of failed logins.

In step (F), when it is determined that the number of failed logins is greater than or equal to the preset value, the baseboard management control unit determines whether the accumulated time of failed logins is less than or equal to a preset time.

In step (G), when it is determined that the cumulative login failure time is greater than the preset time, the baseboard management control unit resets the login failure count and the login failure cumulative time.

In this step (H), when it is determined that the accumulated login failure time is less than or equal to the preset time, the baseboard management control unit locks the remote login.

The effect of the present invention is: before the baseboard management control unit determines that the number of failed logins is greater than or equal to the preset value and the accumulated time of failed logins is less than or equal to the preset time, it can log in continuously without waiting time, and After it is determined that the number of failed logins is greater than or equal to the preset value and the accumulated time of failed logins is less than or equal to the preset time, the remote login is locked, complying with the B10 specification to prevent hacker attacks.

Before the present invention is described in detail, it should be noted that similar elements are represented by the same numbers in the following description.

Referring to Figure 1, a computer device 11 used to implement an embodiment of the remote login method of the present invention is illustrated, including a storage unit 111, a communication unit 112, and a substrate electrically connected to the storage unit 111 and the communication unit 112. Management control unit 113, the communication unit 112 consists of a communication network 12 and a client 13. The storage unit 111 stores an account password information, a number of failed logins, a cumulative time of failed logins, and a status flag. The number of failed logins is initially 0, the cumulative time of failed logins is initially 0, and a flag of the status flag. The flag value is one of a first predetermined value indicating that remote login is locked, and a second predetermined value that is different from the first predetermined value and indicates that remote login is unlocked. The computer device 11 is, for example, a server, the baseboard management control unit 113 is, for example, a baseboard management controller, the communication network 12 is, for example, the Internet, and the client 13 is, for example, a personal computer or a laptop. But it is not limited to this.

Referring to Figures 1 and 2, this embodiment of the remote login method of the present invention is shown. The steps included in this embodiment will be described below.

In step 201 , the baseboard management control unit 113 receives a login request from the client 13 including an account and password information via the communication unit 112 .

In step 202, the baseboard management control unit 113 determines whether the remote login is locked. When the baseboard management control unit 113 determines that the remote login is locked, the process proceeds to step 203; and when the baseboard management control unit 113 determines that the remote login is not locked, the process proceeds to step 206.

It is worth noting that in this embodiment, the baseboard management control unit 113 determines whether the flag value of the status flag is the first predetermined value to determine whether remote login is locked, but is not limited to this.

In step 203, the baseboard management control unit 113 determines whether an unlocking instruction related to local login is received. When the substrate management control unit 113 determines that the unlocking instruction is not received, the process proceeds to step 204; and when the substrate management control unit 113 determines that the unlocking instruction is received, the process proceeds to step 205.

It is worth noting that in this embodiment, the user must successfully log in locally before generating the unlocking command, but this is not a limitation.

In step 204, the baseboard management control unit 113 sends a warning message indicating that local login is required for unlocking to the client 12 via the communication unit 112, and repeats step 201.

It should be noted that in other implementations, step 204 may not be included. That is, after step 203 determines that the unlocking instruction is not received, step 201 may be directly repeated, but is not limited to this.

In step 205, the substrate management control unit 113 updates the flag value of the status flag to the second predetermined value.

In step 206, the substrate management control unit 113 determines whether the login is successful based on the account password information and the account password data of the login request. When the substrate management control unit 113 determines that the login is successful, the process proceeds to step 207; and when the substrate management control unit 113 determines that the login is unsuccessful, the process proceeds to step 208.

In step 207, the baseboard management control unit 113 resets the number of login failures and the accumulated time of login failures, that is, the baseboard management control unit 113 resets the number of failed logins and the accumulated time of login failures to their initial values, and repeats Step 201.

It should be noted that when the baseboard management control unit 113 determines that the login is successful, the Intelligent Platform Management Interface (IPMI) of the baseboard management control unit is based on Serial Over LAN (SOL). The function is to transfer the serial port to the LAN port, so that the client 13 can control the computer device 11 through the LAN.

In step 208, the baseboard management control unit 113 determines whether the number of login failures is greater than or equal to a preset value. When the substrate management control unit 113 determines that it is less than the preset value, the process proceeds to step 209; and when the substrate management control unit 113 determines that it is greater than or equal to the preset value, the process proceeds to step 210.

It is worth noting that in this embodiment, the default value is 120, but it is not limited to this.

In step 209, the baseboard management control unit 113 updates the number of failed logins and the accumulated time of failed logins, and repeats step 201.

It is worth noting that, in this embodiment, the baseboard management control unit 113 adds a single statistical time related to a single login to the accumulated failed login time to update the accumulated failed login time, and adds the accumulated login time to the accumulated failed login time. The number of failed logins is increased by one to update the number of failed logins, where the single statistical time is from one relative to the first time point when step 208 is executed when the number of failed logins is reduced by one to one relevant to execution of step 208 when the number of failed logins is reduced by one. At the second time point, if it is the first time the process is executed to step 209, since the accumulated login failure time has not been updated, the accumulated login failure time is the initial value. In other words, the accumulated login failure time refers to the accumulated time from the first time point to the second time point when step 208 is performed multiple times. When step 208 is No, the process proceeds to step 209, that is, the user continues to log in and continues to accumulate the accumulated time from the first time point of the last execution of step 208 to the second time point of this execution of step 208.

It should be noted that in other implementations, the single statistical time can also be the time of each execution of step 201 to step 208, but is not limited to this.

In step 210, the baseboard management control unit 113 determines whether the accumulated login failure time is less than or equal to a preset time. When the baseboard management control unit 113 determines that the accumulated failed login time is greater than the preset time, the process proceeds to step 207; and when the baseboard management control unit 113 determines that the accumulated failed login time is less than or equal to the preset time, then The process proceeds to step 211.

It is worth noting that in this embodiment, the preset time is 3600 seconds, but it is not limited to this.

It is worth mentioning that in step 208, when the substrate management control unit 113 determines that it is less than the preset value, it means that the number of times that can be logged in has not reached the critical value. If you log in again, the process can be directly executed from step 201 to Step 206. In addition, in step 210, when the baseboard management control unit 113 determines that the accumulated login failure time is greater than the preset time, it means that the time to reset the number of login failures and the accumulated login failure time is reached, so step 207 is performed. After resetting the number of failed logins and the accumulated time of failed logins, if you log in again, the process can also be directly executed from step 201 to step 206.

In step 211, the baseboard management control unit 113 locks the remote login and executes step 207.

It is worth noting that in this embodiment, the baseboard management control unit 113 updates the flag value of the status flag to the first predetermined value to lock the remote login, but is not limited to this.

To sum up, in the remote login method of the present invention, the baseboard management control unit 113 does not need to wait before determining that the number of failed logins is greater than or equal to the preset value and the accumulated time of failed logins is less than or equal to the preset time. You can log in continuously over time, and after it is determined that the number of failed logins is greater than or equal to the preset value and the cumulative time of failed logins is less than or equal to the preset time, the remote login will be locked, complying with the B10 specification to prevent hacker attacks. Therefore, the purpose of the present invention can indeed be achieved.

However, the above are only examples of the present invention. They cannot be used to limit the scope of the present invention. All simple equivalent changes and modifications made based on the patent scope of the present invention and the contents of the patent specification are still within the scope of the present invention. within the scope covered by the patent of this invention.

11:Computer device 111:Storage unit 112: Communication unit 113:Baseboard management control unit 12:Communication network 13:User end 201~211: Steps

Other features and effects of the present invention will be clearly presented in the embodiments with reference to the drawings, in which: Figure 1 is a block diagram illustrating a computer device used to implement an embodiment of the remote login method of the present invention; and FIG. 2 is a flow chart illustrating the embodiment of the remote login method of the present invention.

201~211: Steps

Claims (10)

A remote login method is executed by a computer device. The computer device includes a communication unit, a storage unit and a base management control unit electrically connected to the communication unit and the storage unit. The communication unit is connected to a user through a communication network. At the end, the storage unit stores an account password information, a number of failed logins, and a cumulative failed login time. The method includes the following steps: (A) The baseboard management control unit receives a login request from the client including an account and password information through the communication unit; (B) The baseboard management control unit determines whether the login is successful based on the account password information and the account password information of the login request; (C) When it is determined that the login is successful, the baseboard management control unit resets the number of login failures and the accumulated login failure time; (D) When a login failure is determined, the baseboard management control unit determines whether the number of login failures is greater than or equal to a preset value; (E) When it is determined that the number of login failures is less than the preset value, the baseboard management control unit updates the number of login failures and the accumulated login failure time; (F) When it is determined that the number of failed logins is greater than or equal to the preset value, the baseboard management control unit determines whether the accumulated time of failed logins is less than or equal to a preset time; (G) When it is determined that the accumulated login failure time is greater than the preset time, the baseboard management control unit resets the number of login failures and the accumulated login failure time; and (H) When it is determined that the accumulated login failure time is less than or equal to the preset time, the baseboard management control unit locks the remote login. The remote login method described in request item 1 also includes the following steps between step (A) and step (B): (I) The baseboard management control unit determines whether remote login is locked; Wherein, when the baseboard management control unit determines that the remote login is not locked, step (B) is performed. According to the remote login method of claim 2, the storage unit also stores a status flag, a flag value of the status flag is a first predetermined value indicating that the remote login is locked, and a flag value different from the The first predetermined value indicates one of the second predetermined values of remote login unlocking, wherein, in step (1), the baseboard management control unit determines whether the flag value of the status flag is the first predetermined value. A predetermined value to determine whether the remote login is locked. The remote login method according to claim 3, wherein in step (H), the baseboard management control unit updates the flag value of the status flag to the first predetermined value to lock the remote login. The remote login method as described in request item 3 also includes the following steps after step (I): (J) When it is determined that the flag value of the status flag is the first predetermined value, the baseboard management control unit determines whether an unlocking instruction related to local login is received; and (K) When it is determined that the unlocking instruction is received, the baseboard management control unit updates the flag value of the status flag to the second predetermined value. The remote login method as described in request item 5 also includes the following steps after step (K): (L) When it is determined that the unlocking command has not been received, the baseboard management control unit sends a warning message indicating that local login is required for unlocking to the client via the communication unit. The remote login method as described in request item 1 also includes the following steps after step (H): (M) The baseboard management control unit resets the number of login failures and the accumulated login failure time. The remote login method as described in claim 1, wherein in step (E), the baseboard management control unit adds a single statistical time related to a single login to the accumulated login failure time to update the The accumulated time of failed logins, and the number of failed logins is added by one to update the number of failed logins. The remote login method as described in request item 8, wherein in step (E), the single statistical time is a correlation between the first time point when step (D) is performed when the number of failed logins is reduced by one to a correlation Perform step (D) at the second time point when the number of failed logins is reached. The remote login method as described in claim 1, wherein in step (D), the preset value is 120, and in step (F), the preset time is 3600 seconds.

Images