User identity authentication method of cloud database and related product

Abstract

The invention provides a user identity authentication method of a cloud database and a related product. The authentication method comprises the following steps: acquiring a first identity feature of a user registration container, wherein the first identity feature is bound to the registration container; generating a unique identity label corresponding to the registration container according to the first identity feature; obtaining a second identity feature of the user login container, wherein the second identity feature is bound to the login container; according to the second identity feature, generating a unique to-be-verified identity identifier corresponding to the login container; and authenticating the login container according to the identity label and the to-be-verified identity label. According to the scheme, the identity label can be bound with the registration container, a user is prevented from performing repeated authentication through multiple containers, and cloud database resources are prevented from being abused.

Description

Technical Field

[0001] The present invention relates to the field of database technology, and in particular to a user identity authentication method for a cloud database, a computer-readable storage medium, and a computer program product. Background Art

[0002] With the continuous development of network technology, more and more users choose to use cloud databases. Users can use cloud databases through physical machines, Kubernetes platforms (also known as K8s), Docker and other diverse containers. In related technologies, cloud databases mainly use two methods to authenticate and authorize containers: For physical machines, authentication is mainly performed through their physical addresses (MAC). For non-physical machines, the user mainly sets the container name and authenticates through the container name. However, the container name may not be unique and cannot be bound to a specific container. Users can repeat authentication multiple times by copying the container name or container image, resulting in the abuse of cloud database resources. Summary of the invention

[0003] An object of the present invention is to provide a user identity authentication method for a cloud database, a computer-readable storage medium, and a computer program product, so as to bind a cloud database to a user-specific container, thereby preventing the user from performing multiple repeated authentications through multiple containers and preventing the cloud database resources from being abused.

[0004] Specifically, according to one aspect of the present invention, the present invention provides a method for authenticating a user identity of a cloud database. The method comprises:

[0005] Obtaining a first identity feature of a user registration container, where the registration container includes any one of a Pod container, a Docker container, and a physical machine, and the first identity feature is bound to the registration container;

[0006] Generate a unique identity corresponding to the registration container according to the first identity feature;

[0007] Acquire a second identity feature of a user login container, where the login container includes any one of the Pod container, the Docker container, and the physical machine, and the second identity feature is bound to the login container;

[0008] Generate a unique identity identifier to be verified corresponding to the login container according to the second identity feature;

[0009] The login container is authenticated according to the identity identifier and the identity identifier to be verified.

[0010] Optionally, the step of obtaining the first identity feature of the user registration container includes:

[0011] Obtaining environmental characteristics of the registered container;

[0012] According to the environmental characteristics, obtaining the type of the registration container;

[0013] If the registered container is the Pod container, the unique identifier of its network address is used as the first identity feature;

[0014] If the registered container is the Docker container, use its unique identifier as the first identity feature;

[0015] If the registration container is the physical machine, its physical address is used as the first identity feature.

[0016] Optionally, obtaining the type of the registration container according to the environmental characteristics includes:

[0017] Determine whether the key field of the environment feature includes a pod field;

[0018] If the pod field is included, the type of the registered container is determined to be the Pod container;

[0019] If the pod field is not included, determine whether the key field of the environment feature includes the docker field;

[0020] If the docker field is included, determining that the type of the registered container is the Docker container;

[0021] If the docker field is not included, it is determined that the type of the registered container is the physical machine.

[0022] Optionally, generating a unique identity corresponding to the registration container according to the first identity feature includes:

[0023] Get a random ID code;

[0024] Persisting the random identity code;

[0025] The first identity feature and the persistent random identity code are combined to generate the identity identifier through a preset obfuscation encryption algorithm.

[0026] Optionally, generating a unique identity identifier to be verified corresponding to the login container according to the second identity feature includes:

[0027] Obtaining the persistent random identity code of the login container;

[0028] The preset obfuscation encryption algorithm is used to combine the second identity feature with the persistent random identity code of the login container to generate the identity identifier to be verified.

[0029] Optionally, the step of obtaining a second identity feature of the user logging into the container includes:

[0030] Obtaining environmental characteristics of the login container;

[0031] According to the environmental characteristics, obtaining the type of the landing container;

[0032] If the login container is the Pod container, the unique identifier of its network address is used as the second identity feature;

[0033] If the login container is the Docker container, use its unique identifier as the second identity feature;

[0034] If the login container is the physical machine, its physical address is used as the second identity feature.

[0035] Optionally, obtaining the type of the login container according to the environmental characteristics includes:

[0036] Determine whether the key field of the environment feature includes a pod field;

[0037] If the pod field is included, the type of the login container is determined to be the Pod container;

[0038] If the pod field is not included, determine whether the key field of the environment feature includes the docker field;

[0039] If the docker field is included, it is determined that the type of the login container is the Docker container;

[0040] If the docker field is not included, it is determined that the type of the login container is the physical machine.

[0041] Optionally, after generating a unique identity corresponding to the registration container according to the first identity feature, the authentication method further includes:

[0042] Uploading the identity to the cloud database;

[0043] The cloud database generates an identity certificate according to the identity identifier and stores the identity certificate in the registration container.

[0044] After generating a unique identity identifier to be verified corresponding to the login container according to the second identity feature, the authentication method further includes:

[0045] The cloud database generates an identity certificate to be verified according to the identity identifier to be verified.

[0046] The step of authenticating the login container according to the identity identifier and the identity identifier to be verified includes:

[0047] Uploading the identity certificate stored in the login container to the cloud database;

[0048] Determining whether the identity certificate is consistent with the identity certificate to be verified;

[0049] If they are consistent, the authentication succeeds; if they are inconsistent, the authentication fails.

[0050] According to another aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned methods for authenticating the user identity of a cloud database are implemented.

[0051] According to yet another aspect of the present invention, a computer program product is provided, which includes a computer program, and when the computer program is executed by a processor, the steps of any one of the above-mentioned methods for authenticating a user identity of a cloud database are implemented.

[0052] The user identity authentication method of the cloud database of the present invention can determine whether the login container and the registration container are the same container by obtaining the unique identity identifier bound to the registration container and the unique identity identifier to be verified bound to the login container, and comparing the identity identifier and the identity identifier to be verified, thereby realizing the authentication and authorization of the login container. This solution can prevent users from performing multiple repeated authentications through multiple containers, and prevent the cloud database resources from being abused.

[0053] Based on the following detailed description of specific embodiments of the present invention in conjunction with the accompanying drawings, those skilled in the art will become more aware of the above and other objects, advantages and features of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Hereinafter, some specific embodiments of the present invention will be described in detail in an exemplary and non-limiting manner with reference to the accompanying drawings. The same reference numerals in the accompanying drawings indicate the same or similar components or parts. It should be understood by those skilled in the art that these drawings are not necessarily drawn to scale. In the accompanying drawings:

[0055] Figure 1 is a flowchart of an authentication method according to an embodiment of the present invention;

[0056] Figure 2 is a schematic diagram of a flow chart of obtaining a first identity feature in an authentication method according to an embodiment of the present invention;

[0057] Figure 3 is a schematic diagram of a flow chart of determining a registration container type according to an authentication method of an embodiment of the present invention;

[0058] Figure 4 is a schematic diagram of a flow chart of generating an identity identifier in an authentication method according to an embodiment of the present invention;

[0059] Figure 5 is a schematic diagram of a flow chart of obtaining a second identity feature in an authentication method according to an embodiment of the present invention;

[0060] Figure 6 is a schematic diagram of a flow chart of determining a login container type according to an authentication method according to an embodiment of the present invention;

[0061] Figure 7 is a schematic diagram of a flow chart of generating an identity identifier to be verified according to an authentication method of an embodiment of the present invention;

[0062] Figure 8 is a schematic diagram of a process of generating an identity certificate according to an authentication method of an embodiment of the present invention;

[0063] Fig. 9 is a schematic diagram of a process of generating an identity certificate to be verified according to an authentication method of an embodiment of the present invention;

[0064] Fig.10 is a flowchart of an authentication method according to an embodiment of the present invention;

[0065] Fig.11 is a flow chart comparing an authentication method according to an embodiment of the present invention with the prior art;

[0066] Fig.12 is a schematic diagram of a computer-readable storage medium according to an embodiment of the present invention; and

[0067] Fig.13 is a schematic diagram of a computer program product according to an embodiment of the present invention. DETAILED DESCRIPTION

[0068] In cloud database products, the general problem is how to authorize the cloud database. When the database needs to be authorized, the physical environment (physical machine) is usually bound to a physical address. Physical addresses in cloud environments (non-physical machines) can be forged, so the solution of binding physical addresses is not reliable, causing the cloud database to face the problem of being stolen in the cloud.

[0069] To solve this problem, existing cloud databases usually have the following user authentication methods: Use the API of the cloud platform provider (such as the Kubernetes platform) to obtain the cluster ID. Its advantage is that it can uniquely identify the platform container, but it needs to adapt to the corresponding interface and corresponding permissions of the cloud vendor, and its universality is poor. Use the unique ID of the node. Its advantage is that it can uniquely identify a physical node, but the unique ID of the node changes after the node is dynamically added or deleted, and it needs to be bound again. Use the database system ID (System ID). Its advantage is that it can bind the unique ID generated by the database itself, but authentication can only be performed after the database is initialized, and it cannot be generated in advance. Use the operator system (Operator) to generate a random universally unique identifier (Universally Unique Identifier, referred to as UUID). Its advantage is that the operator system itself maintains the unified relationship of the cluster to generate a unique ID, but in practice, the cost is high and it is heavily dependent on the operator system. Use the physical node address of a non-physical machine. Its advantage is that it can directly bind to the physical node, but there may be permission risks and it requires the support of the operator system.

[0070] like Fig.11 As shown, the related technology also uses a bound container name (such as CONTAINER_NAME), that is, the container name is specified by the user. Specifically, taking the Docker container of the Docker platform as an example, when the user starts the Docker container through Docker run–tid–privileged–e CONTAINER_NAME–name kingbase image:tag, the CONTAINER_NAME entered by the user can be bound as a unique feature as an identity. Taking the Pod container of the kubenetes platform as an example, when the user uses the Pod container, a file configured with the CONTAINER_NAME environment variable will be deployed in the Pod container, and the unique feature entered by the user can be bound as an identity. The advantage of this solution is that it can be used in multiple container platforms such as the Kubernetes platform and Docker. However, the user can manually configure the container name, which cannot play an anti-copying effect, and will cause the problem of cloud database theft.

[0071] The purpose of the user identity authentication method of the cloud database of this embodiment is to bind the cloud database to a user-specific container, thereby preventing the user from performing multiple repeated authentications through multiple containers and preventing the cloud database resources from being abused.

[0072] Figure 1 FIG. 1 is a flow chart of an authentication method according to an embodiment of the present invention. The method may generally include:

[0073] S100, obtaining a first identity feature of a user registration container, where the registration container includes any one of a Pod container, a Docker container, and a physical machine, and the first identity feature is bound to the registration container;

[0074] S200, generating a unique identity corresponding to the registration container according to the first identity feature;

[0075] S300, obtaining a second identity feature of a user's login container, where the login container includes any one of a Pod container, a Docker container, and a physical machine, and the second identity feature is bound to the login container;

[0076] S400, generating a unique identity identifier to be verified corresponding to the login container according to the second identity feature;

[0077] S500: Authenticate the login container according to the identity identifier and the identity identifier to be verified.

[0078] The registered container may be a container used by the user for the first time. The Pod container may be provided by the kubenetes platform, and the Docker container may be provided by the Docker platform. The first identity feature is bound to the registered container, and the first identity feature may have global or partial uniqueness, so that it can distinguish the registered container from other containers (such as another Pod container, another Docker container or a physical machine) to a certain extent. The first identity feature may be a string of character codes, which may be provided by the platform where the registered container is located (such as the network address unique identifier provided by the kubenetes platform, the unique identifier provided by the Docker platform, etc.), or may be obtained by reading the device information of the physical machine (such as the physical address, device number, etc.). The first identity feature is bound to the registered container itself and is not specified by the user, which can prevent the user from specifying multiple containers as the same first identity feature.

[0079] The first identity feature can be automatically generated when the user registers using the registration container and uploaded to the cloud database. For example, a sys_sign file is set in the bin directory of the registration container. The file can be a binary file for generating the first identity feature bound to the registration container. When the user runs the registration container to register, the sys_sign file will be executed to obtain the first identity feature.

[0080] The first identity feature may not be globally unique. For example, the network address unique identifier of a container provided by the kubenetes platform cannot be guaranteed to be different from containers in other clusters. The identity identifier is used for further uniqueness. Specifically, the cloud database can combine the first identity feature with a string of random character codes, or rearrange and combine the first identity feature through a preset algorithm. After further uniqueness, even if the user uses multiple containers with the same network address unique identifier on the kubenetes platform, they can be distinguished by the identity identifier. The identity identifier can also encrypt the first identity feature to prevent users from directly copying the first identity feature to other containers.

[0081] The second identity feature can be generated by the cloud database. When the user logs in using the login container, the cloud database obtains the second identity feature of the login container through the same algorithm as the sys_sign file. The cloud database can use the same steps as the identity generation algorithm to generate a unique identity to be verified corresponding to the login container.

[0082] By comparing the identity identifier and the identity identifier to be verified, it can be determined whether the registered container and the login container are the same container. If they are consistent, it can be determined that the two are the same container, and the authentication is passed, allowing the login container to use the cloud database service. If they are inconsistent, it can be determined that the two are not the same container, and the authentication fails, and the login container is not allowed to use the cloud database service.

[0083] The authentication method of this embodiment obtains the unique identity identifier bound to the registration container and the unique identity identifier to be verified bound to the login container, and compares the identity identifier and the identity identifier to be verified to determine whether the login container and the registration container are the same container, thereby achieving authentication and authorization of the login container. This solution can prevent users from performing multiple repeated authentications through multiple containers and prevent the abuse of cloud database resources.

[0084] In some embodiments of the authentication method of the present invention, Figure 2 As shown, the step of obtaining the first identity feature of the user registration container includes:

[0085] S111, obtaining environmental characteristics of the registered container;

[0086] S112, obtaining the type of the registered container according to the environmental characteristics;

[0087] S113, if the registered container is a Pod container, use its network address unique identifier as the first identity feature;

[0088] S114, if the registered container is a Docker container, use its unique identifier as the first identity feature;

[0089] S115: If the registered container is a physical machine, use its physical address as the first identity feature.

[0090] When a user registers using a registered container, the registered container or cloud database will obtain the environmental characteristics of the registered container. Environmental characteristics include environment variables bound to the registered container, which are read from the kernel file of the container and cannot be modified by the user. The environment variables corresponding to Pod containers, Docker containers, and physical machines have different characteristics (such as different key fields, etc.), and the type of the registered container can be obtained through the environment variables.

[0091] Specifically, when it is determined that the registered container is a Pod container, its network address unique identifier can be used as the first identity feature. The network address unique identifier can be generated based on the namespace and service name of the Pod, and is used for service discovery and communication within the cluster. Exemplarily, the network address unique identifier can be formed by combining fields such as the Pod name, the namespace where the Pod is located, and the service domain within the Kubernetes cluster. In actual use, the permutation and combination of the above fields can be set as needed, and other customized fields can also be combined before and after the above fields. On the one hand, the network address unique identifier can be widely supported, such as CoreDNS plug-in, kubeDNS plug-in, dnsmasq plug-in, skyDNS plug-in, lstioDNS plug-in, Kube-router plug-in, ciliium plug-in, ExternalDNS plug-in, Kube2sky plug-in and other tools. On the other hand, the generation mechanism of the Pod's namespace and service name is in the Kubernetes kernel, so that the network address unique identifier is bound to a specific Pod container, and the user cannot modify it at will. Once modified, other nodes cannot access this device, and the network address unique identifier will be restored after restarting. Therefore, setting the network address unique identifier as the first identity feature of the Pod container can prevent users from making arbitrary modifications, so that the first identity feature is bound to the registered container.

[0092] When the registered container is determined to be a Docker container, its unique identifier (CONTAINER_ID) can be used as the first identity feature. The unique identifier is generated by the Docker operating system kernel, cannot be modified by the user, and is unique. Therefore, setting the unique identifier as the first identity feature of the Docker container can prevent users from modifying it arbitrarily, so that the first identity feature is uniquely bound to the registered container.

[0093] When the registration container is determined to be a physical machine, its physical address can be used as the first identity feature. The physical address is generated by the physical machine, cannot be modified by the user, and is unique. Therefore, setting the physical address as the first identity feature of the physical machine can prevent the user from modifying it arbitrarily, so that the first identity feature is uniquely bound to the registration container.

[0094] Compared with using only the physical address as an identity identifier, this embodiment can effectively prevent users from abusing cloud database resources by changing the physical address of a non-physical machine (such as a Pod container or a Docker container) by determining the type of the registered container and generating a first identity feature bound to the registered container.

[0095] In some embodiments of the authentication method of the present invention, Figure 3 As shown, the type of the registered container is obtained according to the environmental characteristics, including:

[0096] S131, determining whether the key field of the environment feature includes the pod field;

[0097] S132: If the pod field is included, determine that the type of the registered container is a Pod container;

[0098] S133, if the pod field is not included, determine whether the key field of the environment feature includes the docker field;

[0099] S134, if the docker field is included, determining that the type of the registered container is a Docker container;

[0100] S135: If the docker field is not included, it is determined that the type of the registered container is a physical machine.

[0101] The key fields of the kernel files of Pod containers all contain the pod field, but not the docker field. The key fields of the kernel files of Docker containers all contain the docker field, but not the pod field. The key fields of the kernel files of physical machines do not contain the pod field or the docker field. By querying the key fields, the type of registered containers can be quickly and accurately determined, thus providing a basis for extracting their first identity features.

[0102] In some embodiments of the authentication method of the present invention, Figure 4 As shown, the step of generating a unique identity corresponding to the registration container according to the first identity feature includes:

[0103] S211, obtaining a random identity code;

[0104] S212, making the random identity code permanent;

[0105] S213, combining the first identity feature and the persistent random identity code to generate an identity identifier through a preset obfuscation encryption algorithm.

[0106] On the one hand, the first identity feature is usually a plain text string, which is easy for users to obtain and copy. On the other hand, for some types of containers, their first identity features are not globally unique. For example, the network address unique identifier of a container provided by the Kubernetes platform may be the same as that of a container in his cluster.

[0107] In this embodiment, after the first identity feature is extracted, the registration container will randomly generate a random string as a random identity code and save it in a persistent directory. Using this persistent random identity code, the features combined by the first identity feature and the random identity code are obfuscated and encrypted by a preset obfuscation encryption algorithm (such as the SHA-256 algorithm), and an encrypted string of equal length, i.e., the identity identifier, is generated. Due to the addition of the random identity code, the identity identifier generates a unique feature and has global uniqueness. At the same time, through obfuscation and encryption, the identity identifier cannot be reverse cracked. In this way, users can be prevented from obtaining the first identity feature and the random identity code through reverse cracking of the identity identifier, thereby preventing the abuse of cloud database resources.

[0108] In some embodiments of the authentication method of the present invention, Figure 5 As shown, the method of obtaining the second identity feature of the user logging into the container includes:

[0109] S311, obtaining the environment characteristics of the login container;

[0110] S312, obtaining the type of the landing container according to the environmental characteristics;

[0111] S313, if the login container is a Pod container, use its network address unique identifier as the second identity feature;

[0112] S314, if the login container is a Docker container, use its unique identifier as the second identity feature;

[0113] S315: If the login container is a physical machine, its physical address is used as the second identity feature.

[0114] When a user logs in to the cloud database, the cloud database will obtain the environment characteristics of the login container. The environment characteristics include environment variables bound to the login container, etc., which are read from the kernel file of the container and cannot be modified by the user.

[0115] The principle of the cloud database obtaining the second identity feature of the login container is similar to that of obtaining the first identity feature of the registration container, which will not be described here. Similarly, since the second identity feature cannot be modified by the user, the second identity feature is bound to the login container. In this way, it can prevent the user from forging the login container into the registration container, thereby preventing the cloud database resources from being abused.

[0116] In some embodiments of the authentication method of the present invention, Figure 6 As shown, the type of the landing container is obtained according to the environmental characteristics, including:

[0117] S331, determining whether the key field of the environment feature includes the pod field;

[0118] S332: If the pod field is included, determine that the type of the login container is a Pod container;

[0119] S333: If the pod field is not included, determine whether the key field of the environment feature includes the docker field;

[0120] S334, if the docker field is included, determining that the type of the login container is a Docker container;

[0121] S335: If the docker field is not included, it is determined that the type of the login container is a physical machine.

[0122] The principle of determining the type of the login container through the key field of the environmental feature is similar to that of determining the type of the registration container, which will not be repeated here. By querying the key field, the type of the login container can be quickly and accurately determined, thereby providing a basis for extracting its second identity feature.

[0123] In some embodiments of the authentication method of the present invention, Figure 7 As shown, the method of generating a unique identity identifier to be verified corresponding to the login container according to the second identity feature includes:

[0124] S411, obtaining a persistent random identity code for logging into the container;

[0125] S412, using a preset obfuscation encryption algorithm, the second identity feature and the persistent random identity code of the login container are combined to generate an identity identifier to be verified.

[0126] Only registered containers that have completed registration can log in to the cloud database. Therefore, the login container must have a persistent random identity code. The login container can upload the random identity code to the cloud database, which uses the same preset obfuscation encryption algorithm to combine the second identity feature obtained by the cloud database with the random identity code to generate an identity to be verified. In other words, only when the persistent random identity code is consistent with the registration container, and the second identity feature is consistent with the first identity feature, the identity and the identity to be verified are consistent. In this way, users can be prevented from forging the login container into other containers, thereby preventing the cloud database resources from being abused.

[0127] In some embodiments of the authentication method of the present invention, Figure 8-10As shown, after generating a unique identity identifier corresponding to the registration container according to the first identity feature, the authentication method further includes:

[0128] S611, uploading the identity to the cloud database;

[0129] S612, the cloud database generates an identity certificate according to the identity identifier and stores it in the registration container.

[0130] After generating a unique identity identifier to be verified corresponding to the login container according to the second identity feature, the authentication method further includes:

[0131] S613, the cloud database generates an identity certificate to be verified according to the identity identifier to be verified.

[0132] The step of authenticating the login container according to the identity identifier and the identity identifier to be verified includes:

[0133] S614, uploading the identity certificate stored in the login container to the cloud database;

[0134] S615, determining whether the identity certificate is consistent with the identity certificate to be verified;

[0135] S616: If they are consistent, the authentication is successful;

[0136] S617: If they are inconsistent, the authentication fails.

[0137] Exemplarily, an identity generation file (such as sys_sign) is set in the bin directory of the system file of the registration container, and the identity generation file can be a binary file. When the user registers, the identity generation file will be called as part of the container-side database startup process. When the identity generation file is executed, the first identity feature will be obtained (for example, calling the relevant files in the / proc / 1 / cgroup directory) and an identity will be generated. The identity includes the first identity feature and is globally unique. Then, the registration container will upload the identity to the cloud database related module (such as the after-sales module), and the cloud database will generate an identity certificate (such as license.dat) based on the identity. The registration container will store the identity certificate in the specified directory.

[0138] In particular, in the prior art, a license.dat is usually provided, however, the license.dat contains the physical address of the physical machine or the container name specified by the user of the non-physical machine. In this embodiment, only the physical address and container name in the license.dat need to be changed to the identity identifier, and the original system can be used without making too many changes to the system, and it can be conveniently used to transform the existing equipment.

[0139] When a user logs in using a login container, the login container will upload the identity certificate of the specified directory to the cloud database. The cloud database uses the same method as the identity identification file generation method to obtain the second identity feature of the login container and generate an identity certificate to be verified (for example, another license.dat). By comparing the identity certificate and the identity certificate to be verified, it can be determined whether the login container is the same container as the registration container. If it is the same container, the authentication is passed and the login container is authorized to use cloud database related services. If it is not the same container, the authentication fails and the login container is denied to use cloud database related services.

[0140] In some embodiments of the authentication method of the present invention, Fig.11 As shown, the authentication methods include:

[0141] S711, in response to the login container logging into the cloud database, determining the type of the login container;

[0142] S712, if the type of the login container is a physical machine, obtain its physical address and perform authentication through the physical address;

[0143] S713, if the type of the login container is a non-physical machine, determine whether it has an identity certificate;

[0144] S714, if the identity certificate does not exist, it is determined to be a user trial scenario; and the port of the login container is called to generate a trial identity certificate;

[0145] S715, if the identity certificate exists, obtain the identity certificate to be verified of the login container; and authenticate the login container according to the identity certificate and the identity certificate to be verified.

[0146] Specifically, when the main process (e.g., KES_MasterMain) of the container database is logged in, the identity certificate (e.g., license) related information will be loaded, and then the version information tool (e.g., License CheckproductDistribution) will be called to check the version information of the product, and the certificate check tool (e.g., License General Check) will be called to check its identity related information (e.g., GIS information, CPU information, identity certificate, random identity code, etc.). By checking the identity related information, the physical machine can be authenticated by the physical address, and the non-physical machine can be authenticated by the identity certificate. In this way, users can be effectively prevented from abusing cloud database resources by copying the physical address or container name of a non-physical machine.

[0147] The flow chart provided by the present embodiment is not intended to indicate that the operation of the method will be performed in any particular order, or that all operations of the method are included in all every case. In addition, the method may include additional operations. Within the scope of the technical thinking provided by the present embodiment method, additional changes may be made to the above method.

[0148] It should be understood that in some embodiments, each part can be implemented by hardware, software, firmware or a combination thereof. In the above embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system.

[0149] This embodiment also provides a computer program product 10 and a computer readable storage medium 20 . Fig.13 is a schematic diagram of a computer program product 10 according to an embodiment of the present invention, Fig.12 is a schematic diagram of a computer-readable storage medium 20 according to an embodiment of the present invention. The computer program product 10 includes a computer program 11, which implements the steps of any of the above-mentioned authentication methods when executed by a processor 32. The computer-readable storage medium 20 stores the above-mentioned computer program 11 thereon, and the computer program 11 implements the steps of the authentication method of any of the above-mentioned embodiments when executed by the processor 32.

[0150] The computer program 11 for performing the operation of the present invention may be an assembly instruction, an instruction set architecture (ISA) instruction, a machine instruction, a machine-related instruction, a microcode, a firmware instruction, a state setting data, a configuration data of an integrated circuit, or a source code or an object code written in any combination of one or more programming languages ​​and process programming languages. The computer program 11 may be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider via the Internet). In some embodiments, in order to perform various aspects of the present invention, an electronic circuit including, for example, a programmable logic circuit, a field programmable gate array (FPGA) or a programmable logic array (PLA) may execute computer-readable program instructions by utilizing the state information of the computer-readable program instructions to personalize the electronic circuit.

[0151] In the description of this embodiment, the computer program product 10 is a related product including the computer program 11 .

[0152] For the purpose of the description of the present embodiment, the computer readable storage medium 20 is a tangible device capable of retaining and storing the computer program 11, which can be any device that can contain, store, communicate, propagate or transmit the computer program 11 for use with an instruction execution system, device or apparatus or in conjunction with these instruction execution systems, devices or apparatuses. More specific examples (a non-exhaustive list) of the computer readable storage medium 20 include the following: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, and any suitable combination of the above.

[0153] The computer program product 10 can be run on a computer device. The computer device may include a memory, a processor 32, and a computer program 11 stored in the memory and running on the processor 32. The computer device may be, for example, a server, a desktop computer, a notebook computer, a tablet computer, or a smart phone. In some examples, the computer device may be a cloud computing node. The computer device may be described in the general context of computer system executable instructions (such as program modules) executed by a computer system. Typically, a program module may include routines, programs, target programs, components, logic, data structures, etc. that perform specific tasks or implement specific abstract data types. The computer device may be implemented in a distributed cloud computing environment where remote processing devices linked through a communication network perform tasks. In a distributed cloud computing environment, program modules may be located on a local or remote computing system storage medium including a storage device.

[0154] The computer device may include a processor 32 adapted to execute stored instructions, and a memory that provides temporary storage space for the operation of the instructions during operation. The processor 32 may be a single-core processor, a multi-core processor, a computing cluster, or any number of other configurations. The memory may include random access memory (RAM), read-only memory, flash memory, or any other suitable storage system.

[0155] The computer device may also include a network adapter / interface and an input / output (I / O) interface. The I / O interface allows input and output of data with external devices that may be connected to the computer device. The network adapter / interface may provide communication between the computer device and a network, which is usually shown as a communication network.

[0156] At this point, those skilled in the art should recognize that, although multiple exemplary embodiments of the present invention have been shown and described in detail herein, many other variations or modifications that conform to the principles of the present invention can still be directly determined or derived based on the content disclosed in the present invention without departing from the spirit and scope of the present invention. Therefore, the scope of the present invention should be understood and recognized as covering all these other variations or modifications.

Claims

1. A user identity authentication method for a cloud database, characterized in that: include: Obtaining a first identity feature of a user registration container, where the registration container includes any one of a Pod container, a Docker container, and a physical machine, and the first identity feature is bound to the registration container; Generate a unique identity corresponding to the registration container according to the first identity feature; Acquire a second identity feature of a user login container, where the login container includes any one of the Pod container, the Docker container, and the physical machine, and the second identity feature is bound to the login container; Generate a unique identity identifier to be verified corresponding to the login container according to the second identity feature; The login container is authenticated according to the identity identifier and the identity identifier to be verified.

2. The authentication method according to claim 1, characterized in that: The step of obtaining the first identity feature of the user registration container includes: Obtaining environmental characteristics of the registered container; According to the environmental characteristics, obtaining the type of the registration container; If the registered container is the Pod container, the unique identifier of its network address is used as the first identity feature; If the registered container is the Docker container, use its unique identifier as the first identity feature; If the registration container is the physical machine, its physical address is used as the first identity feature.

3. The authentication method according to claim 2, characterized in that: The obtaining the type of the registration container according to the environmental characteristics includes: Determine whether the key field of the environment feature includes a pod field; If the pod field is included, the type of the registered container is determined to be the Pod container; If the pod field is not included, determine whether the key field of the environment feature includes the docker field; If the docker field is included, determining that the type of the registered container is the Docker container; If the docker field is not included, it is determined that the type of the registered container is the physical machine.

4. The authentication method according to claim 1, characterized in that: The step of generating a unique identity corresponding to the registration container according to the first identity feature includes: Get a random ID code; Persisting the random identity code; The first identity feature and the persistent random identity code are combined to generate the identity identifier through a preset obfuscation encryption algorithm.

5. The authentication method according to claim 4, characterized in that: The step of generating a unique identity identifier to be verified corresponding to the login container according to the second identity feature includes: Obtaining the persistent random identity code of the login container; The preset obfuscation encryption algorithm is used to combine the second identity feature with the persistent random identity code of the login container to generate the identity identifier to be verified.

6. The authentication method according to claim 1, characterized in that: The step of obtaining the second identity feature of the user logging into the container includes: Obtaining environmental characteristics of the login container; According to the environmental characteristics, obtaining the type of the landing container; If the login container is the Pod container, the unique identifier of its network address is used as the second identity feature; If the login container is the Docker container, use its unique identifier as the second identity feature; If the login container is the physical machine, its physical address is used as the second identity feature.

7. The authentication method according to claim 6, characterized in that: The obtaining the type of the landing container according to the environmental characteristics includes: Determine whether the key field of the environment feature includes a pod field; If the pod field is included, the type of the login container is determined to be the Pod container; If the pod field is not included, determine whether the key field of the environment feature includes the docker field; If the docker field is included, it is determined that the type of the login container is the Docker container; If the docker field is not included, it is determined that the type of the login container is the physical machine.

8. The authentication method according to claim 1, characterized in that: After generating a unique identity corresponding to the registration container according to the first identity feature, the authentication method further includes: Uploading the identity to the cloud database; The cloud database generates an identity certificate according to the identity identifier and stores the identity certificate in the registration container; After generating a unique identity identifier to be verified corresponding to the login container according to the second identity feature, the authentication method further includes: The cloud database generates an identity certificate to be verified according to the identity identifier to be verified; The step of authenticating the login container according to the identity identifier and the identity identifier to be verified includes: Uploading the identity certificate stored in the login container to the cloud database; Determining whether the identity certificate is consistent with the identity certificate to be verified; If they are consistent, the authentication succeeds; if they are inconsistent, the authentication fails.

9. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the steps of the user identity authentication method for a cloud database as described in any one of claims 1 to 8 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the user identity authentication method for a cloud database as described in any one of claims 1 to 8 are implemented.

Images