Identity escrow and authentication cloud resource access control system and method for multiple tenants

Abstract

The invention provides an identity escrow and authentication cloud resource access control system and an identity escrow and authentication cloud resource access control method for multiple tenants. The system is characterized in that the cloud service business of a cloud service provider is divided into two parts of an identity authentication permission part and a cloud resource access control part, wherein the business of the identity authentication permission part is hosted by a credible third party TIdP of the cloud service, and the TIdP is in charge of governing hosted user information and group information of the tenant, completes the user identity authentication work of a hosting user and generates cross-domain security credential service containing identity recognition information; the cloud resource access control part is responsible for assigning corresponding permission for a group where the user is located, and analyzes the access request of the user and implements an access control decision according to the existing resource access control strategy when the user accesses to the cloud resource, so as to achieve safety access control over the cloud resource.

Description

technical field [0001] The invention belongs to the field of identity trusteeship and access control of information security, and in particular relates to a multi-tenant-oriented identity trusteeship authentication cloud resource access control system and control method. Background technique [0002] With the development of new information technologies such as cloud computing and the Internet of Things, cloud service providers are faced with how to adapt to this new cloud service identity management model, how to reduce the cost of user identity management and maintenance, and how to ensure safe user identity authentication, etc. As a result, a new type of user identity authentication hosting business was born, that is, each cloud service provider delivers the identity authentication work to a trusted third party for cloud services (usually called TIdP, Trusteeship Identity Provider) , so as to reduce the burden of the service provider (Service Provider, SP) on user identity...

AI Technical Summary

Problems solved by technology

[0003] The current identity authentication service method (commonly referred to as the traditional single sign-on service method) of a trusted third party in the cloud service mode can no longer meet the needs of users to exchange identity information securely under cross-domain service access. There are mainly the following problems in the traditional single sign-on service: (1) Most of the OAuth protocol is used as the protocol for transmitting user identity authentication information. In addition, the protocol requires all users to be in a user group domain, and cannot provide a secure and relatively isolated single sign-on service for cloud service providers; (2) Use cookies to maintain user login authentication status The single sign-on service implemented cannot solve the problem of authentication identity information transfer across DNS domains, that is, the login status stored in the cookie cannot be transferred from one domain to another

[0004] At the same time, the current identity authentication service method cannot control the service provider SP's access to its cloud resources, and cannot individually revoke the access to a certain SP without affecting all SPs

Images