Techniques of improving KVM security under KVM sharing

1. A method of operating a service processor, comprising:

receiving a keyboard, video and mouse console (KVM) flow from a host;

redirecting the KVM console flow to a first destination console;

redirecting a video stream, without a keyboard stream and a mouse stream, of the KVM console flow to a second destination console;

detecting that the first destination console is disconnected from the service processor;

invoking a privilege-checking event at the host through a first input to the host such that a security interface requesting credentials indicating a user privilege associated with the second destination console is generated at the host and displayed at the second destination console through the video stream;

redirecting the keyboard stream and the mouse stream to the second destination console;

receiving a second input in at least one of the keyboard stream and the mouse stream from the second destination console, wherein the second input contains the credentials;

redirecting the second input to the host; and

determining whether the second destination console is associated with a user privilege different from a user privilege associated with the first destination console, wherein the invoking the privilege-checking event is performed when the user privilege associated with the second destination console is different from the user privilege associated with the first destination console.

2. The method of claim 1 , wherein the video stream is destined to a display controller, the keyboard stream is destined to a keyboard, and the mouse stream is destined to a pointing device.

3. The method of claim 1 , wherein the invoking the privilege-checking event comprises sending, to the host, the first input, wherein the first input is further configured to trigger the host to generate a lock screen.

4. An apparatus, the apparatus being a service processor, comprising:

a memory; and

at least one processor coupled to the memory and configured to:

receive a keyboard, video and mouse console (KVM) flow from a host;

redirect the KVM console flow to a first destination console;

redirect a video stream, without a keyboard stream and a mouse stream, of the KVM console flow to a second destination console;

detect that the first destination console is disconnected from the service processor;

invoke a privilege-checking event at the host through a first input to the host such that a security interface requesting credentials indicating a user privilege associated with the second destination console is generated at the host and displayed at the second destination console through the video stream;

redirect the keyboard stream and the mouse stream to the second destination console;

receive a second input in at least one of the keyboard stream and the mouse stream from the second destination console, wherein the second input contains the credentials;

redirect the second input to the host; and

determine whether the second destination console is associated with a user privilege different from a user privilege associated with the first destination console, wherein the invoking the privilege-checking event is performed when the user privilege associated with the second destination console is different from the user privilege associated with the first destination console.

5. The apparatus of claim 4 , wherein the video stream is destined to a display controller, the keyboard stream is destined to a keyboard, and the mouse stream is destined to a pointing device.

6. The apparatus of claim 4 , wherein to invoke the privilege-checking event, the at least one processor is further configured to send, to the host, the first input, wherein the first input is further configured to trigger the host to generate a lock screen.

7. A non-transitory computer-readable medium storing computer executable code for operating a service processor, comprising code to:

receive a keyboard, video and mouse console (KVM) flow from a host;

redirect the KVM console flow to a first destination console;

redirect a video stream, without a keyboard stream and a mouse stream, of the KVM console flow to a second destination console;

detect that the first destination console is disconnected from the service processor;

invoke a privilege-checking event at the host through a first input to the host such that a security interface requesting credentials indicating a user privilege associated with the second destination console is generated at the host and displayed at the second destination console through the video stream;

redirect the keyboard stream and the mouse stream to the second destination console;

receive a second input in at least one of the keyboard stream and the mouse stream from the second destination console, wherein the second input contains the credentials;

redirect the second input to the host; and

determine whether the second destination console is associated with a user privilege different from a user privilege associated with the first destination console, wherein the invoking the privilege-checking event is performed when the user privilege associated with the second destination console is different from the user privilege associated with the first destination console.

8. The non-transitory computer-readable medium of claim 7 , wherein the video stream is destined to a display controller, the keyboard stream is destined to a keyboard, and the mouse stream is destined to a pointing device.

9. The non-transitory computer-readable medium of claim 7 , wherein to invoke the privilege-checking event, the code is further configured to send, to the host, the first input, wherein the first input is further configured to trigger the host to generate a lock screen.