Multi-platform login method and device, equipment, storage medium and program product

Abstract

The invention relates to a multi-platform login method and device, equipment, a storage medium and a program product. The method is applied to a multi-platform login system, and comprises the following steps: in response to a login operation triggered by a user on a login interface of the multi-platform login system, displaying candidate platform pages; in response to a selection operation of a user on a target login identifier in the plurality of login identifiers, establishing a communication connection with a target cloud platform corresponding to the target login identifier, and obtaining and displaying a target login page from the target cloud platform; the candidate platform page comprises login identifiers of a plurality of different types of cloud platforms. According to the method, multi-platform login can be realized through two responses, so that the convenience and high efficiency of multi-cloud platform login are greatly improved.

Description

Technical Field

[0001] The present application relates to the technical field of cloud computing platforms, and in particular to a multi-platform login method, device, equipment, storage medium and program product. Background Art

[0002] In recent years, with the rapid expansion of the cloud computing industry market, cloud computing companies have sprung up like mushrooms after a rain. Domestic large-scale cloud computing platforms alone have developed no less than 10 cloud platforms, including Alibaba Cloud, Tencent Cloud, Huawei Cloud, Baidu Cloud, and Telecom Cloud. They provide a series of hardware, software, and network facilities to support the deployment, management, and operation of applications, as well as the storage, processing, and transmission of data.

[0003] Each cloud computing platform has its own distinct advantages in the computing, storage, network, monitoring and other services it provides. Currently, when a user needs to log in to multiple cloud computing platforms to handle business, he or she needs to register an account on each cloud platform separately in order to log in to each cloud computing platform.

[0004] However, the login methods of the above-mentioned multiple cloud computing platforms have the problem of poor login flexibility. Summary of the invention

[0005] Based on this, it is necessary to provide a multi-platform login method, device, equipment, storage medium and program product that can improve the login flexibility of each cloud computing platform in response to the above technical problems.

[0006] In a first aspect, the present application provides a multi-platform login method, comprising:

[0007] In response to a login operation triggered by a user on a login interface of the multi-platform login system, a candidate platform page is displayed; the candidate platform page includes login identifiers of multiple different types of cloud platforms;

[0008] In response to a user's selection operation of a target login identifier among multiple login identifiers, a communication connection is established with a target cloud platform corresponding to the target login identifier, and a target login page is obtained and displayed from the target cloud platform.

[0009] In one embodiment, the candidate platform pages include first-category candidate platform pages and second-category candidate platform pages, and the method further includes:

[0010] Display the login information input area;

[0011] In response to the user's input operation in the login information input area, the user's identity type is determined based on the login information corresponding to the input operation. If the identity type is an administrator identity type, the first category candidate platform page is displayed; if the identity type is an ordinary user identity type, the second category candidate platform page is displayed; the cloud platform type included in the first category candidate platform page is different from the cloud platform type included in the second category candidate platform page.

[0012] In one embodiment, determining the user's identity type according to the login information corresponding to the input operation includes:

[0013] Determine whether the login information is consistent with the administrator's login information based on the login information corresponding to the input operation;

[0014] If the login information is consistent with the administrator login information, the user's identity type is determined to be an administrator;

[0015] If the login information is inconsistent with the administrator's login information, the legitimacy of the user's identity is verified based on the login information, and the user's identity type is determined based on the verification result.

[0016] In one embodiment, determining the identity type of the user according to the verification result includes:

[0017] If the verification result indicates that the user is a legitimate user, the user's identity type is determined to be a common identity;

[0018] If the verification result identifies the user as an illegal user, the user's identity type is determined to be an illegal user, and the user information is added to a blacklist.

[0019] In one embodiment, the method further comprises:

[0020] In response to the user's input operation on the target login page, sending a login request to the target cloud platform, and receiving an application page returned by the target cloud platform based on the login request;

[0021] Determine the user's identity type;

[0022] If the identity type is an administrator identity type and is at the super administrator level, the processing authority for the first object is released; the first object includes any one of a resource, a user, and an organization;

[0023] If the identity type is an administrator identity type and belongs to the organization administrator level, the processing authority for the second object is released; the second object includes all users or resources under the organization;

[0024] If the identity type is an administrator identity type and belongs to the member administrator level, the processing authority for the third object is released; the third object includes the resources under the user.

[0025] In one embodiment, the login information input area includes a login name input area and a login password input area, and the response to the user's input operation in the login information input area includes:

[0026] When receiving the login name input by the user in the login name input area, responding to the login name input operation of the user in the login name input area;

[0027] When receiving the login password input by the user in the login password input area, respond to the login password input operation of the user in the login password input area.

[0028] In a second aspect, the present application also provides a multi-platform login device, which is applied to a multi-platform login system, including:

[0029] A first response module is used to respond to a login operation triggered by a user on a login interface of the multi-platform login system and display a candidate platform page; the candidate platform page includes login identifiers of multiple different types of cloud platforms;

[0030] The second response module is used to respond to the user's selection operation of a target login identifier among multiple login identifiers, establish a communication connection with a target cloud platform corresponding to the target login identifier, and obtain and display a target login page from the target cloud platform.

[0031] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0032] In response to a login operation triggered by a user on a login interface of the multi-platform login system, a candidate platform page is displayed; the candidate platform page includes login identifiers of multiple different types of cloud platforms;

[0033] In response to a user's selection operation of a target login identifier among multiple login identifiers, a communication connection is established with a target cloud platform corresponding to the target login identifier, and a target login page is obtained and displayed from the target cloud platform.

[0034] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0035] In response to a login operation triggered by a user on a login interface of the multi-platform login system, a candidate platform page is displayed; the candidate platform page includes login identifiers of multiple different types of cloud platforms;

[0036] In response to a user's selection operation of a target login identifier among multiple login identifiers, a communication connection is established with a target cloud platform corresponding to the target login identifier, and a target login page is obtained and displayed from the target cloud platform.

[0037] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0038] In response to a login operation triggered by a user on a login interface of the multi-platform login system, a candidate platform page is displayed; the candidate platform page includes login identifiers of multiple different types of cloud platforms;

[0039] In response to a user's selection operation of a target login identifier among multiple login identifiers, a communication connection is established with a target cloud platform corresponding to the target login identifier, and a target login page is obtained and displayed from the target cloud platform.

[0040] The above-mentioned multi-platform login method, device, equipment, storage medium and program product are applied to a multi-platform login system, and in response to a login operation triggered by a user on the login interface of the multi-platform login system, a candidate platform page is displayed; in response to a user's selection operation of a target login identifier among multiple login identifiers, a communication connection is established with a target cloud platform corresponding to the target login identifier, and a target login page is obtained and displayed from the target cloud platform; the candidate platform page includes login identifiers of multiple different types of cloud platforms. The above-mentioned method provides a method for realizing multi-platform login through a multi-platform login system, and multi-platform login can be realized through two responses. Compared with the existing login method that requires registering an account on each platform and logging in on each platform separately when logging in to multiple platforms, the above-mentioned method is applied to a multi-platform login system, and the user only needs to log in to the multi-platform login system and trigger the identifiers corresponding to multiple cloud platforms on the multi-platform login system interface to realize multi-platform login, which greatly improves the convenience and efficiency of multi-cloud platform login. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 An application environment diagram of a multi-platform login method in an embodiment;

[0043] Figure 2 A schematic diagram of a multi-platform login method in one embodiment;

[0044] Figure 3 A schematic diagram of a flow chart of a multi-platform login method in another embodiment;

[0045] Figure 4 A schematic diagram of a flow chart of a multi-platform login method in another embodiment;

[0046] Figure 5 A schematic diagram of a flow chart of a multi-platform login method in another embodiment;

[0047] Figure 6 A schematic diagram of a flow chart of a multi-platform login method in another embodiment;

[0048] Figure 7 A schematic diagram of a flow chart of a multi-platform login method in another embodiment;

[0049] Figure 8 A schematic diagram of a flow chart of a multi-platform login method in another embodiment;

[0050] Fig. 9 A model diagram for implementing multi-platform login in combination with OIDC authentication in an embodiment;

[0051] Fig.10 This is a diagram of an identity authority management model in an embodiment;

[0052] Fig.11 A flowchart of implementing multi-service login in combination with OIDC authentication in one embodiment;

[0053] Fig.12 It is a flowchart of identity authority management in one embodiment;

[0054] Fig.13 It is a structural block diagram of a multi-platform login device in one embodiment;

[0055] Fig.14 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0057] In recent years, with the rapid expansion of the cloud computing industry market, cloud computing companies have sprung up like mushrooms after a rain. Domestic large-scale cloud computing platforms alone have developed no less than 10 cloud platforms, including Alibaba Cloud, Tencent Cloud, Huawei Cloud, Baidu Cloud, and Telecom Cloud. They provide a series of hardware, software, and network facilities to support the deployment, management, and operation of applications, as well as the storage, processing, and transmission of data.

[0058] Each cloud computing platform has its own distinct advantages in the computing, storage, network, monitoring and other services it provides. Currently, when a user needs to log in to multiple cloud computing platforms to handle business, he needs to register accounts on each cloud platform to log in to each cloud computing platform. However, the login methods of the above multiple cloud computing platforms have the problem of poor login flexibility. This application aims to solve this problem.

[0059] After introducing the background technology of the multi-platform login method provided by the embodiment of the present application, the implementation environment involved in the multi-platform login method provided by the embodiment of the present application will be briefly described below. The multi-platform login method provided by the embodiment of the present application can be applied to Figure 1 The multi-platform login system 01 shown. The multi-platform login system 01 includes a login interface 10, a candidate platform interface 20, and a login information input area 30. The candidate platform page 20 includes multiple login identifiers 200 of different types of cloud platforms. The candidate platform page 20 includes a first candidate platform page 201 and a second candidate platform page 202, and the cloud platform type included in the first candidate platform page 201 is different from the cloud platform type included in the second candidate platform page 202. When logging in to different cloud computing platforms through the multi-platform login system 01, you can first log in to the multi-platform login system 01, and then the multi-platform login system 01 will display multiple login identifiers of different types of cloud platforms. The user only needs to trigger one of the login identifiers of multiple different types of cloud platforms to log in to the cloud platform corresponding to the identifier on the multi-platform login system.

[0060] Those skilled in the art will understand that Figure 1 The structure shown in the figure is only a block diagram of a part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific terminal may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0061] After introducing the application scenarios of the multi-platform login method provided by the embodiments of the present application, the following focuses on introducing the multi-platform login method described in the present application.

[0062] In one embodiment, Figure 2 As shown, a multi-platform login method is provided, which is applied to Figure 1 The computer device in the example is used to illustrate, including the following steps:

[0063] S201. In response to a login operation triggered by a user on a login interface of a multi-platform login system, a candidate platform page is displayed.

[0064] The candidate platform page includes login logos of multiple different types of cloud platforms.

[0065] In an embodiment of the present application, when a user needs to log in to different types of cloud platforms on a multi-platform login system, a corresponding login control can be triggered on the login interface of the multi-platform login system, so that the multi-platform login system displays a candidate platform page after receiving the login operation triggered by the user on the login interface.

[0066] S202. In response to a user's selection operation of a target login identifier among multiple login identifiers, a communication connection is established with a target cloud platform corresponding to the target login identifier, and a target login page is obtained and displayed from the target cloud platform.

[0067] In an embodiment of the present application, after the candidate platform interface is displayed on the above-mentioned multi-platform login system, the user can trigger the target login identifier among the login identifiers of multiple different types of cloud platforms on the candidate platform interface, and establish a communication connection with the target cloud platform corresponding to the target login identifier, obtain and display the target login page from the target cloud platform, thereby realizing login to the corresponding cloud platform from the multi-platform login system.

[0068] The multi-platform login method provided in the embodiment of the present application is applied to a multi-platform login system, and in response to a login operation triggered by a user on the login interface of the multi-platform login system, a candidate platform page is displayed; in response to a user's selection operation of a target login identifier among multiple login identifiers, a communication connection is established with a target cloud platform corresponding to the target login identifier, and a target login page is obtained and displayed from the target cloud platform; the candidate platform page includes login identifiers of multiple different types of cloud platforms. The above method provides a method for realizing multi-platform login through a multi-platform login system, and multi-platform login can be realized through two responses. Compared with the existing login method that requires registering an account on each platform and logging in on each platform separately when logging in to multiple platforms, the above method is applied to a multi-platform login system, and the user only needs to log in to the multi-platform login system and trigger the identifiers corresponding to multiple cloud platforms on the multi-platform login system interface to realize multi-platform login, which greatly improves the convenience and efficiency of multi-cloud platform login.

[0069] In one embodiment, Figure 2 Based on the embodiment shown, the candidate platform pages include a first type of candidate platform page and a second type of candidate platform page, such as Figure 3 As shown, the above method also includes:

[0070] S203: Display the login information input area.

[0071] In an embodiment of the present application, after the above-mentioned response to the login operation triggered by the user on the login interface of the multi-platform login system, the multi-platform login system will display a login information input area on the login interface.

[0072] S204. In response to the user's input operation in the login information input area, determine the user's identity type according to the login information corresponding to the input operation. If the identity type is an administrator identity type, execute S205; if the identity type is a common user identity type, execute S206.

[0073] In the embodiment of the present application, after the login information input area is displayed as above, the user can enter the login information in the login information input area. When the multi-platform system receives the login information entered by the user in the login information input area, it responds to the user's login operation in the login information input area, and determines the user's identity type based on the login information corresponding to the input operation. If the identity type is an administrator identity type, S205 is executed; if the identity type is an ordinary user identity type, S206 is executed.

[0074] S205. Display the first category of candidate platform pages.

[0075] In the embodiment of the present application, when it is determined that the user's identity type is an administrator identity type, a first category candidate platform page is displayed to the user.

[0076] S206. Display the second category candidate platform page.

[0077] The types of cloud platforms included in the first candidate platform page are different from those included in the second candidate platform page. The types of cloud platforms included in the first candidate platform page are more than those included in the second candidate platform page.

[0078] In the embodiment of the present application, when it is determined that the identity type of the user is a common user identity type, the second candidate platform page is displayed to the user.

[0079] The multi-platform login method provided in the embodiment of the present application determines the user's identity type through login information, and displays different candidate platform interfaces for different types of users, so that different types of users can operate the candidate platform interfaces with different permissions, thereby facilitating the management of different types of users.

[0080] In one embodiment, Figure 3 Based on the embodiment shown, the process of determining the identity type of the user can be described in detail, see Figure 4 The above S204 "determining the user's identity type according to the login information corresponding to the input operation" includes:

[0081] S301. Determine whether the login information is consistent with the administrator login information according to the login information corresponding to the input operation. If the login information is consistent with the administrator login information, execute S302. If the login information is inconsistent with the administrator login information, execute S303.

[0082] In an embodiment of the present application, after receiving the user's input operation as mentioned above, it can be determined whether the login information is consistent with the administrator login information pre-stored in the system based on the login information corresponding to the input operation. If the login information is consistent with the administrator login information, S302 is executed; if the login information is inconsistent with the administrator login information, S303 is executed.

[0083] S302: Determine that the user's identity type is an administrator.

[0084] In the embodiment of the present application, when it is determined that the login information is consistent with the administrator login information, the user's identity type is determined to be an administrator identity.

[0085] S303: Verify the legitimacy of the user's identity according to the login information, and determine the user's identity type according to the verification result.

[0086] In the embodiment of the present application, when it is determined that the login information is inconsistent with the administrator's login information, it is necessary to further verify the legitimacy of the user's identity based on the login information, obtain a verification result, and determine the user's identity type based on the verification result.

[0087] Optionally, the following provides a method for determining the user's identity type based on the verification result, see Figure 5 The above S303 “determine the user's identity type according to the verification result” includes:

[0088] S401. If the verification result indicates that the user is a legitimate user, determine that the user's identity type is a common identity.

[0089] In the embodiment of the present application, when the user is determined to be a legitimate user based on the verification result, the user's identity type is determined to be a common identity.

[0090] S402: If the verification result identifies the user as an illegal user, determine the identity type of the user as an illegal user, and add the user information to a blacklist.

[0091] In the embodiment of the present application, in the case where the user is determined to be an illegal user based on the verification result, the identity type of the user is determined to be an illegal user, and the user information corresponding to the illegal user is added to the blacklist.

[0092] The multi-platform login method provided in the embodiment of the present application determines the user's identity type through login information, including administrator identity, legal identity and illegal identity, and when the identity type is an illegal identity, the user's illegal identity information is added to a blacklist, providing certain convenient conditions for subsequent confirmation of the user's identity type.

[0093] In one embodiment, Figure 2-Figure 5 Based on the embodiment shown, see Figure 6 , the above method further comprises:

[0094] S207: In response to the user's input operation on the target login page, a login request is sent to the target cloud platform, and an application page returned by the target cloud platform based on the login request is received.

[0095] In an embodiment of the present application, after the above-mentioned multi-platform login system obtains and displays the target login page from the target cloud platform, the user can perform input operations on the target login page. At this time, the multi-platform operating system can respond to the user's input operations on the target login page, send a login request to the target cloud platform, and receive the application page returned by the target cloud platform based on the login request.

[0096] S208. Determine the user's identity type. If the identity type is an administrator identity type and belongs to the super administrator level, execute the following S209. If the identity type is an administrator identity type and belongs to the organization administrator level, execute the following S210. If the identity type is an administrator identity type and belongs to the member administrator level, execute the following S211.

[0097] In an embodiment of the present application, the user's identity type can be determined based on the user's input operation on the target login page, and when it is determined that the user's identity type is an administrator identity type and belongs to the super administrator level, the following S209 is executed; when it is determined that the user's identity type is an administrator identity type and belongs to the organization administrator level, the following S210 is executed; when it is determined that the user's identity type is an administrator identity type and belongs to the member administrator level, the following S211 is executed.

[0098] S209: Release the processing authority for the first object.

[0099] The first object includes any one of a resource, a user, and an organization.

[0100] In the embodiment of the present application, when it is determined that the identity type of the user is an administrator identity type and belongs to the super administrator level, the processing authority of any object among resources, users and organizations is released.

[0101] S210: Release the processing authority for the second object.

[0102] The second object includes all users or resources under the organization.

[0103] In the embodiment of the present application, when it is determined that the identity type of the user is the administrator identity type and belongs to the organization administrator level, the processing authority of any one of the resources and the user is released.

[0104] S211. Release the processing authority for the third object.

[0105] The third object includes resources under the user.

[0106] In the embodiment of the present application, when it is determined that the user's identity type is an administrator identity type and belongs to the member administrator level, the user's processing authority is released.

[0107] The multi-platform login method provided in the embodiment of the present application determines the user's identity type through login information, including administrator identity, legal identity and illegal identity, and when the identity type is an illegal identity, the user's illegal identity information is added to a blacklist, providing certain convenient conditions for subsequent confirmation of the user's identity type.

[0108] In one embodiment, Figure 3-Figure 5 Based on the embodiment shown, the above login information input area includes a login name input area and a login password input area, see Figure 7 The above S203 “responding to the user's input operation in the login information input area” includes:

[0109] S401. When receiving a login name input by a user in a login name input area, respond to the login name input operation of the user in the login name input area.

[0110] In the embodiment of the present application, when the login name input by the user in the login name input area is received, the multi-platform login system responds to the login name input operation of the user in the login name input area so that the login name input operation input by the user is received.

[0111] S402: When receiving the login password input by the user in the login password input area, respond to the login password input operation of the user in the login password input area.

[0112] In the embodiment of the present application, when the login password entered by the user in the login password input area is received, the multi-platform login system responds to the user's login password input operation in the login password input area so that the multi-platform login system receives the login password input operation entered by the user.

[0113] The multi-platform login method provided in the embodiment of the present application can log in to the multi-platform login system through a login name and a login password. The operation is simple and convenient, and provides a technical basis for subsequent logins to various platforms.

[0114] In one embodiment, see Figure 8 , also provides a multi-platform login method, including:

[0115] S10, in response to a login operation triggered by a user on a login interface of the multi-platform login system, displaying a login information input area;

[0116] S11, in response to the user's input operation in the login information input area, determine whether the login information is consistent with the administrator login information according to the login information corresponding to the input operation, if the login information is consistent with the administrator login information, execute the following S12, if the login information is inconsistent with the administrator login information, execute the following S13;

[0117] S12, determining that the user's identity type is an administrator, and displaying the first category candidate platform page;

[0118] S13. Verify the legitimacy of the user's identity according to the login information, and if the verification result indicates that the user is a legitimate user, determine that the user's identity type is a common identity, and display the second category candidate platform page;

[0119] S14. If the verification result identifies the user as an illegal user, determine the user's identity type as an illegal user, and add the user information to a blacklist;

[0120] S15, in response to the user's selection operation of a target login identifier among the multiple login identifiers, establishing a communication connection with a target cloud platform corresponding to the target login identifier, and obtaining and displaying a target login page from the target cloud platform;

[0121] S16, in response to the user's input operation on the target login page, sending a login request to the target cloud platform, and receiving an application page returned by the target cloud platform based on the login request;

[0122] S17, determining the identity type of the user;

[0123] S18. If the identity type is an administrator identity type and is at the super administrator level, the processing authority for any object in resources, users, and organizations is released;

[0124] S19. If the identity type is an administrator identity type and belongs to the organization administrator level, release the processing authority for the user or resource object;

[0125] S20. If the identity type is an administrator identity type and belongs to the member administrator level, release the processing authority for the user.

[0126] The above method provides a method for realizing multi-platform login through a multi-platform login system. Multi-platform login can be realized through two responses. Compared with the existing login method that requires registering an account on each platform and logging in to each platform separately when logging in to multiple platforms, the above method is applied to the multi-platform login system. Users only need to log in to the multi-platform login system and trigger the corresponding logos of multiple cloud platforms on the multi-platform login system interface to realize multi-platform login, which greatly improves the convenience and efficiency of multi-cloud platform login.

[0127] Below, we also provide the configuration method of the multi-platform login system, see Fig. 9 , Fig.10 , Fig.11 and Fig.12 ,include:

[0128] 1) The design of identities and permissions within the system should be integrated with the design of current mainstream cloud services, mainly including super administrators / organization administrators / organization members / visitors. Among them, super administrators have the rights to add, delete, modify, and check all resources / users / organizations, organization administrators have the rights to add, delete, modify, and check all users / resources under the organization, organization members have the rights to add, delete, modify, and check resources under their own names, and visitors have the right to view resources authorized to them. In addition, corresponding to the existing structure of various cloud services, the super administrator corresponds to the cloud service account opened by the enterprise. This account is naturally equivalent to the super administrator. If other accounts want to have super administrator permissions, they need to perform additional authorization operations. Organization administrators correspond to the highest authorized users under the user group created by the enterprise, organization members correspond to ordinary permission users under the user group, and visitors correspond to users without operation permissions under the user group.

[0129] 2) The premise of using this multi-platform login system to log in to other cloud platforms is that you have opened an enterprise account on other cloud platforms and authorized the single sign-on permission of this multi-platform login system. The single sign-on protocol is set to OIDC, and the single sign-on authorization address is this system. Then, this multi-platform login system can pass the corresponding cloud service through the OIDC protocol authentication to obtain an access token for the unified creation of permission sets / user accounts / organizations. In addition, this multi-platform login system needs to encrypt and store the OIDC protocol access token. To ensure its security, you can use the KMS service to encrypt and store it. Combined with Ukey certificate authentication, super-management permissions / account information is built into Ukey. The Ukey account permissions correspond to the login account one by one to successfully log in to the super-management account, ensuring the security of the super-management account login. This encryption method can be enabled only for super-management users. When logging in, it will automatically check whether it is a super-management account. If not, you can log in directly through the account, increasing security while ensuring ease of use for ordinary users. For the convenience of users, users can set the validity period of Ukey authentication. During the validity period, Redis caches random numbers and randomized Ukey signature verification data. The system can directly compare and verify the validity of the certificate to speed up the verification process.

[0130] 3) When initializing the multi-platform login system, you need to configure the cloud service companies that the enterprise using this system requires to support, such as Alibaba Cloud, Tencent Cloud, Huawei Cloud, etc. And configure the access token required by the corresponding cloud service. In addition, the identity, namely the above-mentioned super administrator / organization administrator / organization member / visitor, corresponds to various cloud platforms, which is the embodiment of the permission set. When initializing the project, you must first initialize the permission set corresponding to the identity, that is, the system identity policy and policy-related permission set of the cloud service. The multi-platform login system must naturally support the mainstream domestic cloud service vendors: Huawei Cloud, Alibaba Cloud, Tencent Cloud, and Tianyi Cloud. Initialize the mapping relationship between the system identity, permissions, and cloud service permission sets in the database, and the interfaces used by various services to create permission sets and identity policies. Get the AK / SK of the cloud service while registering OIDC. When initializing the project, directly create these four types of identities in the cloud service through the interface call, and store the original data returned by the cloud service in the library, especially the identity, permission set ID, etc. for subsequent deletion, modification, and query operations. Secondly, after the permissions are initialized, user groups need to be created before authorization to plan the permissions of each user. Similarly, for different manufacturers, the interfaces for adding, deleting, modifying, and checking user groups and the management of user-group binding relationships should be configured in the database for unified creation of user groups on each platform and the function of assigning user groups to users. If you want to synchronize the existing user group information of the cloud service, you need to export the user group-user association table in the cloud service and provide it to the system for user group import.

[0131] 4) After the above steps are completed, you can authorize each user. There are two main situations: one is to support the configuration of existing cloud service users to associate with system users, and the other is to create new users for cloud service use. If the first one is to associate with a single cloud service, before creating a system user, the cloud service side configures the user account association, and provides the AK / SK of the corresponding cloud service when creating the system user. The system side configures the synchronization of cloud service permissions, and the system side adds the identity corresponding to the original permission. At this time, the user can choose whether to create other cloud service accounts and identity permissions synchronously, so that other cloud services can be guaranteed to have the same identity permissions as the cloud service account used by the user. If they are not synchronized, the existing identity can be associated and permissions can be re-issued; if there are multiple existing cloud service accounts, the user can choose to synchronize multiple identities in the system, or use the existing identity permissions in the system to issue unified permissions for multiple cloud services. This requires that the various permissions of the system and the permissions of the cloud service have been one-to-one in the database, and provide users with the ability to display existing permissions. Similarly, the account association on the cloud service side must be configured before creating a system account. When creating a system account, the AK / SK corresponding to the cloud service account must be entered for interface calls. The second type of new creation is to create the same account as the system user in multiple cloud services by default. This can be achieved directly through the AK / SK call interface corresponding to each cloud service stored by the super administrator. After the creation is completed, the authority binding and organization binding are issued internally to associate the existing identity and organization. The super administrator needs to configure the account login rules in the cloud service to automatically bind the user with the same email or Tong account.

[0132] 5) When logging into the system, in addition to the user name and password, a mobile phone verification code is accessed to ensure the security of the login. Since the system integrates multi-platform identity management and authentication, the security requirements are high. The service agreement needs to use the HTTPS protocol. Asymmetric encryption and digital signature certificates ensure that the system service is unique and the transmission path is not tampered with. The confidentiality requirements for user data within the database are also high, which affects the use of users on multiple platforms. Therefore, encryption is required during storage. This encryption algorithm can be negotiated with the user to use the encryption algorithm that the user trusts to be built into the server, or the des algorithm can be used. In particular, the initial super administrator is associated with the corporate account of the cloud service. The security requirements for this account are extremely strict. The corresponding access token and other data need to ensure the authenticity of the user before issuing operations. It can be encrypted based on the original encryption of the database and other authentication factors, such as third-party KMS encryption and decryption services, Ukey built-in certificate symmetric encryption and decryption, etc. In addition to the above encryption and decryption methods, you can also set the token validity period and set the validity time. After expiration, the access token needs to be updated for OIDC authentication to improve security according to the user's willingness to use.

[0133] 6) Create an enterprise account on Huawei Cloud and Alibaba Cloud. This is the initial super administrator account. Obtain the super administrator's AK / SK. In the IAM / RAM console of the cloud service, create an identity provider for this system, set the access method to OIDC, select programmatic access and management console access for the access method, and fill in the client ID of the identity provider with the client ID provided by this system. This ID must be unique, and it is best to use the system domain name. Configure the cloud service login link. Use this system to create a super administrator user, insert Ukey to obtain the symmetric encrypted digital signature certificate in Ukey, and store the clientID in the system database. The cloud service corresponds to the clientID set in the cloud service one by one. The obtained AK / SK is also encrypted and stored in the database. At this time, the data can only be encrypted and decrypted by the certificate in Ukey to ensure the security of the super administrator's AK / SK information. Set the configuration information of the identity provider (this system). The system side provides the authorization request URL user single sign-on authorization for the cloud service, and also provides the signature public key for OIDC ID token signature verification. This signature can be changed regularly to ensure the security of single sign-on. According to the Huawei Cloud / Alibaba Cloud API documents, initialize the permission item mapping rules. For example, when uploading files to object storage, the configuration string of Alibaba Cloud is oss:PutObject, and the configuration string of Huawei Cloud is obs:object:PutObject. The system has built-in permission mapping rules for mainstream cloud services to facilitate user operations. The system also provides the function of editing each permission mapping. Initialize identity policy. The system has four built-in identities: super administrator / organization administrator / organization member / visitor. After registering a super administrator account, you need to call the cloud service's create custom policy interface through the AK / SK obtained, create these four types of custom policies according to the initialized permission mapping, and automatically bind the super administrator's permissions to the account.

[0134] 8) Create an organization and create an organization administrator account. Using AK / SK, create an organization with the same name in Huawei Cloud / Alibaba Cloud at the same time, call the interface to add the organization administrator to the user group, grant service permissions to the user group, and save the corresponding account information in the system. If the organization administrator already has a Huawei Cloud account, you need to configure the corresponding cloud service account / account ID / email and other information in the system for OIDC authentication of single sign-on. At the same time, you need to configure the AK / SK of the account to the system for organization binding and related permission authorization. You need to configure the identity provider. Create an organization member account. Using AK / SK, call the administrator to create a user interface to create a user, move it into the organization and authorize it, and save the account information in the cloud service to the system. If you already have a cloud service account, it is similar to the second case. Log in to the cloud service. After logging in to this system, the OIDC ID TOKEN information for the user's cloud service login will be automatically generated. After configuring the login link, you can directly click the icon in the system to log in to the corresponding cloud service without a password.

[0135] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0136] Based on the same inventive concept, the embodiment of the present application also provides a multi-platform login device for implementing the multi-platform login method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more multi-platform login device embodiments provided below can refer to the limitations on the multi-platform login method above, and will not be repeated here.

[0137] In an exemplary embodiment, Fig.13 As shown, a multi-platform login device is provided, including: a first response module 10 and a second response module 11, wherein:

[0138] The first response module 10 is used to display a candidate platform page in response to a login operation triggered by a user on a login interface of the multi-platform login system; the candidate platform page includes login identifiers of multiple different types of cloud platforms.

[0139] The second response module 11 is used to respond to the user's selection operation of a target login identifier among multiple login identifiers, establish a communication connection with a target cloud platform corresponding to the target login identifier, and obtain and display a target login page from the target cloud platform.

[0140] In an exemplary embodiment, the candidate platform pages include a first type of candidate platform page and a second type of candidate platform page, and the apparatus further includes: a display module 12 and a third response module 13, wherein:

[0141] Display module 12, used to display the login information input area;

[0142] The third response module 13 is used to respond to the user's input operation in the login information input area, and determine the user's identity type according to the login information corresponding to the input operation. If the identity type is an administrator identity type, the first category candidate platform page is displayed; if the identity type is an ordinary user identity type, the second category candidate platform page is displayed; the cloud platform type included in the first category candidate platform page is different from the cloud platform type included in the second category candidate platform page.

[0143] In an exemplary embodiment, the third response module 13 includes: a first determination unit, a second determination unit and a verification unit, wherein:

[0144] A first determining unit, specifically configured to determine whether the login information is consistent with the administrator login information according to the login information corresponding to the input operation;

[0145] The second determining unit is specifically configured to determine that the user's identity type is an administrator identity when the login information is consistent with the administrator's login information;

[0146] The verification unit is specifically used to verify the legitimacy of the user's identity according to the login information when the login information is inconsistent with the administrator's login information, and determine the user's identity type according to the verification result.

[0147] In an exemplary embodiment, the above-mentioned verification unit, specifically the unit, determines that the user's identity type is a common identity when the verification result indicates that the user is a legal user; and is also specifically used to determine that the user's identity type is an illegal user when the verification result identifies that the user is an illegal user, and add the user information to a blacklist.

[0148] In an exemplary embodiment, the above device further includes: a fourth response module, a determination module, a first release module, a second release module and a third release module, wherein:

[0149] A fourth response module, configured to send a login request to a target cloud platform in response to an input operation of a user on a target login page, and receive an application page returned by the target cloud platform based on the login request;

[0150] A determination module, used to determine the identity type of the user;

[0151] A first release module is used to release the processing authority of the first object when the identity type is an administrator identity type and belongs to the super administrator level; the first object includes any one of a resource, a user, and an organization;

[0152] A second release module is used to release the processing authority of the second object when the identity type is an administrator identity type and belongs to the organization administrator level; the second object includes all users or resources under the organization;

[0153] The third release module is used to release the processing authority of the third object when the identity type is the administrator identity type and belongs to the member administrator level; the third object includes the resources under the user.

[0154] In an exemplary embodiment, the login information input area includes a login name input area and a login password input area, and the third response module 13 includes: a first response unit and a second response unit, wherein:

[0155] A first response unit, specifically configured to respond to the user's login name input operation in the login name input area when receiving the login name input by the user in the login name input area;

[0156] The second response unit is specifically configured to respond to the login password input operation of the user in the login password input area when receiving the login password input by the user in the login password input area.

[0157] Each module in the above multi-platform login device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module above.

[0158] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Fig.14As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store login data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a multi-platform login method is implemented.

[0159] Those skilled in the art will understand that Fig.14 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0160] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0161] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0162] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0163] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0164] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0165] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0166] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A multi-platform login method, characterized in that: The method is applied to a multi-platform login system, and the method comprises: In response to a login operation triggered by a user on a login interface of the multi-platform login system, a candidate platform page is displayed; the candidate platform page includes login identifiers of multiple different types of cloud platforms; In response to the user's selection operation of a target login identifier among multiple login identifiers, a communication connection is established with a target cloud platform corresponding to the target login identifier, and a target login page is obtained and displayed from the target cloud platform.

2. The method according to claim 1, characterized in that The candidate platform pages include first-category candidate platform pages and second-category candidate platform pages, and the method further includes: Display the login information input area; In response to the user's input operation in the login information input area, the identity type of the user is determined according to the login information corresponding to the input operation. If the identity type is an administrator identity type, the first category candidate platform page is displayed; if the identity type is an ordinary user identity type, the second category candidate platform page is displayed; the cloud platform type included in the first category candidate platform page is different from the cloud platform type included in the second category candidate platform page.

3. The method according to claim 2, characterized in that The determining the identity type of the user according to the login information corresponding to the input operation includes: Determining, based on the login information corresponding to the input operation, whether the login information is consistent with the administrator login information; If the login information is consistent with the administrator login information, determining that the identity type of the user is an administrator identity; If the login information is inconsistent with the administrator's login information, the legitimacy of the user's identity is verified according to the login information, and the user's identity type is determined according to the verification result.

4. The method according to claim 3, characterized in that Determining the identity type of the user according to the verification result includes: If the verification result indicates that the user is a legitimate user, determining that the identity type of the user is a common identity; If the verification result identifies the user as an illegal user, the identity type of the user is determined to be an illegal user, and the user information is added to a blacklist.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: In response to the user's input operation on the target login page, sending a login request to the target cloud platform, and receiving an application page returned by the target cloud platform based on the login request; determining the identity type of the user; If the identity type is an administrator identity type and belongs to the super administrator level, then releasing the processing authority for the first object; the first object includes any one of a resource, a user, and an organization; If the identity type is the administrator identity type and belongs to the organization administrator level, releasing the processing authority for the second object; the second object includes all users or resources under the organization; If the identity type is the administrator identity type and belongs to the member administrator level, the processing authority for the third object is released; the third object includes resources under the user.

6. The method according to any one of claims 2 to 4, characterized in that: The login information input area includes a login name input area and a login password input area, and the response to the user's input operation in the login information input area includes: Upon receiving the login name input by the user in the login name input area, responding to the login name input operation of the user in the login name input area; When receiving the login password input by the user in the login password input area, respond to the login password input operation of the user in the login password input area.

7. A multi-platform login device, characterized in that: Applied to a multi-platform login system, the device comprises: A first response module, configured to display a candidate platform page in response to a login operation triggered by a user on a login interface of the multi-platform login system; the candidate platform page includes login identifiers of multiple cloud platforms of different types; The second response module is used to establish a communication connection with a target cloud platform corresponding to the target login identifier in response to the user's selection operation of the target login identifier among multiple login identifiers, and obtain and display a target login page from the target cloud platform.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images