Cloud–computing –based access management method and apparatus, and device

Abstract

The present disclosure pertains to the field of cloud technologies, and provides a cloud computing technology based access management method and apparatus, and a device. The method includes: A cloud platform receives a data boundary establishment request that is input by a first tenant for a cloud service, where a data boundary includes at least one of the following constraint conditions: information about an identity subject that uses the cloud service, access resource information related to the cloud service, network information related to use of the cloud service, information about a device that initiates an access request to the cloud service, and trusted execution environment information related to the cloud service. The cloud platform establishes the data boundary for the cloud service. The cloud platform compares information carried in an access request, for the cloud service, that is received by the cloud service with the constraint condition in the data boundary; and if the information carried in the access request matches the constraint condition in the data boundary, allows the cloud service to respond to the access request; otherwise, skips allowing the cloud service to respond to the first access request. In the present disclosure, security of data on a tenant cloud can be effectively ensured.

Description

(12) International application published under the Patent Cooperation Treaty (19) International Bureau of WIPO (43) International Publication Date November 21, 2024 (21.11.2024) WIPO I PCT (51) International Patent Classification: H04L 9 / 40 (2022.01) (21) International Application Number: (22) International Application Date: (25) Application Language: (26) Publication Language: (30) Priority: 202310564727.1 202311247399.9 PCT / CN2024 / 093888 May 17, 2024 (17.05.2024) Chinese Chinese May 18, 2023 (18.05.2023) CN September 25, 2023 (25.09.2023) CN (71) Applicant: Huawei Cloud Computing Technologies Co., Ltd. [CN / CN]; Huawei Cloud Data Center, Jiaoxinggong Road, Qianzhong Avenue, Guian New District, Guiyang City, Guizhou Province, China 550025 (CN) 0 lllllllllllllllllllllllllllllllllll^ (10) International Publication No.: WO 2024 / 235311 Al (72) Inventor: Lin Weibo; Huawei Cloud Data Center, Jiaoxinggong Road, Qianzhong Avenue, Guian New District, Guiyang City, Guizhou Province, China 550025 (CN). LI, Jun; Huawei Cloud Data Center, Jiaoxinggong Road, Qianzhong Avenue, Gui'an New District, Guiyang City, Guizhou Province, China 550025 (CN) 0 LIU, Boyang; Huawei Cloud Data Center, Jiaoxinggong Road, Qianzhong Avenue, Gui'an New District, Guiyang City, Guizhou Province, China 550025 (CN) 0 (74) Agent: BEIJING SAN GAO YONG XIN INTELLECTUAL PROPERTY AGENCY CO., LTD.; Room 503, 4th Floor, Building 1, No. 32, Xizhimen North Street, Haidian District, Beijing, China 100088 (CN) 0 (81) Designated Country (unless otherwise specified, each requiring available national protection): AE, AG, AL, AM, AO, AT, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, BZ, CA, CH, CL, CN, CO, CR, CU, (54) Title:CLOUD-COMPUTING-BASED ACCESS MANAGEMENT METHOD AND APPARATUS, AND DEVICE (54)Title of the Invention: A cloud-computing-based access management method, apparatus, and device AA BB CC 201 Data boundary establishment request directed at target cloud service 202 Establish a data boundary for the target cloud service according to the data boundary establishment request 203 Receive an access request directed at the target cloud service 204 Target information carried in the access request 205 Compare the target information with a constraint in the data boundary of the target cloud service, and determine whether the target information matches the constraint in the data boundary of the target cloud service 206 Authentication result 207 Process the access request in accordance with the authentication 208 Send an access approval result or access refusal message to the terminal of the tenant that sent the access request AA First tenant BB Cloud platform CC Target cloud service 1 ν 2 drawing / 3 o r O M (57) Abstract: The present disclosure provides a cloud-computing-based access management method andapparatus, and a device, and belongs to the technical field of the cloud. The method comprises: a cloud platform receiving a data boundary establishment request inputted by a first tenant with regard to a cloud service; the data boundary comprising at least one of the constraints: information of an identity subject using the cloud service, access resource information related to the cloud service, network information related to the cloud service, the information of a device which initiates an access request to the cloud service, and the information of a trusted [see continued page] WO 2024 / 235311 A1 ||||||||||||||||||||||||||||||||| CY CZ, DE, DJ, DK, DM, DO, DZ, EC, EE, EG, ES, FI, GB, GD, GE, GH, GM, GT, HN, HR, HU, ID, IL, IN, IQ, IR, IS, IT, JM, JO, JP, KE, KG, KH, KN, KP, KR, KW, KZ, LA, LC, LK, LR, LS, LU, LY MA, MD, MG, MK, MN, MU, MW, MX, MY MZ, NA, NG, NI, NO, NZ, OM, PA, PE, PG, PH, PL, PT, QA, RO, RS, RU, RW, SA, SC, SD, SE, SG, SK, SL, ST, SY SY TH, TJ, TM, TN, TR, TT, TZ, UA, UG, US, UZ,VC, VN, WS, ZA, ZM, ZWO (84) Designated countries (unless otherwise specified, each requiring available regional protection): ARIPO (BW, CV, GH, GM, KE, LR, LS, MW, MZ, NA, RW, SC, SD, SL, ST, SZ, TZ, UG, ZM, ZW), Eurasia (AM, AZ, BY, KG, KZ, RU, TJ, TM), Europe (AL, AT, BE, BG, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LT, LU, LV, MC, ME, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, SM, TR), OAPI (BF, BJ, CF, CG, CI, CM, GA, GN, GQ, GW, KM, ML, MR, NE, SN, TD, TG). This International Publication: - includes the international search report (Article 21 of the Treaty (3)_______________________________________________ execution environment related to the cloud service. The cloud platform establishes a data boundary for the cloud service.First access request. The use of the present disclosure can effectively ensure tenant data security on the cloud. (57) Abstract: This disclosure provides an access management method, apparatus, and device based on cloud computing technology, belonging to the field of cloud technology. The method includes a cloud platform receiving a data boundary establishment request for a cloud service input by a first tenant. The data boundary includes at least one constraint condition among the following: identity subject information of the cloud service user, access resource information related to the cloud service, network information involved in the use of the cloud service, device information initiating the access request to the cloud service, and trusted execution environment information related to the cloud service. The cloud platform establishes a data boundary for the cloud service. The cloud platform compares the information carried by the access request for the cloud service received by the cloud service with the constraint conditions in the data boundary. If the information carried by the access request matches the constraint conditions in the data boundary, the cloud service is allowed to respond to the access request; otherwise, the cloud service is not allowed to respond to the first access request. The use of this disclosure can effectively ensure the data security of tenants on the cloud. WO 2024 / 235311 PCT / CN2024 / 093888 Method, Apparatus, and Device for Access Management Based on Cloud Computing Technology This disclosure claims priority to Chinese Patent Application No. 202310564727.1, filed May 18, 2023, entitled "Method, Apparatus, and Device for Implementing Cloud Data Security Boundaries Based on IAM," and Chinese Patent Application No. 202311247399.9, filed September 25, 2023, entitled "Method, Apparatus, Device, and Storage Medium for Data Access," the entire contents of which are incorporated herein by reference. Technical Field This disclosure relates to the field of cloud technology, and particularly to a method, apparatus, and device for access management based on cloud computing technology. Background Art With the development of cloud computing technology, data centers are evolving from local data centers to cloud data centers. Cloud data centers can provide cloud services to multiple tenants, store tenant data, and, in addition, provide services and resources to the public network, which exposes tenant data in cloud data centers to numerous security threats. Therefore, there is an urgent need for a method to ensure the data security of tenants in cloud data centers. The present invention discloses a method, apparatus, and device for access management based on cloud computing technology, which can effectively ensure data security in cloud data centers. The corresponding technical solution is as follows: Firstly, an access management method based on cloud computing technology is provided. The method is applied to a cloud platform, which manages the infrastructure providing cloud services. The infrastructure includes at least one cloud data center, and each cloud data center includes…A cloud service is hosted on one or more servers in at least one cloud data center. The method includes: a cloud platform receiving a data boundary establishment request for the cloud service input by a first tenant. The data boundary establishment request instructs the cloud platform to establish a data boundary for the cloud service. The data boundary includes at least one constraint condition selected from the following: identity information of the user of the cloud service, access resource information related to the cloud service, network information involved in using the cloud service, device information initiating the access request to the cloud service, and trusted execution environment information related to the cloud service. The cloud platform establishes the data boundary for the cloud service based on the data boundary establishment request. When the cloud service receives a first access request for the cloud service from a second tenant or the first tenant, the cloud platform compares the information carried in the first access request with the constraints in the data boundary. If the information carried in the first access request matches the constraints in the data boundary, the cloud service is allowed to respond to the first access request. If the information carried in the first access request does not match the constraints in the data boundary, the cloud service is not allowed to respond to the first access request. The information carried in the first access request includes one or more of the following: first identity information, first access resource information, first network information, first device information initiating the first access request, and first trusted execution environment information. In the technical solution provided in this disclosure, tenants can establish data boundaries for purchased cloud services through a cloud platform according to their actual needs. These data boundaries constrain one or more of the following: the identity of the user of the cloud service, access resources related to the cloud service, the network involved in using the cloud service, the device initiating the access request to the cloud service, and the trusted execution environment related to the cloud service. Furthermore, when an access request for the cloud service is received, the information carried in the access request is compared with the data boundary established by the tenant for that cloud service. If the information carried in the access request matches the constraints in the data boundary, the cloud service is allowed to respond to the access request; otherwise, the cloud service is not allowed to respond. In this way, the data boundary constraints effectively protect the tenant's data security in the cloud. In one possible implementation, a first tenant and a second tenant register on the cloud platform. The first tenant acts as the administrator of the data boundary, and the second tenant acts as the visitor of the data boundary. In another possible implementation, the method further includes: the cloud platform receiving a request from the first tenant to add constraints to the data boundary. The cloud platform adds constraints to the data boundary, specifying a first constraint as indicated in the request. This first constraint is one or more of the following: second identity subject information, second access resource information, second network information, second device information initiating the access request, and second trusted execution environment information. (1 WO 2024 / 235311)In the technical solution provided in PCT / CN2024 / 093888, tenants can freely add constraints to the established data boundary according to their actual needs, offering greater flexibility and ease of operation. In one possible implementation, the method further includes: the cloud platform receiving a constraint removal request for the data boundary from a first tenant. The cloud platform removes the second constraint indicated by the constraint removal request from the data boundary, wherein the second constraint is one or more of the following: third identity subject information, third access resource information, third network information, third device information initiating the access request, and third trusted execution environment information. In the technical solution provided in this disclosure, tenants can freely remove constraints to the established data boundary according to their actual needs, offering greater flexibility and ease of operation. In one possible implementation, the method further includes: the cloud platform receiving a data boundary deletion request for the cloud service from a first tenant. The cloud platform deletes the data boundary indicated by the data boundary deletion request. In the technical solution provided in this disclosure, tenants can delete the established data boundary according to their actual needs, offering greater flexibility and ease of operation. In one possible implementation, the method further includes: the cloud platform receiving a request from a first tenant to disable the data boundary function for the cloud service. The cloud platform then disables the data boundary function for the cloud service. In the technical solution provided by this disclosure, tenants can disable the data boundary function for the cloud service according to actual needs, offering greater operational flexibility and simplicity. In another possible implementation, the method further includes: the cloud platform receiving a request from a first tenant to enable the data boundary function for the cloud service. The cloud platform then enables the data boundary function for the cloud service. In the technical solution provided by this disclosure, tenants can enable the data boundary function for the cloud service according to actual needs, offering greater operational flexibility and simplicity. Secondly, a cloud computing-based access management device is provided. The device is applied to a cloud platform, which manages infrastructure providing cloud services. The infrastructure includes at least one cloud data center, each of which includes multiple servers. The cloud service is configured on one or more servers within the at least one cloud data center. The method includes: a management module, configured to receive a data boundary establishment request for the cloud service input by a first tenant, wherein the data boundary establishment request instructs the cloud platform to establish a data boundary for the cloud service, wherein the data boundary includes at least one constraint condition selected from the following: identity information of the user of the cloud service, access resource information related to the cloud service, network information involved in using the cloud service, device information initiating the access request to the cloud service, and trusted execution environment information related to the cloud service; and establishing a data boundary for the cloud service according to the data boundary establishment request.The authentication module is used to compare the information carried in the first access request with the constraints in the data boundary when the cloud service receives a first access request from the second tenant or the first tenant. If the information carried in the first access request matches the constraints in the data boundary, the cloud service is allowed to respond to the first access request; if the information carried in the first access request does not match the constraints in the data boundary, the cloud service is not allowed to respond to the first access request. The information carried in the first access request includes one or any combination of first identity subject information, first access resource information, first network information, first device information initiating the first access request, and first trusted execution environment information. In one possible implementation, the first tenant and the second tenant register on the cloud platform, with the first tenant acting as the administrator of the data boundary and the second tenant acting as the visitor of the data boundary. In one possible implementation, the management module is further configured to: receive a constraint addition request for the data boundary input by the first tenant; add a first constraint indicated by the constraint addition request to the data boundary, wherein the first constraint is one or more of second identity subject information, second access resource information, second network information, second device information initiating the access request, and second trusted execution environment information. In one possible implementation, the management module is further configured to: receive a constraint removal request for the data boundary input by the first tenant; remove the second constraint indicated by the constraint removal request from the data boundary of the server, wherein the first constraint is one or more of third identity subject information, third access resource information, third network information, third device information initiating the access request, and third trusted execution environment information. In one possible implementation, the management module is further configured to: receive a data boundary deletion request for the cloud service input by the first tenant; delete the data boundary indicated by the data boundary deletion request. In one possible implementation, the management module is further configured to: receive a data boundary function deactivation request for the cloud service input by the first tenant; and deactivate the data boundary function for the cloud service. In another possible implementation, the management module is further configured to: receive a data boundary function enable request for the cloud service input by the first tenant; and enable the data boundary function for the cloud service. In a third aspect, a computing device cluster is provided, including at least one computing device, each computing device including a processor and memory.The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, causing the computing device cluster to perform the cloud-based access management method provided in the first aspect above. In a fourth aspect, a computer program product containing instructions is provided, which, when executed by a computing device cluster, cause the computing device cluster to perform the cloud-based access management method provided in the first aspect above. In a fifth aspect, a computer-readable storage medium is provided, including computer program instructions, which, when executed by a computing device cluster, cause the computing device cluster to perform the cloud-based access management method provided in the first aspect. Figure 1 is a schematic diagram of an implementation scenario provided by an embodiment of this disclosure; Figure 2 is a flowchart of a cloud computing-based access management method provided by an embodiment of this disclosure; Figure 3 is a schematic diagram of a data boundary provided by an embodiment of this disclosure; Figure 4 is a schematic diagram of a data boundary provided by an embodiment of this disclosure; Figure 5 is a schematic diagram of a data boundary provided by an embodiment of this disclosure; Figure 6 is a schematic diagram of a data boundary provided by an embodiment of this disclosure; Figure 7 is a flowchart of a cloud computing-based access management method provided by an embodiment of this disclosure; Figure 8 is a structural schematic diagram of a cloud computing-based access management device provided by an embodiment of this disclosure; Figure 9 is a structural schematic diagram of a computer device provided by an embodiment of this disclosure; Figure 10 is a structural schematic diagram of a computer device cluster provided by an embodiment of this disclosure; Figure 11 is a structural schematic diagram of a computer device cluster provided by an embodiment of this disclosure. Detailed Description: To make the objectives, technical solutions, and advantages of this disclosure clearer, the embodiments of this disclosure will be further described in detail below with reference to the accompanying drawings. Some terms used in the implementation of this disclosure will be explained below to facilitate understanding of this disclosure by those skilled in the art. Cloud Platform and Infrastructure: The cloud platform manages the cloud vendor's infrastructure, which consists of multiple cloud data centers located in different regions. Each region has at least one cloud data center. The cloud platform provides interfaces related to cloud computing services, such as configuration pages or application programming interfaces (APIs), for tenants to access cloud services. Tenants can log in to the cloud platform using pre-registered accounts and passwords. After successful login, they can select and purchase cloud services provided by the cloud data centers in their designated regions. These cloud services include object storage services, database services, message queue services, or other known cloud services. Tenant: The top-level object used to manage cloud services and / or cloud resources. Tenants register tenant accounts and set tenant passwords on the cloud platform through local clients (e.g., browsers). Local clients remotely log in to the cloud platform using the tenant account and password. The cloud platform provides configuration...A user interface or API is provided for tenants to configure and use cloud services, which can be provided by the infrastructure managed by the aforementioned cloud platform. Virtual Private Cloud (VPC): A dynamically configured pool of public cloud computing resources requires the use of encryption protocols, tunneling protocols, and other security procedures to transmit data between enterprises and cloud service providers. VPCs build isolated, user-configurable and managed virtual network environments for elastic cloud servers, improving the security of resources in the user's cloud and simplifying network deployment. Security groups, Virtual Private Networks (VPNs), IP address ranges, bandwidth, and other network characteristics can be defined in a VPC. Tenants can easily manage and configure their internal networks and make secure and rapid network changes through VPCs. This disclosure provides an access management method based on cloud computing technology. This method can be applied to a cloud platform, which manages the infrastructure providing cloud services. The infrastructure includes at least one cloud data center, and each cloud data center includes multiple servers. Cloud services are set up on one or more servers in the at least one cloud data center. The following description, in conjunction with the accompanying drawings, illustrates an implementation scenario of the cloud computing-based access management method provided in this disclosure. Figure 1 is a schematic diagram of an implementation scenario provided in this disclosure. As shown in Figure 1, this implementation scenario includes a cloud platform 10, cloud data centers 1...m, and each cloud data center has multiple servers. For example, cloud data center 1 has servers 1, 2...n, and cloud services such as cloud service 1, cloud service 2...a are deployed on the servers. Tenant 40 can log in to cloud platform 10 via client 30 through internet 20 using a tenant account and password pre-registered on cloud platform 10, purchase cloud services through cloud platform 10, and establish data boundaries for the cloud services they have purchased. Tenant 50 can log in to cloud platform 10 via client 60 through internet 20 using a tenant account and password pre-registered on cloud platform 10, purchase cloud services through cloud platform 10, and establish data boundaries for the cloud services they have purchased. Tenant 50 or Tenant 40 can use the cloud service they have already purchased to store data. However, because cloud data centers may serve multiple tenants and may also provide services to the public internet, tenant data is exposed to many security threats. The following explains the security threats to tenant data in the cloud. Taking cloud service as an object storage service as an example, Tenant 40 can purchase at least one storage bucket according to its actual needs, such as storage bucket L.Bucket 2 stores data in storage buckets. For tenant 50, their data in the cloud may face the following security threats: Security Threat 1: Attacks from external attackers. External attackers holding legitimate credentials from tenant 40 can directly access tenant 50's storage buckets (such as storage bucket 1 and storage bucket 2), obtaining tenant 40's data and causing data leakage. Security Threat 2: Attacks from other tenants in the cloud (such as tenant 50). Due to incorrect resource allocation or malicious authorization configuration, unauthorized tenants (such as tenant 50) can access tenant 40's storage buckets (1 / 4 storage bucket 1, storage bucket 2), obtaining tenant 40's data and causing data leakage. Security Threat 3: Attacks from internal personnel or malicious code. Internal personnel from tenant 40 or malicious code can write data that should be stored in storage bucket 1 / 2 of tenant 40 into other tenants' storage buckets, causing data leakage. This disclosure provides an access management method based on cloud computing technology. In this method, tenants can establish data boundaries for purchased cloud services through a cloud platform according to their actual needs. These data boundaries constrain one or more of the following: the identity of the user of the cloud service, access resources related to the cloud service, the network involved in using the cloud service, the device initiating the access request to the cloud service, and the trusted execution environment related to the cloud service. Furthermore, when there is an access request for the cloud service, the information carried in the access request is compared with the data boundary established by the tenant for that cloud service. If the information carried in the access request matches the constraints in the data boundary, the cloud service is allowed to respond to the access request; otherwise, the cloud service is not allowed to respond to the access request. Thus, through the constraints of the data boundary, the data security of the tenant in the cloud can be effectively guaranteed. The access management method based on cloud computing technology provided by this disclosure is described below with reference to the accompanying drawings. Referring to Figure 2, the processing flow of the access management method based on cloud computing technology provided by this disclosure may include the following steps: Step 201: The first tenant sends a data boundary establishment request for the target cloud service to the cloud platform through a terminal. In this context, the first tenant refers to any tenant that has purchased the target cloud service, such as tenant 40 and tenant 50 in Figure 1. In implementation, after purchasing the target cloud service, to ensure data security in the cloud, the first tenant can send a data boundary establishment request for the target cloud service to the cloud platform via its terminal, instructing the cloud platform to establish a data boundary for the target cloud service. The data boundary...The boundary establishment request carries different constraints in different fields within the data boundary. These constraints may include one or more of the following: identity subject information using the target cloud service, access resource information related to the target cloud service, network information involved in using the target cloud service, device information initiating the access request to the target cloud service, and trusted execution environment information related to the target cloud service. The following explains these constraints: Identity subject information using the target cloud service: This identity subject information can be the identifier of the Identity and Access Management (IAM) identity established by the tenant for members within an organization. The first tenant can be an enterprise. The first tenant can establish an organization corresponding to the first tenant through the organization service provided by the cloud platform. Employees in the enterprise are mapped to members within that organization. The first tenant can establish a corresponding IAM identity for each member within that organization, and members can use this IAM identity to access the target cloud service purchased by the tenant. This constraint can be used to restrict which IAM identities are allowed to access the target cloud service. 4 WO 2024 / 235311 PCT / CN2024 / 093888 Access resource information related to the target cloud service: This access resource information can be the resource information of the target cloud service purchased by the first tenant. Taking the target cloud service as an object storage service as an example, the access resource information can be the bucket identifier; taking the target cloud service as a database service as an example, the access resource information can be the database identifier. This constraint can be used to restrict which resources of the target cloud service are allowed to access. Network information involved in using the target cloud service: Network information can be the identifier of a Virtual Private Cloud (VPC) or a public network identifier. The network information involved in using the target cloud service can be used to restrict which networks are allowed to access the target cloud service. Device information initiating the access request to the target cloud service: Device information can be the device information of the device that initiated the access request to the target cloud service. Device information indicates the device's operating system, whether a security scanning application is installed, etc. This constraint can be used to restrict which types of devices are allowed to access the target cloud service. Trusted Execution Environment (TEE) Information Related to the Target Cloud Service: TEE information refers to the execution environment information corresponding to the trusted execution environment of the target application accessing the target cloud service. This execution environment information indicates whether the device executing the application supports a Trusted Platform Module (TPM) and memory protection, etc. The following example illustrates step 201. Example 1: The first tenant needs to establish a data boundary for the purchased object storage service to implement the following constraints: Only...IAM identities 1 and 2, under Trusted Execution Environment 1, using device 1 and through VPC1, can access buckets 1 and 2. Accordingly, the data boundary establishment request sent by the terminal carries the identifier P1 of IAM identity 1, the identifier P2 of IAM identity 2, the Trusted Execution Environment information E1 of Trusted Execution Environment 1, the device information DI of the device, the identifier N1 of VPC1, the identifier R1 of bucket 1, and the identifier R2 of bucket 2. Example 2: The first tenant wants to establish a data boundary for the purchased object storage service to implement the following constraint: only IAM identities 3, 4, and 5, through VPC2, can access bucket 3. Accordingly, the data boundary establishment request sent by the terminal carries the identifier P3 of IAM identity 3, the identifier P4 of IAM identity 4, the identifier P5 of IAM identity 5, the identifier N2 of VPC2, and the identifier R3 of bucket 3. Step 202: The cloud platform establishes a data boundary for the target cloud service based on the data boundary establishment request. In implementation, after receiving a data boundary establishment request from a terminal, the cloud platform obtains the constraints carried in the request and establishes a data boundary containing those constraints. Referring to Example 1 above: if the data boundary establishment request carries P1, P2, E1, DI, N1, RI, and R2, the cloud platform establishes a data boundary for the target cloud service, including P1, P2, E1, DI, N1, RI, and R2. Referring to Example 2 above: if the data boundary establishment request carries P3, P4, P5, N2, and R3, the cloud platform establishes a data boundary for the target cloud service, including P3, P4, P5, N2, and R3. Step 203: The target cloud service receives an access request for the target cloud service. In implementation, when a tenant needs to use the target cloud service, they can send an access request to the target cloud service through their device. Correspondingly, the target cloud service receives the access request sent by the tenant. The tenant can be the aforementioned first tenant, or other tenants registered on the cloud platform besides the first tenant. The access request carries target information, which includes one or more of the following: first identity entity information, first access resource information, first network information, first device information initiating the access request, and first trusted execution environment information. Step 204: The target cloud service sends the target information carried in the access request to the cloud platform. In implementation, after receiving the access request, the target cloud service obtains the target information carried in the access request and sends it to the cloud platform. Step 205: The cloud platform compares the target information with the constraints in the data boundary for the target cloud service to determine whether the target information matches the constraints in the data boundary for the target cloud service. In implementation, the cloud platform can obtain the data boundary for the target cloud service and compare the target information with the constraints in the data boundary for the target cloud service.The constraints in the data boundary are compared sequentially to determine whether the target information matches any constraint in the data boundary for the target cloud service. The following example illustrates the comparison process between the target information and any constraint in the data boundary, using the target information comprising five types of information (first identity subject information, first access resource information, first network information, first device information initiating the access request, and first trusted execution environment information) and the data boundary comprising five constraints (identity subject information using the target cloud service, access resource information related to the target cloud service, network information involved in using the target cloud service, device information initiating the access request to the target cloud service, and trusted execution environment information related to the target cloud service). For the comparison of identity subject information: The first identity subject information in the target information is compared with the identity subject information using the target cloud service in the data boundary. If the identity subject information using the target cloud service includes the first identity subject information, then the first identity subject information is determined to match; otherwise, the first identity subject information is determined not to match. For comparison of access resource information: The first access resource information in the target information is compared with the access resource information related to the target cloud service in the data boundary. If the access resource information related to the target cloud service includes the first access resource information, the first access resource information is determined to match; otherwise, the first access resource information is determined to not match. For comparison of network information: The first network information in the target information is compared with the network information involved in using the target cloud service in the data boundary. If the first network information is a VPC identifier, it is determined whether the network information involved in using the target cloud service includes the first network information. If the network information involved in using the target cloud service includes the first network information, the first network information is determined to match; otherwise, the first network information is determined to not match. If the first network information is public network related information (such as the destination IP address), it is determined whether the network information involved in the target cloud service includes a public network identifier. If the network information involved in the target cloud service includes a public network identifier, the first network information is determined to match; otherwise, the first network information is determined to not match. For device information comparison: The first device information in the target information is compared with the device information in the data boundary that initiated the access request to the target cloud service. If the device information in the data boundary includes the first device information, the first device information is determined to match; otherwise, the first device information is determined to not match. For trusted execution environment information comparison: The first trusted execution environment information in the target information is compared with the trusted execution environment information related to the target cloud service in the data boundary. If the trusted execution environment information related to the target cloud service includes the first trusted device information, the first device information is determined to match.If the execution environment information is matched, the first trusted execution environment information is determined to be a match; otherwise, the first trusted execution environment information is determined to be a mismatch. If all five types of information included in the target information match the five types of constraints included in the data boundary, the target information is determined to match the constraints in the data boundary. If any one of the five types of information does not match the corresponding constraint in the data boundary, the target information is determined to be a mismatch. The following example illustrates step 205. Example 1: As shown in Figure 3, the target information includes first identity subject information P3, first trusted execution environment information E1, first device information D1, first network information N2, and first access resource information R1. The data boundaries for the target cloud service are data boundary 1 and data boundary 2. Data boundary 1 includes P1, P2, E1, D1, N1, R1, and R2, while data boundary 2 includes P3, P4, E1, D1, N2, R1, and R2. First, the target information is compared with the constraints in data boundary 1. It is determined that P1 and N2 are not included in data boundary 1, thus the constraints in data boundary 1 do not match. Then, the target information is compared with the constraints in data boundary 2. It is determined that all five types of information in the target information are in data boundary 1, thus the constraints in data boundary 1 match. Therefore, the constraints in the data boundary for the target cloud service are determined to match. Example 2: As shown in Figure 4, the target information includes first identity subject information P3, first network information N2, and first access resource information R1. The data boundaries for the target cloud service are data boundary 3 and data boundary 4. Data boundary 3 includes P3, P4, P5, N2, and R3, while data boundary 4 includes P1, P2, N1, and R1. First, compare the target information with the constraints in data boundary 3. If R1 is not included in data boundary 3, then the target information and the constraints in data boundary 3 are determined to be mismatched. Next, compare the target information with the constraints in data boundary 4. If P3 and N2 are not included in data boundary 4, then the target information and the constraints in data boundary 4 are determined to be mismatched. Furthermore, it is determined that the target information does not match the constraints in the data boundary for the target cloud service. Step 206: The cloud platform sends the authentication result of the access request to the target cloud service. In implementation, if the cloud platform determines that the target information matches the constraints in the data boundary for the target cloud service, it sends an authentication success message to the target cloud service; if it determines that the target information does not match the constraints in the data boundary for the target cloud service, it sends an authentication failure message to the target cloud service. Step 207: The target cloud service processes the access request based on the authentication result. In implementation, if the target cloud service receives an authentication success message from the cloud platform, it executes the access request; if it receives an authentication failure message from the cloud platform...If the authentication failure message returned by the platform is received, the access request is rejected. Step 208: The target cloud service sends an access result or an access rejection message to the tenant's terminal that sent the above access request. In implementation, if the target cloud service executes the access request, it sends the executed access result to the tenant's terminal; if it rejects the access request, it sends an access rejection message to the tenant's terminal. In one possible implementation, for an established data boundary, the first tenant can add constraints, remove constraints, delete data boundaries, disable data boundary functions for the target cloud service, and enable data boundary functions for the target cloud service through the cloud platform. These functions are described below. Adding constraints: If the first tenant wants to add constraints to the first data boundary, it can send a constraint addition request to the cloud platform through its terminal, carrying the first constraint to be added and the identifier of the first data boundary in the constraint addition request. Correspondingly, after receiving the constraint addition request, the cloud platform adds the first constraint to the first data boundary. The identifier of the first data boundary can be generated by the terminal and included in the data boundary establishment request when sending it to the cloud platform, or it can be generated by the cloud platform when establishing the first data boundary and the generated identifier of the first data boundary is returned to the terminal. The following example illustrates adding constraints. As shown in Figure 5, data boundary 1 includes P1, P2, E1, DI, N1, RI, and R2. If the first tenant wants to add identity subject information P5 for using the target cloud service to data boundary 1, it sends a constraint addition request to the cloud platform through the terminal, including P5 and the identifier of data boundary 1. After receiving the constraint addition request, the cloud platform adds the identity subject information P5 for using the target cloud service to data boundary 1. Removing constraints: If the first tenant wants to remove one or more constraints in the second data boundary, it can send a constraint removal request to the cloud platform through the terminal, including the identifier of the second constraint to be removed and the identifier of the second data boundary. Accordingly, upon receiving the add request, the cloud platform removes the second constraint from the second data boundary. The following example illustrates the addition of constraints. As shown in Figure 6, data boundary 2 includes P3, P4, E1, DI, N2, RI, and R2. If the first tenant removes the access resource information R1 related to the target cloud service from data boundary 2, it sends a constraint removal request to the cloud platform via its terminal, carrying the identifiers of R1 and data boundary 2 in the request. Upon receiving the constraint removal request, the cloud platform removes the access resource information R1 related to the target cloud service from data boundary 2.Deleting a Data Boundary: If a first tenant wants to delete a third data boundary, they can send a data boundary deletion request for the target cloud service to the cloud platform via their terminal, including the identifier of the third data boundary in the request. Upon receiving the request, the cloud platform will delete the third data boundary for the target cloud service. Disabling Data Boundary Functionality: If a first tenant wants to disable the data boundary functionality for the target cloud service, they can send a data boundary disable request for the target cloud service to the cloud platform via their terminal. Upon receiving the disable request, the cloud platform will disable all data boundaries established by the first tenant for the target cloud service. Enabling Data Boundary Functionality: If a first tenant wants to enable the data boundary functionality for the target cloud service, they can send a data boundary enable request for the target cloud service to the cloud platform via their terminal. Upon receiving the enable request, the cloud platform will enable all data boundaries established by the first tenant for the target cloud service. In one possible implementation, the cloud platform can provide an Application Programming Interface (API) for establishing data boundaries, adding constraints, removing constraints, deleting data boundaries, disabling data boundary functionality, and enabling data boundary functionality. Correspondingly, the terminal can send a data boundary establishment request to the cloud platform by calling the API for establishing data boundaries; a constraint addition request by calling the API for adding constraints; a constraint removal request by calling the API for removing constraints; a data boundary deletion request by calling the API for deactivating data boundaries; and a data boundary enable request by calling the API for enabling data boundaries. In another possible implementation, to improve the efficiency of tenants establishing data boundaries, constraints can be added to data boundaries at the organizational unit level in this embodiment. The organizational unit can correspond to a department, subsidiary, or project team within an enterprise. Accordingly, the processing in step 201 above can be as follows: When the first tenant establishes a data boundary, if it needs the data boundary to include all IAM identities under the first organizational unit, then the field used to carry the identity subject information for using the target cloud service in the data boundary establishment request sent by the terminal carries the identifier of the first organizational unit. If it needs the data boundary to exclude identities within the organization, then the field used to carry the identity subject information for using the target cloud service in the data boundary establishment request carries indication information of identities outside the organization. If it needs the data boundary to include all resources of the target cloud service under the first organizational unit, then the field used to carry access information related to the target cloud service in the data boundary establishment request sent by the terminal...The source information fields carry the identifier of the first organizational unit. If the data boundary is to include all networks under the first organizational unit, the field in the data boundary establishment request sent by the terminal that carries network information related to the use of the target cloud service carries the identifier of the first organizational unit. If the data boundary is to include networks outside the organization, the field in the data boundary establishment request that carries network information related to the use of the target cloud service carries indication information of networks outside the organization. The following example illustrates the above processing. Example 1: A first tenant wants to establish a data boundary for a purchased object storage service to implement the following constraint: Only all IAM identities under organizational unit 1 can access the resources of the object storage service under organizational unit 1 through the network under organizational unit 1. Accordingly, in the data boundary establishment request sent by the terminal, the field carrying the identity subject information for using the target cloud service carries the identifier of organizational unit 1, the field carrying access resource information related to the target cloud service carries the identifier of organizational unit 1, and the field carrying network information related to the use of the target cloud service carries the identifier of organizational unit 1. Example 2: The first tenant needs to establish a data boundary for the purchased object storage service to achieve the following constraint: only an identity outside the organization (as per WO 2024 / 235311 PCT / CN2024 / 093888) can access the resources of the object storage service under organizational unit 2 through an external network. Accordingly, in the data boundary establishment request sent by the terminal, the field carrying the identity subject information for using the target cloud service includes an indication of the identity outside the organization; the field carrying access resource information related to the target cloud service includes the identifier of organizational unit 2; and the field carrying network information involved in using the target cloud service includes an indication of the external network. In this possible implementation, step 202 above can be processed as follows: After receiving the data boundary establishment request sent by the terminal, if the cloud platform determines that the field in the data boundary establishment request used to carry the identity subject information for using the target cloud service carries the identifier of the first organizational unit, then the identifiers of all IAM identities under the first organizational unit are added to the data boundary as the identity subject information for using the target cloud service. If the field in the data boundary establishment request used to carry the identity subject information for using the target cloud service carries indication information of external identities, then the indication information of external identities is added to the data boundary as the identity subject information for using the target cloud service. If the field in the data boundary establishment request used to carry the access resource information related to the target cloud service carries the identifier of the first organizational unit, then the information of all resources of the target cloud service under the first organizational unit is added to the data boundary as access resource information related to the target cloud service. If the field in the data boundary establishment request used to carry the identity subject information for using the target cloud service carries the identifier of the first organizational unit, then the information of all resources of the target cloud service under the first organizational unit is added to the data boundary as access resource information related to the target cloud service.If the field for network information related to the target cloud service carries the identifier of the first organizational unit, then all network information under the first organizational unit is added to the data boundary as network information related to the use of the target cloud service. If it is determined that the field for carrying network information related to the use of the target cloud service carries indication information of external networks, then the indication information of external networks is added to the data boundary as network information related to the use of the target cloud service. Then, the correspondence between this data boundary and the organization corresponding to the first tenant is recorded. The following example illustrates the establishment of a data boundary. Combining with Example 1 above: In the data boundary establishment request, the field for carrying the identity subject information for using the target cloud service carries the identifier of organizational unit 1, the field for carrying access resource information related to the target cloud service carries the identifier of organizational unit 1, and the field for carrying network information related to the use of the target cloud service carries the identifier of organizational unit 1. Accordingly, the cloud platform establishes a data boundary, which includes all IAM identities under organizational unit 1, the identifiers of all VPCs under organizational unit 1, and the identifiers of all storage buckets under organizational unit 1. Referring to Example 2 above: In the data boundary establishment request, the field used to carry the identity subject information for using the target cloud service carries indication information of an external identity; the field used to carry access resource information related to the target cloud service carries the identifier of organization unit 2; and the field used to carry network information involved in using the target cloud service carries indication information of an external network. Accordingly, the cloud platform establishes a data boundary, which includes indication information of an external identity, indication information of an external network, and identifiers of all buckets under organization unit 2. In this possible implementation, the processing of step 205 above can be as follows: Taking the target identity information including first identity subject information, first access resource information, and first network information as an example: Determine the first organization to which the first identity subject belongs, the second organization to which the first access resource information belongs, and the third organization to which the first network information belongs. The first, second, and third organizations may be the same organization or different organizations. Obtain the data boundary established by the first organization for the target cloud service, the data boundary established by the second organization for the target cloud service, and the data boundary established by the third organization for the target cloud service. The target information is compared sequentially with each data boundary. The comparisons of different types of information in the target information and different constraints in the data boundaries are explained below. Regarding the comparison of identity information: The first identity subject information in the target information is compared with the identity subject information of the user of the target cloud service in the data boundary. If the identity subject information of the user of the target cloud service in the data boundary is an indication of an external identity, it is determined whether the first identity subject information belongs to the organization corresponding to that data boundary. If the first identity subject information belongs to the organization corresponding to that data boundary...If the target cloud service is used by an organization, the first identity information is determined to be mismatched; otherwise, it is determined to be a match. If the identity information of the user of the target cloud service within the data boundary is not an indication of an external identity, it is determined whether the identity information of the user of the target cloud service within the data boundary includes the first identity information. If it does, the first identity information is determined to be a match; otherwise, it is determined to be a mismatch. Regarding network information comparison: the first network information in the target information is compared with the network information related to the use of the target cloud service within the data boundary. If the network information related to the use of the target cloud service within the data boundary is an indication of an external network, it is determined whether the first network information belongs to the organization corresponding to that data boundary. If it does, the first network information is determined to be a mismatch; otherwise, it is determined to be a match. When the network information involved in using the target cloud service within the data boundary is not an indication of an external network, it is determined whether the network information involved in using the target cloud service includes the first network information. If the network information involved in using the target cloud service includes the first network information, the first network information is determined to match; otherwise, the first network information is determined to not match. 8 WO 2024 / 235311 PCT / CN2024 / 093888 Regarding the comparison of access resource information: The first access resource information in the target information is compared with the access resource information related to the target cloud service within the data boundary. If the access resource information related to the target cloud service includes the first access resource information, the first access resource information is determined to match; otherwise, the first access resource information is determined to not match. The above processing is illustrated below with an example. The target information includes first identity subject information P3, first network information I, and first access resource information R1. The cloud platform determines that the first identity subject information P3 belongs to organization 1, the first network information I is public network information and does not belong to any organization, and the first access resource information R1 belongs to organization 1. Then, the data boundaries established by Organization 1 for the target cloud service are obtained, including data boundary 5 and data boundary 6. Data boundary 5 includes all IAM identities (such as P1, P2, P3…) under Organization Unit 1, all network information under Organization Unit 1 (such as the identifier N1 of VPC1, the identifier N2 of VPC2, the identifier N3 of VPC3…), and the identifiers of all buckets of the object storage service under Organization Unit 1 (such as RI, R2, R3…). Organization Unit 1 belongs to Organization 1. Data boundary 6 includes indication information of identities outside the organization, indication information of networks outside the organization, and the identifiers of all buckets of the object storage service under Organization Unit 2 (such as RIO, R20, R30…). Organization Unit 2 belongs to Organization 1.The target information is compared with the constraints in data boundary 5. Regarding the comparison of identity information: it is determined that the identity subject information using the target cloud service in data boundary 5 is not an indication of an external identity, and the first identity subject information P3 is included in the identity subject information using the target cloud service in data boundary 5 (all IAM identities under organizational unit 1). Therefore, the first identity subject information is determined to match. Regarding the comparison of network information: it is determined that the network information involved in using the target cloud service in data boundary 5 is not an indication of an external network, and the first network information is not included in the network information involved in using the target cloud service in data boundary 5 (all network information under organizational unit 1). Therefore, the first network information is determined to not match. Regarding the comparison of access resource information: it is determined that the first access resource information R1 is included in the access resource information related to the target cloud service in data boundary 5 (identifiers of all buckets of object storage services under organizational unit 1). Therefore, the first access resource information R1 is determined to match. Because the first network information does not match, it is determined that the target information and the constraints in data boundary 6 do not match. The target information is then compared with the constraints in data boundary 6. Regarding the comparison of identity information: It is determined that the identity subject information using the target cloud service in data boundary 6 is indication information of an external identity. Then, it is determined that the first identity subject information P3 belongs to organization 1. Since data boundary 6 also belongs to organization 1, it is determined that the first identity subject information P3 does not match. Regarding the comparison of network information: It is determined that the network information involved in using the target cloud service in data boundary 5 is indication information of an external network, and it is determined that the first network information does not belong to organization 1. Therefore, it is determined that the first network information matches. Regarding the comparison of access resource information: It is determined that the first access resource information R1 is not included in the access resource information related to the target cloud service (identifiers of all buckets of the object storage service under organizational unit 2) in data boundary 6. Therefore, it is determined that the first access resource information R1 matches. Because the first identity subject information does not match, it is determined that the target information and the constraints in data boundary 6 do not match. This disclosure also provides an access management method based on cloud computing technology. In this method, the cloud platform includes a management plane and an authentication data plane. In the steps shown in Figure 2 above, the processing of the cloud platform is implemented by the management plane and the authentication data plane. Accordingly, as shown in Figure 7, the processing flow of this method can be as follows: Step 701: The first tenant sends a data boundary establishment request for the target cloud service to the management plane of the cloud platform through the terminal. The difference between step 701 and step 201 above is only that the recipient of the data boundary establishment request changes from the cloud platform to the management plane of the cloud platform. The specific processing is not described here. Step 702: The management plane establishes the data boundary for the target cloud service according to the data boundary establishment request.The difference between step 702 and step 202 above is that the data boundary establishment is changed from the cloud platform to the cloud platform's management plane. Specific processing details are omitted here. Step 703: The target cloud service receives the access request for the target cloud service. The specific processing of step 703 is the same as that of step 203 above, and will not be repeated here. Step 704: The target cloud service sends the target information carried in the access request to the cloud platform's authentication data plane. The difference between step 704 and step 204 above is that the recipient of the target information carried in the access request is changed from the cloud platform to the cloud platform's authentication data plane. Specific processing details are omitted here. Step 705: The authentication data plane sends a data boundary acquisition request to the management plane. In implementation, after receiving the target information sent by the target cloud service, the authentication data plane sends a data boundary acquisition request to the management plane. The data boundary acquisition request carries the identifier of the target cloud service. In one possible implementation, where the constraint organization units in the data boundary are added at the granular level, after receiving the target information sent by the target cloud service, the authentication data plane can first obtain the first organization to which the first identity subject information belongs, the second organization to which the first network information belongs, and the third organization to which the first access resource information belongs, and then send a data boundary acquisition request to the management plane. In WO 2024 / 235311 PCT / CN2024 / 093888, the data boundary acquisition request carries the identifier of the target cloud service, the organization identifier of the first organization, the organization identifier of the second organization, and the organization identifier of the third organization. Step 706: The management plane acquires the data boundary for the target cloud service and sends the data boundary for the target cloud service to the authentication data plane. In implementation, after receiving the data boundary acquisition request, the management plane acquires the data boundaries established by each tenant for the target cloud service and sends the acquired data boundaries to the authentication data plane. In one possible implementation, when the constraint organization units in the data boundary are added at the granular level, the management plane obtains the data boundaries for the target cloud service established by the first organization, the second organization, and the third organization, and sends the obtained data boundaries to the authentication data plane. Step 707: The authentication data plane compares the target information with the constraints in the data boundaries for the target cloud service to determine if the target information matches the constraints. The specific processing in step 707 is the same as the comparison processing by the cloud platform in step 205 above, and will not be elaborated here. Step 708: The authentication data plane sends the authentication result of the access request to the target cloud service. The difference between step 708 and step 206 above is only that the sender of the authentication result changes from the cloud platform to the cloud platform's authentication data plane; the specific processing will not be elaborated here.Step 709: The target cloud service processes the access request based on the authentication result. The specific processing in step 709 is the same as in step 207 above, and will not be repeated here. Step 710: The target cloud service sends an access result or an access denial message to the terminal of the tenant who sent the access request. The specific processing in step 710 is the same as in step 208 above, and will not be repeated here. This disclosure also provides a data access apparatus applied to a cloud platform. The cloud platform manages infrastructure providing cloud services. The infrastructure includes at least one cloud data center, and each cloud data center includes multiple servers. The cloud service is set up on one or more servers in the at least one cloud data center, as shown in FIG8. The apparatus includes a management module 810 and an authentication module 820, wherein: the management module 810 is used to receive a data boundary establishment request for the cloud service input by a first tenant, wherein the data boundary establishment request is used to instruct the cloud platform to establish a data boundary for the cloud service, wherein the data boundary includes at least one constraint condition selected from the following: identity subject information of the user of the cloud service, access resource information related to the cloud service, network information involved in the use of the cloud service, device information of the device initiating the access request to the cloud service, and trusted execution environment information related to the cloud service; and establishes a data boundary for the cloud service according to the data boundary establishment request. The authentication module 820 is configured to, when the cloud service receives a first access request for the cloud service from a second tenant or a first tenant, compare the information carried in the first access request with the constraints in the data boundary. If the information carried in the first access request matches the constraints in the data boundary, the cloud service is allowed to respond to the first access request; if the information carried in the first access request does not match the constraints in the data boundary, the cloud service is not allowed to respond to the first access request. The information carried in the first access request includes one or any combination of first identity subject information, first access resource information, first network information, first device information initiating the first access request, and first trusted execution environment information. In one possible implementation, the first tenant and the second tenant register on the cloud platform, with the first tenant acting as the administrator of the data boundary and the second tenant acting as the visitor of the data boundary. In one possible implementation, the management module 810 is further configured to: receive a constraint addition request for the data boundary input by the first tenant; and add a first constraint indicated by the constraint addition request to the data boundary, wherein the first constraint is second identity subject information, second access resource information, second network information, second device information initiating the access request, and second trusted execution.One or more of the environmental information. In one possible implementation, the management module 810 is further configured to: receive a constraint removal request for the data boundary input by the first tenant; remove the second constraint indicated by the constraint removal request from the data boundary of the server, wherein the first constraint is one or more of the following: third identity subject information, third access resource information, third network information, third device information initiating the access request, and third trusted execution environment information. In one possible implementation, the management module 810 is further configured to: receive a data boundary deletion request for the cloud service input by the first tenant; delete the data boundary indicated by the data boundary deletion request. In one possible implementation, the management module 810 is further configured to: receive a data boundary function deactivation request for the cloud service input by the first tenant; deactivate the data boundary function for the cloud service. In one possible implementation, the management module 810 is further configured to: receive a data boundary function enable request for the cloud service input by the first tenant; and enable the data boundary function for the cloud service. Both the management module 810 and the authentication module 820 can be implemented in software or hardware. For example, the implementation of the management module 810 will be described below. Similarly, the implementation of the authentication module 820 can refer to the implementation of the management module 810. As an example of a software functional unit, the management module 810 may include code running on a computing instance. The computing instance may be at least one of a physical host (computing device), a virtual machine, a container, etc. Further, the aforementioned computing device may be one or more. For example, the management module 810 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the application may be distributed in the same region or in different regions. The multiple hosts / virtual machines / containers used to run the code may be distributed in the same Availability Zone (AZ) or in different AZs, each AZ including one data center or multiple geographically proximate data centers. Typically, a region can include multiple Availability Zones (AZs). Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed within the same VPC or across multiple VPCs. Typically, a VPC is set up within one region. Communication between two VPCs within the same region, and between VPCs in different regions, requires a communication gateway to be set up within each VPC to enable interconnection between VPCs.As an example of a hardware functional unit, management module 810 may include at least one computing device, such as a server. Alternatively, management module 810 may also be a device implemented using an ASIC or a PLD. The PLD may be implemented using a CPLD, FPGA, GAL, or any combination thereof. The multiple computing devices included in management module 810 may be distributed in the same region or in different regions. The multiple computing devices included in management module 8100 may be distributed in the same Availability Zone (AZ) or in different AZs. Similarly, the multiple computing devices included in management module 410 may be distributed in the same Virtual Private Cloud (VPC) or in multiple VPCs. These multiple computing devices may be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs. This disclosure also provides a computing device 100. As shown in FIG9, computing device 100 includes: a bus 102, a processor 104, a memory 106, and a communication interface 108. The processor 104, memory 106, and communication interface 108 communicate via bus 102. The computing device 100 may be a server or a terminal device. It should be understood that this disclosure does not limit the number of processors or memories in the computing device 100. The bus 102 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, only one line is used in Figure 5, but this does not indicate that there is only one bus or one type of bus. The bus 102 may include pathways for transmitting information between various components of the computing device 100 (e.g., memory 106, processor 104, communication interface 108). The processor 104 may include any one or more processors such as a central processing unit (CPU), graphics processing unit (GPU), microprocessor (MP), or digital signal processor (DSP). The memory 106 may include volatile memory, such as random access memory (RAM). Memory 106 may also include non-volatile memory, such as read-only memory.ROM, flash memory, hard disk drive (HDD), or solid state drive (SSD). The memory 106 stores executable code, which the processor 104 executes to implement the functions of the aforementioned management module 810 and authentication module 820, thereby realizing the data access method. That is, the memory 106 stores instructions for executing the access management method based on cloud computing technology. The communication interface 108 uses transceiver modules such as, but not limited to, network interface cards and transceivers to realize communication between the computing device 100 and other devices or communication networks. This disclosure also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a desktop computer, a laptop computer, or a smartphone, etc. As shown in FIG10, the computing device cluster includes at least one computing device 100. The memory 106 of one or more computing devices 100 in a computing device cluster may store the same instructions for executing access management methods based on cloud computing technology. In some possible implementations, the memory 106 of one or more computing devices 100 in the computing device cluster may also store partial instructions for executing access management methods based on cloud computing technology. In other words, a combination of one or more computing devices 100 can jointly execute instructions for executing access management methods based on cloud computing technology. It should be noted that the memory 106 of different computing devices 100 in the computing device cluster may store different instructions, each used to execute a portion of the functions of the access management methods based on cloud computing technology. In some possible implementations, the memory 106 of one or more computing devices 100 in the computing device cluster may also store partial instructions for executing automated testing methods. In other words, a combination of one or more computing devices 100 can jointly execute instructions for executing access management methods based on cloud computing technology. It should be noted that the memory 106 of different computing devices 100 in the computing device cluster may store different instructions, used to execute a portion of the functions of the automated testing system. That is, the instructions stored in the memory 106 of different computing devices 100 can implement the functions of one or more nodes in the management module 810 and the monitoring module 820. In some possible implementations, one or more computing devices in the computing device cluster can be connected via a network. Wherein, the...The network can be a wide area network (WAN) or a local area network (LAN), etc. Figure 11 illustrates one possible implementation. As shown in Figure 11, two computing devices 100A and 100B are connected via a network. Specifically, they are connected to the network through the communication interfaces in each computing device. In this type of possible implementation, the memory 106 in computing device 100A stores instructions for performing the functions of the management module 810. Simultaneously, the memory 106 in computing device 100B stores instructions for performing the functions of the authentication module 820. It should be understood that the functions of computing device 100A shown in Figure 11 can also be performed by multiple computing devices 100. Similarly, the functions of computing device 100B can also be performed by multiple computing devices 100. This disclosure also provides another computing device cluster. The connection relationship between the computing devices in this computing device cluster can be similarly referred to the connection method of the computing device clusters shown in Figures 10 and 11. The difference is that the memory 106 in one or more computing devices 100 in this computing device cluster can store the same instructions for performing access management methods based on cloud computing technology. In some possible implementations, the memory 106 of one or more computing devices 100 in the computing device cluster may also store partial instructions for executing automated testing methods. In other words, a combination of one or more computing devices 100 can jointly execute instructions for executing access management methods based on cloud computing technology. It should be noted that the memory 106 of different computing devices 100 in the computing device cluster can store different instructions for executing partial functions of the access management device based on cloud computing technology. That is, the instructions stored in the memory 106 of different computing devices 100 can implement the functions of one or more nodes in the management module 810 and the authentication module 820. This disclosure also provides a computer program product containing instructions. The computer program product may be software or program products containing instructions that can run on a computing device or be stored in any usable medium. When the computer program product runs on at least one computing device, it causes at least one computing device to execute the access management method based on cloud computing technology. This disclosure also provides a computer-readable storage medium. The computer-readable storage medium may be any usable medium that a computing device can store or a data storage device such as a data center containing one or more usable media. The usable medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive), etc. The computer-readable storage medium includes instructions that instruct a computing device to execute an access management method based on cloud computing technology. Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this disclosure and are not intended to limit it; although referring to the foregoing embodiments...This disclosure provides a detailed description, and those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of this disclosure. 12 WO 2024 / 235311 PCT / CN2024 / 093888 Claim 1. An access management method based on cloud computing technology, characterized in that the method is applied to a cloud platform, the cloud platform is used to manage infrastructure providing cloud services, the infrastructure includes at least one cloud data center, each cloud data center includes multiple servers, the cloud service is set in one or more servers in the at least one cloud data center, the method includes: the cloud platform receiving a data boundary establishment request for the cloud service input by a first tenant, wherein the data boundary establishment request is used to instruct the cloud platform to establish a data boundary for the cloud service, wherein the data boundary includes at least one constraint condition selected from identity subject information using the cloud service, access resource information related to the cloud service, network information involved in using the cloud service, device information initiating access requests to the cloud service, and trusted execution environment information related to the cloud service; the cloud platform establishes a data boundary for the cloud service according to the data boundary establishment request; When the cloud service receives a first access request for the cloud service from a second tenant or the first tenant, the cloud platform compares the information carried in the first access request with the constraints in the data boundary. If the information carried in the first access request matches the constraints in the data boundary, the cloud service is allowed to respond to the first access request; if the information carried in the first access request does not match the constraints in the data boundary, the cloud service is not allowed to respond to the first access request. The information carried in the first access request includes one or more of the following: first identity subject information, first access resource information, first network information, first device information initiating the first access request, and first trusted execution environment information. 2. The method according to claim 1, wherein the first tenant and the second tenant register on the cloud platform, the first tenant's role is the administrator of the data boundary, and the second tenant's role is the visitor of the data boundary. 3. The method according to claim 1 or 2, further comprising: the cloud platform receiving a constraint addition request for the data boundary input by the first tenant; the cloud platform adding the first constraint indicated by the constraint addition request to the data boundary, wherein the first...The constraint is one or more of the following: second identity subject information, second access resource information, second network information, second device information initiating the access request, and second trusted execution environment information. 4. The method according to any one of claims 1-3, characterized in that the method further comprises: the cloud platform receiving a constraint removal request for the data boundary input by the first tenant; the cloud platform removing the second constraint indicated by the constraint removal request from the data boundary, wherein the second constraint is one or more of the following: third identity subject information, third access resource information, third network information, third device information initiating the access request, and third trusted execution environment information. 5. The method according to any one of claims 1-4, characterized in that the method further comprises: the cloud platform receiving a data boundary deletion request for the cloud service input by the first tenant; the cloud platform deleting the data boundary indicated by the data boundary deletion request. 6. The method according to any one of claims 1-5, characterized in that the method further comprises: the cloud platform receiving a data boundary function deactivation request for the cloud service input by the first tenant; the cloud platform deactivating the data boundary function for the cloud service. 7. The method according to claim 6, characterized in that the method further comprises: the cloud platform receiving a data boundary function activation request for the cloud service input by the first tenant; and the cloud platform activating the data boundary function for the cloud service. 8. An access management device based on cloud computing technology, characterized in that the device is applied to a cloud platform, the cloud platform is used to manage the infrastructure providing cloud services, the infrastructure includes at least one cloud data center, each cloud data center in the at least one cloud data center includes multiple servers, the cloud service is set in one or more servers in the at least one cloud data center, the method includes: a management module, configured to receive a data boundary establishment request for the cloud service input by a first tenant, wherein the data boundary establishment request is used to instruct the cloud platform to establish a data boundary for the cloud service, wherein the data boundary includes at least one constraint condition among identity subject information of the user of the cloud service, access resource information related to the cloud service, network information involved in the use of the cloud service, device information of the device initiating the access request to the cloud service, and trusted execution environment information related to the cloud service; and establish a data boundary for the cloud service according to the data boundary establishment request; an authentication module, configured to, when the cloud service receives a first access request for the cloud service generated by a second tenant or the first tenant.In the event of a request, the information carried in the first access request is compared with the constraints in the data boundary. If the information carried in the first access request matches the constraints in the data boundary, the cloud service is allowed to respond to the first access request; if the information carried in the first access request does not match the constraints in the data boundary, the cloud service is not allowed to respond to the first access request. The information carried in the first access request includes one or any combination of first identity subject information, first access resource information, first network information, first device information initiating the first access request, and first trusted execution environment information. 9. The apparatus according to claim 8, wherein the first tenant and the second tenant are registered on the cloud platform, the first tenant's role is the administrator of the data boundary, and the second tenant's role is the visitor of the data boundary. 10. The apparatus according to claim 8 or 9, wherein the management module is further configured to: receive a constraint addition request for the data boundary input by the first tenant; add a first constraint indicated by the constraint addition request to the data boundary, wherein the first constraint is one or more of second identity subject information, second access resource information, second network information, second device information initiating the access request, and second trusted execution environment information. n. The apparatus according to any one of claims 8-10, wherein the management module is further configured to: receive a constraint removal request for the data boundary input by the first tenant; remove the second constraint indicated by the constraint removal request from the data boundary of the server, wherein the first constraint is one or more of third identity subject information, third access resource information, third network information, third device information initiating the access request, and third trusted execution environment information. 12. The apparatus according to any one of claims 8-11, wherein the management module is further configured to: receive a data boundary deletion request for the cloud service input by the first tenant; delete the data boundary indicated by the data boundary deletion request. 13. The apparatus according to any one of claims 8-12, wherein the management module is further configured to: receive a data boundary function deactivation request for the cloud service input by the first tenant; and deactivate the data boundary function for the cloud service. 14. The apparatus according to claim 13, wherein the management module is further configured to: receive a data boundary function enable request for the cloud service input by the first tenant; and enable the data boundary function for the cloud service. 15. A computer device cluster, wherein the computer device cluster includes at least one computing device, each computing device including a processor and a memory;The processor of the at least one computing device is configured to execute instructions stored in the memory of the device, causing the computing device cluster to perform the access management method based on cloud computing technology as described in any one of claims 1 to 7. 16. A computer program product comprising instructions, characterized in that, when the instructions are executed by a computing device, the computing device performs the access management method based on cloud computing technology as described in any one of claims 1 to 7. 17. A computer-readable storage medium, characterized in that it comprises computer program instructions, which, when executed by a computing device, cause the computing device to perform the access management method based on cloud computing technology as described in any one of claims 1 to 7. 15 WO 2024 / 235311 PCT / CN2024 / 093888 1 / 9 Figure 1 WO 2024 / 235311 PCT / CN2024 / 093888 2 / 9 Figure 2 WO 2024 / 235311 PCT / CN2024 / 093888 WO 2024 / 235311 PCT / CN2024 / 093888 4 / 9 Figure 5 WO 2024 / 235311 PCT / CN2024 / 093888 5 / 9 Figure 6 WO 2024 / 235311 PCT / CN2024 / 093888 6 / 9 Figure 7 WO 2024 / 235311 PCT / CN2024 / 093888 7 / 9 "810 Management module < 820 Authentication module Figure 9 WO 2024 / 235311 PCT / CN2024 / 093888 8 / 9 Figure 10 WO 2024 / 235311 PCT / CN2024 / 093888 Figure 11 INTERNATIONAL SEARCH REPORT International application No. PCT / CN2024 / 093888 A. CLASSIFICATION OF SUBJECT MATTER H04L 9 / 40(2022.01)1 According to International Patent Classification (IPC) or to both national classification and IPC B. FIELDS SEARCHED Minimum documentation searched (classification system followed by classification symbols)IPC:H04L,H04W Documentation searched other than the minimum documentation to the extent that such documents are included in the searched fields Electronic database consulted during the international search (name of database and, where practicable, search terms used) CNTXT, WPABSC, CJFD, ENTXT, DWPI, WPABS, CNKI, 3GPP: cloud service, cloud platform, IAM, permission, boundary, resource, access, matching, cloud services, cloud platform, identity and Access Management, permissions, resource, access, match C. DOCUMENTS CONSIDERED TO BE RELEVANT Category* Citation of document, with indication, where appropriate, of the relevant passages Relevant to claim No. X CN 112995166 A (BEIJING KINGSOFT CLOUD NETWORK TECHNOLOGY CO., LTD.) 18 June 2021 (2021-06-18) description, paragraphs

[0030] -

[0096] 1-17 A CN 112235400 A (TENCENT TECHNOLOGY (SHENZHEN) CO., LTD.) 15 January 2021 (2021-01-15) entire document 1-17 A CN 113010897 A (CHINA UNITED NETWORK COMMUNICATIONS GROUP CO., LTD. et al.) 22 June 2021 (2021-06-22) entire document 1-17 A EP 3794794 A1 (SIEMENSAG) 24 March 2021 (2021-03-24) entire document 1-17 | | Further documents are listed in the continuation of Box C. | / 1 See patent family annex. * Special categories of cited documents: “T" later document published after the international filing date or priority “A" document defining the general state of the art which is not considered date and not in conflict with the application but cited to understand the to be of paiticulai' relevance principle or theory underlying the invention "D” document cited by the applicant in the international application “χ” document of particular relevance; the claimed invention cannot be “E” eailier application or patent but published on or after the international considered novel or cannot be considered to involve an inventive step filing date when the document is taken alone “L" document which may thi'ow doubts on priority claim(s) or which is “Y" document of paiticulai' relevance; the claimed invention cannot be cited to establish the publication dateof another citation or other considered to involve an inventive step when the document is special reason (as specified) combined with one or more other such documents, such combination "O” document refen'ing to an oral disclosure, use, exhibition or other being obvious to a person skilled in the art means document member of the same patent family "P” document published prior to the international filing date but later than the priority date claimed Date of the actual completion of the international search 02 July 2024 Date of mailing of the international search report 04 July 2024 Name and mailing address of the ISA / CN China National Intellectual Property Administration (ISA / CN) China No. 6, Xitucheng Road, Jimenqiao, Haidian District, Beijing 100088 Authorized officer Telephone No. Form PCT / ISA / 210 (second sheet) (July 2022) International application No.INTERNATIONAL SEARCH REPORT Information on patent family members PCT / CN2024 / 093888 Patent document cited in search report Publicationdate (day / month / year) Patent family member(s) Publication date (day / month / year) CN 112995166 A 18 June 2021 None CN 112235400 A 15 January 2021 None CN 113010897 A 22 June 2021 None EP 3794794 Al 24 March 2021 WO 2019243429 Al 26 December 2019 US 2021105274 Al 08 April 2021 US 11855984 B2 26 December 2023 EP 3585026 Al 25 December 2019 EP 3794794 CO 26 July 2023 Form PCT / ISA / 210 (patent family annex) (July 2022) International Application No. PCT / CN2024 / 093888 International Search Report A. Subject Classification H04L 9 / 40 (2022.01) 1 Classified by International Patent Classification (IPC) or by both national classification and IPC B. Search Field Minimum Documents Searched (Indicate classification system and classification number) IPC: H04L, H04W Electronic databases consulted during the international search, excluding the minimum documents in the search field (database name and search terms used, if applicable) CNTXT, WPABSC, CJFD, ENTXT, DWPI, WPABS, CNKI, 3Gpp cloud services, cloud platform, IAM, permissions, boundaries, resources, access, match C. Relevant Document Types * Cited documents, indicating relevant paragraphs where necessary Relevant claims X CN 112995166 A (Beijing Kingsoft Cloud Network Technology Co., Ltd.) June 18, 2021 (2021-06-18) Specification Sections

[0030] -

[0096] 1-17 A CN 112235400 A (Tencent Technology (Shenzhen) Co., Ltd.) January 15, 2021 (2021-01-15) Full Text 1-17 A CN 113010897A (China United Network Communications Group Co., Ltd., etc.) June 22, 2021 (2021-06-22) Full text 1-17 A EP 3794794 A1 (SIEMENS AG) March 24, 2021 (2021-03-24) Full text 1-17 □The remaining documents are listed on the continuation page in column C. *Specific types of cited documents: “A” Documents that are considered not particularly relevant and represent the general state of the prior art. “D” Documents cited by the applicant in the international application. “E” Earlier applications or patents published on or after the international filing date. “L” Documents that may raise doubt about the priority claim, or documents cited to determine the publication date of another cited document, or documents cited for other special reasons (as specifically stated). Documents involving □head disclosure, use, exhibition, or other disclosure. “P” Documents published before the international filing date but later than the claimed priority date. See the patent family appendix. "A document published after the application date or priority date, which does not conflict with the application, but is particularly different from the subsequent document for understanding the inventive theory or principle, is considered alone, and the claimed invention is deemed not novel or lacking inventiveness. A document particularly related to "Y" is also considered, and when the document is not combined with any of the other documents of the same class and such combination is obviously excessive to those skilled in the art, the claimed invention lacks inventiveness. International search of patent family documents: Date of actual completion: July 2, 2024. Name and mailing address of ISA / CN: China National Intellectual Property Administration, No. 6, Tucheng Road, Xijimenqiao, Haidian District, Beijing 100088, China. International search report mailing date: July 4, 2024. Authorized officer: Li Xiao. Telephone number: (+86) 010-62412283. PCT / ISA / 210 Form (Page 2) (July 2022). International Application Number: PCT / CN2024 / 093888 International Search Report Information on Patent Family Publication Date of Patent Documents Cited in the Search Report (Year / Month / Day) Publication Date of Patent Family (Year / Month / Day) CN 112995166 A June 18, 2021 None CN 112235400 A January 15, 2021 None CN 113010897 A June 22, 2021 None EP 3794794 A1 March 24, 2021 WO 2019243429 A1 December 26, 2019 US 2021105274 A1 April 8, 2021 US 11855984 B2 December 26, 2023 EP 3585026 A1 December 25, 2019 EP 3794794 co July 26, 2023PCT / ISA / 210 Form (Patent Family Annex) (July 2022) (19) *EP004701133A1* (11) EP 4 701 133 A1 (12) EUROPEAN PATENT APPLICATION published in accordance with Art. 153(4) EPC (43) Date of publication: 25.02.2026 Bulletin 2026 / 09 (21) Application number: 24806660.7 (22) Date of filing: 17.05.2024 (51) International Patent Classification (IPC): H04L 9 / 40 (2022.01) (52) Cooperative Patent Classification (CPC): H04L 9 / 40; H04L 67 / 12 (86) International application number: PCT / CN2024 / 093888 (87) International publication number: WO 2024 / 235311 (21.11.2024 Gazette 2024 / 47) (84) Designated Contracting States: AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC ME MK MT NL NO PL PT RO RS SE SI SK SM TR Designated Extension States: BA Designated Validation States: GE KH MA MD TN (30) Priority: 18.05.2023 CN 202310564727 25.09.2023 CN 202311247399 (71) Applicant: Huawei Cloud Computing Technologies Co., Ltd. Guiyang, Guizhou 550025 (CN) (72) Inventors: • LIN, Weibo Guiyang, Guizhou 550025 (CN) •LI, Jun Guiyang, Guizhou 550025 (CN) • LIU, Boyang Guiyang, Guizhou 550025 (CN) (74) Representative: MERH-IP Matias Erny Reichl Hoffmann Patentanwälte PartG mbB Paul-Heyse-Straße 29 80336 München (DE) (54) CLOUD‑COMPUTING‑BASED ACCESS MANAGEMENT METHOD AND APPARATUS, AND DEVICE (57) The present disclosure pertains to the field of cloud technologies, and provides a cloud computing technology based access management method and ap- paratus, and a device. The method includes: A cloud platform receives a data boundary establishment request that is input by a first tenant for a cloud service, where a data boundary includes at least one of the following constraint conditions: information about an identity sub- ject that uses the cloud service, access resource infor- mation related to the cloud service, network information related to use of the cloud service, information about a device that initiates an access request to the cloud ser- vice, and trusted execution environment information re-lated to the cloud service. The cloud platform establishes the data boundary for the cloud service. The cloud plat- form compares information carried in an access request, for the cloud service, that is received by the cloud service with the constraint condition in the data boundary; and if the information carried in the access request matches the constraint condition in the data boundary, allows the cloud service to respond to the access request; other- wise, skips allowing the cloud service to respond to the first access request. In the present disclosure, security of data on a tenant cloud can be effectively ensured. EP 4 70 1 13 3 A 1 Processed by Luminess, 75001 PARIS (FR) (Cont. next page) 2 EP 4 701 133 A1 3 1 EP 4 701 133 A1 2 Description

[0001] The present disclosure claims priorities to Chi- nese Patent Application No. 202310564727.1, filed on May 18, 2023 and entitled "METHOD AND APPARATUS FOR IMPLEMENTING SECURITY BOUNDARY FOR CLOUD DATA BASED ON IAM, AND DEVICE", and toChinese Patent Application No. 202311247399.9, filed on September 25, 2023 and entitled "DATA ACCESS METHOD AND APPARATUS, DEVICE, AND STORAGE MEDIUM", both of which are incorporated herein by reference in their entireties. TECHNICAL FIELD

[0002] The present disclosure relates to the field of cloud technologies, and in particular, to a cloud comput- ing technology-based access management method and apparatus, and a device. BACKGROUND

[0003] With development of cloud computing technol- ogies, a data center is evolving from a local data center to a cloud data center. The cloud data center may provide cloud services for a plurality of tenants and store tenant data. In addition, a cloud also provides some services and resources for a public network. This causes many security threats to the tenant data in the cloud data center. Therefore, currently, a method that can ensure security of the tenant data in the cloud data center is urgently needed. SUMMARY

[0004] The present disclosureprovides a cloud com- puting technology-based access management method and apparatus, and a device, to effectively ensure se- curity of data in a cloud data center. Corresponding technical solutions are as follows.

[0005] According to a first aspect, a cloud computing technology based access management method is pro- vided. The method is applied to a cloud platform. The cloud platform is configured to manage infrastructure that provides a cloud service. The infrastructure includes at least one cloud data center. Each of the at least one cloud data center includes a plurality of servers. The cloud service is deployed on one or more servers in the at least one cloud data center. The method includes: The cloud platform receives a data boundary establishment request that is input by a first tenant for the cloud service, where the data boundary establishment request is used to in- dicate the cloud platform to establish a data boundary for the cloud service, and the data boundary includes atleast one of the following constraint conditions: information about an identity subject that uses the cloud service, access resource information related to the cloud service, network information related to use of the cloud service, information about a device that initiates an access re- quest to the cloud service, and trusted execution envir- onment information related to the cloud service. The cloud platform establishes a data boundary for the cloud service based on the data boundary establishment re- quest. When the cloud service receives a first access request generated by a second tenant or the first tenant for the cloud service, the cloud platform compares in- formation carried in the first access request with the constraint condition in the data boundary; and when the information carried in the first access request matches the constraint condition in the data boundary, allows the cloud service to respond to the first access request; or when the information carried in the firstac- cess request does not match the constraint condition in the data boundary, skips allowing the cloud service to respond to the first access request, where the information carried in the first access request includes one or more of the following: first identity subject information, first ac- cess resource information, first network information, first device information for initiating the first access request, and first trusted execution environment information.

[0006] In the technical solution provided in the present disclosure, a tenant may establish, through the cloud platform according to an actual requirement of the tenant, a data boundary for a purchased cloud service; and constrain, through the data boundary, one or more of the following: an identity subject that uses the cloud service, an access resource related to the cloud service, a network related to use of the cloud service, a device that initiates an access request to the cloud service, and a trusted executionenvironment related to the cloud ser- vice. Further, when there is an access request for the cloud service, information carried in the access request is compared with the data boundary established by the tenant for the cloud service. If the information carried in the access request matches a constraint condition in the data boundary, the cloud service is allowed to re- spond to the access request. If the information carried in the access request does not match a constraint condition in the data boundary, the cloud service is not allowed to respond to the access request. In this way, security of tenant data on a cloud can be effectively ensured based on the constraint of the data boundary.

[0007] In a possible implementation, the first tenant and the second tenant are registered with the cloud platform, a role of the first tenant is an administrator of the data boundary, and a role of the second tenant is a visitor of the data boundary.

[0008] In a possible implementation, the methodfurther includes: The cloud platform receives a constraint condition addition request that is input by the first tenant for the data boundary. The cloud platform adds, to the data boundary,a first constraint condition indicated by the constraint condition addition request, where the first con- straint condition is one or more of the following: second identity subject information, second access resource information, second network information, second device 5 10 15 20 25 30 35 40 45 50 55 4 3 EP 4 701 133 A1 4 information for initiating an access request, and second trusted execution environment information.

[0009] In the technical solution provided in the present disclosure, a tenant may freely add a constraint condition to an established data boundary according to an actual requirement, so that flexibility is higher, and an operation is simple.

[0010] In a possible implementation, the method further includes: The cloud platform receives a constraint condition removal request that isinput by the first tenant for the data boundary. The cloud platform removes, from the data boundary, a second constraint condition indi- cated by the constraint condition removal request, where the second constraint condition is one or more of the following: third identity subject information, third access resource information, third network information, third device information for initiating an access request, and third trusted execution environment information.

[0011] In the technical solution provided in the present disclosure, a tenant may freely remove a constraint con- dition from an established data boundary according to an actual requirement, so that flexibility is higher, and an operation is simple.

[0012] In a possible implementation, the method further includes: The cloud platform receives a data boundary deletion request that is input by the first tenant for the cloud service. The cloud platform deletes the data boundary indicated by the data boundary deletion re- quest.

[0013] In the technical solution provided in the present disclosure, a tenant may delete an established data boundary according to an actual requirement, so that flexibility is higher, and an operation is simple.

[0014] In a possible implementation, the method further includes: The cloud platform receives a data boundary function disabling request that is input by the first tenant for the cloud service. The cloud platform disables a data boundary function for the cloud service.

[0015] In the technical solution provided in the present disclosure, a tenant may disable a data boundary func- tion for a cloud service according to an actual require- ment, so that operation flexibility is higher, and an opera- tion is simple.

[0016] In a possible implementation, the method further includes: The cloud platform receives a data boundary function enabling request that is input by the first tenant for the cloud service. The cloud platform enables a data boundary function for the cloud service.

[0017] In the technical solution provided in the present disclosure, a tenant may enable a data boundary function for a cloud service according to an actual requirement, so that operation flexibility is higher, and an operation is simple.

[0018] According to a second aspect, a cloud comput- ing technology-based access management apparatus is provided. The apparatus is used in a cloud platform. The cloud platform is configured to manage infrastructure that provides a cloud service. The infrastructure includes at least one cloud data center. Each of the at least one cloud data center includes a plurality of servers. The cloud service is deployed on one or more servers in the at least one cloud data center. The method includes: a management module, configured to: receive a data boundary establishment request that is input by a first tenant for the cloud service, where the data boundary establishment request is used to indicate the cloud platform to establish a data boundary for the cloudservice, and the data boundary includes at least one of the following constraint conditions: in- formation about an identity subject that uses the cloud service, access resource information related to the cloud service, network information related to use of the cloud service, information about a device that initiates an access request to the cloud service, and trusted execution environment information re- lated to the cloud service; and establish a data boundary for the cloud service based on the data boundary establishment request; and an authentication module, configured to: when the cloud service receives a first access request gener- ated by a second tenant or the first tenant for the cloud service, compare information carried in the first access request with the constraint condition in the data boundary, and when the information carried in the first access request matches the constraint con- dition in the data boundary, allow the cloud service to respond to the first accessrequest, or when the information carried in the first access request does not match the constraint condition in the data bound- ary, skip allowing the cloud service to respond to the first access request, where the information carried in the first access request includes one or any combi- nation of the following: first identity subject informa- tion, first access resource information, first network information, first device information for initiating the first access request, and first trusted execution en- vironment information.

[0019] In a possible implementation, the first tenant and the second tenant are registered with the cloud platform, a role of the first tenant is an administrator of the data boundary, and a role of the second tenant is a visitor of the data boundary.

[0020] In a possible implementation, the management module is further configured to: receive a constraint condition addition request that is input by the first tenant for the data boundary; and add, to the databoundary, a first constraint condition indicated by the constraint condition addition re- quest, where the first constraint condition is one or more of the following: second identity subject infor- mation, second access resource information, sec- ond network information, second device information for initiating an access request, and second trusted 5 10 15 20 25 30 35 40 45 50 55 5 5 EP 4 701 133 A1 6 execution environment information.

[0021] In a possible implementation, the management module is further configured to: receive a constraint condition removal request that is input by the first tenant for the data boundary; and remove, from the data boundary of the server, a second constraint condition indicated by the con- straint condition removal request, where the first constraint condition is one or more of the following: third identity subject information, third access re- source information, third network information, third device information for initiating an access request, andthird trusted execution environment information.

[0022] In a possible implementation, the management module is further configured to: receive a data boundary deletion request that is input by the first tenant for the cloud service; and delete the data boundary indicated by the data boundary deletion request.

[0023] In a possible implementation, the management module is further configured to: receive a data boundary function disabling request that is input by the first tenant for the cloud service; and disable a data boundary function for the cloud ser- vice.

[0024] In a possible implementation, the management module is further configured to: receive a data boundary function enabling request that is input by the first tenant for the cloud service; and enable a data boundary function for the cloud ser- vice.

[0025] According to a third aspect, a computing device cluster is provided, and includes at least one computing device. Each computing device includes a processor and a memory. Aprocessor of the at least one computing device is configured to execute instructions stored in a memory of the at least one computing device, to enable the computing device cluster to perform the cloud com- puting-based access management method provided in the first aspect.

[0026] According to a fourth aspect, a computer pro- gram product including instructions is provided. When the instructions are run by a computing device cluster, the computing device cluster is enabled to perform the cloud computing based access management method provided in the first aspect.

[0027] According to a fifth aspect, a computer-read- able storage medium is provided, and includes computer program instructions. When the computer program in- structions are executed by a computing device cluster, the computing device cluster performs the cloud comput- ing based access management method provided in the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0028] FIG. 1 is a diagram of an implementation scenarioaccording to an embodiment of the present disclo- sure; FIG. 2 is a schematic flowchart of a cloud computing based access management method according to an embodiment of the present disclosure; FIG. 3 is a diagram of a data boundary according to an embodiment of the present disclosure; FIG. 4 is a diagram of a data boundary according to an embodiment of the present disclosure; FIG. 5 is a diagram of a data boundary according to an embodiment of the present disclosure; FIG. 6 is a diagram of a data boundary according to an embodiment of the present disclosure; FIG. 7 is a schematic flowchart of a cloud computing based access management method according to an embodiment of the present disclosure; FIG. 8 is a diagram of a structure of a cloud comput- ing based access management apparatus according to an embodiment of the present disclosure; FIG. 9 is a diagram of a structure of a computer device according to an embodiment of the present disclosure; FIG. 10 is a diagram of a structure of acomputer device cluster according to an embodiment of the present disclosure; and FIG. 11 is a diagram of a structure of a computer device cluster according to an embodiment of the present disclosure. DESCRIPTION OF EMBODIMENTS

[0029] To make the objectives, technical solutions, and advantages of the present disclosure clearer, the follow- ing further describes implementations of the present disclosure in detail with reference to the accompanying drawings.

[0030] The following first describes some terms used in implementations of the present disclosure, to help per- sons skilled in the art to understand the present disclo- sure.

[0031] Cloud platform and infrastructure: The cloud platform is configured to manage infrastructure of a cloud vendor. The infrastructure is a plurality of cloud data centers deployed in different regions, where at least one cloud data center is deployed in each region. The cloud platform may provide an interface related to a cloud 5 10 15 20 25 30 35 40 45 5055 6 7 EP 4 701 133 A1 8 computing service, for example, a configuration page or an application programming interface (Application Pro- gramming Interface, API), for a tenant to access a cloud service. The tenant may log in to the cloud platform by using a pre-registered account and password, and after the login succeeds, select and purchase a cloud service provided by a cloud data center in a predetermined region. The cloud service is, for example, an object storage service, a database service, a messaging queue service, or another known cloud service.

[0032] Tenant: The tenant is a top-level object used to manage a cloud service and / or a cloud resource. The tenant registers a tenant account and sets a tenant pass- word on a cloud platform through a local client (for ex- ample, a browser). The local client remotely logs in to the cloud platform through the local client by using the tenant account and the specified tenant password. The cloud platform provides a configuration interfaceor an API for the tenant to configure and use a cloud service. The cloud service is specifically provided by infrastructure mana- ged by the cloud platform.

[0033] Virtual private cloud (Virtual Private Cloud, VPC): The VPC is a dynamic configuration pool of public cloud computing resources, and needs to use an encryp- tion protocol, a tunneling protocol, and other security programs to transmit data between an enterprise and a cloud service provider. The VPC builds, for an elastic cloud server, an isolated virtual network environment that is autonomously configured and managed by a user, to improve security of cloud resources of the user, and simplify network deployment of the user. Network char- acteristics such as a security group, a virtual private network (Virtual Private Network, VPN), an IP address segment, and bandwidth may be defined in the VPC. A tenant may easily manage and configure an internal network through the VPC, to securely and efficiently perform a network change.

[0034] Embodiments of the present disclosure provide a cloud computing technology based access manage- ment method. The method may be applied to a cloud platform. The cloud platform is configured to manage infrastructure that provides a cloud service. The infra- structure includes at least one cloud data center. Each of the at least one cloud data center includes a plurality of servers. The cloud service is deployed on one or more servers in the at least one cloud data center. With refer- ence to the accompanying drawings, the following de- scribes an example implementation scenario of the cloud computing technology based access management meth- od provided in embodiments of the present disclosure.

[0035] FIG. 1 is a diagram of an implementation sce- nario according to an embodiment of the present disclo- sure. As shown in FIG. 1, the implementation scenario includes a cloud platform 10, a cloud data center 1, ..., and a cloud data center m. A plurality of servers are deployed in eachcloud data center. For example, a server 1, a server 2, ..., and a server n are deployed in the cloud data center 1. Cloud services, such as a cloud service 1, a cloud service 2, ..., and a cloud service a, are deployed on the server. A tenant 40 may log in to the cloud platform 10 through a client 30 and the Internet 20 by using a tenant account and a password that are pre- registered with the cloud platform 10, purchase a cloud service through the cloud platform 10, and establish a data boundary for a cloud service that has been pur- chased by the tenant 40. A tenant 50 may log in to the cloud platform 10 through a client 60 and the Internet 20 by using a tenant account and a password that are pre- registered with the cloud platform 10, purchase a cloud service through the cloud platform 10, and establish a data boundary for a cloud service that has been pur- chased by the tenant 50. The tenant 50 or the tenant 40 may store data by using the purchased cloud service. However, becausethe cloud data center may provide services for a plurality of tenants and may also provide a service for a public network, tenant data faces many security threats. The following describes security threats to tenant data on a cloud.

[0036] For example, the cloud service is an object storage service. The tenant 40 may purchase at least one storage bucket (storage bucket), for example, a storage bucket 1 or a storage bucket 2, according to an actual requirement, and store data in the storage bucket. For the tenant 40, data of the tenant 50 on the cloud may face the following security threats.

[0037] Security threat 1: an attack from an external attacker. The external attacker holds a valid credential of the tenant 40 and directly accesses the storage bucket (for example, the storage bucket 1 or the storage bucket 2) of the tenant 50 to obtain data of the tenant 40, causing leakage of data of the tenant 50.

[0038] Security threat 2: an attack from another tenant (for example, the tenant50) on the cloud. Due to incorrect or malicious authorization configuration of resources, an unexpected tenant (for example, the tenant 50) may access the storage bucket (for example, the storage bucket 1 or the storage bucket 2) of the tenant 40 to obtain data of the tenant 40, causing leakage of data of the tenant 40.

[0039] Security threat 3: an attack from an internal person or malicious code. Data that should be stored in the storage bucket 1 or the storage bucket 2 of the tenant 40 are written into a storage bucket of another tenant by an internal person of the tenant 40 or through malicious code, causing leakage of data of the tenant 40.

[0040] Embodiments of the present disclosure provide a cloud computing technology based access manage- ment method. In the method, a tenant may establish, through a cloud platform according to an actual require- ment of the tenant, a data boundary for a purchased cloud service; and constrain, through the data boundary, one or more of thefollowing: an identity subject that uses the cloud service, an access resource related to the cloud service, a network related to use of the cloud service, a device that initiates an access request to the cloud ser- vice, and a trusted execution environment related to the 5 10 15 20 25 30 35 40 45 50 55 7 9 EP 4 701 133 A1 10 cloud service. Further, when there is an access request for the cloud service, information carried in the access request is compared with the data boundary established by the tenant for the cloud service. If the information carried in the access request matches a constraint con- dition in the data boundary, the cloud service is allowed to respond to the access request. If the information carried in the access request does not match a constraint con- dition in the data boundary, the cloud service is not allowed to respond to the access request. In this way, security of tenant data on a cloud can be effectively ensured based on the constraint of the data boundary.With reference to the accompanying drawings, the fol- lowing describes the cloud computing technology-based access management method provided in embodiments of the present disclosure.

[0041] As shown in FIG. 2, a processing process of a cloud computing technology based access management method provided in an embodiment of the present dis- closure may include the following steps.

[0042] Step 201: A first tenant sends a data boundary establishment request for a target cloud service to a cloud platform through a terminal.

[0043] The first tenant is any tenant that has purchased the target cloud service, for example, the tenant 40 or the tenant 50 in FIG. 1.

[0044] During implementation, after purchasing the target cloud service, to ensure security of data on a cloud, the first tenant may send the data boundary establish- ment request for the target cloud service to the cloud platform through the terminal, to indicate the cloud plat- form to establish a data boundary for the target cloudservice. In the data boundary establishment request, different constraint conditions included in the data bound- ary are carried in different fields. The constraint condition may include one or more of the following: information about an identity subject that uses the target cloud ser- vice, access resource information related to the target cloud service, network information related to use of the target cloud service, information about a device that initiates an access request to the target cloud service, and trusted execution environment information related to the target cloud service. The foregoing constraint condi- tions are described below.

[0045] Information about the identity subject that uses the target cloud service: The information about the iden- tity subject may be an identifier of an identity access management (Identity and Access Management, IAM) identity established by a tenant for a member in an organization (Organizations). The first tenant may be an enterprise. Thefirst tenant may establish, through an organization service provided by the cloud platform, an organization corresponding to the first tenant. An employee in the enterprise is mapped to a member in the organization. The first tenant may establish a corre- sponding IAM identity for each member in the organiza- tion, and the member may use the IAM identity to access the target cloud service purchased by the tenant. The constraint condition may be used to specify IAM identities that are allowed to access the target cloud service.

[0046] Access resource information related to the tar- get cloud service: The access resource information may be resource information of the target cloud service pur- chased by the first tenant. For example, the target cloud service is an object storage service, and the access resource information may be an identifier of a storage bucket. For example, the target cloud service is a data- base service, and the access resource information may be an identifier of adatabase. The constraint condition may be used to specify resources of the target cloud service that are allowed to be accessed.

[0047] Network information related to use of the target cloud service: The network information may be an iden- tifier of a virtual private cloud (Virtual Private Cloud, VPC) or an identifier of a public network. The network informa- tion related to use of the target cloud service may be used to specify networks that are allowed to access the target cloud service.

[0048] Information about the device that initiates the access request to the target cloud service: The informa- tion about the device may be device information of a device used to initiate an access request to the target cloud service, and the device information indicates an operating system of the device, whether a security scan- ning application is installed, or the like. The constraint condition may be used to specify a specific type of device that is allowed to access the target cloud service.

[0049] Trusted execution environment information re- lated to the target cloud service: The trusted execution environment information may be execution environment information corresponding to a trusted execution envir- onment of a target application that accesses the target cloud service, and the execution environment informa- tion indicates whether a device that executes the appli- cation supports a trusted platform module (trusted plat- form module, TPM), whether memory protection is sup- ported, or the like.

[0050] The following describes step 201 by using ex- amples.

[0051] Example 1: The first tenant needs to establish a data boundary for a purchased object storage service, to implement the following constraint: Only an IAM identity 1 and an IAM identity 2 can access a storage bucket 1 and a storage bucket 2 in a trusted execution environment 1 through a VPC 1 by using a device 1. Correspondingly, the data boundary establishment request sent by the terminal carries an identifierP1 of the IAM identity 1, an identifier P2 of the IAM identity 2, trusted execution environment information E1 of the trusted execution en- vironment 1, device information D1 of the device, an identifier N1 of the VPC 1, an identifier R1 of the storage bucket 1, and an identifier R2 of the storage bucket 2.

[0052] Example 2: The first tenant needs to establish a data boundary for a purchased object storage service to implement the following constraint: Only an IAM identity 3, an IAM identity 4, and an IAM identity 5 can access a 5 10 15 20 25 30 35 40 45 50 55 8 11 EP 4 701 133 A1 12 storage bucket 3 through a VPC 2. Correspondingly, the data boundary establishment request sent by the term- inal carries an identifier P3 of the IAM identity 3, an identifier P4 of the IAM identity 4, an identifier P5 of the IAM identity 5, an identifier N2 of the VPC 2, and an identifier R3 of the storage bucket 3.

[0053] Step 202: The cloud platform establishes a data boundary for the target cloudservice based on the data boundary establishment request.

[0054] During implementation, after receiving the data boundary establishment request sent by the terminal, the cloud platform obtains the constraint condition carried in the data boundary establishment request, and estab- lishes a data boundary including the constraint condition.

[0055] With reference to the foregoing example 1, the data boundary establishment request carries P1, P2, E1, D1, N1, R1, and R2. In this case, the cloud platform establishes a data boundary for the target cloud service, where the data boundary includes P1, P2, E1, D1, N1, R1, and R2.

[0056] With reference to the foregoing example 2, the data boundary establishment request carries P3, P4, P5, N2, and R3. In this case, the cloud platform establishes a data boundary for the target cloud service, where the data boundary includes P3, P4, P5, N2, and R3.

[0057] Step 203: The target cloud service receives an access request for the target cloud service.

[0058] During implementation, when a tenant needs to use the target cloud service, the tenant may send an access request to the target cloud service through a device. Correspondingly, the target cloud service re- ceives the access request sent by the tenant. The tenant may be the first tenant, or may be a tenant registered with the cloud platform other than the first tenant. The access request carries target information, and the target infor- mation includes one or more of the following: first identity subject information, first access resource information, first network information, first device information for in- itiating the access request, and first trusted execution environment information.

[0059] Step 204: The target cloud service sends the target information carried in the access request to the cloud platform.

[0060] During implementation, after receiving the ac- cess request, the target cloud service obtains the target information carried in the access request, and sends thetarget information to the cloud platform.

[0061] Step 205: The cloud platform compares the target information with the constraint condition in the data boundary for the target cloud service, and determines whether the target information matches the constraint condition in the data boundary for the target cloud ser- vice.

[0062] During implementation, the cloud platform may obtain data boundaries for the target cloud service, and sequentially compare the target information with con- straint conditions in the data boundaries for the target cloud service, to determine whether the target informa- tion matches a constraint condition in any data boundary for the target cloud service. The following describes comparison between the target information and a con- straint condition in any data boundary by using an ex- ample in which the target information includes five types of information (the first identity subject information, the first access resource information, the first network infor-mation, the first device information for initiating the ac- cess request, and the first trusted execution environment information) and the data boundary includes five con- straint conditions (the information about the identity sub- ject that uses the target cloud service, the access re- source information related to the target cloud service, the network information related to use of the target cloud service, the information about the device that initiates the access request to the target cloud service, and the trusted execution environment information related to the target cloud service).

[0063] Comparison in terms of identity subject informa- tion: The first identity subject information in the target information is compared with the information about the identity subject that uses the target cloud service in the data boundary. If the information about the identity sub- ject that uses the target cloud service includes the first identity subject information, it is determined that thefirst identity subject information matches the information about the identity subject that uses the target cloud service; otherwise, it is determined that the first identity subject information does not match the information about the identity subject that uses the target cloud service.

[0064] Comparison in terms of access resource infor- mation: The first access resource information in the target information is compared with the access resource infor- mation related to the target cloud service in the data boundary. If the access resource information related to the target cloud service includes the first access resource information, it is determined that the first access resource information matches the access resource information related to the target cloud service; otherwise, it is deter- mined that the first access resource information does not match the access resource information related to the target cloud service.

[0065] Comparison in terms of network information: The firstnetwork information in the target information is compared with the network information related to use of the target cloud service in the data boundary. When the first network information is an identifier of a VPC, whether the network information related to use of the target cloud service includes the first network infor- mation is determined. If the network information related to use of the target cloud service includes the first network information, it is determined that the first network infor- mation matches the network information related to use of the target cloud service; otherwise, it is determined that the first network information does not match the network information related to use of the target cloud service. When the first network information is related information (for example, a destination IP address) of a public net- 5 10 15 20 25 30 35 40 45 50 55 9 13 EP 4 701 133 A1 14 work, whether the network information related to the target cloud service includes an identifierof the public network is determined. If the network information related to the target cloud service includes the identifier of the public network, it is determined that the first network information matches the network information related to the target cloud service; otherwise, it is determined that the first network information does not match the network information related to the target cloud service.

[0066] Comparison in terms of device information: The first device information in the target information is com- pared with the information about the device that initiates the access request to the target cloud service in the data boundary. If the information about the device that initiates the access request to the target cloud service includes the first device information, it is determined that the first device information matches the information about the device that initiates the access request to the target cloud service; otherwise, it is determined that the first deviceinformation does not match the information about the device that initiates the access request to the target cloud service.

[0067] Comparison in terms of trusted execution en- vironment information: The first trusted execution envir- onment information in the target information is compared with the trusted execution environment information re- lated to the target cloud service in the data boundary. If the trusted execution environment information related to the target cloud service includes the first trusted execu- tion environment information, it is determined that the first trusted execution environment information matches the trusted execution environment information related to the target cloud service; otherwise, it is determined that the first trusted execution environment information does not match the trusted execution environment information related to the target cloud service.

[0068] If the five types of information included in the target information match the five constraintconditions included in the data boundary, it is determined that the target information matches the constraint condition in the data boundary. If any one of the five types of information does not match a corresponding constraint condition in the data boundary, it is determined that the target infor- mation does not match the constraint condition in the data boundary.

[0069] The following describes step 205 by using ex- amples.

[0070] Example 1: As shown in FIG. 3, the target in- formation includes first identity subject information P3, first trusted execution environment information E1, first device information D1, first network information N2, and first access resource information R1. The data boundary for the target cloud service includes a data boundary 1 and a data boundary 2. The data boundary 1 includes P1, P2, E1, D1, N1, R1, and R2, and the data boundary 2 includes P3, P4, E1, D1, N2, R1, and R2. The target information is first compared with the constraint condi- tions in thedata boundary 1, and it is determined that P1 and N2 are not included in the data boundary 1. In this case, it is determined that the target information does not match the constraint conditions in the data boundary 1. Then the target information is compared with the con- straint conditions in the data boundary 2, and it is deter- mined that all of the five types of information in the target information are in the data boundary 1. In this case, it is determined that the target information matches the con- straint conditions in the data boundary 1. Further, it is determined that the target information matches the con- straint condition in the data boundary for the target cloud service.

[0071] Example 2: As shown in FIG. 4, the target in- formation includes first identity subject information P3, first network information N2, and first access resource information R1. The data boundary for the target cloud service includes a data boundary 3 and a data boundary 4. The data boundary 3includes P3, P4, P5, N2, and R3, and the data boundary 4 includes P1, P2, N1, and R1. The target information is first compared with the con- straint conditions in the data boundary 3, and it is deter- mined that R1 is not included in the data boundary 3. In this case, it is determined that the target information does not match the constraint conditions in the data boundary 3. Then the target information is compared with the constraint conditions in the data boundary 4, and it is determined that P3 and N2 are not included in the data boundary 4. In this case, it is determined that the target information does not match the constraint conditions in the data boundary 4. Further, it is determined that the target information does not match the constraint condi- tion in the data boundary for the target cloud service.

[0072] Step 206: The cloud platform sends an authen- tication result for the access request to the target cloud service.

[0073] During implementation, if determining that thetarget information matches the constraint condition in the data boundary for the target cloud service, the cloud platform sends an authentication success message to the target cloud service; or if determining that the target information does not match the constraint condition in the data boundary for the target cloud service, the cloud platform sends an authentication failure message to the target cloud service.

[0074] Step 207: The target cloud service processes the access request based on the authentication result.

[0075] During implementation, if receiving the authen- tication success message returned by the cloud platform, the target cloud service executes the access request; or if receiving the authentication failure message returned by the cloud platform, the target cloud service rejects the access request.

[0076] Step 208: The target cloud service sends an access result or an access reject message to a terminal of the tenant that sends the access request.

[0077] Duringimplementation, if executing the access request, the target cloud service sends the access result obtained through execution to the terminal of the tenant; 5 10 15 20 25 30 35 40 45 50 55 10 15 EP 4 701 133 A1 16 or if rejecting the access request, the target cloud service sends the access reject message to the terminal of the tenant.

[0078] In a possible implementation, for an established data boundary, the first tenant may add a constraint condition to or remove a constraint condition from the data boundary through the cloud platform, or may delete the data boundary, disable a data boundary function for the target cloud service, or enable a data boundary function for the target cloud service. The functions are separately described below.

[0079] Adding a constraint condition: If the first tenant needs to add a constraint condition to a first data bound- ary, the first tenant may send a constraint condition addition request to the cloud platform through the term- inal, where theconstraint condition addition request car- ries a to-be-added first constraint condition and an iden- tifier of the first data boundary. Correspondingly, after receiving the constraint condition addition request, the cloud platform adds the first constraint condition to the first data boundary. The identifier of the first data bound- ary may be generated by the terminal and carried in the data boundary establishment request when the terminal sends the data boundary establishment request to the cloud platform; or may be generated by the cloud platform when establishing the first data boundary, where the cloud platform returns the generated identifier of the first data boundary to the terminal. The following describes an example of adding a constraint condition.

[0080] As shown in FIG. 5, a data boundary 1 includes P1, P2, E1, D1, N1, R1, and R2. The first tenant needs to add, to the data boundary 1, identity subject information P5 for using the target cloud service, and therefore sendsa constraint condition addition request to the cloud plat- form through the terminal, where the constraint condition addition request carries P5 and an identifier of the data boundary 1. After receiving the constraint condition ad- dition request, the cloud platform adds the identity sub- ject information P5 for using the target cloud service to the data boundary 1.

[0081] Removing a constraint condition: If the first tenant needs to remove one or more constraint condi- tions from a second data boundary, the first tenant may send a constraint condition removal request to the cloud platform through the terminal, where the constraint con- dition removal request carries a to-be-removed second constraint condition and an identifier of the second data boundary. Correspondingly, after receiving the removal request, the cloud platform removes the second con- straint condition from the second data boundary. The following describes an example of removing a constraint condition.

[0082] As shownin FIG. 6, a data boundary 2 includes P3, P4, E1, D1, N2, R1, and R2. The first tenant is to remove the access resource information R1 related to the target cloud service from the data boundary 2, and there- fore sends a constraint condition removal request to the cloud platform through the terminal, where the constraint condition removal request carries R1 and an identifier of the data boundary 2. After receiving the constraint con- dition removal request, the cloud platform removes the access resource information R1 related to the target cloud service from the data boundary 2.

[0083] Deleting a data boundary: If the first tenant needs to delete a third data boundary, the first tenant may send a data boundary deletion request for the target cloud service to the cloud platform through the terminal, where the data boundary deletion request carries an identifier of the third data boundary. Correspondingly, after receiving the data boundary deletion request, the cloud platform deletes thethird data boundary for the target cloud service.

[0084] Disabling a data boundary function: If the first tenant needs to disable a data boundary function for the target cloud service, the first tenant may send a data boundary disabling request for the target cloud service to the cloud platform through the terminal. Correspondingly, after receiving the data boundary disabling request for the target cloud service, the cloud platform disables all data boundaries established by the first tenant for the target cloud service.

[0085] Enabling a data boundary function: If the first tenant is to enable a data boundary function for the target cloud service, the first tenant may send a data boundary enabling request for the target cloud service to the cloud platform through the terminal. Correspondingly, after receiving the data boundary enabling request for the target cloud service, the cloud platform enables all data boundaries established by the first tenant for the target cloud service.

[0086] In a possible implementation, the cloud platform may provide an application programming interface (Ap- plication Programming Interface, API) for establishing a data boundary, adding a constraint condition, removing a constraint condition, deleting a data boundary, disabling a data boundary function, or enabling a data boundary function.

[0087] Correspondingly, the terminal may send a data boundary establishment request to the cloud platform by invoking an API for establishing a data boundary, send a constraint condition addition request to the cloud platform by invoking an API for adding a constraint condition, send a constraint condition removal request to the cloud plat- form by invoking an API for removing a constraint con- dition, send a data boundary deletion request to the cloud platform by invoking an API for deleting a data boundary, send a data boundary disabling request to the cloud platform by invoking an API for disabling a data boundary, or send a data boundaryenabling request to the cloud platform by invoking an API for enabling a data boundary.

[0088] In a possible implementation, to improve effi- ciency of establishing a data boundary by a tenant, in this embodiment of the present disclosure, a constraint con- dition may be added to the data boundary at a granularity of an organization unit. The organization unit may corre- spond to a department, a subsidiary, a project team, or 5 10 15 20 25 30 35 40 45 50 55 11 17 EP 4 701 133 A1 18 the like in an enterprise. Correspondingly, processing of step 201 may be as follows:

[0089] When the first tenant establishes a data bound- ary, if the data boundary needs to include all IAM iden- tities in a first organization unit, an identifier of the first organization unit is carried in a field that is in the data boundary establishment request sent by the terminal and that is used to carry the information about the identity subject that uses the target cloud service; or if the data boundary needs toexclude an identity in an organization, indication information of an identity outside the organiza- tion is carried in a field that is in the data boundary establishment request and that is used to carry the in- formation about the identity subject that uses the target cloud service. If the data boundary needs to include all resources of the target cloud service in the first organiza- tion unit, the identifier of the first organization unit is carried in a field that is in the data boundary establish- ment request sent by the terminal and that is used to carry the access resource information related to the target cloud service. If the data boundary is expected to include all networks in the first organization unit, the identifier of the first organization unit is carried in a field that is in the data boundary establishment request sent by the term- inal and that is used to carry the network information related to use of the target cloud service; or if the data boundary is expected toinclude a network outside an organization, indication information of the network out- side the organization is carried in a field that is in the data boundary establishment request and that is used to carry the network information related to use of the target cloud service. The following describes the foregoing proces- sing by using examples.

[0090] Example 1: The first tenant needs to establish a data boundary for a purchased object storage service to implement the following constraint: Only all IAM identities in an organization unit 1 can access a resource of an object storage service in the organization unit 1 through a network in the organization unit 1. Correspondingly, in the data boundary establishment request sent by the term- inal, the field used to carry the information about the identity subject that uses the target cloud service carries an identifier of the organization unit 1, the field used to carry the access resource information related to the target cloud servicecarries the identifier of the organiza- tion unit 1, and the field used to carry the network in- formation related to use of the target cloud service carries the identifier of the organization unit 1.

[0091] Example 2: The first tenant needs to establish a data boundary for a purchased object storage service to implement the following constraint: Only an identity out- side an organization can access a resource of an object storage service in an organization unit 2 through a net- work outside the organization. Correspondingly, in the data boundary establishment request sent by the term- inal, the field used to carry the information about the identity subject that uses the target cloud service carries indication information of the identity outside the organi- zation, the field used to carry the access resource in- formation related to the target cloud service carries an identifier of the organization unit 2, and the field used to carry the network information related to use of the targetcloud service carries indication information of the net- work outside the organization.

[0092] In this possible implementation, processing of step 202 may be as follows: After receiving the data boundary establishment request sent by the terminal, if determining that the field, in the data boundary establishment request, used to carry the information about the identity subject that uses the target cloud service carries the identifier of the first organization unit, the cloud platform adds all of the IAM identities in the first organization unit to the data boundary as the infor- mation about the identity subject that uses the target cloud service; or if determining that the field used to carry the information about the identity subject that uses the target cloud service carries the indication information of the identity outside the organization, the cloud platform adds the indication information of the identity outside the organization to the data boundary as the information about theidentity subject that uses the target cloud service. If determining that the field, in the data boundary establishment request, used to carry the access resource information related to the target cloud service carries the identifier of the first organization unit, the cloud platform adds information about all of the resources of the target cloud service in the first organization unit to the data boundary as the access resource information related to the target cloud service. If determining that the field, in the data boundary establishment request, used to carry the network information related to use of the target cloud service carries the identifier of the first organization unit, the cloud platform adds information about all of the networks in the first organization unit to the data bound- ary as the network information related to use of the target cloud service; or if determining that the field used to carry the network information related to use of the target cloud service carriesthe indication information of the network outside the organization, the cloud platform adds the indication information of the network outside the organi- zation to the data boundary as the network information related to use of the target cloud service. Then the cloud platform records a correspondence between the data boundary and the organization corresponding to the first tenant. The following describes an example of establish- ing a data boundary.

[0093] With reference to the foregoing example 1, in the data boundary establishment request, the field used to carry the information about the identity subject that uses the target cloud service carries the identifier of the organization unit 1, the field used to carry the access resource information related to the target cloud service carries the identifier of the organization unit 1, and the field used to carry the network information related to use of the target cloud service carries the identifier of the organization unit 1.Correspondingly, the cloud platform 5 10 15 20 25 30 35 40 45 50 55 12 19 EP 4 701 133 A1 20 establishes a data boundary, where the data boundary includes all of the IAM identities in the organization unit 1, identifiers of all VPCs in the organization unit 1, and identifiers of all storage buckets in the organization unit 1.

[0094] With reference to the foregoing example 2, in the data boundary establishment request, the field used to carry the information about the identity subject that uses the target cloud service carries the indication in- formation of the identity outside the organization, the field used to carry the access resource information related to the target cloud service carries the identifier of the orga- nization unit 2, and the field used to carry the network information related to use of the target cloud service carries the indication information of the network outside the organization. Correspondingly, the cloud platform establishes a data boundary, where the databoundary includes the indication information of the identity outside the organization, the indication information of the network outside the organization, and identifiers of all storage buckets in the organization unit 2.

[0095] In this possible implementation, processing of step 205 may be as follows: An example in which the target information includes the first identity subject information, the first access resource information, and the first network information is used for description. A first organization to which the first identity subject information belongs, a second organization to which the first access resource information belongs, and a third organization to which the first network information belongs are determined, where the first organization, the second organization, and the third organization may be a same organization or different organizations. A data boundary established by the first organization for the target cloud service, a data boundary established by the secondorganization for the target cloud service, and a data boundary established by the third organization for the target cloud service are obtained. The target information is sequentially compared with each data boundary. The following separately describes compar- ison between different types of information in the target information and different constraint conditions in the data boundary.

[0096] Comparison in terms of identity subject informa- tion: The first identity subject information in the target information is compared with information about an iden- tity subject that uses the target cloud service in the data boundary. When the information about the identity sub- ject that uses the target cloud service in the data bound- ary is indication information of an identity outside an organization, whether the first identity subject information belongs to an organization corresponding to the data boundary is determined. If the first identity subject infor- mation belongs to the organizationcorresponding to the data boundary, it is determined that the first identity subject information does not match the information about the identity subject that uses the target cloud service; otherwise, it is determined that the first identity subject information matches the information about the identity subject that uses the target cloud service. When the information about the identity subject that uses the target cloud service in the data boundary is not indication in- formation of an identity outside an organization, whether the information about the identity subject that uses the target cloud service in the data boundary includes the first identity subject information is determined. If the informa- tion about the identity subject that uses the target cloud service includes the first identity subject information, it is determined that the first identity subject information matches the information about the identity subject that uses the target cloud service; otherwise, it isdetermined that the first identity subject information does not match the information about the identity subject that uses the target cloud service.

[0097] Comparison in terms of network information: The first network information in the target information is compared with network information related to use of the target cloud service in the data boundary. When the network information related to use of the target cloud service in the data boundary is indication information of a network outside an organization, whether the first net- work information belongs to the organization corre- sponding to the data boundary is determined. If the first network information belongs to the organization corre- sponding to the data boundary, it is determined that the first network information does not match the network information related to use of the target cloud service; otherwise, it is determined that the first network informa- tion matches the network information related to use of the target cloudservice. When the network information re- lated to use of the target cloud service in the data bound- ary is not indication information of a network outside an organization, whether the network information related to use of the target cloud service includes the first network information is determined. If the network information related to use of the target cloud service includes the first network information, it is determined that the first network information matches the network information related to use of the target cloud service; otherwise, it is determined that the first network information does not match the network information related to use of the target cloud service.

[0098] Comparison in terms of access resource infor- mation: The first access resource information in the target information is compared with access resource informa- tion related to the target cloud service in the data bound- ary. If the access resource information related to the target cloud service includesthe first access resource information, it is determined that the first access resource information matches the access resource information related to the target cloud service; otherwise, it is deter- mined that the first access resource information does not match the access resource information related to the target cloud service.

[0099] The following describes the foregoing proces- sing by using an example.

[0100] The target information includes first identity 5 10 15 20 25 30 35 40 45 50 55 13 21 EP 4 701 133 A1 22 subject information P3, first network information I, and first access resource information R1. The cloud platform determines that the first identity subject information P3 belongs to an organization 1, the first network information I is related information of a public network and does not belong to any organization, and the first access resource information R1 belongs to the organization 1; and then obtains a data boundary established by the organization 1 for the targetcloud service are obtained, where the data boundary includes a data boundary 5 and a data bound- ary 6. The data boundary 5 includes all IAM identities (for example, P1, P2, P3...) in an organization unit 1, infor- mation about all networks (for example, an identifier N1 of a VPC 1, an identifier N2 of a VPC 2, an identifier N3 of a VPC 3...) in the organization unit 1, and identifiers (for example, R1, R2, R3...) of all storage buckets of an object storage service in the organization unit 1, where the organization unit 1 belongs to the organization 1. The data boundary 6 includes indication information of an identity outside an organization, indication information of a network outside an organization, and identifiers (for example, R10, R20, R30...) of all storage buckets of an object storage service in an organization unit 2, where the organization unit 2 belongs to the organization 1.

[0101] The target information is compared with con- straint conditions in the data boundary 5.Comparison in terms of identity information: It is determined that infor- mation about an identity subject that uses the target cloud service in the data boundary 5 is not indication informa- tion of an identity outside an organization, and the first identity subject information P3 is included in the informa- tion about the identity subject (all of the IAM identities in the organization unit 1) that uses the target cloud service in the data boundary 5. Further, it is determined that the first identity subject information matches the information about the identity subject that uses the target cloud service. Comparison in terms of network information: It is determined that network information related to use of the target cloud service in the data boundary 5 is not indication information of a network outside an organiza- tion, and the first network information is not included in the network information (information about all of the net- works in the organization unit 1) related to use ofthe target cloud service in the data boundary 5. Further, it is determined that the first network information does not match the network information related to use of the target cloud service. Comparison in terms of access resource information: It is determined that the first access resource information R1 is included in access resource information (the identifiers of all of the storage buckets of the object storage service in the organization unit 1) related to the target cloud service in the data boundary 5. Further, it is determined that the first access resource information R1 matches the access resource information related to the target cloud service. Because the first network informa- tion does not match the network information related to use of the target cloud service, it is determined that the target information does not match the constraint condi- tions in the data boundary5.

[0102] The target information is compared with con- straint conditions in the data boundary 6.Comparison in terms of identity information: It is determined that infor- mation about an identity subject that uses the target cloud service in the data boundary 6 is indication information of an identity outside an organization, and then it is deter- mined that the first identity subject information P3 be- longs to the organization 1. Because the data boundary 6 also belongs to the organization 1, it is determined that the first identity subject information P3 does not match the information about the identity subject that uses the target cloud service. Comparison in terms of network information: It is determined that network information related to use of the target cloud service in the data boundary 6 is indication information of a network outside an organization, and it is determined that the first network information does not belong to the organization 1. In this case, it is determined that the first network information matches the network information related to use of the targetcloud service. Comparison in terms of access resource information: It is determined that the first access resource information R1 is not included in access re- source information (the identifiers of all of the storage buckets of the object storage service in the organization unit 2) related to the target cloud service in the data boundary 6. Further, it is determined that the first access resource information R1 matches the access resource information related to the target cloud service. Because the first identity subject information does not match the information about the identity subject that uses the target cloud service, it is determined that the target information does not match the constraint conditions in the data boundary 6.

[0103] An embodiments of the present disclosure further provides a cloud computing technology based access management method. In the method, a cloud platform includes a management plane and an authenti- cation data plane. In the steps shown in FIG. 2, theprocessing of the cloud platform is implemented by the management plane and the authentication data plane. Correspondingly, as shown in FIG. 7, a processing pro- cess of the method may include the following steps.

[0104] Step 701: A first tenant sends a data boundary establishment request for a target cloud service to the management plane of the cloud platform through a term- inal.

[0105] A difference between step 701 and step 201 lies only in that a receiver of the data boundary establishment request changes from the cloud platform to the manage- ment plane of the cloud platform. Specific processing is not described herein again.

[0106] Step 702: The management plane establishes a data boundary for the target cloud service based on the data boundary establishment request.

[0107] A difference between step 702 and step 202 lies only in that an entity that establishes the data boundary changes from the cloud platform to the management 5 10 15 20 25 30 35 40 45 50 55 14 23 EP 4 701 133 A124 plane of the cloud platform. Specific processing is not described herein again.

[0108] Step 703: The target cloud service receives an access request for the target cloud service.

[0109] Specific processing of step 703 is the same as the specific processing of step 203, and details are not described herein again.

[0110] Step 704: The target cloud service sends target information carried in the access request to the authen- tication data plane of the cloud platform.

[0111] A difference between step 704 and step 204 lies only in that a receiver of the target information carried in the access request changes from the cloud platform to the authentication data plane of the cloud platform. Spe- cific processing is not described herein again.

[0112] Step 705: The authentication data plane sends a data boundary obtaining request to the management plane.

[0113] During implementation, after receiving the tar- get information sent by the target cloud service, the authentication data plane sendsthe data boundary ob- taining request to the management plane. An identifier of the target cloud service is carried in the data boundary obtaining request.

[0114] In a possible implementation, when a constraint condition in the data boundary is added at a granularity of an organization unit, after receiving the target information sent by the target cloud service, the authentication data plane may first obtain a first organization to which first identity subject information carried in the target informa- tion belongs, a second organization to which first network information carried in the target information belongs, and a third organization to which first access resource infor- mation carried in the target information belongs, and send the data boundary obtaining request to the manage- ment plane. The data boundary obtaining request carries the identifier of the target cloud service, an organization identifier of the first organization, an organization identi- fier of the secondorganization, and an organization identifier of the third organization.

[0115] Step 706: The management plane obtains the data boundary for the target cloud service, and sends the data boundary for the target cloud service to the authen- tication data plane.

[0116] During implementation, after receiving the data boundary obtaining request, the management plane ob- tains a data boundary established by each tenant for the target cloud service, and sends the obtained data bound- ary to the authentication data plane.

[0117] In a possible implementation, when the con- straint condition in the data boundary is added at a granularity of an organization unit, the management plane obtains a data boundary established by the first organization for the target cloud service, a data boundary established by the second organization for the target cloud service, and a data boundary established by the third organization for the target cloud service, and sends the obtained data boundaries to theauthentication data plane.

[0118] Step 707: The authentication data plane com- pares the target information with the constraint condition in the data boundary for the target cloud service, and determines whether the target information matches the constraint condition in the data boundary for the target cloud service.

[0119] Specific processing of step 707 is the same as the comparison processing of the cloud platform in step 205, and details are not described herein again.

[0120] Step 708: The authentication data plane sends an authentication result for the access request to the target cloud service.

[0121] A difference between step 708 and step 206 lies only in that a sender of the authentication result changes from the cloud platform to the authentication data plane of the cloud platform. Specific processing is not described herein again.

[0122] Step 709: The target cloud service processes the access request based on the authentication result.

[0123] Specific processing of step 709is the same as the specific processing of step 207, and details are not described herein again.

[0124] Step 710: The target cloud service sends an access result or an access reject message to a terminal of a tenant that sends the access request.

[0125] Specific processing of step 710 is the same as the specific processing of step 208, and details are not described herein again.

[0126] An embodiment of the present disclosure further provides a cloud computing technology based access management apparatus. The apparatus is used in a cloud platform. The cloud platform is configured to manage infrastructure that provides a cloud service. The infrastructure includes at least one cloud data center. Each of the at least one cloud data center includes a plurality of servers. The cloud service is deployed on one or more servers in the at least one cloud data center. As shown in FIG. 8, the apparatus includes a management module 810 and an authentication module 820.

[0127] The management module810 is configured to: receive a data boundary establishment request that is input by a first tenant for the cloud service, where the data boundary establishment request is used to indicate the cloud platform to establish a data boundary for the cloud service, and the data boundary includes at least one of the following constraint conditions: information about an identity subject that uses the cloud service, access re- source information related to the cloud service, network information related to use of the cloud service, informa- tion about a device that initiates an access request to the cloud service, and trusted execution environment infor- mation related to the cloud service; and establish a data boundary for the cloud service based on the data bound- ary establishment request.

[0128] The authentication module 820 is configured to: when the cloud service receives a first access request generated by a second tenant or the first tenant for the 5 10 15 20 25 30 35 40 45 50 55 15 25EP 4 701 133 A1 26 cloud service, compare information carried in the first access request with the constraint condition in the data boundary, and when the information carried in the first access request matches the constraint condition in the data boundary, allow the cloud service to respond to the first access request, or when the information carried in the first access request does not match the constraint condition in the data boundary, skip allowing the cloud service to respond to the first access request, where the information carried in the first access request includes one or any combination of the following: first identity subject information, first access resource information, first network information, first device information for in- itiating the first access request, and first trusted execution environment information.

[0129] In a possible implementation, the first tenant and the second tenant are registered with the cloud platform, a role of the first tenant is anadministrator of the data boundary, and a role of the second tenant is a visitor of the data boundary.

[0130] In a possible implementation, the management module 810 is further configured to: receive a constraint condition addition request that is input by the first tenant for the data boundary; and add, to the data boundary, a first constraint condition indicated by the constraint condition addition re- quest, where the first constraint condition is one or more of the following: second identity subject infor- mation, second access resource information, sec- ond network information, second device information for initiating an access request, and second trusted execution environment information.

[0131] In a possible implementation, the management module 810 is further configured to: receive a constraint condition removal request that is input by the first tenant for the data boundary; and remove, from the data boundary of the server, a second constraint condition indicated by the con-straint condition removal request, where the first constraint condition is one or more of the following: third identity subject information, third access re- source information, third network information, third device information for initiating an access request, and third trusted execution environment information.

[0132] In a possible implementation, the management module 810 is further configured to: receive a data boundary deletion request that is input by the first tenant for the cloud service; and delete the data boundary indicated by the data boundary deletion request.

[0133] In a possible implementation, the management module 810 is further configured to: receive a data boundary function disabling request that is input by the first tenant for the cloud service; and disable a data boundary function for the cloud ser- vice.

[0134] In a possible implementation, the management module 810 is further configured to: receive a data boundary function enabling request that is input by thefirst tenant for the cloud service; and enable a data boundary function for the cloud ser- vice.

[0135] Both the management module 810 and the authentication module 820 may be implemented by using software or hardware. For example, the following de- scribes an implementation of the management module 810. Similarly, for an implementation of the authentica- tion module 820, refer to the implementation of the man- agement module 810.

[0136] For example, the module is a software func- tional unit, and the management module 810 may include code that is run on a computing instance. The computing instance may be at least one of the following computing devices: a physical host (computing device), a virtual machine, a container, and the like. Further, there may be one or more computing devices. For example, the management module 810 may include code that is run on a plurality of hosts, virtual machines, or containers. It should be noted that the plurality of hosts, virtual ma- chines, orcontainers for running the code may be dis- tributed in a same region or different regions. The plurality of hosts, virtual machines, or containers for running the code may be distributed in a same AZ or different AZs. Each AZ includes one data center or a plurality of data centers that are geographically close to each other. Usually, one region may include a plurality of AZs.

[0137] Similarly, the plurality of hosts, virtual machines, or containers for running the code may be distributed in a same VPC or a plurality of VPCs. Usually, one VPC is deployed in one region. A communication gateway needs to be deployed in each VPC for communication between two VPCs in a same region or between VPCs in different regions. The VPCs are interconnected through the com- munication gateway.

[0138] For example, the module is a hardware func- tional unit, and the management module 810 may include at least one computing device, for example, a server. Alternatively, the management module 810 may be adevice implemented by using an ASIC or a PLD, or the like. The PLD may be implemented by using a CPLD, an FPGA, a GAL, or any combination thereof.

[0139] A plurality of computing devices included in the management module 810 may be distributed in a same region or different regions. The plurality of computing devices included in the management module 810 may 5 10 15 20 25 30 35 40 45 50 55 16 27 EP 4 701 133 A1 28 be distributed in a same AZ or different AZs. Similarly, the plurality of computing devices included in the manage- ment module 410 may be distributed in a same VPC or a plurality of VPCs. The plurality of computing devices may be any combination of the following computing devices: a server, an ASIC, a PLD, a CPLD, an FPGA, a GAL, and the like.

[0140] The present disclosure further provides a com- puting device 100. As shown in FIG. 9, the computing device 100 includes a bus 102, a processor 104, a memory 106, and a communication interface 108. The processor 104, the memory106, and the communication interface 108 communicate with each other through the bus 102. The computing device 100 may be a server or a terminal device. It should be understood that quantities of processors and memories in the computing device 100 are not limited in the present disclosure.

[0141] The bus 102 may be a peripheral component interconnect (peripheral component interconnect, PCI) bus, an extended industry standard architecture (ex- tended industry standard architecture, EISA) bus, or the like. The bus may be classified into an address bus, a data bus, a control bus, and the like. For ease of representation, only one line is used to represent the bus in FIG. 9, but this does not mean that there is only one bus or only one type of bus. The bus 102 may include a path for transmitting information between the compo- nents (for example, the memory 106, the processor 104, and the communication interface 108) of the com- puting device 100.

[0142] The processor 104 may include anyone ormore of the following processors: a central processing unit (central processing unit, CPU), a graphics processing unit (graphics processing unit, GPU), a microprocessor (microprocessor, MP), a digital signal processor (digital signal processor, DSP), or the like.

[0143] The memory 106 may include a volatile memory (volatile memory), for example, a random access mem- ory (random access memory, RAM). The memory 106 may alternatively include a non-volatile memory (non- volatile memory), for example, a read-only memory (read-only memory, ROM), a flash memory, a hard disk drive (hard disk drive, HDD), or a solid-state drive (solid- state drive, SSD).

[0144] The memory 106 stores executable code, and the processor 104 executes the executable code to se- parately implement the functions of the management module 810 and the authentication module 820, to im- plement the data access method. That is, the memory 106 stores instructions for performing the cloud comput- ing technology-basedaccess management method.

[0145] The communication interface 108 implements communication between the computing device 100 and another device or a communication network through a transceiver module, for example, but not limited to, a network interface card or a transceiver.

[0146] An embodiment of the present disclosure further provides a computing device cluster. The comput- ing device cluster includes at least one computing device. The computing device may be a server, for example, a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device may alternatively be a terminal device, for example, a desktop computer, a notebook computer, or a smart- phone.

[0147] As shown in FIG. 10, the computing device cluster includes at least one computing device 100. A memory 106 in one or more computing devices 100 in the computing device cluster may store same instructions for performing the cloud computing technology based ac- cessmanagement method.

[0148] In some possible implementations, a memory 106 in one or more computing devices 100 in the com- puting device cluster may alternatively respectively store some of instructions for performing the cloud computing technology-based access management method. In other words, a combination of one or more computing devices 100 may jointly execute instructions for performing the cloud computing technology-basedaccessmanagement method.

[0149] It should be noted that memories 106 in different computing devices 100 in the computing device cluster may store different instructions that are respectively used to perform some of functions of the cloud computing technology-based access management method.

[0150] In some possible implementations, a memory 106 in one or more computing devices 100 in the com- puting device cluster may alternatively respectively store some of instructions for performing the automated testing method. In other words, a combination of one or morecomputing devices 100 may jointly execute instructions for performing the cloud computing technology-based access management method.

[0151] It should be noted that memories 106 in different computing devices 100 in the computing device cluster may store different instructions for performing some of functions of the automated testing system. In other words, instructions stored in memories 106 in different computing devices 100 may implement functions of one or more nodes in the management module 810 and the authentication module 820.

[0152] In some possible implementations, one or more computing devices in the computing device cluster may be connected through a network. The network may be a wide area network, a local area network, or the like. FIG. 11 shows a possible implementation. As shown in FIG. 11, twocomputing devices 100A and 100B areconnected through a network. Specifically, each computing device is connected to the network through a communication inter- face of the computingdevice. In this possible implemen- tation, a memory 106 in the computing device 100A stores instructions for performing the functions of the management module 810. In addition, a memory 106 in the computing device 100B stores instructions for performing the functions of the authentication module 820. It should be understood that functions of the com- 5 10 15 20 25 30 35 40 45 50 55 17 29 EP 4 701 133 A1 30 puting device 100A shown in FIG. 11 may alternatively be performed by a plurality of computing devices 100. Si- milarly, functions of the computing device 100B may alternatively be performed by a plurality of computing devices 100.

[0153] An embodiment of the present disclosure further provides another computing device cluster. For a connection relationship between computing devices in the computing device cluster, refer to the connection manner in the computing device cluster in FIG. 10 and FIG. 11. A difference lies in that a memory 106 in one or more computing devices 100 in thecomputing device cluster may store same instructions for performing the cloud computing technology based access management method.

[0154] In some possible implementations, a memory 106 in one or more computing devices 100 in the com- puting device cluster may alternatively respectively store some of instructions for performing the automated testing method. In other words, a combination of one or more computing devices 100 may jointly execute instructions for performing the cloud computing technology-based access management method.

[0155] It should be noted that memories 106 in different computing devices 100 in the computing device cluster may store different instructions that are used to perform some of functions of the cloud computing technology- based access management apparatus. In other words, instructions stored in memories 106 in different comput- ing devices 100 may implement functions of one or more nodes in the management module 810 and the authenti- cation module 820.

[0156] An embodiment of the present disclosure further provides a computer program product including instructions. The computer program product may be soft- ware or a program product that includes instructions and that can be run on a computing device or stored in any usable medium. When the computer program product is run on at least one computing device, the at least one computing device is enabled to perform the cloud com- puting technology-based access management method.

[0157] An embodiment of the present disclosure further provides a computer-readable storage medium. The computer-readable storage medium may be any usable medium that can be stored on a computing device, or a data storage device, for example, a data center, including one or more usable media. The usable medium may be a magnetic medium (for example, a floppy disk, a hard disk drive, or a magnetic tape), an optical medium (for example, a DVD), a semiconductor medium (for example, a solid-state drive), or the like. Thecompu- ter-readable storage medium includes instructions, and the instructions instruct a computing device to perform the cloud computing technology-based access manage- ment method.

[0158] Finally, it should be noted that the foregoing embodiments are merely intended to describe the tech- nical solutions of the present disclosure, but not to limit the present disclosure. Although the present disclosure is described in detail with reference to the foregoing embo- diments, persons of ordinary skill in the art should under- stand that they may still make modifications to the tech- nical solutions described in the foregoing embodiments or make equivalent replacements to some technical fea- tures thereof, without departing from the protection scope of the technical solutions of embodiments of the present disclosure. Claims 1. A cloud computing technology based access man- agement method, wherein the method is applied to a cloud platform, the cloud platform is configured to manageinfrastructure that provides a cloud service, the infrastructure comprises at least one cloud data center, each of the at least one cloud data center comprises a plurality of servers, the cloud service is deployed on one or more servers in the at least one cloud data center, and the method comprises: receiving, by the cloud platform, a data bound- ary establishment request that is input by a first tenant for the cloud service, wherein the data boundary establishment request is used to in- dicate the cloud platform to establish a data boundary for the cloud service, and the data boundary comprises at least one of the following constraint conditions: information about an iden- tity subject that uses the cloud service, access resource information related to the cloud ser- vice, network information related to use of the cloud service, information about a device that initiates an access request to the cloud service, and trusted execution environment information related to the cloud service;establishing, by the cloud platform, a data boundary for the cloud service based on the data boundary establishment request; and when the cloud service receives a first access request generated by a second tenant or the first tenant for the cloud service, comparing, by the cloud platform, information carried in the first access request with the constraint condition in the data boundary, and when the information carried in the first access request matches the constraint condition in the data boundary, allow- ing the cloud service to respond to the first access request, or when the information carried in the first access request does not match the constraint condition in the data boundary, skip- ping allowing the cloud service to respond to the first access request, wherein the information carried in the first access request comprises one or more of the following: first identity subject information, first access resource information, 5 10 15 20 25 30 35 40 45 50 55 18 31 EP 4 701 133 A132 first network information, first device information for initiating the first access request, and first trusted execution environment information. 2. The method according to claim 1, wherein the first tenant and the second tenant are registered with the cloud platform, a role of the first tenant is an admin- istrator of the data boundary, and a role of the second tenant is a visitor of the data boundary. 3. The method according to claim 1 or 2, wherein the method further comprises: receiving, by the cloud platform, a constraint condition addition request that is input by the first tenant for the data boundary; and adding, by the cloud platform to the data bound- ary, a first constraint condition indicated by the constraint condition addition request, wherein the first constraint condition is one or more of the following: second identity subject information, second access resource information, second network information, second device information for initiating an access request, andsecond trusted execution environment information. 4. The method according to any one of claims 1 to 3, wherein the method further comprises: receiving, by the cloud platform, a constraint condition removal request that is input by the first tenant for the data boundary; and removing, by the cloud platform from the data boundary, a second constraint condition indi- cated by the constraint condition removal re- quest, wherein the second constraint condition is one or more of the following: third identity subject information, third access resource infor- mation, third network information, third device information for initiating an access request, and third trusted execution environment information. 5. The method according to any one of claims 1 to 4, wherein the method further comprises: receiving, by the cloud platform, a data bound- ary deletion request that is input by the first tenant for the cloud service; and deleting, by the cloud platform, the data bound- ary indicated by the databoundary deletion re- quest. 6. The method according to any one of claims 1 to 5, wherein the method further comprises: receiving, by the cloud platform, a data bound- ary function disabling request that is input by the first tenant for the cloud service; and disabling, by the cloud platform, a data boundary function for the cloud service. 7. The method according to claim 6, wherein the meth- od further comprises: receiving, by the cloud platform, a data bound- ary function enabling request that is input by the first tenant for the cloud service; and enabling, by the cloud platform, a data boundary function for the cloud service. 8. A cloud computing technology-based access man- agement apparatus, wherein the apparatus is used in a cloud platform, the cloud platform is configured to manage infrastructure that provides a cloud service, the infrastructure comprises at least one cloud data center, each of the at least one cloud data center comprises a plurality of servers, the cloudservice is deployed on one or more servers in the at least one cloud data center, and the apparatus comprises: a management module, configured to: receive a data boundary establishment request that is input by a first tenant for the cloud service, wherein the data boundary establishment re- quest is used to indicate the cloud platform to establish a data boundary for the cloud service, and the data boundary comprises at least one of the following constraint conditions: information about an identity subject that uses the cloud service, access resource information related to the cloud service, network information related to use of the cloud service, information about a device that initiates an access request to the cloud service, and trusted execution environ- ment information related to the cloud service; and establish a data boundary for the cloud service based on the data boundary establish- ment request; and an authentication module, configured to: when the cloud service receives afirst access request generated by a second tenant or the first tenant for the cloud service, compare information car- ried in the first access request with the constraint condition in the data boundary, and when the information carried in the first access request matches the constraint condition in the data boundary, allow the cloud service to respond to the first access request, or when the informa- tion carried in the first access request does not match the constraint condition in the data boundary, skip allowing the cloud service to respond to the first access request, wherein the information carried in the first access request comprises one or any combination of the follow- ing: first identity subject information, first access resource information, first network information, 5 10 15 20 25 30 35 40 45 50 55 19 33 EP 4 701 133 A1 34 first device information for initiating the first ac- cess request, and first trusted execution envir- onment information. 9. The apparatus according toclaim 8, wherein the first tenant and the second tenant are registered with the cloud platform, a role of the first tenant is an admin- istrator of the data boundary, and a role of the second tenant is a visitor of the data boundary. 10. The apparatus according to claim 8 or 9, wherein the management module is further configured to: receive a constraint condition addition request that is input by the first tenant for the data boundary; and add, to the data boundary, a first constraint condition indicated by the constraint condition addition request, wherein the first constraint condition is one or more of the following: second identity subject information, second access re- source information, second network informa- tion, second device information for initiating an access request, and second trusted execution environment information. 11. The apparatus according to any one of claims 8 to 10, wherein the management module is further config- ured to: receive a constraint conditionremoval request that is input by the first tenant for the data boundary; and remove, from the data boundary of the cloud service, a second constraint condition indicated by the constraint condition removal request, wherein the second constraint condition is one or more of the following: third identity subject information, third access resource information, third network information, third device informa- tion for initiating an access request, and third trusted execution environment information. 12. The apparatus according to any one of claims 8 to 11, wherein the management module is further config- ured to: receive a data boundary deletion request that is input by the first tenant for the cloud service; and delete the data boundary indicated by the data boundary deletion request. 13. The apparatus according to any one of claims 8 to 12, wherein the management module is further config- ured to: receive a data boundary function disabling re- quest that is input by the first tenant forthe cloud service; and disable a data boundary function for the cloud service. 14. The apparatus according to claim 13, wherein the management module is further configured to: receive a data boundary function enabling re- quest that is input by the first tenant for the cloud service; and enable a data boundary function for the cloud service. 15. A computer device cluster, wherein the computer device cluster comprises at least one computing device, and each computing device comprises a processor and a memory, wherein a processor of the at least one computing device is configured to execute instructions stored in a mem- ory of the device, to enable the computing device cluster to perform the cloud computing technology based access management method according to any one of claims 1 to 7. 16. A computer program product comprising instruc- tions, wherein when the instructions are run by a computing device, the computing device is enabled to perform the cloud computing technology-basedaccess management method according to any one of claims 1 to 7. 17. A computer-readable storage medium, comprising computer program instructions, wherein when the computer program instructions are executed by a computing device, the computing device performs the cloud computing technology based access man- agement method according to any one of claims 1 to 7. 5 10 15 20 25 30 35 40 45 50 55 20 EP 4 701 133 A1 21 EP 4 701 133 A1 22 EP 4 701 133 A1 23 EP 4 701 133 A1 24 EP 4 701 133 A1 25 EP 4 701 133 A1 26 EP 4 701 133 A1 27 EP 4 701 133 A1 28 EP 4 701 133 A1 29 EP 4 701 133 A1 30 EP 4 701 133 A1 5 10 15 20 25 30 35 40 45 50 55 31 EP 4 701 133 A1 5 10 15 20 25 30 35 40 45 50 55 32 EP 4 701 133 A1 REFERENCES CITED IN THE DESCRIPTION This list of references cited by the applicant is for the reader’s convenience only. It does not form part of the European patent document. Even though great care has been taken in compiling the references, errors or omissions cannot be excluded and the EPOdisclaims all liability in this regard. Patent documents cited in the description • CN 202310564727

[0001] • CN 202311247399

[0001]

Claims

1. A cloud computing technology based access management method, wherein the method is applied to a cloud platform, the cloud platform is configured to manage infrastructure that provides a cloud service, the infrastructure comprises at least one cloud data center, each of the at least one cloud data center comprises a plurality of servers, the cloud service is deployed on one or more servers in the at least one cloud data center, and the method comprises: receiving, by the cloud platform, a data boundary establishment request that is input by a first tenant for the cloud service, wherein the data boundary establishment request is used to indicate the cloud platform to establish a data boundary for the cloud service, and the data boundary comprises at least one of the following constraint conditions: information about an identity subject that uses the cloud service, access resource information related to the cloud service, network information related to use of the cloud service, information about a device that initiates an access request to the cloud service, and trusted execution environment information related to the cloud service; establishing, by the cloud platform, a data boundary for the cloud service based on the data boundary establishment request; and when the cloud service receives a first access request generated by a second tenant or the first tenant for the cloud service, comparing, by the cloud platform, information carried in the first access request with the constraint condition in the data boundary, and when the information carried in the first access request matches the constraint condition in the data boundary, allowing the cloud service to respond to the first access request, or when the information carried in the first access request does not match the constraint condition in the data boundary, skipping allowing the cloud service to respond to the first access request, wherein the information carried in the first access request comprises one or more of the following: first identity subject information, first access resource information, first network information, first device information for initiating the first access request, and first trusted execution environment information.

2. The method according to claim 1, wherein the first tenant and the second tenant are registered with the cloud platform, a role of the first tenant is an administrator of the data boundary, and a role of the second tenant is a visitor of the data boundary.

3. The method according to claim 1 or 2, wherein the method further comprises: receiving, by the cloud platform, a constraint condition addition request that is input by the first tenant for the data boundary; and adding, by the cloud platform to the data boundary, a first constraint condition indicated by the constraint condition addition request, wherein the first constraint condition is one or more of the following: second identity subject information, second access resource information, second network information, second device information for initiating an access request, and second trusted execution environment information.

4. The method according to any one of claims 1 to 3, wherein the method further comprises: receiving, by the cloud platform, a constraint condition removal request that is input by the first tenant for the data boundary; and removing, by the cloud platform from the data boundary, a second constraint condition indicated by the constraint condition removal request, wherein the second constraint condition is one or more of the following: third identity subject information, third access resource information, third network information, third device information for initiating an access request, and third trusted execution environment information.

5. The method according to any one of claims 1 to 4, wherein the method further comprises: receiving, by the cloud platform, a data boundary deletion request that is input by the first tenant for the cloud service; and deleting, by the cloud platform, the data boundary indicated by the data boundary deletion request.

6. The method according to any one of claims 1 to 5, wherein the method further comprises: receiving, by the cloud platform, a data boundary function disabling request that is input by the first tenant for the cloud service; and disabling, by the cloud platform, a data boundary function for the cloud service.

7. The method according to claim 6, wherein the method further comprises: receiving, by the cloud platform, a data boundary function enabling request that is input by the first tenant for the cloud service; and enabling, by the cloud platform, a data boundary function for the cloud service.

8. A cloud computing technology-based access management apparatus, wherein the apparatus is used in a cloud platform, the cloud platform is configured to manage infrastructure that provides a cloud service, the infrastructure comprises at least one cloud data center, each of the at least one cloud data center comprises a plurality of servers, the cloud service is deployed on one or more servers in the at least one cloud data center, and the apparatus comprises: a management module, configured to: receive a data boundary establishment request that is input by a first tenant for the cloud service, wherein the data boundary establishment request is used to indicate the cloud platform to establish a data boundary for the cloud service, and the data boundary comprises at least one of the following constraint conditions: information about an identity subject that uses the cloud service, access resource information related to the cloud service, network information related to use of the cloud service, information about a device that initiates an access request to the cloud service, and trusted execution environment information related to the cloud service; and establish a data boundary for the cloud service based on the data boundary establishment request; and an authentication module, configured to: when the cloud service receives a first access request generated by a second tenant or the first tenant for the cloud service, compare information carried in the first access request with the constraint condition in the data boundary, and when the information carried in the first access request matches the constraint condition in the data boundary, allow the cloud service to respond to the first access request, or when the information carried in the first access request does not match the constraint condition in the data boundary, skip allowing the cloud service to respond to the first access request, wherein the information carried in the first access request comprises one or any combination of the following: first identity subject information, first access resource information, first network information, first device information for initiating the first access request, and first trusted execution environment information.

9. The apparatus according to claim 8, wherein the first tenant and the second tenant are registered with the cloud platform, a role of the first tenant is an administrator of the data boundary, and a role of the second tenant is a visitor of the data boundary.

10. The apparatus according to claim 8 or 9, wherein the management module is further configured to: receive a constraint condition addition request that is input by the first tenant for the data boundary; and add, to the data boundary, a first constraint condition indicated by the constraint condition addition request, wherein the first constraint condition is one or more of the following: second identity subject information, second access resource information, second network information, second device information for initiating an access request, and second trusted execution environment information.

11. The apparatus according to any one of claims 8 to 10, wherein the management module is further configured to: receive a constraint condition removal request that is input by the first tenant for the data boundary; and remove, from the data boundary of the cloud service, a second constraint condition indicated by the constraint condition removal request, wherein the second constraint condition is one or more of the following: third identity subject information, third access resource information, third network information, third device information for initiating an access request, and third trusted execution environment information.

12. The apparatus according to any one of claims 8 to 11, wherein the management module is further configured to: receive a data boundary deletion request that is input by the first tenant for the cloud service; and delete the data boundary indicated by the data boundary deletion request.

13. The apparatus according to any one of claims 8 to 12, wherein the management module is further configured to: receive a data boundary function disabling request that is input by the first tenant for the cloud service; and disable a data boundary function for the cloud service.

14. The apparatus according to claim 13, wherein the management module is further configured to: receive a data boundary function enabling request that is input by the first tenant for the cloud service; and enable a data boundary function for the cloud service.

15. A computer device cluster, wherein the computer device cluster comprises at least one computing device, and each computing device comprises a processor and a memory, wherein a processor of the at least one computing device is configured to execute instructions stored in a memory of the device, to enable the computing device cluster to perform the cloud computing technology based access management method according to any one of claims 1 to 7.

16. A computer program product comprising instructions, wherein when the instructions are run by a computing device, the computing device is enabled to perform the cloud computing technology-based access management method according to any one of claims 1 to 7.

17. A computer-readable storage medium, comprising computer program instructions, wherein when the computer program instructions are executed by a computing device, the computing device performs the cloud computing technology based access management method according to any one of claims 1 to 7.

Images