Supercomputing interface trusted identification method, system and computing device

Abstract

The present invention discloses a supercomputing interface trusted authentication method, system and computing device, the method comprising: responding to a request from a client to obtain a key pair for a supercomputing interface, returning a key pair to the client; receiving a supercomputing interface request sent by the client based on a user identifier in the key pair, the supercomputing interface request including request information and a first trusted identifier; obtaining second key information corresponding to the user identifier, signing the supercomputing interface request based on the second key information, and generating a second trusted identifier; authenticating the supercomputing interface request by comparing whether the first trusted identifier is consistent with the second trusted identifier, and determining whether the time difference between a first timestamp from the client and a second timestamp from the server is less than or equal to a time difference threshold, and providing computing power resource services to the client if the authentication passes. The present invention can strengthen the authority control and authorization protection mechanism for user access to the supercomputing interface, and prevent the supercomputing interface request information from being tampered with.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a supercomputer interface trusted identification method, a supercomputer interface trusted identification system, and a computing device. Background Art

[0002] A supercomputing center API (Application Programming Interface) is an interface used by supercomputing centers to provide external software services. Using the services provided by a supercomputing center API, users can conveniently manage all their computing, network, and storage resources, and quickly schedule and scale resources according to business needs. To meet the needs of comprehensive access scenarios, APIs are typically developed based on the HTTP protocol.

[0003] However, existing supercomputing center APIs often have the following security issues in their implementation: 1) Authentication and authorization are too simple, relying solely on username and password combinations that can be easily cracked; 2) Parameters are easily tampered with. After a supercomputing center API request is intercepted, attackers can easily tamper with request parameters to obtain sensitive data and exhaustively identify interface vulnerabilities; 3) Denial of service attacks are impossible. Sending a large number of requests to the supercomputing center API will exhaust server resources, making it impossible for normal users to access the services provided by the supercomputing center API; 4) Insufficient control over the scope of permissions makes it easy for users to access other information beyond their authorized scope.

[0004] Therefore, a supercomputing interface trusted authentication method is needed to solve the problems existing in the above technical solutions. Summary of the Invention

[0005] To this end, the present invention provides a supercomputing interface trusted authentication method and a supercomputing interface trusted authentication system to solve or at least alleviate the above problems.

[0006] According to one aspect of the present invention, a supercomputing interface trusted authentication method is provided, which is executed on a server side to control the access rights of a client to the supercomputing interface, wherein the supercomputing interface is used to provide external computing resource services, and the computing resource services are used to manage computing resources, network resources and storage resources. The server side is in communication with the client side, and the method comprises: in response to a login request from the client side, performing user identity authentication on the client side; in response to a request from the client side to obtain a key pair of the supercomputing interface after the user identity authentication is passed, returning a key pair to the client side, wherein the key pair includes a user identifier of the client side and first key information corresponding to the user identifier; the client side is adapted to sign the request information based on the first key information to generate a first trusted identifier, and the request information includes a first timestamp from the client side; and receiving a request from the client side based on the user identifier. A supercomputing interface request is sent, wherein the supercomputing interface request includes the request information and the first trusted identifier; second key information corresponding to the user identifier is obtained from the server, and the supercomputing interface request is signed based on the second key information to generate a second trusted identifier; a first trusted authentication is performed on the supercomputing interface request by comparing whether the first trusted identifier is consistent with the second trusted identifier, and a second trusted authentication is performed on the supercomputing interface request by judging whether the time difference between the first timestamp from the client and the second timestamp from the server is less than or equal to a time difference threshold; if both the first trusted authentication and the second trusted authentication are passed, the computing power resource service is provided to the client, so that the client can manage the computing resources, network resources and storage resources corresponding to the user identifier of the client through the computing power resource service.

[0007] Optionally, the supercomputing interface trusted authentication method according to the present invention further includes: if the first trusted authentication and / or the second trusted authentication fails, refusing to provide the computing resource service to the client.

[0008] Optionally, the supercomputing interface trusted authentication method according to the present invention also includes: judging whether the number of supercomputing interface requests corresponding to the user identifier within a predetermined time interval exceeds a flow control threshold; if it exceeds the flow control threshold, limiting the flow of the client to restrict the client from continuing to send supercomputing interface requests.

[0009] Optionally, in the supercomputing interface trusted authentication method according to the present invention, a first trusted authentication is performed on the supercomputing interface request by comparing whether the first trusted identifier is consistent with the second trusted identifier, including: if the first trusted identifier is consistent with the second trusted identifier, it is determined that the first trusted authentication is passed; if the first trusted identifier is inconsistent with the second trusted identifier, it is determined that the first trusted authentication is not passed; by judging whether the time difference between the first timestamp from the client and the second timestamp from the server is less than or equal to a time difference threshold, a second trusted authentication is performed on the supercomputing interface request, including: if the time difference is less than or equal to the time difference threshold, it is determined that the second trusted authentication is passed; if the time difference is greater than the time difference threshold, it is determined that the second trusted authentication is not passed.

[0010] Optionally, in the supercomputing interface trusted authentication method according to the present invention, the request information includes: request method, request path, request header, request query parameters, request parameters, and request behavior information; wherein, the request header includes the first timestamp, Host field and data type, and the request behavior information includes the request trusted encryption method, supercomputing interface version information, service information and authorization scope; the client is suitable for generating a regular request string based on the request information, and signing the regular request string based on the first key information to generate a first trusted identifier.

[0011] Optionally, in the supercomputing interface trusted authentication method according to the present invention, the client is further adapted to: regularize the request header, request query parameters, and request parameters; concatenate the request method and request path with the regularized request header, request query parameters, and request parameters to generate a regularized request body; concatenate the request behavior information and the user identifier in the key pair with the regularized request body to generate a regularized request string; and utilize the request trusted encryption method to encrypt the trusted identifier prefix, the first key information, and the regularized request string, and convert them into a hexadecimal string to obtain the first trusted identifier.

[0012] Optionally, in the supercomputing interface trusted authentication method according to the present invention, providing the computing power resource service to the client includes: providing the computing power resource service corresponding to the authorization scope to the client.

[0013] Optionally, in the supercomputing interface trusted authentication method according to the present invention, the supercomputing interface request is signed based on the second key information to generate a second trusted identifier, including: obtaining request information from the supercomputing interface request; regularizing the request header, request query parameters, and request parameters in the request information; concatenating the request method and request path in the request information with the regularized request header, request query parameters, and request parameters to generate a regularized request body; concatenating the request behavior information in the request information and the user identifier in the key pair with the regularized request body to generate a regularized request string; using the request trusted encryption method in the request information to encrypt the trusted identifier prefix, the first key information, and the regularized request string, and convert them into a hexadecimal string to obtain the first trusted identifier.

[0014] Optionally, in the supercomputing interface trusted authentication method according to the present invention, the server includes a service monitoring module, a second request signature module, and a user key management module; receiving the supercomputing interface request sent by the client based on the user identifier, including: the service monitoring module monitors the supercomputing interface request sent by the client based on the user identifier, and in response to monitoring the supercomputing interface request, sends a signature request for the supercomputing interface request to the second request signature module; obtaining the second key information corresponding to the user identifier from the server, signing the supercomputing interface request based on the second key information, and generating a second trusted identifier, including: the second request signature module obtains the second key information corresponding to the user identifier from the user key management module in response to the signature request, signing the supercomputing interface request based on the second key information, and generating a second trusted identifier.

[0015] According to one aspect of the present invention, a supercomputing interface trusted authentication system is provided, comprising: a client; and a server, communicatively connected to the client and adapted to execute the method described above to control the client's access rights to the supercomputing interface, wherein the supercomputing interface is used to provide external computing resource services, and the computing resource services are used to manage computing resources, network resources, and storage resources; wherein the server comprises:

[0016] A user account management module, adapted to perform user identity authentication on the client in response to a login request from the client;

[0017] a user key management module, adapted to, in response to a request from a client for a key pair for a supercomputing interface after user identity authentication is passed, return a key pair to the client, wherein the key pair includes a user identifier of the client and first key information corresponding to the user identifier; the client is adapted to sign a request message based on the first key information to generate a first trusted identifier, and the request message includes a first timestamp from the client;

[0018] A service monitoring module, adapted to receive a supercomputing interface request sent by the client based on the user identifier, wherein the supercomputing interface request includes the request information and the first trusted identifier;

[0019] a second request signing module, adapted to obtain second key information corresponding to the user identifier from the user key management module, sign the supercomputing interface request based on the second key information, and generate a second trusted identifier;

[0020] a trusted authentication module, adapted to perform a first trusted authentication on the supercomputing interface request by comparing the first trusted identifier with the second trusted identifier to determine whether they are consistent, and to perform a second trusted authentication on the supercomputing interface request by determining whether a time difference between the first timestamp from the client and the second timestamp from the server is less than or equal to a time difference threshold;

[0021] A service providing module, if both the first trusted authentication and the second trusted authentication are passed, then the service providing module is suitable for providing the computing power resource service to the client, so that the client manages the computing resources, network resources and storage resources corresponding to the user identification of the client through the computing power resource service.

[0022] According to one aspect of the present invention, a computing device is provided, comprising: at least one processor; and a memory storing program instructions, wherein the program instructions are configured to be suitable for execution by the at least one processor, and the program instructions include instructions for executing the supercomputing interface trusted authentication method as described above.

[0023] According to one aspect of the present invention, a computer program product is provided, comprising a computer program / instruction, wherein the computer program / instruction implements the method described above when executed by a processor.

[0024] According to one aspect of the present invention, a readable storage medium storing program instructions is provided. When the program instructions are read and executed by a computing device, the computing device executes the supercomputing interface trusted authentication method as described above.

[0025] According to the technical solution of the present invention, a supercomputing interface trusted authentication method is provided. On the basis of authenticating the identity of the client user, the client and the server also encrypt the request information of the current supercomputing interface request based on the first key information and the second key information respectively obtained, and generate a first trusted identifier and a second trusted identifier respectively. The server determines whether the request information has been tampered with and whether the supercomputing interface request is credible by comparing the first trusted identifier and the second trusted identifier. In addition, the server further determines whether the supercomputing interface request is credible by verifying the time difference between the client and server requests. Based on this, the permission control and authorization protection mechanism for user access to the supercomputing interface can be strengthened to prevent the supercomputing interface request information from being tampered with.

[0026] Furthermore, the server verifies whether the number of requests sent by the client exceeds the flow control threshold and decides whether to limit the client's flow. This can prevent service attacks.

[0027] In addition, by providing computing power resource services corresponding to the authorization scope to the client, the authorized access scope of the client user to the computing power resource service can be controlled.

[0028] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] To achieve the above and related purposes, certain illustrative aspects are described herein in conjunction with the following description and accompanying drawings, which indicate various ways in which the principles disclosed herein may be practiced, and all aspects and their equivalents are intended to fall within the scope of the claimed subject matter. The above and other objects, features, and advantages of the present disclosure will become more apparent by reading the following detailed description in conjunction with the accompanying drawings. Throughout this disclosure, the same reference numerals generally refer to the same parts or elements.

[0030] Figure 1 A schematic diagram of a supercomputer interface trusted authentication system 100 provided according to an embodiment of the present invention is shown;

[0031] Figure 2 A schematic diagram of a computing device 200 provided according to an embodiment of the present invention is shown;

[0032] Figure 3 A flow chart of a supercomputer interface trust authentication method 300 provided according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0033] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0034] For ease of understanding, the terms used in the present invention are explained below.

[0035] API stands for "Application Programming Interface." It is a set of rules, protocols, and tools that define the interactions between software components. An API can be thought of as a "bridge" or "contract" between different software components, specifying how data is exchanged and functions are invoked. The supercomputing center API is an interface used by the supercomputing center to provide external software services. Using the services provided by the supercomputing center API, users can easily manage all their computing, network, and storage resources, and quickly schedule and scale resources according to business needs.

[0036] In response to the problems faced by existing supercomputing center APIs, such as overly simple authentication and authorization, and easy tampering of parameters, an embodiment of the present invention provides a supercomputing interface trusted authentication method, which can strengthen the permission control and authorization protection mechanism for users to access the supercomputing interface, and prevent the supercomputing interface request information from being tampered with.

[0037] It should be noted that, in the embodiments of the present invention, "supercomputing" is the abbreviation of supercomputing center, and "supercomputing interface" is the abbreviation of supercomputing center API.

[0038] The supercomputer interface trust authentication method provided in accordance with an embodiment of the present invention can be implemented in a supercomputer interface trust authentication system. The supercomputer interface trust authentication system of the present invention is described below.

[0039] Figure 1 A schematic diagram of a supercomputer interface trusted authentication system 100 provided according to an embodiment of the present invention is shown.

[0040] like Figure 1 As shown, in an embodiment of the present invention, a supercomputer interface trusted authentication system 100 includes one or more clients 110 and a server 120. The server 120 is connected to the one or more clients 110 in communication, for example, via a wired or wireless network connection.

[0041] It should be noted that the supercomputing interface is used to provide computing resource services to the outside world (for example, to the client 110), and the computing resource services are used to manage computing resources, network resources and storage resources.

[0042] In an embodiment of the present invention, the client 110 can use the computing power resource services provided by the supercomputing interface by calling the supercomputing interface. The server 120 can provide a supercomputing interface trusted authentication function to control the client 110's access rights to the supercomputing interface, and further control the client 110's access rights to the computing power resource services provided by the supercomputing interface.

[0043] like Figure 1 As shown, in an embodiment of the present invention, the server 120 includes a user account management module 121, a user key management module 122, a service monitoring module 123, a second request signature module 124, a trusted authentication module 125, and a service provision module 126. The user account management module 121 is used to centrally manage the basic user information of each client 110 and provide unified user identity authentication and authorization.

[0044] The user account management module 121 is used to perform user identity authentication on the client 110 in response to a login request from the client 110 .

[0045] User key management module 122 is configured to respond to a request from client 110 for a key pair for the supercomputing interface after successful user identity authentication by returning a key pair to client 110. The key pair includes the user identifier of client 110 and first key information corresponding to the user identifier. Client 110 may sign the request information based on the first key information to generate a first trusted identifier. The request information may include a first timestamp from client 110.

[0046] The service monitoring module 123 is used to receive a supercomputing interface request sent by the client 110 based on the user identifier, where the supercomputing interface request includes request information and the first trusted identifier.

[0047] The second request signature module 124 is used to obtain the second key information corresponding to the user identifier from the user key management module 122, sign the supercomputing interface request based on the second key information, and generate a second trusted identifier.

[0048] The trusted authentication module 125 performs a first trusted authentication on the supercomputing interface request by comparing whether the first trusted identifier is consistent with the second trusted identifier, and performs a second trusted authentication on the supercomputing interface request by determining whether the time difference between the first timestamp from the client 110 and the second timestamp from the server 120 is less than or equal to the time difference threshold.

[0049] If both the first trusted authentication and the second trusted authentication are passed, the service providing module 126 can provide computing resource services to the client 110 so that the client 110 manages the computing resources, network resources and storage resources corresponding to the user identification of the client 110 through the computing resource services.

[0050] In some embodiments, the user account management module 121 can provide a network login page to the client 110. The client 110 can enter the login account and corresponding login password on the network login page to send a login request to the server 120. Then, the server 120 can perform user identity authentication on the client 110.

[0051] In addition, in some embodiments, the server 120 may further include a traffic control module. The traffic control module may determine whether the number of supercomputing interface requests corresponding to the user identifier (i.e., the number of times the client 110 sends supercomputing interface requests) within a predetermined time interval exceeds a traffic control threshold. If the number of supercomputing interface requests exceeds the traffic control threshold, the module may impose traffic restrictions on the client 110 to prevent the client 110 from sending further supercomputing interface requests. This can prevent service attacks.

[0052] In some embodiments, as Figure 1 As shown, the client 110 includes a first request signature module and a request connection module. The first request signature module is used to sign the request information based on the first key information to generate a first trusted identifier. The request connection module is used to send a supercomputing interface request (connection request) to the server 120 based on the user identifier.

[0053] In an embodiment of the present invention, the server 120 in the supercomputing interface trusted authentication system 100 can be configured to execute the supercomputing interface trusted authentication method 300 to achieve the above-mentioned functions. The supercomputing interface trusted authentication method 300 of the present invention will be described in detail below. The specific execution logic of each module of the server 120 can be found in the description of the supercomputing interface trusted authentication method 300 below, and will not be repeated here.

[0054] According to the supercomputing interface trusted identification system 100 of the present invention, on the basis of authenticating the identity of the client user, the client and the server also encrypt the request information of the supercomputing interface request based on the first key information and the second key information respectively obtained, and generate a first trusted identifier and a second trusted identifier respectively. The server determines whether the request information has been tampered with and whether the supercomputing interface request is trustworthy by comparing the first trusted identifier and the second trusted identifier. In addition, it further determines whether the supercomputing interface request is trustworthy by verifying the time difference between the client and the server requests. Based on this, it is possible to strengthen the permission control and authorization protection mechanism for users to access the supercomputing interface and prevent the supercomputing interface request information from being tampered with.

[0055] Furthermore, the server verifies whether the number of requests sent by the client exceeds the flow control threshold and decides whether to limit the client's flow. This can prevent service attacks.

[0056] In one embodiment, the server 120 of the present invention can be implemented as a computing device described below, so that the supercomputing interface trust authentication method 300 of the present invention can be executed in the computing device.

[0057] Figure 2 FIG. 2 shows a schematic diagram of a computing device 200 provided according to an embodiment of the present invention. Figure 2 As shown, in a basic configuration, computing device 200 includes at least one processing unit 202 and system memory 204. According to one aspect, depending on the configuration and type of computing device, processing unit 202 can be implemented as a processor. System memory 204 includes, but is not limited to, volatile storage (e.g., random access memory), non-volatile storage (e.g., read-only memory), flash memory, or any combination of such memories. According to one aspect, system memory 204 includes an operating system 205.

[0058] According to one aspect, operating system 205 is suitable for controlling the operation of computing device 200, for example. Furthermore, examples may be practiced in conjunction with graphics libraries, other operating systems, or any other application programs, and are not limited to any particular application or system. Figure 2 The basic configuration is shown in FIG. 2 by those components within the dashed lines. According to one aspect, the computing device 200 has additional features or functionality. For example, according to one aspect, the computing device 200 includes additional data storage devices (removable and / or non-removable), such as magnetic disks, optical disks, or tapes. Such additional storage Figure 2 In the figure, removable storage device 209 and non-removable storage device 210 are shown.

[0059] As stated above, according to one aspect, a program module 203 is stored in the system memory 204. According to one aspect, the program module 203 may include one or more application programs, and the present invention is not limited to the type of application program. For example, the application program may include an email and contact application program, a word processing application program, a spreadsheet application program, a database application program, a slide show application program, a drawing or computer-aided application program, a web browser application program, etc.

[0060] In an embodiment according to the present invention, the program module 203 includes a plurality of program instructions for executing the supercomputer interface trustworthy authentication method 300 of the present invention.

[0061] According to one aspect, examples may be practiced on a circuit comprising discrete electronic components, a packaged or integrated electronic chip containing logic gates, a circuit utilizing a microprocessor, or a single chip containing electronic components or a microprocessor. Figure 2 In the embodiment of the present invention, each or many components shown in the embodiment of the present invention can be integrated into a system on a chip (SOC) on a single integrated circuit to practice the example. According to one aspect, such a SOC device may include one or more processing units, a graphics unit, a communication unit, a system virtualization unit, and various application functions, all of which are integrated (or "burned") onto a chip substrate as a single integrated circuit. When operated via the SOC, the functions described in this article can be operated via a dedicated logic integrated with other components of the computing device 200 on a single integrated circuit (chip). Other technologies capable of performing logical operations (such as AND, OR, and NOT) can also be used to practice embodiments of the present invention, and the other technologies include but are not limited to mechanical, optical, fluid, and quantum technologies. In addition, embodiments of the present invention can be practiced in a general-purpose computer or in any other circuit or system.

[0062] According to one aspect, the computing device 200 may also have one or more input devices 212, such as a keyboard, a mouse, a pen, a voice input device, a touch input device, etc. Output devices 214 may also be included, such as a display, speakers, a printer, etc. The aforementioned devices are examples, and other devices may also be used. The computing device 200 may include one or more communication connections 216 that allow communication with other computing devices 218. Examples of suitable communication connections 216 include, but are not limited to: RF transmitter, receiver, and / or transceiver circuitry; Universal Serial Bus (USB), parallel, and / or serial ports.

[0063] As used herein, the term computer-readable medium includes computer storage media. Computer storage media can include volatile and non-volatile, removable and non-removable media implemented with any method or technology for storing information (e.g., computer-readable instructions, data structures, or program modules). System memory 204, removable storage device 209, and non-removable storage device 210 are all examples of computer storage media (i.e., memory storage). Computer storage media can include random access memory (RAM), read-only memory (ROM), electrically erasable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical storage, cassette tape, magnetic tape, disk storage or other magnetic storage device, or any other product that can be used to store information and can be accessed by computing device 200. According to one aspect, any such computer storage medium can be a part of computing device 200. Computer storage media does not include carrier waves or other propagated data signals.

[0064] According to one aspect, communication media is implemented by computer-readable instructions, data structures, program modules, or other data in a modulated data signal (e.g., a carrier wave or other transport mechanism), and includes any information delivery media. According to one aspect, the term "modulated data signal" describes a signal that has one or more characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, radio frequency (RF), infrared, and other wireless media.

[0065] In an embodiment according to the present invention, the computing device 200 is configured to execute the supercomputing interface trusted authentication method 300. The computing device 200 includes one or more processors and one or more readable storage media storing program instructions. When the program instructions are configured to be executed by the one or more processors, the computing device executes the supercomputing interface trusted authentication method 300 in the embodiment of the present invention, so that the computing device 200 controls the access rights of the client 110 to the supercomputing interface by executing the supercomputing interface trusted authentication method 300 of the present invention.

[0066] In an embodiment of the present invention, the computing device that executes the supercomputing interface trusted authentication method 300 in the embodiment of the present invention may be the server 120. That is, the supercomputing interface trusted authentication method 300 may be executed on the server 120. By executing the supercomputing interface trusted authentication method 300, the server 120 can strengthen the authority control and authorization protection mechanism for user access to the supercomputing interface, thereby preventing the tampering of supercomputing interface request information.

[0067] In an embodiment of the present invention, the server 120 includes a user account management module 121 , a user key management module 122 , a service monitoring module 123 , a second request signature module 124 , a trusted authentication module 125 , and a service provision module 126 .

[0068] The following is a detailed description of the supercomputing interface trustworthiness authentication method 300 in an embodiment of the present invention.

[0069] Figure 3 FIG. 3 is a flow chart of a supercomputer interface trustworthy authentication method 300 according to an embodiment of the present invention. Figure 3 As shown, the supercomputer interface trust authentication method 300 includes the following steps 310 to 360.

[0070] Step 320 : The server 120 may perform user identity authentication on the client 110 in response to the login request of the client 110 .

[0071] In an embodiment of the present invention, step 310 may be performed by the user account management module 121 of the server 120. That is, the user account management module 121 of the server 120 may perform user identity authentication on the client 110 in response to a login request from the client 110.

[0072] In an embodiment of the present invention, when client 110 needs to call a supercomputing interface, client 110 first sends a login request to server 120. Server 120 can perform user authentication on client 110 in response to the login request from client 110. Here, the login request includes the login account and password entered by the user on client 110. Server 120 can verify the login account and password of client 110 to perform user authentication on client 110. After the user authentication is successful, server 120 allows client 110 to log in, and client 110 can log in to server 120. Furthermore, client 110 can request a key pair from server 120.

[0073] Step 320: The server 120 may respond to the client 110's request to obtain the key pair of the supercomputing interface after the user identity authentication is passed, and return the key pair to the client 110 so that the client 110 can call the supercomputing interface based on the key pair and use the corresponding computing resource service.

[0074] In an embodiment of the present invention, step 320 may be performed by the user key management module 122 of the server 120. That is, the client 110 may request the server 120 to obtain a key pair. The user key management module 122 of the server 120 may return the key pair to the client 110 in response to the client 110's request for the supercomputing interface key pair after the user identity is successfully authenticated.

[0075] It should be noted that the key pair includes the user identification of the client 110 (the user identification is userKey, which can uniquely identify the user of the client 110) and the first key information (secretKey) corresponding to the user identification.

[0076] In some embodiments, the user identifier (userKey) may be obtained by encrypting the first identifier of the user at the server 120 , the second identifier of the user at the supercomputing center, and other information.

[0077] After client 110 obtains the key pair from server 120, client 110 can sign the request information based on the first key information to generate a first trusted identifier. Here, the request information includes a first timestamp from client 110. Furthermore, client 110 can obtain a supercomputing interface request based on the request information and the first trusted identifier, and send the supercomputing interface request to server 120 based on the user identifier.

[0078] In step 330, the server 120 receives the supercomputing interface request (connection request) sent by the client 110 based on the user identifier. The supercomputing interface request in step 330 includes request information and a first trusted identifier.

[0079] In an embodiment of the present invention, step 330 may be performed by the service monitoring module 123 of the server 120. That is, the service monitoring module 123 of the server 120 may receive the supercomputing interface request sent by the client 110 based on the user identifier.

[0080] Step 340: The server 120 obtains the second key information corresponding to the user identifier from the server 120 locally, signs the supercomputing interface request based on the second key information, and generates a second trusted identifier.

[0081] Specifically, in step 340, the server 120 may obtain the second key information corresponding to the user identifier from the user key management module 122, and then sign the supercomputing interface request based on the second key information to generate a second trusted identifier.

[0082] In an embodiment of the present invention, step 340 may be performed by the second request signature module 124 of the server 120. That is, the second request signature module 124 of the server 120 may obtain the second key information corresponding to the user identifier from the user key management module 122, and then sign the supercomputing interface request based on the second key information to generate a second trusted identifier.

[0083] Step 350: The server 120 performs a first trusted authentication on the supercomputing interface request by comparing the first trusted identifier with the second trusted identifier to determine whether they are consistent, and performs a second trusted authentication on the supercomputing interface request by determining whether the time difference between the first timestamp from the client 110 and the second timestamp from the server 120 is less than or equal to the time difference threshold.

[0084] It can be understood that the server 120 can perform trust authentication on the supercomputing interface request by executing step 350. The trust authentication on the supercomputing interface request includes at least a first trust authentication and a second trust authentication.

[0085] In an embodiment of the present invention, step 350 can be performed by the trusted authentication module 125 of the server 120. That is, the trusted authentication module 125 can perform a first trusted authentication on the supercomputing interface request by comparing the first trusted identifier and the second trusted identifier to determine whether they are consistent. Furthermore, the trusted authentication module 125 can perform a second trusted authentication on the supercomputing interface request by determining whether the time difference (the absolute value of the time difference) between the first timestamp from the client 110 and the second timestamp from the server 120 is less than or equal to a time difference threshold.

[0086] In an embodiment of the present invention, in step 350, when the server 120 (trusted authentication module 125) performs a first trusted authentication on the supercomputing interface request, if the first trusted identifier is consistent with the second trusted identifier, it can be determined that the first trusted authentication has passed; if the first trusted identifier is inconsistent with the second trusted identifier, it is determined that the first trusted authentication has failed.

[0087] When the server 120 (trusted authentication module 125) performs the second trusted authentication on the supercomputing interface request, if the time difference (absolute value) between the first timestamp of the client 110 and the second timestamp of the server 120 is less than or equal to the time difference threshold, it is determined that the second trusted authentication has passed; if the time difference (absolute value) between the first timestamp of the client 110 and the second timestamp of the server 120 is greater than the time difference threshold, it is determined that the second trusted authentication has failed.

[0088] In some embodiments, the time difference threshold may be, for example, 120 seconds. However, it should be noted that the present invention does not limit the specific value of the time difference threshold, which can be set by those skilled in the art according to actual needs.

[0089] In an embodiment of the present invention, if both the first trusted authentication and the second trusted authentication are passed, the server 120 may execute the following step 350 .

[0090] Step 360: The server 120 provides computing power resource services to the client 110. Then, the client 110 can manage the computing resources, network resources, and storage resources corresponding to the user identifier of the client 110 through the computing power resource services.

[0091] In an embodiment of the present invention, step 360 may be performed by the service provision module 126 of the server 120. That is, if both the first trusted authentication and the second trusted authentication are passed, the service provision module 126 of the server 120 may provide computing resource services to the client 110, so that the client 110 can manage the computing resources, network resources, and storage resources corresponding to the user identifier of the client 110 through the computing resource services.

[0092] In addition, if the first trusted authentication and / or the second trusted authentication fails, the server 120 refuses to provide computing resource services to the client 110 .

[0093] In some embodiments, the server 120 may also determine whether the number of supercomputing interface requests corresponding to the user identifier (i.e., the number of supercomputing interface requests sent by the client 110 corresponding to the user identifier) ​​within a predetermined time interval (a first predetermined time interval) exceeds a flow control threshold (a first flow control threshold). If the flow control threshold (the first flow control threshold) is exceeded, flow control is imposed on the client 110 to prevent the client 110 from continuing to send supercomputing interface requests. In this way, service attacks can be avoided.

[0094] In some embodiments, the predetermined time interval (first predetermined time interval) is, for example, 1 minute. The flow control threshold (first flow control threshold) is, for example, 20 times. Specifically, the server 120 can determine whether the number of supercomputing interface requests corresponding to the user identifier exceeds 20 times within 1 minute. If so, the server 120 can impose flow restrictions on the client 110 to prevent the client 110 from continuing to send supercomputing interface requests.

[0095] In yet other embodiments, the server 120 may further determine whether the total number of all supercomputing interface requests sent by the client 110 corresponding to the user identifier within a predetermined time period exceeds a second flow control threshold. If the total number of all supercomputing interface requests sent by the client 110 exceeds the second flow control threshold, the server 120 may impose flow restrictions on the client 110 to prevent the client 110 from continuing to send supercomputing interface requests. Here, the second predetermined time interval is greater than the predetermined time interval. For example, the second predetermined time interval is 1 hour, and the second flow control threshold is, for example, 36,000 times.

[0096] It should be understood that the present invention does not limit the specific value of the above-mentioned flow control threshold, and those skilled in the art can reasonably set the flow control threshold according to actual conditions (such as time interval).

[0097] In some embodiments, the request information includes: request method, request path, request header, request query parameters, request parameters, and request behavior information. Among them, the request header includes a first timestamp from the client 110, a Host field (used to indicate the domain name / IP address and port number of the server 120), and a data type (i.e., Content-Type, used to indicate the data type or data format of the data transmitted by the server). The request behavior information includes requesting a trusted encryption method, supercomputing interface version information, service information (used to indicate the computing power resource service that the client 110 requests to access), and an authorization scope (used to control the scope of authorized access of the client 110 to the computing power resource service). In some embodiments, the requesting a trusted encryption method can be, for example, the HmacSHA256 encryption algorithm. The supercomputing interface version information is, for example, V3.

[0098] The client 110 may generate a regularized request string based on the request information, and sign the regularized request string based on the first key information to generate a first trusted identifier. The client 110 includes a first request signing module and a request connection module. The client 110 may generate a regularized request string based on the request information using the first request signing module, and sign the regularized request string based on the first key information to generate a first trusted identifier.

[0099] Specifically, the client 110 (first request signature module) may generate the first trusted identifier in the following manner:

[0100] First, the request header, request query parameters, and request parameters are regularized. Specifically, the request header can be regularized as follows: all the information in the request header that needs to be encapsulated for this supercomputing interface request (including the first timestamp, Host field, and data type) can be encapsulated, and the Key and Value in the encapsulated request header are uniformly converted to lowercase characters, and the leading and trailing spaces are removed, and then spliced ​​in the key:value\n format. The last Key and Value combination does not add \n, and each Key is sorted in ascending order according to the ASCII code. The request query parameters are regularized as follows: the request query parameter string that needs to be encapsulated for this supercomputing interface request is converted into a format that complies with the URL encoding specification, all the Keys and Values ​​in the request query parameters are uniformly converted to lowercase characters, and special characters are converted to a format similar to %2F. The request parameters are regularized as follows: the request parameters that need to be encapsulated for this supercomputing interface request are encrypted. Specifically, all the request parameter information can be first encrypted with SHA-256, and then converted into a hexadecimal string.

[0101] Then, the request method and request path are concatenated with the regularized request header, request query parameters, and request parameters (each part needs to be separated by \n) to generate a regularized request body.

[0102] Furthermore, the request behavior information (including the requested trusted encryption method, supercomputing interface version information, service information, and authorization scope) and the user identifier in the key pair can be concatenated with the regular request body (each part needs to be separated by \n) to generate a regular request string.

[0103] Finally, a trusted identifier prefix, the first key information, and the regularized request string can be encrypted using a trusted request encryption method (e.g., the HmacSHA256 encryption algorithm) to obtain first encrypted information, and the first encrypted information is converted into a hexadecimal string to obtain the first trusted identifier. Here, the hexadecimal string converted from the first encrypted information is the first trusted identifier.

[0104] Furthermore, client 110 can send a supercomputing interface request to server 120 based on the request information and the generated first trusted identifier, and based on the user identifier. The supercomputing interface request received by server 120 includes the request information and the first trusted identifier. In other words, server 120 can obtain the request information and the first trusted identifier generated by client 110 from the supercomputing interface request.

[0105] In some embodiments, after the first request signature module of the client 110 generates the first trusted identifier, the request connection module of the client 110 may send a supercomputing interface request (connection request) to the server 120 based on the user identifier. In step 330, the service monitoring module 123 of the server 120 may monitor the supercomputing interface request sent by the client 110 (request connection module) based on the user identifier. When the supercomputing interface request from the client 110 is monitored, the server 120 may send a signature request for the supercomputing interface request to the second request signature module 124 of the server 120 in response to the monitored supercomputing interface request. Subsequently, in step 340, the second request signature module 124 of the server 120 may obtain the second key information corresponding to the user identifier from the user key management module 122 in response to the signature request from the second request signature module 124, and sign the supercomputing interface request based on the second key information to generate a second trusted identifier.

[0106] In some embodiments, in step 340, the server 120 (second request signature module 124) may obtain request information from the supercomputing interface request and sign the request information in the supercomputing interface request based on the second key information obtained from the user key management module 122 to generate a second trusted identifier. Here, the second request signature module 124 of the server 120 may sign the request information in the supercomputing interface request in a manner similar to the first signature module of the client 110, as follows:

[0107] First, the server 120 (the second request signature module 124 ) can obtain request information from the supercomputing interface request.

[0108] Next, the server 120 (the second request signature module 124) regularizes the request header, request query parameters, and request parameters in the request information. Specifically, the regularization method for the request header is as follows: all the information in the request header that needs to be encapsulated for this supercomputing interface request (including the first timestamp, Host field, and data type) can be encapsulated, and the Key and Value in the request header involved in the encapsulation are uniformly converted to lowercase characters, and the leading and trailing spaces are removed, and then spliced ​​in the key:value\n format. The last Key and Value combination does not add \n, and each Key is sorted in ascending order according to the ASCII code. The regularization method for the request query parameters is as follows: the request query parameter string that needs to be encapsulated for this supercomputing interface request is converted into a format that complies with the URL encoding specification, all the Keys and Values ​​in the request query parameters are uniformly converted into lowercase characters, and special characters are converted into a format similar to %2F. The regularization method for the request parameters is as follows: the request parameters that need to be encapsulated for this supercomputing interface request are encrypted. Specifically, all the request parameter information can be first encrypted with SHA-256 and then converted into a hexadecimal string.

[0109] Subsequently, the server 120 (the second request signature module 124) concatenates the request method and request path in the request information with the regularized request header, request query parameters, and request parameters (each part needs to be separated by \n) to generate a regularized request body.

[0110] Furthermore, the server 120 (the second request signature module 124) can concatenate the request behavior information (including the requested trusted encryption method, supercomputing interface version information, service information, and authorization scope) in the request information and the user identifier in the key pair with the regular request body (each part needs to be separated by \n) to generate a regular request string.

[0111] Finally, the server 120 (second request signature module 124) can use the request trusted encryption method (e.g., HmacSHA256 encryption algorithm) in the request information to encrypt the trusted identifier prefix, the second key information obtained from the user key management module 122 (different from the first key information of the client 110), and the regularized request string to obtain second encrypted information, and convert the second encrypted information into a hexadecimal string to obtain the second trusted identifier. Here, the hexadecimal string converted from the second encrypted information is the second trusted identifier.

[0112] In some embodiments, if both the first trusted authentication and the second trusted authentication are passed, then in step 360, the server 120 (service provision module 126) can provide the computing power resource service corresponding to the authorization scope in the request information to the client 110. In this way, it is possible to control the scope of authorized access of the client 110 user to the computing power resource service.

[0113] In some embodiments, the format of the timestamp in the present invention may be a 10-digit Unix timestamp.

[0114] According to the supercomputing interface trusted identification method 300 of the present invention, on the basis of authenticating the identity of the client user, the client and the server also encrypt the request information of the supercomputing interface request based on the first key information and the second key information respectively obtained, and generate a first trusted identifier and a second trusted identifier respectively. The server determines whether the request information has been tampered with and whether the supercomputing interface request is trustworthy by comparing the first trusted identifier and the second trusted identifier. In addition, it further determines whether the supercomputing interface request is trustworthy by verifying the time difference between the client and the server requests. Based on this, it is possible to strengthen the permission control and authorization protection mechanism for users to access the supercomputing interface and prevent the supercomputing interface request information from being tampered with.

[0115] Furthermore, the server verifies whether the number of requests sent by the client exceeds the flow control threshold and decides whether to limit the client's flow. This can prevent service attacks.

[0116] In addition, by providing computing power resource services corresponding to the authorization scope to the client, the authorized access scope of the client user to the computing power resource service can be controlled.

[0117] In addition, an embodiment of the present invention further discloses: A9, a method as described in any one of A1-A8, wherein the server includes a service monitoring module, a second request signature module, and a user key management module; receiving a supercomputing interface request sent by the client based on the user identifier, comprising: the service monitoring module monitoring the supercomputing interface request sent by the client based on the user identifier, and in response to monitoring the supercomputing interface request, sending a signature request for the supercomputing interface request to the second request signature module; obtaining second key information corresponding to the user identifier from the server, signing the supercomputing interface request based on the second key information, and generating a second trusted identifier, comprising: the second request signature module, in response to the signature request, obtaining second key information corresponding to the user identifier from the user key management module, signing the supercomputing interface request based on the second key information, and generating a second trusted identifier. B12, a computer program product, comprising a computer program / instruction, wherein the computer program / instruction, when executed by a processor, implements the method as described in any one of A1-A9. C13. A readable storage medium storing program instructions, which, when read and processed by a computing device, enables the computing device to process the method described in any one of A1 to A9.

[0118] The various techniques described herein may be implemented in conjunction with hardware or software, or a combination thereof. Thus, the methods and apparatus of the present invention, or certain aspects or portions of the methods and apparatus of the present invention, may be implemented in the form of program codes (i.e., instructions) embedded in a tangible medium, such as a removable hard disk, a USB flash drive, a floppy disk, a CD-ROM, or any other machine-readable storage medium, wherein when the program is loaded into a machine such as a computer and executed by the machine, the machine becomes an apparatus for practicing the present invention.

[0119] When the program code is executed on a programmable computer, the mobile terminal generally includes a processor, a storage medium readable by the processor (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device. The memory is configured to store the program code; the processor is configured to execute the supercomputing interface trusted authentication method of the present invention according to the instructions in the program code stored in the memory.

[0120] By way of example and not limitation, readable media include readable storage media and communication media. Readable storage media store information such as computer-readable instructions, data structures, program modules, or other data. Communication media typically embody computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and include any information delivery medium. Combinations of any of the above are also included within the scope of readable media.

[0121] In the description provided herein, the algorithms and displays are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems may also be used in conjunction with the examples of the present invention. Based on the above description, it is apparent that the structure required for constructing such systems is well understood. In addition, the present invention is not directed to any specific programming language. It should be understood that various programming languages ​​may be utilized to implement the present invention described herein, and the description of specific languages ​​above is provided for the purpose of disclosing the preferred embodiment of the present invention.

[0122] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0123] Similarly, it should be understood that in order to streamline the disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together into a single embodiment, figure, or description thereof.

[0124] Those skilled in the art will appreciate that the modules, units, or components of the devices in the examples disclosed herein may be arranged in the device described in the embodiment, or alternatively may be located in one or more devices different from the devices in the examples. The modules in the foregoing examples may be combined into one module or further divided into multiple submodules.

[0125] Unless otherwise specified, the use of ordinal numbers "first," "second," "third," etc. to describe common objects merely indicates that different instances of similar objects are involved and is not intended to imply that the objects so described must have a given order in time, space, ranking, or in any other manner.

Claims

1. A method for authenticating a supercomputing interface, executed on a server to control a client's access rights to the supercomputing interface, wherein the supercomputing interface is used to provide external computing resource services, which are used to manage computing resources, network resources, and storage resources. The server is in communication with the client, and the method comprises: In response to a login request from a client, performing user identity authentication on the client; In response to a request from a client to obtain a key pair for a supercomputing interface after user identity authentication is passed, returning a key pair to the client, wherein the key pair includes a user identifier of the client and first key information corresponding to the user identifier; the client is adapted to sign a request message based on the first key information to generate a first trusted identifier, and the request message includes a first timestamp from the client; receiving a supercomputing interface request sent by the client based on the user identifier, wherein the supercomputing interface request includes the request information and the first trusted identifier; Obtaining second key information corresponding to the user identifier from the server, signing the supercomputing interface request based on the second key information, and generating a second trusted identifier; Performing a first trust authentication on the supercomputing interface request by comparing the first trust identifier and the second trust identifier to determine whether they are consistent, and performing a second trust authentication on the supercomputing interface request by determining whether a time difference between the first timestamp from the client and the second timestamp from the server is less than or equal to a time difference threshold; If both the first trusted authentication and the second trusted authentication are passed, the computing power resource service is provided to the client, so that the client manages the computing resources, network resources and storage resources corresponding to the user identification of the client through the computing power resource service.

2. The method according to claim 1, wherein Also includes: If the first trusted authentication and / or the second trusted authentication fails, the computing resource service is refused to be provided to the client.

3. The method according to claim 1, wherein Also includes: Determine whether the number of supercomputing interface requests corresponding to the user identifier within a predetermined time interval exceeds a flow control threshold. If the flow control threshold is exceeded, flow restriction is performed on the client to restrict the client from continuing to send supercomputing interface requests.

4. The method according to any one of claims 1 to 3, wherein Performing a first trust authentication on the supercomputing interface request by comparing the first trustworthy identifier with the second trustworthy identifier to determine whether the first trustworthy identifier is consistent with the second trustworthy identifier includes: If the first trusted identifier is consistent with the second trusted identifier, it is determined that the first trusted authentication is passed; if the first trusted identifier is inconsistent with the second trusted identifier, it is determined that the first trusted authentication is failed; Performing a second trusted authentication on the supercomputing interface request by determining whether a time difference between the first timestamp from the client and the second timestamp from the server is less than or equal to a time difference threshold includes: If the time difference is less than or equal to the time difference threshold, it is determined that the second trusted authentication has passed; if the time difference is greater than the time difference threshold, it is determined that the second trusted authentication has failed.

5. The method according to any one of claims 1 to 3, wherein The request information includes: request method, request path, request header, request query parameters, request parameters, and request behavior information; wherein the request header includes the first timestamp, Host field, and data type, and the request behavior information includes the request trusted encryption method, supercomputing interface version information, service information, and authorization scope; The client is adapted to generate a regularized request string based on the request information, and sign the regularized request string based on the first key information to generate a first trusted identifier.

6. The method according to claim 5, wherein: The client is further adapted to: Regularizing the request header, request query parameters, and request parameters; Concatenate the request method and request path with the regularized request header, request query parameters, and request parameters to generate a regularized request body; Concatenate the request behavior information and the user identifier in the key pair with the regularized request body to generate a regularized request string; The trusted identifier prefix, the first key information and the regular request character string are encrypted using the request trusted encryption method and converted into a hexadecimal character string to obtain the first trusted identifier.

7. The method according to claim 5, wherein: Providing the computing resource service to the client includes: Provide computing power resource services corresponding to the authorization scope to the client.

8. The method of claim 5, wherein: Signing the supercomputing interface request based on the second key information to generate a second trusted identifier includes: Obtaining request information from the supercomputing interface request; Regularize the request header, request query parameters, and request parameters in the request information; Concatenate the request method and request path in the request information with the regularized request header, request query parameters, and request parameters to generate a regularized request body; Concatenate the request behavior information in the request information and the user identifier in the key pair with the regularized request body to generate a regularized request string; The trusted identifier prefix, the first key information, and the regular request character string are encrypted using the trusted encryption method in the request information, and converted into a hexadecimal character string to obtain the first trusted identifier.

9. The method according to any one of claims 1 to 3, wherein The server includes a service monitoring module, a second request signature module, and a user key management module; Receiving a supercomputing interface request sent by the client based on the user identifier includes: The service monitoring module monitors the supercomputing interface request sent by the client based on the user identifier, and in response to monitoring the supercomputing interface request, sends a signature request for the supercomputing interface request to the second request signature module; Obtaining second key information corresponding to the user identifier from the server, signing the supercomputing interface request based on the second key information, and generating a second trusted identifier, including: In response to the signature request, the second request signature module obtains second key information corresponding to the user identifier from the user key management module, signs the supercomputing interface request based on the second key information, and generates a second trusted identifier.

10. A supercomputer interface trusted authentication system, comprising: Client; A server, communicatively connected to the client, adapted to execute the method according to any one of claims 1 to 9, to control the client's access rights to a supercomputing interface, wherein the supercomputing interface is used to provide external computing resource services, and the computing resource services are used to manage computing resources, network resources, and storage resources; wherein the server comprises: A user account management module, adapted to perform user identity authentication on the client in response to a login request from the client; a user key management module, adapted to, in response to a request from a client for a key pair for a supercomputing interface after user identity authentication is passed, return a key pair to the client, wherein the key pair includes a user identifier of the client and first key information corresponding to the user identifier; the client is adapted to sign a request message based on the first key information to generate a first trusted identifier, and the request message includes a first timestamp from the client; A service monitoring module, adapted to receive a supercomputing interface request sent by the client based on the user identifier, wherein the supercomputing interface request includes the request information and the first trusted identifier; a second request signing module, adapted to obtain second key information corresponding to the user identifier from the user key management module, sign the supercomputing interface request based on the second key information, and generate a second trusted identifier; a trusted authentication module, adapted to perform a first trusted authentication on the supercomputing interface request by comparing the first trusted identifier with the second trusted identifier to determine whether they are consistent, and to perform a second trusted authentication on the supercomputing interface request by determining whether a time difference between the first timestamp from the client and the second timestamp from the server is less than or equal to a time difference threshold; A service providing module, if both the first trusted authentication and the second trusted authentication are passed, then the service providing module is suitable for providing the computing power resource service to the client, so that the client manages the computing resources, network resources and storage resources corresponding to the user identification of the client through the computing power resource service.

11. A computing device comprising: at least one processor; and A memory storing program instructions, wherein the program instructions are configured to be processed by the at least one processor, and the program instructions include instructions for processing the method according to any one of claims 1 to 9.

12. A computer program product comprising a computer program / instructions, wherein: When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 9 is implemented.

13. A readable storage medium storing program instructions, wherein when the program instructions are read and processed by a computing device, the computing device is caused to process the method according to any one of claims 1 to 9.

Images