Management method and device for ACME service of public cloud

Abstract

The invention relates to the technical field of internet communication, discloses a management method and device for ACME service of public cloud, electronic equipment, a computer readable storage medium and a computer program product, and is used for solving the technical problem that an existing management method for ACME service of public cloud is poor in safety management effect. The method comprises the steps that an ACME client initiates a new account creating request to a management platform based on a request of a user, and the new account creating request comprises a request user mailbox, an EAB KID and an account public key; the management platform checks whether the EAB KID exists or not, and judges whether the EAB KID is bound with a unique user identifier or not; if so, continuing; the management platform forwards the account creating request to a CA platform; the CA platform generates new account information after receiving the new account request, binds the new account information with the EAB KID, the account public key and the unique user identifier, and returns the new account information to the ACME client; and the ACME client responds to the request of the user and processes the ACME request based on the new account information.

Description

Technical Field

[0001] The present invention relates to the field of Internet communication technology, and in particular to a management method, device, electronic device, computer storage medium and computer program product for ACME services of a public cloud. Background Art

[0002] With the rapid development of cloud computing technology, more and more enterprises and individuals choose to use cloud platforms to host their applications and services. In a multi-tenant cloud platform, different users share the same physical resources, but need to ensure the security isolation of their data and applications.

[0003] In the prior art, the Automatic Certificate Management Environment (ACME) protocol used in cloud platforms faces some challenges in management, such as security management issues in multi-tenant environments, EAB Token leakage issues, renewal failure issues, and risks of certificate revocation due to non-compliance, etc. Therefore, a management method for ACME services in public clouds is urgently needed to enhance the multi-tenant security management effect of cloud platforms. Summary of the invention

[0004] The main purpose of the present invention is to solve the technical problem that the management method of ACME service for public cloud in the prior art is not effective in security management.

[0005] A first aspect of the present invention provides a management method for ACME services in a public cloud, comprising: an ACME client initiating a new account request to a management platform based on a user's request, wherein the new account request includes a requesting user's mailbox, an EAB KID, and an account public key;

[0006] The management platform checks whether the EAB KID exists, and if so, determines whether the EAB KID is bound to a unique user identifier; if not, returns an error; if bound, continues;

[0007] The management platform forwards the new account creation request to the CA platform;

[0008] After receiving the request to create a new account, the CA platform generates the new account information, binds the new account information with the EAB KID, the account public key, and the unique user ID, and returns the new account information to the ACME client;

[0009] The ACME client responds to the user's request and processes the ACME request based on the newly created account information.

[0010] Optionally, in a first implementation of the first aspect of the present invention, before the ACME client initiates a request to create a new account to the management platform based on a user's request, the method further includes:

[0011] The cloud platform sends an EAB account creation request to the management platform based on the request sent by the user, wherein the EAB account creation request carries the unique user ID of the user on the cloud platform and the email address of the created user;

[0012] In response to the account creation request from the cloud platform, the management platform initiates a request to create a new EAB account to the CA platform;

[0013] The CA platform generates the user's EAB account information in response to the new EAB account request, wherein the EAB account information includes the EAB KID and the EAB MAC Key;

[0014] The management platform binds the EAB KID to the unique user ID, saves the created user mailbox, and returns the EAB account information to the user.

[0015] Optionally, in a second implementation of the first aspect of the present invention, before the management platform forwards the new account request to the CA platform, it further includes:

[0016] Check whether the requesting user's mailbox and the pre-saved created user's mailbox are the same mailbox;

[0017] If they are not the same mailbox, an error prompt is returned, and an alarm notification is sent to the user's mailbox, and the alarm notification is sent to the cloud platform through callback;

[0018] The warning notification also includes a link for quickly banning the client. Based on the user's operation, the issuing client is banned according to the link for quickly banning the client.

[0019] Optionally, in a third implementation manner of the first aspect of the present invention, before the detecting the management platform to check whether the EAB KID exists, the method further includes:

[0020] Monitor whether it is the first registration;

[0021] If it is the first registration, before the management platform forwards the new account request to the CA platform, it also includes:

[0022] A registration notification is sent to the creating user's mailbox. If the user feedbacks that the registration operation corresponding to the registration notification is not an authorized operation, an alarm notification is sent to the user's mailbox, and the alarm notification is sent to the cloud platform through a callback.

[0023] Optionally, in a fourth implementation of the first aspect of the present invention, if it is not the first registration, the method further includes:

[0024] Get the client location information during registration;

[0025] Obtain the IP address of the client currently making the request, and detect whether the IP address of the client making the request is consistent with the client address at the time of registration based on the IP address;

[0026] If they are inconsistent, an alarm notification is sent to the user's mailbox, and the alarm notification is sent to the cloud platform through callback.

[0027] Optionally, in a fifth implementation of the first aspect of the present invention, the management method for ACME services in a public cloud further includes:

[0028] The management platform accepts the ARI request periodically sent by the ACME client to the management platform;

[0029] Determine whether the current time interval from the last ARI request sent by the client exceeds the preset waiting time;

[0030] If it exceeds, an alarm notification is sent to the user's mailbox, and the alarm notification is sent to the cloud platform through a callback. The second aspect of the present invention provides a management device for ACME services in a public cloud, including:

[0031] The ACME client is used to initiate a new account request to the management platform based on a user's request, wherein the new account request includes a requesting user's email address, an EAB KID, and an account public key; and, in response to the user's request, process the ACME request based on the new account information;

[0032] The management platform is used to check whether the EAB KID exists, and if so, determine whether the EAB KID is bound to the unique user identifier; if not, return an error; if bound, continue; and forward the new account request to the CA platform; and bind the new account information with the EAB KID, the account public key and the unique user identifier, and return the new account information to the ACME client;

[0033] CA platform, used to generate new account information after receiving a new account request;

[0034] The management platform is also used to bind the newly created account information with the EAB KID, the account public key and the unique user identifier, and return the newly created account information to the ACME client.

[0035] A third aspect of the present invention provides a management device for ACME services for a public cloud, comprising: a memory and at least one processor, wherein the memory stores instructions; the at least one processor calls the instructions in the memory so that the management device for ACME services for a public cloud executes the steps of the above-mentioned management method for ACME services for a public cloud.

[0036] A fourth aspect of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute the steps of the above-mentioned management method for ACME services in a public cloud.

[0037] A fifth aspect of the present invention provides a computer program product, comprising a computer program / instruction, characterized in that when the computer program / instruction is executed by a processor, the steps of the above-mentioned management method for ACME services in a public cloud are implemented.

[0038] In the technical solution provided by the present invention, the ACME client initiates a new account request to the management platform based on the user's request, wherein the new account request includes the requesting user's mailbox, EAB KID and account public key; the management platform checks whether the EAB KID exists, and if so, determines whether the EAB KID is bound to a unique user identifier; if not, an error is returned; if bound, the process continues; the management platform forwards the new account request to the CA platform; after receiving the new account request, the CA platform generates new account information, binds the new account information with the EAB KID, the account public key and the unique user identifier, and returns the new account information to the ACME client; the ACME client responds to the user's request and processes the ACME request based on the new account information.

[0039] The embodiment of the present invention provides a management method for ACME services for public clouds, which can verify security through account information before using ACME services to execute specific ACME requests, and can improve the security management effect of the management method for ACME services for public clouds, thereby enhancing the multi-tenant security management effect of cloud platforms. A device, electronic device, computer-readable storage medium, and computer program product provided by the present invention also solve corresponding technical problems. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0041] Figure 1 This is a flow chart of a first embodiment of a management method for ACME services in a public cloud according to an embodiment of the present invention;

[0042] Figure 2 This is a flow chart of creating a new EAB account in the second embodiment of the management method for ACME services in a public cloud in an embodiment of the present invention;

[0043] Figure 3This is a flow chart of creating a new account based on an ACME client in a second embodiment of the management method for ACME services in a public cloud according to an embodiment of the present invention;

[0044] Figure 4 This is a flow chart of applying for a certificate in the second embodiment of the management method for ACME services in a public cloud in an embodiment of the present invention;

[0045] Figure 5 This is a flow chart of ARI periodic polling and certificate revocation in the second embodiment of the management method for ACME services in a public cloud in an embodiment of the present invention;

[0046] Figure 6 A schematic diagram of an embodiment of a management device for ACME services in a public cloud according to an embodiment of the present invention. DETAILED DESCRIPTION

[0047] Exemplary embodiments of the present invention will now be described more fully with reference to the accompanying drawings. However, exemplary embodiments can be implemented in a variety of forms, and should not be construed as limiting the present invention to the embodiments set forth herein. On the contrary, providing these exemplary embodiments enables the present invention to be more comprehensive and complete, and is more convenient for fully conveying the inventive concept to those skilled in the art. The same reference numerals in the figures represent the same or similar elements, components or parts, and thus their repeated description will be omitted.

[0048] Under the premise of being consistent with the technical concept of the present invention, the features, structures, characteristics or other details described in a specific embodiment do not exclude that they can be combined in one or more other embodiments in a suitable manner.

[0049] In the description of specific embodiments, the features, structures, characteristics or other details described in the present invention are intended to enable those skilled in the art to fully understand the embodiments. However, it does not exclude that those skilled in the art can practice the technical solutions of the present invention without one or more of the specific features, structures, characteristics or other details.

[0050] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0051] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0052] The term "and / or" or "and / or" includes all combinations of any one or more of the associated listed items.

[0053] See also Figure 1 The first embodiment of the management method of ACME service for public cloud in the embodiment of the present invention includes:

[0054] S101. ACME client initiates a request to create a new account to the management platform based on the user's request.

[0055] It is understandable that the execution subject of the present invention may be a management device for ACME (Automated Certificate Management Environment) service of a public cloud, or may be a server, which is not specifically limited here.

[0056] In this embodiment, the user can use the ACME client to initiate a request for a new account (New Account) to the management platform. The new account request will include the requesting user email address, EAB KID (External Account Binding Key ID) and the account public key (Account Key) corresponding to the new account request.

[0057] S102, the management platform checks whether the EAB KID exists;

[0058] In this step, when the management platform receives a request to create a new account, it first checks whether the EAB KID carried in the request exists. If not, an error is returned; if so, the next step of judgment is continued.

[0059] S103, if it exists, determine whether the EAB KID is bound to a unique user identifier;

[0060] S104. If not bound, an error is returned;

[0061] S105, if bound, continue;

[0062] Determine whether the EAB KID carried in the current new account request is bound to a unique user identifier (End UserID): If the EAB KID is not bound to a unique user identifier, an error is returned; if the EAB KID is bound to a unique user identifier, continue to execute the following steps.

[0063] S106. The management platform forwards the new account creation request to the CA platform;

[0064] When the management platform determines that the EAB KID carried in the new account request has been bound to a unique user identifier, the new account request is forwarded to the CA platform (Certificate Authority).

[0065] S107. After receiving the new account request, the CA platform generates new account information, binds the EAB KID, the account public key and the unique user ID, and returns the new account information to the ACME client.

[0066] After receiving the request for creating a new account, the CA platform generates and returns the new account information to the management platform based on the request for creating a new account. Specifically, the new account information includes information such as the Account URL. In a specific implementation, the Account URL is generated based on the user's unique identifier.

[0067] Subsequently, the management platform binds the user's public key (Account Key) to the EBA KID for identification of subsequent certificate requests.

[0068] S108. The ACME client responds to the user's request and processes the ACME request based on the newly created account information.

[0069] Specifically, after completing the client's account registration through the aforementioned steps and obtaining the newly created account information, the client can submit certificate applications, certificate renewals, and other request operations based on the newly created account information that has been registered.

[0070] The embodiment of the present invention provides a management method for ACME services for public clouds, which can verify security through account information before using the ACME service to execute a specific ACME request, thereby improving the security management effect of the management method for ACME services for public clouds, and further enhancing the multi-tenant security management effect of the cloud platform.

[0071] Please see Figure 2-5 The second embodiment of the management method of ACME service for public cloud in the embodiment of the present invention includes the following contents:

[0072] See also Figure 2Before the ACME client initiates a new account request to the management platform based on the user's request, the user needs to create an EAB account first.

[0073] Specifically, the user first issues an EAB creation request and sends the EAB request to the cloud platform. Based on the request issued by the user, the cloud platform sends an EAB account creation request to the management platform with a unique user identifier. In this embodiment, the unique user identifier can be the end user identifier (End User ID) of the user who issued the EAB creation request.

[0074] In a specific implementation, when the cloud platform sends an EAB account creation request to the management platform, it also carries the creation user mailbox provided by the user when creating the EAB request.

[0075] Subsequently, the management platform responds to the account creation request of the cloud platform and initiates a new EAB account request to the CA platform; the CA platform generates the user's EAB account information in response to the new EAB account request, wherein the EAB account information includes EABKID and EAB MAC Key; the management platform binds the EAB KID to the unique user identifier; in this way, the specific tenant of the cloud platform can be identified to prevent information confusion between tenants. At the same time, the created user mailbox is saved and the EAB account information is returned to the cloud platform, which then provides the EAB account information to the user.

[0076] S201. ACME client initiates a new account request to the management platform based on the user's request.

[0077] Please continue reading Figure 3 To process various transactions and requests through the ACME client, they need to be processed based on the account information of the ACME client. Therefore, users need to apply for a new account based on the ACME client.

[0078] Specifically, the user uses the ACME client to initiate a new account request to the management platform, wherein the new account request carries the requesting user's email address, EAB KID, and account public key (Account Key);

[0079] S202, the management platform checks whether the EAB KID exists, and if so, determines whether the EAB KID is bound to a unique user identifier;

[0080] S203. If not bound, an error is returned;

[0081] S204, if bound, continue;

[0082] In this embodiment, after receiving a new account request, the management platform first monitors whether there is an EAB KID in the new account request. If so, it continues to determine whether the current EAB KID is bound to a unique user. If not, an error prompt is returned and an alarm notification is sent to the user's mailbox, and the alarm notification is sent to the cloud platform through a callback; wherein the alarm notification also includes a link for quickly banning the client. Based on the user's operation, the issuing client is banned according to the link for quickly banning the client; if the unique user ID has been bound, it continues. In this embodiment, the use of the end user ID as the unique user ID can securely isolate multiple tenants of the cloud platform, thereby enhancing the security of the cloud platform.

[0083] In this embodiment, when creating an account, the management platform will also detect abnormal behavior of the client, and the abnormal behavior detection includes abnormal registration, fraudulent registration, etc. In a specific implementation, when the management platform receives a request to create a new account, it will first monitor whether the current request is the first registration; if it is the first registration, before the management platform forwards the new account request to the CA platform, it will send a registration notification to the mailbox of the creating user, where the registration notification includes user agent information, client IP address and client version information; after sending the registration notification to the mailbox of the creating user, if the user confirms that this registration operation is an authorized operation, it can continue.

[0084] When creating an account, it also includes the detection of abnormal behavior of the client. If abnormal behavior occurs, an alarm notification is sent to the email address of the creating user, and the alarm notification is sent to the cloud platform through a callback. In a specific implementation, if it is monitored that the current request is not the first registration, the client location information reserved during registration is obtained; the IP address of the client that currently issues the request is obtained, and the IP location of the client that issues the request is detected based on the IP address to see if it is consistent with the client location at the time of registration; if they are inconsistent, it is judged as an abnormality, and an alarm notification is sent to the user's email address, and the alarm notification is sent to the cloud platform through a callback; if they are consistent, it can continue. Among them, when judging whether the location of the IP address is consistent, it is judged based on the geographical location range of the IP address. If the IP address of the client that currently issues the request and the location range of the client location at the time of registration belong to the same area, they are considered to be consistent.

[0085] In a specific implementation, it also includes checking whether the requesting user email and the pre-saved created user email (User Email) are the same email; if they are not the same email, an error prompt is returned, and an alarm notification is sent to the pre-saved created user email (User Email), and the alarm notification is sent to the cloud platform through a callback; similarly, the alarm notification also includes a link for quickly banning the client, and based on the user's operation, the issuing client is banned according to the link for quickly banning the client.

[0086] S205, the management platform forwards the new account creation request to the CA platform;

[0087] S206. After receiving the new account request, the CA platform generates new account information, binds the EAB KID, the account public key and the unique user ID, and returns the new account information to the ACME client.

[0088] After confirming that the new account request is correct through the above steps, the management platform forwards the new account request to the CA platform. The CA platform generates new account information based on the request, wherein the new account information may be the URL (Uniform Resource Locator) of the account; the CA platform returns the new account information to the management platform.

[0089] After receiving the newly created account information, the management platform binds the newly created account information with the EAB KID, the account public key, and the unique user identifier, and returns the bound newly created account information to the ACME client for storage, which can be used to identify subsequent certificate requests.

[0090] S207. The ACME client responds to the user's request and processes the ACME request based on the newly created account information.

[0091] After obtaining the newly created account information and the bound user information, when the user needs to process a transaction through ACME request, the management platform can process it based on the newly created account information.

[0092] See also Figure 4In a specific implementation, the ACME request may be a request for applying for a certificate. Specifically, the ACME client, in response to the certificate application request issued by the user, submits a new order request (New Order) for applying for a certificate to the management platform, wherein the new order request carries the user's account public key and domains. After receiving the new order request, the management platform will detect the abnormality of the client. If there is an abnormality, an error notification will be sent through the user's creation user mailbox. If an error is currently confirmed, it will be blocked and the abnormal information will be called back to the cloud platform. If there is no abnormality, the new order request will be sent to the CA platform for processing. After the CA platform completes the processing, it will send the processing result to the management platform. The management platform will call back the order-related information to the cloud platform for processing; the cloud platform returns the URL of the order to the ACME client. In this step, if there are other standard ACME requests, they can be processed accordingly according to the above process, which will not be repeated here.

[0093] Please continue reading Figure 5 In a specific implementation, the management method ARI (Automatic Revocation Initiation) timed polling management of the ACME service for the public cloud includes a management platform accepting an ARI request periodically sent by the ACME client to the management platform; the management platform detects and predicts risks for the received ARI request, and takes an example of distance to illustrate. After the management platform accepts the ARI request periodically sent by the ACME client to the management platform, it determines whether the current time is longer than the preset waiting time from the last ARI request sent by the client; if so, an alarm notification is sent to the user's mailbox, and the alarm notification is sent to the cloud platform through a callback.

[0094] To illustrate with a specific example, using the feature of ACME client supporting ARI, the management platform predicts whether there is a risk from the client request frequency. When the client makes the first request, the platform returns a retry interval of 3600 seconds, which means that the client will initiate an ARI request every 3600 seconds. If the client does not initiate an ARI request for more than 10800 seconds, the client may be abnormal. The platform will warn the user by creating a user email. The warning information includes the client registration IP, client UserAgent, and the client's last reporting time; allowing customers to check the client in advance to prevent renewal problems from causing business risks.

[0095] According to the CAB (CA / Browser Forum) standard, when the CA platform finds that the certificate is non-compliant, the non-compliant certificate will be revoked within 24 hours at the earliest. If this happens, the management platform can use the suggested Window in ARI to let the client immediately initiate renewal to avoid business risks. When the management platform receives the emergency revocation request for the certificate sent by the CA platform, the management platform uses the time of the current emergency revocation of the certificate as the next renewal time; the ACME client can receive the renewal time and initiate a new renewal-related application to the management platform. To illustrate with a specific example, when the management platform receives the revocation notice from the CA platform, for example, the CA platform wants to revoke the certificate with serial number SN1 within 24 hours, when the ACME client initiates the ARI request for the SN1 certificate next time, the suggested Window returned by the platform will start the day before the current time and end the current time. According to the characteristics of ARI, after receiving the return, the ACME client will immediately initiate a renewal request, thereby replacing the certificate to be revoked through renewal to avoid the risk of revocation. At the same time, the platform will also send the revocation information to the email address of the creating user, thereby warning the customer in advance.

[0096] The embodiment of the present invention provides a management method for ACME services for public clouds, which can verify security before using ACME services to execute specific ACME requests and in various situations when executing requests, can reduce the risk of EAB Token leakage, improve the certificate renewal success rate and reduce the occurrence of renewal failure problems, as well as the risk of certificate non-compliance revocation, etc., can improve the security management effect of the management method for ACME services for public clouds, and thus enhance the multi-tenant security management effect of the cloud platform.

[0097] The above describes the management method of the ACME service for the public cloud in the embodiment of the present invention. The following describes the management device of the ACME service for the public cloud in the embodiment of the present invention. Figure 6 An embodiment of a management device for ACME services in a public cloud in an embodiment of the present invention includes:

[0098] ACME client 601 is used to initiate a new account request to the management platform based on a user's request, wherein the new account request includes a requesting user's email address, EAB KID and account public key; and, in response to the user's request, process the ACME request based on the new account information;

[0099] The management platform 602 is used to check whether the EAB KID exists and determine whether the EAB KID is bound to a unique user identifier; if not, return an error; if bound, continue; and forward the new account request to the CA platform;

[0100] CA platform 603, used to generate new account information after receiving a new account request;

[0101] The management platform 602 is also used to bind the newly created account information with the EAB KID, the account public key and the unique user identifier, and return the newly created account information to the ACME client.

[0102] The embodiment of the present invention provides a management method for ACME services for public clouds, which can verify security through account information before using the ACME service to execute a specific ACME request, thereby improving the security management effect of the management method for ACME services for public clouds, and further enhancing the multi-tenant security management effect of the cloud platform.

[0103] In another embodiment of the present application, the management device for ACME service of public cloud further includes a cloud platform, and the cloud platform is used to send an EAB account creation request to the management platform based on a request sent by a user, wherein the EAB account creation request carries a unique user identifier of the user on the cloud platform and a mailbox of the created user;

[0104] The management platform 602 is also used to respond to the account creation request of the cloud platform and initiate a new EAB account request to the CA platform;

[0105] The CA platform 603 is further configured to generate the user's EAB account information in response to the new EAB account request, wherein the EAB account information includes the EAB KID and the EAB MAC Key;

[0106] The management platform 602 is also used to bind the EAB KID to a unique user identifier, save the created user mailbox, and return the EAB account information to the user.

[0107] In another embodiment of the present application, the management platform 602 is also used to check whether the requesting user mailbox and the pre-saved creating user mailbox are the same mailbox; if they are not the same mailbox, an error prompt is returned, and an alarm notification is sent to the user mailbox, and the alarm notification is sent to the cloud platform through a callback, wherein the alarm notification also includes a link for quickly banning the client, and based on the user's operation, the issuing client is banned according to the link for quickly banning the client.

[0108] In another embodiment of the present application, the management platform 602 is also used to monitor whether it is the first registration; if it is the first registration, a registration notification is sent to the creating user's mailbox. If the user feedbacks that the registration operation corresponding to the registration notification is not an authorized operation, an alarm notification is sent to the user's mailbox, and the alarm notification is sent to the cloud platform through a callback.

[0109] In another embodiment of the present application, the management platform 602 is also used to obtain the client location information at the time of registration if it is not the first registration; obtain the IP address of the client currently making the request, and detect whether the IP location of the client making the request is consistent with the client location at the time of registration based on the IP address; if they are inconsistent, send an alarm notification to the user's email, and send the alarm notification to the cloud platform through a callback.

[0110] In another embodiment of the present application, the management platform 602 is also used to accept the ARI request periodically sent by the ACME client to the management platform; determine whether the current time is longer than the preset waiting time from the last ARI request sent by the client; if so, send an alarm notification to the user's mailbox, and send the alarm notification to the cloud platform through a callback.

[0111] The specific details of the management device for ACME services for public clouds described in this embodiment can be found in the aforementioned embodiment of the management method for ACME services for public clouds, which will not be described in detail here.

[0112] An embodiment of the present invention provides a management device for ACME services for public clouds, which can verify security before using ACME services to execute specific ACME requests and in multiple situations when executing requests, can reduce the risk of EAB Token leakage, improve the certificate renewal success rate and reduce the occurrence of renewal failure problems, as well as the risk of certificate non-compliance revocation, etc., can improve the security management effect of the management method for ACME services for public clouds, and thus enhance the multi-tenant security management effect of the cloud platform.

[0113] Based on the same inventive concept, the embodiments of this specification also provide an electronic device for managing ACME services of a public cloud. It is easy for those skilled in the art to understand that the exemplary embodiments described in the present invention can be implemented by software or by combining software with necessary hardware. When the electronic device for managing ACME services of a public cloud is running, the above method of the present invention can be implemented, that is: Figure 1-5 The method shown in .

[0114] Furthermore, the technical solution according to the embodiment of the present invention can be embodied in the form of a software product, which can be stored in a computer-readable storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, or a network device, etc.) to execute the above method according to the present invention. When the computer program is executed by a data processing device, the computer-readable medium can implement the above method of the present invention, that is: Figure 1-5 The method shown in .

[0115] Therefore, achieving Figure 1-5 The computer program of the method shown in can be stored on one or more computer readable media. The computer readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0116] The computer readable storage medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by an instruction execution system, an apparatus, or a device or used in combination with it. The program code contained on the readable storage medium may be transmitted with any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0117] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0118] In summary, the present invention can be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that general data processing devices such as microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components in the embodiments of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., a computer program and a computer program product) for executing part or all of the methods described herein. Such a program implementing the present invention can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0119] In addition, the present invention also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the method of any of the above embodiments of the present invention, namely: Figure 1-5 The method shown in .

[0120] The specific embodiments described above further describe the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the present invention is not inherently related to any specific computer, virtual device or electronic device, and various general devices can also implement the present invention. The above description is only a specific embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

[0121] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0122] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A management method for ACME services in a public cloud, characterized in that: include: Based on the user's request, the ACME client initiates a new account request to the management platform, wherein the new account request includes the requesting user's email address, EAB KID, and account public key; The management platform checks whether the EAB KID exists. If so, it determines whether the EAB KID is bound to a unique user identifier. If not, an error is returned. If so, the process continues. The management platform forwards the new account creation request to the CA platform; After receiving the request to create a new account, the CA platform generates the new account information, binds the new account information with the EAB KID, the account public key, and the unique user ID, and returns the new account information to the ACME client; The ACME client responds to the user's request and processes the ACME request based on the newly created account information.

2. The management method of ACME service for public cloud according to claim 1, characterized in that: Before the ACME client initiates a request to create a new account to the management platform based on the user's request, the process further includes: The cloud platform sends an EAB account creation request to the management platform based on the request sent by the user, wherein the EAB account creation request carries the unique user ID of the user on the cloud platform and the email address of the created user; In response to the account creation request from the cloud platform, the management platform initiates a request to create a new EAB account to the CA platform; The CA platform generates the user's EAB account information in response to the new EAB account request, wherein the EAB account information includes the EAB KID and the EAB MAC Key; The management platform binds the EAB KID to the unique user ID, saves the created user mailbox, and returns the EAB account information to the user.

3. The management method of ACME service for public cloud according to claim 2, characterized in that: Before the management platform forwards the new account request to the CA platform, the method further includes: Check whether the requesting user's mailbox and the pre-saved created user's mailbox are the same mailbox; If they are not the same mailbox, an error prompt is returned, and an alarm notification is sent to the user's mailbox, and the alarm notification is sent to the cloud platform through callback, wherein the alarm notification also includes a link for quickly banning the client. Based on the user's operation, the issuing client is banned according to the link for quickly banning the client.

4. The management method of ACME service for public cloud according to claim 3, characterized in that: Before the detecting that the management platform checks whether the EAB KID exists, the method further includes: Monitor whether it is the first registration; If it is the first registration, before the management platform forwards the new account request to the CA platform, it also includes: A registration notification is sent to the creating user's mailbox. If the user feedbacks that the registration operation corresponding to the registration notification is not an authorized operation, an alarm notification is sent to the user's mailbox, and the alarm notification is sent to the cloud platform through a callback.

5. The management method of ACME service for public cloud according to claim 4, characterized in that: If it is not the first registration, it also includes: Get the client location information during registration; Obtain the IP address of the client currently making the request, and detect whether the IP address of the client making the request is consistent with the client address at the time of registration based on the IP address; If they are inconsistent, an alarm notification is sent to the user's mailbox, and the alarm notification is sent to the cloud platform through callback.

6. The management method of ACME service for public cloud according to claim 5, characterized in that: The management method of the ACME service for a public cloud also includes: The management platform accepts the ARI request periodically sent by the ACME client to the management platform; Determine whether the current time interval from the last ARI request sent by the client exceeds the preset waiting time; If it exceeds, an alarm notification will be sent to the user's mailbox, and the alarm notification will be sent to the cloud platform through callback.

7. A management device for ACME services in a public cloud, characterized in that: The management device for ACME service of public cloud includes: The ACME client is used to initiate a new account request to the management platform based on a user's request, wherein the new account request includes a requesting user's email address, an EAB KID, and an account public key; and, in response to the user's request, process the ACME request based on the new account information; The management platform is used to check whether the EAB KID exists, and if so, determine whether the EAB KID is bound to a unique user identifier; if not, return an error; if so, continue; and forward the new account request to the CA platform; CA platform, used to generate new account information after receiving a new account request; The management platform is also used to bind the newly created account information with the EAB KID, the account public key and the unique user identifier, and return the newly created account information to the ACME client.

8. A management device for ACME services in a public cloud, characterized in that: The management device for ACME service of public cloud includes: a memory and at least one processor, wherein instructions are stored in the memory; The at least one processor calls the instruction in the memory to enable the management device of the ACME service for a public cloud to perform the steps of the management method of the ACME service for a public cloud as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the program / instructions are executed by a processor, the steps of the management method for ACME services for a public cloud as described in any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method for managing ACME services for a public cloud as described in any one of claims 1 to 6 are implemented.

Images