A cloud platform and access control method, storage medium

Abstract

The embodiment of the application provides a cloud platform and an access control method and a storage medium, the cloud platform comprises a gateway and an access control unit; the cloud platform is associated with at least one application; wherein: the gateway is used for sending a login judgment request to the access control unit; the login judgment request carries request login information of a target object for a target application; the access control unit is used for determining a target number of the target object according to first mapping information and pre-stored second mapping information in the case of receiving the login judgment request; and finding pre-stored network information corresponding to the target number from a preset whitelist; the access control unit is also used for returning a first judgment result of allowing login to the gateway if it is judged that the first network information is same as the pre-stored network information; so that the gateway allows the target object to log in the target application based on the first judgment result. Through the above technical solution, the security in the process of accessing the application can be improved.

Description

Technical Field

[0001] This application relates to the field of edge cloud, and more particularly to a cloud platform, access control method, and storage medium. Background Technology

[0002] Cloud platforms leverage cloud computing technology to provide edge computing, networking, storage, security, and various application capabilities. Their application scenarios are extensive, playing a significant role in numerous industries including the Industrial Internet, smart agriculture, energy IoT, security monitoring, smart parks, new retail, cloud gaming, Virtual Reality (VR) / Augmented Reality (AR), smart homes, smart healthcare, connected vehicles, and smart transportation. Regardless of the application scenario, a considerable number of applications for that scenario are deployed on cloud platforms to support it. Therefore, access control for these deployed applications has become a crucial issue that the industry needs to address.

[0003] Existing technologies control access to applications on cloud platforms by controlling network access policies. However, in scenarios where only some applications on the cloud platform are accessible to visitors, the fact that only network access is controlled means that verified visitors can access all applications on the cloud platform, posing a security risk. Summary of the Invention

[0004] This application provides a cloud platform, access control method, and storage medium that can improve security during application access.

[0005] The technical solution of this application is implemented as follows:

[0006] In a first aspect, embodiments of this application provide a cloud platform, the cloud platform including a gateway and an access control unit; the cloud platform is associated with at least one application; wherein:

[0007] The gateway is used to send a login determination request to the access control unit; the login determination request carries login information requested by the target object for the target application; the login information includes first mapping information and first network information; the first mapping information is the mapping relationship between the authorization code of the target object and the application token of the target application;

[0008] The access control unit is configured to, upon receiving the login determination request, determine the target number of the target object based on the first mapping information and the pre-stored second mapping information; and search for the pre-stored network information corresponding to the target number from a preset whitelist; the second mapping information is the mapping relationship between the target number of the target object and the authorization code.

[0009] The access control unit is further configured to, if it is determined that the first network information is the same as the pre-stored network information, return a first determination result allowing login to the gateway, so that the gateway allows the target object to log in to the target application based on the first determination result.

[0010] In the aforementioned cloud platform, the gateway is further configured to, upon receiving the first determination result returned by the access control unit, allow the target object to log in to the target application and return the application token to the target object; intercept subsequent access requests from the target object to the target application; and carry the application token in the subsequent access requests.

[0011] The gateway is further configured to determine the current second network information of the target object based on the subsequent access request; and send an access judgment request to the access control unit; the access judgment request carries the target object's request access information for the target application; the request access information includes the second network information and the application token.

[0012] In the aforementioned cloud platform, the access control unit is further configured to, after determining the target number of the target object based on the first mapping information and the pre-stored second mapping information, store the target number and the application token as third mapping information.

[0013] In the aforementioned cloud platform, the access control unit is further configured to, upon receiving the access determination request sent by the gateway, determine the target number of the target object based on the application token and the pre-stored third mapping information; and search for the pre-stored network information corresponding to the target number from the preset whitelist.

[0014] The access control unit is further configured to return a second judgment result allowing access to the gateway if the second network information is the same as the pre-stored network information; so that the gateway can allow the target object to continue accessing the target application based on the second judgment result.

[0015] In the aforementioned cloud platform, the identity authentication unit is used to receive the first access request from the target object for the target application; and if it is determined that the target object has not logged into the target application, it determines whether the target object has performed identity verification; if it is determined that the target object has not performed identity verification, it opens the identity verification page to the target object so that the target object can perform identity verification on the identity verification page;

[0016] The identity authentication unit is further configured to assign the authorization code to the target object if the identity authentication of the target object is successful, so that the target object can log in to the target application through the authorization code.

[0017] In the aforementioned cloud platform, the application front-end unit is used to initiate a login request to the application back-end unit using the authorization code; the login request carries the authorization code.

[0018] The gateway is also used to intercept the login request and obtain the authorization code;

[0019] The gateway is further configured to send the authorization code to the application backend unit so that the application backend unit can return the corresponding application token; and to determine the authorization code and the application token as the first mapping information.

[0020] In the aforementioned cloud platform, the application backend unit is also used to apply to the identity authentication unit for an access token to access the target application through the authorization code;

[0021] The identity authentication unit is further configured to determine the authorization code and the access token as fourth mapping information; and send the fourth mapping information to the access control unit;

[0022] The identity authentication unit is further configured to, upon receiving the access token sent by the application backend unit, determine the target code based on the first access request sent by the target object, determine the target code and the access token as fifth mapping information, and send the fifth mapping information to the access control unit so that the access control unit can determine the second mapping information based on the fourth mapping information and the fifth mapping information.

[0023] In the aforementioned cloud platform, the access control unit is further configured to return a third judgment result indicating that login is not allowed to the gateway if it is determined that the first network information is different from the pre-stored network information.

[0024] The gateway is further configured to, upon receiving the third judgment result returned by the access control unit, present a login failure page to the target object and refuse the target object's login to the target application.

[0025] Secondly, embodiments of this application provide an access control method applied to a cloud platform, the cloud platform including a gateway and an access control unit; the cloud platform is associated with at least one application; the method includes:

[0026] The gateway sends a login determination request to the access control unit; the login determination request carries login information requested by the target object for the target application; the login information includes first mapping information and first network information; the first mapping information is the mapping relationship between the authorization code of the target object and the application token of the target application;

[0027] Upon receiving the login determination request, the access control unit determines the target number of the target object based on the first mapping information and the pre-stored second mapping information; and searches for the pre-stored network information corresponding to the target number from a preset whitelist; the second mapping information is the mapping relationship between the target number of the target object and the authorization code.

[0028] If the access control unit determines that the first network information is the same as the pre-stored network information, it returns a first determination result allowing login to the gateway, so that the gateway can allow the target object to log in to the target application based on the first determination result.

[0029] Thirdly, embodiments of this application provide a storage medium storing a computer program thereon, characterized in that the computer program, when executed by a processor, implements the access control method as described above.

[0030] This application provides a cloud platform, access control method, and storage medium. The cloud platform includes a gateway and an access control unit. The cloud platform is associated with at least one application. The gateway sends a login judgment request to the access control unit. The login judgment request carries login information requested by a target object for a target application. The login information includes first mapping information and first network information. The first mapping information is a mapping relationship between the target object's authorization code and the target application's application token. The access control unit, upon receiving the login judgment request, determines the target object's target number based on the first mapping information and pre-stored second mapping information. It also searches a pre-stored network information corresponding to the target number from a preset whitelist. The second mapping information is a mapping relationship between the target object's target number and the authorization code. The access control unit is further configured to return a first judgment result allowing login to the gateway if the first network information matches the pre-stored network information. This allows the gateway to allow the target object to log in to the target application based on the first judgment result. By setting up an access control unit and a gateway within the cloud platform, and combining the access control unit and the gateway, fine-grained control can be implemented when a target object logs into an application on the cloud platform, thereby improving the security of the application access process. Attached Figure Description

[0031] Figure 1 A schematic diagram of the composition structure of a cloud platform provided in an embodiment of this application;

[0032] Figure 2 An exemplary gateway proxy diagram provided for embodiments of this application;

[0033] Figure 3 An exemplary access control flowchart is provided for embodiments of this application;

[0034] Figure 4 This is a flowchart of an access control method provided in an embodiment of this application. Detailed Implementation

[0035] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit the scope of this application.

[0036] This application provides a cloud platform 1. Figure 1 This is a schematic diagram of the composition structure of a cloud platform provided in an embodiment of this application, such as... Figure 1 As shown, the cloud platform 1 includes: a gateway 10 and an access control unit 11; the cloud platform is associated with at least one application; wherein:

[0037] The gateway is used to send a login determination request to the access control unit; the login determination request carries the login request information of the target object for the target application; the login request information includes first mapping information and first network information; the first mapping information is the mapping relationship between the authorization code of the target object and the application token of the target application;

[0038] The access control unit is used to determine the target number of the target object based on the first mapping information and the pre-stored second mapping information when a login judgment request is received; and to search for the pre-stored network information corresponding to the target number from the preset whitelist; the second mapping information is the mapping relationship between the target number of the target object and the authorization code.

[0039] The access control unit is also used to return a first judgment result allowing login to the gateway if it is determined that the first network information is the same as the pre-stored network information; so that the gateway can allow the target object to log in to the target application based on the first judgment result.

[0040] The cloud platform provided in this application embodiment is suitable for scenarios where users access applications on the cloud platform to manage their access process.

[0041] It should be noted that in this embodiment of the application, the gateway can realize the network proxy of the cloud platform for the application. The edge cloud uniformly allocates the Internet Protocol (IP) proxy for the applications that are stationed on the cloud platform. The gateway uniformly proxies the access IP of the applications on the cloud platform. When a user accesses the application on the cloud platform, including accessing the application front-end and the application front-end accessing the application back-end, all request communications need to be forwarded through the gateway.

[0042] Figure 2 An exemplary gateway proxy diagram is provided for embodiments of this application, such as... Figure 2As shown, the gateway adds network proxy functionality: the gateway manages a pool of external IP resources, for example: network 10.0.0.0 network endpoint, i.e. Figure 2 The IP addresses 10.0.0.1-10.0.0.255 are used for applications deployed on a cloud platform. Their IP addresses are on the 192.168.1.0 network. The gateway randomly selects IP addresses from the IP resource pool and maps them one-to-one with the application IP addresses. The application IP address exposed to users on the cloud platform is the IP address in the IP resource pool, i.e., the 10.0.0.0 network IP address. When a user accesses an application on the cloud platform, they are accessing the 10.0.0.0 network IP address. The gateway can then perform operations such as application identification, access control, and login information analysis based on the network information accessed by the user.

[0043] Understandably, the gateway in this application adds network proxy functionality compared to traditional network gateways, which can prevent the application's real service IP from being exposed to the user side, thereby improving the security of users accessing applications.

[0044] It should be noted that, in this embodiment of the application, the gateway sends a login judgment request to the access control unit to inquire whether the target object is allowed to log in to the target application. After receiving the login judgment request, the access control unit first determines the target number of the target object based on the first mapping information and the pre-stored second mapping information carried in the login judgment request, then searches for the pre-stored network information corresponding to the target number from the preset whitelist, and finally allows the target object to log in to the target application when the pre-stored network information is the same as the first network information carried in the login judgment request.

[0045] It should be noted that, in the embodiments of this application, network information includes at least source IP, destination IP, destination port, and network protocol; network information can be determined according to actual conditions, and this embodiment of the application does not limit it.

[0046] It should be noted that, in this embodiment, the preset whitelist is an access control policy pre-configured by the access control unit. The access control policy includes "target number (user ID), application (application proxy IP, application proxy port, protocol), and network (source IP, which can be a network segment)". The access control policy takes effect by communicating between the access control unit and the gateway to obtain the request information of the target object for the target application, and then comparing it with the access control policy.

[0047] For example, an access control policy can be configured as "Target object A (user ID-A), Application 1 (proxy IP is 88.88.88.1, proxy port is 80, protocol is http), network a (192.168.42.23 / 24)". This policy allows user A to access application 1 through network a. Specifically, target object A with user ID user ID-A can only access cloud platform application 1 with proxy IP 88.88.88.1, proxy port 80, and protocol http if the client IP is within the 192.168.42.23 / 24 network segment. All conditions in the policy must be met; none can be omitted.

[0048] It should be noted that, in this embodiment of the application, the access control unit added to the cloud platform can realize access control policy management, including adding, deleting, querying and modifying access control policies, applying and activating access control policies, and can also interact with the gateway to realize access control policy matching based on network and application.

[0049] It should be noted that, in the embodiments of this application, the first mapping information is the mapping relationship between the authorization code and the application token; wherein, the authorization code is assigned to the target object by the identity authentication unit after the target object is authenticated by the identity authentication unit in the cloud platform, and the application token is returned by the application backend unit to the application frontend unit after the application frontend unit of the target application initiates a login request to the application backend unit through the authorization code.

[0050] It should be noted that, in this embodiment of the application, the second mapping information is the mapping relationship between the target number user ID and the authorization code; wherein, the target number user ID is determined by the identity authentication unit based on the access request sent by the target object.

[0051] It should be noted that, in this embodiment of the application, if the access control unit determines that the target object is allowed to log in to the target application, it sends a first determination result to the gateway. After receiving the first determination result, the network directly allows the target object to log in to the target application. At this time, the target object successfully logs in to the target application and can access the target application.

[0052] In this embodiment of the application, the access control unit is further configured to return a third judgment result of not allowing login to the gateway if it is determined that the first network information is different from the pre-stored network information; the gateway is further configured to open the login failure page to the target object and refuse the target object from logging into the target application if it receives the third judgment result returned by the access control unit.

[0053] It should be noted that, in this embodiment of the application, if the access control unit determines that the target object is not allowed to log in to the target application, it sends a third determination result to the gateway. After receiving the third determination result, the network directly interrupts the target object's login request for the target application and redirects the login request to the failure page. The target object fails to log in and cannot access the target application.

[0054] In this embodiment of the application, the access control unit is further configured to, after determining the target number of the target object based on the first mapping information and the pre-stored second mapping information, store the target number and the application token as third mapping information.

[0055] In this embodiment, the gateway is further configured to, upon receiving a first judgment result returned by the access control unit, allow the target object to log in to the target application and return the application token to the target object; intercept subsequent access requests from the target object to the target application; the subsequent access requests carry the application token; the gateway is further configured to determine the target object's current second network information based on the subsequent access requests; and send an access judgment request to the access control unit; the access judgment request carries the target object's request access information for the target application; the request access information includes the second network information and the application token.

[0056] It should be noted that, in this embodiment of the application, after receiving the first judgment result sent by the access control unit, the gateway allows the login request of the target object to the target application and sends the application token corresponding to the target application to the target object. The target object can then access the target application based on the application token. Each access request of the target object in the target application will carry the application token. At this time, the gateway will intercept each access request carrying the application token and send an access judgment request to the access control unit to ask whether the target object is allowed to continue accessing the target application.

[0057] In this embodiment of the application, the access control unit is further configured to, upon receiving an access judgment request sent by the gateway, determine the target number of the target object based on the application token and the pre-stored third mapping information; and search for the pre-stored network information corresponding to the target number from the preset whitelist; the access control unit is further configured to, if the second network information is the same as the pre-stored network information, return a second judgment result allowing access to the gateway; so that the gateway can allow the target object to continue accessing the target application based on the second judgment result.

[0058] It should be noted that, in this embodiment of the application, after receiving the access judgment request sent by the gateway, the access control unit first determines the target number of the target object based on the application token carried in the access judgment request and the pre-stored third mapping information (the mapping relationship between the target number and the application token), then searches for the pre-stored network information corresponding to the target number from the preset whitelist, and finally allows the target object to continue to access the target application when the pre-stored network information is the same as the second network information carried in the login judgment request.

[0059] It should be noted that in this embodiment of the application, if the network environment of the target object changes after the target object logs into the target application, that is, the source IP in the network information changes, the network information does not meet the preset access control policy, and the access request is not allowed.

[0060] In this embodiment of the application, the cloud platform further includes an identity authentication unit; wherein: the identity authentication unit is used to receive a first access request from a target object for a target application; and if it is determined that the target object has not logged into the target application, it determines whether the target object has performed identity verification; if it is determined that the target object has not performed identity verification, it opens an identity verification page to the target object so that the target object can perform identity verification on the identity verification page; the identity authentication unit is also used to assign an authorization code to the target object if the identity verification of the target object is successful, so that the target object can log in to the target application through the authorization code.

[0061] It should be noted that, in the embodiments of this application, before all the above steps, the target object accesses the target application through the cloud platform. At this time, it is first determined whether the target object has logged into the target application. If it is determined that the target object has not logged in, the identity authentication unit is used to determine whether the target object has performed identity verification. If the target object has not performed identity verification, the identity verification page is opened to the target object. The target object enters a username and password for verification. The identity authentication unit verifies the username and password. If the verification is successful, an authorization code is provided to the target object.

[0062] In this embodiment of the application, the target application includes an application front-end unit and an application back-end unit; wherein: the application front-end unit is used to initiate a login request to the application back-end unit through an authorization code; the login request carries the authorization code; the gateway is also used to intercept the login request and obtain the authorization code; the gateway is also used to send the authorization code to the application back-end unit so that the application back-end unit can return the corresponding application token; the authorization code and the application token are determined as the first mapping information.

[0063] It should be noted that, in this embodiment of the application, when the identity authentication unit provides the authorization code to the target object, it actually provides the authorization code to the application front-end unit. Then, the application front-end unit initiates a login request to the application back-end unit through the authorization code. The login request carries the authorization code. Since the gateway is set up between the application front-end unit and the application back-end unit, it can monitor and intercept the interaction between the application front-end unit and the application back-end unit. When the application front-end unit initiates a login request to the application back-end unit through the authorization code, it can intercept the login request and obtain the authorization code.

[0064] It should be noted that, in this embodiment, after obtaining the authorization code, the gateway sends the authorization code to the application backend unit. The application backend unit obtains the access token from the identity authentication unit through the authorization code, and then obtains the target ID of the target object from the identity authentication unit through the access token. If the identity authentication unit returns the user ID to the application backend unit, the application backend unit returns the application token to the application frontend unit. At this time, the gateway can intercept the application token and obtain the mapping relationship between the authorization code and the application token (first mapping information).

[0065] In this embodiment, the application backend unit is further configured to request an access token for accessing the target application from the identity authentication unit via an authorization code; the identity authentication unit is further configured to determine the authorization code and the access token as fourth mapping information; and send the fourth mapping information to the access control unit; the identity authentication unit is further configured to, upon receiving the access token sent by the application backend unit, determine the target code based on the first access request sent by the target object, determine the target code and the access token as fifth mapping information; and send the fifth mapping information to the access control unit so that the access control unit can determine the second mapping information based on the fourth mapping information and the fifth mapping information.

[0066] It should be noted that, in this embodiment, after the application backend unit obtains the access token from the identity authentication unit through the authorization code, the identity authentication unit determines the authorization code and the access token as the fourth mapping information and sends it to the access control unit; after the application backend unit obtains the target number user ID of the target object from the identity authentication unit through the access token, the identity authentication unit determines the access token and the target number user ID as the fifth mapping information and sends it to the access control unit. At this time, the access control unit has the mapping relationship between the authorization code and the access token, and between the access token and the target number user ID. The mapping relationship between the authorization code and the target number user ID can be determined based on these two mapping relationships, that is, the pre-stored second mapping information.

[0067] In one practical application, this application is illustrated by way of describing how a target object accesses application A on a cloud platform. Figure 3 An exemplary access control flowchart is provided for embodiments of this application, such as... Figure 3 As shown, one possible implementation method is as follows:

[0068] S101, Access application A.

[0069] Specifically, the target object accesses the front-end unit of application A on the cloud platform through a browser, that is, the target object sends the first access request for application A.

[0070] S102. Determine the login status of the target object.

[0071] Specifically, application A's front-end unit determines whether the target object has logged into application A.

[0072] S103. If not logged in, then identity verification will be performed.

[0073] Specifically, if the front-end unit A determines that the target object is not logged in, it will redirect to the identity authentication unit for identity verification.

[0074] S104. Determine if the target object is logged in.

[0075] Specifically, the identity authentication unit determines whether the target object has logged in, that is, whether the target object has undergone identity verification.

[0076] S105. If not logged in, the identity verification page will be opened.

[0077] Specifically, if the identity authentication unit determines that the target object is not logged in, i.e. has not performed authentication, it will redirect the page to the authentication page so that the target object can perform authentication on the authentication page.

[0078] S106. Authentication of the target object.

[0079] Specifically, the target user enters a username and password on the authentication page, and the authentication unit authenticates the target user.

[0080] S107. After successful authentication, the page will be redirected and an authorization code will be provided.

[0081] Specifically, after the identity authentication unit successfully authenticates the target object, it will provide the target object with an authorization code and redirect the page.

[0082] S108. Obtain the application token using the authorization code.

[0083] Specifically, the front-end unit of application A initiates a login request to the back-end unit of application A using the authorization code. The login request carries the authorization code. Since the gateway proxies application A, the login request will be intercepted by the gateway. At this time, the gateway can obtain the authorization code in the login request and then send the authorization code to the back-end unit of application A so that the back-end unit of application A can return the corresponding application token.

[0084] S109. Obtain an Access Token by exchanging the authorization code.

[0085] Specifically, application A backend unit requests an access token (AccessToken) from the identity authentication unit using an authorization code (code).

[0086] S110, Return Access Token.

[0087] Specifically, the identity authentication unit returns an access token to the application A backend unit.

[0088] S111 Record the mapping relationship between the authorization code and the access token.

[0089] Specifically, the identity authentication unit sends the mapping relationship between the authorization code and the access token (the fourth mapping information) to the access control unit, and the access control unit records the fourth mapping information.

[0090] S112. Obtain the target number (user ID) through the access token.

[0091] Specifically, application A backend unit obtains the target ID corresponding to the target object from the identity authentication unit through the access token.

[0092] S113. Return the target number, user ID.

[0093] Specifically, the identity authentication unit returns user information such as the target number (user ID) to the application A backend unit based on the access token.

[0094] S114. Record the mapping relationship between the Access Token and the target number user ID.

[0095] Specifically, the identity authentication unit sends the mapping relationship between the access token and the target number user ID (the fifth mapping information) to the access control unit. The access control unit records the fifth mapping information and determines the second mapping information between the authorization code and the target number user ID based on the fourth mapping information between the authorization code and the access token.

[0096] S115, Return the application token.

[0097] Specifically, the backend unit of application A returns the application token to the frontend unit of application A, corresponding to step S108. The application token is generated by application A and is used by application A to authenticate the identity of the target object. When the backend unit of application A returns the application token to the frontend unit of application A, it is intercepted by the gateway, and the gateway will obtain the application token.

[0098] S116. Send login verification request.

[0099] Specifically, the gateway obtains the authorization code in step S108, and then obtains the application token in step S115, thus obtaining the mapping relationship between the authorization code and the application token (first mapping information). At the same time, the gateway can also obtain first network information such as "source IP, destination IP, destination port, and network protocol". The gateway sends a login judgment request to the access control unit. The login judgment request carries the login request information of the target object for the target application. The login request information includes the first mapping information and the first network information.

[0100] S117. Asks if login is allowed.

[0101] Specifically, the gateway queries the access control unit to determine whether the target object is allowed to log in to application A.

[0102] S118. Make a judgment based on the requested login information.

[0103] Specifically, the access control unit determines the user ID of this login request (confirming the target object) based on the first mapping information in the login request information and the pre-stored second mapping information. Then, it retrieves the pre-stored network information corresponding to the user ID from the preset whitelist and compares the pre-stored network information with the first network information in the login request information. If they are the same, the target object is allowed to log in to application A; otherwise, it is not allowed.

[0104] S119. Return the judgment result.

[0105] Specifically, the access control unit returns a decision to the gateway regarding whether login is allowed.

[0106] S120. Perform different operations based on the judgment result.

[0107] Specifically, the gateway performs different operations based on the judgment result returned by the access control unit: if the judgment result indicates that login is allowed, the gateway allows the application token returned in step S115; if the judgment result indicates that login is not allowed, the current login request is interrupted, the login request is redirected to the failure page, the target object fails to log in and cannot access the application A.

[0108] S121, Return the application token.

[0109] Specifically, if the access control unit returns a judgment result to the gateway that login is allowed, the application token from step S115 of the gateway is returned, that is, the application token is returned to the application A front-end unit.

[0110] S122. Successfully logged into application A.

[0111] Specifically, the target object successfully logged into application A.

[0112] S123. Access application A.

[0113] Specifically, after successfully logging in, the target object accesses application A and receives access operations from the target object within application A.

[0114] S124. Send a follow-up access request.

[0115] Specifically, the front-end unit of application A sends a subsequent access request to the back-end unit of application A based on the access operation of the target object in application A. The subsequent access request carries the application token, and this subsequent access request will also be intercepted by the gateway.

[0116] S125. Send an access determination request.

[0117] Specifically, the gateway sends an access decision request to the access control unit. The access decision request carries access request information, including the application token and second network information, and asks the access control unit whether to allow the target object to continue accessing application A.

[0118] S126. Make a judgment based on the requested access information.

[0119] Specifically, the access control unit determines the user ID of this login request (confirming the target object) based on the application token in the access request information and the pre-stored third mapping information. Then, it retrieves the pre-stored network information corresponding to the user ID from the preset whitelist and compares the pre-stored network information with the second network information in the access request information. If they are the same, the target object is allowed to continue accessing application A; otherwise, it is not allowed. For example, if the network environment of the target object changes, i.e., the source IP changes, which does not conform to the preset access control policy, then the access request is determined to be not allowed.

[0120] S127. Return the judgment result.

[0121] Specifically, the access control unit returns a judgment result to the gateway, indicating whether continued access is allowed. The gateway performs different operations based on the judgment result returned by the access control unit: if the judgment result indicates that continued access is allowed, the gateway allows the access request in step S124; if the judgment result indicates that continued access is not allowed, the current access request is interrupted, the access request is redirected to a failure page, the target object access fails, and the application A cannot be accessed.

[0122] S128. Allow subsequent access requests.

[0123] Specifically, if continued access is allowed, the gateway will continue to forward the subsequent access request, which will then reach the backend unit of application A.

[0124] S129, Access successful.

[0125] Specifically, if the access is successful, the access request is returned to the front-end unit of application A, and the target object successfully accesses application A.

[0126] This application provides a cloud platform, access control method, and storage medium. The cloud platform includes a gateway and an access control unit. The cloud platform is associated with at least one application. The gateway sends a login judgment request to the access control unit. The login judgment request carries login information requested by a target object for a target application. The login information includes first mapping information and first network information. The first mapping information is a mapping relationship between the target object's authorization code and the target application's application token. The access control unit, upon receiving the login judgment request, determines the target object's target number based on the first mapping information and pre-stored second mapping information. It also searches a pre-stored network information corresponding to the target number from a preset whitelist. The second mapping information is a mapping relationship between the target object's target number and the authorization code. The access control unit is further configured to return a first judgment result allowing login to the gateway if the first network information matches the pre-stored network information. This allows the gateway to allow the target object to log in to the target application based on the first judgment result. By setting up an access control unit and a gateway within the cloud platform, and combining the access control unit and the gateway, fine-grained control can be implemented when a target object logs into an application on the cloud platform, thereby improving the security of the application access process.

[0127] Based on the above embodiments, another embodiment of this application provides an access control method. Figure 4 This application provides a flowchart of an access control method, applied to a cloud platform, the cloud platform including a gateway and an access control unit; the cloud platform is associated with at least one application, such as... Figure 4 As shown, the method includes:

[0128] S201. The gateway sends a login determination request to the access control unit. The login determination request carries the login request information of the target object for the target application. The login request information includes first mapping information and first network information. The first mapping information is the mapping relationship between the authorization code of the target object and the application token of the target application.

[0129] In this embodiment, the gateway sends a login determination request to the access control unit; the login determination request carries the login request information of the target object for the target application; the login request information includes first mapping information and first network information; the first mapping information is the mapping relationship between the authorization code of the target object and the application token of the target application.

[0130] S202. Upon receiving a login determination request, the access control unit determines the target number of the target object based on the first mapping information and the pre-stored second mapping information; and searches for the pre-stored network information corresponding to the target number from the preset whitelist; the second mapping information is the mapping relationship between the target number of the target object and the authorization code.

[0131] In this embodiment of the application, when the access control unit receives a login determination request, it determines the target number of the target object based on the first mapping information and the pre-stored second mapping information; and searches for the pre-stored network information corresponding to the target number from the preset whitelist; the second mapping information is the mapping relationship between the target number of the target object and the authorization code.

[0132] S203. If the access control unit determines that the first network information is the same as the pre-stored network information, it returns the first judgment result of allowing login to the gateway, so that the gateway can allow the target object to log in to the target application based on the first judgment result.

[0133] In this embodiment of the application, if the access control unit determines that the first network information is the same as the pre-stored network information, it returns a first determination result allowing login to the gateway, so that the gateway can allow the target object to log in to the target application based on the first determination result.

[0134] In this embodiment, if the gateway receives the first judgment result returned by the access control unit, it allows the target object to log in to the target application and returns the application token to the target object; it intercepts subsequent access requests from the target object to the target application; the subsequent access requests carry the application token; it determines the target object's current second network information based on the subsequent access requests; and it sends an access judgment request to the access control unit; the access judgment request carries the target object's request access information for the target application; the request access information includes the second network information and the application token.

[0135] In this embodiment of the application, after the access control unit determines the target number of the target object based on the first mapping information and the pre-stored second mapping information, it stores the target number and the application token as third mapping information.

[0136] In this embodiment, when the access control unit receives an access judgment request sent by the gateway, it determines the target number of the target object based on the application token and the pre-stored third mapping information; and searches for the pre-stored network information corresponding to the target number from the preset whitelist; if the second network information is the same as the pre-stored network information, it returns a second judgment result allowing access to the gateway; so that the gateway can allow the target object to continue accessing the target application based on the second judgment result.

[0137] In this embodiment of the application, the cloud platform further includes an identity authentication unit; the identity authentication unit receives a first access request from the target object for the target application; and if it is determined that the target object has not logged into the target application, it determines whether the target object has performed identity verification; if it is determined that the target object has not performed identity verification, it opens the identity verification page to the target object so that the target object can perform identity verification on the identity verification page; if the target object's identity verification is successful, it assigns an authorization code to the target object so that the target object can log in to the target application through the authorization code.

[0138] In this embodiment of the application, the target application includes an application front-end unit and an application back-end unit; the application front-end unit initiates a login request to the application back-end unit through an authorization code; the login request carries the authorization code; the gateway intercepts the login request; obtains the authorization code, and sends the authorization code to the application back-end unit so that the application back-end unit can return the corresponding application token; the authorization code and the application token are determined as the first mapping information.

[0139] In this embodiment, the application backend unit requests an access token from the identity authentication unit to access the target application via an authorization code; the identity authentication unit determines the authorization code and the access token as fourth mapping information; and sends the fourth mapping information to the access control unit. Upon receiving the access token sent by the application backend unit, the unit determines the target code based on the first access request sent by the target object, and determines the target code and the access token as fifth mapping information; and sends the fifth mapping information to the access control unit so that the access control unit can determine the second mapping information based on the fourth mapping information and the fifth mapping information.

[0140] In this embodiment of the application, if the access control unit determines that the first network information is different from the pre-stored network information, it returns a third determination result that login is not allowed to the gateway; if the gateway receives the third determination result returned by the access control unit, it opens the login failure page to the target object and refuses the target object to log in to the target application.

[0141] This application provides an access control method applied to a cloud platform. The cloud platform includes a gateway and an access control unit. The cloud platform is associated with at least one application. The method includes: the gateway sending a login judgment request to the access control unit; the login judgment request carrying login request information of a target object for a target application; the login request information includes first mapping information and first network information; the first mapping information is a mapping relationship between the authorization code of the target object and the application token of the target application; upon receiving the login judgment request, the access control unit determines the target number of the target object according to the first mapping information and pre-stored second mapping information; and searches for the pre-stored network information corresponding to the target number from a preset whitelist; the second mapping information is a mapping relationship between the target number of the target object and the authorization code; if the access control unit determines that the first network information is the same as the pre-stored network information, it returns a first judgment result allowing login to the gateway; so that the gateway allows the target object to log in to the target application based on the first judgment result. By adopting the above implementation scheme, by setting up an access control unit and a gateway in the cloud platform, and by combining the access control unit and the gateway, fine-grained control can be performed on the access of the target object for the target application when the target object logs in to the application on the cloud platform, thereby improving the security of the application access process.

[0142] This application provides a storage medium storing a computer program thereon. The computer-readable storage medium stores one or more programs, which can be executed by one or more processors and applied to a cloud platform. The computer program implements the access control method as described in the above embodiments.

[0143] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0144] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0145] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0146] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0147] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention.

Claims

1. A cloud platform, characterized in that, The cloud platform includes a gateway and an access control unit; the cloud platform is associated with at least one application; wherein: The gateway is used to send a login determination request to the access control unit; the login determination request carries login information requested by the target object for the target application; the login information includes first mapping information and first network information; the first mapping information is the mapping relationship between the authorization code of the target object and the application token of the target application; The access control unit is configured to, upon receiving the login determination request, determine the target number of the target object based on the first mapping information and the pre-stored second mapping information; and search for the pre-stored network information corresponding to the target number from a preset whitelist; the second mapping information is the mapping relationship between the target number of the target object and the authorization code. The access control unit is further configured to, if it is determined that the first network information is the same as the pre-stored network information, return a first determination result allowing login to the gateway, so that the gateway allows the target object to log in to the target application based on the first determination result.

2. The cloud platform according to claim 1, characterized in that, The gateway is further configured to, if it receives the first determination result returned by the access control unit, allow the target object to log in to the target application and return the application token to the target object; Subsequent access requests from the target object to the target application are intercepted; the subsequent access requests carry the application token. The gateway is further configured to determine the current second network information of the target object based on the subsequent access request; and send an access judgment request to the access control unit; the access judgment request carries the target object's request access information for the target application; the request access information includes the second network information and the application token.

3. The cloud platform according to claim 1, characterized in that, The access control unit is further configured to, after determining the target number of the target object based on the first mapping information and the pre-stored second mapping information, store the target number and the application token as third mapping information.

4. The cloud platform according to claim 2, characterized in that, The access control unit is further configured to determine the target number of the target object based on the application token and pre-stored third mapping information when receiving the access judgment request sent by the gateway; And search the pre-stored network information corresponding to the target number from the preset whitelist; The access control unit is further configured to return a second judgment result allowing access to the gateway if the second network information is the same as the pre-stored network information; The gateway may allow the target object to continue accessing the target application based on the second determination result.

5. The cloud platform according to claim 1, characterized in that, The cloud platform also includes an identity authentication unit; wherein: The identity authentication unit is configured to receive a first access request from the target object for the target application; and if it is determined that the target object has not logged into the target application, determine whether the target object has performed identity verification; if it is determined that the target object has not performed identity verification, then open the identity verification page to the target object so that the target object can perform identity verification on the identity verification page; The identity authentication unit is further configured to assign the authorization code to the target object if the identity authentication of the target object is successful, so that the target object can log in to the target application through the authorization code.

6. The cloud platform according to claim 5, characterized in that, The target application includes an application front-end unit and an application back-end unit; wherein: The application front-end unit is used to initiate a login request to the application back-end unit using the authorization code; the login request carries the authorization code. The gateway is also used to intercept the login request and obtain the authorization code; The gateway is further configured to send the authorization code to the application backend unit so that the application backend unit can return the corresponding application token; and to determine the authorization code and the application token as the first mapping information.

7. The cloud platform according to claim 6, characterized in that, The application backend unit is also used to apply to the identity authentication unit for an access token to access the target application through the authorization code; The identity authentication unit is further configured to determine the authorization code and the access token as fourth mapping information; and send the fourth mapping information to the access control unit; The identity authentication unit is further configured to, upon receiving the access token sent by the application backend unit, determine the target code based on the first access request sent by the target object, and determine the target code and the access token as fifth mapping information; The fifth mapping information is then sent to the access control unit so that the access control unit can determine the second mapping information based on the fourth mapping information and the fifth mapping information.

8. The cloud platform according to claim 1, characterized in that, The access control unit is further configured to return a third judgment result indicating that login is not allowed to the gateway if it is determined that the first network information is different from the pre-stored network information; The gateway is also configured to, if it receives the third judgment result returned by the access control unit, open a login failure page to the target object and refuse the target object from logging into the target application.

9. An access control method, characterized in that, Applied to a cloud platform, the cloud platform including a gateway and an access control unit; the cloud platform is associated with at least one application; the method includes: The gateway sends a login determination request to the access control unit; the login determination request carries login information requested by the target object for the target application; the login information includes first mapping information and first network information; the first mapping information is the mapping relationship between the authorization code of the target object and the application token of the target application; Upon receiving the login determination request, the access control unit determines the target number of the target object based on the first mapping information and the pre-stored second mapping information; and searches for the pre-stored network information corresponding to the target number from a preset whitelist; the second mapping information is the mapping relationship between the target number of the target object and the authorization code. If the access control unit determines that the first network information is the same as the pre-stored network information, it returns a first determination result allowing login to the gateway, so that the gateway can allow the target object to log in to the target application based on the first determination result.

10. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the method as described in claim 9.

Images