Method, apparatus and system for authentication

Abstract

The application provides an authentication method, which comprises the following steps: obtaining N authentication requests, wherein N is a positive integer greater than or equal to 1; determining an authentication judgment strategy corresponding to each authentication request in the N authentication requests, wherein the authentication judgment strategy corresponding to each authentication request is a local authentication judgment strategy or a remote authentication judgment strategy; and processing the N authentication requests according to the authentication judgment strategy corresponding to each authentication request in the N authentication requests. The authentication method provided by the application can effectively reduce the load of an authentication server and improve the accuracy of the authentication method.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cloud computing, and more particularly, to a method, device and system for authentication. BACKGROUND

[0002] On a cloud computing platform, each customer is a tenant, and each tenant needs to be authorized by an administrator when accessing cloud resources on the cloud computing platform. Only when the tenant to be accessed resources is authorized, the tenant can access the corresponding resources.

[0003] The role-based access control (RBAC) model is the most widely used authentication model. The RBAC model decouples users and permissions by associating users with roles and roles with permissions, simplifies the management of permissions, reduces management overhead, and can flexibly support enterprise security policies and have great flexibility to changes in enterprises. However, the RBAC authentication model also has the following problems: the role or permission data is not synchronized in time, and the permission is issued late; the role or resource data is centrally stored, which cannot guarantee the authorization and authentication performance, such as misjudging a legal access request as an illegal access request; and it cannot meet the authentication in many business scenarios. For example, it cannot be used to ensure the control of the sequence of resource operations. SUMMARY

[0004] The present application provides a method, device and system for authentication to improve the accuracy of the authentication method.

[0005] In a first aspect, a method for authentication is provided, the method comprising:

[0006] obtaining N authentication requests, N being a positive integer greater than or equal to 1;

[0007] determining an authentication judgment strategy corresponding to each authentication request in the N authentication requests, the authentication judgment strategy corresponding to each authentication request being a local authentication judgment strategy or a remote authentication judgment strategy;

[0008] processing the N authentication requests according to the authentication judgment strategy corresponding to each authentication request in the N authentication requests.

[0009] The present application provides two authentication judgment strategies, the local authentication judgment strategy has the characteristics of low latency and high authentication performance, and the remote authentication judgment strategy has the characteristic of high authentication accuracy. The local authentication judgment strategy and the remote authentication judgment strategy are combined, and the authentication judgment strategy corresponding to each authentication request is determined according to the number of authentication requests. Therefore, the authentication method provided by the present application can effectively reduce the load of the authentication server and improve the accuracy of the authentication method.

[0010] With reference to the first aspect, in some implementations of the first aspect, the determining of the authentication judgment policy corresponding to each of the N authentication requests comprises:

[0011] determining M tenants corresponding to the N authentication requests, wherein each of the N authentication requests corresponds to one of the M tenants, M is a positive integer, and 1≤M≤N;

[0012] determining the authentication judgment policy of the authentication request corresponding to the mth tenant in the N authentication requests according to the number of authentication requests corresponding to the mth tenant in the M tenants, m is a positive integer, and 1≤m≤M.

[0013] Optionally, in some implementations, the authentication judgment policy corresponding to the mth tenant can be determined according to the frequency of sending authentication requests by the mth tenant in the M tenants.

[0014] Specifically, in a case where the frequency of sending authentication requests by the tenant is greater than or equal to a first frequency, it is determined to process the authentication request sent by the tenant using the local authentication judgment policy. In a case where the frequency of sending authentication requests by the tenant is less than or equal to a second frequency, it is determined to process the authentication request sent by the tenant using the remote authentication judgment policy. The first frequency is greater than the second frequency.

[0015] With reference to the first aspect, in some implementations of the first aspect, the determining of the authentication judgment policy corresponding to each of the N authentication requests comprises:

[0016] if the number of authentication requests corresponding to the mth tenant is greater than or equal to a first threshold, it is determined that the authentication judgment policy of the authentication request corresponding to the mth tenant is the local authentication judgment policy;

[0017] if the number of authentication requests corresponding to the mth tenant is less than or equal to a second threshold, it is determined that the authentication judgment policy of the authentication request corresponding to the mth tenant is the remote authentication judgment policy, wherein the first threshold is greater than the second threshold.

[0018] Based on the above scheme, the authentication judgment policy corresponding to the authentication request corresponding to each tenant is determined according to the number of authentication requests corresponding to different tenants, which can effectively improve the efficiency of authentication.

[0019] For example, at T1, the cloud service cluster receives 5000 authentication requests, and 4950 of the 5000 authentication requests are from tenant #1, and the remaining 50 authentication requests are from tenant #2. According to the authentication method provided in the present application, it is determined to process the 4950 authentication requests sent by tenant #1 using the local authentication judgment strategy, and to process the 50 authentication requests sent by tenant #2 using the remote authentication judgment strategy. By processing the authentication requests of different tenants through different authentication judgment strategies, the efficiency of authentication can be effectively improved to a certain extent.

[0020] In conjunction with the first aspect, in some implementations of the first aspect, the processing of the N authentication requests according to the authentication judgment strategy corresponding to each of the N authentication requests comprises:

[0021] In the case where the authentication judgment strategy corresponding to at least one of the N authentication requests is the local authentication judgment strategy, when the first permission policy is queried in the cloud service cluster, it is determined whether to allow the at least one authentication request according to the at least one authentication request and the first permission policy; or,

[0022] In the case where the authentication judgment strategy corresponding to at least one of the N authentication requests is the local authentication judgment strategy, when the first permission policy cannot be queried in the cloud service cluster, the following steps are performed:

[0023] Sending a query message to an identity recognition and access management (IAM) service cluster, the query message being used to obtain a second authentication policy, the second authentication policy being a permission policy saved in the IAM service cluster;

[0024] Receiving the second permission policy sent by the IAM service cluster;

[0025] Determining whether to allow the at least one authentication request according to the at least one authentication request and the second permission policy.

[0026] In conjunction with the first aspect, in some implementations of the first aspect, the processing of the N authentication requests according to the authentication judgment strategy corresponding to each of the N authentication requests comprises:

[0027] In the case where the authentication judgment strategy corresponding to at least one of the N authentication requests is the remote authentication judgment strategy, the at least one authentication request is sent to the IAM service cluster;

[0028] Receiving an authentication result corresponding to the at least one authentication request sent by the IAM service cluster;

[0029] Determine whether to allow the at least one authentication request according to an authentication result corresponding to the at least one authentication request sent by the IAM service cluster.

[0030] In conjunction with the first aspect, in some implementations of the first aspect, the determining whether to allow the at least one authentication request according to the authentication result corresponding to the at least one authentication request sent by the IAM service cluster includes:

[0031] In a case where the at least one authentication request is not allowed, determine whether to allow the at least one authentication request according to resource information requested to be accessed by the at least one authentication request, the resource information requested to be accessed by the authentication request including one or more of the following information: resource level, resource type.

[0032] Based on the above scheme, in a case where the remote authentication judgment policy determines not to allow the authentication request of the tenant, or in a case where the remote authentication judgment policy cannot determine whether to allow the authentication request of the tenant, the cloud service cluster can further determine whether to allow the authentication request according to information of a resource requested to be accessed by the authentication request sent by the tenant. In the case of ensuring the security of the resource information, the demand of the tenant can be further met.

[0033] For example, the information of the resource requested to be accessed by the authentication request sent by the tenant A is weather information, and the weather information has a low importance. In a case where the remote authentication judgment policy determines not to allow the authentication request, or in a case where the remote authentication judgment policy cannot determine whether to allow the authentication request, the cloud service cluster can determine to allow the authentication request.

[0034] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes:

[0035] Obtain format information of the first permission policy and / or format information of the second permission policy;

[0036] Convert the format information of the resource type in the format information of the first permission policy and / or convert the format information of the resource type in the format information of the second permission policy.

[0037] Based on the above scheme, in the authentication algorithm, the format of the converted permission policy data can be used, and the efficiency of the authentication algorithm can be improved.

[0038] The second aspect provides an authentication device, which includes:

[0039] A transceiver unit configured to obtain N authentication requests, N being a positive integer greater than or equal to 1;

[0040] determine, for each of the N authentication requests, an authentication judgment policy corresponding to the each of the N authentication requests, the authentication judgment policy corresponding to the each of the N authentication requests being a local authentication judgment policy or a remote authentication judgment policy;

[0041] The processing unit is further configured to process the N authentication requests according to the authentication judgment policy corresponding to each of the N authentication requests.

[0042] With reference to the second aspect, in some implementations of the second aspect, the processing unit is further configured to:

[0043] determine M tenants corresponding to the N authentication requests, wherein each of the N authentication requests corresponds to one of the M tenants, M is a positive integer, and 1≤M≤N;

[0044] determine, according to a number of authentication requests corresponding to an mth tenant of the M tenants, an authentication judgment policy of an authentication request corresponding to the mth tenant of the N authentication requests, m is a positive integer, and 1≤m≤M.

[0045] With reference to the second aspect, in some implementations of the second aspect, the processing unit is further configured to:

[0046] if the number of authentication requests corresponding to the mth tenant is greater than or equal to a first threshold value, determine that the authentication judgment policy of the authentication request corresponding to the mth tenant is the local authentication judgment policy;

[0047] if the number of authentication requests corresponding to the mth tenant is less than or equal to a second threshold value, determine that the authentication judgment policy of the authentication request corresponding to the mth tenant is the remote authentication judgment policy, wherein the first threshold value is greater than the second threshold value.

[0048] With reference to the second aspect, in some implementations of the second aspect, the processing unit is further configured to:

[0049] in a case where the authentication judgment policy corresponding to at least one of the N authentication requests is the local authentication judgment policy, when a first permission policy is queried in the cloud service cluster, determine whether to allow the at least one authentication request according to the at least one authentication request and the first permission policy; or,

[0050] in a case where the authentication judgment policy corresponding to at least one of the N authentication requests is the local authentication judgment policy, when a first permission policy cannot be queried in the cloud service cluster,

[0051] The transceiver is further configured to send a query message to an identity and access management (IAM) service cluster, the query message being used to obtain a second authentication policy, the second authentication policy being a permission policy saved in the IAM service cluster.

[0052] The transceiver is further configured to receive the second permission policy sent by the IAM service cluster.

[0053] The processing unit is further configured to determine whether to allow the at least one authentication request according to the at least one authentication request and the second permission policy.

[0054] With reference to the second aspect, in some implementations of the second aspect, in a case where the authentication judgment policy corresponding to at least one of the N authentication requests is the remote authentication judgment policy,

[0055] The transceiver is further configured to send the at least one authentication request to the IAM service cluster.

[0056] The transceiver is further configured to receive an authentication result corresponding to the at least one authentication request sent by the IAM service cluster.

[0057] The processing unit is further configured to determine whether to allow the at least one authentication request according to the authentication result corresponding to the at least one authentication request sent by the IAM service cluster.

[0058] With reference to the second aspect, in some implementations of the second aspect, the transceiver is further configured to:

[0059] In a case where the at least one authentication request is not allowed, determine whether to allow the at least one authentication request according to resource information requested to be accessed by the at least one authentication request, the resource information requested to be accessed by the authentication request including one or more of the following information: resource level, resource type.

[0060] With reference to the second aspect, in some implementations of the second aspect, the transceiver is further configured to obtain format information of the first permission policy and / or format information of the second permission policy.

[0061] The processing unit is further configured to convert the format information of the resource type in the format information of the first permission policy and / or convert the format information of the resource type in the format information of the second permission policy.

[0062] A third aspect provides a device, including a memory and a processor, the memory is configured to store instructions, and the processor is configured to read the instructions stored in the memory, so that the device executes the method in the first aspect and any possible implementation manner of the first aspect.

[0063] In a fourth aspect, a processor is provided, including an input circuit, an output circuit and a processing circuit. The processing circuit is configured to receive a signal through the input circuit and transmit a signal through the output circuit, so that any of the aspects of the first aspect and the method in any possible implementation manner of the first aspect are implemented.

[0064] In implementation, the processor can be a chip, the input circuit can be an input pin, the output circuit can be an output pin, and the processing circuit can be a transistor, a gate circuit, a flip-flop, various logic circuits, etc. The input signal received by the input circuit can be received and input by, for example but not limited to, a receiver, the signal output by the output circuit can be output to and transmitted by, for example but not limited to, a transmitter, and the input circuit and the output circuit can be the same circuit which is used as the input circuit and the output circuit at different times. The embodiments of the present application do not limit the specific implementation manners of the processor and various circuits.

[0065] In a fifth aspect, a processing apparatus is provided, including a processor and a memory. The processor is configured to read instructions stored in the memory and can receive a signal through a receiver and transmit a signal through a transmitter to execute the method in the first aspect and any possible implementation manner of the first aspect.

[0066] Optionally, the processor is one or more, and the memory is one or more.

[0067] Optionally, the memory can be integrated with the processor, or the memory and the processor can be separately arranged.

[0068] In implementation, the memory can be a non-transitory memory, for example, a read only memory (ROM), which can be integrated with the processor on the same chip or arranged separately on different chips. The embodiments of the present application do not limit the type of memory and the arrangement of the memory and the processor.

[0069] It should be understood that the related data interaction process, for example, transmitting the indication information can be the process of outputting the indication information from the processor, and receiving the capability information can be the process of receiving the input capability information by the processor. Specifically, the processed output data can be output to a transmitter, and the input data received by the processor can come from a receiver. The transmitter and the receiver can be collectively referred to as a transceiver.

[0070] In a sixth aspect, a computer readable storage medium is provided for storing a computer program, the computer program including instructions for executing the method in the first aspect and any possible implementation manner of the first aspect.

[0071] In a seventh aspect, a computer program product containing instructions, which when executed on a computer, cause the computer to carry out the method according to the first aspect and any possible implementation thereof.

[0072] In an eighth aspect, a chip is provided, which includes at least one processor and an interface; the at least one processor is configured to invoke and run a computer program, so that the chip executes the method according to the first aspect and any possible implementation thereof.

[0073] In a ninth aspect, a system is provided, which includes a management device, a cloud service cluster, and an IAM service cluster. BRIEF DESCRIPTION OF DRAWINGS

[0074] Figure 1 is an authentication model provided by the present application.

[0075] Figure 2 is a system architecture diagram of an authentication method provided by the present application.

[0076] Figure 3 is a schematic flow chart of the method 300 of authentication provided by the present application.

[0077] Figure 4 is a schematic flow chart of the method 400 of remote authentication provided by the present application.

[0078] Figure 5 is a schematic flow chart of the method 500 of local authentication provided by the present application.

[0079] Figure 6 is a schematic structure diagram of the authentication device 600 provided by the present application.

[0080] Figure 7 is a schematic structure diagram of the authentication equipment 700 provided by the present application. DETAILED DESCRIPTION

[0081] The technical solutions in the present application will be described below with reference to the drawings.

[0082] It should be noted that the terms "comprising" and "having" and any variations thereof in the specification and claims of the present application are intended to cover not exclusive inclusion, for example, a process, method, system, product or equipment containing a series of steps or units need not be limited to only those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or equipment.

[0083] First, the related terms involved in the present application are introduced.

[0084] 1, public cloud

[0085] Public cloud, usually refers to the cloud that can be used by the user provided by the third-party provider. Public cloud can be generally used through the Internet. The core attribute of public cloud is shared resource service.

[0086] 2, tenant

[0087] Tenant, in the field of cloud computing, refers to the account of renting public cloud resources. One tenant account can create one or more sub-accounts, and these one or more sub-accounts correspond to one or more users under the tenant.

[0088] 3, user

[0089] User, refers to the sub-account created by the tenant under its account. The user has part of the permissions of the tenant. In addition, the tenant can also set the user's permissions to resources and operations according to needs.

[0090] 4, authentication

[0091] Authentication, refers to verifying whether the user has the right to access the system.

[0092] 5, user access control (user authentication)

[0093] Enterprise tenant managers control the access of users within the enterprise using cloud services, manage and control the service functions required by tenant users, develop business roles, assign permissions, and manage users, user role assignments, and role permission assignments.

[0094] 6, tenant access control (tenant authentication)

[0095] Cloud service providers control the access of enterprise or institutional tenants using cloud services, manage and control the service functions required by tenants, review and issue cloud service licenses for tenants, develop tenant management strategies, and charge corresponding service fees to tenants through service billing.

[0096] 7, object storage service (OBS)

[0097] OBS is an object-based mass storage service that provides customers with mass, secure, highly reliable, and low-cost data storage capabilities.

[0098] 8, hyper text transfer protocol (HTTP)

[0099] HTTP protocol is a transfer protocol used to transfer hypertext from a world wide web (WWW) server to a client (local browser). The HTTP protocol is based on the TCP / IP communication protocol to deliver data (HTML files, picture files, query results, etc.).

[0100] 9, identity and access management (IAM)

[0101] IAM is a comprehensive set of business processes and management means for establishing and maintaining digital identities and providing effective and secure access to Internet resources, thereby realizing unified identity authentication, authorization, and centralized management and auditing of identity data for organization information assets.

[0102] In the following, the authentication model and system architecture of the present application are introduced in combination with Figure 1 and Figure 2 .

[0103] Figure 1 An authentication model provided by the present application is shown.

[0104] As shown in Figure 1 , the authentication model includes a tenant 110, a policy enforcement point (PEP) 120, a policy decision point (PDP) 130, a policy information point (PIP) 140, a policy retrieval point (PRP) 150, a policy administration point (PAP) 160, and a management device 170.

[0105] The tenant 110 is configured to send an access request (authentication request). For example, the access request can be a service request. Alternatively, the access request can be an application request.

[0106] In the embodiments of the present application, the number of sub-accounts included in the tenant 110 is not specifically limited. For example, the tenant 110 can be a private account, in which case the tenant 110 can include only one sub-account. Alternatively, the tenant 110 can also be an enterprise account, in which case the tenant 110 can include multiple sub-accounts. The PEP 120 is configured to intercept the access request sent by the tenant 110, convert the access request into an authentication request, and send the authentication request to the PDP 130.

[0107] PDP 130, configured to perform authentication logic, by extracting information provided in the authentication request, and using PIP to find rules set in the permission policy to determine whether the authentication request should be allowed.

[0108] PIP 140, which can be any attribute information source, including an internal database, an external database, or other storage.

[0109] PRP 150, configured to find and store permission policies, which can be an internal database, an external database, or other storage.

[0110] PAP 160, configured to manage policy data relied on by the PDP authentication process.

[0111] Management device 170, configured to perform management operations such as creation, editing, and deletion of policies in the PAP, and to manage authorization relationships of permission policies.

[0112] Figure 2 A system architecture diagram of the authentication method provided by the present application is shown.

[0113] As shown in Figure 2 , the system architecture diagram includes tenant 210, cloud service cluster 220, IAM service cluster 230, and management device 240.

[0114] Cloud service cluster 220 includes cloud service modules, IAM authentication SDK, and policy cache plug-ins.

[0115] The cloud service module functions similarly to the PEP 120, and is configured to intercept access requests sent by the tenant 210, convert the access requests into authentication requests, and send the authentication requests to the IAM authentication SDK.

[0116] The IAM authentication SDK functions similarly to the PDP 130, and is configured to perform authentication logic, by extracting information provided in the authentication request, and using the permission policy to find rules set in the permission policy to determine whether the authentication request should be allowed.

[0117] It should be noted that the number of cloud servers included in the cloud service cluster 220 is not specifically limited by the present application. For example, the cloud service cluster 220 can include 5 cloud servers. Alternatively, the cloud service cluster 220 can include 10 cloud servers.

[0118] It should also be noted that the deployment in each cloud server in the cloud service cluster 220 is not specifically limited by the present application. For example, the IAM authentication SDK and the policy cache plug-in can be deployed in cloud server 1, and the IAM authentication SDK can be deployed in cloud server 2.

[0119] The IAM service cluster 230 comprises an authentication service module, a permission management module, a cache module, and a database module.

[0120] The authentication service module is equivalent to the function of the PDP 130, and is configured to perform authentication logic operations, and determine whether to allow the authentication request by extracting information provided in the authentication request and rules set in the permission policy.

[0121] The permission management module is equivalent to the function of the PAP 160, and is configured to manage policy data relied on by the PDP 130 in the authentication process.

[0122] The cache module is equivalent to the function of the PRP 150, and is configured to search and store the permission policy, which can be an internal database, an external database, or other storage modes.

[0123] The database module is configured to store the permission policy configured by the management device 240 and the like.

[0124] Optionally, in an implementation manner, the management device 240 is a separate device.

[0125] Optionally, in another implementation manner, the management device 240 is a device or a module deployed in a cloud server cluster.

[0126] Next, the authentication method 300 provided in the present application is described in detail. Figure 3 The authentication method 300 provided in the present application is described in detail.

[0127] Figure 3 A schematic flowchart of the authentication method 300 provided in the present application is shown.

[0128] As shown in the flowchart, the authentication method 300 comprises steps 310 to 330, which are described in detail as follows. Figure 3

[0129] In step 310, N authentication requests are acquired, where N is a positive integer greater than or equal to 1.

[0130] The acquisition of the N authentication requests can be understood as that the cloud service cluster acquires the N authentication requests.

[0131] For example, a tenant A accesses the cloud service cluster through a client, and sends one or more authentication requests to the server cluster. In this case, the cloud service cluster can acquire the one or more authentication requests sent from the tenant A.

[0132] In the embodiments of the present application, the number of the acquired N authentication requests is not specifically limited. For example, N can be 5. For another example, N can be 30. For yet another example, N can be 200.

[0133] ​In the embodiments of the present application, the resources accessed by the obtained N authentication requests are not specifically limited.

[0134] In an implementable manner, the resources accessed by the obtained N authentication requests are the same in content.

[0135] For example, enterprise A sends 4 authentication requests to the cloud service cluster, which are authentication request 1, authentication request 1, authentication request 1 and authentication request 1. Among them, authentication request 1 is a request sent by department 1 of enterprise A, authentication request 2 is a request sent by department 2 of enterprise A, authentication request 3 is a request sent by department 3 of enterprise A, and authentication request 4 is a request sent by department 4 of enterprise A. And the four authentication requests all request to access resource A.

[0136] In an implementable manner, the resources accessed by the obtained N authentication requests are not the same in content.

[0137] For example, enterprise A sends 4 authentication requests to the cloud service cluster, which are authentication request 1, authentication request 1, authentication request 1 and authentication request 1. Among them, authentication request 1 is a request sent by department 1 of enterprise A, authentication request 2 is a request sent by department 2 of enterprise A, authentication request 3 is a request sent by department 3 of enterprise A, and authentication request 4 is a request sent by department 4 of enterprise A. And authentication request 1 and authentication request 2 both request to access resource A, and authentication request 3 and authentication request 4 both request to access resource B.

[0138] For example, enterprise A sends 4 authentication requests to the cloud service cluster, which are authentication request 1, authentication request 1, authentication request 1 and authentication request 1. Among them, authentication request 1 is a request sent by department 1 of enterprise A, authentication request 2 is a request sent by department 2 of enterprise A, authentication request 3 is a request sent by department 3 of enterprise A, and authentication request 4 is a request sent by department 4 of enterprise A. And authentication request 1 requests to access resource A, authentication request 2 requests to access resource B, authentication request 3 requests to access resource C, and authentication request 4 requests to access resource D.

[0139] In the embodiments of the present application, the tenants corresponding to the obtained N authentication requests are not specifically limited, and the number of users included in each tenant is also not specifically limited.

[0140] In an implementable manner, the N authentication requests obtained are all from the same tenant.

[0141] For example, the cloud service cluster receives 100 authentication requests sent by tenant A, and tenant A only includes one user, which is department 1. Among them, the 100 authentication requests are all from department 1 of tenant A.

[0142] For example, the cloud service cluster receives 100 authentication requests sent by tenant A, and tenant A includes two users, namely department 1 and department 2. Among them, 50 authentication requests come from department 1 of tenant A, and the remaining 50 authentication requests come from department 2 of tenant A.

[0143] In another implementable manner, the obtained N authentication requests come from different tenants.

[0144] For example, the cloud service cluster receives 100 authentication requests, and the 100 authentication requests come from tenant A, tenant B, respectively. Specifically, tenant A sends 80 authentication requests to the server cluster, and tenant B sends 20 authentication requests to the server cluster.

[0145] For example, the cloud service cluster receives 100 authentication requests, and the 100 authentication requests come from tenant A, tenant B, tenant C, respectively. Specifically, tenant A sends 10 authentication requests to the server cluster, tenant B sends 30 authentication requests to the server cluster, and tenant C sends 60 authentication requests to the server cluster.

[0146] In step 320, a determination is made of an authentication judgment strategy corresponding to each of the N authentication requests. The authentication judgment strategy corresponding to each of the N authentication requests is either a local authentication judgment strategy or a remote authentication judgment strategy.

[0147] In the embodiments of the present application, the determination of the authentication judgment strategy corresponding to each of the N authentication requests includes:

[0148] M tenants corresponding to the N authentication requests are determined, wherein each of the N authentication requests corresponds to one of the M tenants, M is a positive integer, and 1≤M≤N;

[0149] The authentication judgment strategy of the authentication request corresponding to the mth tenant in the N authentication requests is determined according to the number of authentication requests corresponding to the mth tenant in the M tenants, m is a positive integer, and 1≤m≤M.

[0150] The manner of determining the M tenants corresponding to the N authentication requests is not specifically limited.

[0151] For example, the ID information of the tenant is carried in each authentication request message, and the tenant corresponding to each authentication request can be determined through the ID information.

[0152] Optionally, in some implementable manners, the authentication judgment strategy of the authentication request corresponding to the mth tenant in the N authentication requests is determined according to the number of authentication requests corresponding to the mth tenant in the M tenants, m is a positive integer, and 1≤m≤M.

[0153] If the number of authentication requests corresponding to the mth tenant is greater than or equal to the first threshold value, it is determined that the authentication judgment strategy of the authentication request corresponding to the mth tenant is the local authentication judgment strategy.

[0154] If the number of authentication requests corresponding to the mth tenant is less than or equal to the second threshold value, it is determined that the authentication judgment strategy of the authentication request corresponding to the mth tenant is the remote authentication judgment strategy, wherein the first threshold value is greater than the second threshold value.

[0155] In the embodiments of the present application, the sizes of the first threshold value and the second threshold value are not specifically limited.

[0156] In an implementable manner, the first threshold value and the second threshold value are fixed-size values.

[0157] For example, the first threshold value is set to 1000 and the second threshold value is set to 50.

[0158] In another implementable manner, the values of the first threshold value and the second threshold value are related to the specific application scenarios of the authentication method.

[0159] For example, the selection of the first threshold value and the second threshold value is related to the number of cloud servers included in the cloud service cluster. When the cloud service cluster includes 3 cloud servers, the first threshold value is 500 and the second threshold value is 50. When the cloud service cluster includes 5 cloud servers, the first threshold value is 1000 and the second threshold value is 200.

[0160] For example, taking the first threshold value and the second threshold value as fixed-size values, according to the number of authentication requests corresponding to the mth tenant in the M tenants, the authentication judgment strategy of the authentication request corresponding to the mth tenant in the N authentication requests is determined as follows:

[0161] For example, the first threshold value is 600, the second threshold value is 100, M is 6, m is 5, N is 1000, and through the tenant ID information carried in the authentication request, it is determined that the 1000 authentication requests received by the cloud service cluster come from 6 tenants, which are tenant #1, tenant #2, tenant #3, tenant #4, tenant #5, and tenant #6. The number of authentication requests corresponding to tenant #5 (i.e. tenant ID number 5) is 800. In this case, it can be determined that the local authentication judgment strategy is used to process the authentication request corresponding to the tenant #5.

[0162] It should be noted that in the case where the number of authentication requests received by the cloud service cluster is less than the first threshold value and greater than the second threshold value, the local authentication judgment strategy or the remote authentication judgment strategy can be used to process the authentication request according to the current network state and / or the number of authentication requests.

[0163] For example, the first threshold value is 600, the second threshold value is 100, and the tenant ID information carried in the authentication request is used to determine that the 850 authentication requests received by the cloud service cluster come from three tenants, namely tenant #1, tenant #2, and tenant #3. The number of authentication requests corresponding to tenant #1 (i.e., tenant ID number 1) is 610, the number of authentication requests corresponding to tenant #2 (i.e., tenant ID number 2) is 150, and the number of authentication requests corresponding to tenant #3 (i.e., tenant ID number 3) is 90. In the case of a good network state, the local authentication judgment strategy can be used to process the authentication requests of tenant #1, and the remote authentication judgment strategy can be used to process the authentication requests of tenant #2 and tenant #3. In the case of a poor network state, the local authentication judgment strategy can be used to process the authentication requests of tenant #1 and tenant #2, and the remote authentication judgment strategy can be used to process the authentication requests of tenant #3.

[0164] Optionally, in some possible implementations, the authentication judgment strategy of the authentication requests corresponding to the mth tenant in the M tenants can be determined according to the frequency of sending authentication requests by the mth tenant.

[0165] Specifically, in the case where the frequency of sending authentication requests by a tenant is greater than or equal to a first frequency, it is determined that the local authentication judgment strategy is used to process the authentication requests sent by the tenant. In the case where the frequency of sending authentication requests by a tenant is less than or equal to a second frequency, it is determined that the remote authentication judgment strategy is used to process the authentication requests sent by the tenant. The first frequency is greater than the second frequency. Optionally, in some embodiments, the first frequency and the second frequency are fixed values.

[0166] For example, the first frequency is set to at least N authentication requests sent every 1 minute, and the second frequency is set to N authentication requests sent every 15 minutes. N is a positive integer greater than or equal to 1.

[0167] Optionally, in some embodiments, the size of the first frequency and the second frequency is related to a specific application scenario.

[0168] For example, the selection of the first frequency and the second frequency is related to the number of cloud servers included in the cloud service cluster. When the cloud service cluster includes three cloud servers, the first frequency is at least one authentication request sent every 5 minutes, and the second frequency is at least one authentication request sent every 20 minutes. When the cloud service cluster includes five cloud servers, the first frequency is at least one authentication request sent every 1 minute, and the second frequency is at least one authentication request sent every 10 minutes.

[0169] Exemplarily, taking the fixed size values of the first frequency and the second frequency as an example, according to the frequency at which the mth tenant in the M tenants sends the authentication request, the authentication judgment policy corresponding to the authentication request of the mth tenant is determined, and the determination process is as follows:

[0170] It is assumed that the first frequency is at least one authentication request sent every 1 minute, and the second frequency is at least one authentication request sent every 20 minutes. The cloud service cluster obtains, through tenant ID information carried in authentication requests saved in a period of time in a historical record, that tenant A sends at least one authentication request to the cloud service cluster every 30 seconds on average. In this case, it can be determined that the local authentication judgment policy is used to process the authentication request corresponding to the tenant #1.

[0171] It should be noted that in the case where the frequency of the authentication request received by the cloud service cluster is less than the first frequency and greater than the second frequency, the local authentication judgment policy or the remote authentication judgment policy can be used to process the authentication request according to the current network state and / or the frequency of the authentication request.

[0172] Exemplarily, it is assumed that the first frequency is at least one authentication request sent every 2 minutes, the second frequency is at least one authentication request sent every 20 minutes, and the cloud service cluster obtains, through tenant ID information carried in authentication requests saved in a period of time in a historical record, that tenant A sends at least one authentication request to the cloud service cluster every 30 seconds on average, tenant B sends at least one authentication request to the cloud service cluster every 2.5 minutes on average, tenant C sends at least one authentication request to the cloud service cluster every 10 minutes on average, and tenant D sends at least one authentication request to the cloud service cluster every 21 minutes on average. In the case of a good network state, the local authentication judgment policy can be used to process the authentication requests of tenant A and tenant B, and the remote authentication judgment policy can be used to process the authentication requests of tenant C and tenant D. In the case of a poor network state, the local authentication judgment policy can be used to process the authentication request of tenant A, and the remote authentication judgment policy can be used to process the authentication requests of tenant B, tenant C, and tenant D.

[0173] In step 330, the N authentication requests are processed according to the authentication judgment policy corresponding to each of the N authentication requests.

[0174] In an implementable manner, the N authentication requests are processed according to the authentication judgment policy corresponding to each of the N authentication requests, including:

[0175] In a case where the authentication judgment policy corresponding to at least one of the N authentication requests is a local authentication judgment policy, when the first permission policy is queried in the cloud service cluster, whether the at least one authentication request is allowed is determined according to the at least one authentication request and the first permission policy; or

[0176] In a case where the authentication judgment policy corresponding to at least one of the N authentication requests is a local authentication judgment policy, when the first permission policy cannot be queried in the cloud service cluster, the following steps are performed:

[0177] A query message is sent to the IAM service cluster, and the query message is used to obtain a second authentication policy, the second authentication policy being a permission policy saved in the IAM service cluster;

[0178] The second permission policy sent by the IAM service cluster is received;

[0179] Whether the at least one authentication request is allowed is determined according to the at least one authentication request and the second permission policy.

[0180] It should be understood that the policy content of the permission policy included in the first permission policy and the second permission policy is the same.

[0181] It can be understood that the first permission policy saved in the cloud service cluster has expired or been cleared in a case where the first permission policy cannot be queried in the cloud service cluster. In this case, the first permission policy cannot be queried in the cloud service cluster.

[0182] Optionally, in an implementable manner, the format information of the first permission policy and / or the format information of the second permission policy is obtained; the format information of the resource type in the format information of the first permission policy is converted and / or the format information of the resource type in the format information of the second permission policy is converted.

[0183] Illustratively, the resource type included in the first permission policy and the second permission policy is the Action level type and the Resource level type, and the data format of the Action level type and the Resource level type can be converted.

[0184] In another implementable manner, the N authentication requests are processed according to the authentication judgment policy corresponding to each of the N authentication requests, including:

[0185] In a case where the authentication judgment policy corresponding to at least one of the N authentication requests is a remote authentication judgment policy, the at least one authentication request is sent to the IAM service cluster;

[0186] The authentication result corresponding to the at least one authentication request sent by the IAM service cluster is received;

[0187] determine whether to allow the at least one authentication request according to the authentication result corresponding to the at least one authentication request sent by the IAM service cluster.

[0188] It should be noted that one authentication request corresponds to one authentication result.

[0189] For example, the cloud service cluster determines to process the two authentication requests (authentication request 1 and authentication request 2) sent by the tenant A by using the remote authentication judgment strategy, and then sends the two authentication requests to the IAM service cluster. The IAM service cluster determines whether to allow each of the two authentication requests according to the two authentication requests and the second permission policy, and obtains a result of processing the authentication request 1 and a result of processing the authentication request 2. The results of processing the authentication request 1 and the authentication request 2 are returned to the cloud service cluster.

[0190] In the embodiment of the present application, the determination of whether to allow the at least one authentication request according to the authentication result corresponding to the at least one authentication request sent by the IAM service cluster includes:

[0191] In the case where the at least one authentication request is not allowed, it is determined whether to allow the at least one authentication request according to resource information requested to be accessed by the at least one authentication request, and the resource information requested to be accessed by the authentication request includes one or more of the following information: resource level, resource type.

[0192] That is, in the case where the remote authentication judgment strategy determines not to allow the authentication request of the tenant, or in the case where the remote authentication judgment strategy cannot determine whether to allow the authentication request of the tenant, the cloud service cluster can also determine whether to allow the authentication request according to information of a resource requested to be accessed by the authentication request sent by the tenant.

[0193] For example, the authentication request sent by the tenant A requests to access a resource A, and the level of the resource A is low. In the case where the remote authentication judgment strategy determines not to allow the authentication request of the tenant A, or in the case where the remote authentication judgment strategy cannot determine whether to allow the authentication request of the tenant A, since the level of the resource A requested to be accessed by the tenant A is low, the cloud service cluster determines to allow the authentication request of the tenant A.

[0194] The authentication method provided in the application combines a local authentication judgment strategy and a remote authentication judgment strategy, and determines the authentication judgment strategy corresponding to each authentication request according to the number of authentication requests. The local authentication judgment strategy has the characteristics of low delay and high authentication performance, and the remote authentication judgment strategy has the characteristic of high authentication accuracy. Therefore, the authentication method provided in the application can effectively reduce the load of the authentication server and improve the accuracy of the authentication method. In addition, through the conversion of the permission policy format, the efficiency of the authentication method can be further improved.

[0195] Next, the remote authentication method 400 and the local authentication method 500 provided in the application will be introduced respectively in combination with Figure 4 and Figure 5 .

[0196] Figure 4 The schematic flowchart of the remote authentication method 400 provided in the application is shown.

[0197] As shown in Figure 4 , the application scenarios of remote authentication include a management device 401, a cloud service cluster 402, and an IAM service cluster 404. The cloud service cluster 402 is configured to provide cloud services. The IAM service cluster 404 includes a permission management module, an authentication service module, a cache module, and a database. The remote authentication method 400 provided in the application includes S410 to S428, which will be described in detail below.

[0198] S410, configure a permission policy #1.

[0199] The management device configures the permissions of the tenants according to the permission policy #1.

[0200] The application does not limit the specific content of the permission policy #1. For example, one policy in the permission policy #1 allows high-level tenants to access resource A and allows low-level tenants to access resource B. Alternatively, one policy in the permission policy #1 allows department 1 to access resource B.

[0201] S411, the permission management module sends the permission policy #1 to the database module.

[0202] S412, the database stores the permission policy #1.

[0203] S413, the database returns the storage result of the permission policy #1 to the permission management module.

[0204] Optionally, in some embodiments, step S413 can be omitted. That is, after S412 is executed, S420 is executed.

[0205] S420, the cloud service module sends an authentication request to the authentication service module.

[0206] Exemplarily, the authentication service module can return a uniform response body REST API (REST API) based on a server-side integration of an HTTP protocol, and accept the authentication request sent from the cloud service module.

[0207] S421, the authentication service module sends a message for querying a permission policy #1 to the database module.

[0208] S422, the database module returns the permission policy #1 to the authentication service module.

[0209] S423, the authentication service module determines whether to allow the authentication request.

[0210] The authentication service module determines whether to allow the authentication request according to the permission policy #1 and the authentication request, including:

[0211] In a case where the permission policy #1 can query the policy corresponding to the authentication request, it is determined that the authentication request is allowed; or,

[0212] In a case where the permission policy #1 cannot query the policy corresponding to the authentication request, it is determined that the authentication request is not allowed.

[0213] Exemplarily, the permission policy #1 includes a policy that a high-level tenant accesses a resource A and a low-level tenant accesses a resource B, and the authentication request is for accessing the resource A. In a case where the authentication request is from the low-level tenant, the authentication service module determines that the authentication request is not allowed. In a case where the authentication request is from the high-level tenant, the authentication service module determines that the authentication request is allowed.

[0214] S424, the authentication service module returns an authentication result to the cloud service module.

[0215] The authentication result includes: allowing the authentication request, or not allowing the authentication request.

[0216] Specifically, when the authentication result is to allow the authentication request, the cloud server provides the resource corresponding to the authentication request to the corresponding tenant; when the authentication result is not to allow the authentication request, the cloud server does not provide the resource corresponding to the authentication request to the corresponding tenant.

[0217] In the embodiments of the present application, the way in which the authentication service module returns the authentication result to the cloud server is not specifically limited.

[0218] Exemplarily, the authentication module can return the authentication result to the cloud server through a REST API.

[0219] Optionally, in some embodiments, when the authentication result received by the cloud server is that the authentication request is not allowed, the cloud server can further determine whether to allow the authentication request according to the authentication request.

[0220] For example, the authentication request is a request to access a resource corresponding to weather conditions, although the corresponding permission policy cannot be queried in the IAM service cluster, since the resource information accessed by the authentication request is less important, in this case, the cloud server can allow the authentication request.

[0221] Optionally, S423 can further include S425 to S428 before S423.

[0222] S425, the authentication service module converts the format of the permission policy #1 to obtain the permission policy #2.

[0223] For example, as shown in Table 1, the left side of Table 1 is the format of the permission policy #1 before conversion, and the right side of Table 1 is the format of the permission policy #2 after conversion. The specific conversion process is to delete the following information in the content of the left side of Table 1:

[0224] "Version":"1.1",

[0225] "Name":"OBS Reader",

[0226] "Created_time":"2019-09-25 12:12:44",

[0227] "Description":"The policy is used for checking OBS bucket and objectrelated permissions.",

[0228] "Created_by":"administrator"

[0229] The format information of the resource type on the left side of Table 1 is converted, for example, the resource type on the left side of Table 1 includes the type of Action level and the type of Resource level.

[0230] Taking the type of Action level as an example, the format information of this type is converted:

[0231] The format of the Action level type before conversion is:

[0232]

[0233] The format of the Action type after conversion is:

[0234]

[0235] Take the type of Resource level as an example, the format information conversion of the type is as follows:

[0236] The format of the type of Resource level before conversion is as follows:

[0237]

[0238]

[0239] The format of the type of Resource level after conversion is as follows:

[0240]

[0241] It should be understood that Table 1 is only illustrative and does not constitute any limitation on the present application. For example, multiple Action types and / or Resource types of resources can be included in Table 1. For another example, other types of resources can also be included in Table 1.

[0242] Table 1

[0243]

[0244]

[0245] S426, the authentication service module sends the permission policy #2 to the cache module.

[0246] S427, the cache module stores the permission policy #2.

[0247] S428, the cache module returns the storage result of the permission policy #2 to the authentication service module.

[0248] The method of remote authentication provided by the embodiments of the present application is suitable for the application scenario in which the cloud service cluster has less tenants, and when the access request of the tenant is authenticated, the method has the characteristics of high authentication efficiency and high authentication accuracy.

[0249] Figure 5 A schematic flowchart of the method 500 of local authentication provided by the present application is shown.

[0250] As Figure 5As shown, the application scenarios of the local authentication include: a cloud service cluster 501, and an IAM service cluster 502. The cloud service cluster 501 includes: a cloud service module, an IAM authentication software development kit (SDK), and a policy cache plug-in. The IAM service cluster 502 includes: an authentication service module and a cache module. The method 500 for local authentication provided in this application includes S510 to S564, which are described in detail below.

[0251] S510, the cloud service module sends an authentication request to the IAM authentication SDK.

[0252] S520, the IAM authentication SDK sends a message for querying a permission policy #1 to the policy cache plug-in.

[0253] In the embodiment of this application, when the permission policy data is stored in the policy cache plug-in, after S520 is executed, S530 is executed.

[0254] In the embodiment of this application, when the permission policy data is not stored in the policy cache plug-in or the permission policy data stored in the policy cache plug-in is expired or cleared, after S520 is executed, S560 to S564 are executed first, and then S530 is executed.

[0255] S530, the policy cache plug-in returns the permission policy to the IAM authentication SDK.

[0256] In some implementable manners, the permission policy is the permission policy #1.

[0257] In other implementable manners, the permission policy is the permission policy #2.

[0258] In the embodiment of this application, the conversion method of the permission policy #1 and the permission policy #2 is the same as the conversion method of the permission policy #1 and the permission policy #2 in S425. For brevity, the details are not described here. S540, the IAM authentication SDK determines whether to allow the authentication request according to the permission policy #1 and the authentication request.

[0259] The IAM authentication SDK determines whether to allow the authentication request according to the permission policy #1 and the authentication request, including:

[0260] In the case that the policy corresponding to the authentication request can be queried in the permission policy #1, it is determined that the authentication request is allowed; or

[0261] In the case that the policy corresponding to the authentication request cannot be queried in the permission policy #1, it is determined that the authentication request is not allowed.

[0262] For example, the authentication request 1 is a request sent from a tenant A, and the authentication request 1 requests to access a resource A. The tenant A is a normal user. The permission policy includes: allowing the normal tenant to access the resource A. In this case, it can be determined that the authentication request of the tenant A is allowed.

[0263] For example, the authentication request 1 is a request sent from a tenant A, and the authentication request 1 requests to access a resource A, and the authentication request 2 is a request sent from a tenant B, and the authentication request 2 requests to access the resource A. The tenant A is a high-level tenant, and the tenant B is a low-level tenant. The permission policy includes: allowing the high-level tenant to access the resource A, and allowing the low-level tenant to access a resource B. In this case, it can be determined that the authentication request of the tenant A is allowed, and the authentication request of the tenant B is not allowed. S550, the IAM authentication SDK returns the authentication result to the cloud service module.

[0264] S560, the policy cache plug-in sends a message for querying the permission policy #1 to the authentication service module.

[0265] S561, the authentication service module sends a message for querying the permission policy #1 to the cache module.

[0266] S562, the cache module returns a message of the permission policy #2.

[0267] The policy cache module converts the format of the obtained permission policy #1, and obtains the permission policy #2 after the conversion.

[0268] It should be understood that the permission policy #1 and the permission policy #2 include the same permission policy content, but the format of the permission policy #1 and the format of the permission policy #2 are different. As an example, the format of the permission policy #1 and the format of the permission policy #2 can refer to the content in Table 1 above.

[0269] S563, the authentication service module returns the permission policy #2 to the policy cache module.

[0270] S564, the policy cache module stores the permission policy #2.

[0271] Optionally, in some embodiments, when the cloud service cluster cannot connect to the IAM service cluster, or the service of the IAM provided by the IAM service cluster fails, the local policy cache plug-in in the cloud service cluster cannot update the expired local cache data, but the business of the cloud service cluster will not be interrupted. In this case, the cloud service cluster can continue to use the expired permission policy data to process the authentication request sent by the tenant.

[0272] The method for remote authentication provided in the embodiments of the present application is suitable for an application scenario in which a cloud service cluster accesses many tenants, and has the characteristics of low latency and high authentication performance when authenticating access requests of the tenants.

[0273] The above Figures 3 to 5 The method for authentication provided in the present application is described in detail. In the following, the authentication device and the authentication equipment provided in the present application are described in detail. Figure 6 and Figure 7 The authentication device and the authentication equipment provided in the present application are described in detail.

[0274] Figure 6 FIG. 6 is a schematic structural diagram of the authentication device 600 provided in the embodiments of the present application.

[0275] The authentication device 600 comprises a transceiver unit 610 and a processing unit 620. The transceiver unit 610 and the processing unit 620 communicate with each other through an internal connection path to transfer control and / or data signals.

[0276] The transceiver unit 610 is configured to acquire N authentication requests, where N is a positive integer greater than or equal to 1.

[0277] The processing unit 620 is configured to determine an authentication judgment strategy corresponding to each authentication request in the N authentication requests, where the authentication judgment strategy corresponding to each authentication request is a local authentication judgment strategy or a remote authentication judgment strategy.

[0278] The processing unit 620 is further configured to process the N authentication requests according to the authentication judgment strategy corresponding to each authentication request in the N authentication requests.

[0279] Optionally, in some embodiments, the processing unit 620 is further configured to:

[0280] determine M tenants corresponding to the N authentication requests, where each authentication request in the N authentication requests corresponds to one tenant in the M tenants, M is a positive integer, and 1≤M≤N;

[0281] determine the authentication judgment strategy of the authentication request corresponding to the mth tenant in the N authentication requests according to the number of authentication requests corresponding to the mth tenant in the M tenants, where m is a positive integer, and 1≤m≤M.

[0282] Optionally, in some embodiments, the processing unit 620 is further configured to:

[0283] if the number of authentication requests corresponding to the mth tenant is greater than or equal to a first threshold value, determine that the authentication judgment strategy of the authentication request corresponding to the mth tenant is the local authentication judgment strategy.

[0284] If the number of authentication requests corresponding to the mth tenant is less than or equal to a second threshold, it is determined that the authentication judgment policy of the authentication request corresponding to the mth tenant is the remote authentication judgment policy, where the first threshold is greater than the second threshold.

[0285] Optionally, in some embodiments, the processing unit 620 is further configured to:

[0286] In a case where the authentication judgment policy corresponding to at least one of the N authentication requests is the local authentication judgment policy, when the first permission policy is queried in the cloud service cluster, it is determined whether to allow the at least one authentication request according to the at least one authentication request and the first permission policy; or,

[0287] In a case where the authentication judgment policy corresponding to at least one of the N authentication requests is the local authentication judgment policy, when the first permission policy cannot be queried in the cloud service cluster,

[0288] The transceiver 610 is further configured to send a query message to an identity recognition and access management (IAM) service cluster, where the query message is used to obtain a second authentication policy, and the second authentication policy is a permission policy saved in the IAM service cluster.

[0289] The transceiver 610 is further configured to receive the second permission policy sent by the IAM service cluster.

[0290] The processing unit 620 is further configured to determine whether to allow the at least one authentication request according to the at least one authentication request and the second permission policy.

[0291] Optionally, in some embodiments, in a case where the authentication judgment policy corresponding to at least one of the N authentication requests is the remote authentication judgment policy,

[0292] The transceiver 610 is further configured to send the at least one authentication request to the IAM service cluster.

[0293] The transceiver 610 is further configured to receive an authentication result corresponding to the at least one authentication request sent by the IAM service cluster.

[0294] The processing unit 620 is further configured to determine whether to allow the at least one authentication request according to the authentication result corresponding to the at least one authentication request sent by the IAM service cluster.

[0295] Optionally, in some embodiments, the transceiver 610 is further configured to:

[0296] In the case that the at least one authentication request is not allowed, it is determined whether to allow the at least one authentication request according to resource information requested to be accessed by the at least one authentication request, the resource information requested to be accessed by the authentication request at least comprising one or more of the following information: resource level, resource type.

[0297] Optionally, in some embodiments, the transceiver 610 is further configured to acquire format information of the first permission policy and / or format information of the second permission policy.

[0298] The processing unit 620 is further configured to convert the format information of the resource type in the format information of the first permission policy and / or convert the format information of the resource type in the format information of the second permission policy.

[0299] Figure 7 FIG. 7 is a schematic structural diagram of an authentication device 700 provided by an embodiment of the present application.

[0300] The authentication device 700 comprises a transceiver 710, a processor 720 and a memory 730. The transceiver 710, the processor 720 and the memory 730 communicate with each other through internal connection paths to transfer control and / or data signals. The memory 730 is configured to store a computer program. The processor 710 is configured to call and run the computer program from the memory 730 to control the transceiver 720 to transceive signals.

[0301] The transceiver 710 is configured to acquire N authentication requests, N being a positive integer greater than or equal to 1.

[0302] The processor 720 is configured to determine an authentication judgment policy corresponding to each authentication request in the N authentication requests, the authentication judgment policy corresponding to each authentication request being a local authentication judgment policy or a remote authentication judgment policy.

[0303] The processor 720 is further configured to process the N authentication requests according to the authentication judgment policy corresponding to each authentication request in the N authentication requests.

[0304] Optionally, in some embodiments, the processor 720 is further configured to:

[0305] determine M tenants corresponding to the N authentication requests, wherein each authentication request in the N authentication requests corresponds to one tenant in the M tenants, M being a positive integer and 1≤M≤N;

[0306] determine the authentication judgment policy of the authentication request corresponding to the mth tenant in the N authentication requests according to the number of authentication requests corresponding to the mth tenant in the M tenants, m being a positive integer and 1≤m≤M.

[0307] Optionally, in some embodiments, the processor 720 is further configured to:

[0308] If the number of authentication requests corresponding to the mth tenant is greater than or equal to a first threshold, the authentication determination policy for the authentication requests corresponding to the mth tenant is determined to be the local authentication determination policy.

[0309] If the number of authentication requests corresponding to the mth tenant is less than or equal to a second threshold, the authentication determination policy for the authentication requests corresponding to the mth tenant is determined to be the remote authentication determination policy, wherein the first threshold is greater than the second threshold.

[0310] Optionally, in some embodiments, the processor 720 is further configured to:

[0311] In a case where the authentication determination policy corresponding to at least one of the N authentication requests is the local authentication determination policy, when a first permission policy is queried in the cloud service cluster, it is determined whether to allow the at least one authentication request according to the at least one authentication request and the first permission policy; or,

[0312] In a case where the authentication determination policy corresponding to at least one of the N authentication requests is the local authentication determination policy, when a first permission policy cannot be queried in the cloud service cluster,

[0313] The transceiver 710 is further configured to send a query message to an identity and access management (IAM) service cluster, the query message being used to obtain a second authentication policy, the second authentication policy being a permission policy saved in the IAM service cluster;

[0314] The transceiver 710 is further configured to receive the second permission policy sent from the IAM service cluster;

[0315] The processor 720 is further configured to determine whether to allow the at least one authentication request according to the at least one authentication request and the second permission policy.

[0316] Optionally, in some embodiments, in a case where the authentication determination policy corresponding to at least one of the N authentication requests is the remote authentication determination policy,

[0317] The transceiver 710 is further configured to send the at least one authentication request to the IAM service cluster;

[0318] The transceiver 710 is further configured to receive an authentication result corresponding to the at least one authentication request sent from the IAM service cluster;

[0319] The processor 720 is further configured to determine whether to allow the at least one authentication request according to an authentication result corresponding to the at least one authentication request sent by the IAM service cluster.

[0320] Optionally, in some embodiments, the transceiver 710 is further configured to:

[0321] In the case where the at least one authentication request is not allowed, determine whether to allow the at least one authentication request according to resource information requested to be accessed by the at least one authentication request, the resource information requested to be accessed by the at least one authentication request comprising at least one or more of the following information: resource level, resource type.

[0322] Optionally, in some embodiments, the transceiver 710 is further configured to obtain format information of the first permission policy and / or format information of the second permission policy.

[0323] The processor 720 is further configured to convert format information of the resource type in the format information of the first permission policy and / or convert format information of the resource type in the format information of the second permission policy.

[0324] Those skilled in the art can clearly understand that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solutions. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0325] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working process of the system, device and unit described above can refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

[0326] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or other forms.

[0327] The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed on multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0328] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present alone, or two or more units can be integrated in one unit.

[0329] The functions, if realized in the form of software functional units and sold or used as independent products, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application or the part of the present application that essentially contributes to the prior art or the part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program code storage media.

[0330] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method of authentication, characterized by, The method comprises: obtaining N authentication requests, N being a positive integer greater than or equal to 1; determining an authentication judgment strategy corresponding to each authentication request in the N authentication requests, the authentication judgment strategy corresponding to each authentication request being a local authentication judgment strategy or a remote authentication judgment strategy; The determination of the authentication judgment strategy corresponding to each authentication request in the N authentication requests comprises: determining M tenants corresponding to the N authentication requests, wherein each of the N authentication requests corresponds to one of the M tenants, M being a positive integer, and ; If the number of authentication requests corresponding to the mth tenant is greater than or equal to the first threshold value, it is determined that the authentication judgment policy of the authentication request corresponding to the mth tenant is the local authentication judgment policy, m is a positive integer, and ; if the number of authentication requests corresponding to the mth tenant is less than or equal to a second threshold value, the authentication judgment strategy of the authentication requests corresponding to the mth tenant is determined to be the remote authentication judgment strategy, wherein the first threshold value is greater than the second threshold value; processing the N authentication requests according to the authentication judgment strategy corresponding to each authentication request in the N authentication requests.

2. The method of claim 1, wherein, The processing of the N authentication requests according to the authentication judgment strategy corresponding to each authentication request in the N authentication requests comprises: in the case that the authentication judgment strategy corresponding to at least one authentication request in the N authentication requests is the local authentication judgment strategy, when a first permission policy is queried in the cloud service cluster, it is determined whether to allow the at least one authentication request according to the at least one authentication request and the first permission policy; or, in the case that the authentication judgment strategy corresponding to at least one authentication request in the N authentication requests is the local authentication judgment strategy, when a first permission policy cannot be queried in the cloud service cluster, the following steps are performed: sending a query message to an identity recognition and access management (IAM) service cluster, the query message being used to obtain a second permission policy, the second permission policy being a permission policy saved in the IAM service cluster; receiving the second permission policy sent from the IAM service cluster; determining whether to allow the at least one authentication request according to the at least one authentication request and the second permission policy.

3. The method of claim 2, wherein, The processing of the N authentication requests according to the authentication judgment strategy corresponding to each authentication request in the N authentication requests comprises: in the case that the authentication judgment strategy corresponding to at least one authentication request in the N authentication requests is the remote authentication judgment strategy, sending the at least one authentication request to an IAM service cluster; receiving an authentication result corresponding to the at least one authentication request sent from the IAM service cluster; determining whether to allow the at least one authentication request according to the authentication result corresponding to the at least one authentication request sent from the IAM service cluster.

4. The method of claim 3, wherein, The determination of whether to allow the at least one authentication request according to the authentication result corresponding to the at least one authentication request sent from the IAM service cluster comprises: in the case that the at least one authentication request is not allowed, it is determined whether to allow the at least one authentication request according to resource information requested to be accessed by the at least one authentication request, the resource information requested to be accessed by the authentication request comprising at least one or more of the following information: resource level, resource type.

5. The method of claim 2, wherein, The method further comprises: obtaining format information of the first permission policy and / or format information of the second permission policy; convert format information of a resource type in format information of the first permission policy and / or convert format information of a resource type in format information of the second permission policy.

6. An apparatus for authentication, the apparatus comprising: The apparatus comprises: a transceiving unit, configured to acquire N authentication requests, N being a positive integer greater than or equal to 1; a processing unit, configured to determine an authentication judgment policy corresponding to each authentication request in the N authentication requests, the authentication judgment policy corresponding to each authentication request being a local authentication judgment policy or a remote authentication judgment policy; the processing unit is further configured to: determining M tenants corresponding to the N authentication requests, wherein each of the N authentication requests corresponds to one of the M tenants, M being a positive integer, and ; If the number of authentication requests corresponding to the mth tenant is greater than or equal to the first threshold value, it is determined that the authentication judgment policy of the authentication request corresponding to the mth tenant is the local authentication judgment policy, m is a positive integer, and ; if the number of authentication requests corresponding to the mth tenant is less than or equal to a second threshold value, determine that the authentication judgment policy of the authentication requests corresponding to the mth tenant is the remote authentication judgment policy, wherein the first threshold value is greater than the second threshold value; the processing unit is further configured to process the N authentication requests according to the authentication judgment policy corresponding to each authentication request in the N authentication requests.

7. The apparatus according to claim 6, wherein the processing unit is further configured to: in a case where the authentication judgment policy corresponding to at least one authentication request in the N authentication requests is the local authentication judgment policy, when a first permission policy is queried in a cloud service cluster, determine whether to allow the at least one authentication request according to the at least one authentication request and the first permission policy; or, in a case where the authentication judgment policy corresponding to at least one authentication request in the N authentication requests is the local authentication judgment policy, when a first permission policy cannot be queried in a cloud service cluster, the transceiving unit is further configured to send a query message to an identity recognition and access management (IAM) service cluster, the query message being used to acquire a second permission policy, the second permission policy being a permission policy saved in the IAM service cluster; the transceiving unit is further configured to receive the second permission policy sent from the IAM service cluster; the processing unit is further configured to determine whether to allow the at least one authentication request according to the at least one authentication request and the second permission policy.

8. The apparatus according to claim 6 or 7, wherein in a case where the authentication judgment policy corresponding to at least one authentication request in the N authentication requests is the remote authentication judgment policy, the transceiving unit is further configured to send the at least one authentication request to an IAM service cluster; the transceiving unit is further configured to receive an authentication result corresponding to the at least one authentication request sent from the IAM service cluster; the processing unit is further configured to determine whether to allow the at least one authentication request according to the authentication result corresponding to the at least one authentication request sent from the IAM service cluster.

9. The apparatus of claim 8, wherein, the transceiving unit is further configured to: in a case where the at least one authentication request is not allowed, determine whether to allow the at least one authentication request according to resource information requested to be accessed by the at least one authentication request, the resource information requested to be accessed by the authentication request comprising at least one or more of the following information: resource level, resource type.

10. The apparatus of claim 7, wherein the transceiver is further configured to obtain format information of the first permission policy and / or format information of the second permission policy. The processing unit is further configured to convert format information of a resource type in the format information of the first permission policy and / or convert format information of a resource type in the format information of the second permission policy. The system comprises a management device, a cloud service cluster as claimed in any one of claims 2 to 5, an identity and access management (IAM) service cluster, 11. A system for authentication, characterized by The management device is configured to configure a first permission policy for the cloud service cluster and a second permission policy for the IAM service cluster, the first permission policy being a permission policy stored in the cloud service cluster, and the second permission policy being a permission policy stored in the IAM service cluster. The IAM service cluster receives at least one authentication request from N authentication requests sent by the cloud service cluster. The IAM service cluster determines an authentication result corresponding to the at least one authentication request according to the second permission policy and the at least one authentication request. The IAM service cluster sends the authentication result corresponding to the at least one authentication request to the cloud service cluster. The IAM service cluster determines an authentication result corresponding to the at least one authentication request according to the second permission policy and the at least one authentication request, comprising:

12. The system of claim 11, wherein, In the case that the at least one authentication request is queried in the second permission policy, it is determined that the at least one authentication request is allowed; or In the case that the at least one authentication request is not queried in the second permission policy, it is determined that the at least one authentication request is not allowed.

13. The system of claim 11 or 12, wherein the IAM service cluster receives a query message from the cloud service cluster, the query message being used to obtain the second permission policy. The IAM service cluster sends the second permission policy to the cloud service cluster.

14. An authentication apparatus, comprising a processor and a memory, the memory being configured to store instructions, and the processor being configured to read the instructions stored in the memory to perform the method of any one of claims 1 to 5.

15. A computer-readable storage medium, comprising a computer program, when the computer program is executed on a computer, the computer performs the method of any one of claims 1 to 5. ​ ​

Images