A cross-cloud authentication processing method and apparatus

Abstract

This invention provides a cross-cloud authentication processing method and apparatus, relating to the field of data processing technology, and applicable to the financial sector or other technical fields. The method includes: a second cloud service node receiving a first authentication message and a key forwarded from a main agent node by a second proxy node; recovering a second session key based on the key and a second terminal private key; and completing second terminal authentication. A first cloud service node receives the second authentication message and the key forwarded from the main agent node by the first proxy node; recovering a first session key based on the key and a first terminal private key; and completing first terminal authentication. The apparatus executes the above method. The cross-cloud authentication processing method and apparatus provided by this invention can improve the efficiency of cross-cloud certificate issuance and ensure the security of cross-cloud access information.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and specifically to a cross-cloud authentication processing method and apparatus. Background Technology

[0002] With the booming development of the cloud service industry, identity authentication and secure message exchange are crucial for cross-cloud communication. Currently, the industry typically uses PKI (Public Key Infrastructure) and IBE (Identity Base Encryption) technologies to sign and encrypt user public keys to ensure secure communication with the cloud service core network.

[0003] However, PKI technology involves certificates, which presents problems such as lengthy certificate issuance processes, inefficient certificate configuration, complex cross-CA trust mechanisms, and heavy computational load. IBE identity authentication suffers from excessive node permissions, making it prone to single points of failure and limiting its effectiveness to a smaller trust domain. Summary of the Invention

[0004] To address the problems in the prior art, embodiments of the present invention provide a cross-cloud authentication processing method and apparatus, which can at least partially solve the problems existing in the prior art.

[0005] On one hand, this invention proposes a cross-cloud authentication processing method, applied to a first cloud service node contained in a first cloud domain and a second cloud service node contained in a second cloud domain, comprising:

[0006] The first cloud service node receives the first authentication message sent by the first terminal and sends the first key request message to the first agent node, so that the first agent node forwards the first key request message to the general agent node, so that the general agent node determines the second terminal identifier corresponding to the first terminal identifier and the key shared by the first terminal and the second terminal according to the mapping relationship stored locally in advance.

[0007] Wherein, the first authentication message carries a first terminal identifier, the first key request message carries the first authentication message, and the mapping relationship includes the mapping relationship between the first terminal identifier, the second terminal identifier, and the key;

[0008] The second cloud service node receives the first authentication message and the key forwarded by the second agent node from the main agent node, and recovers the second session key based on the key and the second terminal private key to complete the second terminal authentication;

[0009] The second cloud service node receives the second authentication message sent by the second terminal and sends a second key request message to the second agent node, so that the second agent node forwards the second key request message to the main agent node, so that the main agent node determines the first terminal identifier corresponding to the second terminal identifier and the key according to the mapping relationship;

[0010] The second authentication message carries a second terminal identifier, and the second key request message carries the second authentication message.

[0011] The first cloud service node receives the second authentication message and the key forwarded by the first agent node from the general agent node, and recovers the first session key based on the key and the first terminal private key to complete the first terminal authentication.

[0012] The first cloud service node receives the first authentication message sent by the first terminal, including:

[0013] The first cloud service node receives the first authentication message generated and sent by the first terminal after signing the first terminal's private key.

[0014] The second cloud service node receives the second authentication message sent by the second terminal, including:

[0015] The second cloud service node receives the second authentication message generated and sent by the second terminal after the second terminal signs the second terminal's private key.

[0016] The first authentication message also carries a first terminal public key; correspondingly, after the step of completing the first terminal authentication, the cross-cloud authentication processing method further includes:

[0017] The first cloud service node uses the first terminal's public key to encrypt the first terminal's authentication completion information and sends the encrypted first terminal authentication completion information to the first terminal.

[0018] The second authentication message also carries a second terminal public key; correspondingly, after the step of completing the second terminal authentication, the cross-cloud authentication processing method further includes:

[0019] The second cloud service node uses the public key of the second terminal to encrypt the authentication completion information of the second terminal, and then sends the encrypted authentication completion information to the second terminal.

[0020] Prior to the step of the first cloud service node receiving the first authentication message sent by the first terminal, the cross-cloud authentication processing method further includes:

[0021] The first cloud service node divides the first session key into the key and the first terminal private key;

[0022] The first terminal private key is sent to the first terminal, and the key is sent to the first proxy node, so that the first proxy node can send the key to the main proxy node, and the main proxy node can establish the mapping relationship based on the key corresponding to the first terminal sent by the first proxy node and the key corresponding to the second terminal sent by the second proxy node in advance.

[0023] Prior to the step of the second cloud service node receiving the second authentication message sent by the second terminal, the cross-cloud authentication processing method further includes:

[0024] The second cloud service node splits the second session key into the key and the second terminal private key;

[0025] The second terminal private key is sent to the second terminal, and the key is sent to the second proxy node, so that the second proxy node can send the key to the main proxy node, and the main proxy node can establish the mapping relationship based on the key corresponding to the second terminal sent by the second proxy node and the key corresponding to the first terminal sent by the first proxy node in advance.

[0026] On one hand, the present invention proposes a cross-cloud authentication processing device, applied to a first cloud service node contained in a first cloud domain and a second cloud service node contained in a second cloud domain, comprising:

[0027] The first sending unit is configured to receive a first authentication message sent by a first terminal through a first cloud service node, and send a first key request message to a first agent node, so that the first agent node forwards the first key request message to a general agent node, so that the general agent node determines the second terminal identifier corresponding to the first terminal identifier and the key shared by the first terminal and the second terminal according to the mapping relationship pre-stored locally.

[0028] Wherein, the first authentication message carries a first terminal identifier, the first key request message carries the first authentication message, and the mapping relationship includes the mapping relationship between the first terminal identifier, the second terminal identifier, and the key;

[0029] The first receiving unit is configured to receive the first authentication message and the key forwarded by the second agent node from the main agent node through the second cloud service node, recover the second session key based on the key and the second terminal private key, and complete the second terminal authentication.

[0030] The second sending unit is configured to receive a second authentication message sent by a second terminal through a second cloud service node, and send a second key request message to the second agent node, so that the second agent node forwards the second key request message to the main agent node, so that the main agent node determines the first terminal identifier corresponding to the second terminal identifier and the key according to the mapping relationship;

[0031] The second authentication message carries a second terminal identifier, and the second key request message carries the second authentication message.

[0032] The second receiving unit is configured to receive the second authentication message and the key forwarded by the first agent node from the general agent node through the first cloud service node, recover the first session key based on the key and the first terminal private key, and complete the first terminal authentication.

[0033] In another aspect, embodiments of the present invention provide an electronic device, including: a processor, a memory, and a bus, wherein,

[0034] The processor and the memory communicate with each other via the bus;

[0035] The memory stores program instructions that can be executed by the processor, and the processor can execute the following methods by calling the program instructions:

[0036] The first cloud service node receives the first authentication message sent by the first terminal and sends the first key request message to the first agent node, so that the first agent node forwards the first key request message to the general agent node, so that the general agent node determines the second terminal identifier corresponding to the first terminal identifier and the key shared by the first terminal and the second terminal according to the mapping relationship stored locally in advance.

[0037] Wherein, the first authentication message carries a first terminal identifier, the first key request message carries the first authentication message, and the mapping relationship includes the mapping relationship between the first terminal identifier, the second terminal identifier, and the key;

[0038] The second cloud service node receives the first authentication message and the key forwarded by the second agent node from the main agent node, and recovers the second session key based on the key and the second terminal private key to complete the second terminal authentication;

[0039] The second cloud service node receives the second authentication message sent by the second terminal and sends a second key request message to the second agent node, so that the second agent node forwards the second key request message to the main agent node, so that the main agent node determines the first terminal identifier corresponding to the second terminal identifier and the key according to the mapping relationship;

[0040] The second authentication message carries a second terminal identifier, and the second key request message carries the second authentication message.

[0041] The first cloud service node receives the second authentication message and the key forwarded by the first agent node from the general agent node, and recovers the first session key based on the key and the first terminal private key to complete the first terminal authentication.

[0042] This invention provides a non-transitory computer-readable storage medium, comprising:

[0043] The non-transitory computer-readable storage medium stores computer instructions that cause the computer to perform the following methods:

[0044] The first cloud service node receives the first authentication message sent by the first terminal and sends the first key request message to the first agent node, so that the first agent node forwards the first key request message to the general agent node, so that the general agent node determines the second terminal identifier corresponding to the first terminal identifier and the key shared by the first terminal and the second terminal according to the mapping relationship stored locally in advance.

[0045] Wherein, the first authentication message carries a first terminal identifier, the first key request message carries the first authentication message, and the mapping relationship includes the mapping relationship between the first terminal identifier, the second terminal identifier, and the key;

[0046] The second cloud service node receives the first authentication message and the key forwarded by the second agent node from the main agent node, and recovers the second session key based on the key and the second terminal private key to complete the second terminal authentication;

[0047] The second cloud service node receives the second authentication message sent by the second terminal and sends a second key request message to the second agent node, so that the second agent node forwards the second key request message to the main agent node, so that the main agent node determines the first terminal identifier corresponding to the second terminal identifier and the key according to the mapping relationship;

[0048] The second authentication message carries a second terminal identifier, and the second key request message carries the second authentication message.

[0049] The first cloud service node receives the second authentication message and the key forwarded by the first agent node from the general agent node, and recovers the first session key based on the key and the first terminal private key to complete the first terminal authentication.

[0050] The cross-cloud authentication processing method and apparatus provided in this embodiment of the invention involve a first cloud service node receiving a first authentication message from a first terminal and sending a first key request message to a first proxy node. The first proxy node forwards the first key request message to a main proxy node, which then determines a second terminal identifier corresponding to the first terminal identifier and a key shared by the first and second terminals based on a pre-stored mapping relationship. The first authentication message carries the first terminal identifier, the first key request message carries the first authentication message, and the mapping relationship includes a mapping relationship between the first terminal identifier, the second terminal identifier, and the key. A second cloud service node receives the first authentication message and the key forwarded from the main proxy node by the second proxy node, and determines the key and the key shared by the first and second terminals based on the mapping relationship. The first cloud service node receives the second authentication message sent by the second terminal and sends a second key request message to the second proxy node, so that the second proxy node forwards the second key request message to the main proxy node, so that the main proxy node determines the first terminal identifier corresponding to the second terminal identifier and the key according to the mapping relationship; wherein, the second authentication message carries the second terminal identifier and the second key request message carries the second authentication message; the first cloud service node receives the second authentication message and the key forwarded by the first proxy node from the main proxy node, and recovers the first session key according to the key and the first terminal private key, thus completing the first terminal authentication. This can improve the efficiency of cross-cloud certificate issuance and ensure the security of cross-cloud access information. Attached Figure Description

[0051] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0052] Figure 1 This is a flowchart illustrating a cross-cloud authentication processing method provided in an embodiment of the present invention.

[0053] Figure 2 This is a schematic diagram illustrating a cross-cloud authentication processing method provided in another embodiment of the present invention.

[0054] Figure 3 This is a schematic diagram of the cross-cloud authentication processing device provided in an embodiment of the present invention.

[0055] Figure 4 This is a schematic diagram of the physical structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. Here, the illustrative embodiments and descriptions of the present invention are used to explain the present invention, but are not intended to limit the present invention. It should be noted that, unless otherwise specified, the embodiments and features in the embodiments of this application can be arbitrarily combined with each other.

[0057] Figure 1 This is a flowchart illustrating a cross-cloud authentication processing method provided in an embodiment of the present invention, as shown below. Figure 1 As shown, the cross-cloud authentication processing method provided in this embodiment of the invention is applied to a first cloud service node contained in a first cloud domain and a second cloud service node contained in a second cloud domain, including:

[0058] Step S1: The first cloud service node receives the first authentication message sent by the first terminal and sends a first key request message to the first agent node, so that the first agent node forwards the first key request message to the general agent node, so that the general agent node determines the second terminal identifier corresponding to the first terminal identifier and the key shared by the first terminal and the second terminal according to the mapping relationship stored locally in advance.

[0059] The first authentication message carries a first terminal identifier, the first key request message carries the first authentication message, and the mapping relationship includes the mapping relationship between the first terminal identifier, the second terminal identifier, and the key.

[0060] Step S2: The second cloud service node receives the first authentication message and the key forwarded by the second agent node from the main agent node, and recovers the second session key based on the key and the second terminal private key to complete the second terminal authentication.

[0061] Step S3: The second cloud service node receives the second authentication message sent by the second terminal and sends a second key request message to the second agent node, so that the second agent node forwards the second key request message to the general agent node, so that the general agent node determines the first terminal identifier corresponding to the second terminal identifier and the key according to the mapping relationship;

[0062] The second authentication message carries a second terminal identifier, and the second key request message carries the second authentication message.

[0063] Step S4: The first cloud service node receives the second authentication message and the key forwarded by the first agent node from the general agent node, and recovers the first session key based on the key and the first terminal private key to complete the first terminal authentication.

[0064] In step S1 above, the first cloud service node of the device receives the first authentication message sent by the first terminal and sends the first key request message to the first agent node, so that the first agent node forwards the first key request message to the general agent node, so that the general agent node determines the second terminal identifier corresponding to the first terminal identifier and the key shared by the first terminal and the second terminal according to the mapping relationship stored locally in advance.

[0065] The first authentication message carries a first terminal identifier, the first key request message carries the first authentication message, and the mapping relationship includes the mapping relationship between the first terminal identifier, the second terminal identifier, and the key. The apparatus can be a computer device executing the method, such as a cloud service node server. It should be noted that the information collected in this embodiment of the invention is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0066] Provide users with corresponding operation entry points, allowing them to choose to agree to or reject the automated decision results; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0067] like Figure 2 As shown, the first cloud service node can be either cloud service node P1 or cloud service node P2, and the corresponding second cloud service node can be either cloud service node P2 or cloud service node P1.

[0068] Similarly, the first cloud domain can be CLOUD1 or CLOUD2, and the second cloud domain can be CLOUD2 or CLOUD1.

[0069] Similarly, the first proxy node can be either proxy node T1 or proxy node T2, and the second proxy node can be either proxy node T2 or proxy node T1.

[0070] Similarly, the first terminal can be U1 or U2, and the second terminal can be U2 or U1.

[0071] The first cloud service node receives the first authentication message sent by the first terminal, including:

[0072] The first cloud service node receives the first authentication message generated and sent by the first terminal after signing the first terminal's private key.

[0073] In step S2 above, the second cloud service node receives the first authentication message and the key forwarded by the second proxy node from the main proxy node, and recovers the second session key based on the key and the second terminal private key, thus completing the second terminal authentication. The second authentication message also carries the second terminal public key; correspondingly, after the step of completing the second terminal authentication, the cross-cloud authentication processing method further includes:

[0074] The second cloud service node uses the public key of the second terminal to encrypt the authentication completion information of the second terminal, and then sends the encrypted authentication completion information to the second terminal.

[0075] In step S3 above, the second cloud service node of the device receives the second authentication message sent by the second terminal and sends a second key request message to the second agent node, so that the second agent node forwards the second key request message to the general agent node, so that the general agent node determines the first terminal identifier corresponding to the second terminal identifier and the key according to the mapping relationship;

[0076] The second authentication message carries a second terminal identifier, and the second key request message carries the second authentication message. The second cloud service node receives the second authentication message sent by the second terminal, including:

[0077] The second cloud service node receives the second authentication message generated and sent by the second terminal after the second terminal signs the second terminal's private key.

[0078] In step S4 above, the first cloud service node receives the second authentication message and the key forwarded by the first proxy node from the main proxy node, and recovers the first session key based on the key and the first terminal private key, thus completing the first terminal authentication. The first authentication message also carries the first terminal public key; correspondingly, after the step of completing the first terminal authentication, the cross-cloud authentication processing method further includes:

[0079] The first cloud service node uses the first terminal's public key to encrypt the first terminal's authentication completion information and sends the encrypted first terminal authentication completion information to the first terminal.

[0080] Before the step of the first cloud service node receiving the first authentication message sent by the first terminal, the cross-cloud authentication processing method further includes:

[0081] The first cloud service node divides the first session key into the key and the first terminal private key;

[0082] The first terminal private key is sent to the first terminal, and the key is sent to the first proxy node, so that the first proxy node can send the key to the main proxy node, and the main proxy node can establish the mapping relationship based on the key corresponding to the first terminal sent by the first proxy node and the key corresponding to the second terminal sent by the second proxy node in advance.

[0083] Before the step of the second cloud service node receiving the second authentication message sent by the second terminal, the cross-cloud authentication processing method further includes:

[0084] The second cloud service node splits the second session key into the key and the second terminal private key;

[0085] The second terminal private key is sent to the second terminal, and the key is sent to the second proxy node, so that the second proxy node can send the key to the main proxy node, and the main proxy node can establish the mapping relationship based on the key corresponding to the second terminal sent by the second proxy node and the key corresponding to the first terminal sent by the first proxy node in advance.

[0086] Taking the first cloud domain as CLOUD1, the first cloud service node as cloud service node P1, the first proxy node as proxy node T1, and the first terminal as U1, the second cloud domain as CLOUD2, the second cloud service node as cloud service node P2, the second proxy node as proxy node T2, and the second terminal as U2 as an example, the explanation is as follows:

[0087] After cloud server node P1 in CLOUD1 generates the first session key S1, it divides S1 into two parts (m, k). The first terminal private key m is sent to the first terminal U1, and the key k is sent to the first proxy node T1 in CLOUD1. At the same time, the first proxy node T1 stores the key k in the main proxy node. Similarly, after cloud service node P2 in CLOUD2 generates the second session key S2, it divides S2 into two parts (n, k). The second terminal private key n is sent to the second terminal U2, and the key k (the same as k in CLOUD1) is sent to the first proxy node T2 in CLOUD2. At the same time, the second proxy node T2 stores the key k in the main proxy node and establishes a mapping relationship.

[0088] The following explains cross-cloud authentication:

[0089] 1. The first terminal U1 signs the first terminal private key m, generates a first authentication message and sends it to P1. The first authentication message carries the first terminal public key and the first terminal identifier.

[0090] 2. After receiving the first authentication message, P1 sends a first key request message to the first agent node T1; the first key request message carries the first authentication message.

[0091] 3. After receiving the first key request message, T1 sends the first key request message to the general agent node;

[0092] 4. After receiving the first key request message, the master agent node sends the first authentication message and key k to the second agent node T2 in CLOUD2;

[0093] 5. After receiving the first authentication message and the key k, T2 sends them to P2;

[0094] 6. P2 uses key k and combines it with the second terminal key n to recover the second session key S2. At this point, the second terminal authentication is successful.

[0095] 7. The second terminal U2 signs the second terminal private key n, generates a second authentication message and sends it to P2. The second authentication message carries the second terminal public key and the second terminal identifier.

[0096] 8. After receiving the second authentication message, P2 sends a second key request message to the second agent node T2; the second key request message carries the second authentication message.

[0097] 9. After receiving the second key request message, T2 sends the second key request message to the master agent node;

[0098] 10. After receiving the second key request message, the master agent node sends the second authentication message and key k to the first agent node T1 in CLOUD1;

[0099] 11. After receiving the second authentication message and the key k, T1 sends them to P1;

[0100] 12. P1 uses key k and combines it with the first terminal key m to recover the first session key S1. At this point, the first terminal authentication is successful.

[0101] After the first terminal is successfully authenticated, the cloud service node P1 uses the first terminal's public key to encrypt the first terminal's authentication completion information and sends the encrypted first terminal authentication completion information to the first terminal U1.

[0102] The first terminal U1 receives the encrypted first terminal authentication completion information, decrypts it, and confirms the identity of the cloud service node P1.

[0103] After successful authentication of the second terminal, cloud service node P2 uses the public key of the second terminal to encrypt the authentication completion information of the second terminal, and sends the encrypted authentication completion information to the second terminal U2.

[0104] The second terminal U2 receives the encrypted second terminal authentication completion information, decrypts it, and confirms the identity of the cloud service node P2.

[0105] The cross-cloud authentication processing method provided in this invention introduces a distributed computing architecture to segment the keys generated by cloud service nodes. Furthermore, the message authentication process requires the joint participation of both cloud service nodes and proxy nodes, reducing excessive reliance on cloud service nodes. Simultaneously, the use of a central proxy node between domains overcomes the problem of low efficiency in cross-cloud certificate issuance. Applying this model to a cloud service environment effectively solves the security problem of cross-cloud access for users in a cloud service environment.

[0106] The cross-cloud authentication processing method provided in this embodiment of the invention has the following beneficial effects:

[0107] 1. By using a distributed approach for identity authentication and splitting the key, attackers who want to obtain the key for cloud services need not only to obtain the user's key but also to compromise the proxy node, which greatly improves the security of the main server in the cloud.

[0108] 2. The cloud platform adopts a general agent node approach, which overcomes the certificate validity issue of cross-domain authentication and improves the efficiency of cross-domain authentication.

[0109] The cross-cloud authentication processing method provided in this embodiment of the invention involves a first cloud service node receiving a first authentication message from a first terminal and sending a first key request message to a first proxy node. This causes the first proxy node to forward the first key request message to a master proxy node, which then determines a second terminal identifier corresponding to the first terminal identifier and a key shared by the first and second terminals based on a pre-stored mapping relationship. The first authentication message carries the first terminal identifier, the first key request message carries the first authentication message, and the mapping relationship includes a mapping relationship between the first terminal identifier, the second terminal identifier, and the key. A second cloud service node receives the first authentication message and the key forwarded from the master proxy node by the second proxy node, and then, based on the key and the second terminal's private key... The process involves: recovering the second session key and completing second terminal authentication; the second cloud service node receiving the second authentication message from the second terminal and sending a second key request message to the second proxy node, causing the second proxy node to forward the second key request message to the main proxy node, so that the main proxy node can determine the first terminal identifier corresponding to the second terminal identifier and the key according to the mapping relationship; wherein, the second authentication message carries the second terminal identifier and the second key request message carries the second authentication message; the first cloud service node receiving the second authentication message and the key forwarded from the main proxy node by the first proxy node, recovering the first session key according to the key and the first terminal private key, and completing first terminal authentication, which can improve the efficiency of cross-cloud certificate issuance and ensure the security of cross-cloud access information.

[0110] Furthermore, the first cloud service node receives the first authentication message sent by the first terminal, including:

[0111] The first cloud service node receives the first authentication message generated and sent by the first terminal after signing its private key. This can be referred to the above embodiment for further explanation, and will not be repeated here.

[0112] The cross-cloud authentication processing method provided in this embodiment of the invention ensures the security of the first authentication message.

[0113] Furthermore, the second cloud service node receives the second authentication message sent by the second terminal, including:

[0114] The second cloud service node receives the second authentication message generated and sent by the second terminal after signing its private key. This can be referred to the above embodiment for further explanation, and will not be repeated here.

[0115] The cross-cloud authentication processing method provided in this embodiment of the invention ensures the security of the second authentication message.

[0116] Furthermore, the first authentication message also carries the first terminal public key; correspondingly, after the step of completing the first terminal authentication, the cross-cloud authentication processing method further includes:

[0117] The first cloud service node uses the first terminal's public key to encrypt the first terminal's authentication completion information, and then sends the encrypted first terminal authentication completion information to the first terminal. This can be referred to the above embodiment for further explanation, and will not be repeated here.

[0118] The cross-cloud authentication processing method provided in this embodiment of the invention ensures the security of the authentication completion information of the first terminal.

[0119] Furthermore, the second authentication message also carries a second terminal public key; correspondingly, after the step of completing the second terminal authentication, the cross-cloud authentication processing method further includes:

[0120] The second cloud service node uses the public key of the second terminal to encrypt the authentication completion information of the second terminal, and then sends the encrypted authentication completion information to the second terminal. This can be referred to the above embodiment for further explanation, and will not be repeated here.

[0121] The cross-cloud authentication processing method provided in this embodiment of the invention ensures the security of the authentication completion information of the second terminal.

[0122] Furthermore, prior to the step of the first cloud service node receiving the first authentication message sent by the first terminal, the cross-cloud authentication processing method further includes:

[0123] The first cloud service node divides the first session key into the key and the first terminal private key; this can be described with reference to the above embodiments and will not be repeated here.

[0124] The first terminal's private key is sent to the first terminal, and the key is sent to the first proxy node, so that the first proxy node can send the key to the main proxy node. The main proxy node then establishes the mapping relationship based on the key corresponding to the first terminal sent by the first proxy node and the key corresponding to the second terminal sent by the second proxy node, which was obtained in advance. This can be referred to the above embodiment for further explanation, and will not be repeated here.

[0125] The cross-cloud authentication processing method provided in this embodiment of the invention ensures the smooth progress of subsequent cross-cloud authentication through preprocessing.

[0126] Furthermore, prior to the step of the second cloud service node receiving the second authentication message sent by the second terminal, the cross-cloud authentication processing method further includes:

[0127] The second cloud service node divides the second session key into the key and the second terminal private key; this can be described with reference to the above embodiments and will not be repeated here.

[0128] The private key of the second terminal is sent to the second terminal, and the key is sent to the second proxy node, so that the second proxy node can send the key to the main proxy node, and the main proxy node can establish the mapping relationship based on the key corresponding to the second terminal sent by the second proxy node and the key corresponding to the first terminal sent by the first proxy node in advance. This can be referred to the above embodiment for explanation, and will not be repeated here.

[0129] The cross-cloud authentication processing method provided in this embodiment of the invention ensures the smooth progress of subsequent cross-cloud authentication through preprocessing.

[0130] It should be noted that the cross-cloud authentication processing method provided in this embodiment of the invention can be used in the financial field, or in any technical field other than the financial field. This embodiment of the invention does not limit the application field of the cross-cloud authentication processing method.

[0131] Figure 3 This is a schematic diagram of the cross-cloud authentication processing device provided in an embodiment of the present invention, as shown below. Figure 3 As shown, the cross-cloud authentication processing device provided in this embodiment of the invention is applied to a first cloud service node included in a first cloud domain and a second cloud service node included in a second cloud domain, and includes a first sending unit 301, a first receiving unit 302, a second sending unit 303, and a second receiving unit 304, wherein:

[0132] The first sending unit 301 is configured to receive a first authentication message sent by a first terminal through a first cloud service node, and send a first key request message to a first agent node, so that the first agent node forwards the first key request message to a general agent node, so that the general agent node determines a second terminal identifier corresponding to the first terminal identifier and a key shared by the first terminal and the second terminal according to a mapping relationship pre-stored locally; wherein, the first authentication message carries the first terminal identifier, the first key request message carries the first authentication message, and the mapping relationship includes the mapping relationship between the first terminal identifier, the second terminal identifier, and the key; the first receiving unit 302 is configured to receive the first authentication message and the key forwarded by the second agent node from the general agent node through a second cloud service node, and determine the key and the key shared by the first terminal and the second terminal according to the mapping relationship pre-stored locally. The second terminal private key is used to recover the second session key and complete the second terminal authentication. The second sending unit 303 is used to receive the second authentication message sent by the second terminal through the second cloud service node, and send the second key request message to the second agent node, so that the second agent node forwards the second key request message to the general agent node, so that the general agent node determines the first terminal identifier corresponding to the second terminal identifier and the key according to the mapping relationship. The second authentication message carries the second terminal identifier and the second key request message carries the second authentication message. The second receiving unit 304 is used to receive the second authentication message and the key forwarded by the first agent node from the general agent node through the first cloud service node, and recover the first session key according to the key and the first terminal private key to complete the first terminal authentication.

[0133] Specifically, the first sending unit 301 in the device is used to receive a first authentication message sent by a first terminal through a first cloud service node, and send a first key request message to a first proxy node, so that the first proxy node forwards the first key request message to a general proxy node, so that the general proxy node determines a second terminal identifier corresponding to the first terminal identifier and a key shared by the first terminal and the second terminal according to a mapping relationship pre-stored locally; wherein, the first authentication message carries the first terminal identifier, the first key request message carries the first authentication message, and the mapping relationship includes the mapping relationship between the first terminal identifier, the second terminal identifier, and the key; the first receiving unit 302 is used to receive the first authentication message and the key forwarded by the second proxy node from the general proxy node through a second cloud service node, and determine the key according to the key. The second terminal private key is used to recover the second session key and complete the second terminal authentication; the second sending unit 303 is used to receive the second authentication message sent by the second terminal through the second cloud service node, and send the second key request message to the second agent node, so that the second agent node forwards the second key request message to the general agent node, so that the general agent node determines the first terminal identifier corresponding to the second terminal identifier and the key according to the mapping relationship; wherein, the second authentication message carries the second terminal identifier, and the second key request message carries the second authentication message; the second receiving unit 304 is used to receive the second authentication message and the key forwarded by the first agent node from the general agent node through the first cloud service node, and recover the first session key according to the key and the first terminal private key to complete the first terminal authentication.

[0134] The cross-cloud authentication processing apparatus provided in this embodiment of the invention includes a first cloud service node receiving a first authentication message sent by a first terminal and sending a first key request message to a first proxy node. This causes the first proxy node to forward the first key request message to a master proxy node, which then determines a second terminal identifier corresponding to the first terminal identifier and a key shared by the first and second terminals based on a pre-stored mapping relationship. The first authentication message carries the first terminal identifier, the first key request message carries the first authentication message, and the mapping relationship includes a mapping relationship between the first terminal identifier, the second terminal identifier, and the key. A second cloud service node receives the first authentication message and the key forwarded from the master proxy node by the second proxy node, and then uses the key and the second terminal's private key... The process involves: recovering the second session key and completing second terminal authentication; the second cloud service node receiving the second authentication message from the second terminal and sending a second key request message to the second proxy node, causing the second proxy node to forward the second key request message to the main proxy node, so that the main proxy node can determine the first terminal identifier corresponding to the second terminal identifier and the key according to the mapping relationship; wherein, the second authentication message carries the second terminal identifier and the second key request message carries the second authentication message; the first cloud service node receiving the second authentication message and the key forwarded from the main proxy node by the first proxy node, recovering the first session key according to the key and the first terminal private key, and completing first terminal authentication, which can improve the efficiency of cross-cloud certificate issuance and ensure the security of cross-cloud access information.

[0135] Furthermore, the first sending unit 301 is specifically used to:

[0136] The first cloud service node receives the first authentication message generated and sent by the first terminal after signing the first terminal's private key.

[0137] The cross-cloud authentication processing device provided in this embodiment of the invention ensures the security of the first authentication message.

[0138] Furthermore, the second sending unit 303 is specifically used to:

[0139] The second cloud service node receives the second authentication message generated and sent by the second terminal after the second terminal signs the second terminal's private key.

[0140] The cross-cloud authentication processing device provided in this embodiment of the invention ensures the security of the second authentication message.

[0141] Furthermore, the first authentication message also carries a first terminal public key; correspondingly, after the step of completing the first terminal authentication, the cross-cloud authentication processing device is further used to:

[0142] The first cloud service node uses the first terminal's public key to encrypt the first terminal's authentication completion information and sends the encrypted first terminal authentication completion information to the first terminal.

[0143] The cross-cloud authentication processing device provided in this embodiment of the invention ensures the security of the authentication completion information of the first terminal.

[0144] Furthermore, the second authentication message also carries a second terminal public key; correspondingly, after the step of completing the second terminal authentication, the cross-cloud authentication processing device is further used to:

[0145] The second cloud service node uses the public key of the second terminal to encrypt the authentication completion information of the second terminal, and then sends the encrypted authentication completion information to the second terminal.

[0146] The cross-cloud authentication processing device provided in this embodiment of the invention ensures the security of the authentication completion information of the second terminal.

[0147] Furthermore, before the step of the first cloud service node receiving the first authentication message sent by the first terminal, the cross-cloud authentication processing device is also used to:

[0148] The first cloud service node divides the first session key into the key and the first terminal private key;

[0149] The first terminal private key is sent to the first terminal, and the key is sent to the first proxy node, so that the first proxy node can send the key to the main proxy node, and the main proxy node can establish the mapping relationship based on the key corresponding to the first terminal sent by the first proxy node and the key corresponding to the second terminal sent by the second proxy node in advance.

[0150] The cross-cloud authentication processing device provided in this embodiment of the invention ensures the smooth progress of subsequent cross-cloud authentication through preprocessing.

[0151] Furthermore, before the step of the second cloud service node receiving the second authentication message sent by the second terminal, the cross-cloud authentication processing device is also used to:

[0152] The second cloud service node splits the second session key into the key and the second terminal private key;

[0153] The second terminal private key is sent to the second terminal, and the key is sent to the second proxy node, so that the second proxy node can send the key to the main proxy node, and the main proxy node can establish the mapping relationship based on the key corresponding to the second terminal sent by the second proxy node and the key corresponding to the first terminal sent by the first proxy node in advance.

[0154] The cross-cloud authentication processing device provided in this embodiment of the invention ensures the smooth progress of subsequent cross-cloud authentication through preprocessing.

[0155] The embodiments of the cross-cloud authentication processing device provided in this invention can be used to execute the processing flow of the above-described method embodiments. Its functions will not be repeated here, but can be referred to the detailed description of the above-described method embodiments.

[0156] Figure 4 This is a schematic diagram of the physical structure of an electronic device provided in an embodiment of the present invention, such as... Figure 4 As shown, the electronic device includes: a processor 401, a memory 402, and a bus 403;

[0157] The processor 401 and the memory 402 communicate with each other via the bus 403.

[0158] The processor 401 is used to call program instructions in the memory 402 to execute the methods provided in the above-described method embodiments, including, for example:

[0159] The first cloud service node receives the first authentication message sent by the first terminal and sends the first key request message to the first agent node, so that the first agent node forwards the first key request message to the general agent node, so that the general agent node determines the second terminal identifier corresponding to the first terminal identifier and the key shared by the first terminal and the second terminal according to the mapping relationship stored locally in advance.

[0160] Wherein, the first authentication message carries a first terminal identifier, the first key request message carries the first authentication message, and the mapping relationship includes the mapping relationship between the first terminal identifier, the second terminal identifier, and the key;

[0161] The second cloud service node receives the first authentication message and the key forwarded by the second agent node from the main agent node, and recovers the second session key based on the key and the second terminal private key to complete the second terminal authentication;

[0162] The second cloud service node receives the second authentication message sent by the second terminal and sends a second key request message to the second agent node, so that the second agent node forwards the second key request message to the main agent node, so that the main agent node determines the first terminal identifier corresponding to the second terminal identifier and the key according to the mapping relationship;

[0163] The second authentication message carries a second terminal identifier, and the second key request message carries the second authentication message.

[0164] The first cloud service node receives the second authentication message and the key forwarded by the first agent node from the general agent node, and recovers the first session key based on the key and the first terminal private key to complete the first terminal authentication.

[0165] This embodiment discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, and when the program instructions are executed by a computer, the computer can perform the methods provided in the above-described method embodiments, such as:

[0166] The first cloud service node receives the first authentication message sent by the first terminal and sends the first key request message to the first agent node, so that the first agent node forwards the first key request message to the general agent node, so that the general agent node determines the second terminal identifier corresponding to the first terminal identifier and the key shared by the first terminal and the second terminal according to the mapping relationship stored locally in advance.

[0167] Wherein, the first authentication message carries a first terminal identifier, the first key request message carries the first authentication message, and the mapping relationship includes the mapping relationship between the first terminal identifier, the second terminal identifier, and the key;

[0168] The second cloud service node receives the first authentication message and the key forwarded by the second agent node from the main agent node, and recovers the second session key based on the key and the second terminal private key to complete the second terminal authentication;

[0169] The second cloud service node receives the second authentication message sent by the second terminal and sends a second key request message to the second agent node, so that the second agent node forwards the second key request message to the main agent node, so that the main agent node determines the first terminal identifier corresponding to the second terminal identifier and the key according to the mapping relationship;

[0170] The second authentication message carries a second terminal identifier, and the second key request message carries the second authentication message.

[0171] The first cloud service node receives the second authentication message and the key forwarded by the first agent node from the general agent node, and recovers the first session key based on the key and the first terminal private key to complete the first terminal authentication.

[0172] This embodiment provides a computer-readable storage medium storing a computer program that causes the computer to execute the methods provided in the above-described method embodiments, including, for example:

[0173] The first cloud service node receives the first authentication message sent by the first terminal and sends the first key request message to the first agent node, so that the first agent node forwards the first key request message to the general agent node, so that the general agent node determines the second terminal identifier corresponding to the first terminal identifier and the key shared by the first terminal and the second terminal according to the mapping relationship stored locally in advance.

[0174] Wherein, the first authentication message carries a first terminal identifier, the first key request message carries the first authentication message, and the mapping relationship includes the mapping relationship between the first terminal identifier, the second terminal identifier, and the key;

[0175] The second cloud service node receives the first authentication message and the key forwarded by the second agent node from the main agent node, and recovers the second session key based on the key and the second terminal private key to complete the second terminal authentication;

[0176] The second cloud service node receives the second authentication message sent by the second terminal and sends a second key request message to the second agent node, so that the second agent node forwards the second key request message to the main agent node, so that the main agent node determines the first terminal identifier corresponding to the second terminal identifier and the key according to the mapping relationship;

[0177] The second authentication message carries a second terminal identifier, and the second key request message carries the second authentication message.

[0178] The first cloud service node receives the second authentication message and the key forwarded by the first agent node from the general agent node, and recovers the first session key based on the key and the first terminal private key to complete the first terminal authentication.

[0179] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0180] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0181] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0182] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0183] In the description of this specification, the references to terms such as "an embodiment," "a specific embodiment," "some embodiments," "for example," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0184] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A cross-cloud authentication processing method, characterized in that, Applied to a system comprising a first cloud domain and a second cloud domain, wherein the first cloud domain includes a first cloud service node, a first proxy node, and a first terminal, and the second cloud domain includes a second cloud service node, a second proxy node, and a second terminal, the cross-cloud authentication processing method includes: The first cloud service node receives the first authentication message sent by the first terminal and sends the first key request message to the first agent node, so that the first agent node forwards the first key request message to the general agent node, so that the general agent node determines the second terminal identifier corresponding to the first terminal identifier and the key shared by the first terminal and the second terminal according to the mapping relationship stored locally in advance. Wherein, the first authentication message carries a first terminal identifier, the first key request message carries the first authentication message, and the mapping relationship includes the mapping relationship between the first terminal identifier, the second terminal identifier, and the key; The second cloud service node receives the first authentication message and the key forwarded by the second agent node from the main agent node, and recovers the second session key based on the key and the second terminal private key to complete the second terminal authentication; The second cloud service node receives the second authentication message sent by the second terminal and sends a second key request message to the second agent node, so that the second agent node forwards the second key request message to the main agent node, so that the main agent node determines the first terminal identifier corresponding to the second terminal identifier and the key according to the mapping relationship; The second authentication message carries a second terminal identifier, and the second key request message carries the second authentication message. The first cloud service node receives the second authentication message and the key forwarded by the first agent node from the general agent node, and recovers the first session key based on the key and the first terminal private key to complete the first terminal authentication.

2. The cross-cloud authentication processing method according to claim 1, characterized in that, The first cloud service node receives the first authentication message sent by the first terminal, including: The first cloud service node receives the first authentication message generated and sent by the first terminal after signing the first terminal's private key.

3. The cross-cloud authentication processing method according to claim 1, characterized in that, The second cloud service node receives the second authentication message sent by the second terminal, including: The second cloud service node receives the second authentication message generated and sent by the second terminal after the second terminal signs the second terminal's private key.

4. The cross-cloud authentication processing method according to claim 1, characterized in that, The first authentication message also carries a first terminal public key; correspondingly, after the step of completing the first terminal authentication, the cross-cloud authentication processing method further includes: The first cloud service node uses the first terminal's public key to encrypt the first terminal's authentication completion information and sends the encrypted first terminal authentication completion information to the first terminal.

5. The cross-cloud authentication processing method according to claim 1, characterized in that, The second authentication message also carries a second terminal public key; correspondingly, after the step of completing the second terminal authentication, the cross-cloud authentication processing method further includes: The second cloud service node uses the public key of the second terminal to encrypt the authentication completion information of the second terminal, and then sends the encrypted authentication completion information to the second terminal.

6. The cross-cloud authentication processing method according to any one of claims 1 to 5, characterized in that, Before the step of the first cloud service node receiving the first authentication message sent by the first terminal, the cross-cloud authentication processing method further includes: The first cloud service node divides the first session key into the key and the first terminal private key; The first terminal private key is sent to the first terminal, and the key is sent to the first proxy node, so that the first proxy node can send the key to the main proxy node, and the main proxy node can establish the mapping relationship based on the key corresponding to the first terminal sent by the first proxy node and the key corresponding to the second terminal sent by the second proxy node in advance.

7. The cross-cloud authentication processing method according to any one of claims 1 to 5, characterized in that, Before the step of the second cloud service node receiving the second authentication message sent by the second terminal, the cross-cloud authentication processing method further includes: The second cloud service node splits the second session key into the key and the second terminal private key; The second terminal private key is sent to the second terminal, and the key is sent to the second proxy node, so that the second proxy node can send the key to the main proxy node, and the main proxy node can establish the mapping relationship based on the key corresponding to the second terminal sent by the second proxy node and the key corresponding to the first terminal sent by the first proxy node in advance.

8. A cross-cloud authentication processing device, characterized in that, Applied to a system comprising a first cloud domain and a second cloud domain, wherein the first cloud domain includes a first cloud service node, a first proxy node, and a first terminal, and the second cloud domain includes a second cloud service node, a second proxy node, and a second terminal, wherein the first cloud service node includes a first sending unit and a second receiving unit, and the second cloud service node includes a second sending unit and a first receiving unit, the cross-cloud authentication processing device includes: The first sending unit is configured to receive a first authentication message sent by a first terminal and send a first key request message to a first agent node, so that the first agent node forwards the first key request message to a general agent node, so that the general agent node determines the second terminal identifier corresponding to the first terminal identifier and the key shared by the first terminal and the second terminal according to the mapping relationship stored locally in advance. Wherein, the first authentication message carries a first terminal identifier, the first key request message carries the first authentication message, and the mapping relationship includes the mapping relationship between the first terminal identifier, the second terminal identifier, and the key; The first receiving unit is configured to receive the first authentication message and the key forwarded by the second agent node from the main agent node, recover the second session key based on the key and the second terminal private key, and complete the second terminal authentication. The second sending unit is configured to receive a second authentication message sent by the second terminal and send a second key request message to the second agent node, so that the second agent node forwards the second key request message to the main agent node, so that the main agent node determines the first terminal identifier corresponding to the second terminal identifier and the key according to the mapping relationship; The second authentication message carries a second terminal identifier, and the second key request message carries the second authentication message. The second receiving unit is used to receive the second authentication message and the key forwarded by the first agent node from the main agent node, recover the first session key based on the key and the first terminal private key, and complete the first terminal authentication.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images