Cloud platform login method, device, equipment and storage medium

Abstract

This disclosure provides a cloud platform login method, apparatus, device, and storage medium, applicable to the field of cloud computing technology. The method includes: responding to a user's redirection request, determining whether a first token is pre-stored; if the first token is pre-stored locally, sending the first token to a public cloud platform; if the public cloud platform successfully verifies the first token, receiving a second token, wherein the validity period of the first token is longer than that of the second token; and if the second token's validity period has not expired, sending the second token to the public cloud platform to perform an account login operation. Employing two tokens, where the second token is used for login and the first token is used to exchange for the second token, increases the automation and convenience of login, effectively balancing account security and login convenience.

Description

Technical Field

[0001] This disclosure relates to the field of cloud computing technology, and in particular to a cloud platform login method, apparatus, device, medium, and program product. Background Technology

[0002] Currently, various public cloud products exist both domestically and internationally, each corresponding to a different public cloud platform. These platforms typically use fixed secret_ID and secret_Key for signature verification during login. However, this method compromises the security of the cloud platform if data is lost or tampered with.

[0003] Therefore, designing a secure cloud platform login method has become an urgent technical problem to be solved. Summary of the Invention

[0004] In view of the above issues, this disclosure provides cloud platform login methods, devices, equipment, media, and program products.

[0005] According to a first aspect of this disclosure, a cloud platform login method is provided, the method being applied to a client, the method comprising: determining whether a first token is pre-stored, wherein the first token indicates that the client has successfully bound itself to a public cloud platform; if the first token is pre-stored, sending the first token to the public cloud platform; if the public cloud platform successfully verifies the first token, receiving a second token, wherein the validity period of the first token is greater than the validity period of the second token; and if the validity period of the second token has not expired, sending the second token to the public cloud platform to perform an account login operation.

[0006] According to an embodiment of this disclosure, after determining whether a first token is pre-stored, the method further includes: if the first token is not pre-stored, obtaining login parameters; sending the login parameters to the public cloud platform; and if the public cloud platform successfully verifies the login parameters, receiving the first token.

[0007] According to an embodiment of this disclosure, after sending the first token to the public cloud platform, the method further includes: receiving a new first token from the public cloud platform; and replacing and updating the original first token based on the new first token.

[0008] According to an embodiment of this disclosure, after receiving the second token, the method further includes: if the validity period of the second token expires, sending the first token to a public cloud platform to exchange for a new second token.

[0009] According to an embodiment of this disclosure, the first token and the second token are transmitted based on symmetric encryption. The step of sending the second token to the public cloud platform to perform the account login operation includes: sending the second token to the public cloud platform; and, if the public cloud platform verifies the validity of the second token, receiving a unique sub-identifier and a one-time password, and forwarding them to the front end so that the front end redirects to a specified resource page.

[0010] According to a second aspect of this disclosure, a cloud platform login method is provided, the method being applied to a public cloud platform, the method comprising: in response to receiving a first token, verifying the first token; if the first token is successfully verified, generating a second token, wherein the validity period of the first token is greater than the validity period of the second token; sending the second token to a client; in response to receiving the second token, verifying the second token; and if the validity verification of the second token is successful, completing the account login operation.

[0011] According to an embodiment of this disclosure, before verifying the login parameters in response to the received login parameters, the method further includes: verifying the login parameters in response to the received login parameters; generating the first token if the login parameters are successfully verified; and sending the first token to the client.

[0012] According to an embodiment of this disclosure, after verifying the first token in response to the received first token, the method further includes: generating a new first token if the first token is successfully verified; and sending the new first token to the client.

[0013] According to an embodiment of this disclosure, the first token and the second token are transmitted based on symmetric encryption. After receiving the second token from the client, the method further includes: obtaining a preset public key; and decrypting the second token based on the preset public key.

[0014] A third aspect of this disclosure provides a cloud platform login device, applied to a client. The device includes: a first token determination module for determining whether a first token is pre-stored, wherein the first token indicates that the client has successfully bound itself to a public cloud platform; a first token sending module for sending the first token to the public cloud platform if the first token is pre-stored; a second token receiving module for receiving a second token if the public cloud platform successfully verifies the first token, wherein the validity period of the first token is greater than the validity period of the second token; and a second token sending module for sending the second token to the public cloud platform if the validity period of the second token has not expired, to perform an account login operation.

[0015] The fourth aspect of this disclosure provides a cloud platform login device, which is applied to a public cloud platform. The device includes: a first token verification module, configured to verify the first token in response to a received first token; a second token generation module, configured to generate a second token if the first token is successfully verified, wherein the validity period of the first token is longer than the validity period of the second token; a second token delivery module, configured to send the second token to a client; a second token verification module, configured to verify the second token in response to receiving the second token; and an automated account login module, configured to complete the account login operation if the validity verification of the second token is successful.

[0016] A fifth aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the methods described above.

[0017] A sixth aspect of this disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the methods described above.

[0018] The seventh aspect of this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0019] In the embodiments disclosed herein, two types of tokens are employed: a second token for login and a first token for exchanging for the second token, thereby improving the security of cloud platform login. Furthermore, the first token has a longer validity period than the second token, allowing users to exchange the first token for the second token again before the first token expires, avoiding multiple manual login attempts and increasing the automation and convenience of login. This effectively balances account security and login convenience. Attached Figure Description

[0020] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0021] Figure 1 The diagram illustrates an application scenario of the cloud platform login method according to an embodiment of the present disclosure.

[0022] Figure 2 A flowchart illustrating a cloud platform login method according to an embodiment of the present disclosure is shown.

[0023] Figure 3 A flowchart illustrating a cloud platform login method according to an embodiment of the present disclosure is shown.

[0024] Figure 4 A flowchart illustrating a cloud platform login method according to an embodiment of the present disclosure is shown.

[0025] Figure 5 A flowchart illustrating a cloud platform login method according to an embodiment of the present disclosure is shown.

[0026] Figure 6 A flowchart illustrating a cloud platform login method according to an embodiment of the present disclosure is shown.

[0027] Figure 7 A flowchart illustrating a cloud platform login method according to an embodiment of the present disclosure is shown.

[0028] Figure 8 A flowchart illustrating a cloud platform login method according to an embodiment of the present disclosure is shown.

[0029] Figure 9A A flowchart illustrating a cloud platform login method according to an embodiment of the present disclosure is shown.

[0030] Figure 9B A flowchart illustrating another cloud platform login method according to an embodiment of this disclosure is shown schematically.

[0031] Figure 10 A schematic block diagram of a cloud platform login device according to an embodiment of the present disclosure is shown.

[0032] Figure 11 A schematic block diagram of a cloud platform login device according to an embodiment of the present disclosure is shown.

[0033] Figure 12 A block diagram schematically illustrates an electronic device suitable for implementing a cloud platform login method according to an embodiment of the present disclosure. Detailed Implementation

[0034] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0035] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0036] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0037] When using expressions such as "at least one of A, B, and C", they should generally be interpreted in accordance with the meaning that is commonly understood by a person skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B, and C, etc.).

[0038] In the technical solutions disclosed herein, the collection, storage, use, processing, transmission, provision, disclosure, and application of data (including but not limited to user personal information) comply with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and they do not violate public order and good morals.

[0039] To address the technical problems existing in the prior art, embodiments of this disclosure provide a cloud platform login method. The method is applied to a client and includes: determining whether a first token is pre-stored, wherein the first token indicates that the client has successfully bound itself to a public cloud platform; if the first token is pre-stored, sending the first token to the public cloud platform; if the public cloud platform successfully verifies the first token, receiving a second token, wherein the validity period of the first token is greater than the validity period of the second token; and if the validity period of the second token has not expired, sending the second token to the public cloud platform to perform an account login operation.

[0040] In the embodiments disclosed herein, two types of tokens are employed: a second token for login and a first token for exchanging for the second token, thereby improving the security of cloud platform login. Furthermore, the first token has a longer validity period than the second token, allowing users to exchange the first token for the second token again before the first token expires, avoiding multiple manual login attempts and increasing the automation and convenience of login. This effectively balances account security and login convenience.

[0041] Figure 1 The diagram illustrates an application scenario of the cloud platform login method according to an embodiment of the present disclosure.

[0042] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0043] Users can interact with server 105 via network 104 using at least one of the first terminal device 101, second terminal device 102, and third terminal device 103 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, second terminal device 102, and third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0044] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0045] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0046] It should be noted that the cloud platform login method provided in this embodiment can generally be executed by server 105. Correspondingly, the cloud platform login device provided in this embodiment can generally be located in server 105. The cloud platform login method provided in this embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the cloud platform login device provided in this embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0047] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0048] The following will be based on Figure 1 The described scene, through Figures 2 to 9B The cloud platform login method of the disclosed embodiments is described in detail.

[0049] Figure 2 A flowchart illustrating a cloud platform login method according to an embodiment of the present disclosure is shown.

[0050] like Figure 2 As shown, the cloud platform login method of this embodiment includes operations S210 to S240. The method is applied to a client, which can be configured on a first terminal device 101, a second terminal device 102, a third terminal device 103, or a server 105.

[0051] It is understood that the client of the cloud platform login method in this embodiment of the present disclosure can be configured on terminals 101, 102, 103 or server 105 as a single cloud platform client. The client of the cloud platform login method in this embodiment of the present disclosure can also be configured on terminals 101, 102, 103 or server 105 as a multi-cloud platform client. Here, a multi-cloud platform can be viewed as a management platform that can manage accounts from multiple different public cloud platforms.

[0052] In operation S210, it is determined whether a first token is pre-stored, wherein the first token indicates that the client has successfully bound to the public cloud platform.

[0053] Specifically, the first token indicates that the user's client has been successfully bound to the public cloud platform in the past. That is, after successful login authentication, the public cloud platform assigns an identifier to the client and sends it a first token. For example, this first token could be named refresh_token.

[0054] In operation S220, if the first token is pre-stored, the first token is sent to the public cloud platform.

[0055] Specifically, you can check whether the first token is pre-existing locally, or you can check whether the first token is pre-existing remotely.

[0056] In operation S230, if the public cloud platform successfully verifies the first token, it receives the second token, wherein the validity period of the first token is longer than the validity period of the second token.

[0057] Specifically, the first token has a long validity period but expires after one redemption, while the second token has a short validity period and can be used for login authentication. For example, the second token mentioned above could be named id_token.

[0058] In operation S240, if the second token has not expired, the second token is sent to the public cloud platform to perform the account login operation.

[0059] It is understandable that the account login operation involves the public cloud platform returning the corresponding resource interface to the client. It should be noted that the process from operation S230 to operation S240 is not real-time. After the client obtains the second token, it can choose not to perform any further action or interact with the public cloud platform immediately to complete the login.

[0060] In the embodiments disclosed herein, two types of tokens are employed: a second token for login and a first token for exchanging for the second token, thereby improving the security of cloud platform login. Furthermore, the first token has a longer validity period than the second token, allowing users to exchange the first token for the second token again before the first token expires, avoiding multiple manual login attempts and increasing the automation and convenience of login. This effectively balances account security and login convenience.

[0061] Figure 3 A flowchart illustrating a cloud platform login method according to an embodiment of the present disclosure is shown.

[0062] like Figure 3As shown, the cloud platform login method of this embodiment includes operations S310 to S330. Operations S310 to S330 can be executed after operation S210.

[0063] In operation S310, login parameters are obtained if the first token is not pre-stored.

[0064] In operation S320, the login parameters are sent to the public cloud platform.

[0065] In operation S330, if the public cloud platform successfully verifies the login parameters, the first token is received.

[0066] Specifically, the login parameters can be the user's cloud platform account and password. If the first token is not stored locally on the client, authentication is completed by performing a login operation.

[0067] Of course, in the actual implementation process, the data received from the public cloud platform at this time includes not only the first token, but also the identifier (or client_id) and the public key secret (or client_secret) assigned to the client by the public cloud platform, which are used by the public cloud platform to identify and authenticate the client later.

[0068] Figure 4 A flowchart illustrating a cloud platform login method according to an embodiment of the present disclosure is shown.

[0069] like Figure 4 As shown, the cloud platform login method of this embodiment includes operations S410 to S420 and operation S430. Operations S410 to S420 are executed after operation S220, and operation S430 is executed after operation S230.

[0070] In operation S410, a new first token is received from the public cloud platform.

[0071] In operation S420, the original first token is replaced and updated based on the new first token.

[0072] According to embodiments of this disclosure, after operation S420, the original first token is set to invalid. During each exchange of the first token for the second token, a new first token is generated and updated to ensure the timeliness of the first token.

[0073] In operation S430, if the second token expires, the first token is sent to the public cloud platform to exchange for a new second token.

[0074] If the second token expires, instead of requiring the user to log in again, the first token is used for redemption, and the first token has a relatively long validity period. This reduces the cumbersome login process.

[0075] Figure 5 A flowchart illustrating a cloud platform login method according to an embodiment of the present disclosure is shown.

[0076] like Figure 5 As shown, the cloud platform login method in this embodiment includes operations S510 to S520.

[0077] In operation S510, the second token is sent to the public cloud platform.

[0078] In operation S520, if the public cloud platform verifies the second token as valid, it receives a unique sub-identifier and a one-time password, and forwards them to the front end so that the front end redirects to the specified resource page.

[0079] Specifically, a unique sub-identifier (or uin) and a one-time password (or skey) are used to indicate successful login.

[0080] According to embodiments of this disclosure, the first token and the second token are transmitted using symmetric encryption. Specifically, the first token and the second token can be encrypted using the AES symmetric encryption algorithm.

[0081] Figure 6 A flowchart illustrating a cloud platform login method according to an embodiment of the present disclosure is shown.

[0082] like Figure 6 As shown, the cloud platform login method of this embodiment includes operations S610 to S650. This cloud platform login method can be applied to a public cloud platform, which can be configured on server 105.

[0083] In operation S610, in response to the received first token, the first token is verified.

[0084] In operation S620, if the first token is successfully verified, a second token is generated, wherein the validity period of the first token is longer than the validity period of the second token.

[0085] In operation S630, the second token is sent to the client.

[0086] In operation S640, in response to receiving the second token, the second token is verified.

[0087] In operation S650, if the validity of the second token is successfully verified, the account login operation is completed.

[0088] According to embodiments of this disclosure, the first token and the second token are transmitted based on symmetric encryption. After receiving the second token from the client, the method further includes: obtaining a preset public key; and decrypting the second token based on the preset public key. Specifically, the preset public key is generated during the client binding phase, along with the client's identifier, allowing the public cloud platform to distinguish between different clients.

[0089] In the embodiments disclosed herein, two types of tokens are employed: a second token for login and a first token for exchanging for the second token, thereby improving the security of cloud platform login. Furthermore, the first token has a longer validity period than the second token, allowing users to exchange the first token for the second token again before the first token expires, avoiding multiple manual login attempts and increasing the automation and convenience of login. This effectively balances account security and login convenience.

[0090] Of course, in some cases, such as when initial login requires binding, the authentication information received by the public cloud platform is not a token, but login parameters. Therefore, binding is required for the client undergoing initial authentication.

[0091] Figure 7 A flowchart illustrating a cloud platform login method according to an embodiment of the present disclosure is shown.

[0092] like Figure 7 As shown, the cloud platform login method of this embodiment includes operations S710 to S730.

[0093] In operation S710, the login parameters are verified in response to the received login parameters.

[0094] In operation S720, if the login parameters are successfully verified, the first token is generated.

[0095] In operation S730, the first token is sent to the client.

[0096] Upon initial login, login parameters need to be assembled. If a normal login process is successful, the public cloud platform generates a first token and returns it to the client. In subsequent login attempts, the first token can be used to exchange for a second token, thus enabling page redirection after login.

[0097] Figure 8A flowchart illustrating a cloud platform login method according to an embodiment of the present disclosure is shown.

[0098] like Figure 8 As shown, the cloud platform login method of this embodiment includes operations S810 to S820. Operations S810 to S820 are executed after operation S610.

[0099] In operation S810, if the first token is successfully verified, a new first token is generated.

[0100] Specifically, once a new first token is generated, the public cloud platform determines that the original first token is invalid.

[0101] In operation S820, the new first token is sent to the client.

[0102] The existing first token will be set to invalid. During each exchange of the first token for the second token, a new first token will be generated and updated to ensure the timeliness and security of the first token.

[0103] The cloud platform login method of this disclosure will be described in detail below with specific examples:

[0104] Figure 9A A flowchart illustrating a cloud platform login method according to an embodiment of the present disclosure is shown.

[0105] like Figure 9A As shown, Figure 9A This illustration shows the process of assigning tokens without account binding.

[0106] First, the client initiates a binding process, which allows the public cloud platform to assign a unique client_id and client_secret to the client. The client_secret serves as a public key and can be used to decrypt the encrypted first token (refresh_token) and the encrypted second token (id_token).

[0107] Then, the client-side triggers the user's environment selection and account binding operation, sending client_id, state, redirect_uri, and signature to the public cloud platform. Here, client_id is a unique ID assigned to the client by the cloud platform; state is unique client identifier (e.g., which public cloud environment is being selected, a unique ID for multi-cloud platform users, etc.), which is synchronously returned after authorization from the public cloud platform; redirect_uri is the address to which the public cloud platform redirects to the client after authorization; and signature is a signature added to prevent data tampering, as data transmission in this embodiment does not use HTTPS. It should be noted that if the user's client is an expired user and is being re-bound, the following parameters can be added to automatically fill in the username when redirecting to the response page: user_name (username), owner_uin (owner account uin), and uin (user uin). Understandably, when users log in to multiple public cloud platforms in different environments through a unified multi-cloud platform, multiple different first- and second-level accounts are required. Among them, owner_uin corresponds one-to-one with the account on the multi-cloud platform, and uin corresponds one-to-one with the public cloud platform in different environments under the multi-cloud platform. One multi-cloud platform account includes accounts on multiple public cloud platforms in different environments.

[0108] Finally, after validating the client_id, state, redirect_uri, and signature on the public cloud platform, a refresh_token is generated through the corresponding process. The received redirect_uri is then used for redirection, allowing the client to receive and save these parameters.

[0109] Figure 9B A flowchart illustrating another cloud platform login method according to an embodiment of this disclosure is shown schematically.

[0110] like Figure 9B As shown, Figure 9B This illustration shows the process of logging in using a pre-stored token when an account is already linked.

[0111] First, if an account is already bound, send the refresh_token, client_id, and signature to the public cloud platform for verification. The public cloud platform then verifies the received refresh_token. If the refresh_token is valid, it returns the id_token and a new refresh_token. However, if the refresh_token has expired, the client needs to re-initiate the authorization and binding process, restarting the above steps. Figure 9A The process in the process.

[0112] Then, when the client needs to log in, it sends an id_token to the public cloud platform. The public cloud platform obtains the corresponding client's public key (client_secret), decrypts the id_token, and calls the relevant interface for verification. The client's public key was generated by the public cloud platform when the client was bound and is pre-embedded in both the client and the public cloud platform.

[0113] Finally, if the public cloud platform successfully verifies the id_token, it returns uin (a unique sub-identifier) ​​and skey (a one-time password) to the client. uin and skey are the information required for login. The uin is parsed from the id_token, along with the owner uin. The skey is generated from this user-related data.

[0114] Based on the above-described cloud platform login method, this disclosure also provides a cloud platform login device. The following will combine... Figure 10 and Figure 11 The login device for this cloud platform is described in detail.

[0115] Figure 10 A schematic block diagram of a cloud platform login device according to an embodiment of the present disclosure is shown.

[0116] like Figure 10 As shown, the cloud platform login device 1000 of this embodiment includes a first token judgment module 1010, a first token sending module 1020, a second token receiving module 1030, and a second token sending module 1040. This cloud platform login device 1000 is applied to a client.

[0117] The first token determination module 1010 is used to determine whether a first token is pre-stored, wherein the first token indicates that the client has been successfully bound to the public cloud platform. In one embodiment, the first token determination module 1010 can be used to perform the operation S210 described above, which will not be repeated here.

[0118] The first token sending module 1020 is used to send the first token to the public cloud platform when the first token is pre-stored. In one embodiment, the first token sending module 1020 can be used to perform the operation S220 described above, which will not be repeated here.

[0119] The second token receiving module 1030 is used to receive a second token when the public cloud platform successfully verifies the first token, wherein the validity period of the first token is longer than the validity period of the second token. In one embodiment, the second token receiving module 1030 can be used to perform the operation S230 described above, which will not be repeated here.

[0120] The second token sending module 1040 is used to send the second token to the public cloud platform to perform the account login operation if the validity period of the second token has not expired. In one embodiment, the second token sending module 1040 can be used to perform the operation S240 described above, which will not be repeated here.

[0121] In the embodiments disclosed herein, two types of tokens are employed: a second token for login and a first token for exchanging for the second token, thereby improving the security of cloud platform login. Furthermore, the first token has a longer validity period than the second token, allowing users to exchange the first token for the second token again before the first token expires, avoiding multiple manual login attempts and increasing the automation and convenience of login. This effectively balances account security and login convenience.

[0122] According to embodiments of this disclosure, any plurality of modules among the first token determination module 1010, the first token sending module 1020, the second token receiving module 1030, and the second token sending module 1040 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the first token determination module 1010, the first token sending module 1020, the second token receiving module 1030, and the second token sending module 1040 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in a suitable combination of any of these. Alternatively, at least one of the first token judgment module 1010, the first token sending module 1020, the second token receiving module 1030, and the second token sending module 1040 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0123] Figure 11 A schematic block diagram of a cloud platform login device according to an embodiment of the present disclosure is shown.

[0124] like Figure 11 As shown, the cloud platform login device 1100 of this embodiment includes a first token verification module 1110, a second token generation module 1120, a second token delivery module 1130, a second token verification module 1140, and an automated account login module 1150. This cloud platform login device 1100 is applied to a public cloud platform.

[0125] The first token verification module 1110 is used to verify the first token in response to the received first token. In one embodiment, the first token verification module 1110 can be used to perform the operation S610 described above, which will not be repeated here.

[0126] The second token generation module 1120 is used to generate a second token if the first token verification is successful, wherein the validity period of the first token is longer than the validity period of the second token. In one embodiment, the second token generation module 1120 can be used to perform the operation S620 described above, which will not be repeated here.

[0127] The second token sending module 1130 is used to send the second token to the client. In one embodiment, the second token sending module 1130 can be used to perform the operation S630 described above, which will not be repeated here.

[0128] The second token verification module 1140 is used to verify the second token in response to receiving the second token. In one embodiment, the second token verification module 1140 can be used to perform the operation S640 described above, which will not be repeated here.

[0129] The automated account login module 1150 is used to complete the account login operation when the validity verification of the second token is successful. In one embodiment, the automated account login module 1150 can be used to perform the operation S650 described above, which will not be repeated here.

[0130] In the embodiments disclosed herein, two types of tokens are employed: a second token for login and a first token for exchanging for the second token, thereby improving the security of cloud platform login. Furthermore, the first token has a longer validity period than the second token, allowing users to exchange the first token for the second token again before the first token expires, avoiding multiple manual login attempts and increasing the automation and convenience of login. This effectively balances account security and login convenience.

[0131] According to embodiments of this disclosure, any multiple modules among the first token verification module 1110, the second token generation module 1120, the second token delivery module 1130, the second token verification module 1140, and the automated account login module 1150 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the first token verification module 1110, the second token generation module 1120, the second token delivery module 1130, the second token verification module 1140, and the automated account login module 1150 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the first token verification module 1110, the second token generation module 1120, the second token delivery module 1130, the second token verification module 1140, and the account automated login module 1150 can be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0132] Figure 12 A block diagram schematically illustrates an electronic device suitable for implementing a cloud platform login method according to an embodiment of the present disclosure.

[0133] like Figure 12 As shown, an electronic device 1200 according to an embodiment of the present disclosure includes a processor 1201, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1202 or a program loaded from a storage portion 1208 into a random access memory (RAM) 1203. The processor 1201 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1201 may also include onboard memory for caching purposes. The processor 1201 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0134] RAM 1203 stores various programs and data required for the operation of electronic device 1200. Processor 1201, ROM 1202, and RAM 1203 are interconnected via bus 1204. Processor 1201 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 1202 and / or RAM 1203. It should be noted that the programs may also be stored in one or more memories other than ROM 1202 and RAM 1203. Processor 1201 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0135] According to embodiments of this disclosure, the electronic device 1200 may further include an input / output (I / O) interface 1205, which is also connected to the bus 1204. The electronic device 1200 may also include one or more of the following components connected to the I / O interface 1205: an input section 1206 including a keyboard, mouse, etc.; an output section 1207 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1208 including a hard disk, etc.; and a communication section 1209 including a network interface card such as a LAN card, modem, etc. The communication section 1209 performs communication processing via a network such as the Internet. A drive 1210 is also connected to the I / O interface 1205 as needed. A removable medium 1211, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 1210 as needed so that computer programs read from it can be installed into the storage section 1208 as needed.

[0136] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0137] According to embodiments of this disclosure, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 1202 and / or RAM 1203 and / or one or more memories other than ROM 1202 and RAM 1203 described above.

[0138] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the item recommendation method provided in the embodiments of this disclosure.

[0139] When the computer program is executed by the processor 1201, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0140] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 1209, and / or installed from the removable medium 1211. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0141] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 1209, and / or installed from the removable medium 1211. When the computer program is executed by the processor 1201, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0142] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0143] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0144] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0145] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A cloud platform login method, characterized in that, The method is applied to a client, and the method includes: Determine whether a first token is pre-stored, wherein the first token indicates that the client has successfully bound itself to the public cloud platform; If the first token is pre-stored, the first token will be sent to the public cloud platform; If the public cloud platform successfully verifies the first token, it receives the second token, wherein the validity period of the first token is longer than that of the second token; wherein the first token expires after successful verification and is exchanged for a new first token; and If the validity period of the second token has not expired, the second token is sent to the public cloud platform to perform the account login operation. The account login operation includes: allocating a client unique sub-identifier and a one-time password. Different unique sub-identifiers correspond to different public cloud platform environments. The unique sub-identifier is parsed by the second token, and the one-time password is generated from at least the unique sub-identifier.

2. The method according to claim 1, wherein, After determining whether a first token is pre-stored, the process further includes: If the first token is not pre-stored, obtain the login parameters; Send the login parameters to the public cloud platform; and If the login parameters are successfully verified on the public cloud platform, the first token is received.

3. The method according to claim 1, wherein, After sending the first token to the public cloud platform, the method further includes: Receive a new first token from the public cloud platform; and The original first token is replaced and updated based on the new first token.

4. The method according to claim 1, wherein, After receiving the second token, the following is also included: If the second token expires, the first token will be sent to the public cloud platform to exchange for a new second token.

5. The method according to any one of claims 1-4, wherein, The first token and the second token are transmitted based on symmetric encryption. Sending the second token to the public cloud platform to perform the account login operation includes: Send the second token to the public cloud platform; and If the public cloud platform verifies the second token as valid, it receives a unique sub-identifier and a one-time password, and forwards them to the front end so that the front end redirects to the specified resource page.

6. A cloud platform login method, characterized in that, The method is applied to a public cloud platform, and the method includes: In response to the received first token, the first token is verified; If the first token is successfully verified, a second token is generated, wherein the validity period of the first token is longer than that of the second token; wherein the first token expires after successful verification and is exchanged for a new first token. Send the second token to the client; In response to receiving the second token, verify the second token; and If the validity of the second token is successfully verified, the account login operation is completed. The account login operation includes: assigning a client-unique sub-identifier and a one-time password. Different unique sub-identifiers correspond to different public cloud platform environments. The unique sub-identifier is parsed by the second token, and the one-time password is generated from at least the unique sub-identifier.

7. The method according to claim 6, wherein, Before verifying the login parameters in response to the received login parameters, the method further includes: In response to the received login parameters, the login parameters are validated; If the login parameters are successfully verified, the first token is generated; and Send the first token to the client.

8. The method according to claim 6, wherein, After verifying the first token in response to the received first token, the method further includes: If the first token is successfully verified, a new first token is generated; and The new first token is sent to the client.

9. The method according to any one of claims 6 to 8, wherein, The first token and the second token are transmitted based on symmetric encryption. After receiving the second token from the client, the process also includes: Obtain the preset public key; and The second token is decrypted based on the preset public key.

10. A cloud platform login device, characterized in that, The device is used on a client side, and the device includes: The first token determination module is used to determine whether a first token is pre-stored, wherein the first token indicates that the client has successfully bound to the public cloud platform; The first token sending module is used to send the first token to the public cloud platform when the first token is pre-stored. The second token receiving module is configured to receive a second token if the public cloud platform successfully verifies the first token, wherein the validity period of the first token is longer than that of the second token; wherein the first token expires and is exchanged for a new first token after successful verification; and The second token sending module is used to send the second token to the public cloud platform before the expiration of the second token's validity period to perform an account login operation. The account login operation includes: allocating a client-unique sub-identifier and a one-time password. Different unique sub-identifiers correspond to different public cloud platform environments. The unique sub-identifier is parsed by the second token, and the one-time password is generated from at least the unique sub-identifier.

11. A cloud platform login device, characterized in that, The device is used in a public cloud platform, and the device includes: The first token verification module is used to verify the first token in response to the received first token; The second token generation module is used to generate a second token if the first token is successfully verified, wherein the validity period of the first token is longer than that of the second token; wherein the first token expires and is exchanged for a new first token after successful verification. The second token sending module is used to send the second token to the client; The second token verification module is configured to verify the second token in response to receiving the second token; and The automated account login module is used to complete the account login operation when the validity of the second token is successfully verified. The account login operation includes: allocating a client-unique sub-identifier and a one-time password. Different unique sub-identifiers correspond to different public cloud platform environments. The unique sub-identifier is parsed by the second token, and the one-time password is generated from at least the unique sub-identifier.

12. An electronic device, comprising: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 9.

13. A computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 9.

14. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 9.

Images