CN109150863B - Desktop cloud access control method and device and desktop cloud terminal equipment - Google Patents

Abstract

The present application provides a desktop cloud access control method, device, and desktop cloud terminal device. The method includes: a security login module of the desktop cloud detects a USB key removal event, and the USB key removal event is used to indicate the required login to the desktop cloud. The USB key is removed from the desktop cloud terminal device; the secure login module determines that the USB key is mapped to the virtual machine that provides the desktop cloud; the secure login module controls the desktop cloud to be in an accessible state that can be accessed by desktop cloud users. In the method of the embodiment of the present application, the secure login module can determine that the USBkey removal event is triggered because the USBkey is mapped to the virtual machine through the state of the USBkey, thereby controlling the desktop cloud to be in an accessible state, which is beneficial to improve user experience.

Description

Access control method and device for desktop cloud, and desktop cloud terminal device

technical field

The present application relates to the field of information technology, and more particularly, to a desktop cloud access control method, apparatus, and desktop cloud terminal device.

Background technique

Desktop cloud is a virtual desktop application based on cloud computing platform. By deploying software and hardware on the cloud platform, users can access cross-platform applications through thin client (TC) or any other device connected to the network. programs, and the entire client desktop. The desktop cloud can replace the traditional personal computer (personal computer, PC) for office work. At present, the desktop cloud is also widely used in industries with high security levels such as the government, the military, and banks. In order to meet the security level requirements of these industries, users need to use USBkey for identity authentication and log in to the desktop cloud.

During the process of logging in to the desktop cloud through a USB key, you need to map the USB key from the desktop cloud client to the virtual machine that provides the desktop cloud, perform identity authentication, and obtain the permission to access the virtual machine, so as to access the desktop cloud by accessing the virtual machine.

However, in the above process of logging in to the desktop cloud, in order to obtain the permission to access the virtual machine, it is necessary to map the USB key from the desktop cloud client to the virtual machine. At this time, for the desktop cloud client, since the USB key cannot be detected, If the USB key is considered to be removed, the desktop cloud will be controlled to be in a prohibited access state, so that the desktop cloud users can no longer access the desktop cloud client.

SUMMARY OF THE INVENTION

The present application provides a desktop cloud access control method, device and desktop cloud terminal device to improve user experience.

In a first aspect, an access control method for a desktop cloud is provided, which is characterized in that: the security login module of the desktop cloud detects a USB key removal event, and the USB key removal event is used to indicate the USB key required for logging in to the desktop cloud. removed from the desktop cloud terminal device; the secure login module determines that the USB key is mapped to the virtual machine that provides the desktop cloud; the secure login module controls the desktop cloud to be accessible by desktop cloud users state.

In the embodiment of the present application, after the security login module detects a USB key removal event, and the USB key removal event is triggered by the USB key being mapped to the virtual machine of the desktop cloud, the security login module controls the desktop cloud to be accessible In the process of logging in to the desktop cloud through the USB key, after the USB key is mapped to the virtual machine, the security login module mistakenly thinks that the USB key has been removed, resulting in the control of the desktop cloud being in a prohibited access state. , which is beneficial to improve the user experience of the desktop cloud.

In a possible implementation manner, the method further includes: receiving, by the secure login module, first indication information sent by the desktop cloud client, where the first indication information is used to instruct the USB key from the virtual The security login module controls the desktop cloud to be in a prohibited access state that is prohibited from being accessed by the desktop cloud user.

The aforementioned access prohibited state may include interrupting the desktop protocol of the desktop cloud, and/or the terminal controlling the desktop cloud being in a locked screen state. Of course, after only interrupting the desktop protocol of the desktop cloud, the user can still operate the desktop cloud terminal device, but cannot log in to the desktop cloud. At this time, the desktop cloud terminal device is similar to a traditional PC.

In the embodiment of the present application, the secure login module communicates with the desktop cloud client and controls the desktop cloud to be in a forbidden access state after learning that the USB key is removed from the virtual machine, which is beneficial to improve the security performance of the desktop cloud.

In a possible implementation manner, the secure login module determining that the USB key is mapped to the virtual machine that provides the desktop cloud includes: the secure login module obtains the status of the USB key, and the status of the USB key is: mapped to the virtual machine.

In a possible implementation manner, before the security login module acquires the state of the USB key, the method further includes: the security login module receives the second indication information sent by the client of the desktop cloud, The second indication information is used to instruct the USBkey to be mapped from the desktop cloud terminal device to the virtual machine; the security login module modifies the state of the USBkey according to the indication information.

It should be noted that the above-mentioned security login module modifies the status of the USBkey before the security login module of the desktop cloud detects the USBkey removal event, so as to improve the accuracy of the security login module to obtain the USBkey and avoid the security login module When the status of the USBkey is not modified, the USBkey removal event has been detected, which is beneficial to improve the accuracy of the security login module to control desktop cloud access.

In a possible implementation manner, the secure login module determines that the USB key is mapped to the virtual machine that provides the desktop cloud through USB mapping, including: the secure login module queries the device recorded by the desktop cloud terminal device In the directory, the port for accessing the USBkey is recorded; the security login module determines that the USBkey is mapped to the virtual machine.

In a possible implementation manner, the method further includes: the secure login module determines that the USB key is mapped from the virtual machine to the desktop cloud terminal device; the secure login module controls the desktop cloud to be disabled Access prohibited status accessed by the desktop cloud user.

In the embodiment of the present application, the security login module determines that the USB key is mapped from the virtual machine to the desktop cloud terminal device, and controls the desktop cloud to be in a state of forbidden access, so as to improve the security of the desktop cloud.

In a second aspect, an access control apparatus for a desktop cloud is provided, and the apparatus includes various modules for executing the above method.

In a third aspect, a desktop cloud terminal device is provided, including a processor and a memory. The memory is used to store a computer program, and the processor is used to call and execute the computer program from the memory, so that the controller executes the above method.

In a fourth aspect, a computer program product is provided, the computer program product comprising: computer program code, when the computer program code is run on a computer, causing the computer to perform the methods in the above aspects.

It should be noted that the above computer program codes may be stored in whole or in part on the first storage medium, wherein the first storage medium may be packaged with the processor or separately packaged with the processor, which is not specifically limited in this application .

In a fifth aspect, a computer-readable medium is provided, and the computer-readable medium stores program code, which, when the computer program code is executed on a computer, causes the computer to execute the methods in the above-mentioned aspects.

Description of drawings

FIG. 1 is a schematic diagram of a desktop cloud system used in an embodiment of the present application.

FIG. 2 is a schematic flowchart of an access control method for a desktop cloud according to an embodiment of the present application.

FIG. 3 is a schematic diagram of an access control apparatus for a desktop cloud according to an embodiment of the present application.

FIG. 4 is a schematic block diagram of a desktop cloud terminal device according to an embodiment of the present application.

Detailed ways

The technical solutions in the present application will be described below with reference to the accompanying drawings.

FIG. 1 is a schematic diagram of a desktop cloud system used in an embodiment of the present application. The desktop cloud system 100 shown in FIG. 1 includes a desktop cloud terminal device 110 and a desktop cloud platform 120 .

The desktop cloud terminal device 110 is used to provide a user interface for the desktop cloud. The desktop cloud terminal device may be provided with a secure login module 111 and a desktop cloud client 112 .

For example, the desktop cloud terminal device 110 may be a thin client or any other device connected to the network. The thin client (or thin terminal) performs hardware-level transcoding on the built-in storage, and the transcoding algorithm is bound to the unique information of the hardware. The TC system can be embedded in a simplified Linux OS or Windows embedded in the OS, and the TC has no local storage.

The secure login module 111 is configured to control the access state of the desktop cloud, wherein the access state includes an accessible state that can be accessed by the desktop cloud user and an access forbidden state that prohibits the desktop cloud user from accessing.

The desktop cloud client 112, also known as the desktop protocol client, is used to communicate with the desktop protocol server of the desktop cloud platform to establish a desktop protocol channel.

The desktop cloud platform 120 is used to manage and schedule desktop cloud resources. For example, the cloud management FusionManager can be used to uniformly integrate the interface of the desktop cloud service maintenance system, the interface of the virtualization platform, and the interface of the hardware management system. Taking the Huawei desktop cloud platform as an example, the desktop cloud platform may include a web interface (WI), a Huawei desktop controller (Huawei desktop controller), GaussDB, an ITA node, a license node, and the like.

WI: Provides a web login interface for users. When a user initiates a login request, it forwards the user's login information (encrypted user name and password) to the HDC. The WI presents the virtual machine list provided by the HDC to the user and provides access to the virtual machine for the user. Provide entrance.

Huawei Desktop Controller (HDC): It is the core component of the desktop cloud management system. It provides virtual desktop service provisioning, virtual desktop management, virtual desktop login management, and virtual machine policy management functions.

GaussDB: Provides a database for ITA and HDC to store data information, such as the association between virtual machines and users, desktop groups, virtual machine naming rules, and scheduled task information.

ITA node: ITA provides interfaces and Portal functions for users to manage virtual IT assets, and realizes functions such as virtual machine creation and allocation, virtual machine state management, virtual machine image management, and operation and maintenance of virtual desktop systems.

License node: The system for managing and issuing desktop cloud licenses. The license server is used for the number of users connected to the desktop cloud by the controller.

TC management: Centralized management of thin terminals, including version upgrade, status management, information monitoring, log management, etc.

In the traditional process of logging in to the desktop cloud based on the USB key, in order to obtain the permission to access the virtual machine, it is necessary to map the USB key from the desktop cloud client to the virtual machine. At this time, for the desktop cloud client, since the USB key cannot be detected The desktop cloud client will be locked, so that desktop cloud users can no longer access the desktop cloud client. However, this situation of actually mapping the USB key to the virtual machine is only for authentication in the virtual machine, so that the user can select the virtual machine to access the desktop cloud. This situation of mapping the USB key to the virtual machine is different from the situation of logging out of the desktop cloud due to physically pulling out the USB key. In this scenario, the user still needs to access the desktop cloud, and the user has permission to access the desktop cloud (the USB key still inserted in the desktop cloud client).

Therefore, in order to prevent the desktop cloud from being in a forbidden access state due to the USBkey being mapped to the virtual machine in the above scenario, the present application provides an access control method for the desktop cloud, which performs login authentication according to whether the USBkey is mapped to the virtual machine, In this way, the state of the desktop cloud is controlled to be accessible or forbidden.

The method of the embodiment of the present application is described below with reference to FIG. 2 . FIG. 2 is a schematic flowchart of an access control method for a desktop cloud according to an embodiment of the present application. It should be understood that the method shown in FIG. 2 may be executed by the secure login module 111 shown in FIG. 1 .

210. The secure login module of the desktop cloud detects a USB key removal event, where the USB key removal event is used to instruct that the USB key required for logging in to the desktop cloud is removed from the desktop cloud terminal device.

It should be noted that there are various USB devices used in desktop cloud terminal devices, including U disk, USBkey, etc. In order to distinguish, the USBkey removal event and the removal event of other USB devices can be determined by the PID/VID information of the USBkey Whether the current removal event is a USBkey removal event or a USB removal event.

220. The secure login module determines that the USB key is mapped to the virtual machine that provides the desktop cloud, where the mapping may be PC/SC mapping, or a mapping manner such as USB mapping.

The above USBkey is mapped to the virtual machine that provides the desktop cloud, which can be understood as providing the identity authentication information in the USBkey to the virtual machine, so that the virtual machine can determine whether the user has the right to use the virtual machine according to the identity authentication information.

Optionally, the above step 220 includes: the security login module obtains the status of the USB key, and the status of the USB key is mapped to the virtual machine.

The secure login module can record the status of the USBkey, and determine whether the USBkey is physically pulled out from the desktop cloud terminal device or the USBkey is mapped to the virtual machine when the above-mentioned USBkey removal event is detected based on the status of the USBkey. Correspondingly, when the above is used to indicate that the USBkey is mapped to the virtual machine, the state of the USBkey may be referred to as being in the virtual machine.

The above function of recording the status of the USBkey can be implemented by the secure login module, but the operations related to mapping the USBkey to the virtual machine are mainly performed by the desktop cloud client. That is to say, the desktop cloud client needs to notify the security login module of the current USBkey. status so that the secure login module records the status of the USBkey.

That is, before the security login module of the desktop cloud detects the USB key removal event, the method further includes: the security login module receives the second indication information sent by the client of the desktop cloud, the second indication The information is used to instruct the USBkey to be mapped from the desktop cloud terminal device to the virtual machine; the security login module modifies the state of the USBkey according to the indication information.

It should be noted that the above-mentioned desktop cloud client notifies the security login module to record the status of the USBkey, which may be before the desktop cloud client maps the USBkey to the virtual machine, so as to prevent the desktop cloud client from mapping the USBkey to the virtual machine before it is too late. When the security login module is notified to record the status of the USBkey, the security login module has detected the above USBkey removal event. At this time, the security login module controls the desktop cloud to be in a prohibited access state because it cannot know the exact status of the USBkey. Of course, in the embodiment of the present application, the notification of the status of the USB key to the security login module can also be performed after the desktop cloud client maps the USB key to the virtual machine, and this execution sequence may cause the security login module to misjudge.

The above-mentioned communication mechanism of the desktop cloud client notifying the security login module to record the status of the USBkey can reuse the system event processing mechanism in the operating system, that is, the desktop cloud client generates a USBkey removal event, and generates the above-mentioned second USBkey removal event according to the USBkey removal event. Indication information to notify the secure login module to record the status of the USBkey. Specifically, the above-mentioned system event for instructing the mapping of the USBkey to the virtual machine may be instructed to map the USBkey from the desktop cloud client to the virtual machine event (USBkey FROM TC TO VM EVT).

Optionally, as an embodiment, step 220 includes: the security login module queries the device directory recorded by the desktop cloud terminal device to record the port for accessing the USBkey; the security login module determines the USBkey mapping into the virtual machine.

In other operating systems, such as Linux operating systems, it is also possible to distinguish whether the USBkey is mapped to the virtual machine or whether the USBkey is mapped to the virtual machine by querying the device directory (for example, dev/bus/usb) in the operating system that also records the port information of the USBkey. Unplugged from the desktop cloud terminal device. That is, if the port information of the USBkey cannot be queried in the device directory, it means that the USBkey has been removed from the desktop cloud terminal device; if the port information of the USBkey can be queried in the device directory, it means that the USBkey is mapped to the virtual machine.

230. The secure login module controls the desktop cloud to be in an accessible state that can be accessed by desktop cloud users.

The above-mentioned desktop cloud is in an accessible state, the desktop protocol that may include the desktop cloud can communicate normally, and the display screen of the terminal device of the desktop cloud is not locked.

In the embodiment of the present application, after the security login module detects a USB key removal event, and the USB key removal event is triggered by the USB key being mapped to the virtual machine of the desktop cloud, the security login module controls the desktop cloud to be accessible In the process of logging in to the desktop cloud through the USB key, after the USB key is mapped to the virtual machine, the security login module mistakenly thinks that the USB key has been removed, resulting in the control of the desktop cloud being in a prohibited access state. , which is beneficial to improve the user experience of the desktop cloud.

Optionally, as an embodiment, the method further includes: receiving, by the secure login module, first indication information sent by the desktop cloud client, where the first indication information is used to instruct the USB key from the virtual The security login module controls the desktop cloud to be in a prohibited access state that is prohibited from being accessed by the desktop cloud user.

If the USBkey is mapped to the virtual machine, the secure login module receives the first instruction information sent by the desktop cloud client, indicating that the USBkey is removed from the virtual machine. At this time, the secure login module can control the desktop cloud to be in a prohibited access state. .

The above access prohibited state may include interrupting the desktop protocol of the desktop cloud, and further, the terminal of the desktop cloud may be controlled to be in a locked screen state. Of course, after only interrupting the desktop protocol of the desktop cloud, the user can still operate the desktop cloud terminal device, but cannot log in to the desktop cloud. At this time, the desktop cloud terminal device is similar to a traditional PC.

It should be noted that the above-mentioned mechanism for the desktop cloud client to send the first indication information to the security login module is the same as the mechanism for the desktop cloud client to send the second indication information to the security login module above, and existing operations can be reused. The event handling mechanism in the system. Of course, the system event that triggers the second indication information can be named as USBkey REMOVE FROM VM EVT.

In the embodiment of the present application, the secure login module communicates with the desktop cloud client and controls the desktop cloud to be in a forbidden access state after learning that the USB key is removed from the virtual machine, which is beneficial to improve the security performance of the desktop cloud.

Optionally, as an embodiment, the method further includes: the security login module determines that the USB key is mapped from the virtual machine to the desktop cloud terminal device; the security login module controls the desktop cloud to be disabled Access prohibited status accessed by the desktop cloud user.

The way that the above-mentioned secure login module determines that the USB key is mapped from the virtual machine to the desktop cloud terminal device is the same as the way that the above-mentioned security login module determines that the USB key is mapped from the desktop cloud terminal device to the virtual machine.

The naming of the above-mentioned system event for instructing the mapping of the USBkey from the virtual machine to the desktop cloud terminal device may be the system event (USBkey FROM VM TO TCEVT) of the USBkey mapping from the virtual machine to the desktop cloud terminal device.

The system event that the above-mentioned USB key is mapped from the virtual machine to the desktop cloud terminal device may be when the desktop cloud user wishes to exit the virtual machine, and at this time, the above-mentioned forbidden access state may only be to disconnect the desktop protocol of the desktop cloud, so that It is used to log in to the virtual machine on the desktop cloud terminal device, but the user can still operate the desktop cloud client in the same way as operating a PC. Of course, the secure login module can also lock the desktop cloud terminal device at the same time, which is not specifically limited in this embodiment of the present application.

In the embodiment of the present application, the security login module determines that the USB key is mapped from the virtual machine to the desktop cloud terminal device, and controls the desktop cloud to be in a state of forbidden access, so as to improve the security of the desktop cloud.

Optionally, as an embodiment, when logging in to the desktop cloud terminal device, when the desktop cloud terminal device sends a login request to the desktop cloud platform, the WI located on the desktop cloud platform can randomly generate a login password and return it to the desktop cloud controller cache. , so that subsequent users can log in to the virtual machine for use. The valid times of the above randomly generated password can be set to 1 time, that is, each login request needs to correspond to a new login password, so as to improve the security of the user login virtual.

The access control method for the desktop cloud according to the embodiment of the present invention is described in detail above with reference to FIG. 1 and FIG. 2 , and the apparatus of the embodiment of the present invention is described in detail below with reference to FIG. 3 and FIG. 4 . It should be noted that the apparatuses shown in FIG. 3 to FIG. 4 can implement each step in the above method, which is not repeated here for brevity.

FIG. 3 is a schematic diagram of an access control apparatus for a desktop cloud according to an embodiment of the present application. The apparatus 300 shown in FIG. 3 includes a detection module 310 , a processing module 320 and a control module 330 .

The detection module 310 is configured to detect a USBkey removal event, where the USBkey removal event is used to instruct the USBkey required for logging in to the desktop cloud to be removed from the desktop cloud terminal device;

a processing module 320, configured to determine that the USB key is mapped to the virtual machine that provides the desktop cloud;

The control module 330 is configured to control the desktop cloud to be in an accessible state that can be accessed by desktop cloud users.

Optionally, as an embodiment, the control module is further configured to: receive first indication information sent by the desktop cloud client, where the first indication information is used to instruct the USBkey to delete from the virtual machine Remove; control the desktop cloud to be in a prohibited access state that is prohibited from being accessed by the desktop cloud user.

Optionally, as an embodiment, the processing module is configured to: acquire the state of the USB key, where the state of the USB key is mapped to the virtual machine.

Optionally, as an embodiment, the processing module is further configured to: receive second indication information sent by the client of the desktop cloud, where the second indication information is used to instruct the USBkey to download from the desktop cloud terminal. The device is mapped to the virtual machine; the state of the USB key is modified according to the indication information.

Optionally, as an embodiment, the processing module is further configured to: query the device directory recorded by the desktop cloud terminal device to record the port for accessing the USBkey; determine that the USBkey is mapped to the virtual machine .

Optionally, as an embodiment, the control module is further configured to: determine that the USB key is mapped from the virtual machine to the desktop cloud terminal device; control the desktop cloud to be in a state that is prohibited from being accessed by the desktop cloud user. Access forbidden state.

In an optional embodiment, the above-mentioned apparatus 300 may also be a desktop cloud terminal device 400. Specifically, the detection module 310, the processing module 320 and the control module 330 may be the processor 420, and the apparatus may also be A memory 410 and an input/output interface 430 may be included, as shown in FIG. 4 .

FIG. 4 is a schematic block diagram of a desktop cloud terminal device according to an embodiment of the present application. The desktop cloud terminal device 400 shown in FIG. 4 may include: a memory 410 , a processor 420 and an input/output interface 430 . The memory 410, the processor 420 and the input/output interface 430 are connected through an internal connection path, the memory 410 is used for storing program instructions, and the processor 420 is used for executing the program instructions stored in the memory 420 to control the input/output interface 430 receives input data and information, and outputs data such as operation results.

It should be understood that, in this embodiment of the present application, the processor 420 may adopt a general central processing unit (Central Processing Unit, CPU), a microprocessor, an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits The circuit is used to execute the relevant program to realize the technical solutions provided by the embodiments of the present application.

The memory 410 , which may include read-only memory and random access memory, provides instructions and data to the processor 420 . A portion of processor 420 may also include non-volatile random access memory. For example, the processor 420 may also store device type information.

In the implementation process, each step of the above-mentioned method may be completed by an integrated logic circuit of hardware in the processor 420 or an instruction in the form of software. The methods disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor. The software modules may be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art. The storage medium is located in the memory 410, and the processor 420 reads the information in the memory 410, and completes the steps of the above method in combination with its hardware. To avoid repetition, detailed description is omitted here.

It should be understood that in this embodiment of the present application, the processor may be a central processing unit (central processing unit, CPU), and the processor may also be other general-purpose processors, digital signal processors (digital signal processors, DSP), application-specific integrated circuits ( application specific integrated circuit, ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described systems, devices and units may refer to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.

The functions, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution, and the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, removable hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program codes .

The above are only specific embodiments of the present application, but the protection scope of the present application is not limited to this. should be covered within the scope of protection of this application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims (14)

1. An access control method of a desktop cloud, comprising:

the method comprises the steps that a security login module of the desktop cloud detects a USBKey removal event, wherein the USBKey removal event is used for indicating that the USBKey required for logging in the desktop cloud is removed from the desktop cloud terminal equipment;

the security login module determines that the USBKey is mapped to a virtual machine providing the desktop cloud;

the security login module controls the desktop cloud to be in an accessible state which can be accessed by a desktop cloud user.

2. The method of claim 1, wherein the method further comprises:

the security login module receives first indication information sent by a client of the desktop cloud, wherein the first indication information is used for indicating that the USBKey is removed from the virtual machine;

the security login module controls the desktop cloud to be in an access prohibition state of prohibiting being accessed by the desktop cloud user.

3. The method of claim 1 or 2, wherein the secure login module determining that the USBKey maps into a virtual machine that provides the desktop cloud comprises:

and the security login module acquires the state of the USBKey, and the state of the USBKey is mapped to the virtual machine.

4. The method of claim 3, wherein prior to the secure login module obtaining the status of the USBKey,

the method further comprises the following steps:

the security login module receives second indication information sent by a client of the desktop cloud, wherein the second indication information is used for indicating the USBKey to be mapped to the virtual machine from the desktop cloud terminal equipment;

and the safety login module modifies the state of the USBKey according to the indication information.

5. The method of claim 1 or 2, wherein the secure login module determining that the USBKey is mapped into a virtual machine providing the desktop cloud via a USB mapping comprises:

the security login module inquires the device directory recorded by the desktop cloud terminal device, and records a port for accessing the USBKey;

and the safety login module determines that the USBKey is mapped to the virtual machine.

6. The method of claim 1 or 2, wherein the method further comprises:

the security login module determines that the USBKey is mapped to the desktop cloud terminal equipment from the virtual machine;

the security login module controls the desktop cloud to be in an access prohibition state of prohibiting being accessed by the desktop cloud user.

7. An access control apparatus of a desktop cloud, comprising:

the detection module is used for detecting a USBKey removal event, wherein the USBKey removal event is used for indicating that the USBKey required by logging in the desktop cloud is removed from the desktop cloud terminal equipment;

the processing module is used for determining that the USBKey is mapped to a virtual machine providing the desktop cloud;

and the control module is used for controlling the desktop cloud to be in an accessible state which can be accessed by a desktop cloud user.

8. The apparatus of claim 7, wherein the control module is further to:

receiving first indication information sent by a client of the desktop cloud, wherein the first indication information is used for indicating that the USBKey is removed from the virtual machine;

and controlling the desktop cloud to be in an access prohibition state which prohibits the desktop cloud user from accessing.

9. The apparatus of claim 7 or 8, wherein the processing module is to:

and acquiring the state of the USBKey, wherein the state of the USBKey is mapped to the virtual machine.

10. The apparatus of claim 9, wherein the processing module is further to:

receiving second indication information sent by a client of the desktop cloud, wherein the second indication information is used for indicating that the USBKey is mapped to the virtual machine from the desktop cloud terminal equipment;

and modifying the state of the USBKey according to the indication information.

11. The apparatus of claim 7 or 8, wherein the processing module is further to:

inquiring an equipment directory recorded by the desktop cloud terminal equipment, wherein a port for accessing the USBKey is recorded;

determining that the USBKey is mapped into the virtual machine.

12. The apparatus of claim 7 or 8, wherein the control module is further to:

determining that the USBKey is mapped to the desktop cloud terminal equipment from the virtual machine;

and controlling the desktop cloud to be in an access prohibition state which prohibits the desktop cloud user from accessing.

13. A desktop cloud terminal device, characterized in that the desktop cloud terminal device comprises a secure login module of a desktop cloud and a desktop cloud client, the secure login module performing the method of any one of claims 1-6.

14. A computer-readable medium, characterized in that the computer-readable medium has stored program code which, when run on a computer, causes the computer to perform the method according to any one of claims 1-6.

Images