Cloud application authentication method, device and equipment based on cloud account

Abstract

The invention provides a cloud application authentication method, device and equipment based on a cloud account, and a storage medium, and relates to various scenes such as cloud technology, artificial intelligence, intelligent traffic, auxiliary driving and the like. The method comprises the following steps: calling a cloud API (Application Program Interface) through cloud account information of a user; obtaining an identifier of a first cloud application and first request information through the cloud API, wherein the first request information comprises operation information which is requested by a user and aims at the first cloud application; affiliation authentication is carried out on the first cloud application through the cloud account information of the user, and after the affiliation authentication of the first cloud application is completed, a public network access address and a signature key of a user API gateway are acquired from an authentication database; and the signature key of the user API gateway is used to sign the first request information, and the signed first request information is sent to the application server through the public network access address of the user API gateway. According to the method and the device, the complexity of cloud application authentication management is reduced, and the cloud application does not need to be subjected to adaptive authentication transformation.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of cloud computing technology, and in particular to cloud account systems and cloud application authentication technologies. More specifically, the present application provides a cloud application authentication method, apparatus, device, and storage medium based on cloud accounts. Background Art

[0002] With the rapid development of cloud computing, cloud platforms can provide computing, network and storage capabilities. Users can use the capabilities of cloud platforms to build their own cloud applications, such as backend management, resource operation and maintenance, etc. At the same time, cloud applications are increasingly involving information security issues. Therefore, when users want to access cloud applications, they need to be authenticated first to determine whether they have the authority to access cloud applications.

[0003] In the related art, when a user wants to access a cloud application, the cloud application needs to authenticate the user first to determine whether the user has the authority to access the cloud application. In this mode, if there are multiple cloud applications, an authentication process needs to be designed for each cloud application. The repeated design of the authentication process is relatively large, and the authentication management process is relatively complicated. In addition, when designing the authentication process for the cloud application, the cloud application needs to be modified to adapt to user authentication, which increases the difficulty of developing the cloud application. Summary of the invention

[0004] The present application provides a cloud application authentication method, apparatus, device and storage medium based on cloud accounts, which can realize user authentication of cloud applications based on cloud accounts, and can realize safe, convenient and complete cloud application authentication management, thereby reducing the complexity of cloud application authentication management, and there is no need to adapt the authentication to the cloud application, and the cost of cloud application access is relatively low.

[0005] In a first aspect, an embodiment of the present application provides a cloud application authentication method based on a cloud account, which is applied to an authentication server, and the method includes:

[0006] Call the cloud API through the user's cloud account information;

[0007] Obtaining, through the cloud API, an identifier of a first cloud application and first request information, wherein the first request information includes operation information requested by the user for the first cloud application;

[0008] Performing attribution authentication on the first cloud application through the cloud account information of the user, and after completing the attribution authentication on the first cloud application, obtaining the public network access address and signature key of the user API gateway corresponding to the first cloud application from the authentication database;

[0009] The first request information is signed using the signature key of the user API gateway, and the signed first request information is sent to the application server corresponding to the first cloud application through the public network access address of the user API gateway.

[0010] In a second aspect, an embodiment of the present application provides a cloud application authentication method based on a cloud account, which is applied to a client, and the method includes:

[0011] After the user logs in to the cloud platform by inputting cloud account information and is routed to the client through an access link, calling the cloud API through an internal call, wherein the access link includes an identification field of the first cloud application;

[0012] Sending a second request message to the authentication server through the cloud API, wherein the second request message includes an identifier of the first cloud application, and the second request message is used to request a COS address of a page resource file of the client;

[0013] The COS address of the page resource file of the client is obtained from the authentication server through the cloud API, and the page of the client is rendered through the page resource file of the client.

[0014] In a third aspect, an embodiment of the present application provides a cloud application authentication device based on a cloud account, including:

[0015] A calling unit, used to call a cloud API through the user's cloud account information;

[0016] an acquiring unit, configured to acquire, through the cloud API, an identifier of a first cloud application and first request information, wherein the first request information includes operation information requested by the user for the first cloud application;

[0017] an authentication unit, configured to authenticate the ownership of the first cloud application through the cloud account information of the user, and after completing the authentication of the ownership of the first cloud application, the acquisition unit is further configured to acquire the public network access address and signature key of the user API gateway corresponding to the first cloud application from the authentication database;

[0018] A signing unit, configured to sign the first request information using a signing key of the user API gateway; and

[0019] A sending unit is used to send the signed first request information to the application server corresponding to the first cloud application through the public network access address of the user API gateway.

[0020] In a fourth aspect, an embodiment of the present application provides a cloud application authentication device based on a cloud account, comprising:

[0021] a calling unit, configured to call the cloud API by an internal calling method after the user logs into the cloud platform by inputting cloud account information and is routed to the client through an access link, wherein the access link includes an identification field of the first cloud application;

[0022] A sending unit, configured to send a second request message to the authentication server through the cloud API, wherein the second request message includes an identifier of the first cloud application, and the second request message is used to request a cloud object storage COS address of a page resource file of the client;

[0023] an acquisition unit, configured to acquire a COS address of a page resource file of the client from the authentication server through the cloud API; and

[0024] A rendering unit is used to render the page of the client through the page resource file of the client.

[0025] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising: a processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory, and executing the method in the first aspect or the second aspect.

[0026] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, comprising instructions, which, when executed on a computer, enables the computer to execute a method as in the first aspect or the second aspect.

[0027] In a seventh aspect, an embodiment of the present application provides a computer program product, comprising computer program instructions, which enable a computer to execute a method as in the first aspect or the second aspect.

[0028] In an eighth aspect, an embodiment of the present application provides a computer program, which enables a computer to execute the method in the first aspect or the second aspect.

[0029] The embodiment of the present application calls the cloud API through the user's cloud account information, and then obtains the identification of the first cloud application and the first request information through the cloud API, wherein the first request information includes the operation information requested by the user for the first cloud application, and after completing the attribution authentication of the first cloud application through the user's cloud account information, obtains the public network access address and signature key of the user API gateway corresponding to the first cloud application from the authentication database, and then uses the signature key of the user API gateway to sign the first request information, and sends the signed first request information to the application server corresponding to the first cloud application through the public network access address of the user API gateway. Specifically, the authentication server can be exposed in the form of a cloud API, so that the authentication management of the cloud application can be realized based on the user's cloud account, and safe, convenient and complete cloud application authentication management can be realized, which reduces the complexity of cloud application authentication management, and does not require the cloud application to be adapted for authentication, and the cost of cloud application access is low. In addition, the technical solution of the present application can quickly obtain the same authentication management capabilities as the cloud account system. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0031] Figure 1 A schematic diagram of an application scenario of the solution of an embodiment of the present application;

[0032] Figure 2 A schematic flow chart of a cloud application authentication method based on a cloud account according to an embodiment of the present application;

[0033] Figure 3 is a schematic flow chart of calling a cloud API according to an embodiment of the present application;

[0034] Figure 4 A schematic diagram of a cloud application authentication architecture to which the embodiments of the present application may be applied;

[0035] Figure 5 A schematic diagram of a client page calling an application server through a cloud platform proxy according to an embodiment of the present application;

[0036] Figure 6 A schematic diagram of an authentication server performing cloud application authentication according to an embodiment of the present application;

[0037] Figure 7is a schematic diagram of recording information related to a first cloud application in an authentication database according to an embodiment of the present application;

[0038] Figure 8 is a schematic flow chart of obtaining information related to a first cloud application according to an embodiment of the present application;

[0039] Fig. 9 is a schematic diagram of obtaining information related to a first cloud application according to an embodiment of the present application;

[0040] Fig.10 It is a schematic flow chart of feeding back the COS address of the page resource file of the client to the client according to an embodiment of the present application;

[0041] Fig.11 A schematic diagram of a client executing cloud application authentication according to an embodiment of the present application;

[0042] Fig.12 is a schematic flow chart of another cloud application authentication method based on a cloud account according to an embodiment of the present application;

[0043] Fig.13 A schematic block diagram of a cloud application authentication device based on a cloud account according to an embodiment of the present application;

[0044] Fig.14 is a schematic block diagram of another cloud application authentication device based on a cloud account according to an embodiment of the present application;

[0045] Fig.15 is a schematic block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0046] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0047] It should be understood that in the embodiment of the present application, "B corresponding to A" means that B is associated with A. In one implementation, B can be determined based on A. However, it should also be understood that determining B based on A does not mean determining B based only on A, and B can also be determined based on A and / or other information.

[0048] In the description of the present application, unless otherwise specified, "at least one" means one or more, and "plurality" means two or more than two. In addition, "and / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0049] It should also be understood that the first, second, etc. descriptions appearing in the embodiments of the present application are only used for illustration and distinction of the description objects, without any distinction of order, nor do they indicate any special limitation on the number of devices in the embodiments of the present application, and cannot constitute any limitation on the embodiments of the present application.

[0050] It should also be understood that the specific features, structures or characteristics related to the embodiments in the specification are included in at least one embodiment of the present application. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner.

[0051] In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such process, method, product, or device.

[0052] In order to facilitate a better understanding of the embodiments of the present application, the terms related to the present application are explained.

[0053] Cloud Virtual Machine (CVM) is a simple, efficient, secure, reliable, and elastically scalable computing service for cloud computing. It is a simulated server on which customers can install and run operating systems and applications.

[0054] Cloud Object Storage (COS) is a distributed storage service for storing massive files. Users can store and view data at any time through the network. COS enables users to use highly scalable, low-cost, reliable and secure data storage services. COS can be easily and quickly accessed through a variety of methods such as consoles, APIs, SDKs and tools, realizing the storage and management of massive data. COS can be used to upload, download and manage files of any format.

[0055] A Virtual Private Cloud (VPC) is a cloud computing service in which a public cloud provider isolates specific parts of its public cloud infrastructure for private use. The VPC infrastructure is managed by the public cloud provider, but the resources allocated to it are not shared with other customers.

[0056] Public Cloud usually refers to the cloud provided by cloud service providers for users to use. Public Cloud is generally available through the Internet and may be free or low-cost. The core attribute of Public Cloud is shared resource services. There are many instances of this cloud, which can provide services in the entire open public network today.

[0057] Cloud account system: Cloud Access Management (CAM) provides the main account, sub-account, access key and related permission management capabilities. CAM is a user and permission management system provided by cloud service providers, which can achieve refined management of access to cloud products and resources. CAM can achieve access control to resources, support enterprise directory single sign-on, secondary identity verification and other application scenarios.

[0058] Cloud primary account UIN: the unique identifier of the cloud service provider account.

[0059] Cloud API: The cloud service provider's own standard application programming interface (API) calling solution, using the cloud account system for permission management.

[0060] Cloud API Gateway: API hosting service provided by cloud service providers to users, providing security authentication capabilities.

[0061] Cloud applications: applications deployed by users on the cloud.

[0062] The embodiments of the present application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, assisted driving, etc.

[0063] The embodiments of the present application can be applied to the field of cloud technology, where cloud technology refers to a hosting technology that unifies hardware, software, network and other resources within a wide area network or a local area network to achieve data computing, storage, processing and sharing.

[0064] Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, application technology, etc. based on the cloud computing business model. It can form a resource pool, which can be used on demand and is flexible and convenient. Cloud computing technology will become an important support. The backend services of the technical network system require a large amount of computing and storage resources, such as video websites, picture websites and more portal websites. With the rapid development and application of the Internet industry, in the future, each item may have its own identification mark, which needs to be transmitted to the backend system for logical processing. Data of different levels will be processed separately. All kinds of industry data need strong system backing support, which can only be achieved through cloud computing.

[0065] The embodiments of the present application can be applied to the field of cloud computing in cloud technology, wherein cloud computing refers to the delivery and use mode of IT infrastructure, which means obtaining required resources through the network in an on-demand and easily scalable manner; cloud computing in a broad sense refers to the delivery and use mode of services, which means obtaining required services through the network in an on-demand and easily scalable manner. Such services can be IT and software, Internet-related, or other services. Cloud computing is the product of the development and integration of traditional computer and network technologies such as grid computing, distributed computing, parallel computing, utility computing, network storage technologies, virtualization, and load balancing.

[0066] With the development of the Internet, real-time data streams, and the diversification of connected devices, as well as the demand for search services, social networks, mobile commerce, and open collaboration, cloud computing has developed rapidly. Different from the previous parallel distributed computing, the emergence of cloud computing will promote revolutionary changes in the entire Internet model and enterprise management model from a conceptual perspective.

[0067] The embodiments of the present application can be applied to the field of cloud security in cloud technology, where cloud security refers to the general term for security software, hardware, users, organizations, and security cloud platforms based on cloud computing business model applications. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and unknown virus behavior judgment. Through a large number of meshed clients, it monitors the abnormal behavior of software in the network, obtains the latest information of Trojans and malicious programs on the Internet, and sends it to the server for automatic analysis and processing, and then distributes virus and Trojan solutions to each client.

[0068] The main research directions of cloud security include: 1. Cloud computing security, which mainly studies how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of user data, user access authentication, information transmission security, network attack protection, compliance auditing, etc.; 2. Cloudification of security infrastructure, which mainly studies how to use cloud computing to build and integrate security infrastructure resources and optimize security protection mechanisms, including building a large-scale security event, information collection and processing platform through cloud computing technology, realizing the collection and correlation analysis of massive information, and improving the control ability of security events and risk control capabilities of the entire network; 3. Cloud security services, which mainly studies various security services provided to users based on cloud computing platforms, such as antivirus services.

[0069] The embodiments of the present application can also be applied to the field of artificial intelligence technology.

[0070] Among them, artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that machines have the functions of perception, reasoning and decision-making.

[0071] Artificial intelligence technology is a comprehensive discipline that covers a wide range of fields, including both hardware-level and software-level technologies. The basic technologies of artificial intelligence generally include sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics and other technologies. Artificial intelligence software technology mainly includes computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0072] With the research and advancement of artificial intelligence technology, artificial intelligence technology has been studied and applied in many fields, such as common smart homes, smart wearable devices, virtual assistants, smart speakers, smart marketing, unmanned driving, automatic driving, drones, robots, smart medical care, smart customer service, etc. I believe that with the development of technology, artificial intelligence technology will be applied in more fields and play an increasingly important role.

[0073] In the related art, when a user wants to access a cloud application, the cloud application needs to authenticate the user first to determine whether the user has the authority to access the cloud application. In this mode, if there are multiple cloud applications, an authentication process needs to be designed for each cloud application. The repeated design of the authentication process is relatively large, and the authentication management process is relatively complicated. In addition, when designing an authentication process for a cloud application, the cloud application needs to be modified to adapt to user authentication, which increases the difficulty of developing the cloud application.

[0074] In view of this, the embodiments of the present application provide a cloud application authentication method, apparatus, device and storage medium based on cloud accounts, which can implement user authentication of cloud applications based on cloud accounts, and can achieve safe, convenient and complete cloud application authentication management, thereby reducing the complexity of cloud application authentication management, and there is no need to adapt the authentication to the cloud application, and the cost of cloud application access is relatively low.

[0075] Specifically, the cloud API can be called through the user's cloud account information; the identification of the first cloud application and the first request information can be obtained through the cloud API, wherein the first request information includes the operation information requested by the user for the first cloud application; after completing the attribution authentication of the first cloud application through the user's cloud account information, the public network access address and signature key of the user API gateway corresponding to the first cloud application are obtained from the authentication database; the first request information is signed using the signature key of the user API gateway, and the signed first request information is sent to the application server corresponding to the first cloud application through the public network access address of the user API gateway. Optionally, the cloud account information includes one of the following: a cloud master account and key, a cloud sub-account and key.

[0076] The embodiment of the present application calls the cloud API through the user's cloud account information, and then obtains the identification of the first cloud application and the first request information through the cloud API, wherein the first request information includes the operation information requested by the user for the first cloud application, and after completing the attribution authentication of the first cloud application through the user's cloud account information, obtains the public network access address and signature key of the user API gateway corresponding to the first cloud application from the authentication database, and then uses the signature key of the user API gateway to sign the first request information, and sends the signed first request information to the application server corresponding to the first cloud application through the public network access address of the user API gateway. Specifically, the authentication server can be exposed in the form of a cloud API, so that the authentication management of the cloud application can be realized based on the user's cloud account, which can realize safe, convenient and complete cloud application authentication management, reduce the complexity of cloud application authentication management, and do not need to adapt the authentication to the cloud application, and the cost of cloud application access is low. In addition, the technical solution of the present application can quickly obtain the same authentication management capabilities as the cloud account system.

[0077] The embodiments of the present application can be used for authentication of various cloud applications, including but not limited to cloud applications for service expansion and contraction, operation monitoring, data backup and export, and cloud applications of types such as background management, resource operation and maintenance, etc. For example, the cloud applications used in the embodiments of the present application can be: web applications or backend service applications deployed on the cloud that do not implement login / authentication capabilities themselves and need to have access authentication capabilities, especially cloud applications of operation and maintenance management.

[0078] For example, a typical application scenario is as follows: an enterprise deploys application [A] on the cloud. Behind application [A], there may be several cloud applications for internal operation and maintenance management that serve application [A], such as [A-service monitoring and management system]. The administrator or developer of the enterprise needs to log in to these cloud applications for internal operation and maintenance management to complete some operations, such as service expansion and contraction, operation monitoring, data backup and export, etc.

[0079] This type of operation and maintenance management application has the following characteristics:

[0080] ① An independent access authentication account system is required;

[0081] ② The users are usually the same as those who manage cloud resources, and they will use cloud accounts themselves;

[0082] ③Operation and maintenance applications themselves may need to operate cloud resources, that is, the user who logs into the application also needs to have the authority to operate cloud resources.

[0083] Therefore, it can be applied to the embodiments of the present application, that is, the authentication of such cloud applications for internal operation and maintenance management can be realized based on cloud accounts. The authentication server can be exposed in the form of cloud API, so that the authentication management of cloud applications can be realized based on the user's cloud account, which can realize safe, convenient and complete cloud application authentication management, reduce the complexity of cloud application authentication management, and do not need to adapt the authentication to the cloud application, so the cost of cloud application access is low.

[0084] Figure 1 A schematic diagram showing an application scenario of an embodiment of the present application.

[0085] like Figure 1 As shown, the application scenario involves an authentication server 1, a client 2 and an application server 3, which can implement authentication management of cloud application A. Among them, the authentication server 1 can be a server deployed on the cloud for implementing the authentication function, such as the authentication server 1 is a cloud server, the client 2 can be a client corresponding to the cloud application A, and the application server 3 can be an application server corresponding to the cloud application A. It should be noted that the client 2 can also be called the front-end device or front-end page of the cloud application A, and the application server 3 can also be called the back-end server of the cloud application A. That is, the application server 3 can be the back-end application server of the client 2.

[0086] Specifically, after the user logs in to the cloud platform, the authentication server 1 can be routed to the client 2 page (i.e., the front-end page) through the access link specified by the cloud platform (containing the identification field of cloud application A), and the client 2 can call the application server 3 through the cloud platform agent to complete the user operation.

[0087] Exemplarily, after cloud application A is connected, authentication server 1 will generate a unique application identifier (Identity, ID) (i.e., cloud master account UIN), such as app-56piv506; when the user uses cloud application A, after logging in to the cloud platform through the cloud account (cloud master account + key or cloud sub-account + key), the client 2 page (i.e., the front-end page of cloud application A) can be loaded through the access link specified by the cloud platform (including the identification field of cloud application A (i.e., app-56piv506)), such as the access link specified by the cloud platform: https: / / console.cloud.com / app / run / app-56piv506; the client 2 page (i.e., the front-end page of cloud application A) will call application server 3 (i.e., the application back-end server) through the cloud platform agent to complete the user operation.

[0088] Exemplarily, when creating cloud application A, authentication server 1 generates an identifier of cloud application A; and authentication server 1 can obtain the cloud account information of the user corresponding to cloud application A and the intranet address of the application server corresponding to cloud application A (i.e., application server 3) from the developer of cloud application A; authentication server 1 can create a user API gateway corresponding to cloud application A (including the public network access address and signature key of the user API gateway) under the VPC to which the intranet address of the application server corresponding to cloud application A (i.e., application server 3) belongs. Further, authentication server 1 records the identifier of cloud application A, the cloud account information of the user corresponding to cloud application A, the public network access address and signature key of the user API gateway corresponding to cloud application A in the authentication database. Optionally, authentication server 1 can further obtain the client (i.e., client 2) page resource file (for rendering) corresponding to cloud application A from the developer of cloud application A, authentication server 1 can store the client (i.e., client 2) page resource file corresponding to cloud application A in the COS of authentication server 1, and record the COS address of the client (i.e., client 2) page resource file corresponding to cloud application A in the authentication database.

[0089] Exemplarily, first, the authentication server 1 calls the cloud API through the user's cloud account information; then, the authentication server 1 obtains the identifier of cloud application A and request information 1 (which may be a custom request parameter) through the cloud API, wherein the request information 1 includes the operation information requested by the user for cloud application A; after completing the attribution authentication of cloud application A through the user's cloud account information (after attribution authentication, the relevant information of cloud application A can be obtained from the authentication database), the authentication server 1 obtains the public network access address and signature key of the user API gateway corresponding to cloud application A from the authentication database; then, the authentication server 1 signs the request information 1 using the signature key of the user API gateway corresponding to cloud application A, and sends the signed request information 1 to the application server corresponding to cloud application A (i.e., application server 3) through the public network access address of the user API gateway corresponding to cloud application A. Further, after the signed request information 1 arrives at the user API gateway corresponding to cloud application A, a signature verification will be performed, and after the verification passes, the request information 1 will be forwarded to the application server corresponding to cloud application A (i.e., application server 3). Optionally, the authentication server 1 may obtain a response message from the application server corresponding to the cloud application A (ie, the application server 3 ) to the request information 1 through the user API gateway corresponding to the cloud application A.

[0090] Exemplarily, after the user logs in to the cloud platform by entering the cloud account information, the authentication server 1 obtains the cloud API key through an internal call, and calls the cloud API through the cloud API key; alternatively, the authentication server 1 directly calls the cloud API through the user's cloud account information.

[0091] Exemplarily, after the user logs in to the cloud platform by inputting the cloud account information, the authentication server 1 routes to the client (i.e., client 2) page corresponding to the cloud application A through the access link, wherein the access link includes the identification field of the cloud application A; then the authentication server 1 obtains the request information 2 from the client 2 through the cloud API, wherein the request information 2 is used to request the COS address of the page resource file of the client 2; after completing the attribution authentication of the cloud application A through the user's cloud account, the authentication server 1 obtains the COS address of the page resource file of the client 2 from the authentication database; the authentication server 1 feeds back the COS address of the page resource file of the client 2 to the client 2 through the cloud API. Further, the client 2 can obtain the COS address of the page resource file of the client 2 from the authentication server 1 through the cloud API, so that the client 2 can obtain the page resource file of the client 2 through the COS address of the page resource file of the client 2, and render the page of the client 2 through the page resource file of the client 2.

[0092] For example, the client 2 may refer to a type of device that has a rich human-computer interaction mode, has the ability to access the Internet, is usually equipped with various operating systems, and has strong processing capabilities. The client 2 may be a terminal device such as a smart phone, a tablet computer, a portable laptop, a desktop computer, a wearable device, a vehicle-mounted device, etc., but is not limited thereto.

[0093] Exemplarily, the authentication server 1 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. The authentication server 1 can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms. The authentication server 1 can also become a node of the blockchain.

[0094] The authentication server 1 may be one or more. When there are multiple authentication servers 1, there are at least two authentication servers 1 for implementing authentication management of different cloud applications, and / or there are at least two authentication servers 1 for implementing authentication management of the same cloud application, such as implementing authentication management of the same cloud application in a load balancing manner, which is not limited in the embodiments of the present application.

[0095] This application does not limit the number of authentication servers or clients. The solution provided by this application can be completed by the authentication server independently, or by the client independently, or by the authentication server and the client in cooperation, and this application does not limit this.

[0096] It should be understood that Figure 1This is only an exemplary description and does not specifically limit the application scenarios of the embodiments of the present application. Figure 1 An authentication server, a client, and an application server are shown by way of example. In practice, other numbers of authentication servers, clients, and application servers may be included, and this application does not impose any limitation on this.

[0097] The technical solutions of the embodiments of the present application are described in detail below through some embodiments. The following embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0098] Figure 2 FIG. 2 is a schematic flow chart of a cloud application authentication method 200 implemented based on a cloud account according to an embodiment of the present application. The cloud application authentication method 200 implemented based on a cloud account can be executed by any electronic device having a cloud application authentication capability. For example, the electronic device can be implemented as an authentication server, for example, can be implemented as Figure 1 The authentication server 1 in the present application is not limited to this. The following is an example of the authentication server executing the cloud application authentication method 200 based on the cloud account. Figure 2 As shown, the cloud application authentication method 200 based on cloud account implementation includes part or all of S210 to S240. It should be understood that Figure 2 The steps or operations shown are only examples, and the present application embodiment may also perform other operations or Figure 2 Variations of the various operations in .

[0099] S210, calling a cloud API through the user's cloud account information.

[0100] Specifically, after calling the cloud API, information can be exchanged with the client through the cloud API, that is, the authentication server can be exposed to the client in the form of a cloud API.

[0101] In some embodiments, the cloud account information includes one of the following: a cloud master account and key, a cloud sub-account and key.

[0102] For example, a cloud sub-account can be generated based on a cloud master account, or a cloud sub-account can be associated with a cloud master account (i.e., the cloud sub-account and the cloud master account can call each other). Optionally, application users and application developers can correspond to the same cloud master account, or to different cloud sub-accounts.

[0103] In some embodiments, see Figure 3 , the cloud API can be called through the following S211.

[0104] S211, after the user logs in to the cloud platform by inputting the cloud account information, the cloud API key is obtained through an internal call method, and the cloud API is called through the cloud API key; or, the cloud API is directly called through the user's cloud account information.

[0105] Specifically, after the user logs in to the cloud platform by entering the cloud account information, the authentication server can obtain the cloud API key through internal calling. That is, in the logged-in state, the cloud platform can internally exchange the cloud API key and call the cloud API through the cloud API key.

[0106] Specifically, the authentication server can directly call the cloud API through the user's cloud account information (without logging into the cloud platform), that is, the cloud API can be directly called through the user's cloud account information in any scenario (without logging into the cloud platform). In this scenario, the cloud API key is known to the user and does not need to be obtained again.

[0107] S220, obtaining an identifier of a first cloud application and first request information through a cloud API, wherein the first request information includes operation information requested by a user for the first cloud application.

[0108] Specifically, the authentication server can obtain the identifier of the first cloud application and the first request information from the client through the cloud API, that is, the user needs to pass the identifier of the first cloud application and the first request information when calling the cloud API. Exemplarily, the first request information can be a custom request parameter.

[0109] In some embodiments, the first cloud application may include but is not limited to cloud applications for service expansion and contraction, operation monitoring, data backup and export, etc., such as cloud applications of the types of background management, resource operation and maintenance management, etc. Exemplarily, the first cloud application may be: a web application or backend service application that is deployed on the cloud and does not implement login / authentication capabilities itself, and needs to have access authentication capabilities, especially cloud applications of the types of background management, resource operation and maintenance management, etc.

[0110] S230, authenticate the ownership of the first cloud application through the user's cloud account information, and after completing the ownership authentication of the first cloud application, obtain the public network access address and signature key of the user API gateway corresponding to the first cloud application from the authentication database.

[0111] Exemplarily, when the first cloud application is accessed, the authentication server may record the user's cloud account information, the public network access address and signature key of the user API gateway corresponding to the first cloud application in the authentication database, so that the first cloud application can be authenticated through the user's cloud account (cloud main account or cloud sub-account). After the authentication, the public network access address and signature key of the user API gateway corresponding to the first cloud application can be obtained from the authentication database.

[0112] S240, using the signature key of the user API gateway to sign the first request information, and sending the signed first request information to the application server corresponding to the first cloud application through the public network access address of the user API gateway.

[0113] Specifically, the calling method of the application server corresponding to the first cloud application can be exposed to the user through the user API gateway, that is, the authentication server can exchange information with the application server corresponding to the first cloud application through the user API gateway. Exemplarily, when calling the cloud API, the user needs to pass the identification of the first cloud application and the first request information. After authentication and forwarding based on the cloud account system in the middle layers, the first request information is sent to the application server corresponding to the first cloud application through the user API gateway corresponding to the first cloud application, and the response content of the application server corresponding to the first cloud application to the first request information is forwarded back through the user API gateway corresponding to the first cloud application.

[0114] Exemplarily, first, the authentication server calls the cloud API through the user's cloud account information (such as the cloud master account and key or the cloud sub-account and key); then the authentication server obtains the identifier of the first cloud application and the first request information (which may be a custom request parameter) through the cloud API, wherein the first request information includes the operation information requested by the user for the first cloud application; after completing the attribution authentication of the first cloud application through the user's cloud account information (after the attribution authentication, the relevant information of the first cloud application can be obtained from the authentication database), the authentication server obtains the public network access address and signature key of the user API gateway corresponding to the first cloud application from the authentication database; then, the authentication server signs the first request information using the signature key of the user API gateway corresponding to the first cloud application, and sends the signed first request information to the application server corresponding to the first cloud application through the public network access address of the user API gateway corresponding to the first cloud application. Further, after the signed first request information arrives at the user API gateway corresponding to the first cloud application, a signature verification will be performed, and after the verification passes, the first request information will be forwarded to the application server corresponding to the first cloud application. Optionally, the authentication server may obtain a response message from the application server corresponding to the first cloud application to the first request information through a user API gateway corresponding to the first cloud application.

[0115] In some embodiments, the cloud application authentication architecture to which the embodiments of the present application can be applied can be as follows: Figure 4As shown, the cloud account (cloud master account or cloud sub-account) can support the CAM permission system, the authentication service page can be exposed to the client through the cloud API, and the application server can expose the authentication service page through the user API gateway. The user can log in to the cloud platform through the cloud master account and key or the cloud sub-account and key. The client page will call the application server (i.e., the application backend server) corresponding to the first cloud application through the cloud platform agent to complete the user operation.

[0116] Exemplarily, after the first cloud application is connected, the authentication server will generate a unique application ID (i.e., cloud master account UIN), such as app-56piv506; when the user uses the first cloud application, after logging in to the cloud platform through the cloud account (cloud master account + key or cloud sub-account + key), the client page (i.e., the front-end page of the first cloud application) can be loaded through the access link specified by the cloud platform (including the identification field of the first cloud application (i.e., app-56piv506)), such as the access link specified by the cloud platform: https: / / console.cloud.com / app / run / app-56piv506; the client page (i.e., the front-end page of the first cloud application) will call the application server (i.e., the application back-end server) corresponding to the first cloud application through the cloud platform agent to complete the user operation.

[0117] In some embodiments, see Figure 5 The client page will call the application server corresponding to the first cloud application through the cloud platform proxy to complete the user operation. The backend service (i.e., the backend application server) can be exposed to the user through the cloud API. The cloud API can be called in the front-end page of the cloud platform through the login state, and can also be directly called in other scenarios through the cloud account access key. Among them, the user logs in to the cloud platform through the cloud master account and key or the cloud sub-account and key. The cloud account (cloud master account or cloud sub-account) can support the CAM permission system.

[0118] The embodiment of the present application calls the cloud API through the user's cloud account information, and then obtains the identification of the first cloud application and the first request information through the cloud API, wherein the first request information includes the operation information requested by the user for the first cloud application, and after completing the attribution authentication of the first cloud application through the user's cloud account information, obtains the public network access address and signature key of the user API gateway corresponding to the first cloud application from the authentication database, and then uses the signature key of the user API gateway to sign the first request information, and sends the signed first request information to the application server corresponding to the first cloud application through the public network access address of the user API gateway. Specifically, the authentication server can be exposed in the form of a cloud API, so that the authentication management of the cloud application can be realized based on the user's cloud account, which can realize safe, convenient and complete cloud application authentication management, reduce the complexity of cloud application authentication management, and do not need to adapt the cloud application for authentication, so the cost of cloud application access is relatively low.

[0119] In the examples of this application, see Figure 6 As shown, overall, the calling method of the application server will eventually be exposed to the user through a unified cloud API gateway. When calling the cloud API, the user needs to pass the cloud application ID and other custom request parameters. After several layers of authentication and forwarding, the custom request parameters will be sent to the user's application server, and the application server response content will be forwarded back. Exemplarily, the cloud application authentication process executed by the authentication server may include the following S11 to S14.

[0120] S11, the user can log in to the cloud account and call the cloud API internally in the client page under the cloud platform, or directly call the cloud API in any scenario through the cloud account and key.

[0121] S12, complete user identity authentication at the cloud API layer and transmit the user information (including at least the cloud account) to the authentication server.

[0122] S13, the authentication server completes the attribution authentication of the cloud application through the cloud account information, and after passing, the public network access address and signature key of the user API gateway of the cloud application can be obtained from the authentication database. Subsequently, the authentication server will sign the requested custom request parameters with the signature key of the user API gateway, and send the signed custom request parameters using the public network address of the user API gateway.

[0123] S14, after the signed custom request parameters arrive at the user API gateway, the signature verification will be performed and the custom request parameters will be forwarded to the application server.

[0124] In some embodiments, see Figure 7Before S210, the cloud application authentication method 200 implemented based on a cloud account may further include S250 to record information related to the first cloud application in an authentication database.

[0125] S250, record information related to the first cloud application in the authentication database; wherein the information related to the first cloud application includes an identifier of the first cloud application, cloud account information of a user corresponding to the first cloud application, a public network access address of a user API gateway corresponding to the first cloud application, and a signature key.

[0126] Specifically, information related to the first cloud application is recorded in the authentication database, so that the first cloud application can be authenticated based on the cloud account information of the user corresponding to the first cloud application.

[0127] Exemplarily, the user corresponding to the first cloud application may be a user of the first cloud application or a developer of the first cloud application.

[0128] In some embodiments, the information related to the first cloud application may also include a COS address of a client page resource file corresponding to the first cloud application. Thus, the client may extract the COS address of the client page resource file from the authentication database through the authentication server, obtain the client page resource file, and render the client page based on the COS address.

[0129] In some embodiments, see Figure 8 Before S250, the cloud application authentication method 200 implemented based on the cloud account may also include S260 to S280 to obtain information related to the first cloud application.

[0130] S260: When creating the first cloud application, generate an identifier of the first cloud application.

[0131] Specifically, when the developer creates the first cloud application, the authentication server generates an identifier (a unique application ID) of the first cloud application.

[0132] S270, obtaining from the developer of the first cloud application the cloud account information of the user corresponding to the first cloud application, the intranet address of the application server corresponding to the first cloud application, and the client page resource file corresponding to the first cloud application.

[0133] It should be noted that the client page resource file corresponding to the first cloud application is optional information, that is, when the information related to the first cloud application in the above S250 does not include the COS address of the client page resource file corresponding to the first cloud application, the authentication server may not need to obtain the client page resource file corresponding to the first cloud application from the developer.

[0134] S280, create a user API gateway corresponding to the first cloud application under the VPC to which the intranet address of the application server corresponding to the first cloud application belongs.

[0135] For details, see Fig. 9 When the developer creates the first cloud application, the authentication server will generate a unique application ID for the first cloud application. At the same time, it is necessary to upload the client page resource file corresponding to the first cloud application (optional), register the address of the backend application server, and register the cloud master account UIN to the authentication server.

[0136] like Fig. 9 As shown, the client page resource file corresponding to the first cloud application will be stored in the COS of the authentication server, and the corresponding COS address will be recorded in the authentication database after the upload is completed.

[0137] like Fig. 9 As shown, the address of the backend application server can be the intranet address for user services. After being submitted to the authentication server, the authentication server will create a user API gateway under the same VPC as the intranet of the user's backend application server (the function of the user API gateway is to provide a public network access address for the user's intranet service, and it needs to be signed and accessed through asymmetric encryption). After the creation is completed, the public network address and signature key of the user API gateway are recorded in the authentication database.

[0138] like Fig. 9 As shown, the cloud account (such as the cloud master account UIN) will be recorded in the authentication database as the owner of the first cloud application.

[0139] like Fig. 9 As shown, for the first cloud application, the authentication server records in the authentication database: the ID of the first cloud application, the cloud account information of the owner of the first cloud application, the COS address of the client page resource file corresponding to the first cloud application, the public network address and signature key of the user API gateway.

[0140] In some embodiments, see Fig.10 After S240, the cloud application authentication method 200 implemented based on the cloud account may further include S2001 to S2004 to feed back the COS address of the client's page resource file to the client.

[0141] S2001, after the user logs in to the cloud platform by inputting cloud account information, the access link is routed to the client corresponding to the first cloud application, wherein the access link includes an identification field of the first cloud application.

[0142] Specifically, when a user uses the first cloud application, after logging in to the cloud platform through a cloud account (cloud main account + key or cloud sub-account + key), the user can load the client page (i.e., the front-end page of the first cloud application) through the access link specified by the cloud platform (including the identification field of the first cloud application (such as app-56piv506)). For example, the access link specified by the cloud platform is: https: / / console.cloud.com / app / run / app-56piv506; the client page (i.e., the front-end page of the first cloud application) will call the application server (i.e., the application back-end server) corresponding to the first cloud application through the cloud platform agent to complete the user operation.

[0143] S2002, obtaining second request information from the client through the cloud API, wherein the second request information includes an identifier of the first cloud application, and the second request information is used to request a COS address of a page resource file of the client.

[0144] S2003, after completing the attribution authentication of the first cloud application through the user's cloud account information, obtain the COS address of the client's page resource file from the authentication database.

[0145] S2004, feeding back the COS address of the client's page resource file to the client through the cloud API.

[0146] Specifically, after obtaining the COS address of the client's page resource file, the client accesses the COS address of the client's page resource file to obtain the client's page resource file, so that the client page can be rendered based on the client's page resource file.

[0147] In the examples of this application, see Fig.11 As shown, the user needs to log in to the designated access link (including the ID of the first cloud application) of the cloud platform to enter the client page of the first cloud application. Exemplarily, the cloud application authentication process executed by the client may include the following S21 to S24.

[0148] S21, the user uses the cloud account information to log in to the cloud platform, and accesses the specified route under the cloud platform to the client page. The client page will use the internal call (using the user login state to exchange the key call) cloud API to pass the second request information to the authentication server, where the second request information includes the identifier of the first cloud application, and the second request information is used to request the authentication server to feedback the COS address of the client page resource file.

[0149] S22, the second request information will be authenticated at the cloud API layer. After the authentication is passed, the user identity information will be attached to the request and transmitted to the authentication server.

[0150] S23, the authentication server performs attribution authentication on the first cloud application according to the user identity information (i.e., the cloud main account or cloud sub-account). After the attribution authentication is passed, the COS address of the client page resource file of the first cloud application is searched in the authentication database, and the COS address of the client page resource file is fed back to the client.

[0151] S24, the client obtains the client page resource files based on the COS addresses of the client page resource files, then loads these files and renders the client page.

[0152] Therefore, in an embodiment of the present application, the cloud API can be called through the user's cloud account information, and then the identification of the first cloud application and the first request information are obtained through the cloud API, wherein the first request information includes the operation information requested by the user for the first cloud application, and after the attribution authentication of the first cloud application is completed through the user's cloud account information, the public network access address and signature key of the user API gateway corresponding to the first cloud application are obtained from the authentication database, and then the first request information is signed using the signature key of the user API gateway, and the signed first request information is sent to the application server corresponding to the first cloud application through the public network access address of the user API gateway. Specifically, the authentication server can be exposed in the form of a cloud API, so that the authentication management of the cloud application can be realized based on the user's cloud account, and safe, convenient and complete cloud application authentication management can be realized, which reduces the complexity of cloud application authentication management, and there is no need to adapt the authentication to the cloud application, and the cost of cloud application access is low. In addition, the technical solution of the present application can quickly obtain the same authentication management capabilities as the cloud account system.

[0153] Combination of the above Figures 2 to 11 , describes in detail the authentication server side embodiment of the present application, and the following is combined with Fig.12 , the client side embodiment of the present application is described in detail. It should be understood that the client side embodiment corresponds to the authentication server side embodiment, and similar descriptions can refer to the authentication server side embodiment.

[0154] Fig.12 FIG. 3 is a schematic flow chart of a cloud application authentication method 300 implemented based on a cloud account according to an embodiment of the present application. The cloud application authentication method 300 implemented based on a cloud account can be executed by any electronic device having a cloud application authentication capability. For example, the electronic device can be implemented as a client, for example, can be implemented as Figure 1 The client 2 in the present application is not limited to this. The following is an example of a client executing a cloud application authentication method 300 based on a cloud account. Fig.12 As shown, the cloud application authentication method 300 based on cloud account implementation includes part or all of S310 to S330. It should be understood that Fig.12The steps or operations shown are only examples, and the present application embodiment may also perform other operations or Fig.12 Variations of the various operations in .

[0155] S310, after the user logs in to the cloud platform by inputting cloud account information and is routed to the client through an access link, the cloud API is called through an internal call method, wherein the access link includes an identification field of the first cloud application.

[0156] For example, the cloud API key can be obtained through an internal call, and the cloud API can be called through the cloud API key. In this scenario, the cloud API key is known to the user and does not need to be obtained again.

[0157] In some embodiments, the cloud account information includes at least one of the following: a cloud master account and key, a cloud sub-account and key.

[0158] S320, sending a second request message to the authentication server through the cloud API, wherein the second request message includes an identifier of the first cloud application, and the second request message is used to request a COS address of a page resource file of the client.

[0159] S330, obtaining the COS address of the client's page resource file from the authentication server through the cloud API, and rendering the client's page through the client's page resource file.

[0160] Therefore, in the embodiment of the present application, the authentication server can be exposed in the form of a cloud API, so that the authentication management of cloud applications can be realized based on the user's cloud account, which can realize safe, convenient and complete cloud application authentication management, reduce the complexity of cloud application authentication management, and do not need to adapt the cloud application to authentication, so the cost of cloud application access is low. In addition, the technical solution of the present application can quickly obtain the same authentication management capability as the cloud account system.

[0161] The specific implementation modes of the present application are described in detail above in conjunction with the accompanying drawings. However, the present application is not limited to the specific details in the above implementation modes. Within the technical concept of the present application, the technical solution of the present application can be subjected to a variety of simple modifications, and these simple modifications all belong to the protection scope of the present application. For example, the various specific technical features described in the above specific implementation modes can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present application will not further explain various possible combinations. For another example, the various different implementation modes of the present application can also be arbitrarily combined, and as long as they do not violate the ideas of the present application, they should also be regarded as the contents disclosed in the present application.

[0162] It should also be understood that in the various method embodiments of the present application, the size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. It should be understood that these sequence numbers can be interchanged where appropriate, so that the embodiments of the present application described can be implemented in an order other than those shown or described.

[0163] The above describes the method embodiment of the present application in detail. Figures 13 to 15 , describe in detail the device embodiments of the present application.

[0164] Fig.13 4 is a schematic block diagram of a cloud application authentication device 400 implemented based on a cloud account in an embodiment of the present application. Fig.13 As shown, the cloud application authentication device 400 implemented based on a cloud account includes a calling unit 401 , an acquiring unit 402 , an authentication unit 403 , a signing unit 404 and a sending unit 405 .

[0165] The calling unit 401 is used to call the cloud API through the user's cloud account information;

[0166] The acquisition unit 402 is configured to acquire an identifier of a first cloud application and first request information through the cloud API, wherein the first request information includes operation information requested by the user for the first cloud application;

[0167] The authentication unit 403 is used to authenticate the first cloud application through the cloud account information of the user, and after completing the authentication of the first cloud application, the acquisition unit 402 is also used to obtain the public network access address and signature key of the user API gateway corresponding to the first cloud application from the authentication database after completing the authentication of the first cloud application;

[0168] The signing unit 404 is used to sign the first request information using the signing key of the user API gateway; and

[0169] The sending unit 405 is used to send the signed first request information to the application server corresponding to the first cloud application through the public network access address of the user API gateway.

[0170] In some embodiments, the calling unit 401 is specifically used to:

[0171] After the user logs in to the cloud platform by inputting the cloud account information, the key of the cloud API is obtained through an internal call, and the cloud API is called through the key of the cloud API; or,

[0172] The cloud API is directly called through the cloud account information of the user.

[0173] In some embodiments, before calling the cloud API through the cloud account information of the user, the cloud application authentication device 400 based on the cloud account further includes:

[0174] A recording unit 406, configured to record information related to the first cloud application in the authentication database;

[0175] The information related to the first cloud application includes an identifier of the first cloud application, cloud account information of a user corresponding to the first cloud application, and a public network access address and a signature key of the user API gateway corresponding to the first cloud application.

[0176] In some embodiments, before recording the information related to the first cloud application in the authentication database, the cloud application authentication device 400 implemented based on the cloud account further includes:

[0177] A generating unit 407, configured to generate an identifier of the first cloud application when creating the first cloud application;

[0178] The acquisition unit 402 is further configured to acquire, from the developer of the first cloud application, cloud account information of a user corresponding to the first cloud application and an intranet address of an application server corresponding to the first cloud application;

[0179] The creation unit 408 is used to create the user API gateway corresponding to the first cloud application under the virtual private cloud VPC to which the intranet address of the application server corresponding to the first cloud application belongs.

[0180] In some embodiments, the information related to the first cloud application also includes a cloud object storage COS address of a client page resource file corresponding to the first cloud application.

[0181] In some embodiments, before recording the information related to the first cloud application in the authentication database, the cloud application authentication device 400 implemented based on the cloud account further includes:

[0182] A generating unit 407, configured to generate an identifier of the first cloud application when creating the first cloud application;

[0183] The acquisition unit 402 is configured to acquire, from the developer of the first cloud application, the cloud account information of the user corresponding to the first cloud application, the intranet address of the application server corresponding to the first cloud application, and the client page resource file corresponding to the first cloud application;

[0184] The creation unit 408 is used to create the user API gateway corresponding to the first cloud application under the virtual private cloud VPC to which the intranet address of the application server corresponding to the first cloud application belongs.

[0185] In some embodiments, the cloud application authentication device 400 implemented based on the cloud account further includes:

[0186] A routing unit 409, configured to route to a client corresponding to the first cloud application through an access link after the user logs into the cloud platform by inputting the cloud account information, wherein the access link includes an identification field of the first cloud application;

[0187] The acquisition unit 402 is further configured to acquire second request information from the client through the cloud API, wherein the second request information includes an identifier of the first cloud application, and the second request information is used to request a COS address of a page resource file of the client;

[0188] The acquisition unit 402 is further configured to acquire a COS address of a page resource file of the client from the authentication database after completing the attribution authentication of the first cloud application through the cloud account information of the user;

[0189] The sending unit 405 is further configured to feed back the COS address of the page resource file of the client to the client through the cloud API.

[0190] Fig.14 is a schematic block diagram of a cloud application authentication device 500 implemented based on a cloud account in an embodiment of the present application. Fig.14 As shown, the cloud application authentication device 500 implemented based on a cloud account includes a calling unit 501 , a sending unit 502 , an acquiring unit 503 and a rendering unit 504 .

[0191] A calling unit 501, configured to call the cloud API by an internal calling method after the user logs into the cloud platform by inputting cloud account information and is routed to the client through an access link, wherein the access link includes an identification field of the first cloud application;

[0192] A sending unit 502 is used to send a second request message to the authentication server through the cloud API, wherein the second request message includes an identifier of the first cloud application, and the second request message is used to request a cloud object storage COS address of a page resource file of the client;

[0193] An acquiring unit 503 is used to acquire a COS address of a page resource file of the client from the authentication server through the cloud API; and

[0194] The rendering unit 504 is used to render the page of the client through the page resource file of the client.

[0195] In some embodiments, the calling unit 501 is specifically used to:

[0196] The key of the cloud API is obtained through an internal calling method, and the cloud API is called through the key of the cloud API.

[0197] In some embodiments, the cloud account information includes at least one of the following: a cloud master account and key, a cloud sub-account and key.

[0198] It should be understood that the device embodiment and the method embodiment may correspond to each other, and similar descriptions may refer to the method embodiment. To avoid repetition, they will not be described here.

[0199] Specifically, Fig.13 The cloud application authentication device 400 implemented based on a cloud account shown can execute the above method embodiment, and the aforementioned and other operations and / or functions of each unit in the cloud application authentication device 400 implemented based on a cloud account are respectively for implementing the corresponding processes in the above cloud application authentication method 200 implemented based on a cloud account, which will not be repeated here for the sake of brevity.

[0200] Specifically, Fig.14 The cloud application authentication device 500 based on cloud account implementation shown can execute the above method embodiment, and the aforementioned and other operations and / or functions of each unit in the cloud application authentication device 500 based on cloud account implementation are respectively for implementing the corresponding processes in the above cloud application authentication method 300 based on cloud account implementation, which will not be repeated here for the sake of brevity.

[0201] The above describes the device of the embodiment of the present application from the perspective of the functional module in conjunction with the accompanying drawings. It should be understood that the functional module can be implemented in hardware form, can be implemented by instructions in software form, and can also be implemented by a combination of hardware and software modules. Specifically, the steps of the method embodiment in the embodiment of the present application can be completed by the hardware integrated logic circuit and / or software form instructions in the processor, and the steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or a combination of hardware and software modules in the decoding processor to perform. Optionally, the software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory, and completes the steps in the above method embodiment in conjunction with its hardware.

[0202] Fig.15 It is a schematic block diagram of an electronic device 600 provided in an embodiment of the present application.

[0203] like Fig.15 As shown, the electronic device 600 may include:

[0204] The memory 610 and the processor 620, the memory 610 is used to store the computer program and transmit the program code to the processor 620. In other words, the processor 620 can call and run the computer program from the memory 610 to implement the method in the embodiment of the present application.

[0205] For example, the processor 620 may be configured to execute the above method embodiments according to instructions in the computer program.

[0206] In some embodiments of the present application, the processor 620 may include but is not limited to:

[0207] General-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, etc.

[0208] In some embodiments of the present application, the memory 610 includes but is not limited to:

[0209] Volatile memory and / or non-volatile memory. Among them, the non-volatile memory can be read-only memory (ROM), programmable ROM (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM) or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus random access memory (DR RAM).

[0210] In some embodiments of the present application, the computer program may be divided into one or more modules, which are stored in the memory 610 and executed by the processor 620 to complete the method provided by the present application. The one or more modules may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the electronic device.

[0211] like Fig.15 As shown, the electronic device 600 may further include:

[0212] The transceiver 630 may be connected to the processor 620 or the memory 610 .

[0213] The processor 620 may control the transceiver 630 to communicate with other devices, specifically, to send information or data to other devices, or to receive information or data sent by other devices. The transceiver 630 may include a transmitter and a receiver. The transceiver 630 may further include an antenna, and the number of antennas may be one or more.

[0214] It should be understood that the various components in the electronic device are connected via a bus system, wherein the bus system includes not only a data bus but also a power bus, a control bus and a status signal bus.

[0215] The present application also provides a computer storage medium on which a computer program is stored, and when the computer program is executed by a computer, the computer can perform the method of the above method embodiment. In other words, the present application embodiment also provides a computer program product containing instructions, and when the instructions are executed by a computer, the computer can perform the method of the above method embodiment.

[0216] When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integration. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital video disc (digital video disc, DVD)), or a semiconductor medium (e.g., a solid state drive (solid state disk, SSD)), etc.

[0217] It is understandable that in the specific implementation of the present application, when the above embodiments of the present application are applied to specific products or technologies and involve relevant data such as user information, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards.

[0218] Those of ordinary skill in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0219] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the module is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0220] The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. For example, each functional module in each embodiment of the present application may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0221] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A cloud application authentication method based on cloud account, characterized in that: Applied to an authentication server, the method comprises: Call the cloud API through the user's cloud account information; Obtaining, through the cloud API, an identifier of a first cloud application and first request information, wherein the first request information includes operation information requested by the user for the first cloud application; Performing attribution authentication on the first cloud application through the cloud account information of the user, and after completing the attribution authentication on the first cloud application, obtaining the public network access address and signature key of the user API gateway corresponding to the first cloud application from the authentication database; The first request information is signed using the signature key of the user API gateway, and the signed first request information is sent to the application server corresponding to the first cloud application through the public network access address of the user API gateway.

2. The method according to claim 1, characterized in that in, The calling of the cloud API through the user's cloud account information includes: After the user logs in to the cloud platform by inputting the cloud account information, the key of the cloud API is obtained through an internal call, and the cloud API is called through the key of the cloud API; or, The cloud API is directly called through the user's cloud account information.

3. The method according to claim 1 or 2, characterized in that: in, Before calling the cloud API through the cloud account information of the user, the method further includes: Recording information related to the first cloud application in the authentication database; The information related to the first cloud application includes an identifier of the first cloud application, cloud account information of a user corresponding to the first cloud application, and a public network access address and a signature key of the user API gateway corresponding to the first cloud application.

4. The method according to claim 3, characterized in that in, Before recording the information related to the first cloud application in the authentication database, the method further includes: When creating the first cloud application, generating an identifier of the first cloud application; Obtaining, from the developer of the first cloud application, cloud account information of a user corresponding to the first cloud application and an intranet address of an application server corresponding to the first cloud application; The user API gateway corresponding to the first cloud application is created under the virtual private cloud VPC to which the intranet address of the application server corresponding to the first cloud application belongs.

5. The method according to claim 3, characterized in that: The information related to the first cloud application also includes a cloud object storage COS address of a client page resource file corresponding to the first cloud application.

6. The method according to claim 5, characterized in that in, Before recording the information related to the first cloud application in the authentication database, the method further includes: When creating the first cloud application, generating an identifier of the first cloud application; Obtaining, from the developer of the first cloud application, cloud account information of a user corresponding to the first cloud application, an intranet address of an application server corresponding to the first cloud application, and a client page resource file corresponding to the first cloud application; The user API gateway corresponding to the first cloud application is created under the virtual private cloud VPC to which the intranet address of the application server corresponding to the first cloud application belongs.

7. The method according to claim 5, characterized in that Also includes: After the user logs in to the cloud platform by inputting cloud account information, routing to the client corresponding to the first cloud application through an access link, wherein the access link includes an identification field of the first cloud application; Obtaining second request information from the client through the cloud API, wherein the second request information includes an identifier of the first cloud application, and the second request information is used to request a COS address of a page resource file of the client; Performing attribution authentication on the first cloud application through the cloud account information of the user, and after completing the attribution authentication on the first cloud application, obtaining the COS address of the page resource file of the client from the authentication database; The COS address of the page resource file of the client is fed back to the client through the cloud API.

8. A cloud application authentication method based on cloud account, characterized in that: Applied to a client, the method comprises: After the user logs in to the cloud platform by inputting cloud account information and is routed to the client through an access link, calling the cloud API through an internal call, wherein the access link includes an identification field of the first cloud application; Sending a second request message to the authentication server through the cloud API, wherein the second request message includes an identifier of the first cloud application, and the second request message is used to request a cloud object storage COS address of a page resource file of the client; The COS address of the page resource file of the client is obtained from the authentication server through the cloud API, and the page of the client is rendered through the page resource file of the client.

9. The method according to claim 8, characterized in that in, The calling of the cloud API by internal calling method includes: The key of the cloud API is obtained through an internal calling method, and the cloud API is called through the key of the cloud API.

10. The method according to claim 1 or 8, characterized in that: in, The cloud account information includes one of the following: a cloud master account and key, a cloud sub-account and key.

11. A cloud application authentication device based on a cloud account, characterized in that: include: A calling unit, used to call a cloud API through the user's cloud account information; an acquiring unit, configured to acquire, through the cloud API, an identifier of a first cloud application and first request information, wherein the first request information includes operation information requested by the user for the first cloud application; an authentication unit, configured to authenticate the ownership of the first cloud application through the cloud account information of the user, and after completing the authentication of the ownership of the first cloud application, the acquisition unit is further configured to acquire the public network access address and signature key of the user API gateway corresponding to the first cloud application from the authentication database; A signing unit, configured to sign the first request information using a signing key of the user API gateway; and A sending unit is used to send the signed first request information to the application server corresponding to the first cloud application through the public network access address of the user API gateway.

12. A cloud application authentication device based on a cloud account, characterized in that: include: a calling unit, configured to call the cloud API by an internal calling method after the user logs into the cloud platform by inputting cloud account information and is routed to the client through an access link, wherein the access link includes an identification field of the first cloud application; A sending unit, configured to send a second request message to the authentication server through the cloud API, wherein the second request message includes an identifier of the first cloud application, and the second request message is used to request a cloud object storage COS address of a page resource file of the client; an acquisition unit, configured to acquire a COS address of a page resource file of the client from the authentication server through the cloud API; and A rendering unit is used to render the page of the client through the page resource file of the client.

13. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores instructions, and when the processor executes the instructions, the processor executes the method according to any one of claims 1 to 10.

14. A computer storage medium, characterized in that: Used to store a computer program, the computer program comprising instructions for executing the method according to any one of claims 1 to 10.

15. A computer program product, characterized in that The method comprises a computer program code, and when the computer program code is executed by an electronic device, the electronic device executes the method according to any one of claims 1 to 10.

Images