Super-computing interface credibility identification method and system and computing equipment

Abstract

The invention discloses a super-computing interface credibility identification method and system and computing equipment, and the method comprises the steps: responding to a request of a client for obtaining a key pair of a super-computing interface, and returning the key pair to the client; receiving a supercomputing interface request sent by the client based on the user identifier in the key pair, wherein the supercomputing interface request comprises request information and a first trusted identifier; acquiring second key information corresponding to the user identifier, and signing the supercomputing interface request based on the second key information to generate a second trusted identifier; and identifying the supercomputing interface request by comparing whether the first credible identifier is consistent with the second credible identifier and judging whether the time difference between the first timestamp from the client and the second timestamp from the server is less than or equal to a time difference threshold, and if the identification is passed, providing computing power resource service for the client. According to the method, the authority control and authorization protection mechanism for accessing the supercomputing interface by the user can be enhanced, and the supercomputing interface request information is prevented from being tampered.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a supercomputer interface trusted identification method, a supercomputer interface trusted identification system and a computing device. Background Art

[0002] The supercomputing center API is an interface used by the supercomputing center to provide software services to the outside world. Based on the services provided by the supercomputing center API, users can easily manage all computing resources, network resources, and storage resources under their name, and can quickly schedule resources and scale them up and down according to business needs. In order to meet the needs of full-scenario access, APIs are usually developed based on the HTTP protocol.

[0003] However, existing supercomputing center APIs often have the following security issues in their implementation: 1) Authentication and authorization are too simple, and relying solely on a username and password combination can be easily cracked; 2) Parameters are easily tampered with. After a supercomputing center API request is intercepted, attackers can easily tamper with request parameters to obtain sensitive data and exhaustively enumerate interface vulnerabilities; 3) Denial of service attacks are not possible. Sending a large number of requests to the supercomputing center API will exhaust server resources, making it impossible for normal users to access the services provided by the supercomputing center API; 4) Insufficient control over the scope of permissions makes it easy for users to access other information beyond their authorized scope.

[0004] Therefore, a supercomputer interface trusted authentication method is needed to solve the problems existing in the above technical solutions. Summary of the invention

[0005] To this end, the present invention provides a supercomputing interface trusted authentication method and a supercomputing interface trusted authentication system to solve or at least alleviate the above problems.

[0006] According to one aspect of the present invention, there is provided a supercomputing interface trusted authentication method, which is executed on a server side to control the access rights of a client to a supercomputing interface, wherein the supercomputing interface is used to provide external computing resource services, and the computing resource services are used to manage computing resources, network resources and storage resources. The server side is in communication with the client side, and the method comprises: in response to a login request from the client side, performing user identity authentication on the client side; in response to a request from the client side to obtain a key pair of the supercomputing interface after the user identity authentication is passed, returning a key pair to the client side, wherein the key pair comprises a user identifier of the client side and first key information corresponding to the user identifier; the client side is adapted to sign the request information based on the first key information to generate a first trusted identifier, and the request information comprises a first timestamp from the client side; and receiving a request from the client side based on the user identifier. A supercomputing interface request is sent, wherein the supercomputing interface request includes the request information and the first trusted identifier; second key information corresponding to the user identifier is obtained from the server, and the supercomputing interface request is signed based on the second key information to generate a second trusted identifier; a first trusted authentication is performed on the supercomputing interface request by comparing whether the first trusted identifier is consistent with the second trusted identifier, and a second trusted authentication is performed on the supercomputing interface request by judging whether the time difference between the first timestamp from the client and the second timestamp from the server is less than or equal to a time difference threshold; if both the first trusted authentication and the second trusted authentication pass, the computing power resource service is provided to the client, so that the client can manage the computing resources, network resources and storage resources corresponding to the user identifier of the client through the computing power resource service.

[0007] Optionally, the supercomputing interface trusted authentication method according to the present invention further includes: if the first trusted authentication and / or the second trusted authentication fails, refusing to provide the computing resource service to the client.

[0008] Optionally, in the supercomputing interface trusted authentication method according to the present invention, it also includes: judging whether the number of supercomputing interface requests corresponding to the user identifier within a predetermined time interval exceeds a flow control threshold; if it exceeds the flow control threshold, limiting the flow of the client to restrict the client from continuing to send supercomputing interface requests.

[0009] Optionally, in the supercomputing interface trusted authentication method according to the present invention, a first trusted authentication is performed on the supercomputing interface request by comparing whether the first trusted identifier is consistent with the second trusted identifier, including: if the first trusted identifier is consistent with the second trusted identifier, it is determined that the first trusted authentication has passed; if the first trusted identifier is inconsistent with the second trusted identifier, it is determined that the first trusted authentication has not passed; by judging whether the time difference between the first timestamp from the client and the second timestamp from the server is less than or equal to a time difference threshold, a second trusted authentication is performed on the supercomputing interface request, including: if the time difference is less than or equal to the time difference threshold, it is determined that the second trusted authentication has passed; if the time difference is greater than the time difference threshold, it is determined that the second trusted authentication has not passed.

[0010] Optionally, in the supercomputing interface trusted authentication method according to the present invention, the request information includes: request method, request path, request header, request query parameters, request parameters, and request behavior information; wherein, the request header includes the first timestamp, Host field and data type, and the request behavior information includes request trusted encryption method, supercomputing interface version information, service information and authorization scope; the client is suitable for generating a regular request string based on the request information, and signing the regular request string based on the first key information to generate a first trusted identifier.

[0011] Optionally, in the supercomputing interface trusted authentication method according to the present invention, the client is further suitable for: regularizing the request header, request query parameters, and request parameters; concatenating the request method and request path with the regularized request header, request query parameters, and request parameters to generate a regular request body; concatenating the request behavior information and the user identifier in the key pair with the regular request body to generate a regular request string; using the request trusted encryption method, encrypting the trusted identification prefix, the first key information, and the regular request string, and converting them into a hexadecimal string to obtain the first trusted identification.

[0012] Optionally, in the supercomputing interface trusted authentication method according to the present invention, providing the computing power resource service to the client includes: providing the computing power resource service corresponding to the authorization scope to the client.

[0013] Optionally, in the supercomputing interface trusted authentication method according to the present invention, the supercomputing interface request is signed based on the second key information to generate a second trusted identifier, including: obtaining request information from the supercomputing interface request; regularizing the request header, request query parameters, and request parameters in the request information; concatenating the request method and request path in the request information with the regularized request header, request query parameters, and request parameters to generate a regular request body; concatenating the request behavior information in the request information and the user identifier in the key pair with the regularized request body to generate a regular request string; using the request trusted encryption method in the request information to encrypt the trusted identifier prefix, the first key information, and the regularized request string, and convert them into a hexadecimal string to obtain the first trusted identifier.

[0014] Optionally, in the supercomputing interface trusted authentication method according to the present invention, the server includes a service monitoring module, a second request signature module, and a user key management module; receiving the supercomputing interface request sent by the client based on the user identifier, including: the service monitoring module monitors the supercomputing interface request sent by the client based on the user identifier, and in response to monitoring the supercomputing interface request, sends a signature request for the supercomputing interface request to the second request signature module; obtaining the second key information corresponding to the user identifier from the server, signing the supercomputing interface request based on the second key information, and generating a second trusted identifier, including: the second request signature module obtains the second key information corresponding to the user identifier from the user key management module in response to the signature request, signs the supercomputing interface request based on the second key information, and generates a second trusted identifier.

[0015] According to one aspect of the present invention, a supercomputing interface trusted authentication system is provided, comprising: a client; a server, which is in communication with the client and is suitable for executing the above method to control the client's access rights to the supercomputing interface, wherein the supercomputing interface is used to provide computing power resource services to the outside, and the computing power resource services are used to manage computing resources, network resources and storage resources; wherein the server comprises:

[0016] A user account management module, adapted to perform user identity authentication on the client in response to a login request from the client;

[0017] A user key management module, adapted to respond to a request from a client to obtain a key pair of a supercomputing interface after the user identity authentication is passed, and return a key pair to the client, wherein the key pair includes a user identifier of the client and first key information corresponding to the user identifier; the client is adapted to sign the request information based on the first key information to generate a first trusted identifier, and the request information includes a first timestamp from the client;

[0018] A service monitoring module, adapted to receive a supercomputing interface request sent by the client based on the user identifier, wherein the supercomputing interface request includes the request information and the first trusted identifier;

[0019] A second request signature module, adapted to obtain second key information corresponding to the user identifier from the user key management module, sign the supercomputing interface request based on the second key information, and generate a second trusted identifier;

[0020] a trusted authentication module, adapted to perform a first trusted authentication on the supercomputing interface request by comparing whether the first trusted identifier is consistent with the second trusted identifier, and to perform a second trusted authentication on the supercomputing interface request by determining whether the time difference between the first timestamp from the client and the second timestamp from the server is less than or equal to a time difference threshold;

[0021] A service provision module, if both the first trusted authentication and the second trusted authentication are passed, then the service provision module is suitable for providing the computing power resource service to the client, so that the client can manage the computing resources, network resources and storage resources corresponding to the user identification of the client through the computing power resource service.

[0022] According to one aspect of the present invention, there is provided a computing device, comprising: at least one processor; and a memory storing program instructions, wherein the program instructions are configured to be suitable for execution by the at least one processor, and the program instructions include instructions for executing the supercomputing interface trusted authentication method as described above.

[0023] According to one aspect of the present invention, a computer program product is provided, comprising a computer program / instruction, wherein the computer program / instruction implements the method as described above when executed by a processor.

[0024] According to one aspect of the present invention, a readable storage medium storing program instructions is provided. When the program instructions are read and executed by a computing device, the computing device executes the supercomputing interface trusted authentication method as described above.

[0025] According to the technical solution of the present invention, a supercomputing interface trusted identification method is provided. On the basis of authenticating the identity of the client user, the client and the server also encrypt the request information of the supercomputing interface request based on the first key information and the second key information obtained by each, and generate the first trusted identifier and the second trusted identifier respectively. The server determines whether the request information has been tampered with and whether the supercomputing interface request is credible by comparing the first trusted identifier and the second trusted identifier, and further determines whether the supercomputing interface request is credible by verifying the time difference between the client and the server requests. Based on this, the permission control and authorization protection mechanism for users to access the supercomputing interface can be strengthened to prevent the supercomputing interface request information from being tampered with.

[0026] Furthermore, the server also determines whether to restrict the client's traffic by verifying whether the number of requests sent by the client exceeds the traffic control threshold. Based on this, service attacks can be avoided.

[0027] In addition, by providing computing power resource services corresponding to the authorization scope to the client, the authorized access scope of the client user to the computing power resource services can be controlled.

[0028] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] To achieve the above and related purposes, certain illustrative aspects are described herein in conjunction with the following description and accompanying drawings, which indicate various ways in which the principles disclosed herein can be practiced, and all aspects and their equivalents are intended to fall within the scope of the claimed subject matter. The above and other purposes, features and advantages of the present disclosure will become more apparent by reading the following detailed description in conjunction with the accompanying drawings. Throughout the present disclosure, the same reference numerals generally refer to the same parts or elements.

[0030] Figure 1 A schematic diagram of a supercomputer interface trusted authentication system 100 provided according to an embodiment of the present invention is shown;

[0031] Figure 2 A schematic diagram of a computing device 200 provided according to an embodiment of the present invention is shown;

[0032] Figure 3 A schematic flow chart of a supercomputer interface trustworthy authentication method 300 provided according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0033] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0034] For ease of understanding, the terms involved in the present invention are explained below.

[0035] API stands for "Application Programming Interface", which is translated into Chinese as "application programming interface". It is a set of rules, protocols and tools that define the interaction between software components. API can be understood as a "bridge" or "contract" between different software components, which stipulates how to exchange data and call functions. Supercomputing Center API refers to an interface method for the supercomputing center to provide software services to the outside world. Based on the services provided by the supercomputing center API, users can easily manage all computing resources, network resources and storage resources under their name, and can quickly schedule resources and expand and shrink resources according to business needs.

[0036] In view of the problems faced by existing supercomputing center APIs, such as overly simple identity authentication and authorization, and easy tampering of parameters, the embodiments of the present invention provide a supercomputing interface trusted authentication method, which can strengthen the permission control and authorization protection mechanism for users to access the supercomputing interface, and prevent the supercomputing interface request information from being tampered with.

[0037] It should be noted that, in the embodiments of the present invention, "supercomputing" is the abbreviation of supercomputing center, and "supercomputing interface" is the abbreviation of API of supercomputing center.

[0038] The supercomputer interface trusted authentication method provided according to the embodiment of the present invention can be implemented in a supercomputer interface trusted authentication system. The supercomputer interface trusted authentication system of the present invention is introduced below.

[0039] Figure 1 A schematic diagram of a supercomputer interface trusted authentication system 100 provided according to an embodiment of the present invention is shown.

[0040] like Figure 1 As shown, in an embodiment of the present invention, the supercomputer interface trusted authentication system 100 includes one or more clients 110 and a server 120. The server 120 is respectively connected to the one or more clients 110 in communication, for example, through a wired or wireless network connection.

[0041] It should be noted that the supercomputing interface is used to provide computing resource services to the outside world (for example, to the client 110), and the computing resource services are used to manage computing resources, network resources and storage resources.

[0042] In an embodiment of the present invention, the client 110 can use the computing power resource service provided by the supercomputing interface by calling the supercomputing interface. The server 120 can provide a supercomputing interface trusted authentication function to control the access rights of the client 110 to the supercomputing interface, and further control the access rights of the client 110 to the computing power resource service provided by the supercomputing interface.

[0043] like Figure 1 As shown, in an embodiment of the present invention, the server 120 includes a user account management module 121, a user key management module 122, a service monitoring module 123, a second request signature module 124, a trusted authentication module 125, and a service providing module 126. The user account management module 121 is used to centrally manage the basic user information of each client 110 and provide unified user identity authentication and authorization.

[0044] The user account management module 121 is used to perform user identity authentication on the client 110 in response to a login request from the client 110 .

[0045] The user key management module 122 is used to respond to the client 110's request to obtain the key pair of the supercomputing interface after the user identity authentication is passed, and return the key pair to the client 110, wherein the key pair includes the user identifier of the client 110 and the first key information corresponding to the user identifier. The client 110 can sign the request information based on the first key information to generate a first trusted identifier, and the request information includes a first timestamp from the client 110.

[0046] The service monitoring module 123 is used to receive a supercomputing interface request sent by the client 110 based on the user identifier, where the supercomputing interface request includes request information and the first trusted identifier.

[0047] The second request signature module 124 is used to obtain the second key information corresponding to the user identifier from the user key management module 122, sign the supercomputing interface request based on the second key information, and generate a second trusted identifier.

[0048] The trusted authentication module 125 performs a first trusted authentication on the supercomputing interface request by comparing whether the first trusted identifier is consistent with the second trusted identifier, and performs a second trusted authentication on the supercomputing interface request by determining whether the time difference between the first timestamp from the client 110 and the second timestamp from the server 120 is less than or equal to a time difference threshold.

[0049] If both the first trusted authentication and the second trusted authentication are passed, the service providing module 126 can provide computing resource services to the client 110 so that the client 110 manages the computing resources, network resources and storage resources corresponding to the user identification of the client 110 through the computing resource services.

[0050] In some embodiments, the user account management module 121 can provide a network login page to the client 110 , and the client 110 can enter the login account and corresponding login password on the network login page to send a login request to the server 120 , and then the server 120 can perform user authentication on the client 110 .

[0051] In addition, in some embodiments, the server 120 may further include a flow control module. The flow control module may determine whether the number of supercomputing interface requests corresponding to the user identifier within a predetermined time interval (i.e., the number of times the client 110 sends supercomputing interface requests) exceeds a flow control threshold. If the flow control threshold is exceeded, flow restriction is imposed on the client 110 to restrict the client 110 from continuing to send supercomputing interface requests. Based on this, service attacks can be avoided.

[0052] In some embodiments, Figure 1 As shown, the client 110 includes a first request signature module and a request connection module. The first request signature module is used to sign the request information based on the first key information to generate a first trusted identifier. The request connection module is used to send a supercomputing interface request (connection request) to the server 120 based on the user identifier.

[0053] In an embodiment of the present invention, the server 120 in the supercomputing interface trusted authentication system 100 can be configured to execute the supercomputing interface trusted authentication method 300 to achieve the above functions. The supercomputing interface trusted authentication method 300 of the present invention will be described in detail below. For the specific execution logic of each module of the server 120, please refer to the description of the supercomputing interface trusted authentication method 300 below, which will not be repeated here.

[0054] According to the supercomputing interface trusted identification system 100 of the present invention, on the basis of authenticating the identity of the client user, the client and the server also encrypt the request information of the supercomputing interface request based on the first key information and the second key information obtained by each, and generate the first trusted identifier and the second trusted identifier respectively. The server determines whether the request information has been tampered with and whether the supercomputing interface request is credible by comparing the first trusted identifier and the second trusted identifier, and further determines whether the supercomputing interface request is credible by verifying the time difference between the client and the server request. Based on this, the permission control and authorization protection mechanism for users to access the supercomputing interface can be strengthened to prevent the supercomputing interface request information from being tampered with.

[0055] Furthermore, the server also determines whether to restrict the client's traffic by verifying whether the number of requests sent by the client exceeds the traffic control threshold. Based on this, service attacks can be avoided.

[0056] In one embodiment, the server 120 of the present invention can be implemented as a computing device described below, so that the supercomputing interface trusted authentication method 300 of the present invention can be executed in the computing device.

[0057] Figure 2 FIG. 2 shows a schematic diagram of a computing device 200 provided according to an embodiment of the present invention. Figure 2 As shown, in a basic configuration, the computing device 200 includes at least one processing unit 202 and a system memory 204. According to one aspect, depending on the configuration and type of the computing device, the processing unit 202 can be implemented as a processor. The system memory 204 includes, but is not limited to, volatile storage (e.g., random access memory), non-volatile storage (e.g., read-only memory), flash memory, or any combination of such memories. According to one aspect, the system memory 204 includes an operating system 205.

[0058] According to one aspect, operating system 205 is suitable for controlling the operation of computing device 200, for example. Furthermore, examples are practiced in conjunction with graphics libraries, other operating systems, or any other application programs, and are not limited to any particular application or system. Figure 2 The basic configuration is shown in FIG. 2 by those components within the dashed lines. According to one aspect, the computing device 200 has additional features or functionality. For example, according to one aspect, the computing device 200 includes additional data storage devices (removable and / or non-removable), such as magnetic disks, optical disks, or tapes. Such additional storage Figure 2 2 is illustrated by a removable storage device 209 and a non-removable storage device 210.

[0059] As stated above, according to one aspect, a program module 203 is stored in the system memory 204. According to one aspect, the program module 203 may include one or more application programs, and the present invention does not limit the type of application program, for example, the application program may include: email and contact application programs, word processing application programs, spreadsheet application programs, database application programs, slide show application programs, drawing or computer-aided application programs, web browser application programs, etc.

[0060] In an embodiment according to the present invention, the program module 203 includes a plurality of program instructions for executing the supercomputer interface trusted authentication method 300 of the present invention.

[0061] According to one aspect, the examples may be practiced on a circuit comprising discrete electronic components, a packaged or integrated electronic chip containing logic gates, a circuit utilizing a microprocessor, or a single chip containing electronic components or a microprocessor. Figure 2 Each or many components shown in can be integrated into a system on a chip (SOC) on a single integrated circuit to practice examples. According to one aspect, such a SOC device may include one or more processing units, a graphics unit, a communication unit, a system virtualization unit, and various application functions, all of which are integrated (or "burned") into a chip substrate as a single integrated circuit. When operated via SOC, the functions described in this article can be operated via a dedicated logic integrated with other components of the computing device 200 on a single integrated circuit (chip). Other technologies that can perform logical operations (such as AND, OR, and NOT) can also be used to practice embodiments of the present invention, including but not limited to mechanical, optical, fluid, and quantum technologies. In addition, embodiments of the present invention can be practiced in a general-purpose computer or in any other circuit or system.

[0062] According to one aspect, the computing device 200 may also have one or more input devices 212, such as a keyboard, a mouse, a pen, a voice input device, a touch input device, etc. Output devices 214 may also be included, such as a display, a speaker, a printer, etc. The aforementioned devices are examples and other devices may also be used. The computing device 200 may include one or more communication connections 216 that allow communication with other computing devices 218. Examples of suitable communication connections 216 include, but are not limited to: RF transmitters, receivers and / or transceiver circuits; Universal Serial Bus (USB), parallel and / or serial ports.

[0063] The term computer-readable medium as used herein includes computer storage media. Computer storage media may include volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (e.g., computer-readable instructions, data structures, or program modules). System memory 204, removable storage device 209, and non-removable storage device 210 are all examples of computer storage media (i.e., memory storage). Computer storage media may include random access memory (RAM), read-only memory (ROM), electrically erasable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical storage, cassettes, tapes, disk storage or other magnetic storage devices, or any other products that can be used to store information and can be accessed by computing device 200. According to one aspect, any such computer storage medium can be a part of computing device 200. Computer storage media does not include carrier waves or other propagated data signals.

[0064] According to one aspect, communication media is implemented by computer readable instructions, data structures, program modules, or other data in a modulated data signal (e.g., a carrier wave or other transport mechanism), and includes any information delivery media. According to one aspect, the term "modulated data signal" describes a signal that has one or more characteristics set or changed in a manner that encodes information in the signal. By way of example and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, radio frequency (RF), infrared, and other wireless media.

[0065] In an embodiment according to the present invention, the computing device 200 is configured to execute the supercomputing interface trusted authentication method 300. The computing device 200 includes one or more processors and one or more readable storage media storing program instructions. When the program instructions are configured to be executed by one or more processors, the computing device executes the supercomputing interface trusted authentication method 300 in the embodiment of the present invention, so that the computing device 200 controls the access rights of the client 110 to the supercomputing interface by executing the supercomputing interface trusted authentication method 300 of the present invention.

[0066] In the embodiment of the present invention, the computing device that executes the supercomputing interface trusted authentication method 300 in the embodiment of the present invention may be the server 120, that is, the supercomputing interface trusted authentication method 300 may be executed at the server 120. By executing the supercomputing interface trusted authentication method 300, the server 120 can strengthen the authority control and authorization protection mechanism for users to access the supercomputing interface, and prevent the supercomputing interface request information from being tampered with.

[0067] In the embodiment of the present invention, the server 120 includes a user account management module 121 , a user key management module 122 , a service monitoring module 123 , a second request signature module 124 , a trusted authentication module 125 , and a service providing module 126 .

[0068] The following is a detailed description of the supercomputing interface trustworthy authentication method 300 in an embodiment of the present invention.

[0069] Figure 3 FIG. 3 is a flow chart of a supercomputer interface trustworthy authentication method 300 provided according to an embodiment of the present invention. Figure 3 As shown, the supercomputer interface trusted authentication method 300 includes the following steps 310 to 360.

[0070] Step 320 : The server 120 may perform user identity authentication on the client 110 in response to the login request of the client 110 .

[0071] In the embodiment of the present invention, step 310 may be performed by the user account management module 121 of the server 120. That is, the user account management module 121 of the server 120 may perform user identity authentication on the client 110 in response to the login request of the client 110.

[0072] In an embodiment of the present invention, when the client 110 needs to call the supercomputing interface, the client 110 first sends a login request to the server 120, and the server 120 can perform user identity authentication on the client 110 in response to the login request of the client 110. Here, the login request includes the login account and account password entered by the user on the client 110. The server 120 can verify the login account and account password of the client 110 to perform user identity authentication on the client 110. After the user identity authentication is passed, the server 120 allows the client 110 to log in, and the client 110 can log in to the server 120. Furthermore, the client 110 can request the server 120 to obtain a key pair.

[0073] Step 320, the server 120 may respond to the client 110's request to obtain the key pair of the supercomputing interface after the user identity authentication is passed, and return the key pair to the client 110, so that the client 110 can call the supercomputing interface based on the key pair and use the corresponding computing resource service.

[0074] In an embodiment of the present invention, step 320 may be performed by the user key management module 122 of the server 120. That is, the client 110 may obtain a key pair from a request of the server 120. The user key management module 122 of the server 120 may return a key pair to the client 110 in response to the request of the client 110 to obtain a key pair of the supercomputing interface after the user identity authentication is passed.

[0075] It should be noted that the key pair includes a user identifier of the client 110 (the user identifier is userKey, which can uniquely identify the user of the client 110 ) and first key information (secretKey) corresponding to the user identifier.

[0076] In some embodiments, the user identifier (userKey) may be obtained by encrypting the first identifier of the user at the server 120, the second identifier of the user at the supercomputing center, and other information.

[0077] After the client 110 obtains the key pair from the server 120, the client 110 can sign the request information based on the first key information to generate a first trusted identifier. Here, the request information includes a first timestamp from the client 110. Furthermore, the client 110 can obtain a supercomputing interface request based on the request information and the first trusted identifier, and send the supercomputing interface request to the server 120 based on the user identifier.

[0078] Step 330: The server 120 receives the supercomputing interface request (connection request) sent by the client 110 based on the user identifier. The supercomputing interface request in step 330 includes request information and a first trusted identifier.

[0079] In an embodiment of the present invention, step 330 may be performed by the service monitoring module 123 of the server 120. That is, the service monitoring module 123 of the server 120 may receive a supercomputing interface request sent by the client 110 based on the user identifier.

[0080] Step 340: The server 120 obtains the second key information corresponding to the user identifier locally from the server 120, signs the supercomputing interface request based on the second key information, and generates a second trusted identifier.

[0081] Specifically, in step 340, the server 120 may obtain the second key information corresponding to the user identifier from the user key management module 122, and then sign the supercomputing interface request based on the second key information to generate a second trusted identifier.

[0082] In an embodiment of the present invention, step 340 may be performed by the second request signature module 124 of the server 120. That is, the second request signature module 124 of the server 120 may obtain the second key information corresponding to the user identifier from the user key management module 122, and then sign the supercomputing interface request based on the second key information to generate a second trusted identifier.

[0083] Step 350: The server 120 performs a first trusted authentication on the supercomputing interface request by comparing the first trusted identifier with the second trusted identifier to determine whether they are consistent, and performs a second trusted authentication on the supercomputing interface request by determining whether the time difference between the first timestamp from the client 110 and the second timestamp from the server 120 is less than or equal to a time difference threshold.

[0084] It can be understood that the server 120 can perform trust authentication on the supercomputing interface request by executing step 350. The trust authentication on the supercomputing interface request includes at least a first trust authentication and a second trust authentication.

[0085] In an embodiment of the present invention, step 350 may be performed by the trusted identification module 125 of the server 120. That is, the trusted identification module 125 may perform a first trusted identification on the supercomputing interface request by comparing whether the first trusted identifier is consistent with the second trusted identifier. In addition, the trusted identification module 125 may perform a second trusted identification on the supercomputing interface request by determining whether the time difference (absolute value of the time difference) between the first timestamp from the client 110 and the second timestamp from the server 120 is less than or equal to the time difference threshold.

[0086] In an embodiment of the present invention, in step 350, when the server 120 (trusted authentication module 125) performs a first trusted authentication on the supercomputing interface request, if the first trusted identifier is consistent with the second trusted identifier, it can be determined that the first trusted authentication has passed; if the first trusted identifier is inconsistent with the second trusted identifier, it is determined that the first trusted authentication has not passed.

[0087] When the server 120 (trusted authentication module 125) performs the second trusted authentication on the supercomputing interface request, if the time difference (absolute value) between the first timestamp of the client 110 and the second timestamp of the server 120 is less than or equal to the time difference threshold, it is determined that the second trusted authentication has passed; if the time difference (absolute value) between the first timestamp of the client 110 and the second timestamp of the server 120 is greater than the time difference threshold, it is determined that the second trusted authentication has not passed.

[0088] In some embodiments, the time difference threshold may be, for example, 120 seconds. However, it should be noted that the present invention does not limit the specific value of the time difference threshold, which may be set by those skilled in the art according to actual needs.

[0089] In the embodiment of the present invention, if both the first trusted authentication and the second trusted authentication are passed, the server 120 may execute the following step 350 .

[0090] Step 360: The server 120 provides computing power resource services to the client 110. Then, the client 110 can manage the computing resources, network resources, and storage resources corresponding to the user identifier of the client 110 through the computing power resource services.

[0091] In an embodiment of the present invention, step 360 may be performed by the service providing module 126 of the server 120. That is, if both the first trusted authentication and the second trusted authentication are passed, the service providing module 126 of the server 120 may provide computing power resource services to the client 110, so that the client 110 manages the computing resources, network resources, and storage resources corresponding to the user identification of the client 110 through the computing power resource services.

[0092] In addition, if the first trusted authentication and / or the second trusted authentication fails, the server 120 refuses to provide computing resource services to the client 110 .

[0093] In some embodiments, the server 120 may also determine whether the number of supercomputing interface requests corresponding to the user identifier within a predetermined time interval (first predetermined time interval) (i.e., the number of times the client 110 corresponding to the user identifier sends supercomputing interface requests) exceeds a flow control threshold (first flow control threshold), and if it exceeds the flow control threshold (first flow control threshold), the flow of the client 110 is restricted to restrict the client 110 from continuing to send supercomputing interface requests. Based on this, service attacks can be avoided.

[0094] In some embodiments, the predetermined time interval (first predetermined time interval) is, for example, 1 minute. The flow control threshold (first flow control threshold) is, for example, 20 times. Specifically, the server 120 can determine whether the number of supercomputing interface requests corresponding to the user identifier exceeds 20 times within 1 minute. If it exceeds 20 times, the client 110 can be restricted in terms of flow to restrict the client 110 from continuing to send supercomputing interface requests.

[0095] In some other embodiments, the server 120 may also determine whether the total number of all supercomputing interface requests sent by the client 110 corresponding to the user identifier within a predetermined time period exceeds a second flow control threshold. If the total number of all supercomputing interface requests sent by the client 110 exceeds the second flow control threshold, the client 110 may be subjected to flow restriction to restrict the client 110 from continuing to send supercomputing interface requests. Here, the second predetermined time interval is greater than the predetermined time interval. The second predetermined time interval is, for example, 1 hour, and the second flow control threshold is, for example, 36,000 times.

[0096] It should be understood that the present invention does not limit the specific value of the above-mentioned flow control threshold, and those skilled in the art can reasonably set the flow control threshold according to actual conditions (such as time interval).

[0097] In some embodiments, the request information includes: request method, request path, request header, request query parameters, request parameters, and request behavior information. Among them, the request header includes a first timestamp from the client 110, a Host field (used to indicate the domain name / IP address and port number of the server 120), and a data type (i.e., Content-Type, used to indicate the data type or data format of the data transmitted by the server). The request behavior information includes requesting a trusted encryption method, supercomputing interface version information, service information (used to indicate the computing power resource service that the client 110 requests to access), and an authorization scope (used to control the scope of authorized access of the client 110 to the computing power resource service). In some embodiments, the requesting a trusted encryption method may be, for example, the HmacSHA256 encryption algorithm. The supercomputing interface version information is, for example, V3.

[0098] The client 110 can generate a regular request string based on the request information, and sign the regular request string based on the first key information to generate a first trusted identifier. The client 110 includes a first request signature module and a request connection module. The client 110 can generate a regular request string based on the request information through the first request signature module, and sign the regular request string based on the first key information to generate a first trusted identifier.

[0099] Specifically, the client 110 (first request signature module) can generate the first trusted identifier in the following manner:

[0100] First, the request header, request query parameters, and request parameters are regulated. Specifically, the request header is regulated as follows: all the information in the request header that needs to be encapsulated for this supercomputing interface request (including the first timestamp, Host field, and data type) can be encapsulated, and the Key and Value in the encapsulated request header are uniformly converted to lowercase characters, and the leading and trailing spaces are removed, and then spliced ​​in the key:value\n format. The last Key and Value combination does not add \n, and each Key is sorted in ascending order according to the ASCII code. The request query parameter is regulated as follows: the request query parameter string that needs to be encapsulated for this supercomputing interface request is converted into a format that complies with the URL encoding specification, all Keys and Values ​​in the request query parameters are uniformly converted into lowercase characters, and special characters are converted into a format similar to %2F. The request parameter is regulated as follows: the request parameters that need to be encapsulated for this supercomputing interface request are encrypted. Specifically, all the request parameter information can be encrypted with SHA-256 first, and then converted into a hexadecimal string.

[0101] Then, the request method and request path are concatenated with the regularized request header, request query parameters, and request parameters (each part needs to be separated by \n) to generate a regularized request body.

[0102] Furthermore, the request behavior information (including the requested trusted encryption method, supercomputing interface version information, service information, and authorization scope) and the user identifier in the key pair can be concatenated with the regular request body (each part needs to be separated by \n) to generate a regular request string.

[0103] Finally, the trusted identifier prefix, the first key information, and the regular request string can be encrypted using a request trusted encryption method (e.g., HmacSHA256 encryption algorithm) to obtain first encrypted information, and the first encrypted information is converted into a hexadecimal string to obtain a first trusted identifier. Here, the hexadecimal string converted from the first encrypted information is the first trusted identifier.

[0104] Furthermore, the client 110 can send a supercomputing interface request to the server 120 based on the request information and the generated first trusted identifier and based on the user identifier. The supercomputing interface request received by the server 120 includes the request information and the first trusted identifier. In other words, the server 120 can obtain the request information and the first trusted identifier generated by the client 110 from the supercomputing interface request.

[0105] In some embodiments, after the first request signature module of the client 110 generates the first trusted identifier, the request connection module of the client 110 may send a supercomputing interface request (connection request) to the server 120 based on the user identifier. In step 330, the service monitoring module 123 of the server 120 may monitor the supercomputing interface request sent by the client 110 (request connection module) based on the user identifier, and when the supercomputing interface request from the client 110 is monitored, in response to the monitored supercomputing interface request, a signature request for the supercomputing interface request is sent to the second request signature module 124 of the server 120. Subsequently, in step 340, the second request signature module 124 of the server 120 may obtain the second key information corresponding to the user identifier from the user key management module 122 in response to the signature request from the second request signature module 124, and sign the supercomputing interface request based on the second key information to generate a second trusted identifier.

[0106] In some embodiments, in step 340, the server 120 (second request signature module 124) can obtain request information from the supercomputing interface request, and sign the request information in the supercomputing interface request based on the second key information obtained from the user key management module 122 to generate a second trusted identifier. Here, the second request signature module 124 of the server 120 can sign the request information in the supercomputing interface request in a manner similar to the first signature module of the client 110, as follows:

[0107] First, the server 120 (the second request signature module 124) can obtain request information from the supercomputing interface request.

[0108] Next, the server 120 (second request signature module 124) regularizes the request header, request query parameters, and request parameters in the request information. Specifically, the regularization method for the request header is as follows: all the information (including the first timestamp, Host field, and data type) of the request header that needs to be encapsulated for this supercomputing interface request can be encapsulated, and the Key and Value in the request header involved in the encapsulation are uniformly converted to lowercase characters, and the leading and trailing spaces are removed, and then spliced ​​in the key:value\n format. The last Key and Value combination does not add \n, and each Key is sorted in ascending order according to the ASCII code. The regularization method for the request query parameters is as follows: the request query parameter string that needs to be encapsulated for this supercomputing interface request is converted into a format that complies with the URL encoding specification, all Keys and Values ​​in the request query parameters are uniformly converted into lowercase characters, and special characters are converted into a format similar to %2F. The regularization method for the request parameters is as follows: the request parameters that need to be encapsulated for this supercomputing interface request are encrypted. Specifically, all the request parameter information can be encrypted with SHA-256 first, and then converted into a hexadecimal string.

[0109] Subsequently, the server 120 (second request signature module 124) concatenates the request method and request path in the request information with the regularized request header, request query parameters, and request parameters (each part needs to be separated by \n) to generate a regularized request body.

[0110] Furthermore, the server 120 (the second request signature module 124) can concatenate the request behavior information in the request information (including the requested trusted encryption method, supercomputing interface version information, service information, and authorization scope) and the user identifier in the key pair with the regular request body (each part needs to be separated by \n) to generate a regular request string.

[0111] Finally, the server 120 (the second request signature module 124) can use the request trusted encryption method (such as the HmacSHA256 encryption algorithm) in the request information to encrypt the trusted identifier prefix, the second key information obtained from the user key management module 122 (different from the first key information of the client 110), and the regular request string to obtain the second encrypted information, and convert the second encrypted information into a hexadecimal string to obtain the second trusted identifier. Here, the hexadecimal string converted from the second encrypted information is the second trusted identifier.

[0112] In some embodiments, if both the first trusted authentication and the second trusted authentication are passed, then in step 360, the server 120 (service providing module 126) can provide the computing power resource service corresponding to the authorization scope in the request information to the client 110. In this way, it is possible to control the authorized access scope of the client 110 user to the computing power resource service.

[0113] In some embodiments, the format of the timestamp in the present invention can be a 10-bit Unix timestamp.

[0114] According to the supercomputing interface trusted identification method 300 of the present invention, on the basis of authenticating the client user, the client and the server also encrypt the request information of the supercomputing interface request based on the first key information and the second key information obtained by each, and generate the first trusted identifier and the second trusted identifier respectively. The server determines whether the request information has been tampered with and whether the supercomputing interface request is credible by comparing the first trusted identifier and the second trusted identifier, and further determines whether the supercomputing interface request is credible by verifying the time difference between the client and the server request. Based on this, the permission control and authorization protection mechanism for users to access the supercomputing interface can be strengthened to prevent the supercomputing interface request information from being tampered with.

[0115] Furthermore, the server also determines whether to restrict the client's traffic by verifying whether the number of requests sent by the client exceeds the traffic control threshold. Based on this, service attacks can be avoided.

[0116] In addition, by providing computing power resource services corresponding to the authorization scope to the client, the authorized access scope of the client user to the computing power resource services can be controlled.

[0117] In addition, the embodiment of the present invention also discloses: A9, a method as described in any one of A1-A8, wherein the server includes a service monitoring module, a second request signature module, and a user key management module; receiving the supercomputing interface request sent by the client based on the user identifier, including: the service monitoring module monitors the supercomputing interface request sent by the client based on the user identifier, and in response to monitoring the supercomputing interface request, sends a signature request for the supercomputing interface request to the second request signature module; obtaining the second key information corresponding to the user identifier from the server, signing the supercomputing interface request based on the second key information, and generating a second trusted identifier, including: the second request signature module responds to the signature request, obtains the second key information corresponding to the user identifier from the user key management module, signs the supercomputing interface request based on the second key information, and generates a second trusted identifier. B12, a computer program product, including a computer program / instruction, wherein the computer program / instruction is executed by a processor to implement the method as described in any one of A1-A9. C13. A readable storage medium storing program instructions, which, when read and processed by a computing device, enables the computing device to process a method as described in any one of A1-A9.

[0118] The various techniques described herein may be implemented in combination with hardware or software, or a combination thereof. Thus, the method and apparatus of the present invention, or some aspects or parts of the method and apparatus of the present invention may be in the form of program codes (i.e., instructions) embedded in a tangible medium, such as a removable hard disk, a USB flash drive, a floppy disk, a CD-ROM, or any other machine-readable storage medium, wherein when the program is loaded into a machine such as a computer and executed by the machine, the machine becomes a device for practicing the present invention.

[0119] In the case where the program code is executed on a programmable computer, the mobile terminal generally includes a processor, a storage medium readable by the processor (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device. The memory is configured to store the program code; the processor is configured to execute the supercomputer interface trusted authentication method of the present invention according to the instructions in the program code stored in the memory.

[0120] By way of example and not limitation, readable media include readable storage media and communication media. Readable storage media stores information such as computer readable instructions, data structures, program modules or other data. Communication media generally embody computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and include any information transfer medium. Any combination of the above is also included within the scope of readable media.

[0121] In the description provided herein, algorithms and displays are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the examples of the present invention. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to implement the content of the present invention described herein, and the above description of specific languages ​​is for the purpose of disclosing the best mode of the present invention.

[0122] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0123] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof.

[0124] Those skilled in the art will appreciate that the modules or units or components of the devices in the examples disclosed herein may be arranged in the devices described in the embodiment, or alternatively may be located in one or more devices different from the devices in the examples. The modules in the foregoing examples may be combined into one module or may be divided into multiple submodules.

[0125] Unless otherwise specified, the use of ordinal numbers "first", "second", "third", etc. to describe common objects merely indicates that different instances of similar objects are involved and is not intended to imply that the objects so described must have a given order in time, space, order or in any other manner.

Claims

1. A supercomputing interface trusted authentication method, executed on a server to control the client's access rights to the supercomputing interface, the supercomputing interface is used to provide computing resource services to the outside, the computing resource services are used to manage computing resources, network resources and storage resources, the server is connected to the client in communication, the method comprises: In response to a login request from a client, performing user identity authentication on the client; In response to a request from a client to obtain a key pair of a supercomputing interface after the user identity authentication is passed, a key pair is returned to the client, wherein the key pair includes a user identifier of the client and first key information corresponding to the user identifier; the client is adapted to sign the request information based on the first key information to generate a first trusted identifier, and the request information includes a first timestamp from the client; Receiving a supercomputing interface request sent by the client based on the user identifier, wherein the supercomputing interface request includes the request information and the first trusted identifier; Acquire second key information corresponding to the user identifier from the server, sign the supercomputing interface request based on the second key information, and generate a second trusted identifier; By comparing whether the first trusted identifier is consistent with the second trusted identifier, a first trusted authentication is performed on the supercomputing interface request; and by determining whether the time difference between the first timestamp from the client and the second timestamp from the server is less than or equal to a time difference threshold, a second trusted authentication is performed on the supercomputing interface request; If both the first trusted authentication and the second trusted authentication are passed, the computing power resource service is provided to the client so that the client manages the computing resources, network resources and storage resources corresponding to the user identification of the client through the computing power resource service.

2. The method of claim 1, wherein: Also includes: If the first trusted authentication and / or the second trusted authentication fails, the computing resource service is refused to be provided to the client.

3. The method according to claim 1 or 2, wherein: Also includes: Determine whether the number of supercomputing interface requests corresponding to the user identifier within a predetermined time interval exceeds a flow control threshold. If the number exceeds the flow control threshold, limit the flow of the client to restrict the client from continuing to send supercomputing interface requests.

4. The method according to any one of claims 1 to 3, wherein: By comparing whether the first trusted identifier is consistent with the second trusted identifier, a first trusted authentication is performed on the supercomputing interface request, including: If the first trusted identifier is consistent with the second trusted identifier, it is determined that the first trusted authentication is passed; if the first trusted identifier is inconsistent with the second trusted identifier, it is determined that the first trusted authentication is not passed; By determining whether the time difference between the first timestamp from the client and the second timestamp from the server is less than or equal to a time difference threshold, a second trusted authentication is performed on the supercomputing interface request, including: If the time difference is less than or equal to the time difference threshold, it is determined that the second trusted authentication has passed; if the time difference is greater than the time difference threshold, it is determined that the second trusted authentication has not passed.

5. The method according to any one of claims 1 to 4, wherein: The request information includes: request method, request path, request header, request query parameters, request parameters, and request behavior information; wherein the request header includes the first timestamp, Host field, and data type, and the request behavior information includes request trusted encryption method, supercomputing interface version information, service information, and authorization scope; The client is suitable for generating a regular request string based on the request information, and signing the regular request string based on the first key information to generate a first trusted identifier.

6. The method of claim 5, wherein: The client is further adapted to: Regularizing the request header, request query parameters, and request parameters; Concatenate the request method and request path with the regularized request header, request query parameters, and request parameters to generate a regularized request body; Concatenate the request behavior information and the user identifier in the key pair with the regular request body to generate a regular request string; The trusted identifier prefix, the first key information and the regular request character string are encrypted using the request trusted encryption method, and converted into a hexadecimal character string to obtain the first trusted identifier.

7. The method according to claim 5 or 6, wherein: Providing the computing resource service to the client includes: Provide computing resource services corresponding to the authorization scope to the client.

8. The method according to any one of claims 5 to 7, wherein: Signing the supercomputing interface request based on the second key information to generate a second trusted identifier includes: Obtaining request information from the supercomputing interface request; Regularize the request header, request query parameters, and request parameters in the request information; Concatenate the request method and request path in the request information with the regularized request header, request query parameters, and request parameters to generate a regularized request body; Concatenate the request behavior information in the request information and the user identifier in the key pair with the regular request body to generate a regular request string; The trusted identifier prefix, the first key information and the regular request character string are encrypted using the trusted encryption method in the request information, and converted into a hexadecimal character string to obtain the first trusted identifier.

9. A supercomputer interface trusted authentication system, comprising: Client side; A server, which is in communication with the client and is suitable for executing the method according to any one of claims 1 to 8, so as to control the access rights of the client to the supercomputing interface, wherein the supercomputing interface is used to provide computing resource services to the outside, and the computing resource services are used to manage computing resources, network resources and storage resources; wherein the server includes: A user account management module, adapted to perform user identity authentication on the client in response to a login request from the client; A user key management module, adapted to respond to a request from a client to obtain a key pair of a supercomputing interface after the user identity authentication is passed, and return a key pair to the client, wherein the key pair includes a user identifier of the client and first key information corresponding to the user identifier; the client is adapted to sign the request information based on the first key information to generate a first trusted identifier, and the request information includes a first timestamp from the client; A service monitoring module, adapted to receive a supercomputing interface request sent by the client based on the user identifier, wherein the supercomputing interface request includes the request information and the first trusted identifier; A second request signature module, adapted to obtain second key information corresponding to the user identifier from the user key management module, sign the supercomputing interface request based on the second key information, and generate a second trusted identifier; a trusted authentication module, adapted to perform a first trusted authentication on the supercomputing interface request by comparing whether the first trusted identifier is consistent with the second trusted identifier, and to perform a second trusted authentication on the supercomputing interface request by determining whether the time difference between the first timestamp from the client and the second timestamp from the server is less than or equal to a time difference threshold; A service provision module, if both the first trusted authentication and the second trusted authentication are passed, then the service provision module is suitable for providing the computing power resource service to the client, so that the client can manage the computing resources, network resources and storage resources corresponding to the user identification of the client through the computing power resource service.

10. A computing device comprising: at least one processor; and A memory storing program instructions, wherein the program instructions are configured to be processed by the at least one processor, and the program instructions include instructions for processing the method according to any one of claims 1 to 8.

Images