WO2011147361A1 - Method, device and system for implementing resource management in cloud computing - Google Patents

Abstract

A method, device and system for implementing the resource management in the cloud computing is provided by the present invention. The method comprises: receiving a first message transmitted by a user device for performing the operation on the resource, wherein the first message carries the digital certificate and the requested operation; obtaining an operation list corresponding to the digital certificate according to the pre-recorded corresponding relationships between the digital certificate and the role and between the role and the operation; if the requested operation belongs to the operation list, allowing the requested operation. The embodiments of the present invention enable the rights-divided and domain-divided management.

Description

 Method, device and system for realizing resource management in cloud computing

This application claims the priority of the Chinese patent application filed on December 23, 2010, the Chinese Patent Office, the application number is 201010604779.X, and the invention is entitled "Method, Equipment and System for Realizing Resource Management in Cloud Computing". This is incorporated herein by reference. TECHNICAL FIELD The present invention relates to network communication technologies, and in particular, to a method, device, and system for implementing resource management in cloud computing. BACKGROUND A cloud computing network includes a "cloud" and a user terminal with powerful computing capabilities. The core concept of cloud computing is to continuously improve the processing power of the "cloud", thereby reducing the processing load of the user terminal, and finally simplifying the user terminal into one. Simple input and output devices, and can enjoy the powerful computing power of "cloud" on demand.

 In the existing cloud computing network, the cloud network can assign a security authentication certificate to the user, and the user uses the security authentication certificate to access the cloud network. However, the existing security certificate can only perform security authentication for users and cannot implement decentralized and domain management. Summary of the invention

 The embodiments of the present invention provide a method, a device, and a system for implementing resource management in cloud computing, which are used to implement decentralized and domain-based management of resources in cloud computing.

 The embodiment of the invention provides a method for implementing resource management in cloud computing, including:

 Receiving, by the user equipment, a first message for operating on a resource, where the first message carries a digital certificate and an operation of the request;

 Acquiring an operation list corresponding to the digital certificate according to a correspondence between a pre-recorded digital certificate and a role and a correspondence between a role and an operation;

 If the requested operation belongs to the operation list, then the operation on the request is allowed.

 An embodiment of the present invention provides a device for implementing resource management in a cloud computing, including:

The receiving module is configured to receive a first message that is sent by the user equipment and is used to operate the resource, where the first message carries the digital certificate and the requested operation; An obtaining module, configured to acquire an operation list corresponding to the digital certificate according to a correspondence between a pre-recorded digital certificate and a role and a correspondence between a role and an operation;

 And an execution module, configured to allow an operation on the request if the requested operation belongs to the operation list.

 The embodiment of the invention provides a system for implementing resource management in cloud computing, including:

 The UPF is configured to receive a second message that is sent by the user equipment for registration, where the second message carries the requested role, and allocates a digital certificate to the user equipment according to a corresponding relationship between the pre-configured role and the digital certificate, and Recording a correspondence between the digital certificate and the role; sending the assigned digital certificate to the user equipment, so that the user equipment uses the digital certificate to request an operation;

 a cloud management device, configured to receive a first message sent by the user equipment for operating on a resource, where the first message carries a digital certificate and a request operation; according to a correspondence between a digital certificate and a role recorded in the UPF, and a role Corresponding to the operation, obtaining an operation list corresponding to the digital certificate; if the requested operation belongs to the operation list, allowing an operation on the request.

 According to the foregoing technical solution, the digital certificate is used in the accessing cloud resource, and the digital certificate corresponds to different roles, and different roles correspond to different operations. Therefore, the digital certificate can be used to have different rights or different areas. Different users can perform different operations to achieve decentralized domain management of users. BRIEF DESCRIPTION OF THE DRAWINGS In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below. Obviously, the drawings in the following description are some of the present invention. For the embodiments, other drawings may be obtained from those skilled in the art without any inventive labor.

 1 is a schematic flow chart of a method according to a first embodiment of the present invention;

 2 is a schematic structural diagram of a system corresponding to a second embodiment of the present invention;

 3 is a schematic flow chart of a method corresponding to a second embodiment of the present invention;

 4 is a schematic diagram of a certificate system in an embodiment of the present invention;

 FIG. 5 is a schematic flowchart of a method according to a third embodiment of the present invention; FIG.

 6 is a schematic flow chart of a method according to a fourth embodiment of the present invention;

 7 is a schematic flow chart of a method according to a fifth embodiment of the present invention;

FIG. 8 is a schematic diagram of an application scenario in an embodiment of the present invention; FIG. 9 is a schematic diagram of a resource before and after resource sharing according to an embodiment of the present invention;

 FIG. 10 is a schematic structural diagram of a device according to a sixth embodiment of the present invention; FIG.

 FIG. 11 is a schematic structural diagram of a system according to a seventh embodiment of the present invention. The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. The embodiments are a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

 FIG. 1 is a schematic flowchart of a method according to a first embodiment of the present invention, including:

 Step 11: The system for implementing resource management in the cloud computing receives a first message sent by the user equipment for operating the resource, where the first message carries a digital certificate and an operation of the request;

 Step 12: The system for implementing resource management in the cloud computing obtains an operation list corresponding to the digital certificate according to the correspondence between the pre-recorded digital certificate and the role and the correspondence between the role and the operation;

 Step 13: If the requested operation belongs to the operation list, the operation on the request is allowed. In this embodiment, a digital certificate is used in accessing a cloud resource, and the digital certificate corresponds to different roles, and different roles correspond to different operations. Therefore, the digital certificate can enable different users with different rights or different regions to perform different operations. , to achieve decentralized domain management of users.

 2 is a schematic structural diagram of a system corresponding to a second embodiment of the present invention, including a user equipment (USER) 21, a Provisioning Orchestration Engine (POE) 22, a User Profile Function (UPF) entity 23, and a virtual Machine desktop (VDESKTOP) 24 and cloud resource management device 25. The user equipment 21 can correspond to a company, a home, or an individual, for example, a terminal device used by an enterprise as a user equipment. The POE 22 is the user's account opening. For example, when the user registers, the user equipment can send a message for registration to the UPF through the POE, and complete the user registration at the UPF. UPF 23 is used to assign digital certificates and resources to users who apply for registration, and to save each other's correspondence. The virtual machine desktop 24 is an access interface of the user. For example, the user device requests a specified operation of the specified resource from the cloud resource management device through the virtual machine desktop. The cloud resource management device 25 is configured to receive a message for the resource operation sent by the user equipment through the virtual machine desktop, and then perform authentication from the UPF according to the related information carried in the message. If the authentication is performed, the user equipment is allowed to perform the corresponding operating.

For the specific interaction content between the above devices, refer to the following method embodiments. FIG. 3 is a schematic flowchart of a method corresponding to a second embodiment of the present invention, including:

 Step 31: The user equipment sends a second message for registration to the POE, where the second message carries the requested role.

 In this embodiment, in order to implement decentralized domain management, different digital certificates may be assigned different roles, different roles have different rights, and different rights may perform different operations. For example, the role may include an admin operation guest. Among them, admin can perform all operations, operation can be viewed and modified, and guests can only view. The user who uses the digital certificate corresponding to the admin can create, delete, modify, and view the user. The user who uses the digital certificate corresponding to the operation can modify and view the user who can use the digital certificate corresponding to the guest.

 Step 32: The POE forwards the second message to the UPF.

 Step 33: After receiving the second message, the UPF allocates a digital certificate to the user equipment, and records a correspondence between the user equipment and the digital certificate and the role.

 Among them, the UPF can assign different digital certificates to different roles in a random manner, and it is necessary to ensure that different roles correspond to different digital certificates.

 For example, FIG. 4 is a schematic diagram of a certificate system according to an embodiment of the present invention. Referring to FIG. 4, a certificate system may be saved in the UPF, and the certificate system includes an operation list (PriInfo), a role list (RoleInfo), and a user list (UserInfo) operation. The list includes n operations (Pri), the role list includes n roles (Role), and the user list includes n users (User). It can be understood that the number of operations, roles, and users can be different.

 For the composition of each operation, see Table 1. The composition of each role can be found in Table 2. The composition of each user can be found in Table 3.

 Table 1

表 2 数据 描述

Table 2 Data description

 ROLEDESC role description

 ROLEID role ID

ROLENAME role name

 PRIVID permission ID

Data description

 CERTCONTENT certificate content

 CERTID certificate ID

CREATEDTIME creation time

 STATUS certificate status

ROLEID role ID

RESOWNER resource owner

In the above three lists, the operation list and the role list may be pre-configured, and the user list may be continuously updated as the user equipment requests a digital certificate. For example, when User l requests role ~ 1, the UPF can randomly assign a digital certificate to it (the randomly assigned digital certificate is different from the digital certificate of other roles), and record the ID number of its digital certificate in Table 3. In the certificate ID item. SP, assuming that the number corresponding to the role ~ 1 is the certificate ~ 1, User~l corresponds to the resource owner in Table 3 is User~l, the certificate ID is certificate~1, and the role ID is role~1. In addition, the creation time is the time when the digital certificate is created. The content of the certificate refers to the public-private key pair that the user performs authentication. When generating the certificate, the certificate content of the certificate can be generated according to the preset (including the user name, time stamp, etc.). The certificate status can be active or inactive. When the certificate is invalid, the status of the certificate is set to inactive.

In addition, it can be understood that one user equipment can request multiple roles to obtain multiple digital certificates correspondingly, and then the multiple digital certificates can be allocated to different users using the user equipment. For example, one Enterprises can apply for digital certificates corresponding to different roles such as admin and operation^ guest, and then assign digital certificates corresponding to different roles to different people.

 Step 34: The UPF returns the assigned digital certificate to the user equipment through the POE.

 At this point, the user is opened, and then the user equipment can request the required operation using the assigned digital certificate.

 Step 35: The user equipment requests an operation using the assigned digital certificate.

 In this embodiment, by assigning a digital certificate to a user, and different digital certificates have different roles, different operations can be performed, and thus decentralized domain management can be implemented.

 The following takes the operation to create a virtual machine as an example. For the specific process, see Figure 5.

 FIG. 5 is a schematic flowchart of a method according to a third embodiment of the present invention. In this embodiment, a user equipment is requested to create a virtual machine as an example. Referring to FIG. 5, this embodiment includes:

 Step 51: The user equipment obtains a digital certificate. See steps 31-34 for details.

 Step 52: The user equipment sends a first message for operating the resource to the cloud resource management device by using the virtual machine desktop, where the first message carries the digital certificate and the requested operation.

 Step 53: The cloud resource management device authenticates the first message.

 For example, if the first message is encrypted at the time of transmission, the cloud resource management device needs to decrypt. In addition, the cloud resource management device may also obtain user information from the UPF, and determine whether the digital certificate is owned by the user device to verify the legitimacy of the user. Specifically, the encryption and decryption algorithm and the user legality verification process can be implemented by a usual method.

 In particular, after the foregoing verification, the privilege verification is performed, as follows: Step 54: The cloud resource management device acquires an operation list corresponding to the digital certificate from the UPF.

 Specifically, the role ID corresponding to the digital certificate may be obtained according to Table 3, and the permission ID corresponding to the role ID is obtained according to Table 2, and then the operation name corresponding to the permission ID is obtained according to Table 1. All the operation names corresponding to the digital certificate can form an operation list. For example, if the role corresponding to the digital certificate is admin, the corresponding operation list includes creation, deletion, modification, and viewing; if the role corresponding to the digital certificate is operation, the corresponding operation list includes modification and viewing; if the role corresponding to the digital certificate For guest, the corresponding operation only includes viewing.

 Step 55: If the requested operation belongs to the operation list, allow operations on the request, for example, create a virtual machine.

For example, in this embodiment, it is assumed that the digital certificate adopted by the user can perform a creation operation, and the requested operation is to create a virtual machine, and the cloud resource management device creates a virtual machine. In order to further implement data sharing, this embodiment may further include:

 Step 56: The cloud resource management device records the correspondence between the digital certificate and the virtual machine.

 In some scenarios, mutual authorization between digital certificates may be required. For example, resources under digital certificates ~ 1 need to be assigned to digital certificates ~ 2 for resource sharing.

 In this embodiment, the cloud resource management device is accessed by using a digital certificate, and different digital certificates have different roles, and different operations can be performed, so that decentralized domain management can be implemented.

 FIG. 6 is a schematic flowchart of a method according to a fourth embodiment of the present invention. This embodiment uses an example of assigning a virtual machine under a digital certificate to another digital certificate as an example. Referring to FIG. 6, this embodiment includes:

 Step 61: The user equipment obtains a digital certificate.

 For details, see step 51.

 Step 62: The user equipment sends a first message for operating the resource to the cloud resource management device through the virtual machine desktop, where the first message carries the digital certificate and the requested operation.

 In this embodiment, it is assumed that the digital certificate acquired by the user equipment is a certificate 〜1, and the requested operation is to allocate the virtual machine corresponding to the certificate ~1 to the certificate ～2 for use.

 Step 63: The cloud resource management device authenticates the first message.

 Step 64: The cloud resource management device acquires an operation list corresponding to the digital certificate from the UPF.

 For details of steps 63-64, refer to steps 53-54.

 Step 65: If the requested operation belongs to the operation list, allow operations on the request, such as allocating a virtual machine. When the virtual machine is allocated, the correspondence between the resource and the certificate ID may be added in the cloud resource management device.

 For example, if the operation corresponding to the certificate 〜1 includes allocating resources, the cloud resource management device in this embodiment may assign the virtual machine corresponding to the certificate ～1 to the certificate ～2.

 Step 66: The cloud resource management device updates the correspondence between the digital certificate and the virtual machine.

 For example, the original virtual machine ~ 1 corresponds to the certificate ~ 1, but after the above processing, the certificate corresponding to the virtual machine ~ 1 includes the certificate ~1 and the certificate ~2.

 Through the flow shown in FIG. 6, the certificate 〜2 may have the operation authority for the resource to which the certificate ～1 belongs, for example, the virtual machine ～1 may be operated by using the certificate ～2, specifically the next embodiment.

 In this embodiment, the cloud resource management device is accessed by using a digital certificate, and different digital certificates have different roles, and different operations can be performed, so that decentralized domain management can be implemented. In addition, in this embodiment, resource sharing can be realized by allocating resources under one digital certificate to another digital certificate.

FIG. 7 is a schematic flowchart of a method according to a fifth embodiment of the present invention. In this embodiment, an authorized digital certificate is used. For example, the resource of the digital certificate with the authorized authority is operated. Referring to FIG. 7, the embodiment includes:

 Step 71: The user equipment obtains a digital certificate.

 Step 72: The user equipment sends a first message for operating the resource to the cloud resource management device by using the virtual machine desktop, where the first message carries the digital certificate and the requested operation.

 Step 73: The cloud resource management device authenticates the first message.

 Step 74: The cloud resource management device acquires an operation list corresponding to the digital certificate from the UPF.

 Step 75: If the requested operation belongs to the operation list, allow the operation of the request, for example, restart the virtual machine.

 The specific content of steps 71-75 is similar to steps 61-65. Unlike steps 61-65, the digital certificate used in the embodiment shown in FIG. 6 is a digital certificate with authorization authority (such as certificate ~ 1). The digital certificate used in this embodiment is an authorized digital certificate (such as certificate ~ 2).

 In addition, through the process shown in FIG. 6, the correspondence between the resource and the digital certificate has been updated in the cloud resource management device. Therefore, the operation of the certificate ～2 can be performed on the virtual machine ～1 by using the certificate ～2, for example, for example, The certificate ~ 2 has the right to restart the virtual machine. The requested operation is to restart the virtual machine. In this embodiment, the virtual machine can be restarted by using the certificate ~2.

 In this embodiment, resource sharing is realized by accessing a resource to which a digital certificate having an authorized authority belongs by using an authorized digital certificate.

 The above method of the embodiment of the present invention can be applied to the following scenarios:

 Enterprise-level application: The system is applied to enterprises. The enterprise manager is equivalent to USER. For employees whose internal level is not available, the certificate can be applied for. The role of the certificate and the function corresponding to the certificate role can be requested by the enterprise administrator. Provided at initialization time. USER can assign certificates to employees at different levels within the enterprise and perform corresponding operations. When personnel changes or internal structure rectification, only need to dynamically modify the certificate role held by the sub-users, the decentralized domain of the entire enterprise can be completed. .

 In this way, the management of the entire enterprise is completely managed by certificates, which is flexible, simple, and efficient. Resource sharing can realize the work entrustment within the enterprise. For example: A. Dedicating the resource to B due to business trip, then B can complete the operation of the B holding certificate authority for the A resource.

 Home-level applications: For home-level applications, resource sharing can play a bigger role. As a USER in the family, different certificate roles can be applied according to users in the family, so that in a family, all family members can perform different permission operations on the same resource. Resource sharing can be achieved between family members to maximize resource savings.

Of course, the embodiment of the present invention is not limited to the above application, and can be applied to various applications, and can be provided. State of the deployment to meet the needs of users.

 After the method of the embodiment of the present invention is used, each user equipment can correspond to multiple certificates. For example, FIG. 8 is a schematic diagram of an application scenario according to an embodiment of the present invention. Referring to FIG. 8, each user equipment (USER) can correspond to a certificate. In the set, the certificate set includes multiple certificates, and different certificates have different rights, wherein the user equipment is, for example, a business, a family, and an individual. Since certificates have different permissions, different operations can be performed when different certificates are used, so decentralized and domain-based management can be implemented.

 In addition, the embodiment of the present invention can allocate resources to another certificate by using a certificate, and the resource sharing can be implemented. For example, FIG. 9 is a schematic diagram of the resource sharing before and after the resource sharing in the embodiment of the present invention. Referring to FIG. 9, before the resource sharing, USER 1 (corresponding digital certificate is certificate ~ 1) The resources that can be accessed are VM~1, USER-2 (corresponding digital certificate is certificate~ 2) The resources that can be accessed are VM~2; When certificate~2 is authorized to certificate~ 1 After the resource sharing is realized, the resources that USER-1 (corresponding digital certificate is certificate ~ 1) can be accessed by VM~1 and VM~2, USER-2 (the corresponding digital certificate is certificate~ 2). The resources that can be accessed are VM~2.

 In summary, the digital certificate in the embodiment of the present invention can not only implement the authentication function, but also authorize the digital certificate by authorizing the operation and resources, and can perform decentralized domain management and resource sharing through the digital certificate, so that the decentralization is performed. The domain operation is more reasonable. By adopting a digital certificate with decentralized and decentralized functions, it is possible to complete common authentication and service authentication when accessing a user request, so that the management hierarchy of the entire system is more distinct. At the same time, resource sharing can avoid waste of resources in the whole system, and the overall demand of resources for users will also shrink, thereby saving user resource efficiency, and at the same time, resource operation is more flexible.

 FIG. 10 is a schematic structural diagram of a device according to a sixth embodiment of the present invention, including a receiving module 101, an obtaining module 102, and an executing module 103. The receiving module 101 is configured to receive a first message sent by a user equipment for operating a resource, where The first message carries the operation of the digital certificate and the request; the obtaining module 102 is configured to obtain an operation list corresponding to the digital certificate according to the correspondence between the pre-recorded digital certificate and the role and the correspondence between the role and the operation; For allowing the operation of the request if the requested operation belongs to the operation list.

 The execution module is specifically configured to create a virtual machine corresponding to the digital certificate having the created permission, when the digital certificate is a digital certificate having the right to create a virtual machine, and the operation of the request is to create a virtual machine. And record the correspondence between the digital certificate and the virtual machine.

Or, when the digital certificate is a digital certificate with an assigned authority, and the operation of the request is to allocate the virtual machine corresponding to the digital certificate with the assigned authority to the authorized digital certificate, the executing module is specifically used to Assigning, to the authorized digital certificate, the virtual machine corresponding to the digital certificate with the assigned authority; updating the correspondence between the recorded digital certificate and the resource, so that the resource corresponding to the digital certificate with the authorized authority is And a source, associated with the authorized digital certificate, so that the user equipment can operate the resource corresponding to the authorized digital certificate by using the authorized digital certificate.

 Or, after the digital certificate with the authorized authority grants the corresponding resource to the authorized digital certificate, the executing module is specifically configured to use the digital certificate with the authorized authority according to the authority of the authorized digital certificate. The corresponding resource operates.

 In this embodiment, a digital certificate is used in accessing a cloud resource, and the digital certificate corresponds to different roles, and different roles correspond to different operations. Therefore, the digital certificate can enable different users with different rights or different regions to perform different operations. , to achieve decentralized domain management of users.

 FIG. 11 is a schematic structural diagram of a system according to a seventh embodiment of the present invention, including a UPF 111 and a cloud management device 112. The UPF 111 is configured to receive a second message sent by the user equipment for registration, where the second message carries the requested role. And assigning a digital certificate to the user equipment according to a correspondence between the pre-configured role and the digital certificate, and recording a correspondence between the digital certificate and the role; and sending the distributed digital certificate to the user equipment, so that the user equipment adopts The digital certificate request operation; the cloud management device 112 is configured to receive a first message sent by the user equipment for operating on the resource, where the first message carries a digital certificate and a request operation; according to the digital certificate recorded in the UPF Corresponding relationship with the role and a correspondence between the role and the operation, obtaining an operation list corresponding to the digital certificate; if the requested operation belongs to the operation list, allowing the operation of the request.

 In this embodiment, a digital certificate is used in accessing a cloud resource, and the digital certificate corresponds to different roles, and different roles correspond to different operations. Therefore, the digital certificate can enable different users with different rights or different regions to perform different operations. , to achieve decentralized domain management of users.

 It can be understood that related features in the above methods and devices can be referred to each other. Further, "first", "second", and the like in the above embodiments are used to distinguish the embodiments, and do not represent the advantages and disadvantages of the embodiments.

 A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to program instructions, and the foregoing program may be stored in a computer readable storage medium, and when executed, the program includes The foregoing steps of the method embodiment; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

 Finally, it should be noted that the above embodiments are only for explaining the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art will understand that The technical solutions described in the foregoing embodiments are modified, or the equivalents of the technical features are replaced by the same. However, the modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

Rights request A method for implementing resource management in cloud computing, comprising:  Receiving, by the user equipment, a first message for operating on a resource, where the first message carries a digital certificate and an operation of the request;  Obtaining an operation list corresponding to the digital certificate according to a correspondence between a pre-recorded digital certificate and a role and a correspondence between the role and the operation;  If the requested operation belongs to the operation list, then the operation on the request is allowed.  2. The method according to claim 1, further comprising:  Receiving, by the user equipment, a second message for registration, where the second message carries the requested role;  Assigning a digital certificate to the user equipment according to a correspondence between the pre-configured role and the digital certificate, and recording a correspondence between the digital certificate and the role;  The assigned digital certificate is sent to the user equipment such that the user equipment requests operation using the digital certificate.  The method according to claim 1 or 2, wherein, when the digital certificate is a digital certificate having permission to create a virtual machine, and the operation of the request is to create a virtual machine, the request is allowed to be Operation, including:  Create a virtual machine corresponding to the digital certificate with the created permission, and record the correspondence between the digital certificate and the virtual machine.  The method according to claim 1 or 2, wherein, when the digital certificate is a digital certificate having an assigned authority, the operation of the request is to allocate the virtual machine corresponding to the digital certificate having the assigned authority When an authorized digital certificate is given, the operation of allowing the request includes:  Assigning, to the authorized digital certificate, the virtual machine corresponding to the digital certificate having the assigned authority;  Updating a correspondence between the recorded digital certificate and the resource, so that a resource corresponding to the authorized digital certificate is associated with the authorized digital certificate, so that the user equipment can use the authorized digital certificate to The resource corresponding to the digital certificate with authorized authority operates.  The method according to claim 1 or 2, wherein after the digital certificate having the authorization authority grants the corresponding resource to the authorized digital certificate, the operation of allowing the request includes: Corresponding to the digital certificate having the authorized authority according to the authority of the authorized digital certificate Resources to operate.  6. A device for implementing resource management in cloud computing, characterized in that:  The receiving module is configured to receive a first message that is sent by the user equipment and is used to operate the resource, where the first message carries the digital certificate and the requested operation;  An obtaining module, configured to obtain, according to a correspondence between a pre-recorded digital certificate and a role and a correspondence between a role and an operation, an operation list corresponding to the digital certificate;  And an execution module, configured to allow an operation on the request if the requested operation belongs to the operation list.  The device according to claim 6, wherein when the digital certificate is a digital certificate having the authority to create a virtual machine, and the operation of the request is to create a virtual machine, the executing module is specifically configured to create and The virtual machine corresponding to the digital certificate with the created authority, and records the correspondence between the digital certificate and the virtual machine.  8. The device according to claim 6, wherein when the digital certificate is a digital certificate having an assigned authority, the operation of the request is to assign a virtual machine corresponding to the digital certificate having the assigned authority to the digital certificate. The execution module is specifically configured to allocate the virtual machine corresponding to the digital certificate with the assigned authority to the authorized digital certificate; update the correspondence between the recorded digital certificate and the resource, so that The resource corresponding to the authorized digital certificate is associated with the authorized digital certificate, so that the user equipment can use the authorized digital certificate to operate the resource corresponding to the authorized digital certificate.  The device according to claim 6, wherein after the digital certificate having the authorized authority grants the corresponding resource to the authorized digital certificate, the executing module is specifically configured to use the authorized digital certificate. Permission to operate on resources corresponding to the digital certificate with the authorized authority.  10. A system for implementing resource management in cloud computing, characterized in that:  The UPF is configured to receive a second message that is sent by the user equipment for registration, where the second message carries the requested role, and allocates a digital certificate to the user equipment according to a corresponding relationship between the pre-configured role and the digital certificate, and Recording a correspondence between the digital certificate and the role; sending the assigned digital certificate to the user equipment, so that the user equipment uses the digital certificate to request an operation;  a cloud management device, configured to receive a first message sent by the user equipment for operating on a resource, where the first message carries a digital certificate and a request operation; according to a correspondence between a digital certificate and a role recorded in the UPF, and a role Corresponding to the operation, obtaining an operation list corresponding to the digital certificate; if the requested operation belongs to the operation list, allowing an operation on the request.