Private cloud service-oriented dual identity authentication method and system

Abstract

The invention discloses a private cloud service-oriented dual identity authentication method and system, and the method specifically comprises the steps: proposing a trust transfer model, taking a third-party mechanism trusted by both parties between an application domain A and an application domain B as a guarantee, and guaranteeing the effectiveness of a trust chain between the domain A and the domain B; based on the model, a user firstly establishes a direct trust relationship with the application domain A through an identity authentication process; afterwards, if the user wants to further establish a trust relationship with the domain B, the domain A is used as a middleman for recommendation, so that the recommendation trust of the domain B to the user is realized. And a trust chain for transmitting the trusted identity of the user is established among the domain B, the domain A and the user.

Description

Technical Field

[0001] The present invention belongs to the technical field of data processing, and in particular is a dual identity authentication method for private cloud services. Background Art

[0002] In recent years, with the in-depth promotion of big data and cloud computing technologies, various application services have gradually relied on cloud computing environments for construction and deployment, hosting application services in cloud computing environments and providing users with various access and application services in the form of cloud services. In a cloud computing environment, identity authentication is a means for cloud services and applications to verify the legitimacy of user identities, and is a prerequisite for users to obtain access rights to cloud service-related resources. Since applications are built on cloud platforms, when users operate two applications on the cloud platform at the same time, they need to perform identity authentication processes for the two cloud applications separately. Repeated authentication brings many inconveniences to users' daily work. Summary of the invention

[0003] In view of the shortcomings of the prior art, the present invention optimizes the private cloud service identity authentication process while fully meeting security protection requirements and solves the problem of repeated identity authentication required for accessing cloud applications. This invention studies a private cloud service identity authentication optimization method based on a trust transfer mechanism. By establishing a private cloud service user identity trust transfer model, the secure transfer of user trusted identities between the cloud platform and cloud application entities is achieved, thereby achieving the optimization effect of no longer needing to repeatedly perform identity authentication when users access private cloud services across domains.

[0004] To achieve the above object, the present invention provides the following technical solutions:

[0005] A dual identity authentication method for private cloud services, comprising the following steps:

[0006] Step S1: The user logs in to application domain A, and application domain A verifies the user information. After the verification is passed, application domain A generates tokenA; the user establishes a session connection with application A through tokenA;

[0007] Step S2: The user requests to jump from application domain A to application domain B. Application domain A uploads tokenA to a third-party organization. The third-party organization verifies the user's information by parsing the information of tokenA. After the verification is passed, the third-party organization transmits the parsed user information to application domain B. Application domain B generates tokenB based on the parsed user information. Application domain B responds to the user's jump request based on tokenB through tokenB and establishes a dialogue connection with the user.

[0008] Furthermore, the third-party organization in step S2 includes a private cloud service operator.

[0009] Furthermore, in step S1, the user logs in to application domain A, and application domain A verifies the user information. Specifically, the user logs in to domain A, enters the account and password, and then the account and password are verified on the domain A server.

[0010] Furthermore, the user is a private cloud service administrator.

[0011] Furthermore, the application domain A and the application domain B are established based on the private cloud.

[0012] Further, application domain B generates tokenB based on the parsed user information, and application domain B responds to the user's jump request through tokenB based on tokenB, and establishes a dialogue connection with the user; specifically: for the parsed user information, obtain the shared user information, and set the user's authority in application domain B according to the shared user information;

[0013] Extracting common information: Application domain B extracts common user information required by tokenA and application domain B. The common user information includes, for example, user ID and role.

[0014] Set permissions: Set user permissions in application domain B based on shared user information; expressed as:

[0015] Permission = f(Role);

[0016] Among them, Permission represents the permission number, Role is the user's role, which can be obtained from the shared user information; f is a function that assigns specific permissions according to the role;

[0017] The permission mapping table is imported according to the permission number Permission, and the corresponding application operation permissions are predefined in the permission mapping table.

[0018] A dual identity authentication system for private cloud services, used in the above dual identity authentication method for private cloud services, comprising:

[0019] Private cloud operators;

[0020] Application domain A, connected to the private cloud operator signal;

[0021] Application domain B, connected to the private cloud operator signal;

[0022] The user establishes a session connection with the application domain A and / or the application domain B through the network.

[0023] Compared with the prior art, the present invention has the following beneficial effects:

[0024] The present invention establishes a private cloud service user identity trust transmission model to achieve the secure transmission of user trusted identities between the cloud platform and the cloud application entity, achieving the optimization effect that users no longer need to repeatedly perform identity authentication when accessing private cloud services across domains. Furthermore, by obtaining the common information of user information and assigning different permissions to the user according to the user role information of the common information, the efficiency of identity authentication is ensured while also improving the security of permission browsing. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A schematic diagram of a dual identity authentication method for private cloud services. DETAILED DESCRIPTION

[0026] In order to make the technical means, creative features, objectives and effects achieved by the present invention easy to understand, in the description of the present invention, it should be noted that the terms "center", "up", "down", "left", "right", "vertical", "horizontal", "inside", "outside" and the like indicate the orientation or position relationship based on the orientation or position relationship shown in the accompanying drawings, which is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. In addition, the terms "No. 1", "No. 2" and "No. 3" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. The present invention is further explained below in conjunction with specific embodiments.

[0027] Reference Figure 1 , a dual identity authentication method for private cloud services, comprising the following steps:

[0028] Step S1: The user logs in to application domain A, and application domain A verifies the user information. After the verification is passed, application domain A generates tokenA; the user establishes a session connection with application A through tokenA;

[0029] Step S2: The user requests to jump from application domain A to application domain B. Application domain A uploads tokenA to a third-party organization. The third-party organization verifies the user's information by parsing the information of tokenA. After the verification is passed, the third-party organization transmits the parsed user information to application domain B. Application domain B generates tokenB based on the parsed user information. Application domain B responds to the user's jump request based on tokenB through tokenB and establishes a dialogue connection with the user.

[0030] Furthermore, the third-party organization in step S2 includes a private cloud service operator.

[0031] Furthermore, in step S1, the user logs in to application domain A, and application domain A verifies the user information. Specifically, the user logs in to domain A, enters the account and password, and then the account and password are verified on the domain A server.

[0032] Furthermore, the user is a private cloud service administrator.

[0033] Furthermore, the application domain A and the application domain B are established based on the private cloud.

[0034] A dual identity authentication system for private cloud services, used in the above dual identity authentication method for private cloud services, comprising:

[0035] Private cloud operators;

[0036] Application domain A, connected to the private cloud operator signal;

[0037] Application domain B, connected to the private cloud operator signal;

[0038] The user establishes a session connection with the application domain A and / or the application domain B through the network.

[0039] Further, application domain B generates tokenB based on the parsed user information, and application domain B responds to the user's jump request through tokenB based on tokenB, and establishes a dialogue connection with the user; specifically: for the parsed user information, obtain the shared user information, and set the user's authority in application domain B according to the shared user information;

[0040] Extracting common information: Application domain B extracts common user information required by tokenA and application domain B. The common user information includes, for example, user ID and role.

[0041] Set permissions: Set user permissions in application domain B based on shared user information; expressed as:

[0042] Permission = f(Role);

[0043] Among them, Permission represents the permission number, Role is the user's role, which can be obtained from the shared user information; f is a function that assigns specific permissions according to the role;

[0044] The permission mapping table is imported according to the permission number Permission, and the corresponding application operation permissions are predefined in the permission mapping table.

[0045] In general, this application proposes a trust transfer model, in which a third-party organization trusted by both parties is used as a guarantor between application domain A and application domain B to guarantee the validity of the trust chain between domain A and domain B. Based on this model, the user first establishes a direct trust relationship with application domain A through the identity authentication process; then, if the user wants to further establish a trust relationship with domain B, domain A is used as an intermediary to make a recommendation, so as to achieve domain B's recommendation trust to the user. In this way, a trust chain of user trusted identity transfer is established between domain B, domain A and the user.

[0046] Cloud applications are based on the trusted environment of private cloud service operators and use gateway tokens as information credentials for trust transmission to achieve secure transmission of user identities between different domains. This makes it unnecessary for users to repeat the identity authentication process when accessing applications in different domains of private cloud services, thus simplifying the authentication process and improving the efficiency of identity authentication for users accessing private cloud services.

[0047] When the user completes the identity authentication of the domain where the private cloud service is located, he will receive a Token value as a sign of successful identity authentication. Therefore, this patent model uses Token as a credential to establish a trust relationship between the user and the domain. At present, most web applications use the JWT mechanism to sign Tokens to protect the integrity of Tokens and prevent attackers from maliciously tampering with Tokens. Since different identity authentication gateways use different keys to sign Tokens, the Tokens generated by each gateway are different. This patent uses the domain of completed user identity authentication as an intermediary to achieve secure transmission of trusted identities of users in unauthenticated domains. Both domains are established in the same private cloud service environment, and use existing Token credentials to indirectly calculate and derive the Token that needs to establish a recommended trust relationship.

[0048] In the model of this patent, when a user logs in to domain A for the first time, he enters his account and password, and the account and password are verified on the server side of domain A. If they are correct, Token A is created and sent to the user, and stored on the user side as a credential for the user to establish a direct trust relationship with domain A. The next time he logs in, the user passes Token A to domain A, and Token A is verified in domain A. If it is valid, the login is successful. Since Token A contains user information, when the user wants to establish a recommended trust relationship with domain B with the help of domain A (middleman), domain A will deconstruct the user information from Token A, send the user information to the trust agent of domain B in a secure manner, and help domain B recalculate and generate Token B and send it to the user as a credential for the user to establish a trust relationship with domain B, thus completing the trust transfer.

[0049] This scenario is applicable to a private cloud service administrator who accesses the management environment and then accesses an application to view its status. It is also applicable to scenarios where there are multiple applications on a private cloud service and the administrator needs to switch back and forth between applications for frequent debugging.

[0050] The specific implementation modes as described above further describe the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation mode of the present invention and is not intended to limit the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A dual identity authentication method for private cloud services, characterized in that: The following steps are involved: Step S1: The user logs in to application domain A, and application domain A verifies the user information. After the verification is passed, application domain A generates tokenA; The user establishes a session connection with application A through tokenA; Step S2: The user requests to jump from application domain A to application domain B. Application domain A uploads tokenA to a third-party organization. The third-party organization verifies the user's information by parsing the information of tokenA. After the verification is passed, the third-party organization transmits the parsed user information to application domain B. Application domain B generates tokenB based on the parsed user information. Application domain B responds to the user's jump request based on tokenB through tokenB and establishes a dialogue connection with the user.

2. A dual identity authentication method for private cloud services according to claim 1, characterized in that: The third-party organization in step S2 includes a private cloud service operator.

3. A dual identity authentication method for private cloud services according to claim 1, characterized in that: In step S1, the user logs in to application domain A, and application domain A verifies the user information. Specifically, the user logs in to domain A, enters the account and password, and then the account and password are verified on the domain A server.

4. A dual identity authentication method for private cloud services according to claim 1, characterized in that: The user is a private cloud service administrator.

5. A dual identity authentication method for private cloud services according to claim 1, characterized in that: The application domain A and the application domain B are established based on the private cloud.

6. A dual identity authentication method for private cloud services according to claim 1, characterized in that: Application domain B generates tokenB based on the parsed user information, and application domain B responds to the user's jump request based on tokenB and establishes a dialogue connection with the user; Specifically, for the parsed user information, obtain the shared user information, and set the user's authority in application domain B according to the shared user information; Extracting common information: Application domain B extracts common user information required by tokenA and application domain B. The common user information includes, for example, user ID and role. Set permissions: Set user permissions in application domain B based on shared user information; expressed as: Permission = f(Role); Among them, Permission represents the permission number, Role is the user's role, which can be obtained from the shared user information; f is a function that assigns specific permissions according to the role; The permission mapping table is imported according to the permission number Permission, and the corresponding application operation permissions are predefined in the permission mapping table.

7. A dual identity authentication system for private cloud services, used in a dual identity authentication method for private cloud services as claimed in any one of claims 1 to 6, comprising: Private cloud operators; Application domain A, connected to the private cloud operator signal; Application domain B, connected to the private cloud operator signal; The user establishes a session connection with the application domain A and / or the application domain B through the network.

Images