Cloud service-based authentication method and device, electronic equipment and storage medium

Abstract

The present disclosure provides a cloud service-based authentication method, relates to computers and fields, and particularly relates to the fields of big data technology and database technology. A specific implementation scheme is as follows: in response to receiving a first request, obtaining target authentication information according to the first request; and performing authentication according to the target authentication information to obtain an authentication result, wherein the first request is generated according to target identification information and first permission information required for performing a target operation on a target object in a target database. The present disclosure also provides a cloud service-based authentication device, an electronic device and a storage medium.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and more particularly to big data technology and database technology. More specifically, this disclosure provides an authentication method, apparatus, electronic device, and storage medium based on cloud services. Background Technology

[0002] Database infrastructure tools can process data in a database. For example, Hive can be used to process structured data in the distributed file system Hadoop. Database infrastructure tools can also provide access control tools to control whether users can access or modify data in the database. Summary of the Invention

[0003] This disclosure provides an authentication method, apparatus, device, and storage medium based on cloud services.

[0004] According to the first aspect, a cloud service-based authentication method is provided, the method comprising: in response to receiving a first request, obtaining target authentication information according to the first request; and performing authentication according to the target authentication information to obtain an authentication result, wherein the first request is generated based on target identification information and first permission information required to perform target operations on target objects in the target database.

[0005] According to the second aspect, a cloud service-based authentication method is provided, the method comprising: in response to a request to perform a target operation on a target object in a target database, determining target identification information and first permission information required to perform the target operation; generating a first request based on the target identification information and the first permission information; and sending the first request via a data transmission link with a cloud service platform.

[0006] According to a third aspect, a cloud service-based authentication device is provided, the device comprising: a first acquisition module, configured to acquire target authentication information according to the first request in response to receiving a first request; and an authentication module, configured to perform authentication according to the target authentication information and obtain an authentication result, wherein the first request is generated based on target identification information and first permission information required to perform target operations on target objects in the target database.

[0007] According to the fourth aspect, a cloud service-based authentication device is provided, the device comprising: a second determining module, configured to determine first permission information required to perform the target operation in response to a request to perform a target operation on a target object in a target database; a second generating module, configured to generate a first request based on the target identification information and the first permission information; and a second sending module, configured to send the first request via a data transmission link with a cloud service platform.

[0008] According to a fifth aspect, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform a method provided according to the present disclosure.

[0009] According to a sixth aspect, a non-transitory computer-readable storage medium is provided storing computer instructions for causing a computer to perform the methods provided in this disclosure.

[0010] According to a seventh aspect, a computer program product is provided, including a computer program that, when executed by a processor, implements the method provided in this disclosure.

[0011] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0012] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0013] Figure 1 This is an exemplary system architecture diagram of an authentication method and apparatus based on cloud services that can be applied according to an embodiment of the present disclosure;

[0014] Figure 2 This is a flowchart of a cloud service-based authentication method according to an embodiment of this disclosure;

[0015] Figure 3 This is a schematic diagram of a cloud service-based authentication method according to an embodiment of the present disclosure;

[0016] Figure 4 This is a flowchart of a cloud service-based authentication method according to an embodiment of this disclosure;

[0017] Figure 5 This is a schematic diagram of a cloud service-based authentication method according to an embodiment of the present disclosure;

[0018] Figure 6 This is a block diagram of a cloud service-based authentication device according to an embodiment of the present disclosure;

[0019] Figure 7 This is a block diagram of a cloud service-based authentication device according to an embodiment of the present disclosure; and

[0020] Figure 8 This is a block diagram of an electronic device using a cloud service-based authentication method according to an embodiment of the present disclosure. Detailed Implementation

[0021] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0022] In related technologies, cloud service platforms can provide data storage services. For example, a cloud service platform can integrate with or connect to one or more Hive-based databases. Users of the cloud service platform can access data within the Hive-based databases.

[0023] For example, a Hive-based database deployed on a local server can store local user information and other data. This local user information includes information about the main user Admin A and the sub-user User A. The main user Admin A, such as an administrator, can configure permission information for the sub-user User A to achieve permission control at the database, table, and field levels. The cloud service platform can connect to this Hive-based database. At this time, a user on the cloud service platform (e.g., user User B) can request access to data within the Hive-based database. Since the local user information does not include user User B's information, according to the permission control methods in related technologies, user User B directly has administrator privileges. The main user Admin A cannot configure permissions for user User B, and therefore cannot achieve permission control over user User B on the cloud service platform.

[0024] For example, a Hive-based database deployed on a cloud service platform stores some user information and other data for the cloud service platform. This user information includes information about the main user Admin C and the sub-user User C. Another user on the cloud service platform, User D, can request access to the data in the Hive-based database. Since this user information does not include User D's information, according to the access control methods in related technologies, User D directly has administrator privileges. The main user Admin C cannot configure permissions for User D, and therefore cannot achieve access control over another user, User D, on the cloud service platform.

[0025] Figure 1 This is a schematic diagram of an exemplary system architecture for applying cloud-based authentication methods and apparatus according to an embodiment of this disclosure. It should be noted that... Figure 1The examples shown are merely examples of system architectures that can be applied to the embodiments of this disclosure, in order to help those skilled in the art understand the technical content of this disclosure, but do not mean that the embodiments of this disclosure cannot be used in other devices, systems, environments or scenarios.

[0026] like Figure 1 As shown, the system architecture 100 according to this embodiment may include terminal device 1011, terminal device 1012, terminal device 1013, network 102, and cloud service platform 103. Network 102 is used as a medium to provide a communication link between the terminal devices and the cloud service platform 103. Network 102 may include various connection types, such as wired and / or wireless communication links, etc.

[0027] Users can use terminal devices to interact with server 103 via network 102 to receive or send messages, etc. Terminal devices can be various electronic devices, including but not limited to smartphones, tablets, laptops, etc.

[0028] For example, cloud service platform 103 can connect to one or more databases. User B, a user of the cloud service platform, can interact with cloud service platform 103 via network 102 through terminal device 1011 to request access to data in a database connected to the cloud service platform.

[0029] For example, cloud service platform 103 may have one or more databases deployed within it. User D, a user of the cloud service platform, can interact with cloud service platform 103 via network 102 through terminal device 1012 to request access to data in one of the databases deployed within the cloud service platform.

[0030] Figure 2 This is a flowchart of a cloud service-based authentication method according to an embodiment of the present disclosure.

[0031] like Figure 2 As shown, the method 200 can be deployed on a cloud service platform and may include operations S210 to S220.

[0032] In operation S210, in response to receiving the first request, the target authentication information is obtained according to the first request.

[0033] In this embodiment of the disclosure, the first request is generated based on the target identification information and the first permission information required to perform the target operation on the target object in the target database.

[0034] For example, target identification information could be the identification information of a user on a cloud service platform that accesses the target database through cloud services.

[0035] For example, the target database could be a Hive-based database.

[0036] For example, the target object can be the database itself, a data table in the database, or data in a field of a data table.

[0037] For example, target operations can include viewing, managing, reading, writing, and authorizing operations on a database. Alternatively, target operations can be viewing, managing, reading, writing, and authorizing operations on a single data table. Or, target operations can be reading or writing operations on a single field. In some examples, target operations can be obtained by parsing the SQL (Structured Query Language) statement issued by the user.

[0038] For example, a user named User E on a cloud service platform can request to perform a write operation on a table B in a Hive-based database A. Performing a write operation on this table requires corresponding primary permission information. This primary permission information can be generated based on User E's identification information.

[0039] In this embodiment of the disclosure, target identification information can be obtained.

[0040] For example, target identification information can be obtained based on a first request. This first request can be generated based on the target identification information and first permission information.

[0041] In this embodiment of the disclosure, second permission information set according to the target identification information can be obtained.

[0042] For example, the second permission information can be set by the first user based on the target identifier information. In one example, the first user can be a user of the cloud service platform. This first user's information is not stored in the target database. In another example, the first user can be a user of the cloud service platform. This first user's information can be stored in the target database. In one example, the second permission information set by the first user based on the target identifier information can be "can access table B in database A". In another example, the second permission information set by the first user based on the target identifier information can be "can access table D in database C".

[0043] In this embodiment of the disclosure, target authentication information can be generated based on target identification information and second permission information.

[0044] For example, target authentication information may include first sub-target authentication information and second sub-target authentication information.

[0045] For example, first sub-target authentication information can be generated based on target identification information. In one example, the first sub-target authentication information is an encrypted first key.

[0046] For example, second sub-target authentication information can be generated based on the second permission information. In one example, the second sub-target authentication information is an encrypted second key.

[0047] In this embodiment of the disclosure, configuration information can be generated based on the target authentication information.

[0048] For example, configuration information can be stored in a predetermined storage location on the cloud service platform for quick authentication.

[0049] When operating S220, authentication is performed based on the target authentication information, and the authentication result is obtained.

[0050] In this embodiment of the disclosure, the target database can be determined based on the second request in response to receiving the second request, prior to receiving the first request.

[0051] For example, the second request could be generated when performing a related operation on the target database. In one example, the related operation could be when user E selects data from database A while performing data analysis using the cloud service platform's data analysis module. In this case, a second request can be generated. Based on this second request, database A can then be identified as the target database.

[0052] In this embodiment of the disclosure, a data transmission link with the target database can be established.

[0053] For example, a data transmission link can be used to transmit data within a target database, a first request, authentication results, etc. In one example, the data transmission link includes at least the following devices: a terminal device corresponding to the target identification information, a target database, and an authentication module. User E can request access to data in the target database through the data transmission link. The target database can request authentication from the authentication module through the data transmission link. The authentication module can transmit the authentication result to the target database through the data transmission link. Based on the authentication result, the target database determines whether to transmit its requested access data to the terminal device corresponding to the target identification information.

[0054] It should be noted that the terminal device corresponding to the target identification information can be, for example... Figure 1 The cloud service platform 103 establishes a connection to perform subsequent operations to establish a data transmission link with the target database.

[0055] In this embodiment of the disclosure, in response to receiving a first request via a data transmission link, first authorization information can be obtained based on the first request.

[0056] For example, after a data transmission link is established, the virtual module used for authentication can receive the first request, parse it, and obtain the first permission information. In one example, the first permission information could be "to perform an access operation on data table B in database A". The access operation can include read and write operations.

[0057] In this embodiment of the disclosure, authentication can be performed based on the target authentication information and the first permission information to obtain the authentication result.

[0058] For example, based on the second sub-target authentication information in the target authentication information, the second permission information can be obtained. In one example, the second permission information is "Can access table B in database A". The first permission information could be "Perform access operations on table B in database A". Authentication will result in a successful authentication result. In another example, the second permission information is "Can access table D in database C". The first permission information could be "Perform access operations on table B in database A". Authentication will result in a failed authentication result.

[0059] In this embodiment of the disclosure, the authentication result can be sent via a data transmission link.

[0060] For example, the authentication result can be sent to the target database via a data transmission link.

[0061] Through the embodiments disclosed herein, an authentication module is deployed on the cloud service platform, providing users accessing the Hive-based database via the cloud service with permissions at three granularities: database, table, and field. This achieves fine-grained access control. The Hive-based database also does not need to store the massive user information of the cloud service platform, thus not affecting its performance. Therefore, different granularities of permissions can be flexibly configured for users within the cloud service platform.

[0062] It should be noted that the target identification information in this disclosure is not identification information for a specific user and does not reflect the personal information of a specific user.

[0063] Figure 3 This is a schematic diagram of a cloud service-based authentication method according to an embodiment of the present disclosure.

[0064] like Figure 3As shown, the cloud service platform 310 deploys databases A 311 and C 312. Terminal device 320 can connect to interface 314 provided by the cloud service platform 310 to establish a connection between the terminal and the cloud service platform. Users of terminal device 320 can request to select database A 311 as the target database. Upon receiving the second request to select database A 311 as the target database, the cloud service platform 310 establishes a data transmission link between interface 314, database A 311, and the authentication module 313.

[0065] Next, the user requests a write operation on table B in database A 311 via terminal device 320. Database A 311 receives this request and generates a first request based on the first permission information required to perform the write operation on table B in database A 311 and the user's target identifier information. The first request is sent to the authentication module 313 via the data transmission link. The authentication module 313 receives the first request, performs authentication, and obtains an authentication result. The authentication result is sent to database A, which determines whether to allow the write operation on table B in database A 311 based on the authentication result.

[0066] It should be noted that in this embodiment of the disclosure, database A 311 is deployed on cloud service platform 310. In other embodiments, database A may be deployed on a local server, and cloud service platform 310 may be deployed via, for example... Figure 1 Network 102 connects to the local server to connect to database A.

[0067] Figure 4 This is a flowchart of a cloud service-based authentication method according to an embodiment of the present disclosure.

[0068] like Figure 4 As shown, the method 400 can be deployed on a database, including operations S410 to S430.

[0069] In operation S410, in response to a request to perform a target operation on a target object in the target database, target identification information and first permission information required to perform the target operation are determined.

[0070] For example, User E of a cloud service platform can request to perform a write operation on table B in a Hive-based database A. The first permission information required to perform a write operation on table B in Hive-based database A can be determined.

[0071] For example, target identification information could be the identification information of a user on a cloud service platform that accesses the target database through cloud services.

[0072] For example, the target database could be a Hive-based database.

[0073] For example, the target object can be the database itself, a data table in the database, or data in a field of a data table.

[0074] For example, the target operation could be a database view operation, management operation, read operation, write operation, or authorization operation. Or, it could be a data table view operation, management operation, read operation, write operation, or authorization operation. Or, it could be a field read operation or write operation. In some examples, the target operation can be obtained by parsing the SQL statement issued by the user.

[0075] When operating S420, a first request is generated based on the target identifier information and the first permission information.

[0076] For example, a first request can be generated based on the first permission information required to perform a write operation on table B in a Hive-based database A, as well as the target identifier information. In one example, the target identifier information can be determined when a request to perform a target operation on a target object in the target data is received.

[0077] When operating the S430, the first request is sent via the data transmission link with the cloud service platform.

[0078] For example, a first request can be sent to the authentication module in the cloud service platform via a data transmission link, so that the authentication module can perform authentication.

[0079] In this embodiment of the disclosure, the authentication result can be received via a data transmission link.

[0080] For example, after receiving the first request, the authentication module performs authentication and obtains the authentication result. The authentication result is then sent to the target database, such as database A, via a data transmission link.

[0081] In this embodiment of the disclosure, a target operation can be performed on a target object in the target database in response to an authentication success result.

[0082] For example, database A can allow write operations to be performed on table B in Hive-based database A based on the authentication result that passes authentication.

[0083] It should be noted that the target identification information in this disclosure is not identification information for a specific user and does not reflect the personal information of a specific user.

[0084] Figure 5 This is a schematic diagram of a cloud service-based authentication method according to an embodiment of the present disclosure.

[0085] like Figure 5 As shown, the cloud service platform 310 deploys databases A 311 and C 312. Terminal device 320 can connect to interface 314 provided by the cloud service platform 310 to establish a connection between the terminal and the cloud service platform. Users of terminal device 320 can request to select database A as the target database. Upon receiving the second request to select database A as the target database, the cloud service platform 310 establishes a data transmission link between interface 314, database A 311, and the authentication module 313. In one example, database A 311 deploys a plugin 501. This plugin 501 can be a Hive-Catelog plugin, providing an authentication interface between the user and database A within the cloud service platform. Upon receiving the second request to select database A as the target database, the cloud service platform 310 establishes a data transmission link between interface 314, plugin 501 in database A 311, and the authentication module 313.

[0086] Next, the user requests a write operation on table B in database A 311 via terminal device 320. Database A receives this request and generates a first request based on the first permission information and target identifier information required to perform the write operation on table B in database A 311. The first request is sent to the authentication module 313 via the data transmission link. The authentication module 313, upon receiving the first request, performs authentication to obtain an authentication result. Database A 311, upon receiving the authentication result, determines whether to allow a write operation on table B in database A 311. In one example, the Hive-based database has a database module for authentication. To control user permissions within the cloud service platform 310, the plugin 501 can, in response to a user accessing database A 311 within the cloud service platform, prevent the database module for authentication from performing authentication based on the first request and send the first request to the authentication module 313, so that authentication can be performed using the authentication module 313 deployed on the cloud service platform 310.

[0087] It should be noted that in this embodiment of the disclosure, database A 311 is deployed on platform 310. In other embodiments, database A may be deployed on a local server, and cloud service platform 310 may connect to the local server to connect to database A.

[0088] Figure 6 This is a block diagram of a cloud service-based apparatus according to an embodiment of the present disclosure.

[0089] like Figure 6 As shown, the device 600 may include a first acquisition module 610 and an authentication module 620.

[0090] The first acquisition module 610 is used to obtain target authentication information in response to receiving a first request.

[0091] The authentication module 620 is used to perform authentication based on the above target authentication information and obtain the authentication result.

[0092] The first request mentioned above is generated based on the target identification information and the first permission information required to perform the target operation on the target object in the target database.

[0093] In some embodiments, the apparatus 600 further includes: a first determining module, configured to determine the target database according to the second request in response to receiving a second request; an establishing module, configured to establish a data transmission link with the target database; the authentication module includes: an obtaining unit, configured to obtain the first permission information according to the first request in response to receiving the first request via the data transmission link; and an authentication unit, configured to perform authentication according to the target authentication information and the first permission information, and obtain an authentication result.

[0094] In some embodiments, the system further includes a first sending module, configured to send the authentication result via the aforementioned data transmission link.

[0095] In some embodiments, the system further includes: a second acquisition module for acquiring the target identification information; a third acquisition module for acquiring second permission information based on the target identification information; and a first generation module for generating the target authentication information based on the target identification information and the second permission information.

[0096] In some embodiments, the target authentication information includes first sub-target authentication information and second sub-target authentication information, and the first generation module includes: a first generation unit, configured to generate the first sub-target authentication information based on the target identification information; and a second generation unit, configured to generate the second sub-target authentication information based on the second permission information.

[0097] Figure 7 This is a block diagram of a cloud service-based apparatus according to an embodiment of the present disclosure.

[0098] like Figure 7 As shown, the device 700 may include a second determining module 710, a second generating module 720, and a second sending module 730.

[0099] The second determining module 710 is used to determine target identification information and first permission information required to perform the target operation in response to a request to perform a target operation on a target object in the target database.

[0100] The second generation module 720 is used to generate a first request based on the target identification information and the first permission information.

[0101] The second sending module 730 is used to send the aforementioned first request via a data transmission link with the cloud server cloud service platform.

[0102] In some embodiments, the system further includes: a receiving module, configured to receive an authentication result via the aforementioned data transmission link; and an execution module, configured to perform the aforementioned target operation on the aforementioned target object in the aforementioned target database in response to the aforementioned authentication result indicating that authentication has passed.

[0103] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0104] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0105] Figure 8 A schematic block diagram of an example electronic device 800 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0106] like Figure 8 As shown, device 800 includes a computing unit 801, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 802 or a computer program loaded from storage unit 808 into random access memory (RAM) 803. RAM 803 may also store various programs and data required for the operation of device 800. The computing unit 801, ROM 802, and RAM 803 are interconnected via bus 804. Input / output (I / O) interface 805 is also connected to bus 804.

[0107] Multiple components in device 800 are connected to I / O interface 805, including: input unit 806, such as keyboard, mouse, etc.; output unit 807, such as various types of monitors, speakers, etc.; storage unit 808, such as disk, optical disk, etc.; and communication unit 809, such as network card, modem, wireless transceiver, etc. Communication unit 809 allows device 800 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0108] The computing unit 801 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 801 performs the various methods and processes described above, such as cloud service-based authentication methods. For example, in some embodiments, the cloud service-based authentication method can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 808. In some embodiments, part or all of the computer program can be loaded and / or installed on device 800 via ROM 802 and / or communication unit 809. When the computer program is loaded into RAM 803 and executed by the computing unit 801, one or more steps of the cloud service-based authentication method described above can be performed. Alternatively, in other embodiments, the computing unit 801 can be configured to perform cloud service-based authentication methods by any other suitable means (e.g., by means of firmware).

[0109] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0110] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0111] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0112] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0113] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0114] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other.

[0115] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0116] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A cloud service-based authentication method applied to a cloud service platform, comprising: in response to receiving a second request, determining a target database according to the second request, the target database being one of a plurality of databases deployed in the cloud service platform or one of a plurality of servers connected to the cloud service platform; establishing a data transmission link between an interface provided by the cloud service platform to enable a terminal device to connect to the cloud service platform, a module for authentication deployed by the cloud service platform, and the target database, the target database being deployed with a database module for authentication and a plug-in for preventing the database module for authentication from performing authentication according to a first request; in response to receiving the first request via the data transmission link, obtaining target authentication information and first permission information required for performing a target operation on a target object in the target database according to the first request, the target object being the target database, a data table in the target database, or data of a field in the data table; performing authentication by the module for authentication deployed by the cloud service platform according to the target authentication information and the first permission information to obtain an authentication result, wherein the first request is generated according to target identification information and the first permission information required for performing the target operation on the target object in the target database; and sending the authentication result to the target database via the data transmission link. 2.The method of claim 1, further comprising: obtaining the target identification information; obtaining second permission information set according to the target identification information; generating the target authentication information according to the target identification information and the second permission information. The target authentication information comprises first sub-target authentication information and second sub-target authentication information.

3. The method of claim 2, wherein, The generating the target authentication information according to the target identification information and the second permission information comprises: generating the first sub-target authentication information according to the target identification information; and generating the second sub-target authentication information according to the second permission information. 4.A cloud service-based authentication method applied to a database, comprising: in response to a request for performing a target operation on a target object in a target database, determining target identification information and first permission information required for performing the target operation, the target database being determined from a plurality of databases deployed in a cloud service platform according to a second request or from a plurality of servers connected to the cloud service platform; generating a first request according to the target identification information and the first permission information; preventing a database module for authentication deployed by the database from performing authentication according to the first request; and sending the first request via a data transmission link established between an interface provided by the cloud service platform to enable a terminal device to connect to the cloud service platform, a module for authentication deployed by the cloud service platform, and the target database; and receiving an authentication result via the data transmission link, wherein the authentication result is obtained by the module for authentication deployed by the cloud service platform according to target authentication information and the first permission information. ​ ​ 5. The method of claim 4, further comprising: performing the target operation on the target object in the target database in response to the authentication result being passed.

6. A cloud service-based authentication apparatus applied to a cloud service platform, comprising: a first determination module configured to determine a target database according to a second request in response to receiving the second request, the target database being one of a plurality of databases deployed in the cloud service platform or one of a plurality of servers connected to the cloud service platform; a establishing module configured to establish a data transmission link between an interface provided by the cloud service platform to implement connection between a terminal device and the cloud service platform and a module for authentication deployed by the cloud service platform and the target database, the target database being deployed with a database module for authentication and a plug-in for preventing the database module for authentication from performing authentication according to a first request; a first acquisition module configured to acquire target authentication information according to the first request in response to receiving the first request via the data transmission link; an obtaining unit configured to obtain first permission information according to the first request in response to receiving the first request via the data transmission link; an authentication unit configured to perform authentication according to the target authentication information and the first permission information by the module for authentication deployed by the cloud service platform to obtain an authentication result, wherein the first request is generated according to target identification information and first permission information required for performing a target operation on a target object in the target database, a first sending module configured to send the authentication result via the data transmission link.

7. The apparatus of claim 6, further comprising: a second acquisition module configured to acquire the target identification information; a third acquisition module configured to acquire second permission information set according to the target identification information; a first generation module configured to generate the target authentication information according to the target identification information and the second permission information.

8. The apparatus of claim 7, wherein, the authentication information comprising first sub-target authentication information and second sub-target authentication information, the first generation module comprising: a first generation unit configured to generate the first sub-target authentication information according to the target identification information; a second generation unit configured to generate the second sub-target authentication information according to the second permission information.

9. A cloud service-based authentication apparatus applied to a database, comprising: a second determination module configured to determine target identification information and first permission information required for performing a target operation in response to a request for performing the target operation on a target object in a target database, the target database being determined from a plurality of databases deployed in a cloud service platform according to a second request or from a plurality of servers connected to the cloud service platform; a second generation module configured to generate a first request according to the target identification information and the first permission information, and prevent a database module for authentication deployed by the database from performing authentication according to the first request; a second sending module configured to send the first request via a data transmission link with the cloud service platform. A receiving module, configured to receive an authentication result via the data transmission link, wherein the authentication result is obtained according to target authentication information and the first permission information.

10. The apparatus of claim 9, further comprising: An executing module, configured to perform the target operation on the target object in the target database in response to the authentication result being passed.

11. An electronic device, comprising: at least one processor; and a memory connected with the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 5.

12. A non-transitory computer readable storage medium having stored thereon computer instructions, wherein, The computer instructions are used to enable the computer to perform the method of any one of claims 1 to 5.

13. A computer program product comprising a computer program which, when executed by a processor, implements the method of any one of claims 1 to 5.

Images