BMC生成唯一初始密码的方法及应用  

作　　者：耿梦达 尹明 王博 郑威奇 

机构地区：[1]研祥智慧物联科技有限公司,广东深圳518107 [2]广东省工业控制系统信息安全技术企业重点实验室,广东深圳518107

出　　处：《工业控制计算机》2024年第4期59-60,63,共3页Industrial Control Computer

摘　　要：近年来,计算机网络的迅速发展,各行各业对互联网的依赖日益加强。互联网用户数量迅猛增长,人们的日常生活已经离不开网络环境。同时,网络安全事件不断涌现,给人们的生活和整个社会带来了极大的损失。针对当前服务器厂商提供一个默认的用户账户和密码容易受到攻击等缺陷提供了一种方法,可以生成基于主板管理控制器的初始密码。首先,获取BMC芯片唯一识别码作为用户密码的密码种子。同时,获取用户需求文本并对应提取及转换得到用户账号的密码种子。根据场景选择加密策略,将用户密码的密码种子通过加密策略加密得到基板管理控制器初始密码并存储,将户账号的密码种子通过加密策略加密得到基板管理控制器初始账号并存储。用户通过同样的方式获取到用户账户及用户密码,以此来进行登录。实现了基板管理控制器密码基于BMC芯片唯一识别码加密生成,且基板管理控制器账号是基于用户需求文本生成,初始生成的账号及密码初始数据安全性较高,在未修改初始账号及密码时仍然能够保护BMC系统的安全。The common practice among server manufacturers at present is to provide a default user account and password.This solution has more flaws,such as attacks being carried out through default user accounts and passwords.This paper presents a method to tackle these flaws,by generating an initial password based on the main board management controller.First of all,for BMC chip identification number as the user password password only seed.At the same time,the text get the user demand and corresponding extraction and conversion seeds get user account password.Select encryption strategies according to the scene,the user password password seed baseboard management controller is obtained by strategy encryption initial password and store,seeds will door account password encryption by encryption strategies the baseboard management controller initial account and store.By the user in the same way for users to the user account and password,to log in.Implements the baseboard management controller is the only identification based on BMC chip encryption password generation,and the baseboard management controller,account is text generation based on user demand,higher initial account number and password generated initial data security,without modifying the initial account and password will still be able to protect the BMC system's security.

关 键 词：服务器管理 网络安全 安全漏洞 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]