Authorization method and device of virtual machine instance, computer equipment and readable storage medium

Abstract

The invention relates to a virtual machine instance authorization method and device, computer equipment and a computer readable storage medium. The method is applied to an authorization center and comprises the steps that an authorization request message sent by a virtual machine instance is received, and the authorization request message carries a salt value and a first device identifier of the virtual machine instance; determining whether a target instance password exists in the instance passwords corresponding to the authorization information in the unissued state; a second device identifier generated by the target instance password and the salt value is matched with the first device identifier; under the condition that the target instance password exists, determining target authorization information corresponding to the target instance password based on a corresponding relationship between locally stored authorization information and the instance password; the issuing state of the target authorization information is updated to be an issued state, an authorization success response message is sent to the virtual machine instance, and the target authorization information is carried in the authorization success response message. By adopting the method, the authorization efficiency of the virtual machine instance can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, apparatus, computer device and computer-readable storage medium for authorizing a virtual machine instance. Background Art

[0002] In recent years, with the rapid development of cloud computing, more and more companies have migrated services originally based on physical hardware to the public cloud, using virtual machine instances to provide various services.

[0003] After the virtual machine instance is running, the virtual machine instance can generate a device identifier based on the hardware feature information of the hardware device deployed on it. When the user logs in to the management page of the virtual machine instance, the virtual machine instance displays the device identifier and prompts the user to import the authorization license of the virtual machine instance. At this time, the user needs to send the device identifier to the service provider to make an authorization license for the virtual machine instance, and after obtaining the authorization license of the virtual machine instance, import it into the virtual machine instance to complete the legality authentication.

[0004] However, during the authorization process of the virtual machine instance, the user needs to send the device identification to the service provider to make an authorization license for the virtual machine instance and import it into the virtual machine instance, which will result in low authorization efficiency for the virtual machine instance. Summary of the invention

[0005] Based on this, it is necessary to provide a method, apparatus, computer device and computer-readable storage medium for authorizing virtual machine instances that can improve the authorization efficiency of virtual machine instances in response to the above technical problems.

[0006] In a first aspect, the present application provides a method for authorizing a virtual machine instance, the method being applied to an authorization center, the method comprising:

[0007] Receive an authorization request message sent by a virtual machine instance, wherein the authorization request message carries a salt value and a first device identifier of the virtual machine instance;

[0008] Determine whether there is a target instance password in the instance password corresponding to the authorization information in the unissued state; the second device identifier generated by the target instance password and the salt value matches the first device identifier;

[0009] In the case where the target instance password exists, determining the target authorization information corresponding to the target instance password based on the correspondence between the locally stored authorization information and the instance password;

[0010] The issuing status of the target authorization information is updated to an issued status, and an authorization success response message is sent to the virtual machine instance, wherein the authorization success response message carries the target authorization information.

[0011] In one embodiment, the method further comprises:

[0012] In the absence of the target instance password, an authorization failure response message is sent to the virtual machine instance.

[0013] In one of the embodiments, determining whether a target instance password exists in the instance password corresponding to the authorization information in the unissued state includes:

[0014] According to a preset sorting strategy, the instance passwords in the instance password list are sorted, wherein the instance password list is used to store instance passwords corresponding to the authorization information that has not been issued;

[0015] Starting from the first instance password, based on the instance password and the salt value, determining a second device identifier corresponding to the instance password;

[0016] If the second device identifier matches the first device identifier, determining that the instance password is the target instance password;

[0017] If the second device identifier does not match the first device identifier, the next instance password is polled until the last instance password is polled.

[0018] In a second aspect, the present application provides a method for authorizing a virtual machine instance, the method being applied to the virtual machine instance, the method comprising:

[0019] Obtaining a device identifier of the virtual machine instance; the device identifier is generated based on a hash value and a salt value corresponding to an instance password of the virtual machine instance stored locally;

[0020] Sending an authorization request message to an authorization center, wherein the authorization request message carries the device identifier and the salt value;

[0021] An authorization success response message sent by the authorization center is received, wherein the authorization success response message carries authorization information.

[0022] In one embodiment, obtaining the device identifier of the virtual machine instance includes:

[0023] Obtaining a hash value and a salt value corresponding to the instance password of the virtual machine instance stored locally;

[0024] Concatenate the hash value and the salt value to obtain a concatenation result;

[0025] A hash value of the concatenation result is determined to obtain a device identifier of the virtual machine instance.

[0026] In a third aspect, the present application provides a method for authorizing a virtual machine instance, the method being applied to a virtual machine instance service platform, the method comprising:

[0027] In response to the order request message, generate an instance password for the virtual machine instance;

[0028] Sending a virtual machine instance creation request message to the cloud platform, wherein the virtual machine instance creation request message carries the instance password and parameter information of the virtual machine instance, and is used to instruct the cloud platform to create a virtual machine instance including the instance password based on the parameter information;

[0029] An authorization message is sent to an authorization center, wherein the authorization message carries the authorization information of the virtual machine instance and the instance password, and is used to instruct the authorization center to store the corresponding relationship between the authorization information and the instance password.

[0030] In one embodiment, generating an instance password of a virtual machine instance includes:

[0031] Generate a serial number for the virtual machine instance and generate an initial password using a random algorithm;

[0032] An instance password of the virtual machine instance is generated based on the number identifier and the initial password.

[0033] In a fourth aspect, the present application provides an authorization device for a virtual machine instance, the device being applied to an authorization center, the device comprising:

[0034] A receiving module, configured to receive an authorization request message sent by a virtual machine instance, wherein the authorization request message carries a salt value and a first device identifier of the virtual machine instance;

[0035] A first determination module is used to determine whether there is a target instance password in the instance password corresponding to the authorization information in an unissued state; the second device identifier generated by the target instance password and the salt value matches the first device identifier;

[0036] A second determination module is used to determine the target authorization information corresponding to the target instance password based on the correspondence between the locally stored authorization information and the instance password when the target instance password exists;

[0037] The first sending module is used to update the sending status of the target authorization information to a sent status, and send an authorization success response message to the virtual machine instance, wherein the authorization success response message carries the target authorization information.

[0038] In one embodiment, the device further comprises:

[0039] The second sending module is used to send an authorization failure response message to the virtual machine instance when the target instance password does not exist.

[0040] In one embodiment, the first determining module is specifically configured to:

[0041] According to a preset sorting strategy, the instance passwords in the instance password list are sorted, wherein the instance password list is used to store instance passwords corresponding to the authorization information that has not been issued;

[0042] Starting from the first instance password, based on the instance password and the salt value, determining a second device identifier corresponding to the instance password;

[0043] If the second device identifier matches the first device identifier, determining that the instance password is the target instance password;

[0044] If the second device identifier does not match the first device identifier, the next instance password is polled until the last instance password is polled.

[0045] In a fifth aspect, the present application provides an authorization device for a virtual machine instance, the device being applied to the virtual machine instance, the device comprising:

[0046] An acquisition module, used to acquire a device identifier of the virtual machine instance; the device identifier is generated based on a hash value and a salt value corresponding to an instance password of the virtual machine instance stored locally;

[0047] A sending module, used to send an authorization request message to an authorization center, wherein the authorization request message carries the device identifier and the salt value;

[0048] The receiving module is used to receive the authorization success response message sent by the authorization center, and the authorization success response message carries the authorization information.

[0049] In one embodiment, the acquisition module is specifically used to:

[0050] Obtaining a hash value and a salt value corresponding to the instance password of the virtual machine instance stored locally;

[0051] Concatenate the hash value and the salt value to obtain a concatenation result;

[0052] A hash value of the concatenation result is determined to obtain a device identifier of the virtual machine instance.

[0053] In a sixth aspect, the present application provides an authorization device for a virtual machine instance, the device being applied to a virtual machine instance service platform, the device comprising:

[0054] A generating module, used to generate an instance password of a virtual machine instance in response to a subscription request message;

[0055] A first sending module is used to send a virtual machine instance creation request message to the cloud platform, wherein the virtual machine instance creation request message carries the instance password and parameter information of the virtual machine instance, and is used to instruct the cloud platform to create a virtual machine instance including the instance password based on the parameter information;

[0056] The second sending module is used to send an authorization message to the authorization center, wherein the authorization message carries the authorization information of the virtual machine instance and the instance password, and is used to instruct the authorization center to store the corresponding relationship between the authorization information and the instance password.

[0057] In one embodiment, the generating module is specifically used for:

[0058] Generate a serial number for the virtual machine instance and generate an initial password using a random algorithm;

[0059] An instance password of the virtual machine instance is generated based on the number identifier and the initial password.

[0060] In the seventh aspect, the present application provides a cloud service system, which includes a virtual machine instance service platform, a cloud platform, an authorization center and a virtual machine instance; the authorization center executes the steps of the method described in any one of the first aspect; the virtual machine instance executes the steps of the method described in any one of the second aspect; the virtual machine instance service platform executes the steps of the method described in any one of the third aspect; the cloud platform creates the virtual machine instance including the instance password based on the parameter information of the virtual machine embodiment.

[0061] In an eighth aspect, the present application provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method described in any one of the first aspect, the second aspect, or the third aspect when executing the computer program.

[0062] In a ninth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the method described in any one of the first aspect, the second aspect, or the third aspect are implemented.

[0063] In a tenth aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method described in any one of the first aspect, the second aspect, or the third aspect.

[0064] The authorization method, device, computer equipment and computer-readable storage medium of the virtual machine instance are as follows: the authorization center receives the authorization request message sent by the virtual machine instance. The authorization request message carries a salt value and a first device identifier of the virtual machine instance. Then, the authorization center determines whether there is a target instance password in the instance password corresponding to the authorization information in the unissued state. The second device identifier generated by the target instance password and the salt value matches the first device identifier. Afterwards, in the case where the target instance password exists, the authorization center determines the target authorization information corresponding to the target instance password based on the correspondence between the locally stored authorization information and the instance password, updates the issuance status of the target authorization information to the issued status, and sends an authorization success response message to the virtual machine instance. The authorization success response message carries the target authorization information. In this way, automatic authorization can be achieved between the virtual machine instance and the authorization center without the intervention of the user and the service provider, thereby improving the authorization efficiency of the virtual machine instance. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0066] Figure 1 A schematic diagram of the architecture of a cloud service system in one embodiment;

[0067] Figure 2 A flowchart of a method for authorizing a virtual machine instance in one embodiment;

[0068] Figure 3 A flowchart of a method for authorizing a virtual machine instance in one embodiment;

[0069] Figure 4 A schematic diagram of a salt value and an example password in one embodiment;

[0070] Figure 5 A flowchart of a method for authorizing a virtual machine instance in one embodiment;

[0071] Figure 6 A flowchart of an example of an authorizer of a virtual machine instance in one embodiment;

[0072] Figure 7 is a structural block diagram of an authorization device for a virtual machine instance in one embodiment;

[0073] Figure 8 is a structural block diagram of an authorization device for a virtual machine instance in one embodiment;

[0074] Fig. 9 is a structural block diagram of an authorization device for a virtual machine instance in one embodiment;

[0075] Fig.10 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0076] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0077] In recent years, with the rapid development of cloud computing, more and more enterprises have migrated services originally based on physical hardware to public clouds, using virtual machine instances to provide various services. Currently, there are two ways to authorize virtual machine instances.

[0078] The first method is the offline authorization method. After the virtual machine instance is running, the virtual machine instance can generate a device identifier based on the hardware feature information of the hardware device deployed on it. When the user logs in to the management page of the virtual machine instance, the virtual machine instance displays the device identifier and prompts the user to import the authorization license of the virtual machine instance. At this time, the user needs to send the device identifier to the service provider to produce an authorization license for the virtual machine instance, and after obtaining the authorization license of the virtual machine instance, import it into the virtual machine instance to complete the legality authentication. The above offline authorization method has the following problems: (1) The information on the cloud platform is virtualized, and the virtual machine instance can be copied arbitrarily, resulting in one authorization license being used for multiple virtual machine instances; (2) During the authorization process of the virtual machine instance, the user needs to send the device identifier to the service provider to produce an authorization license for the virtual machine instance and import it into the virtual machine instance, which will result in low authorization efficiency for the virtual machine instance.

[0079] The second method is the online automatic authorization method. The authorization center pre-allocates a specific number of authorization licenses for the device identifier corresponding to the virtual machine instance. When the cloud platform distributes the virtual machine instance image to the user, the cloud platform embeds the device identifier into the virtual machine instance image. When the virtual machine instance is started, the virtual machine instance reports the device identifier to the authorization center. The authorization center decides whether to issue an authorization license to the virtual machine instance based on whether the authorized number of the device identifier has been used up. The above-mentioned online automatic authorization method has the following problems: the device identifier needs to be manually embedded into the virtual machine instance image, resulting in high labor costs, and it is impossible to identify the identity information of a single virtual machine instance for accurate authorization.

[0080] An embodiment of the present application provides a method for authorizing a virtual machine instance, which can be applied to a cloud service system. Figure 1 FIG. 1 is a schematic diagram of the architecture of a cloud service system in an embodiment. Figure 1 As shown, the cloud service system includes a virtual machine instance service platform 110, a cloud platform 120, an authorization center 130 and a virtual machine instance 140. The virtual machine instance service platform 110 is used to generate an instance password of the virtual machine instance 140 in response to a user's order request message for the virtual machine instance 140. The virtual machine instance service platform 110 is also used to send the instance password and parameter information used to generate the virtual machine instance 140 to the cloud platform 120, and send the authorization information and the instance password to the authorization center 130. The cloud platform 120 is used to generate a virtual machine instance 140 containing an instance password based on the parameter information of the virtual machine instance 140. The virtual machine instance 140 is used to generate a device identifier based on a salt value and an instance password, and send the device identifier and the salt value to the authorization center 130. The authorization center 130 is used to determine the target instance password in the instance password corresponding to the authorization information in the unissued state based on the device identifier and salt value of the virtual machine instance 140. The device identifier generated by the target instance password and the salt value matches the device identifier of the virtual machine instance 140. The authorization center 130 is further used to determine the target authorization information corresponding to the target instance password based on the correspondence between the locally stored authorization information and the instance password, and send the target authorization information to the virtual machine instance 140 .

[0081] For ease of understanding, the present application embodiment first introduces the generation process of a virtual machine instance. The present application embodiment provides an authorization method for a virtual machine instance, which is applied to a virtual machine instance service platform, such as Figure 2 As shown, the method comprises the following steps:

[0082] Step 202: Generate an instance password of the virtual machine instance in response to the order request message.

[0083] In one embodiment, when a user needs to order a virtual machine instance, the user may send an order request message for the virtual machine instance to the virtual machine instance service platform. The order request message may carry parameter information of the virtual machine instance (such as operating system, memory parameters, hard disk parameters, network parameters, etc.). After receiving the order request message, the virtual machine instance service platform may generate an instance password for the virtual machine instance.

[0084] In some embodiments, the virtual machine instance service platform generates an instance password for a virtual machine instance as follows:

[0085] Step 1: Generate a serial number for the virtual machine instance and generate an initial password using a random algorithm.

[0086] In one embodiment, first, the virtual machine instance service platform queries the existing number identifiers stored in the database and generates unused number identifiers to prevent duplication of the number identifiers of the generated virtual machine instances. Then, the virtual machine instance service platform generates an initial password that meets the password complexity requirements through a random algorithm.

[0087] Step 2: Generate an instance password for the virtual machine instance based on the number identifier and the initial password.

[0088] In one implementation, after the virtual machine instance service platform generates the number identifier and the initial password, it can further generate an instance password of the virtual machine instance based on the number identifier and the initial password. Specifically, the virtual machine instance service platform can concatenate the number identifier and the initial password to obtain the instance password of the virtual machine instance. The embodiment of the present application does not limit the concatenation order of the number identifier and the initial password.

[0089] Step 204: Send a virtual machine instance creation request message to the cloud platform. The virtual machine instance creation request message carries the instance password and parameter information of the virtual machine instance, and is used to instruct the cloud platform to create a virtual machine instance including the instance password based on the parameter information.

[0090] In one embodiment, after the virtual machine instance service platform generates the instance password of the virtual machine instance, it can further send a virtual machine instance creation request message to the cloud platform. The virtual machine instance creation request message carries the instance password and parameter information of the virtual machine instance; the virtual machine instance creation request message is used to instruct the cloud platform to create a virtual machine instance containing the instance password based on the parameter information. Correspondingly, after receiving the virtual machine instance creation request message, the cloud platform can create a virtual machine instance based on the parameter information of the virtual machine instance. The instance password of the virtual machine instance is stored in the virtual machine instance. Specifically, the virtual machine instance can store the salt value (salt) of the virtual machine instance and the hash value of the instance password under a preset path (such as the / etc / shadow path).

[0091] Step 206: Send an authorization message to the authorization center, wherein the authorization message carries the authorization information and the instance password of the virtual machine instance, and is used to instruct the authorization center to store the corresponding relationship between the authorization information and the instance password.

[0092] In one implementation, after the virtual machine instance service platform generates the instance password of the virtual machine instance, it can also send an authorization message to the authorization center. The authorization message carries the authorization information and the instance password of the virtual machine instance; the authorization message is used to instruct the authorization center to store the corresponding relationship between the authorization information and the instance password. Accordingly, after receiving the authorization message, the authorization center can store the corresponding relationship between the authorization information and the instance password locally, and initialize the issuance status of the authorization information to the unsent status.

[0093] In the embodiment of the present application, the number identification and initial password of the virtual machine instance generated by the virtual machine instance service platform are unique, and the instance password of the virtual machine instance is also unique, thereby ensuring that the device identification of the virtual machine instance subsequently generated based on the instance password is also unique, and further ensuring that the authorization information corresponding to the virtual machine instance is also unique. In this way, the problem that the information on the cloud platform in the above-mentioned offline authorization method is all virtualized, and the virtual machine instance can be copied arbitrarily, resulting in one authorization license being used for multiple virtual machine instances is solved. At the same time, after the cloud platform receives the virtual machine instance creation request message, it can create a virtual machine instance containing the instance password based on the parameter information of the virtual machine instance, thereby solving the problem that the above-mentioned online automatic authorization method requires manual device identification to be built into the virtual machine instance image, resulting in high labor costs.

[0094] Furthermore, the present application embodiment introduces the authorization process of a virtual machine instance. The present application embodiment provides an authorization method for a virtual machine instance, which is applied to a virtual machine instance, such as Figure 3 As shown, the method comprises the following steps:

[0095] Step 301: Obtain a device identifier of a virtual machine instance, wherein the device identifier is generated based on a hash value and a salt value corresponding to an instance password of the virtual machine instance stored locally.

[0096] In one implementation, when the virtual machine instance is running, the virtual machine instance can obtain the hash value and salt value corresponding to the instance password of the virtual machine instance stored locally, and generate a device identifier of the virtual machine instance, wherein the device identifier is used to uniquely identify the virtual machine instance.

[0097] In some embodiments, the process of the virtual machine instance obtaining the device identification of the virtual machine instance is as follows:

[0098] Step 1: Obtain the hash value and salt value corresponding to the instance password of the locally stored virtual machine instance.

[0099] In one embodiment, the virtual machine instance obtains the hash value and salt value corresponding to the instance password of the virtual machine instance stored locally. The hash value and salt value corresponding to the instance password of the virtual machine instance stored locally by the virtual machine instance are as follows: Figure 4shown.

[0100] Step 2: Concatenate the hash value and the salt value to obtain the concatenation result.

[0101] In one implementation, after the virtual machine instance obtains the hash value and salt value corresponding to the instance password of the locally stored virtual machine instance, the hash value and the salt value may be concatenated to obtain a concatenated result. The embodiment of the present application does not limit the concatenation order of the hash value and the salt value.

[0102] Step three: determine the hash value of the concatenation result to obtain the device identifier of the virtual machine instance.

[0103] In one implementation, after the virtual machine instance obtains the splicing result, a hash value of the splicing result may be further determined to obtain a device identifier of the virtual machine instance.

[0104] Step 302: Send an authorization request message to the authorization center, wherein the authorization request message carries a device identifier and a salt value.

[0105] In one implementation, after the virtual machine instance obtains the device identifier, it may send an authorization request message to the authorization center, wherein the authorization request message carries the device identifier and the salt value.

[0106] Step 303: Receive an authorization success response message sent by the authorization center, wherein the authorization success response message carries authorization information.

[0107] In one implementation, the authorization center can send an authorization success response message to the virtual machine instance after determining the authorization information of the virtual machine instance based on the correspondence between the locally stored authorization information and the instance password, the device identifier and the salt value carried in the authorization request message. The authorization success response message carries the authorization information. Accordingly, after the virtual machine instance receives the authorization success response message sent by the authorization center, it can complete the legality authentication based on the authorization information.

[0108] In an embodiment of the present application, when a virtual machine instance is running, the virtual machine instance can obtain the hash value and salt value corresponding to the instance password of the locally stored virtual machine instance, and generate a device identification of the virtual machine instance. Then, the virtual machine instance sends an authorization request message carrying the device identification and salt value to the authorization center, so that the authorization center can determine the authorization information of the virtual machine instance, thereby solving the problem that in the authorization process of the virtual machine instance in the above-mentioned offline authorization method, the user needs to send the device identification to the service manufacturer to make an authorization license for the virtual machine instance and import it into the virtual machine instance, which will result in low authorization efficiency of the virtual machine instance. At the same time, compared with the traditional device identification, the device identification in the present application can uniquely identify the virtual machine instance, thereby solving the problem that the above-mentioned offline authorization method and the online automatic authorization method cannot identify the identity information of a single virtual machine instance for accurate authorization.

[0109] Furthermore, the present application embodiment introduces the authorization process of a virtual machine instance. The present application embodiment provides an authorization method for a virtual machine instance, which is applied to an authorization center, such as Figure 5 As shown, the method comprises the following steps:

[0110] Step 501: Receive an authorization request message sent by a virtual machine instance, wherein the authorization request message carries a salt value and a first device identifier of the virtual machine instance.

[0111] In one embodiment, when the virtual machine instance is running, the virtual machine instance can obtain the hash value and salt value corresponding to the instance password of the virtual machine instance stored locally, and generate the first device identification of the virtual machine instance. Then, the virtual machine instance can send an authorization request message to the authorization center. The authorization request message carries the first device identification and the salt value. Correspondingly, the authorization center can receive the authorization request message sent by the virtual machine instance.

[0112] Step 502: Determine whether there is a target instance password in the instance passwords corresponding to the authorization information in the unissued state, wherein the second device identifier generated by the target instance password and the salt value matches the first device identifier.

[0113] In one embodiment, during the generation process of a virtual machine instance, after the virtual machine instance service platform generates the instance password of the virtual machine instance, it can send an authorization message to the authorization center. The authorization message carries the authorization information and the instance password of the virtual machine instance. Correspondingly, after receiving the authorization message, the authorization center can store the corresponding relationship between the authorization information and the instance password locally, and initialize the issuance status of the authorization information to the unsent state.

[0114] After receiving the authorization request message sent by the virtual machine instance, the authorization center can first determine the instance password corresponding to the authorization information in the unissued state from the correspondence between the authorization information and the instance password stored locally. Then, the authorization center can further determine whether the target instance password exists in the instance password corresponding to the authorization information in the unissued state. The second device identifier generated by the authorization center based on the target instance password and the salt value matches the first device identifier.

[0115] Step 503: if the target instance password exists, determine the target authorization information corresponding to the target instance password based on the correspondence between the locally stored authorization information and the instance password.

[0116] In one implementation, when the target instance password exists, the authorization center may query the target authorization information corresponding to the target instance password in the correspondence relationship between the authorization information and the instance password stored locally.

[0117] Step 504: Update the delivery status of the target authorization information to the delivered status, and send an authorization success response message to the virtual machine instance, wherein the authorization success response message carries the target authorization information.

[0118] In one implementation, after the authorization center has queried the target authorization information corresponding to the target instance password, it can further update the delivery status of the target authorization information to the delivered status in the correspondence between the locally stored authorization information and the instance password. At the same time, the authorization center can send an authorization success response message to the virtual machine instance. The authorization success response message carries the target authorization information.

[0119] In some embodiments, in the absence of a target instance password, an authorization failure response message is sent to the virtual machine instance.

[0120] In one implementation, when the target instance password does not exist, the authorization center may send an authorization failure response message to the virtual machine instance, wherein the authorization failure response message is used to inform the virtual machine instance of the authorization failure.

[0121] In some embodiments, the authorization center determines whether the target instance password exists in the instance password corresponding to the authorization information in the unissued state in the following process:

[0122] Step 1: sort the instance passwords in the instance password list according to a preset sorting strategy, wherein the instance password list is used to store instance passwords corresponding to authorization information that has not been issued.

[0123] In one embodiment, after the authorization center determines the instance password corresponding to the authorization information in the unissued state, the instance password corresponding to the authorization information in the unissued state can be stored in the instance password list. Then, the authorization center can sort the instance passwords in the instance password list according to a preset sorting strategy. Among them, the sorting strategy can be a sorting strategy that sorts in descending order according to the creation time, or it can be a sorting strategy in other ways, which is not limited in the embodiments of the present application.

[0124] Step 2: Starting from the first instance password, based on the instance password and the salt value, determine the second device identifier corresponding to the instance password.

[0125] In one embodiment, starting from the first instance password, the authorization center can determine the second device identification corresponding to the instance password based on the instance password and the salt value. Specifically, the authorization center can first hash the instance password to obtain the hash value of the instance password. Then, the authorization center can concatenate the hash value and the salt value to obtain a concatenation result. Among them, the embodiment of the present application does not limit the concatenation order of the hash value and the salt value. Finally, the authorization center can determine the hash value of the concatenation result to obtain the second device identification corresponding to the instance password.

[0126] Step three: if the second device identifier matches the first device identifier, determine that the instance password is the target instance password.

[0127] In one embodiment, after obtaining the second device identifier corresponding to the instance password, the authorization center can further determine whether the second device identifier matches the first device identifier. If the second device identifier matches the first device identifier, it means that the instance password is the same as the instance password of the virtual machine instance. Accordingly, the authorization center can determine that the instance password is the target instance password, that is, it determines that the target instance password exists.

[0128] Step 4: If the second device identifier does not match the first device identifier, poll the next instance password until the last instance password is polled.

[0129] In one embodiment, if the second device identifier does not match the first device identifier, it means that the instance password is different from the instance password of the virtual machine instance. Accordingly, the authorization center can poll the next instance password until the last instance password is polled. If the second device identifier corresponding to the last instance password still does not match the first device identifier, the authorization center can determine that the target instance password does not exist.

[0130] In an embodiment of the present application, an authorization center receives an authorization request message sent by a virtual machine instance. The authorization request message carries a salt value and a first device identifier of the virtual machine instance. Then, the authorization center determines whether a target instance password exists in the instance password corresponding to the authorization information in an unissued state. The second device identifier generated by the target instance password and the salt value matches the first device identifier. Afterwards, in the case where a target instance password exists, the authorization center determines the target authorization information corresponding to the target instance password based on the correspondence between the locally stored authorization information and the instance password, updates the issuance status of the target authorization information to an issued status, and sends an authorization success response message to the virtual machine instance. The authorization success response message carries the target authorization information. In this way, automatic authorization can be achieved between the virtual machine instance and the authorization center without the intervention of users and service providers, thereby improving the authorization efficiency of the virtual machine instance.

[0131] like Figure 6 As shown, the embodiment of the present application provides an example of a method for authorizing a virtual machine instance, comprising the following steps:

[0132] Step 601: The virtual machine instance service platform generates a number identifier of the virtual machine instance in response to a subscription request message, generates an initial password through a random algorithm, and generates an instance password of the virtual machine instance based on the number identifier and the initial password.

[0133] Step 602a, the virtual machine instance service platform sends a virtual machine instance creation request message to the cloud platform. The virtual machine instance creation request message carries the instance password and parameter information of the virtual machine instance, which is used to instruct the cloud platform to create a virtual machine instance containing the instance password based on the parameter information.

[0134] Step 602b: The virtual machine instance service platform sends an authorization message to the authorization center, wherein the authorization message carries the authorization information and instance password of the virtual machine instance, and is used to instruct the authorization center to store the corresponding relationship between the authorization information and the instance password.

[0135] Step 603a: The cloud platform creates a virtual machine instance including a hash value and a salt value of the instance password based on the parameter information of the virtual machine instance.

[0136] Step 603b: The authorization center stores the corresponding relationship between the authorization information and the instance password locally, and initializes the issuing status of the authorization information to the unissued status.

[0137] Step 604, the virtual machine instance obtains the hash value and salt value corresponding to the instance password of the virtual machine instance stored locally, concatenates the hash value and the salt value to obtain a concatenation result, determines the hash value of the concatenation result, and obtains the device identifier of the virtual machine instance.

[0138] Step 605: The virtual machine instance sends an authorization request message to the authorization center, wherein the authorization request message carries a device identifier and a salt value.

[0139] Step 606: The authorization center determines the second device identifier corresponding to the instance password in the instance password corresponding to the authorization information in the unissued state based on the hash value and the salt value of the instance password, and determines the instance password whose second device identifier matches the first device identifier as the target instance password.

[0140] Step 607: The authorization center determines the target authorization information corresponding to the target instance password based on the correspondence between the locally stored authorization information and the instance password, and updates the delivery status of the target authorization information to the delivered status.

[0141] Step 608: The authorization center sends an authorization success response message to the virtual machine instance, wherein the authorization success response message carries the target authorization information.

[0142] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0143] Based on the same inventive concept, the embodiment of the present application also provides a virtual machine instance authorization device for implementing the virtual machine instance authorization method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of the authorization device for one or more virtual machine instances provided below can refer to the limitations of the virtual machine instance authorization method above, and will not be repeated here.

[0144] In an exemplary embodiment, Figure 7 As shown, a virtual machine instance authorization device is provided, the device is applied to an authorization center, and the device includes: a receiving module 710, a first determining module 720, a second determining module 730 and a first sending module 740; wherein,

[0145] The receiving module 710 is used to receive an authorization request message sent by a virtual machine instance, wherein the authorization request message carries a salt value and a first device identifier of the virtual machine instance;

[0146] A first determination module 720 is used to determine whether there is a target instance password in the instance password corresponding to the authorization information in an unissued state; the second device identifier generated by the target instance password and the salt value matches the first device identifier;

[0147] The second determination module 730 is used to determine the target authorization information corresponding to the target instance password based on the correspondence between the locally stored authorization information and the instance password when the target instance password exists;

[0148] The first sending module 740 is used to update the sending status of the target authorization information to the sent status, and send an authorization success response message to the virtual machine instance, wherein the authorization success response message carries the target authorization information.

[0149] In one embodiment, the device further comprises:

[0150] The second sending module is used to send an authorization failure response message to the virtual machine instance when the target instance password does not exist.

[0151] In one embodiment, the first determining module 720 is specifically configured to:

[0152] According to a preset sorting strategy, the instance passwords in the instance password list are sorted, wherein the instance password list is used to store instance passwords corresponding to the authorization information that has not been issued;

[0153] Starting from the first instance password, based on the instance password and the salt value, determining a second device identifier corresponding to the instance password;

[0154] If the second device identifier matches the first device identifier, determining that the instance password is the target instance password;

[0155] If the second device identifier does not match the first device identifier, the next instance password is polled until the last instance password is polled.

[0156] In an exemplary embodiment, Figure 8 As shown, a virtual machine instance authorization device is provided, the device is applied to the virtual machine instance, and the device includes: an acquisition module 810, a sending module 820 and a receiving module 830; wherein,

[0157] The acquisition module 810 is used to acquire the device identification of the virtual machine instance; the device identification is generated based on the hash value and salt value corresponding to the instance password of the virtual machine instance stored locally;

[0158] A sending module 820 is used to send an authorization request message to an authorization center, wherein the authorization request message carries the device identifier and the salt value;

[0159] The receiving module 830 is used to receive an authorization success response message sent by the authorization center, wherein the authorization success response message carries authorization information.

[0160] In one embodiment, the acquisition module 810 is specifically used to:

[0161] Obtaining a hash value and a salt value corresponding to the instance password of the virtual machine instance stored locally;

[0162] Concatenate the hash value and the salt value to obtain a concatenation result;

[0163] A hash value of the concatenation result is determined to obtain a device identifier of the virtual machine instance.

[0164] In an exemplary embodiment, Fig. 9 As shown, a virtual machine instance authorization device is provided, the device is applied to a virtual machine instance service platform, and the device includes: a generation module 910, a first sending module 920 and a second sending module 930; wherein,

[0165] A generating module 910, configured to generate an instance password of a virtual machine instance in response to a subscription request message;

[0166] A first sending module 920 is used to send a virtual machine instance creation request message to the cloud platform, wherein the virtual machine instance creation request message carries the instance password and parameter information of the virtual machine instance, and is used to instruct the cloud platform to create a virtual machine instance including the instance password based on the parameter information;

[0167] The second sending module 930 is used to send an authorization message to the authorization center, wherein the authorization message carries the authorization information of the virtual machine instance and the instance password, and is used to instruct the authorization center to store the corresponding relationship between the authorization information and the instance password.

[0168] In one embodiment, the generating module 910 is specifically used for:

[0169] Generate a serial number for the virtual machine instance and generate an initial password using a random algorithm;

[0170] An instance password of the virtual machine instance is generated based on the number identifier and the initial password.

[0171] Each module in the authorization device of the above virtual machine instance can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0172] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Fig.10 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a method for authorizing a virtual machine instance is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0173] Those skilled in the art will understand that Fig.10 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0174] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of the above-mentioned virtual machine instance authorization method when executing the computer program.

[0175] In one embodiment, a cloud service system is provided, which includes a virtual machine instance service platform, a cloud platform, an authorization center and a virtual machine instance; wherein the virtual machine instance service platform, the cloud platform, the authorization center and the virtual machine instance implement the steps of the above-mentioned virtual machine instance authorization method.

[0176] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above-mentioned virtual machine instance authorization method are implemented.

[0177] In one embodiment, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the steps of the above-mentioned virtual machine instance authorization method are implemented.

[0178] It should be noted that the user information (including but not limited to user device identification, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0179] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0180] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0181] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for authorizing a virtual machine instance, characterized in that: The method is applied to an authorization center and comprises: Receive an authorization request message sent by a virtual machine instance, wherein the authorization request message carries a salt value and a first device identifier of the virtual machine instance; Determine whether there is a target instance password in the instance password corresponding to the authorization information in the unissued state; the second device identifier generated by the target instance password and the salt value matches the first device identifier; In the case where the target instance password exists, determining the target authorization information corresponding to the target instance password based on the correspondence between the locally stored authorization information and the instance password; The issuing status of the target authorization information is updated to an issued status, and an authorization success response message is sent to the virtual machine instance, wherein the authorization success response message carries the target authorization information.

2. The method according to claim 1, characterized in that The method further comprises: In the absence of the target instance password, an authorization failure response message is sent to the virtual machine instance.

3. The method according to claim 1, characterized in that The determining whether the target instance password exists in the instance password corresponding to the authorization information in the unissued state includes: According to a preset sorting strategy, the instance passwords in the instance password list are sorted, wherein the instance password list is used to store instance passwords corresponding to the authorization information that has not been issued; Starting from the first instance password, based on the instance password and the salt value, determining a second device identifier corresponding to the instance password; If the second device identifier matches the first device identifier, determining that the instance password is the target instance password; If the second device identifier does not match the first device identifier, the next instance password is polled until the last instance password is polled.

4. A method for authorizing a virtual machine instance, characterized in that: The method is applied to a virtual machine instance, and the method comprises: Obtaining a device identifier of the virtual machine instance; the device identifier is generated based on a hash value and a salt value corresponding to an instance password of the virtual machine instance stored locally; Sending an authorization request message to an authorization center, wherein the authorization request message carries the device identifier and the salt value; An authorization success response message sent by the authorization center is received, wherein the authorization success response message carries authorization information.

5. The method according to claim 4, characterized in that The obtaining of the device identification of the virtual machine instance includes: Obtaining a hash value and the salt value corresponding to the instance password of the virtual machine instance stored locally; Concatenate the hash value and the salt value to obtain a concatenation result; A hash value of the concatenation result is determined to obtain a device identifier of the virtual machine instance.

6. A method for authorizing a virtual machine instance, characterized in that: The method is applied to a virtual machine instance service platform, and the method comprises: In response to the order request message, generate an instance password for the virtual machine instance; Sending a virtual machine instance creation request message to the cloud platform, wherein the virtual machine instance creation request message carries the instance password and parameter information of the virtual machine instance, and is used to instruct the cloud platform to create a virtual machine instance including the instance password based on the parameter information; An authorization message is sent to an authorization center, wherein the authorization message carries the authorization information of the virtual machine instance and the instance password, and is used to instruct the authorization center to store the corresponding relationship between the authorization information and the instance password.

7. The method according to claim 6, characterized in that The step of generating an instance password of a virtual machine instance includes: Generate a serial number for the virtual machine instance and generate an initial password using a random algorithm; An instance password of the virtual machine instance is generated based on the number identifier and the initial password.

8. An authorization device for a virtual machine instance, characterized in that: The device is applied to an authorization center, and comprises: A receiving module, configured to receive an authorization request message sent by a virtual machine instance, wherein the authorization request message carries a salt value and a first device identifier of the virtual machine instance; A first determination module is used to determine whether there is a target instance password in the instance password corresponding to the authorization information in an unissued state; the second device identifier generated by the target instance password and the salt value matches the first device identifier; A second determination module is used to determine the target authorization information corresponding to the target instance password based on the correspondence between the locally stored authorization information and the instance password when the target instance password exists; The first sending module is used to update the sending status of the target authorization information to a sent status, and send an authorization success response message to the virtual machine instance, wherein the authorization success response message carries the target authorization information.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the processor implements the steps of the method according to any one of claims 1 to 3, claims 4 to 5, or claims 6 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method of any one of claims 1 to 3, or claims 4 to 5, or claims 6 to 7 are implemented.

Images