CN115473697B - A method and system for protecting security of out-of-band management server - Google Patents

Abstract

The invention belongs to the technical field of server security protection, and particularly provides a method and a system for protecting an out-of-band management server security, wherein the method comprises the following steps: when the client executes the IPMI command, the IPMI command is packed by adopting an IPMI service user name and a dynamic password mode to generate an IPMI command data packet; the IPMI command data packet is encrypted and then transmitted to a server through a network; the server receives the IPMI command data packet, and analyzes the received IPMI command data packet to obtain a user name and a dynamic password; consistency verification is carried out on the analyzed user name and dynamic password and the user name and dynamic password calculated in the server; if the verification is passed, executing the IPMI command and recording a log; if the verification fails, the IPMI command is not executed and the alarm is given, and the log is recorded. The problem of safety caused by password leakage is solved.

Description

A method and system for protecting security of out-of-band management server

Technical Field

The present invention relates to the technical field of server security protection, and in particular to a security protection method and system for out-of-band management servers.

Background technique

IPMI is the abbreviation of Intelligent Platform Management Interface, which is an industrial standard for managing peripheral devices used in Intel-based enterprise systems. The standard is developed by Intel, HP, NEC, Dell Computer, SuperMicro, etc. Users can use IPMI to monitor the physical health characteristics of the server, such as temperature, voltage, fan working status, power supply status, etc.

Because IPMI V2.0 supports RMCP+Authenticated Key Exchange Protocol (RAKP) authentication. A remote attacker can obtain valid user account password hash information through the HMAC in RAKP message 2 responded by the BMC. This is an inherent problem in the IPMI v2.0 specification. There is no patch for this vulnerability. In addition, the username and password of many users' IPMI services overlap with the username and password for logging into the WEB, which allows users without access rights to obtain the username and password for accessing the IPMI service through brute force cracking, thereby accessing the IPMI service that they do not have access rights to. In this way, there are certain security risks in out-of-band access. In existing technologies, strong passwords are usually used to limit the chances of success of offline dictionary attacks. Or isolated networks are used to limit access to the IPMI management interface.

Usually, strong passwords are used to limit the chances of offline dictionary attacks. Alternatively, isolated networks are used to limit access to the IPMI management interface. However, there are the following problems: the username and password used by users for IPMI services overlap with the username and password used to log in to the WEB, increasing the possibility of being cracked; VPN dial-in can bypass the isolated network to access the IPMI management interface; internal staff can obtain user passwords through legal authorization and use them illegally.

Summary of the invention

Strong passwords are usually used to limit the chances of success of offline dictionary attacks. Alternatively, an isolated network is used to limit access to the IPMI management interface. The username and password of the user using the IPMI service overlap with the username and password for logging into the WEB, increasing the possibility of being cracked; VPN dial-in can bypass the isolated network to access the IPMI management interface; internal staff can obtain user passwords through legal authorization and use them illegally. The present invention provides a security protection method and system for an out-of-band management server.

In a first aspect, the technical solution of the present invention provides a security protection method for an out-of-band management server, which is applied to a protection system, wherein the protection system includes a client and a server communicating with the client, and the client is provided with a token. The method includes the following steps:

When the client executes an IPMI command, the IPMI service user name and dynamic password are used to package the IPMI command to generate an IPMI command data packet;

Encrypt the IPMI command data packet and transmit it to the server through the network;

The server receives the IPMI command data packet and parses the received IPMI command data packet to obtain the user name and dynamic password;

The parsed user name and dynamic password are checked for consistency with the user name and dynamic password calculated inside the server;

If the verification passes, execute the IPMI command and record the log;

If the verification fails, the IPMI command will not be executed, an alarm will be given, and a log will be recorded.

The security of managing servers using IPMI commands is improved by replacing static passwords with dynamic passwords, which not only solves the security issues caused by password leakage, but also avoids user permission issues caused by duplication of web login passwords and IPMI service passwords.

Furthermore, when the client executes an IPMI command, the step of using the IPMI service user name and dynamic password to package the IPMI command to generate an IPMI command data packet includes:

The token uses the key and time base to calculate a dynamic password through a hash algorithm.

The dynamic password is updated once a minute and cannot be reused to prevent the IPMI service password from being stolen by hackers and used to attack the server.

Furthermore, the step of performing consistency verification between the parsed user name and dynamic password and the user name and dynamic password calculated inside the server includes:

The server uses the key and time base to calculate the dynamic password through the hash algorithm;

The calculated dynamic passwords are used to generate a dynamic password sequence according to the dynamic password calculation time.

Generally, a unique user ID is set for a user name. The dynamic password sequence is named in sequence based on the unique user ID. When matching a dynamic password, it is necessary to first determine the user name and then match the password based on the user name to the corresponding dynamic password sequence.

Furthermore, the token uses the key and the time base to calculate the dynamic password through a hash algorithm, including the following steps:

The key and a time base generate a set of pseudo-random numbers through a hash algorithm;

Generate a dynamic password based on the generated pseudo-random number and the set operation rules;

The dynamic password set is composed of a key and dynamic passwords generated by several time bases.

The token generates a dynamic password once a minute. Here, the keys corresponding to the client and the server are the same and based on the same time base to ensure that the generated dynamic password matches successfully.

Furthermore, when the client executes an IPMI command, the steps of packaging the IPMI command using the IPMI service user name and dynamic password to generate an IPMI command data packet include:

When the client executes an IPMI command, the current traversal pointer selects a dynamic password from the dynamic password set, and uses the IPMI service user name and the selected dynamic password to package the IPMI command to generate an IPMI command data packet.

The dynamic password is a one-time password that becomes invalid after being used once, thus ensuring the security of the server.

Furthermore, the step of performing consistency verification on the parsed user name and dynamic password with the dynamic password calculated inside the server includes:

Determine whether the parsed user name is consistent with the user name inside the server;

When the user names are the same, traverse the dynamic password sequence and match the parsed dynamic password;

If the match is successful and the verification is passed, the following steps are executed: Execute the IPMI command and record the log;

If the match fails and the verification fails, execute the following steps: Do not execute the IPMI command and issue an alarm, and record a log.

Further, the steps of traversing the dynamic password sequence and matching the parsed dynamic password include:

The parsed dynamic password is matched with the first N and last N data of the current traversal pointer position in the dynamic password sequence at the same time; the position of the traversal pointer is adjusted according to the matching result.

In order to improve the matching speed, during the process of matching the first N and last N data of the traversal pointer at the current moment, the position of the traversal pointer must be adjusted at the set time interval regardless of whether the match is successful. When the match is unsuccessful, the position of the traversal pointer is adjusted, and the first N and last N data of the adjusted traversal pointer are matched at the same time. It should be noted in the setting that N can also be adjusted according to the matching operation and results.

In a second aspect, the technical solution of the present invention provides an out-of-band management server security protection system, including a client and a server, wherein the server is provided with a BMC;

The client is used to execute IPMI commands, and uses the IPMI service user name and dynamic password to package the IPMI commands to generate IPMI command data packets; the IPMI command data packets are encrypted and transmitted to the BMC through the network;

BMC is used to receive IPMI command data packets, parse the received IPMI command data packets to obtain the user name and dynamic password; perform consistency check on the parsed user name and dynamic password with the user name and dynamic password calculated inside the BMC; if the check passes, execute the IPMI command and record the log; if the check fails, do not execute the IPMI command, issue an alarm, and record the log.

Generally, a unique user ID is set for a user name. The dynamic password sequence is named in sequence based on the unique user ID. When matching a dynamic password, it is necessary to first determine the user name and then match the password based on the user name to the corresponding dynamic password sequence.

The security of managing servers using IPMI commands is improved by replacing static passwords with dynamic passwords, which not only solves the security issues caused by password leakage, but also avoids user permission issues caused by duplication of web login passwords and IPMI service passwords.

Furthermore, the client is provided with a token, and the token uses a key and a time base to calculate a dynamic password through a hash algorithm;

The BMC is also used to calculate a dynamic password using a hash algorithm using a key and a time base; and to generate a dynamic password sequence using a number of calculated dynamic passwords according to the time of calculating the dynamic passwords.

Furthermore, the token uses a key and a time base to generate a set of pseudo-random numbers through a hash algorithm; a dynamic password is generated based on the generated pseudo-random number and the set operation rules; the dynamic passwords generated by the key and several time bases constitute a dynamic password set. The token generates a dynamic password once a minute. Here, the keys corresponding to the client and the server are the same and based on the same time base, so as to ensure that the generated dynamic passwords match successfully.

Furthermore, when the client executes an IPMI command, the steps of packaging the IPMI command using the IPMI service user name and dynamic password to generate an IPMI command data packet include:

The client is used to execute an IPMI command. The current traversal pointer selects a dynamic password from the dynamic password set, and uses the IPMI service user name and the selected dynamic password to package the IPMI command to generate an IPMI command data packet.

Furthermore, BMC is specifically used to determine whether the parsed user name is consistent with the user name inside the server; when the user names are consistent, the dynamic password sequence is traversed to match the parsed dynamic password; if the match is successful, the verification passes, the IPMI command is executed and the log is recorded; if the match fails, the verification fails, the IPMI command is not executed, an alarm is issued, and the log is recorded.

Furthermore, the BMC is also used to simultaneously match the parsed dynamic password with the first N and last N data at the current moment of the traversal pointer position in the dynamic password sequence, and adjust the position of the traversal pointer according to the matching result. In order to improve the matching speed, during the process of simultaneously matching the first N and last N data at the current moment of the traversal pointer position, the position of the traversal pointer must be adjusted regardless of whether the match is successful or not. When the match is unsuccessful, after the position of the traversal pointer is adjusted, the first N and last N data at the adjusted traversal pointer position are matched simultaneously. It should be noted in the setting that N can also be adjusted according to the matching operation and results.

It can be seen from the above technical solutions that the present invention has the following advantages: the security of managing the server using IPMI commands is improved by replacing static passwords with dynamic passwords, which solves the security problem caused by password leakage and avoids the user authority problem caused by the duplication of web login password and IPMI service password.

In addition, the invention has a reliable design principle, a simple structure and a very broad application prospect.

It can be seen that compared with the prior art, the present invention has outstanding substantive features and significant progress, and the beneficial effects of its implementation are also obvious.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

FIG1 is a schematic flow chart of a method according to an embodiment of the present invention.

FIG. 2 is a schematic flow chart of a method according to another embodiment of the present invention.

Detailed ways

Because IPMI V2.0 supports RMCP+Authenticated Key Exchange Protocol (RAKP) authentication. A remote attacker can obtain valid user account password hash information through the HMAC in RAKP message 2 responded by the BMC. This is an inherent problem in the IPMI v2.0 specification. There is no patch for this vulnerability. In addition, the username and password of many users' IPMI services overlap with the username and password for logging into the WEB, causing users without access rights to obtain the username and password for accessing the IPMI service through brute force cracking, thereby accessing the IPMI service that they do not have access rights to. In this way, there are certain security risks in out-of-band access. In existing technologies, strong passwords are usually used to limit the chances of success of offline dictionary attacks. Or isolated networks are used to limit access to the IPMI management interface.

Usually, strong passwords are used to limit the chances of offline dictionary attacks. Alternatively, isolated networks are used to limit access to the IPMI management interface. However, there are the following problems: the username and password used by users for IPMI services overlap with the username and password used to log in to the WEB, increasing the possibility of being cracked; VPN dial-in can bypass the isolated network to access the IPMI management interface; internal staff can obtain user passwords through legal authorization and use them illegally.

In order to enable those skilled in the art to better understand the technical solutions in the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

As shown in FIG1 , an embodiment of the present invention provides a security protection method for an out-of-band management server, which is applied to a protection system. The protection system includes a client and a server. The method includes the following steps:

Step 1: When the client executes an IPMI command, the IPMI command is packaged using the IPMI service user name and dynamic password to generate an IPMI command data packet;

Step 2: Encrypt the IPMI command data packet and transmit it to the server through the network;

Step 3: The server receives the IPMI command data packet and parses the received IPMI command data packet to obtain the user name and dynamic password;

Step 4: Check the parsed user name and dynamic password against the user name and dynamic password calculated inside the server;

If the verification passes, execute the IPMI command and record the log;

If the verification fails, the IPMI command will not be executed, an alarm will be given, and a log will be recorded.

First, the client and the server hold the same key and based on the time base, the server and the client use the same Hash algorithm to calculate a six-digit verification code. This verification code is used as a dynamic password. The security of using IPMI commands to manage the server is improved by replacing static passwords with dynamic passwords. This not only solves the security problems caused by password leakage, but also avoids user permission problems caused by duplication of web login passwords and IPMI service passwords.

As shown in FIG. 2 , an embodiment of the present invention provides a security protection method for an out-of-band management server, which is applied to a protection system. The protection system includes a client and a server. The method includes the following steps:

S01: The token uses the key and time base to calculate the dynamic password through a hash algorithm; the specific steps include:

The key and a time base generate a set of pseudo-random numbers through a hash algorithm;

Generate a dynamic password based on the generated pseudo-random number and the set operation rules;

The dynamic password set is composed of a key and dynamic passwords generated by several time bases.

S02: The server uses the key and time base to calculate the dynamic password through a hash algorithm;

In this step, the calculated dynamic passwords are used to generate a dynamic password sequence according to the dynamic password calculation time;

S1: When the client executes an IPMI command, the IPMI command is packaged using the IPMI service user name and the dynamic password to generate an IPMI command data packet; specifically, when the client executes the IPMI command, the current traversal pointer selects a dynamic password in the dynamic password set, and the IPMI command is packaged using the IPMI service user name and the selected dynamic password to generate an IPMI command data packet;

S2: Encrypt the IPMI command data packet and transmit it to the server through the network;

S3: The server receives the IPMI command data packet and parses the received IPMI command data packet to obtain the user name and dynamic password;

S4: Check the parsed user name and dynamic password for consistency with the user name and dynamic password calculated inside the server;

If the verification passes, execute the IPMI command and record the log;

If the verification fails, the IPMI command will not be executed, an alarm will be given, and a log will be recorded.

It should be noted that the verification process in this step first determines whether the parsed user name is consistent with the user name inside the server; when the user names are consistent, traverse the dynamic password sequence to match the parsed dynamic password; if the match is successful, the verification passes, and the steps are executed: execute the IPMI command and record the log; if the match fails, the verification fails, and the steps are executed: do not execute the IPMI command and issue an alarm, and record the log.

The dynamic password is updated once a minute and cannot be reused to prevent the IPMI service password from being stolen by hackers and used to attack the server.

Generally, a unique user ID is set for a user name. The dynamic password sequence is named in sequence based on the unique user ID. When matching a dynamic password, it is necessary to first determine the user name and then match the password based on the user name to the corresponding dynamic password sequence.

The token generates a dynamic password once a minute. Here, the keys corresponding to the client and the server are the same and based on the same time base to ensure that the generated dynamic password matches successfully.

It should be further explained that the steps of traversing the dynamic password sequence and matching the parsed dynamic password include:

The parsed dynamic password is matched with the first N and last N data of the current traversal pointer position in the dynamic password sequence at the same time; the position of the traversal pointer is adjusted according to the matching result.

In order to improve the matching speed, during the process of matching the first N and last N data of the traversal pointer at the current moment, the position of the traversal pointer must be adjusted at the set time interval regardless of whether the match is successful. When the match is unsuccessful, the position of the traversal pointer is adjusted, and the first N and last N data of the adjusted traversal pointer are matched at the same time. It should be noted in the setting that N can also be adjusted according to the matching operation and results.

The embodiment of the present invention provides an out-of-band management server security protection system, including a client and a server, wherein the server is provided with a BMC;

The client is used to execute IPMI commands, and uses the IPMI service user name and dynamic password to package the IPMI commands to generate IPMI command data packets; the IPMI command data packets are encrypted and transmitted to the BMC through the network;

BMC is used to receive IPMI command data packets, parse the received IPMI command data packets to obtain the user name and dynamic password; perform consistency check on the parsed user name and dynamic password with the user name and dynamic password calculated inside the BMC; if the check passes, execute the IPMI command and record the log; if the check fails, do not execute the IPMI command, issue an alarm, and record the log.

Generally, a unique user ID is set for a user name. The dynamic password sequence is named in sequence based on the unique user ID. When matching a dynamic password, it is necessary to first determine the user name and then match the password based on the user name to the corresponding dynamic password sequence.

The security of managing servers using IPMI commands is improved by replacing static passwords with dynamic passwords, which not only solves the security issues caused by password leakage, but also avoids user permission issues caused by duplication of web login passwords and IPMI service passwords.

In some embodiments, the client is provided with a token, and the token uses a key and a time base to calculate a dynamic password through a hash algorithm;

The BMC is also used to calculate a dynamic password using a hash algorithm using a key and a time base; and to generate a dynamic password sequence using a number of calculated dynamic passwords according to the time of calculating the dynamic passwords.

In some embodiments, the token generates a set of pseudo-random numbers using a key and a time base through a hash algorithm; generates a dynamic password based on the generated pseudo-random number and the set operation rules; the dynamic passwords generated by the key and several time bases constitute a dynamic password set. The token generates a dynamic password once a minute, where the keys corresponding to the client and the server are the same and based on the same time base, so as to ensure that the generated dynamic passwords match successfully.

In some embodiments, when the client executes an IPMI command, the steps of packaging the IPMI command using the IPMI service user name and dynamic password to generate an IPMI command data packet include:

The client is used to execute an IPMI command. The current traversal pointer selects a dynamic password from the dynamic password set, and uses the IPMI service user name and the selected dynamic password to package the IPMI command to generate an IPMI command data packet.

BMC is specifically used to determine whether the parsed user name is consistent with the user name inside the server; when the user names are consistent, the dynamic password sequence is traversed to match the parsed dynamic password; if the match is successful, the verification passes, the IPMI command is executed and the log is recorded; if the match fails, the verification fails, the IPMI command is not executed, an alarm is issued, and the log is recorded.

In some embodiments, the BMC is also used to simultaneously match the parsed dynamic password with the first N and last N data of the current position of the traversal pointer in the dynamic password sequence, and adjust the position of the traversal pointer according to the matching result. In order to improve the matching speed, during the process of simultaneously matching the first N and last N data of the current position of the traversal pointer, the position of the traversal pointer must be adjusted regardless of whether the match is successful or not. When the match is unsuccessful, after the position of the traversal pointer is adjusted, the first N and last N data of the adjusted position of the traversal pointer are matched simultaneously. It should be noted in the setting that N can also be adjusted according to the matching operation and results.

Although the present invention has been described in detail by referring to the accompanying drawings and in combination with the preferred embodiments, the present invention is not limited thereto. Without departing from the spirit and essence of the present invention, a person of ordinary skill in the art may make various equivalent modifications or substitutions to the embodiments of the present invention, and these modifications or substitutions shall be within the scope of the present invention. Any person of ordinary skill in the art may easily think of changes or substitutions within the technical scope disclosed by the present invention, and these shall be within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims (10)

1. A security protection method for an out-of-band management server, characterized in that it is applied to a protection system, wherein the protection system includes a client and a server communicating with the client, and the method includes the following steps: When the client executes an IPMI command, the IPMI service user name and dynamic password are used to package the IPMI command to generate an IPMI command data packet; Encrypt the IPMI command data packet and transmit it to the server through the network; The server receives the IPMI command data packet and parses the received IPMI command data packet to obtain the user name and dynamic password; The parsed user name and dynamic password are checked for consistency with the user name and dynamic password calculated inside the server; If the verification passes, execute the IPMI command and record the log; If the verification fails, the IPMI command will not be executed, an alarm will be given, and a log will be recorded. 2. The out-of-band management server security protection method according to claim 1 is characterized in that the client is provided with a token, and when the client executes an IPMI command, the step of using an IPMI service user name and a dynamic password to group the IPMI command into a package to generate an IPMI command data packet includes: The token uses the key and time base to calculate a dynamic password through a hash algorithm. 3. The out-of-band management server security protection method according to claim 2 is characterized in that before the step of performing consistency verification between the parsed user name and dynamic password and the user name and dynamic password calculated inside the server, the step comprises: The server uses the key and time base to calculate the dynamic password through the hash algorithm; The calculated dynamic passwords are used to generate a dynamic password sequence according to the dynamic password calculation time. 4. The out-of-band management server security protection method according to claim 3 is characterized in that the step of using the token to calculate the dynamic password through a hash algorithm using the key and the time base includes: The key and a time base generate a set of pseudo-random numbers through a hash algorithm; Generate a dynamic password based on the generated pseudo-random number and the set operation rules; The dynamic password set is composed of a key and dynamic passwords generated by several time bases. 5. The out-of-band management server security protection method according to claim 4, characterized in that when the client executes the IPMI command, the step of packaging the IPMI command using the IPMI service user name and dynamic password to generate an IPMI command data packet comprises: When the client executes an IPMI command, the current traversal pointer selects a dynamic password from the dynamic password set, and uses the IPMI service user name and the selected dynamic password to package the IPMI command to generate an IPMI command data packet. 6. The out-of-band management server security protection method according to claim 5, characterized in that the step of performing consistency verification on the parsed user name and dynamic password with the dynamic password calculated inside the server comprises: Determine whether the parsed user name is consistent with the user name inside the server; When the user names are the same, traverse the dynamic password sequence and match the parsed dynamic password; If the match is successful and the verification is passed, the following steps are executed: Execute the IPMI command and record the log; If the match fails and the verification fails, execute the following steps: Do not execute the IPMI command and issue an alarm, and record a log. 7. The out-of-band management server security protection method according to claim 6, wherein the step of traversing the dynamic password sequence and matching the parsed dynamic password comprises: The parsed dynamic password is matched with the first N and last N data of the current traversal pointer position in the dynamic password sequence at the same time, and the position of the traversal pointer is adjusted according to the matching result. 8. An out-of-band management server security protection system, characterized in that it includes a client and a server communicating with the client, and the server is provided with a BMC; The client is used to execute IPMI commands, and uses the IPMI service user name and dynamic password to package the IPMI commands to generate IPMI command data packets; the IPMI command data packets are encrypted and transmitted to the BMC through the network; BMC is used to receive IPMI command data packets, parse the received IPMI command data packets to obtain the user name and dynamic password; perform consistency check on the parsed user name and dynamic password with the user name and dynamic password calculated inside the BMC; if the check passes, execute the IPMI command and record the log; if the check fails, do not execute the IPMI command, issue an alarm, and record the log. 9. The out-of-band management server security protection system according to claim 8, characterized in that the client is provided with a token, and the token uses a key and a time base to calculate a dynamic password through a hash algorithm; The BMC is also used to calculate a dynamic password using a hash algorithm using a key and a time base; and to generate a dynamic password sequence using a number of calculated dynamic passwords according to the time of calculating the dynamic passwords. 10. The out-of-band management server security protection system according to claim 9 is characterized in that the BMC is specifically used to determine whether the parsed user name is consistent with the user name inside the server; when the user names are consistent, the dynamic password sequence is traversed to match the parsed dynamic password; if the match is successful, the verification passes, the IPMI command is executed and the log is recorded; if the match fails, the verification fails, the IPMI command is not executed, an alarm is issued, and a log is recorded.