CN112580006A - Access right control method and device of multi-cloud system and authentication server - Google Patents

Abstract

The present application discloses an access authority control method, device and authentication server for a multi-cloud system. The method is applied to an authentication server, the authentication server corresponds to multiple cloud systems, and the cloud system includes multiple accessed objects. The method includes: receiving an object access request sent by the client, where the object access request at least includes a user identifier of a target user and an object identifier of a target object, and the target object is an accessed object in a target cloud system among the multiple cloud systems; In a permission policy set, a target permission policy matching the user ID and the object ID is obtained, the permission policy set includes multiple pieces of permission policy information, each piece of permission policy information corresponds to a user and An accessed object; according to the target authority policy, an authentication result is obtained, and the authentication result indicates whether the target user has the right to access the target object in the target cloud system.

Description

Access authority control method, device and authentication server for multi-cloud system

technical field

The present application relates to the technical field of authority management, and in particular, to a method, device and authentication server for access authority control of a multi-cloud system.

Background technique

With the development of technology, more and more cloud services provide cloud services that provide users with different functions. For different cloud service providers, the user's access rights to the resources or functions of each cloud system can be managed through a unified authentication center.

In the current management of access rights to multi-cloud systems, rights management is usually carried out according to cloud systems. For example, a user has access rights to one or more cloud systems, while another user does not have access rights to a certain cloud system. , based on this, when authenticating the access request made by the user, it can only be determined whether the user has the right to access the resources or functions of a certain cloud system, but it cannot be determined whether the user has access to different resources or functions in the cloud system. Access rights to functions.

Therefore, when the user's access rights are managed, the granularity of the rights cannot be subdivided, resulting in poor flexibility in the management of the user's access rights.

SUMMARY OF THE INVENTION

In view of this, the present application provides an access authority control method, device and authentication server for a multi-cloud system, which are used to solve the technical problem of poor flexibility in user access authority management in the prior art.

The present application provides an access authority control method for a multi-cloud system, which is applied to an authentication server, where the authentication server corresponds to a plurality of cloud systems, and the cloud system includes a plurality of accessed objects, and the method includes:

Receive an object access request sent by the client, where the object access request includes at least the user ID of the target user and the object ID of the target object, and the target object is the accessed object in the target cloud system in the multiple cloud systems;

In a permission policy set, a target permission policy matching the user ID and the object ID is obtained, the permission policy set contains multiple pieces of permission policy information, each piece of permission policy information corresponds to a user and a visited object;

According to the target authority policy, an authentication result is obtained, and the authentication result represents whether the target user has the authority to access the target object in the target cloud system.

In the above method, preferably, in a permission policy set, obtaining a target permission policy matching the user ID and the object ID, including:

In the permission policy set, filter initial policy information that matches the user ID and/or the user group ID corresponding to the user ID; the user group ID is the ID of the target user group to which the target user belongs; The target user group also includes one or more other users;

In the initial policy information, a target permission policy matching the object identifier is filtered out.

In the above method, preferably, in the permission policy set, screening initial policy information that matches the user ID and/or the user group ID corresponding to the user ID, including:

In the permission policy set, filter the first policy information that matches the user identifier;

In the permission policy set, the second policy information matching the user group identifier is screened, and the first policy information and/or the second policy information constitute initial policy information.

The above method, preferably, also includes:

The authentication result is transmitted to the target cloud system.

In the above method, preferably, the object access request also includes the authentication identifier of the target user;

The identity verification identifier is generated when the target user logs in to the target cloud system, and the identity verification identifier indicates that the target user successfully logs in to the target.

Above-mentioned method, preferably, described method also comprises:

receiving a user login request sent by the client, where the user login request at least includes the verification information of the target user and the system identifier of the target cloud system;

According to the system identification, the verification information is verified to obtain a verification result, and the verification result represents whether the target user has passed the identity verification of the target cloud system;

In the case that the verification result indicates that the target user has passed the identity verification of the target cloud system, the identity verification identifier of the target user is obtained.

In the above method, preferably, according to the system identifier, the verification information is verified to obtain a verification result, including:

obtaining the verification signature information corresponding to the verification information;

The standard signature information corresponding to the system identifier is compared with the verification signature information to obtain a verification result.

The above method, preferably, obtains the verification signature information corresponding to the verification information, including:

Using a signature algorithm, the user name and password in the verification information are signed to obtain verification signature information;

or,

Using a signature algorithm, the access key in the verification information is signed to obtain verification signature information.

The present application also provides an access authority control device for a multi-cloud system, which is applied to an authentication server, where the authentication server corresponds to a plurality of cloud systems, and the cloud system includes a plurality of accessed objects, and the device includes:

A request receiving unit, configured to receive an object access request sent by the client, where the object access request at least includes the user ID of the target user and the object ID of the target object, and the target object is the target cloud system in the multiple cloud systems the accessed object within;

a policy obtaining unit, configured to obtain a target permission policy matching the user ID and the object ID in a permission policy set, where the permission policy set includes multiple pieces of permission policy information, and each permission policy Information corresponds to a user and an accessed object;

A result obtaining unit, configured to obtain an authentication result according to the target authority policy, where the authentication result represents whether the target user has the authority to access the target object in the target cloud system.

The present application also provides an authentication server, where the authentication server corresponds to multiple cloud systems, and the cloud system includes multiple visited objects, and the authentication server includes:

The transmission module is configured to receive an object access request sent by the client, where the object access request at least includes the user ID of the target user and the object ID of the target object, and the target object is in the target cloud system in the multiple cloud systems. the visited object;

a processor, configured to obtain a target permission policy matching the user ID and the object ID in a permission policy set, where the permission policy set includes multiple pieces of permission policy information, each piece of permission policy information Corresponding to a user and an accessed object; according to the target authority policy, an authentication result is obtained, and the authentication result represents whether the target user has the authority to access the target object in the target cloud system .

The present application further provides a storage medium on which a program is stored, and when the program is executed by a processor, implements the access authority control method for a multi-cloud system described in any one of the above.

The present application further provides a processor for running a program, wherein when the program runs, the access authority control method for a multi-cloud system described in any one of the above is executed.

It can be seen from the above technical solutions that, in the access authority control method, device and authentication server of a multi-cloud system disclosed in the present application, after receiving the object access request sent by the client, it is possible to obtain the corresponding object in the authority policy set The access request matches the target permission policy, and then an authentication result representing whether the target user in the object access request can access the target object in the target cloud system can be obtained. It can be seen that in the present application, by subdividing the access rights of multiple cloud systems into the accessed objects in each cloud system, when the user accesses the cloud system through the client, it is possible to realize the user access to the cloud system. Permission control of the accessed object, thereby improving the flexibility of permission management.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present application more clearly, the following briefly introduces the drawings that are used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, other drawings can also be obtained from these drawings without any creative effort.

1 is a flowchart of a method for managing access rights of a multi-cloud system according to Embodiment 1 of the present application;

2 to 5 are respectively application example diagrams of the embodiments of the present application;

6 is a partial flowchart of a method for managing access rights of a multi-cloud system according to Embodiment 1 of the present application;

7-8 are another flowchart of a method for managing access rights of a multi-cloud system according to Embodiment 1 of the present application, respectively;

FIG. 9 is another application example diagram of the embodiment of the present application;

10 is another partial flowchart of a method for managing access rights of a multi-cloud system according to Embodiment 1 of the present application;

11 is a schematic structural diagram of an apparatus for managing access rights of a multi-cloud system according to Embodiment 2 of the present application;

12 is another schematic structural diagram of an apparatus for managing access rights of a multi-cloud system according to Embodiment 2 of the present application;

13 is a schematic structural diagram of an authentication server according to Embodiment 3 of the present application;

FIG. 14 to FIG. 16 are respectively exemplary diagrams of the embodiments of the present application applied to the financial industry for user identity authentication and authority management.

Detailed ways

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

Referring to FIG. 1 , a flow chart of the implementation of a method for managing access rights of a multi-cloud system provided in Embodiment 1 of the present application is applicable to an authentication server capable of data processing, such as a computer or a server. It should be noted that , the authentication server corresponds to multiple cloud systems, as shown in Figure 2, each cloud system is implemented by an electronic device deployed in the cloud, and each cloud system contains multiple objects to be accessed, such as those that can be accessed objects such as data resources or functional components. The technical solution in this embodiment is mainly used to realize the control of the user's access to the accessed object in the cloud system, so as to improve the flexibility of the rights management.

Specifically, the method in this embodiment may include the following steps:

Step 101: Receive an object access request sent by the client.

The object access request contains at least the user ID of the target user and the object ID of the target object, the target user is the user who needs to access the target object, and the target object is one or more targets in multiple cloud systems Accessed objects in the cloud system, such as a picture resource or a computing function.

It should be noted that the object access request may be after the target user logs in to the target cloud system, on the operation interface of the target cloud system presented on the target user's client terminal, clicks on the corresponding controls of the target object such as resources or functions. or a request generated by operations such as selection to indicate that the target user needs to access the target object. At this time, the user identifier of the target user may be information such as a user name, code or label that can uniquely characterize the target user, and the object identifier of the target object may be information such as an object name, code, or storage path that can uniquely characterize the target object.

In addition, it should be noted that, in order to realize the unified management of the access rights of the multi-cloud system in this embodiment, the management and control of the access rights are centralized in the authentication server in this embodiment. Therefore, when the object access request is made on the client After being generated and sent to the target cloud system, the client sends the object access request to the authentication server in this embodiment through redirection according to the reply information returned by the target cloud system that needs to authenticate the object access request. , the authentication server in this embodiment can receive the object access request sent by the client through the communication connection with the client, as shown in FIG. 3 .

The client corresponding to the target user may be a terminal or device such as a mobile phone, a pad, or a computer.

Step 102: In the permission policy set, obtain the target permission policy matching the user ID and the object ID.

The permission policy set is a pre-configured set, and the permission policy set may contain multiple pieces of permission policy information, each piece of permission policy information corresponds to a user and an accessed object, and each permission policy information includes whether the user is Information about access rights to the object being accessed. For example, the permission policy set is implemented as a table containing multiple fields, as shown in Figure 4, the table contains multiple rows of fields, each row of fields contains a user column, an object column and a permission column, and the user column is recorded in the user column. The identity of the object is recorded in the object column, and the information of whether it has access rights is recorded in the permission column. Based on this, the information in the permission column in each row of fields represents whether the user in the user column has the object in the object column. The access authority, for example, allow to indicate that user A has access authority to the accessed object B, and use deny to indicate that user A does not have access authority to the accessed object C. It should be noted that the table may contain multiple rows of fields corresponding to the same user, and the multiple rows of fields corresponding to the same user are respectively used to record whether the user has access rights to different accessed objects. It should be noted that the table may contain multiple rows of fields corresponding to the same accessed object, and the multiple rows of fields corresponding to the same accessed object are respectively used to record whether different users respectively have access rights to the accessed object.

Further, in a multi-cloud system, two or more users can be bound to the same user group, as shown in Figure 5, and users in the same user group have the same access rights, such as access to the same user group. or multiple accessed objects have the same access rights. In addition, a user can exist alone and not be bound to any user group, or it can only be bound to a user group, or it can exist alone and be bound to one or more user groups at the same time. middle.

Based on this, the permission policy information in the permission policy set may also be the permission policy information corresponding to the user group and the accessed object, and the permission policy information corresponding to the user group includes whether the users in the user group have access to the accessed object. Access rights information. For example, as shown in FIG. 4, the user column of the row field in the table may also correspond to the user group. In this case, the user group ID is recorded in the user column, the object ID is recorded in the object column, and the permission column is recorded in the permission column. Record whether the information has access permissions. Based on this, the information in the permission column in each row field represents whether the user in the user group in the user column has the permission to access the object in the object column, for example, the user group is represented by allow Users A and D in X have access rights to the accessed object B, and deny means that users A and D in user group Y do not have access rights to the accessed object C. It should be noted that the table may contain multi-line fields corresponding to the same user group, and the multi-line fields corresponding to the same user group are respectively used to record whether the user group has access rights to different accessed objects. It should be noted that the table may contain multi-line fields corresponding to the same accessed object, and the multi-line fields corresponding to the same accessed object are respectively used to record whether different user groups have access rights to the accessed object.

It should be noted that, different from the access rights management that a user can only correspond to one cloud system, in this embodiment, the access rights are subdivided into the granularity of the accessed object, so that each piece of permission policy information can correspond to the access rights of the accessed object. Accessing objects rather than the cloud system to which multiple accessed objects belong.

Based on this, in this embodiment, after the user ID and the object ID are obtained, the permission policy information is filtered in the permission policy set, so as to obtain the target permission policy that matches both the user ID and the object ID in the object access request, The target permission policy contains information about whether the target user has the access right to the target object.

Step 103: Obtain an authentication result according to the target authority policy.

The authentication result represents whether the target user has the right to access the target object in the target cloud system.

Specifically, in this embodiment, it is possible to analyze and determine whether the target user in the target authority policy has the access authority to the target object, thereby analysing whether the target user has the authority to access the target object in the target cloud system. , thereby generating the authentication result.

Wherein, the identification can be used in the authentication result to represent whether the target user has the right to access the target object in the target cloud system. deny indicates that the target user does not have the right to access the target object in the target cloud system.

It can be seen from the above solution that, in the access rights management method for a multi-cloud system provided in the first embodiment of the present application, after receiving the object access request sent by the client, the access rights matching the object access request can be obtained in the permission policy set. According to the target permission policy, an authentication result representing whether the target user in the object access request can access the target object in the target cloud system can be obtained. It can be seen that in this embodiment, by subdividing the access rights of multiple cloud systems into the accessed objects in each cloud system, the user can access the cloud system when the user accesses the cloud system through the client. Permission control of the accessed object, thereby improving the flexibility of permission management.

In an implementation manner, in the permission policy set in step 102, when the target permission policy matching the user ID and the object ID is obtained, the following steps can be specifically implemented, as shown in FIG. 6 :

Step 601: In the permission policy set, filter initial policy information that matches the user ID and/or the user group ID corresponding to the user ID.

The user group identifier is the identifier of the target user group to which the target user belongs. In addition to the target user, the target user group may also include one or more other users. The access rights are the same.

Specifically, in this embodiment, only the initial policy information matching the user ID may be filtered in the permission policy set;

Or, filter only the initial policy information matching the user group ID corresponding to the user ID in the permission policy set;

Or, at the same time, the first policy information matching the user ID and the second policy information matching the user group ID corresponding to the user ID are screened in the permission policy set, and the screened first policy information and/or second policy information Form the initial policy information;

Alternatively, in this embodiment, the first policy information matching the user ID is first screened in the permission policy set. If the first policy information matching the user ID is not screened out in the permission policy set, then the first policy information matching the user ID is The second policy information that matches the user group identifier corresponding to the user identifier is filtered to serve as the initial policy information.

Specifically, taking the screening of the permission policy information matching the user ID as an example, in this embodiment, the user ID can be compared with the user in each permission policy information in the permission policy set, and then the user ID matching the user ID can be filtered out. Matching initial policy information. For example, in this embodiment, in the table of the permission policy set, the user ID is compared with the user in the user column in the table, and then one or more rows of fields matching the user ID are filtered out. The fields respectively correspond to a piece of permission policy information, that is, the initial policy information matched with the user ID. For an implementation manner of filtering the permission policy information matching the user group identifier, reference may be made to the above manner, which will not be described in detail here.

It should be noted that there may be one or more pieces of initial policy information matching the user ID.

Step 602: In the initial policy information, filter out the target permission policy matching the object identifier.

Wherein, in this embodiment, the object identifier and the initial policy information can be compared, and then the target authority policy matching the object identifier can be screened out. For example, in this embodiment, in the filtered one or more rows of fields matching the user ID, the object ID is compared with the accessed objects in the object column in these fields, and then the user ID and the object are filtered out. Identifies one or more fields that all match, and each filtered field corresponds to a piece of permission policy information, that is, the target permission policy.

In an implementation manner, after step 103, the method in this embodiment may further include the following steps, as shown in FIG. 7:

Step 104: Transmit the authentication result to the target cloud system.

Wherein, after the authentication server in this embodiment transmits the authentication result to the target cloud system, the target cloud system may allow or prohibit the target user from accessing the object based on the information in the authentication result whether the target user has access authority to the accessed object. access to the target object. For example, when the authentication result indicates that the target user has access rights to the target object such as pictures, the target cloud system allows the target user to view the picture or allows the target user to download the picture; for another example, when the authentication result indicates that the target If the user does not have access rights to the picture, the target cloud system prohibits the target user from viewing the target object such as the picture.

Further, in this embodiment, after the authentication result is obtained, the authentication result may also be transmitted to the client to prompt the target user. In addition, when the target user does not have the access right to the target object, the target user can be further prompted that the target user can access the object after obtaining the access right.

In an implementation manner, the object access request may also include an authentication identifier of the target user, the authentication identifier is generated when the target user logs in to the target cloud system, and the authentication identifier is used to indicate that the target user successfully logs in to the target cloud system. The target cloud system, that is, the target user is authenticated by the authentication server when logging in to the target cloud system, and the verification is passed.

Among them, the authentication identifier can be represented by a string.

Specifically, when the target user needs to log in to the target cloud system, the target user is authenticated on the authentication server. Based on this, before step 101, the method in this embodiment may further include the following steps of authenticating the target user, as shown in FIG. 8:

Step 105: Receive a user login request sent by the client.

The user login request includes at least the authentication information of the target user and the system identifier of the target cloud system.

Specifically, the verification information of the target user can be implemented in different ways according to the way the target user logs in to the target cloud system: when the target user logs in to the target cloud system through the page, the verification information of the target user includes the user entered by the target user on the page. information such as name and password; when the target user logs in to the target cloud system through the interface such as executing the program, the authentication information of the target user includes the information such as the access key of the target user contained in the execution program.

It should be noted that when the target user performs the login operation of the target cloud system on the client, such as inputting the user name and password or triggering the execution of the program to start running, the client sends the initial user login request generated by the login operation to the target. In the cloud system, at this time, the initial user login request may only include the verification information of the target user. Since in this embodiment, in order to realize the unified management of the access rights of the multi-cloud system, the management and control of the access rights are centralized in this embodiment. In the authentication server, therefore, after the user login request is generated on the client and sent to the target cloud system, the client sends the user login request through the re-pass according to the reply information returned by the target cloud system that needs to authenticate the target user. It is directed and sent to the authentication server in this embodiment. At this time, the user login request received by the authentication server also includes the system identifier of the target cloud system to indicate that the target user needs to be authenticated to log in to the target cloud system. Therefore, the authentication server in this embodiment can receive the user login request sent by the client through the communication connection with the client, as shown in FIG. 9 .

Step 106: Verify the verification information according to the system identification to obtain a verification result.

The verification result represents whether the target user has passed the identity verification of the target cloud system.

Specifically, when verifying the verification information in this embodiment, it can be implemented in the following manner, as shown in FIG. 10 :

Step 1001: Obtain verification signature information corresponding to the verification information.

Specifically, in this embodiment, the verification signature information may be obtained by encrypting or encoding the verification information using a signature algorithm.

In an implementation manner, in this embodiment, a signature algorithm such as an encryption algorithm can be used to sign the username and password in the verification information to obtain verification signature information;

In another implementation manner, in this embodiment, a signature algorithm may be used to sign the access key in the verification information to obtain the verification signature information.

The above two implementation methods respectively correspond to the two access methods here: one is for the target user to log in through the user name and password on the page. At this time, the user name and password are signed with the signature algorithm to obtain the verification signature information, so that It is used to verify the identity of the user; the other is to use the program to call the product service. At this time, the key pair such as AccessKeyID and AccessKeySecret are used as the input parameters of the program, and the key pair is signed with the signature algorithm to obtain the verification signature information, so that to verify user identity.

Step 1002: Compare the standard signature information corresponding to the system identifier with the verification signature information to obtain a verification result.

For example, in this embodiment, the standard signature information of the target cloud system may be obtained from a signature library in which the standard signature information of each cloud system is pre-stored in the authentication server, and then the standard signature information of the target cloud system may be verified by using a signature algorithm. The verification signature information obtained by signing the information is compared to obtain the verification result.

Among them, in the case that the standard signature information corresponding to the system identifier is consistent with the verification signature information, the verification result represents the identity verification of the target user through the target cloud system; in the case that the standard signature information corresponding to the system identifier is inconsistent with the verification signature information , the verification result indicates that the target user has not passed the authentication of the target cloud system.

Step 107: Determine whether the verification result indicates that the target user has passed the identity verification of the target cloud system, and if the verification result indicates that the target user has passed the identity verification of the target cloud system, step 108 is performed.

Specifically, in this embodiment, the content in the verification result can be judged. For example, when the verification result is 1, the verification result represents the identity verification of the target user through the target cloud system, and when the verification result is 0, the verification result represents the target The user is not authenticated to the target cloud system.

Step 108: Obtain the authentication identifier of the target user.

Wherein, in this embodiment, an identity verification identifier, which may also be called an access ticket, may be generated for the target user according to the generation rule of the verification identifier, so as to represent the identity verification of the target user through the target cloud system.

In addition, when the authentication server in this embodiment authenticates the target user, it can provide identification information such as a global ticket, a service ticket, and a global session for the target user to log in to the target cloud system, so as to indicate that the target user logs in to the target cloud system through the client In order to control the target user to log out of the login status of the target cloud system on the client when the target user logs in to the target cloud system again through other terminals such as mobile phones.

11 is a schematic structural diagram of an apparatus for managing access rights of a multi-cloud system provided in Embodiment 2 of the present application. The apparatus may be configured in an authentication server capable of data processing, such as a computer or a server. It should be noted that , the authentication server corresponds to multiple cloud systems, as shown in Figure 2, each cloud system is implemented by an electronic device deployed in the cloud, and each cloud system contains multiple objects to be accessed, such as those that can be accessed objects such as data resources or functional components. The technical solution in this embodiment is mainly used to realize the control of the user's access to the accessed object in the cloud system, so as to improve the flexibility of the rights management.

Specifically, the apparatus in this embodiment may include the following units:

A request receiving unit 1101, configured to receive an object access request sent by a client, where the object access request at least includes a user ID of a target user and an object ID of a target object, where the target object is a target cloud in the multiple cloud systems Accessed objects within the system;

A policy obtaining unit 1102, configured to obtain a target permission policy matching the user ID and the object ID in a permission policy set, where the permission policy set includes multiple pieces of permission policy information, and each permission Policy information corresponds to a user and an accessed object;

The result obtaining unit 1103 is configured to obtain an authentication result according to the target authority policy, where the authentication result represents whether the target user has the right to access the target object in the target cloud system.

It can be seen from the above solution that, in the access authority control device for a multi-cloud system provided in the second embodiment of the present application, after receiving the object access request sent by the client, the access authority matching the object access request can be obtained in the authority policy set. According to the target permission policy, an authentication result representing whether the target user in the object access request can access the target object in the target cloud system can be obtained. It can be seen that in this embodiment, by subdividing the access rights of multiple cloud systems into the accessed objects in each cloud system, the user can access the cloud system when the user accesses the cloud system through the client. Permission control of the accessed object, thereby improving the flexibility of permission management.

In an implementation manner, the policy obtaining unit 1102 is specifically configured to: in the permission policy set, filter initial policy information that matches the user ID and/or the user group ID corresponding to the user ID; the user group The identifier is the identifier of the target user group to which the target user belongs; the target user group also includes one or more other users; in the initial policy information, filter out the target authority that matches the object identifier Strategy.

Optionally, when the policy obtaining unit 1102 selects the initial policy information that matches the user ID and/or the user group ID corresponding to the user ID in the permission policy set, it is specifically used for: in the permission policy set, Screening the first policy information matching the user identifier; in the permission policy set, screening the second policy information matching the user group identifier, the first policy information and/or the second policy information The policy information constitutes the initial policy information.

In an implementation manner, the result obtaining unit 1103 is further configured to: transmit the authentication result to the target cloud system.

In an implementation manner, the object access request further includes an identity verification identifier of the target user; wherein the identity verification identifier is generated when the target user logs in to the target cloud system, and the identity verification identifier is generated when the target user logs in to the target cloud system. The identification signifies that the target user successfully logged into the target.

In an implementation manner, the apparatus in this embodiment may further include the following units, as shown in FIG. 12 :

The identity verification unit 1104 is configured to, after the request receiving unit 1101 receives the user login request sent by the client, the user login request at least includes the verification information of the target user and the system identifier of the target cloud system; The system identifier is used to verify the verification information to obtain a verification result, which indicates whether the target user has passed the identity verification of the target cloud system; the verification result indicates that the target user has passed the In the case of the identity verification of the target cloud system, the identity verification identifier of the target user is obtained.

In an implementation manner, when the identity verification unit 1104 verifies the verification information according to the system identifier to obtain a verification result, the identity verification unit 1104 is specifically configured to: obtain verification signature information corresponding to the verification information; for example, use signature algorithm, sign the user name and password in the verification information to obtain verification signature information; or, use the signature algorithm to sign the access key in the verification information to obtain verification signature information; The standard signature information corresponding to the system identifier is compared with the verification signature information to obtain a verification result.

It should be noted that, for the specific implementation of each unit in this embodiment, reference may be made to the corresponding content in the foregoing, which will not be described in detail here.

Referring to FIG. 13, it is a schematic structural diagram of an authentication server provided in Embodiment 3 of the present application. The authentication server may correspond to multiple cloud systems. As shown in FIG. 2, each cloud system is an electronic device deployed in the cloud. Implementation, each cloud system contains multiple objects to be accessed, such as objects such as data resources or functional components that can be accessed. The technical solution in this embodiment is mainly used to realize the control of the user's access to the accessed object in the cloud system, so as to improve the flexibility of the rights management.

Specifically, the authentication server in this embodiment may include the following structure:

The transmission module 1301 is configured to receive an object access request sent by the client, where the object access request contains at least the user ID of the target user and the object ID of the target object, and the target object is the target cloud system in the multiple cloud systems the accessed object within;

The processor 1302 is configured to obtain a target permission policy matching the user ID and the object ID in a permission policy set, where the permission policy set includes multiple pieces of permission policy information, and each permission policy The information corresponds to a user and an accessed object; according to the target authority policy, an authentication result is obtained, and the authentication result represents whether the target user has access to the target object in the target cloud system. permissions.

Of course, the authentication server in this embodiment may also include a memory for storing the application program and data generated by the running of the application program. Function.

It can be seen from the above solution that, in the authentication server provided in the third embodiment of the present application, after receiving the object access request sent by the client, the target permission policy that matches the object access request can be obtained in the permission policy set, and then An authentication result indicating whether the target user in the object access request can access the target object in the target cloud system can be obtained. It can be seen that in this embodiment, by subdividing the access rights of multiple cloud systems into the accessed objects in each cloud system, the user can access the cloud system when the user accesses the cloud system through the client. Permission control of the accessed object, thereby improving the flexibility of permission management.

An embodiment of the present application further provides a storage medium on which a program is stored, and when the program is executed by a processor, implements the access authority control method for a multi-cloud system described in any of the foregoing embodiments.

An embodiment of the present application further provides a processor, where the processor is configured to run a program, wherein when the program runs, the method for controlling access rights of a multi-cloud system described in any of the foregoing embodiments is executed.

Taking the user and authority management of multiple cloud systems configured in the cloud in the financial industry as an example, the technical solutions in this application are illustrated as an example:

The inventor of the present application found that there are many different implementation schemes while managing the user's identity authentication and authority under the multi-cloud ecology, but they all have certain defects, as follows:

In one implementation scheme, different application systems maintain a set of user identity authentication systems. For administrators who manage different systems, they need to enter their own user names and passwords for login, authorization, operation, etc., use and management. It is inconvenient, and a single sign-on solution is formed in the later stage, and the authentication process is automatically completed by the system. Taking cookie-based single sign-on as an example, the main principle is to encrypt the user name and password and store them in a cookie. Then, when the user accesses the website, the current login status of the user is verified. If the verification fails, the user name and password are retrieved from the cookie. From the user's point of view, it is believed that the login operation of entering the user name and password is only performed once. In fact, the user name and password have been transmitted many times, which increases the risk of theft, and the unified login scheme cannot be accessed across domains. Each system has a set of login authentication system, which increases the complexity of the code and has great limitations.

For the CAS-based unified authentication center login method, an independent authentication center is deployed to provide authentication services. However, due to the complexity of its own authority control, a single CAS authentication cannot meet the subdivision of authority granularity.

Based on the above defects, in order to solve the problem of unified management of user's identity authentication and authority management in the multi-cloud ecosystem (multi-cloud system scenario), the inventor of the present application provides an identity for unified user life-cycle management in the multi-cloud ecosystem. The access and control system effectively reduces the cost of authority management and control, and provides a more flexible and convenient console access method for the multi-cloud ecosystem. For example, based on the unified authentication system of the unified authentication center CAS (Central Authentication Server), the management of the user's entire life cycle and the management of user rights can be regarded as a separate authentication system, so that the same user and the same rights can be used to log in and operate the cloud platform in a multi-cloud ecosystem. .

The specific design scheme is as follows:

In this application, a separate set of unified authentication center is built, namely the authentication server mentioned above. In the multi-cloud ecosystem, each cloud management system no longer manages separate user identity access and authority control modules, and manages users independently through a separate unified authentication center. Create, authorize, log in, authenticate, and delete accounts throughout the life cycle, and provide secure access to resources and operations. Access management is mainly implemented by binding authorization policies to users and user groups. The access key consists of a user name and password, or an AccessKeyID and AccessKeySecret, which are used for authentication of cloud service API requests. When users access functions or resources, they first authenticate their identity, and then verify their access rights. Only after passing the above two steps can they access resources, otherwise the access will be denied.

First, the single sign-on design for unified user lifecycle management in a multi-cloud form:

1. Database design of unified identity access and authority control system:

As shown in Figure 14, in the unified identity authentication scheme proposed in this application, a dedicated user information database is used to store user information, including user name, password, mobile phone number, email address, and user group to which they belong, and the access key corresponding to the user. and other information. Based on the principle of CAS, CAS Server is a unified identity authentication center (that is, an authentication server), and user information is stored in the database DB (database), which is authenticated by querying the DB during user authentication. The CAS Client is deployed in the application system of the client (ie, the client), and a URL is set to redirect the user authentication request to the CAS Server, so as to realize the operations of login, verification and logout.

2. Design of unified identity access and authority control system:

When the user logs in to the system through the domain name for the first time, the web page is redirected to the unified identity authentication server for the first login, and authentication is performed according to the user information credentials such as the user name and password entered by the user. If the authentication is passed, an access authentication evidence is generated. , that is, the authentication identifier in the preceding paragraph. When the user accesses other resources or functions under the cloud system, the user will carry the access ticket and submit it to the CAS unified identity authentication server for verification. At this time, the administrator no longer needs to open the system. Submit your login information again.

In order to realize the single sign-on function, CAS provides a global ticket TGT (ticket granting ticket), a service ticket ST (service ticket) and a global session (ticket granting cookies). The workflow of the unified identity authentication scheme based on CAS single sign-on is shown in Figure 14:

specific description:

1. The user accesses the cloud system 001 through the Web;

2. System 001 finds that the user has not been authenticated, and redirects the page request to the CAS Server;

3. The user enters the relevant authentication information and passes the verification;

4. After the authentication is passed, the authentication center will jump to the corresponding cloud system 001 for the user to log in with the relevant authentication;

5. After the authentication is passed, the authentication center jumps to the corresponding cloud system 002 for the user to log in (or) with the relevant authentication;

6. After the authentication is passed, the authentication center will jump to the corresponding cloud system 004 to log in (or) with the relevant authentication for the user; go to a different cloud system, such as cloud system 001;

7. The cloud system returns the information of the client user logging in to the cloud system.

Secondly, the permission management control of unified user life cycle management in the multi-cloud form:

After users perform unified single sign-on, due to the insufficient granularity of their own authority control, the functions and resources that can be operated after logging in to the platform need further authentication. As shown in Figure 15, when a user clicks on a certain resource or a function of a certain interface level on the cloud platform through the browser, the browser will carry the user information to verify with the authority control module of the unified authentication center. If the identity verification is passed, the user can operate the corresponding functions and resources of the platform. If the authentication fails, it will return to the operation without permission, and contact the administrator for authorization prompt information.

1. Database design of unified identity access and authority control system:

As mentioned above, in the unified identity authentication solution proposed in this application, a dedicated user information database is used to store user information. In addition, in order to further manage user rights, the database is designed to store the platform's policy data separately. The permission control scheme is implemented on the basis of IAM, and the policy is the key element of the scheme: based on the binding policy between the user and the user group, the authentication is realized to confirm whether the user has the authority to operate a certain function or resource of the platform. The authentication process is shown in Figure 15.

2. Design of unified identity access and authority control system

The IAM permission management system is a more refined access control, which achieves the purpose of managing the entire cloud platform for multiple users and different roles. When a user has logged in to the system and operates a certain resource on the platform, the browser will authenticate the operation to the unified authentication center. When a user initiates an access request, the system performs authentication and judgment according to the action in the user's authorized access policy. The inspection rules are shown in Figure 15:

1. The user initiates an access request;

2. The system redirects the request to the CAS Server;

3. Among the granted access permissions, the system firstly searches for permissions based on IAM project authorization, that is, it filters the matching permission policy information action in the permission policy set, and searches for the action corresponding to the request in the permissions;

4. If a matching Allow or Deny action is found, the cloud system 001 performs access control and returns the requested authentication decision, Allow or Deny, the authentication ends;

5. If a matching Allow or Deny action is found, the cloud system 002 performs access control and returns the requested authentication decision, Allow or Deny, the authentication ends;

6. If a matching Allow or Deny action is found, the cloud system 004 performs access control and returns the requested authentication decision, Allow or Deny, the authentication is over;

7. The cloud system returns the content corresponding to the request to the user, such as resources or functions.

Below with reference to Figure 16, the acquisition process of the authentication result will be described:

First, after obtaining the access request, find out whether there is any IAM permission policy information corresponding to the access request. If there is, then the authentication result can be directly obtained, Allow or Deny, the authentication is over;

If there is no IAM permission policy information corresponding to the access request, then determine whether the user is added to the user group. If so, find out whether there is IAM permission policy information corresponding to the user group. If there is, the authentication result can be directly obtained, Allow or Deny , the authentication is over;

And if the user is not added to the user group or there is no IAM permission policy information corresponding to the user group to which the user is added, then the authentication result is also obtained, that is, Deny, and the authentication ends.

To sum up, in the multi-cloud mode, enterprises often use a set of user and authority control systems under different clouds, which has great drawbacks. In view of this, in this application, a separate set of identity access and authority control for user life cycle management is set up. System to solve the status quo of multiple identity authentication and individual authority control in the multi-cloud ecosystem, thereby reducing the management cost of user registration, login, and authority control. Moreover, the unified identity access and authority control system can reduce system redundancy and facilitate system administrators to manage their own products. For example, CVM administrators have the same management authority under different clouds. Compared with the traditional user mode, this mode is more suitable for the actual pain points faced by existing enterprises, and can improve management efficiency for enterprises.

It can be seen that the technical solution in the present application can effectively solve the management of platform users in a multi-cloud deployment form. From the user's point of view, the same user (the product administrator role on the cloud platform) can easily manage the products they operate and maintain through a set of authentication systems; for the platform management side, an independent user authentication system, Get rid of the complex architecture and redundancy of platform-side management, each platform no longer needs to maintain a separate set of user management modules, and can focus more on the development of its own products; in addition, in maintaining user information data fields, the management of the user's full life cycle , user unified authorization, permission management and other aspects can have better operability, and will not cause the unmanageability of multiple user management modules on multiple platforms, or the lack of a platform user, resulting in the lack of product administrator roles and affecting products. management and operation.

The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same and similar parts between the various embodiments can be referred to each other. As for the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant part can be referred to the description of the method.

Professionals may further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two, in order to clearly illustrate the possibilities of hardware and software. Interchangeability, the above description has generally described the components and steps of each example in terms of functionality. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.

The steps of a method or algorithm described in conjunction with the embodiments disclosed herein may be directly implemented in hardware, a software module executed by a processor, or a combination of the two. A software module can be placed in random access memory (RAM), internal memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other in the technical field. in any other known form of storage medium.

The above description of the disclosed embodiments enables any person skilled in the art to make or use the present application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, this application is not intended to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims (10)

1. An access authority control method for a multi-cloud system is applied to an authentication server, the authentication server corresponds to a plurality of cloud systems, and the cloud systems comprise a plurality of accessed objects, and the method comprises the following steps:

receiving an object access request sent by a client, wherein the object access request at least comprises a user identifier of a target user and an object identifier of a target object, and the target object is an accessed object in a target cloud system in the plurality of cloud systems;

obtaining a target permission strategy matched with the user identification and the object identification in a permission strategy set, wherein the permission strategy set comprises a plurality of pieces of permission strategy information, and each piece of permission strategy information corresponds to one user and one accessed object;

and obtaining an authentication result according to the target authority strategy, wherein the authentication result represents whether the target user has the authority of accessing the target object in the target cloud system.

2. The method of claim 1, wherein obtaining a target permission policy matching the user identifier and the object identifier in a permission policy set comprises:

screening initial policy information matched with the user identification and/or the user group identification corresponding to the user identification in an authority policy set; the user group identification is the identification of a target user group to which the target user belongs; the target user group also comprises one or more other users;

and screening out the target authority strategy matched with the object identification in the initial strategy information.

3. The method according to claim 2, wherein screening, in a set of permission policies, initial policy information that matches the user identifier and/or a user group identifier corresponding to the user identifier comprises:

screening first policy information matched with the user identification in an authority policy set;

and screening second policy information matched with the user group identification in the permission policy set, wherein the first policy information and/or the second policy information form initial policy information.

4. The method of claim 1, further comprising:

and transmitting the authentication result to the target cloud system.

5. The method of claim 1, wherein the object access request further includes an authentication identification of the target user;

the identity authentication identifier is generated when the target user logs in the target cloud system, and represents that the target user successfully logs in the target.

6. The method of claim 5, further comprising:

receiving a user login request sent by the client, wherein the user login request at least comprises authentication information of the target user and a system identifier of the target cloud system;

verifying the verification information according to the system identification to obtain a verification result, wherein the verification result represents whether the target user passes the identity verification of the target cloud system;

and under the condition that the verification result represents that the target user passes the identity verification of the target cloud system, obtaining an identity verification identifier of the target user.

7. The method of claim 6, wherein verifying the verification information to obtain a verification result according to the system identifier comprises:

obtaining verification signature information corresponding to the verification information;

and comparing the standard signature information corresponding to the system identification with the verification signature information to obtain a verification result.

8. The method of claim 7, wherein obtaining verification signature information corresponding to the verification information comprises:

signing the user name and the password in the verification information by using a signature algorithm to obtain verification signature information;

or,

and signing the access secret key in the verification information by using a signature algorithm to obtain verification signature information.

9. An access right control device for a multi-cloud system, applied to an authentication server, the authentication server corresponding to a plurality of cloud systems, the cloud systems including a plurality of accessed objects, the device comprising:

a request receiving unit, configured to receive an object access request sent by a client, where the object access request at least includes a user identifier of a target user and an object identifier of a target object, and the target object is an accessed object in a target cloud system of the multiple cloud systems;

a policy obtaining unit, configured to obtain a target permission policy that matches the user identifier and the object identifier in a permission policy set, where the permission policy set includes multiple pieces of permission policy information, and each piece of permission policy information corresponds to one user and one accessed object;

and the result obtaining unit is used for obtaining an authentication result according to the target authority strategy, wherein the authentication result represents whether the target user has the authority of accessing the target object in the target cloud system.

10. An authentication server, wherein the authentication server corresponds to a plurality of cloud systems, and wherein the cloud systems include a plurality of accessed objects, the authentication server comprising:

a transmission module, configured to receive an object access request sent by a client, where the object access request at least includes a user identifier of a target user and an object identifier of a target object, and the target object is an accessed object in a target cloud system of the multiple cloud systems;

the processor is used for obtaining a target authority policy matched with the user identifier and the object identifier in an authority policy set, wherein the authority policy set comprises a plurality of pieces of authority policy information, and each piece of authority policy information corresponds to one user and one accessed object; and obtaining an authentication result according to the target authority strategy, wherein the authentication result represents whether the target user has the authority of accessing the target object in the target cloud system.

Images