Access control method, access credential generation method and access control system

Abstract

One or more embodiments of the invention provide an access control method, an access credential generation method and an access control system, which can be applied to a cloud platform and specifically can obtain a platform internal trusted network range corresponding to a target account so as to generate an address white list for the target account; generating an access credential for the target account based on the address white list; a cloud platform gateway receives an access request sent by a target account, then can extract an address white list of the target account from an access credential carried by the access request, determines that the access request does not pass address authentication in response to the situation that a source address of the access request does not hit the address white list, and intercepts the access request. According to the scheme, an attacker can be effectively prevented from accessing the cloud platform by using an illegal network after the access credential is leaked, the security of the cloud platform is improved, and the platform-level access credential security management is realized.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of cloud technology, and more particularly to an access control method, an access credential generation method, and an access control system. Background Art

[0002] An account is the basic identity credential for accessing and using the cloud platform. Each account is associated with specific permissions and resources, allowing users to deploy, manage, and access resources based on account permissions.

[0003] Currently, accounts usually use AK (Access Key) as the core credential for accessing cloud platforms. However, AK has the risk of leakage. After stealing AK, attackers may launch attacks on cloud platforms, posing greater security risks to cloud platforms. Summary of the invention

[0004] In view of this, one or more embodiments of this specification provide the following technical solutions: According to a first aspect of one or more embodiments of this specification, an access control method is proposed, which is applied to a cloud platform gateway, including: Receive an access request sent by a target account, wherein the access request carries an access credential; Extracting an address whitelist of the target account from the access credential, wherein the address whitelist is used to record a trusted network range corresponding to the target account; Obtaining a source address of the access request; In response to the source address not hitting the address whitelist, it is determined that the access request fails address authentication, and the access request is intercepted.

[0005] According to a second aspect of one or more embodiments of this specification, a method for generating access credentials is proposed, which is applied to an access control unit deployed in a cloud platform, including: Obtaining a trusted network range corresponding to a target account to generate an address whitelist for the target account; An access credential is generated for the target account based on the address whitelist, so that the target account can initiate an access request based on the access credential, wherein the cloud platform gateway performs access control on the access request based on the aforementioned access control method.

[0006] According to a third aspect of one or more embodiments of this specification, an access control system is proposed, which is applied to a cloud platform, wherein a cloud platform gateway and an access control unit are deployed in the cloud platform, wherein: The access control unit is used to obtain a trusted network range corresponding to a target account to generate an address whitelist for the target account, and generate an access credential for the target account based on the address whitelist; The cloud platform gateway is used to receive an access request sent by the target account, wherein the access request carries the access credential; extract the address whitelist of the target account from the access credential; obtain the source address of the access request; and in response to the source address not hitting the address whitelist, determine that the access request fails to pass address authentication, and intercept the access request.

[0007] According to a fourth aspect of one or more embodiments of this specification, an electronic device is proposed, comprising: a processor; a memory for storing processor executable instructions; wherein the processor implements the steps of the method described in the first or second aspect above by running the executable instructions.

[0008] According to a fifth aspect of one or more embodiments of the present specification, a computer-readable storage medium is provided, on which computer instructions are stored. When the instructions are executed by a processor, the steps of the method described in the first or second aspect are implemented.

[0009] According to a sixth aspect of one or more embodiments of the present specification, a computer program product is proposed, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the method described in the first or second aspect above.

[0010] It can be seen from the above embodiments that after receiving an access request from a target account, the cloud platform gateway of this specification can extract an address whitelist from the access credentials carried in the access request. If it is determined that the source address of the access request does not hit the address whitelist, it can be explained that the network initiating the access request is not within the trusted network range, and the access request can be intercepted.

[0011] It can be seen that this specification adds the address whitelist of the target account to the access credentials of the target account, so that after receiving the access request carrying the access credentials, the cloud platform gateway can extract the address whitelist therefrom, and perform address authentication on the access request based on the source address of the access request and the address whitelist. If the address authentication fails, even if the access request can be authenticated by the key pair, the access request will still be intercepted, thereby effectively preventing attackers from using illegal networks to access the cloud platform after the access credentials are leaked, thereby improving the security of the cloud platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a schematic diagram of the architecture of an access control system provided by an exemplary embodiment.

[0013] Figure 2 It is a flowchart of an access control method provided by an exemplary embodiment.

[0014] Figure 3 It is a flowchart of a method for generating access credentials provided by an exemplary embodiment.

[0015] Figure 4 is a flowchart of another access credential generation method provided by an exemplary embodiment.

[0016] Figure 5 It is a schematic diagram of a method for generating access credentials provided by an exemplary embodiment.

[0017] Figure 6 It is a flowchart of another access control method provided by an exemplary embodiment.

[0018] Figure 7 It is a structural schematic diagram of a device provided by an exemplary embodiment.

[0019] Figure 8 It is a block diagram of an access control device provided by an exemplary embodiment.

[0020] Fig. 9 It is a block diagram of an access credential generating device provided by an exemplary embodiment. DETAILED DESCRIPTION

[0021] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this manual are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0022] An account is the basic identity credential for accessing and using the cloud platform. Each account is associated with specific permissions and resources, allowing users to deploy, manage, and access resources based on account permissions.

[0023] Currently, accounts usually use AK as the core credential for accessing cloud platforms. However, AK is at risk of leakage. After stealing AK, attackers may launch attacks on cloud platforms, posing greater security risks to cloud platforms.

[0024] For example, developers may overlook the sensitivity of the AK, especially when hard-coding it in the code for convenience during development, which could expose the AK once the code is made public.

[0025] For another example, attackers may try to steal AK through phishing, exploiting software vulnerabilities, and credential stuffing attacks.

[0026] In response to the above problems, the present invention provides an access control and access credential generation solution, which can add the trusted network range corresponding to the account to the access credential of the account. When the account accesses the cloud platform, the cloud platform gateway performs address authentication on the source address used by the account based on the trusted network address range in the access credential, which can effectively avoid the security risks caused by the illegal use of the account by attackers after the access credential is leaked.

[0027] This specification describes the solution in detail below in conjunction with specific embodiments.

[0028] Figure 1 FIG. 1 is a schematic diagram of an access control system provided by an exemplary embodiment. Figure 1 As shown, the system may include an electronic device 11, an access control unit 12, a cloud platform gateway 13 and a cloud platform backend server 14.

[0029] The electronic device 11 can be a PC (Personal Computer), a mobile phone, a tablet device, a laptop computer, a PDA (Personal Digital Assistants), a wearable device (such as smart glasses, smart watches, etc.), etc. In some scenarios, the electronic device 11 can also be a physical server, and one or more embodiments of this specification do not limit this.

[0030] During operation, the electronic device can run the client-side program provided by the cloud platform to access the cloud platform. Among them, the above-mentioned client-side application can be started and run on the electronic device. The client-side program can be a native application installed on the electronic device, or the client-side program can be a small program, a quick application or other similar forms. Of course, when using web page technologies such as HTML5 or similar, the relevant functions can be implemented through the page displayed by the browser. The browser here can be an independent browser application or a browser module embedded in certain applications.

[0031] The access control unit 12 is usually a service provided by the cloud platform to help users manage their identities and access rights. For example, it can generate and issue access credentials for registered accounts, and the registered accounts can add the access credentials to the access request for access authentication when accessing the cloud platform. The access control unit 12 can be a physical server, or other carriers such as a virtual machine or a container.

[0032] The cloud platform gateway 13 is a key component in the cloud platform architecture, and provides a variety of functions to ensure the efficient, secure and stable operation of cloud services. For example, the cloud platform gateway 13 can implement security policies such as access control. For example, after receiving the access request sent by the electronic device 11, the cloud platform gateway 13 can authenticate the access request based on the access credentials carried in the access request. If the authentication is successful, the access request can be sent to the cloud platform backend server 14. If the authentication fails, the cloud platform gateway 13 can intercept the access request. Among them, the cloud platform gateway 13 can be a physical server, or it can be other carriers such as a virtual machine and a container.

[0033] The cloud platform backend server 14 may be a physical server including an independent host, or the server 14 may be a virtual server carried by a host cluster. During operation, the cloud platform backend server 14 may provide various cloud services for the login account.

[0034] As for the network for interaction between the electronic device 11 and the access control unit 12, the electronic device 11 and the cloud platform gateway 13, and the cloud platform gateway 13 and the cloud platform back-end server 14, the specific choice of using a wired or wireless network to achieve communication can be based on the communication method supported by the corresponding device, and this manual does not limit this.

[0035] Figure 2 It is a flowchart of an access control method provided by an exemplary embodiment.

[0036] Please refer to Figure 2 The access control method provided in this embodiment can be applied in a cloud platform gateway, for example, in a core gateway of a cloud platform, and includes the following steps: Step 202: Receive an access request sent by a target account, wherein the access request carries access credentials.

[0037] In this embodiment, the target account is usually an account registered in the cloud platform, which can be a tenant account or a non-tenant account, such as a service account, resource account, operation and maintenance account, etc. used to manage and operate the cloud platform.

[0038] In this embodiment, when the target account sends an access request, it usually carries access credentials for authentication in the access request, and the access credentials include an access key AK. Of course, in actual implementation, the access request may also include a signature, which is usually obtained by encrypting and calculating the request content using SK (Secret Access Key). The processing and implementation of this part can refer to the relevant technology, and this specification will not be repeated here.

[0039] Step 204: extract the address whitelist of the target account from the access credential, where the address whitelist is used to record the trusted network range corresponding to the target account.

[0040] Based on the aforementioned step 202, after receiving the access request, the cloud platform gateway may extract the address whitelist of the target account from the access credentials carried in the access request to perform address authentication on the access request.

[0041] The address whitelist can be pre-added to the AK to record the trusted network range corresponding to the target account, which may include the underlying network address inside the cloud platform and the VPC (Virtual Private Cloud) network address. The address whitelist can be added by the access control unit of the cloud platform when generating the AK, and its specific generation scheme will be described in detail in subsequent embodiments.

[0042] Step 206: Obtain the source address of the access request.

[0043] In this embodiment, after receiving the access request, the cloud platform gateway may also obtain the source address of the access request from the access request. The source address is usually the original IP address when the access request is initiated.

[0044] It is worth noting that the action of obtaining the source address in this step can be performed after the aforementioned step 204, or before the aforementioned step 204 extracting the address whitelist, or can be performed in parallel with the aforementioned step 204 extracting the address whitelist. This step number 206 does not limit the execution order of the source address extraction action.

[0045] Step 208: In response to the source address not hitting the address whitelist, determining that the access request fails address authentication, and intercepting the access request.

[0046] In this embodiment, it can be determined whether the source address hits the address whitelist extracted in the aforementioned step 204. If the source address does not hit the address whitelist, it can be explained that the network initiating the access request is not within the trusted network range, and further it can be determined that the access request has not passed the address authentication. In this case, regardless of whether the access request passes the key pair authentication, the access request can be directly intercepted.

[0047] If the source address hits the address whitelist, it means that the network that initiates the access request belongs to the trusted network range, and then the access request can be access controlled according to the key pair authentication result of the access request. It is compatible with the original key pair authentication process and realizes the joint authentication of address authentication and key pair authentication.

[0048] The key pair authentication process may include: searching for the SK corresponding to the AK in the access request, then encrypting the request content using the SK, and determining whether the encryption result is consistent with the signature carried in the access request. If they are consistent, it can be determined that the access request has passed the key pair authentication; if they are inconsistent, it is determined that the access request has not passed the key pair authentication.

[0049] In this embodiment, when the access request passes the address authentication, if the access request passes the key pair authentication, the access request can be forwarded to the cloud platform backend server. If the access request does not pass the key pair authentication, even if it has passed the address authentication, the access request needs to be intercepted.

[0050] From the above description, it can be seen that after receiving an access request from the target account, the cloud platform gateway of this manual can extract an address whitelist from the access credentials carried in the access request. If it is determined that the source address of the access request does not hit the address whitelist, it can be explained that the network initiating the access request is not within the trusted network range, and the access request can be intercepted.

[0051] It can be seen that this specification adds the address whitelist of the target account to the access credentials of the target account, so that after receiving the access request carrying the access credentials, the cloud platform gateway can extract the address whitelist therefrom, and perform address authentication on the access request based on the source address of the access request and the address whitelist. If the address authentication fails, even if the access request can be authenticated by the key pair, the access request will still be intercepted, thereby effectively preventing attackers from using illegal networks to access the cloud platform after the access credentials are leaked, thereby improving the security of the cloud platform.

[0052] This specification also provides an access credential generation solution that can be applied to an access control unit deployed in a cloud platform. The access control unit can be an IAM service (Identity and Access Management) deployed in the cloud platform, and its physical carrier can be a server or a server cluster.

[0053] Figure 3 It is a flowchart of a method for generating access credentials provided by an exemplary embodiment.

[0054] Please refer to Figure 3 , the access credential generation method may include the following steps: Step 302: Obtain a trusted network range corresponding to the target account to generate an address whitelist for the target account.

[0055] In this embodiment, the trusted network range may include the underlying network address inside the cloud platform and the VPC network address.

[0056] Among them, the underlying network address inside the cloud platform is usually the address used by the base service inside the cloud platform, which can be planned and configured during the cloud platform deployment phase. It is usually a private network address, which is safe and reliable. In the subsequent operation of the cloud platform, the base network address inside the cloud platform can also be increased as needed.

[0057] The VPC network address is the network address of the virtual private cloud. When obtaining the VPC network address corresponding to the target account, you can first query the VPC identifier (such as VPC ID) of the VPC to which the target account belongs based on the VPC service, and then obtain the VPC network address corresponding to the target account according to the VPC identifier. The VPC network address can be configured through operation and maintenance means.

[0058] In this embodiment, after obtaining the underlying network address and VPC network address inside the cloud platform, a corresponding address whitelist can be generated.

[0059] It should be noted that the address concepts such as "cloud platform internal underlying network address" and "VPC network address" described in this specification can be exact network addresses or address segments. Similarly, the addresses recorded in the address whitelist can include exact network addresses or network address segments. This specification does not impose any special restrictions on this.

[0060] Step 304: Generate access credentials for the target account based on the address whitelist, so that the target account can initiate an access request based on the access credentials.

[0061] Based on the aforementioned step 302, after the address whitelist is generated, the address whitelist can be added to all AKs of the target account respectively to generate access credentials for the target account, and the access credentials can be issued to the target account for address authentication when the target account accesses the cloud platform.

[0062] The address authentication process can refer to the above Figure 2 In the embodiment shown, the cloud platform gateway determines whether the source address of the access request hits the aforementioned address whitelist. If not, it can be determined that the address authentication has failed. If the source address of the access request hits the aforementioned address whitelist, it can be determined that the address authentication has passed.

[0063] From the above description, it can be seen that this specification adds the address whitelist of the target account to the access credentials of the target account, so that after receiving the access request carrying the access credentials, the cloud platform gateway can extract the address whitelist from it, and perform address authentication on the access request based on the address whitelist. If the address authentication fails, the access request will be intercepted, thereby effectively preventing attackers from using illegal networks to access the cloud platform after the access credentials are leaked, thereby improving the security of the cloud platform.

[0064] The specific implementation of the present disclosure is described in detail below from two aspects: access credential generation and access control.

[0065] 1. Generate access credentials In this embodiment, for a newly registered account, an access credential can be generated and issued after the account is successfully registered, so as to serve as a basis for subsequent access to the cloud platform. For an old account, an access credential can be regenerated and issued when the access credential is updated.

[0066] Among them, the timing of updating the access credentials includes: reaching the time point of regular rotation of AK, monitoring AK leakage, and auditing finding high security risks. The processing and implementation of this part can refer to related technologies, and this manual will not go into details here.

[0067] Figure 4 is a flowchart of another access credential generation method provided by an exemplary embodiment. Figure 5 It is a schematic diagram of a method for generating access credentials provided by an exemplary embodiment.

[0068] Please refer to Figure 4 and Figure 5 The access credential generation method described in this embodiment can be applied to an access control unit deployed in a cloud platform, and may include the following steps: Step 402: Query the account type of the target account in the account center.

[0069] In this embodiment, the target account is an account to which access credentials need to be issued, such as the aforementioned newly registered account, or an account to which access credentials need to be updated.

[0070] In this embodiment, before generating access credentials for the target account, it may be determined whether the target account is a key account. For example, the account type of the target account may be queried in the Account and Authentication Service (AAS). The account type may include a key account and a non-key account.

[0071] Among them, the marking methods of account types may include the following two: For a new account, after the new account is created, it can be determined whether the new account is a key account. If it is determined that the new account is a key account, its type can be marked as a key account.

[0072] Specifically, you can monitor new account creation events in the account center, such as database changes. If you monitor that a new account is created, you can query whether the new account is an account used by the VPC network based on the VPC service of the cloud platform. If so, the VPC service can return the VPC identifier to which the new account belongs. Then, you can query the corresponding VPC declaration based on the VPC identifier and determine whether the new account is declared as a critical account in the VPC declaration. If it is declared as a critical account, its account type can be marked as a critical account. If it is not declared as a critical account, its account type can be marked as a non-critical account, or its account type can be left unmarked.

[0073] In actual implementation, the VPC declaration can be extended, and a trusted tag and a key account can be added to the VPC declaration based on VPC information including VPC name, VPC interface, etc. Among them, the trusted tag represents whether the VPC is a trusted VPC. Generally speaking, only trusted VPCs are allowed to set key accounts. If the trusted tag in the VPC declaration is yes, a key account can be added to the VPC declaration, such as adding the account name of the key account. The number of key accounts added to the VPC declaration can be 1 or more. If the trusted tag in the VPC declaration is no, it means that the VPC is not a trusted VPC, and accordingly, no key account is configured. The trusted tag and key account can be added in the form of key-value, and this manual does not impose any special restrictions on this.

[0074] When configuring a VPC statement, for a trusted VPC, you can configure all its accounts as key accounts, or you can configure only some accounts with greater access rights as key accounts. This is because once these accounts with greater access rights are stolen by attackers, it will pose a greater security risk to the cloud platform.

[0075] For accounts created in the Account Center, you can periodically traverse the accounts maintained by the Account Center and mark the account types of accounts with specified attributes as key accounts. Among them, accounts with specified attributes are usually accounts with greater access rights, such as operation and maintenance accounts, resource accounts, service accounts, etc.

[0076] Step 404, when the account type of the target account is a key account, obtain the trusted network range corresponding to the target account to generate an address whitelist for the target account.

[0077] Step 406: Generate access credentials for the target account based on the address whitelist, so that the target account can initiate an access request based on the access credentials.

[0078] Based on the query result of the aforementioned step 402, if the account type of the target account is a key account, the trusted network range corresponding to the target account may be obtained to generate an address whitelist for it.

[0079] On the one hand, the cloud platform internal underlying network address can be obtained as the trusted internal underlying network range. The internal underlying network address is usually planned and configured during the cloud platform deployment phase. It is a private network address and is safe and reliable. For different target accounts, the obtained cloud platform internal underlying network address is the same.

[0080] On the other hand, you can obtain the VPC network address of the VPC to which the target account belongs. The VPC network address is usually configured during the design phase and is also safe and reliable. For example, you can obtain the corresponding VPC network address based on the VPC identifier.

[0081] Specifically, the entire network address of the VPC network can be used as the trusted VPC network range to generate an address whitelist, or part of the addresses in the entire VPC network can be used as the trusted VPC network range to generate an address whitelist. For the same VPC, different trusted VPC network ranges can be configured for different key accounts under it, thereby achieving refined management and control.

[0082] In this embodiment, after obtaining the trusted network range corresponding to the target account, a corresponding address whitelist can be generated. Each network address in the address whitelist is usually marked with the corresponding network type, that is, each network address will be marked as the underlying network address of the cloud platform or the VPC network address. For the VPC network address, the corresponding VPC identifier can be added to the address whitelist.

[0083] Optionally, if the overall network addresses of the VPC network are all trusted VPC networks, only the VPC identifier may be recorded in the address whitelist without adding the corresponding VPC network address.

[0084] In this embodiment, the address whitelist can be added to all AKs of the target account to generate access credentials for the target account, and the generated access credentials can be sent to the target account for the target account to carry and perform address authentication when accessing the cloud platform later.

[0085] It can be seen from the above description that this embodiment can generate an address whitelist only for key accounts, and add the address whitelist to the access credentials of the key accounts. The key accounts will subsequently carry the access credentials when accessing the cloud platform for the cloud platform gateway to perform address authentication. This embodiment only issues access credentials carrying the address whitelist for key accounts, and there is no need to issue access credentials carrying the address whitelist for all cloud platform accounts, which can strike a balance between the processing pressure and security of the cloud platform. Specifically, on the one hand, generating an address whitelist only for key accounts can reduce the processing pressure of the cloud platform, such as saving resources for generating address whitelists, reducing the pressure on the gateway to perform address authentication, etc. On the other hand, it can ensure that after the access credentials of key accounts are leaked, the attacker's use of illegal networks to access the cloud platform can be identified and intercepted by the cloud platform network, thereby ensuring the secure access of key accounts with greater access rights and improving the security of the cloud platform.

[0086] 2. Access Control Figure 6 It is a flowchart of another access control method provided by an exemplary embodiment.

[0087] Please refer to Figure 6 The access control method can be applied in a cloud platform gateway, and includes the following steps: Step 602: Receive an access request sent by a target account, wherein the access request carries access credentials.

[0088] In this embodiment, the cloud platform gateway may receive an access request from a target account forwarded by an SLB device (Server Load Balancer). Of course, in other examples, if the SLB function is not used, the SLB device may not be used to load balance the access request.

[0089] Step 604: extract the address whitelist of the target account from the access credential.

[0090] Based on the aforementioned step 602, after receiving the access request, it may be determined whether the access credential includes an address whitelist, for example, by determining whether the AK carries an address whitelist.

[0091] If the access credential includes an address whitelist, it means that address authentication is required for the access request, the address whitelist can be obtained, and the subsequent steps can be continued.

[0092] If the access credential does not include an address whitelist, it means that address authentication of the access request is not required, and the access request may be authenticated by key pair with reference to relevant technologies, and access control may be performed on the access request based on the key pair authentication result.

[0093] Step 606: Determine whether the access request carries a VPC identifier.

[0094] In this embodiment, for an access request carrying an address whitelist, it may be determined whether the access request carries a VPC identifier, such as a VPC ID.

[0095] Step 608: If the access request carries a VPC identifier, determine whether the source address of the access request matches a VPC network address in the address whitelist.

[0096] Based on the judgment result of the aforementioned step 606, if the access request carries a VPC identifier, it can be indicated that this access belongs to VPC access, and it can be determined whether the source address of the access request hits the VPC network address in the address whitelist. If it hits, it can be indicated that this access comes from a trusted VPC network, and step 612 can be executed.

[0097] If the source address of the access request does not hit the VPC network address in the address whitelist, it means that the access is not from a trusted VPC network, and step 614 can be executed. It should be noted that when judging whether the VPC network address is hit or not, it is usually necessary to compare whether the VPC identifier carried in the access request is the same as the VPC identifier in the address whitelist. If they are not the same, it can be said that the access request is from an untrusted VPC, and the access request can be directly intercepted. If they are the same, the judgment of whether the source address hits the VPC network address can be continued. In actual implementation, if the access request carries a VPC identifier, it can be first determined whether the VPC identifier carried in the access request is the same as the VPC identifier in the address whitelist, and if they are the same, a judgment of whether the source address hits or not can be made.

[0098] In other examples, if the VPC network address corresponding to the VPC identifier is not recorded in the address whitelist, it means that the entire VPC network corresponding to the VPC identifier is a trusted network. If the VPC identifier carried in the access request is the same as the VPC identifier in the address whitelist, it can be said that this access comes from a trusted VPC network, and step 612 can be executed without determining whether the source address is hit or not.

[0099] Step 610: If the access request does not carry a VPC identifier, determine whether the source address of the access request hits the cloud platform internal underlying network address in the address whitelist.

[0100] Based on the judgment result of the aforementioned step 606, if the access request does not carry a VPC identifier, it can be indicated that this access does not belong to VPC access, and it can be determined whether the source address of the access request hits the cloud platform internal underlying network address in the address whitelist.

[0101] If the source address hits the underlying network address inside the platform, it can be explained that this access comes from the underlying network inside the cloud platform, which is safe and reliable, and step 612 can be executed.

[0102] If the source address does not hit the underlying network address inside the platform, it can be explained that the access is not from a trusted network, and step 614 can be executed.

[0103] Step 612: If a hit occurs, it is determined that the access request passes the address authentication, and access control is performed on the access request according to the authentication result of the key pair of the access request.

[0104] In this step, if the source address of the access request hits the address whitelist, in either case, it can be said that the access request comes from a trusted network, and it can be determined that the access request passes the address authentication, and the access request can be access-controlled according to the key pair authentication result of the access request. For example, if the key pair authentication passes, the access request can be forwarded to the backend server, and if the key pair authentication fails, the access request can be intercepted.

[0105] Step 614: If there is no hit, it is determined that the access request does not pass the address authentication, and the access request is intercepted.

[0106] In this step, if the source address of the access request does not hit the address whitelist, in either case, it can be said that the access request does not come from a trusted network. To ensure the security of the cloud platform, the access request can be directly intercepted regardless of whether the access request can pass the key pair authentication.

[0107] Among them, key pair authentication can be executed in parallel with address authentication, or key pair authentication can be executed first and then address authentication, or address authentication can be executed first and then key pair authentication can be executed if address authentication passes, etc. This manual does not impose any special restrictions on this.

[0108] It should be noted that in this embodiment, if an SLB device is deployed, the PPV2 (ProxyProtocol Version 2) protocol can be deployed to implement the transmission of the access request source address and the VPC identifier. The processing and implementation of this part can refer to the relevant technology, and this manual will not go into details here.

[0109] From the above description, it can be seen that this specification adds the address whitelist of the target account to the access credentials of the target account, so that after receiving the access request carrying the access credentials, the cloud platform gateway can extract the address whitelist from it, and perform address authentication on the access request based on the source address of the access request and the address whitelist. If the address authentication fails, even if the access request can be authenticated by the key pair, the access request will still be intercepted, thereby effectively preventing attackers from using illegal networks to access the cloud platform after the access credentials are leaked, thereby improving the security of the cloud platform.

[0110] Figure 7 is a schematic structural diagram of a device provided by an exemplary embodiment. Figure 7 At the hardware level, the device includes a processor 702, an internal bus 704, a network interface 706, a memory 708, and a non-volatile memory 710, and may also include hardware required for other functions. One or more embodiments of this specification may be implemented based on software, such as the processor 702 reading the corresponding computer program from the non-volatile memory 710 into the memory 708 and then running it. Of course, in addition to the software implementation, one or more embodiments of this specification do not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0111] Please refer to Figure 8 The access control device 800 can be applied to Figure 7 The access control device 800 may include: A request receiving module 802 receives an access request sent by a target account, wherein the access request carries an access credential; An address extraction module 804 extracts an address whitelist of the target account from the access credential, wherein the address whitelist is used to record a trusted network range corresponding to the target account; An address determination module 806 is used to obtain a source address of the access request; The address authentication module 808, in response to the source address not hitting the address whitelist, determines that the access request fails address authentication, and intercepts the access request.

[0112] Optionally, the address authentication module 808, in response to the source address hitting the address whitelist, determines that the access request passes address authentication, and performs access control on the access request according to the authentication result of the key pair of the access request.

[0113] Optionally, the address whitelist includes a VPC network address and an underlying network address within the cloud platform, and the process of determining that the access request fails to pass address authentication in response to the source address not hitting the address whitelist includes: In a case where the access request carries a VPC identifier, in response to the source address not hitting the VPC network address in the address whitelist, determining that the access request fails to pass address authentication; In a case where the access request does not carry the VPC identifier, in response to the source address not hitting the cloud platform internal underlying network address in the address whitelist, it is determined that the access request fails address authentication.

[0114] Optionally, the address whitelist records the VPC identifier to which the VPC network address belongs. The address authentication module 808, when the access request carries the VPC identifier, compares the VPC identifier carried in the access request with the VPC identifier recorded in the address whitelist; and when the VPC identifier carried in the access request is the same as the VPC identifier recorded in the address whitelist, executes a step of determining that the access request fails to pass address authentication in response to the source address not hitting the VPC network address in the address whitelist.

[0115] Optionally, if the address authentication module 808 determines that the access credential does not include the address whitelist, the address authentication module 808 performs access control on the access request according to the authentication result of the key pair of the access request.

[0116] Please refer to Fig. 9 The access credential generating device 900 can also be applied to Figure 7 The device shown in the figure is used to implement the technical solution of this specification. The access credential generation device 900 may include: A list generation module 902 obtains a trusted network range corresponding to a target account to generate an address whitelist for the target account; The credential generation module 904 generates access credentials for the target account based on the address whitelist, so that the target account can initiate an access request based on the access credentials, wherein the cloud platform gateway performs access control on the access request based on the aforementioned access control method of this specification.

[0117] Optionally, the device 900 further includes: an account determination module 906, which is used for the account center to query the account type of the target account; when the account type of the target account is a key account, the list generation module 902 executes the step of obtaining the trusted network range corresponding to the target account.

[0118] Optionally, the process of marking the account type in the account center includes: Listen for new account creation events in the account center; In response to a new account being created, querying a VPC declaration corresponding to a VPC to which the new account belongs; In response to the new account being declared as a critical account in the VPC declaration, an account type of the new account is marked as a critical account.

[0119] Optionally, the process of marking the account type in the account center includes: Traverse the account center and mark the account types of accounts with specified attributes in the account center as key accounts.

[0120] Optionally, the process of obtaining the trusted network range corresponding to the target account includes: The underlying network address inside the cloud platform is obtained as the trusted network range corresponding to the target account.

[0121] Optionally, the process of obtaining the trusted network range corresponding to the target account includes: The VPC declaration corresponding to the VPC to which the target account belongs is queried to obtain a pre-declared VPC network address from the VPC declaration as the trusted network range corresponding to the target account.

[0122] Based on the same concept as the above method, this specification also provides an electronic device, including: a processor; a memory for storing processor executable instructions; wherein the processor implements the steps of the method described in any of the above embodiments by running the executable instructions.

[0123] Based on the same concept as the above method, this specification also provides a computer-readable storage medium on which computer instructions are stored. When the instructions are executed by a processor, the steps of the method described in any of the above embodiments are implemented.

[0124] Based on the same concept as the above method, this specification also provides a computer program product, including a computer program / instruction, which implements the steps of the method described in any of the above embodiments when executed by a processor.

Claims

1. An access control method, applied to a cloud platform gateway, comprising: Receive an access request sent by a target account, wherein the access request carries an access credential; Extracting an address whitelist of the target account from the access credential, wherein the address whitelist is used to record a trusted network range corresponding to the target account; Obtaining a source address of the access request; In response to the source address not hitting the address whitelist, it is determined that the access request fails address authentication, and the access request is intercepted.

2. The method according to claim 1, further comprising: In response to the source address hitting the address whitelist, it is determined that the access request passes the address authentication, and access control is performed on the access request according to the authentication result of the key pair of the access request.

3. The method according to claim 1, wherein the address whitelist includes a virtual private cloud (VPC) network address and an underlying network address within the cloud platform, and the process of determining that the access request fails to pass the address authentication in response to the source address not hitting the address whitelist comprises: In a case where the access request carries a VPC identifier, in response to the source address not hitting the VPC network address in the address whitelist, determining that the access request fails to pass address authentication; In a case where the access request does not carry the VPC identifier, in response to the source address not hitting the cloud platform internal underlying network address in the address whitelist, it is determined that the access request fails address authentication.

4. The method according to claim 3, wherein the address whitelist records a VPC identifier to which the VPC network address belongs, and the method further comprises: In the case where the access request carries a VPC identifier, comparing the VPC identifier carried in the access request with the VPC identifier recorded in the address whitelist; In a case where the VPC identifier carried in the access request is the same as the VPC identifier recorded in the address whitelist, a step of determining that the access request fails address authentication in response to the source address not hitting the VPC network address in the address whitelist is performed.

5. The method according to any one of claims 1 to 4, further comprising: If the access credential does not include the address whitelist, access control is performed on the access request according to the authentication result of the key pair of the access request.

6. A method for generating access credentials, applied to an access control unit deployed in a cloud platform, comprising: Obtaining a trusted network range corresponding to a target account to generate an address whitelist for the target account; An access credential is generated for the target account based on the address whitelist, so that the target account can initiate an access request based on the access credential, wherein the cloud platform gateway performs access control on the access request based on the access control method described in any one of claims 1-5.

7. The method according to claim 6, further comprising: Query the account type of the target account in the account center; In a case where the account type of the target account is a key account, a step of acquiring a trusted network range corresponding to the target account is performed.

8. The method according to claim 7, wherein the process of marking the account type in the account center comprises: Listen for new account creation events in the account center; In response to a new account being created, querying a VPC declaration corresponding to a VPC to which the new account belongs; In response to the new account being declared as a critical account in the VPC declaration, an account type of the new account is marked as a critical account.

9. The method according to claim 7, wherein the process of marking the account type in the account center comprises: Traverse the account center and mark the account types of accounts with specified attributes in the account center as key accounts.

10. According to the method of claim 6, the process of obtaining the trusted network range corresponding to the target account comprises: The underlying network address inside the cloud platform is obtained as the trusted network range corresponding to the target account.

11. According to the method of claim 6, the process of obtaining the trusted network range corresponding to the target account comprises: Query the VPC ID of the VPC to which the target account belongs; A corresponding VPC network address is obtained based on the VPC identifier as a trusted network range corresponding to the target account.

12. An access control system, applied to a cloud platform, wherein a cloud platform gateway and an access control unit are deployed in the cloud platform, wherein: The access control unit is used to obtain a trusted network range corresponding to a target account to generate an address whitelist for the target account, and generate an access credential for the target account based on the address whitelist; The cloud platform gateway is configured to receive an access request sent by the target account, wherein the access request carries the access credential; and extract the address whitelist of the target account from the access credential; Obtaining a source address of the access request; In response to the source address not hitting the address whitelist, it is determined that the access request fails address authentication, and the access request is intercepted.

13. An electronic device, comprising: processor; A memory for storing processor-executable instructions; wherein the processor implements the steps of the method according to any one of claims 1 to 11 by executing the executable instructions.

14. A computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the steps of the method according to any one of claims 1 to 11.

15. A computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 11.

Images