Cloud application access control method and device, equipment, storage medium and program product

Abstract

The invention discloses a cloud application access control method and device, equipment, a storage medium and a program product, and belongs to the technical field of communication security. The method comprises the steps of obtaining an identity authentication request sent by a target cloud application in response to a starting operation of the target cloud application; cloud application authentication information corresponding to the identity authentication request is integrated, the integrated cloud application authentication information is sent to at least one authentication system corresponding to the target cloud application, and a cloud application authentication result returned by the at least one authentication system is acquired; and controlling to access the target cloud application according to the cloud application authentication result. Through the mode, multiple authentication requests among different authentication systems can be reduced, and the authentication efficiency of the cloud application is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication security technology, and in particular, to a cloud application access control method, apparatus, device, storage medium, and program product. Background Art

[0002] With the advancement of Internet technology, the popularization of home fiber optic network access, and the continuous maturity of end-to-cloud technology, more and more cloud applications are being launched in different provinces. However, with the coverage of cloud applications, the demand for certification services in various provinces is also increasing. Since the licensees and certification schemes in each province are different, cloud applications must be adjusted according to the certification schemes provided by different licensees when connecting to certification services.

[0003] In response to the certification needs of these license holders, the existing technical model is that the license holder provides a certification docking interface, and the cloud application directly connects with the license holder's certification system. Whenever a new province goes online, the cloud application needs to be connected according to the certification process of the license holder in that province, and carry out corresponding development, testing and submission for acceptance. However, with the increase in the number of provinces going online, especially in the case of multiple license holders in some provinces, the complexity of certification docking increases, the certification process is cumbersome, and the certification efficiency is low. Summary of the invention

[0004] The embodiments of the present application provide a cloud application access control method, apparatus, device, storage medium and program product to at least solve the problems of cumbersome authentication process and low authentication efficiency during the connection authentication process of existing cloud applications.

[0005] In order to solve the above technical problems, this application is implemented as follows: In a first aspect, an embodiment of the present application provides a cloud application access control method, comprising: in response to a startup operation of a target cloud application, obtaining an identity authentication request sent by the target cloud application; integrating cloud application authentication information corresponding to the identity authentication request, sending the integrated cloud application authentication information to at least one authentication system corresponding to the target cloud application, and obtaining a cloud application authentication result returned by the at least one authentication system; and controlling access to the target cloud application based on the cloud application authentication result.

[0006] In the second aspect, an embodiment of the present application provides a cloud application access control device, comprising: an acquisition module, used to obtain an identity authentication request sent by the target cloud application in response to a startup operation of the target cloud application; an authentication module, used to integrate and process the cloud application authentication information corresponding to the identity authentication request, and send the integrated and processed cloud application authentication information to at least one authentication system corresponding to the target cloud application, and obtain the cloud application authentication result returned by the at least one authentication system; a control module, used to control access to the target cloud application according to the cloud application authentication result.

[0007] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, the steps of the method described in the first aspect above are implemented.

[0008] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the first aspect above are implemented.

[0009] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the steps of the method described in the first aspect above.

[0010] In an embodiment of the present application, in response to the start-up operation of the target cloud application, an identity authentication request sent by the target cloud application is obtained; cloud application authentication information corresponding to the identity authentication request is integrated and processed, and the integrated and processed cloud application authentication information is sent to at least one authentication system corresponding to the target cloud application, and a cloud application authentication result returned by at least one authentication system is obtained; and access to the target cloud application is controlled according to the cloud application authentication result. In this way, by integrating and processing cloud application authentication information, sending the integrated and processed cloud application authentication information to at least one authentication system, and controlling access to the target cloud application according to the returned cloud application authentication result, multiple authentication requests between different authentication systems can be reduced, and the authentication efficiency of cloud applications can be improved. It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0012] Figure 1A schematic diagram of the authentication architecture provided by an embodiment of the present application is shown; Figure 2 A schematic diagram of a process flow of a cloud application access control method provided by an embodiment of the present application is shown; Figure 3 A schematic diagram of instruction interaction of a cloud application access control method provided by an embodiment of the present application is shown; Figure 4 A schematic diagram of a process for obtaining an encryption key provided in an embodiment of the present application is shown; Figure 5 A schematic diagram of the information transmission process provided by an embodiment of the present application is shown; Figure 6 A schematic diagram of the structure of a cloud application access control device provided in an embodiment of the present application is shown; Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0013] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0014] With the increase in the types of cloud applications and the number of provinces where cloud applications are deployed, every time a cloud application is launched in a new province, it is necessary to connect with the license holder's certification process and carry out targeted development, testing, and acceptance procedures according to the license holder's certification plan. However, as more and more provinces launch cloud applications, and some provinces have more than one license holder, the demand for completing certification during the certification process has become diversified, and there are at least the following problems: (1) Increased complexity. Different licensees may have different requirements and implementation methods, which cannot be managed and coordinated in a unified manner, increasing the difficulty of development and maintenance.

[0015] (2) Increased compliance challenges. Different licensees often follow their own unique regulations and standards in terms of data protection and privacy, which leads to huge compliance challenges when cloud applications are connected.

[0016] (3) There are compatibility issues with the docking interface. Different authentication systems often have different API interfaces and protocol standards, which results in a lot of interface adaptation and conversion work during the docking process. This requires developers to be familiar with and understand the interface specifications of each authentication system to ensure the correct transmission and processing of data.

[0017] (4) Security authentication is complex. Each authentication system may have a unique security authentication mechanism, such as certificates, tokens, etc., which increases the difficulty of security management.

[0018] (5) Limited scalability. Connecting to the license holder’s authentication system may limit the scalability of the application. If the interface or functions provided by the license holder’s authentication system are not flexible enough, it may affect the development and expansion of the application.

[0019] (6) The testing workload has increased dramatically. Due to the existence of targeted development, it is necessary to conduct comprehensive testing on the connection between each authentication system and application, including normal processes and various abnormal situations, which significantly increases the testing workload.

[0020] In response to the above-mentioned problems existing in the process of cloud application docking and authentication, an embodiment of the present application provides a cloud application access control method. The method integrates and processes cloud application authentication information, and sends the integrated and processed cloud application authentication information to at least one authentication system, and controls access to the target cloud application based on the returned cloud application authentication result. This can reduce multiple authentication requests between different authentication systems and improve the authentication efficiency of cloud applications.

[0021] Figure 1 A schematic diagram of the authentication architecture provided by an embodiment of the present application is shown. As shown in the figure, a user requests access to a cloud application 130 through a cloud HD client 110, and the cloud application interacts with the cloud HD client 110 through a cloud platform 120. The cloud HD client 110 integrates authentication interfaces of multiple authentication systems 140. When the same cloud application faces different authentication systems, it can connect to multiple authentication systems 140 through the cloud HD client 110 without the need to perform authentication process development multiple times, thereby improving the authentication efficiency of cloud applications and reducing the time and economic costs of development.

[0022] Figure 2 The flowchart of the cloud application access control method provided in the embodiment of the present application is shown. The execution subject of the method can be a terminal device or a server, wherein the terminal device can be a device such as a personal computer, or a mobile terminal device such as a mobile phone, a tablet computer, a cloud HD client, etc. The terminal device can be a terminal device used by a user. The server can be an independent server or a server cluster composed of multiple servers. Moreover, the server can be a background server of a certain business, or a background server of a certain platform or application (for example, a cloud HD application, etc.). In the embodiment of the present application, the execution subject is the above-mentioned Figure 1 The cloud HD client 110 in the example is used for explanation. For the server, it can be processed according to the following related content, which will not be repeated here. As shown in the figure, the cloud application access control method 200 can include the following steps: Step 201: In response to a start-up operation of a target cloud application, an identity authentication request sent by the target cloud application is obtained.

[0023] In a specific implementation, the user starts the target cloud application through the cloud HD client 110. After receiving the cloud application start request initiated by the user, the HD client 110 starts the target cloud application through the cloud platform 120 and obtains the identity authentication request sent by the target cloud application, wherein the identity authentication request may include the cloud application authentication parameters of the target cloud application, such as application name, application ID, user ID, credentials, etc.

[0024] Step 202: Integrate the cloud application authentication information corresponding to the identity authentication request, send the integrated cloud application authentication information to at least one authentication system corresponding to the target cloud application, and obtain the cloud application authentication result returned by the at least one authentication system.

[0025] In a specific implementation, the cloud HD client 110 integrates and processes the cloud application authentication information corresponding to the identity authentication request. The cloud application authentication information includes the authentication information, device information, timestamp, version number, encryption algorithm, etc. of the target cloud application, and then sends the integrated cloud application authentication information to at least one authentication system corresponding to the target cloud application. The corresponding authentication process is executed through at least one authentication system. After the authentication process is completed, the cloud application authentication result is returned.

[0026] Step 203: Control access to the target cloud application based on the cloud application authentication result.

[0027] In a specific implementation, access to a target cloud application is controlled based on the cloud application authentication result. For example, when it is determined that the authentication is passed based on the cloud application authentication result, an indication message is sent to the target cloud application to instruct the target cloud application to execute a business corresponding to the startup operation; when it is determined that the authentication fails based on the cloud application authentication result, an indication message is sent to the target cloud application to instruct the target cloud application to execute exit processing.

[0028] In this way, by integrating and processing cloud application authentication information and sending the integrated and processed cloud application authentication information to at least one authentication system, access to the target cloud application is controlled based on the returned cloud application authentication result, multiple authentication requests between different authentication systems can be reduced, thereby improving the authentication efficiency of cloud applications. In a possible implementation, in step 201, in response to a start-up operation of a target cloud application, obtaining an identity authentication request initiated by the target cloud application includes: In response to a start-up operation of a target cloud application, cloud application identification information of the target cloud application is obtained; the cloud application identification information is sent to a cloud platform, and the target cloud platform indicated by the cloud application identification information is started through the cloud platform to obtain an identity authentication request sent by the target cloud application.

[0029] In the embodiment of the present application, the user clicks on the entrance of the cloud HD client 110 and starts the cloud HD client 110 with the cloud application identification information, wherein the cloud application identification information includes cloud application package name parameters, etc. In response to the start operation of the target cloud application, the cloud HD client 110 obtains the cloud application identification information of the target cloud application, and sends the cloud application identification information to the cloud platform 120 to notify the cloud platform 120 to start the target cloud application. The cloud platform 120 starts the target cloud application indicated by the cloud application identification information in the virtual machine. When the target cloud application starts, the identity authentication request carrying the cloud application authentication parameters is passed to the cloud platform 120 through the ContentProvider. The cloud platform 120 transparently transmits the identity authentication request to the cloud HD client 110 through the end-to-cloud communication technology, thereby obtaining the identity authentication request sent by the target cloud application, and the identity authentication request includes the cloud application authentication parameters of the target cloud application.

[0030] In a possible implementation, in the above step 203, controlling access to the target cloud application according to the cloud application authentication result includes: When it is determined that the identity authentication is successful according to the cloud application authentication result, by sending a first indication message to the target cloud application, cloud application content is generated according to the interface flow corresponding to the start operation returned by the target cloud application; When it is determined that the identity authentication has failed based on the cloud application authentication result, an authentication failure page is displayed, and a second indication message is sent to the target cloud application to cause the target cloud application to execute an exit process; wherein the first indication message is used to indicate that the identity authentication of the target cloud application is successful, and the second indication message is used to indicate that the identity authentication of the target cloud application has failed.

[0031] In an exemplary embodiment, if Figure 3 As shown in , the above cloud application access control method may include the following steps: Step 301: The user clicks on the entrance of the cloud HD client 110 and starts the cloud HD client 110 with the cloud application identification information, wherein the cloud application identification information includes cloud application package name parameters, etc.; Step 302: The cloud HD client notifies the cloud platform 120 to start the target cloud application through the end-cloud communication technology; Step 303: The cloud platform 120 starts the target cloud application indicated by the cloud application identification information in the virtual machine; Step 304: When the target cloud application is started, its cloud application authentication parameters are passed to the cloud platform 120 via ContentProvider; Step 305: The cloud platform 120 transparently transmits the cloud application authentication parameters to the cloud HD client 110 through the end-to-cloud communication technology; Step 306: The cloud HD client 110 integrates the cloud application authentication information and initiates a cloud application authentication request to the authentication system according to the license holder version; Step 307: The authentication system returns the cloud application authentication result to the cloud HD client 110; Step 308: After receiving the cloud application authentication result, the cloud HD client 110 determines whether the authentication is successful or failed; Step 309: If the cloud application authentication fails, the cloud HD client 110 displays an authentication failure page and transparently transmits a second indication message through the end-cloud communication technology, where the second indication message is used to indicate that the identity authentication of the target cloud application has failed; Step 310: the cloud platform 120 notifies the target cloud application of the second indication message through the ContentProvider; Step 311: the target cloud application automatically exits after receiving the second instruction message; Step 312: If the cloud application authentication is successful, the cloud HD client 110 transparently transmits a first indication message through the end-to-cloud communication technology; the first indication message is used to indicate that the identity authentication of the target cloud application is successful; Step 313: the cloud platform 120 notifies the target cloud application of the first indication message through the ContentProvider; Step 314: After receiving the first indication message, the target cloud application normally enters the service corresponding to the startup operation and returns to the interface flow; Step 315: The cloud platform 120 loads the interface flow returned by the target cloud application; Step 316: The cloud platform 120 transmits the interface flow to the cloud HD client 110; Step 317: The cloud HD client 110 displays the cloud application content.

[0032] In a possible implementation, in the above step 202, sending the integrated cloud application authentication information to at least one authentication system corresponding to the target cloud application includes: The integrated cloud application authentication information is encrypted by a preset encryption key to obtain authentication encrypted data; and the authentication encrypted data is sent to the at least one authentication system.

[0033] In the embodiment of the present application, in order to ensure the security of the target cloud application during the authentication process, the cloud HD client 110 encrypts the integrated cloud application authentication information through a preset encryption key to obtain authentication encrypted data; and sends the authentication encrypted data to at least one authentication system.

[0034] Wherein, before encrypting the integrated cloud application authentication information by using a preset encryption key to obtain the authentication encrypted data, it also includes: Establish a communication link with at least one authentication system corresponding to the target cloud application; send the identity information corresponding to the identity authentication request to the at least one authentication system through the communication link; when it is determined that the identity information verification is successful, send the service authorization certificate corresponding to the identity information to obtain the encryption key of the at least one authentication system.

[0035] In the embodiment of the present application, during the cloud application authentication process between the cloud HD client 110 and the authentication system, a communication link is established between the cloud HD client 110 and at least one authentication system corresponding to the target cloud application; an encryption key of at least one authentication system is obtained through the communication link, wherein, Figure 4 As shown, the method for obtaining the encryption key includes the following steps: Step 401: After receiving the identity authentication request sent by the target cloud application, the cloud HD client 110 establishes a communication link with at least one authentication system corresponding to the target cloud application. Specifically, the cloud HD client 110 sends a network connection establishment request to the authentication system, and responds to the communication channel establishment success message returned by the authentication system to establish a communication link between the two. Step 402: Through the communication link, the cloud HD client 110 sends the identity information corresponding to the identity authentication request to the authentication system; Step 403: The authentication system verifies the identity information; Step 404: If the identity information verification is successful, the service authorization certificate corresponding to the identity information is sent; Step 405: The authentication system verifies the validity of the service authorization certificate, transmits the cloud application verification result back, and obtains the encryption key of the authentication system.

[0036] Furthermore, after the authorization is completed, the preset encryption key between the cloud HD client and the authentication system is used to establish an encrypted secure communication channel, and subsequent data transmission and interaction are carried out on the secure communication channel.

[0037] The above-mentioned encryption key acquisition method includes: Obtain an initial key sent by the at least one authentication system; send an encryption request to the at least one authentication system, and obtain an encrypted encryption key returned by the at least one authentication system; decrypt the encrypted encryption key using the initial key to obtain the encryption key.

[0038] In the present application embodiment, Figure 5 As shown, the method for obtaining the encryption key includes the following steps: Step 501: When the cloud HD client and the authentication system initially establish a communication connection, they exchange necessary authentication parameters and information and agree on an initial key; Step 502: The cloud HD client sends an encryption request to the authentication system using a communication protocol. The encryption request includes a message encrypted using an initial key, and the message is used to represent the application for an encryption key. Step 503: After receiving the encryption request, the authentication system uses the initial key to decrypt the message, verifies the validity of the encryption request, generates an encryption key, encrypts the encryption key using the initial key, and then sends the encrypted encryption key to the cloud HD client; Step 504: The cloud HD client uses the initial key to decrypt the encrypted encryption key to obtain the encryption key.

[0039] Furthermore, the cloud HD client and the authentication system both have the same encryption key, so that the data communication link is established, and subsequent data interactions will also be encrypted and decrypted using the same communication key.

[0040] Optionally, during secure communication between Cloud HD and the authentication system, a two-stage key negotiation method is constructed for the authentication of both parties, thereby effectively avoiding man-in-the-middle attacks, that is, avoiding the defects of malicious man-in-the-middle attacks through key negotiation and key verification. In the key negotiation phase, the steps of the key exchange protocol based on elliptic curve cryptography (EllipticCurve Diffie-Hellman, ECDH) are executed, and a shared key is negotiated by exchanging public keys. In the key verification phase, both parties perform mutual verification to ensure that there is no man-in-the-middle attack.

[0041] Specifically, first share a short secret key H, and obtain the collective identity authentication secret key H through methods such as device writing and OTA download. Then, two inverse values ​​z and -z are derived from the secret key H. In the key negotiation phase, Cloud HD randomly selects a private key Ry, and then calculates the corresponding public key Py based on the selected private key, that is, Py=(Ry+z)G, and sends it to the authentication system; then, the authentication system also selects a private key Rr, calculates the corresponding public key Pr and sends it to the Cloud HD client, where Pr=(Rr+z)G. After receiving the public keys sent by each other, calculate X, that is, X=Pr+(-t)G=RrG, and then calculate the corresponding session key Kyr through the obtained X. The same steps are used to obtain the session key Kry, where Kyr=RyX=RyRrG, Kry=RrX=RrRyG. In the key authentication phase, Cloud HD and the authentication system calculate the corresponding intermediate values ​​Ty and Tr, and send the obtained intermediate values ​​to each other for verification. By comparing whether the intermediate values ​​are equal, the authenticity of the identity is determined. Among them, Ty=zKyr=rRyRrG, Tr=zKry=tRrRy. After both parties complete the identity authentication, it means that both parties have obtained the same session key. At this time, if a malicious attacker eavesdrops on the public key, but because there is no corresponding identity password S, it is impossible to obtain the corresponding t value, and then cannot pretend to be a cloud HD client or a party in the authentication system to cause damage, thereby ensuring data security. In the above data processing process, G is a public parameter, which represents a base point with an order of a large prime number n, which is a point on the public elliptic curve.

[0042] In a further embodiment, in order to improve the security during data transmission, compared with the inherent encryption methods in the prior art, the embodiment of the present application adopts a dynamic encryption method for encryption during data transmission. In the stage facing data encryption needs, data encryption is achieved by randomly calling encryption methods, thereby avoiding malicious speculation and tampering of data during transmission by others, and effectively ensuring the security of data transmission.

[0043] Specifically, different encryption methods are integrated in the cloud HD client through the program encapsulation mode, and the function programs are named and ranked through the encryption + numerical ranking method. At the stage where data encryption needs to be performed, when calling the encryption function module, the random generation function is first called to generate a random number, and then the corresponding encryption module is called according to the random value to implement the encryption of the data to be transmitted. In a further embodiment, in order to ensure the security interaction requirements between the cloud HD client and the authentication system, a preset update time period can be set, and both parties regularly update and maintain their digital certificates and keys after a period of time.

[0044] Figure 6The structure diagram of the cloud application access control device provided in the embodiment of the present application is shown. The cloud application access control device can implement the following Figure 2 All or part of the contents of the illustrated embodiment, the cloud application access control device 600 includes: The acquisition module 610 is used to obtain the identity authentication request sent by the target cloud application in response to the startup operation of the target cloud application; The authentication module 620 is used to integrate the cloud application authentication information corresponding to the identity authentication request, send the integrated cloud application authentication information to at least one authentication system corresponding to the target cloud application, and obtain the cloud application authentication result returned by the at least one authentication system; The control module 630 is used to control access to the target cloud application according to the cloud application authentication result.

[0045] In a possible implementation, the acquisition module 610, when used to obtain the identity authentication request sent by the target cloud application in response to the startup operation of the target cloud application, is specifically used to: In response to a start-up operation of a target cloud application, cloud application identification information of the target cloud application is obtained; The cloud application identification information is sent to the cloud platform, and the target cloud platform indicated by the cloud application identification information is started through the cloud platform to obtain the identity authentication request sent by the target cloud application.

[0046] In a possible implementation, the authentication module 620, when used to send the integrated cloud application authentication information to at least one authentication system corresponding to the target cloud application, is specifically used to: The integrated cloud application authentication information is encrypted using a preset encryption key to obtain authentication encrypted data; The authentication encrypted data is sent to the at least one authentication system.

[0047] In a possible implementation, the authentication module 620 is further configured to: Establishing a communication link with at least one authentication system corresponding to the target cloud application; sending the identity information corresponding to the identity authentication request to the at least one authentication system via the communication link; When it is determined that the identity information verification is passed, a service authorization certificate corresponding to the identity information is sent, and an encryption key of the at least one authentication system is obtained.

[0048] In a possible implementation, the authentication module 620 is configured to obtain the encryption key in the following manner: Obtaining an initial key sent by the at least one authentication system; Sending an encryption request to the at least one authentication system, and obtaining an encrypted encryption key returned by the at least one authentication system; The encrypted encryption key is decrypted using the initial key to obtain the encryption key.

[0049] In a possible implementation, the control module 630, when used to control access to the target cloud application according to the cloud application authentication result, is specifically used to: When it is determined that the identity authentication is successful according to the cloud application authentication result, by sending a first indication message to the target cloud application, cloud application content is generated according to the interface flow corresponding to the start operation returned by the target cloud application; When it is determined that the identity authentication has failed based on the cloud application authentication result, an authentication failure page is displayed, and a second indication message is sent to the target cloud application to cause the target cloud application to execute an exit process; wherein the first indication message is used to indicate that the identity authentication of the target cloud application is successful, and the second indication message is used to indicate that the identity authentication of the target cloud application has failed.

[0050] The embodiment of the present application provides a cloud application access control device, including an acquisition module, an authentication module and a control module; the acquisition module responds to the startup operation of the target cloud application to acquire the identity authentication request sent by the target cloud application; the authentication module integrates and processes the cloud application authentication information corresponding to the identity authentication request, sends the integrated cloud application authentication information to at least one authentication system corresponding to the target cloud application, and acquires the cloud application authentication result returned by the at least one authentication system; the control module controls access to the target cloud application according to the cloud application authentication result. In this way, by integrating and processing the cloud application authentication information, sending the integrated cloud application authentication information to at least one authentication system, and controlling access to the target cloud application according to the returned cloud application authentication result, multiple authentication requests between different authentication systems can be reduced, and the authentication efficiency of cloud applications can be improved.

[0051] Figure 7 The hardware structure diagram of the electronic device provided by the embodiment of the present application is shown. Referring to the figure, at the hardware level, the electronic device 700 includes a processor 710, and optionally, includes an internal bus 720, a network interface 730, and a memory 740. Among them, the memory 740 may include a memory 741, such as a high-speed random access memory (Random-Access Memory, RAM), and may also include a non-volatile memory 742 (non-volatile memory), such as at least one disk storage, etc. Of course, the electronic device 700 may also include hardware required for other services.

[0052] The processor 710, the network interface 730 and the memory may be interconnected via an internal bus 720, which may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one bidirectional arrow is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0053] The memory 740 stores programs. Specifically, the programs may include program codes, and the program codes include computer operation instructions. The memory 740 may include a memory 741 and a non-volatile memory 742 , and provide instructions and data to the processor 710 .

[0054] The processor 710 reads the corresponding computer program from the non-volatile memory 742 into the memory and then runs it, forming a device for locating the target user at the logical level. The processor 710 executes the program stored in the memory and specifically performs: Figure 2 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0055] The above application Figure 2The method disclosed in the illustrated embodiment can be applied to the processor 710 or implemented by the processor 710. The processor 710 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 710. The above processor 710 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0056] The computer device can also execute the methods described in the foregoing method embodiments, and realize the functions and beneficial effects of the methods described in the foregoing method embodiments, which will not be repeated here.

[0057] Of course, in addition to software implementation, the electronic device 700 of the present application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0058] The embodiment of the present application also provides a computer-readable storage medium, wherein the computer-readable medium stores one or more programs, and when the one or more programs are executed by an electronic device including multiple application programs, the electronic device executes Figure 2 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0059] The computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0060] Furthermore, an embodiment of the present application also provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, and when the program instructions are executed by a computer, the following process is implemented: Figure 2 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0061] The embodiments of the present application can be applied to various electronic device collaboration or interconnection scenarios, including: collaboration and interconnection between mobile phones and laptops / tablet computers; collaboration and interconnection between mobile terminals and smart TVs / displays; collaboration and interconnection between mobile phones or tablet computers and in-car entertainment systems; collaboration and interconnection between mobile terminals and smart conference systems, etc., so as to meet the needs of users in various scenarios such as smart homes, smart offices, and smart travel.

[0062] In short, the above is only a preferred embodiment of the present application and does not limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0063] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0064] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0065] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0066] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Claims

1. A cloud application access control method, characterized in that: include: In response to a start-up operation of a target cloud application, obtaining an identity authentication request sent by the target cloud application; Integrate the cloud application authentication information corresponding to the identity authentication request, send the integrated cloud application authentication information to at least one authentication system corresponding to the target cloud application, and obtain the cloud application authentication result returned by the at least one authentication system; Access to the target cloud application is controlled according to the cloud application authentication result.

2. The method according to claim 1, characterized in that The step of obtaining, in response to a start-up operation of a target cloud application, an identity authentication request initiated by the target cloud application includes: In response to a start-up operation of a target cloud application, obtaining cloud application identification information of the target cloud application; The cloud application identification information is sent to the cloud platform, and the target cloud platform indicated by the cloud application identification information is started through the cloud platform to obtain the identity authentication request sent by the target cloud application.

3. The method according to claim 1, characterized in that The step of sending the integrated cloud application authentication information to at least one authentication system corresponding to the target cloud application includes: The integrated cloud application authentication information is encrypted using a preset encryption key to obtain authentication encrypted data; The authentication encrypted data is sent to the at least one authentication system.

4. The method according to claim 3, characterized in that: Before encrypting the integrated cloud application authentication information by using a preset encryption key to obtain the authentication encrypted data, the method further includes: Establishing a communication link with at least one authentication system corresponding to the target cloud application; sending the identity information corresponding to the identity authentication request to the at least one authentication system via the communication link; When it is determined that the identity information verification is passed, a service authorization certificate corresponding to the identity information is sent, and an encryption key of the at least one authentication system is obtained.

5. The method according to claim 3, characterized in that: The method for obtaining the encryption key includes: Obtaining an initial key sent by the at least one authentication system; Sending an encryption request to the at least one authentication system, and obtaining an encrypted encryption key returned by the at least one authentication system; The encrypted encryption key is decrypted using the initial key to obtain the encryption key.

6. The method according to claim 1, characterized in that The controlling access to the target cloud application according to the cloud application authentication result includes: When it is determined that the identity authentication is successful according to the cloud application authentication result, by sending a first indication message to the target cloud application, cloud application content is generated according to the interface flow corresponding to the start operation returned by the target cloud application; When it is determined that the identity authentication has failed based on the cloud application authentication result, an authentication failure page is displayed, and a second indication message is sent to the target cloud application to cause the target cloud application to execute an exit process; wherein the first indication message is used to indicate that the identity authentication of the target cloud application is successful, and the second indication message is used to indicate that the identity authentication of the target cloud application has failed.

7. A cloud application access control device, characterized in that: include: An acquisition module, configured to acquire, in response to a startup operation of a target cloud application, an identity authentication request sent by the target cloud application; An authentication module, configured to integrate and process the cloud application authentication information corresponding to the identity authentication request, send the integrated and processed cloud application authentication information to at least one authentication system corresponding to the target cloud application, and obtain the cloud application authentication result returned by the at least one authentication system; A control module is used to control access to the target cloud application according to the cloud application authentication result.

8. An electronic device, characterized in that: The electronic device comprises a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises a program or instructions, and when the program or instructions are executed, the steps of the method according to any one of claims 1 to 6 are implemented.

Images