A list authentication method based on IAM extension

Abstract

The present invention relates to the technical field of list authentication, and provides a list authentication method based on IAM extension, including: a cloud product connected to SDK initiates an interface request to an authentication service; the authentication service receives the interface request and authenticates the received interface request; the cloud product connected to SDK obtains list authentication rules from the context of SDK, and parses and converts the obtained list authentication rules into conditional sql; the cloud product connected to SDK adds the conditional sql parsed and converted in step S3 to query conditions, and performs resource screening according to the final query conditions. The list authentication method based on IAM extension according to an exemplary embodiment of the present invention can reduce the user's use cost, has a flexible docking method, improves efficiency, and reduces complexity.

Description

Technical Field

[0001] The present invention relates to the technical field of list authentication, and in particular to a list authentication method based on IAM extension. Background Art

[0002] At present, public cloud products mainly use methods such as specifying an authentication scope, such as specifying a resource group, to authenticate list-type resources. That is, when authorizing an IAM (RAM) authorization subject, specify an authorization scope, such as selecting a resource group, and then assign the resources allowed / denied access to the resource group. When performing authentication, by querying the resources in the resource group, it is possible to distinguish which resources in the list are allowed to be accessed and which are denied resources, thereby screening the list-type resources.

[0003] Take IAM user A querying the ECS (cloud server) list as an example. The method flow chart is as follows: Figure 1 As shown. In actual applications, this method has the following shortcomings: 1. The process interaction is complex, which brings a certain amount of time overhead, and there may be a lag in the effectiveness of authorization. This is mainly reflected in the fact that the creation, modification, and deletion of cloud resources need to be notified to the resource group management-related microservices in a timely manner before the resources in the resource group can be moved in and out. After the resources in the resource group are moved in and out, the authentication service needs to be notified to perceive the changes in resource ownership; 2. The operation complexity is relatively increased, and it is inconsistent with the original cloud resource fine-grained authentication based on CRN, and the authentication configuration is inconsistent.

[0004] Therefore, how to provide an efficient and convenient list authentication method has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] In view of this, in order to overcome the deficiencies of the prior art, the present invention aims to provide a list authentication method based on IAM extension.

[0006] On the one hand, the present invention provides a list authentication method based on IAM extension, comprising:

[0007] Step S1: Connect to the cloud product of the SDK and initiate an interface request to the authentication service;

[0008] Step S2: The authentication service receives the interface request and authenticates the received interface request;

[0009] Step S3: The cloud product connected to the SDK obtains the list authentication rules requested by the authentication interface from the context of the SDK, and parses the obtained list authentication rules into conditional SQL;

[0010] Step S4: The cloud product connected to the SDK adds the conditional SQL parsed and transformed in step S3 to the query conditions, and screens resources according to the final query conditions.

[0011] Furthermore, the present invention is based on the list authentication method extended by IAM. In step S2, the received interface request is authenticated, including: when the interface request passes the authentication, the interface is subjected to list authentication; when the interface request fails the authentication, the failed authentication result is returned to the cloud product.

[0012] Furthermore, the present invention is based on the list authentication method extended by IAM. In step S2, when the interface request passes the authentication, the interface is subjected to list authentication, including: querying the list authentication configuration of the interface request, performing list authentication and generating list authentication rules according to the list authentication configuration obtained by the query, returning the list authentication result to the SDK, the SDK receiving the list authentication result, obtaining the list authentication rules, and storing the list authentication rules in the context of the SDK.

[0013] Furthermore, in the list authentication method based on IAM extension of the present invention, the authentication rules in step S3 include allowed access resource rules and denied access resource rules.

[0014] Furthermore, in the list authentication method based on IAM extension of the present invention, in step S3, the obtained list authentication rules are parsed and converted into conditional SQL, including: calling SDK to convert the obtained list authentication rules into conditional SQL.

[0015] Furthermore, in the list authentication method based on IAM extension of the present invention, in step S4, resources are screened according to the final query conditions, including: resources are screened according to the access resource rules corresponding to the conditional sql.

[0016] Furthermore, the present invention is based on the IAM extended list authentication method. In step S4, resources are screened according to the access resource rules corresponding to the conditional sql, including: the access resources finally allowed are the resources corresponding to the allowed access resource rules minus the resources corresponding to the intersection of the allowed access resource rules and the denied access resource rules.

[0017] On the other hand, the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed, the list authentication method based on IAM extension of the present invention is executed.

[0018] Finally, the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the IAM-based extended list authentication method of the present invention when executing the program.

[0019] The list authentication method based on IAM extension of the present invention has the following beneficial effects:

[0020] 1. The present invention implements list resource permission authentication by accessing the cloud product through SDK. Its usage mode is unchanged compared with the traditional cloud product authorization, thus reducing the user's usage cost.

[0021] 2. The present invention adopts the method of dynamically generating rules or SQL, which reduces the difficulty of understanding authentication for cloud product access. Even if you do not understand the authentication logic of IAM authentication, you can quickly connect. It customizes a whole set of resource screening rules and also provides SQL conditional access, and the connection method is flexible.

[0022] 3. The present invention uses cloud product access SDK to directly parse resource CRN and resource configuration to generate rules, and directly interacts with the access cloud product for data. Compared with the traditional method of collecting resource ownership from the cloud resource center, it reduces the intermediate links, improves efficiency and reduces complexity. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1 A flow chart of a method for an IAM user to query an ECS (cloud server) list in the prior art.

[0025] Figure 2 The figure is a flowchart of a list authentication method based on IAM extension according to the exemplary first embodiment of the present invention.

[0026] Figure 3 The figure is a flow chart of a list authentication method based on IAM extension according to the exemplary second embodiment of the present invention.

[0027] Figure 4 This is a schematic diagram of authentication rules in a list authentication method based on IAM extension according to the fourth exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0028] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0029] It should be noted that the following embodiments and features in the embodiments may be combined with each other in the absence of conflict; and, based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making any creative work are within the scope of protection of the present disclosure.

[0030] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0031] The nouns involved in the present invention are analyzed as follows:

[0032] IAM: Identity and Access Management (IAM) is a basic service provided by the cloud platform for permission management, access control and identity authentication.

[0033] CRN: Global resource descriptor, used to specify specific resources, in compliance with the unified specifications of various manufacturers. A complete CRN is cecloud:IAM:cn-wuhan:110000000001001:image / 123456. When modifying, querying, deleting resources based on resource type / ID / region / IAM user authentication, it is generally configured through the resource CRN in the authentication.

[0034] SDK: refers to the software development kit (Software Development Kit).

[0035] ECS: Elastic Compute Service (ECS) is an elastic and scalable IaaS (Infrastructure as a Service) computing service that includes components such as CPU, memory, cloud hard disk, and basic network.

[0036] Figure 2 FIG. 1 is a flowchart of a list authentication method based on IAM extension according to an exemplary first embodiment of the present invention. Figure 2 As shown, the method described in this embodiment includes:

[0037] Step S1: The cloud product connected to the SDK initiates an interface request to the authentication service;

[0038] Step S2: The authentication service receives the interface request and authenticates the received interface request;

[0039] Step S3: The cloud product connected to the SDK obtains the list authentication rules requested by the authentication interface from the context of the SDK, and parses the obtained list authentication rules into conditional SQL;

[0040] Step S4: The cloud product connected to the SDK adds the conditional SQL parsed and transformed in step S3 to the query conditions, and screens resources according to the final query conditions.

[0041] Figure 3 is a flowchart of a list authentication method based on IAM extension according to an exemplary second embodiment of the present invention. Figure 2 A preferred embodiment of the method is shown.

[0042] like Figure 3 As shown, in step S2 of the method of this embodiment, the received interface request is authenticated, including: when the interface request passes the authentication, the interface is list authenticated; when the interface request fails the authentication, the failed authentication result is returned to the cloud product.

[0043] When the interface request passes the authentication, the interface is subjected to list authentication, including: querying the list authentication configuration of the interface request, performing list authentication and generating list authentication rules according to the list authentication configuration obtained from the query, returning the list authentication result to the SDK, the SDK receiving the list authentication result, obtaining the list authentication rules, and storing the list authentication rules in the context of the SDK.

[0044] The third exemplary embodiment of the present invention provides a list authentication method based on IAM extension. Figure 2 and Figure 3 A preferred embodiment of the method is shown.

[0045] The authentication rules in step S3 of the method of this embodiment include allowed access resource rules and denied access resource rules.

[0046] In step S3 of the method of this embodiment, the obtained list authentication rules are parsed and converted into conditional SQL, including: calling SDK to convert the obtained list authentication rules into conditional SQL.

[0047] The fourth exemplary embodiment of the present invention provides a list authentication method based on IAM extension. Figure 2 and Figure 3 In the preferred embodiment of the method shown in FIG. 1 , in step S4 of the method of this embodiment, resource screening is performed according to the final query condition, including: performing resource screening according to the resource access rule corresponding to the condition sql. Specifically, Figure 4As shown, resources are screened according to the access resource rules corresponding to the conditional sql, including: the access resources finally allowed are the resources corresponding to the allowed access resource rules minus the resources corresponding to the intersection of the allowed access resource rules and the denied access resource rules.

[0048] The fifth exemplary embodiment of the present invention provides a list authentication method based on IAM extension. Figure 2 A preferred embodiment of the method is shown.

[0049] This embodiment takes a complete query of the CRN of an ECS image as an example, and the configured authentication policy content is as follows:

[0050] Allow access to ECS products, with region Wuhan, cloud account 110000000001001, resource type image, and resource ID containing 31.

[0051] At the same time, access to ECS products with region Wuhan, cloud account 110000000001001, resource type image, and resource ID starting with 3986 is denied.

[0052] The rules for generation are as follows:

[0053] Allowed access rules: cloud account equals 110000000001001, region equals cn-wuhan, resourceId fuzzy match (like) 31, resource_type equals image.

[0054] At the same time, a deny access rule is generated: cloud account is not equal to 110000000001001, region is not equal to cn-wuhan, resourceId fuzzy left match (not like) is other than 3986, and resource_type is not equal to image.

[0055] According to the above two rules, that is, (all the allow conditions are met at the same time) minus (the intersection of the deny conditions and all the allow conditions are met at the same time), the result is the allowed access resource.

[0056] According to the rules generated above, the corresponding SQL is generated. All the allowable rules are condition = or like condition set, and all the reject rules are ! = or not like condition set. Finally, the two condition result sets are connected by and.

[0057] On the other hand, the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed, the list authentication method based on IAM extension of the present invention is executed.

[0058] Finally, the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the IAM-based extended list authentication method of the present invention when executing the program.

[0059] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A list authentication method based on IAM extension, characterized in that: The method comprises: Step S1: The cloud product connected to the SDK initiates an interface request to the authentication service; Step S2: The authentication service receives the interface request and authenticates the received interface request; Step S3: The cloud product connected to the SDK obtains the list authentication rules requested by the authentication interface from the context of the SDK, and parses the obtained list authentication rules into conditional SQL; Step S4: The cloud product connected to the SDK adds the conditional SQL parsed and transformed in step S3 to the query conditions, and performs resource screening according to the final query conditions; In step S2, when the interface request passes the authentication, the interface is subjected to list authentication, including: querying the list authentication configuration of the interface request, performing list authentication and generating list authentication rules according to the list authentication configuration obtained by the query, returning the list authentication result to the SDK, the SDK receiving the list authentication result, obtaining the list authentication rule, and storing the list authentication rule in the context of the SDK; In step S3, the obtained list authentication rules are parsed and converted into conditional SQL, including: calling SDK to convert the obtained list authentication rules into conditional SQL; In step S4, resources are screened according to the final query condition, including: screening resources according to the access resource rules corresponding to the condition sql; The resource screening is performed according to the access resource rule corresponding to the conditional sql, including: the access resource finally allowed is the resource corresponding to the allowed access resource rule minus the resource corresponding to the intersection of the allowed access resource rule and the denied access resource rule.

2. According to the IAM extension-based list authentication method of claim 1, it is characterized in that: In step S2, the received interface request is authenticated, including: when the interface request passes the authentication, the interface is list authenticated; when the interface request fails the authentication, the failed authentication result is returned to the cloud product.

3. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 2 is performed.

4. A computer device, characterized in that: The computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the method according to any one of claims 1 to 2 when executing the program.

Images