A user identity authentication method of a cloud database and related products

Abstract

The application provides a user identity authentication method of a cloud database and related products. The authentication method comprises the following steps: obtaining a first identity feature of a user registration container, the first identity feature being bound to the registration container; generating a unique identity corresponding to the registration container according to the first identity feature; obtaining a second identity feature of a user login container, the second identity feature being bound to the login container; generating a unique to-be-verified identity corresponding to the login container according to the second identity feature; and authenticating the login container according to the identity and the to-be-verified identity. The identity is bound to the registration container, the user is prevented from repeatedly authenticating multiple times through multiple containers, and the cloud database resources are prevented from being misused.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of database, in particular to a user identity authentication method of cloud database, computer readable storage medium and computer program product. BACKGROUND

[0002] With the continuous development of network technology, more and more users choose to use cloud database. Users can use cloud database through physical machines, Kubernetes platforms (also known as K8s), Docker and other diversified containers. In related technologies, cloud databases mainly authenticate and authorize containers through two methods: for physical machines, mainly through their physical addresses (MAC) for authentication. For non-physical machines, the user mainly sets the container name, and authenticates through the container name. However, the container name may not be unique and cannot be bound to a specific container. Users can repeatedly authenticate multiple times by copying the container name or container image, resulting in abuse of cloud database resources. SUMMARY

[0003] An object of the present application is to provide a user identity authentication method of cloud database, computer readable storage medium and computer program product, so as to bind the cloud database to the specific container of the user, thereby preventing the user from repeatedly authenticating multiple times through multiple containers and preventing the abuse of cloud database resources.

[0004] Specifically, according to one aspect of the present application, the present application provides a user identity authentication method of cloud database. It includes:

[0005] Obtaining a first identity feature of a user registered container, the registered container including any one of a Pod container, a Docker container and a physical machine, the first identity feature being bound to the registered container;

[0006] According to the first identity feature, a unique identity corresponding to the registered container is generated;

[0007] Obtaining a second identity feature of a user logged-in container, the logged-in container including any one of the Pod container, the Docker container and the physical machine, the second identity feature being bound to the logged-in container;

[0008] According to the second identity feature, a unique to-be-verified identity corresponding to the logged-in container is generated;

[0009] According to the identity and the to-be-verified identity, the logged-in container is authenticated.

[0010] Optionally, the first identity feature of the user registered container is obtained, including:

[0011] acquiring an environment feature of the registration container;

[0012] obtaining a type of the registration container according to the environment feature;

[0013] if the registration container is the Pod container, taking a network address unique identifier of the registration container as the first identity feature;

[0014] if the registration container is the Docker container, taking a unique identifier of the registration container as the first identity feature;

[0015] if the registration container is the physical machine, taking a physical address of the registration container as the first identity feature.

[0016] Optionally, the obtaining of the type of the registration container according to the environment feature comprises:

[0017] judging whether a pod field is contained in a key field of the environment feature;

[0018] if the pod field is contained, determining that the type of the registration container is the Pod container;

[0019] if the pod field is not contained, judging whether a docker field is contained in the key field of the environment feature;

[0020] if the docker field is contained, determining that the type of the registration container is the Docker container;

[0021] if the docker field is not contained, determining that the type of the registration container is the physical machine.

[0022] Optionally, the generating of the unique identity corresponding to the registration container according to the first identity feature comprises:

[0023] acquiring a random identity code;

[0024] persisting the random identity code;

[0025] combining the first identity feature and the persisted random identity code by a preset confusion encryption algorithm to generate the identity.

[0026] Optionally, the generating of the unique identity corresponding to the registration container according to the first identity feature comprises:

[0027] acquiring the persisted random identity code of the login container;

[0028] The second identity feature and the random identity code of the persistent login container are combined by the preset confusion encryption algorithm to generate the identity to be verified.

[0029] Optionally, the second identity feature of the user login container is obtained by:

[0030] An environment feature of the login container is obtained.

[0031] The type of the login container is obtained according to the environment feature.

[0032] If the login container is the Pod container, a network address unique identifier of the login container is taken as the second identity feature.

[0033] If the login container is the Docker container, a unique identifier of the login container is taken as the second identity feature.

[0034] If the login container is the physical machine, a physical address of the login container is taken as the second identity feature.

[0035] Optionally, the type of the login container is obtained according to the environment feature by:

[0036] It is judged whether a pod field is contained in a key field of the environment feature.

[0037] If the pod field is contained, it is determined that the type of the login container is the Pod container.

[0038] If the pod field is not contained, it is judged whether a docker field is contained in the key field of the environment feature.

[0039] If the docker field is contained, it is determined that the type of the login container is the Docker container.

[0040] If the docker field is not contained, it is determined that the type of the login container is the physical machine.

[0041] Optionally, after the unique identity corresponding to the registration container is generated according to the first identity feature, the authentication method further comprises:

[0042] The identity is uploaded to the cloud database.

[0043] The cloud database generates an identity certificate according to the identity and stores the identity certificate in the registration container.

[0044] Optionally, after the unique identity to be verified corresponding to the login container is generated according to the second identity feature, the authentication method further comprises:

[0045] The cloud database generates a to-be-verified identity certificate according to the identity to be verified.

[0046] The authentication of the login container according to the identity and the identity to be verified comprises:

[0047] The identity certificate stored in the login container is uploaded to the cloud database;

[0048] It is judged whether the identity certificate and the to-be-verified identity certificate are consistent;

[0049] If consistent, the authentication is passed; if not consistent, the authentication fails.

[0050] According to another aspect of the present application, there is also provided a computer readable storage medium having stored thereon a computer program which, when executed by a processor, implements the steps of the user identity authentication method of the cloud database according to any of the above.

[0051] According to still another aspect of the present application, there is also provided a computer program product comprising a computer program which, when executed by a processor, implements the steps of the user identity authentication method of the cloud database according to any of the above.

[0052] The user identity authentication method of the cloud database of the present application can judge whether the login container and the registration container are the same container by obtaining the identity bound to the registration container and unique and the identity to be verified bound to the login container and unique, and comparing the identity and the identity to be verified, so as to realize the authentication and authorization of the login container. This scheme can prevent the user from repeatedly authenticating through multiple containers, and prevent the abuse of cloud database resources.

[0053] The above and other objects, advantages and features of the present application will become more apparent from the following detailed description of some embodiments thereof, when taken in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0054] Some specific embodiments of the present application will be described in detail below with reference to the accompanying drawings, in an exemplary and non-limiting manner. The same reference numerals in the drawings denote the same or similar components or parts. Those skilled in the art should understand that these drawings are not necessarily drawn to scale. In the drawings:

[0055] Figure 1 is a flowchart of an authentication method according to an embodiment of the present application;

[0056] Figure 2 is a flowchart of obtaining a first identity feature according to an authentication method of an embodiment of the present application;

[0057] Figure 3 is a flowchart of judging a registration container type of an authentication method according to an embodiment of the present application;

[0058] Figure 4 is a flowchart of generating an identity of an authentication method according to an embodiment of the present application;

[0059] Figure 5 is a flowchart of obtaining a second identity feature of an authentication method according to an embodiment of the present application;

[0060] Figure 6 is a flowchart of judging a login container type of an authentication method according to an embodiment of the present application;

[0061] Figure 7 is a flowchart of generating a to-be-verified identity of an authentication method according to an embodiment of the present application;

[0062] Figure 8 is a flowchart of generating an identity certificate of an authentication method according to an embodiment of the present application;

[0063] Figure 9 is a flowchart of generating a to-be-verified identity certificate of an authentication method according to an embodiment of the present application;

[0064] Figure 10 is a flowchart of an authentication method according to an embodiment of the present application;

[0065] Figure 11 is a flowchart of an authentication method according to an embodiment of the present application compared with prior art;

[0066] Figure 12 is a schematic diagram of a computer readable storage medium according to an embodiment of the present application; and

[0067] Figure 13 is a schematic diagram of a computer program product according to an embodiment of the present application. DETAILED DESCRIPTION

[0068] In a cloud database product, a problem of how to authorize the cloud database is generally faced. When the database needs to be authorized, the physical environment (physical machine) is usually bound to a physical address. The physical address on the cloud environment (non-physical machine) can be forged, so that the reliability of the scheme of binding the physical address is not high, resulting in the problem of the cloud database being stolen and used on the cloud.

[0069] To solve this problem, the existing cloud database usually has the following several user identity authentication methods: using the API of the cloud platform provider (for example, the Kubernetes platform) to obtain the cluster ID, which has the advantages of being able to uniquely identify the platform container, but needs to adapt to the corresponding interface and corresponding permissions of the cloud vendor, and the general type is poor. Using the unique ID of the node, which has the advantages of being able to uniquely identify a physical node, but the unique ID of the node changes after the node is dynamically added or deleted, and needs to be bound again. Using the database system ID (System ID), which has the advantages of being able to bind the unique ID generated by the database itself, but needs to be authenticated after the database is initialized, and cannot be generated in advance. Using the operator system (Operator) to generate a random universally unique identifier (Universally Unique Identifier, referred to as UUID), which has the advantages of being a unique ID generated by the operator system itself to maintain the unified relationship of the cluster, but in practice, the cost is high, and it is severely dependent on the operator system. Using the physical node address of the non-physical machine, which has the advantages of being able to directly bind the physical node, but may have permission risks, and needs the support of the operator system.

[0070] As shown in Figure 11 In the related art, the container name (for example, CONTAINER_NAME) is also used, that is, the container name is specified by the user. Specifically, taking the Docker container of the user using the Docker platform as an example, when the user starts the Docker container by Docker run–tid–privileged–e CONTAINER_NAME–name kingbase image:tag, the user can bind the CONTAINER_NAME input by the user as a unique feature as an identity identifier. Taking the Pod container of the user using the kubenetes platform as an example, when the user uses the Pod container, a file configured with the CONTAINER_NAME environment variable is deployed in the Pod container, and the user can bind the unique feature input by the user as an identity identifier. This scheme has the advantage of being applicable to multiple container platforms such as the Kubernetes platform and the Docker. However, the user can manually configure the container name, which cannot prevent replication and can cause the problem of misuse of the cloud database.

[0071] The purpose of the user identity authentication method of the cloud database of the embodiment is to be able to bind the cloud database with the user-specific container, thereby preventing the user from repeatedly authenticating multiple times through multiple containers and preventing the misuse of the cloud database resources.

[0072] Figure 1 The flowchart of the authentication method according to one embodiment of the present application is shown in the figure, which can generally include:

[0073] S100, obtaining a first identity feature of a user registration container, the registration container including any one of a Pod container, a Docker container and a physical machine, and the first identity feature being bound to the registration container;

[0074] S200, generating a unique identity corresponding to the registration container according to the first identity feature;

[0075] S300, obtaining a second identity feature of a user login container, the login container including any one of a Pod container, a Docker container and a physical machine, and the second identity feature being bound to the login container;

[0076] S400, generating a unique to-be-verified identity corresponding to the login container according to the second identity feature;

[0077] S500, authenticating the login container according to the identity and the to-be-verified identity.

[0078] The registration container can be a container used by the user for the first time. The Pod container can be provided by a kubenetes platform, and the Docker container can be provided by a Docker platform. The first identity feature is bound to the registration container, and the first identity feature can have global or partial uniqueness, so that it can distinguish the registration container from other containers (such as another Pod container, another Docker container or a physical machine) to a certain extent. The first identity feature can be a string of character codes, which can be provided by the platform where the registration container is located (such as a network address unique identifier provided by the kubenetes platform, a unique identifier provided by the Docker platform, etc.), or can be obtained by reading the device information of the physical machine (such as a physical address, a device number, etc.). The first identity feature is bound to the registration container itself and is not specified by the user, which can prevent the user from specifying multiple containers as the same first identity feature.

[0079] The first identity feature can be automatically generated when the user registers using the registration container, and uploaded to a cloud database. For example, a sys_sign file can be set in a bin directory in the registration container, which can be a binary file for generating the first identity feature bound to the registration container. When the user runs the registration container to register, the sys_sign file is executed to obtain the first identity feature.

[0080] The first identity feature can not be globally unique, for example, a network address unique identifier of a certain container provided by a kubenetes platform can not be guaranteed to be different from that of a container in another cluster. The identity identifier is used for further uniqueness. Specifically, the cloud database can combine the first identity feature with a string of random character codes, or rearrange and combine the first identity feature by a preset algorithm. After further uniqueness, even if the user uses multiple containers with the same network address unique identifier in the kubenetes platform, the identity identifier can be used to distinguish them. The identity identifier can also encrypt the first identity feature to prevent the user from directly copying the first identity feature to other containers.

[0081] The second identity feature can be generated by the cloud database. When the user logs in using the login container, the cloud database obtains the second identity feature of the login container by the same algorithm as the sys_sign file. The cloud database can use the same steps as the identity identifier generation algorithm to generate a unique identity identifier to be verified corresponding to the login container.

[0082] By comparing the identity identifier and the identity identifier to be verified, it can be determined whether the registered container and the login container are the same container. If they are the same, it is determined that they are the same container, and the authentication is passed, allowing the login container to use the services of the cloud database. If they are not the same, it is determined that they are not the same container, and the authentication fails, and the login container is not allowed to use the services of the cloud database.

[0083] The authentication method of the embodiment can obtain an identity identifier bound to and unique to the registered container and an identity identifier to be verified bound to and unique to the login container, and compare the identity identifier and the identity identifier to be verified, to determine whether the login container and the registered container are the same container, thereby realizing the authentication and authorization of the login container. This scheme can prevent the user from repeatedly authenticating through multiple containers and prevent the abuse of cloud database resources.

[0084] In some embodiments of the authentication method of the present application, as shown in Figure 2 The first identity feature of the registered container is obtained, including:

[0085] S111, obtaining an environment feature of the registered container;

[0086] S112, obtaining a type of the registered container according to the environment feature;

[0087] S113, if the registered container is a Pod container, taking a network address unique identifier thereof as the first identity feature;

[0088] S114, if the registered container is a Docker container, taking a unique identifier thereof as the first identity feature;

[0089] S115, if the registration container is a physical machine, the physical address of the registration container is taken as the first identity feature.

[0090] When a user registers a registration container, the registration container or the cloud database obtains the environmental features of the registration container. The environmental features include the environmental variables bound to the registration container, and are read from the kernel file of the container and cannot be modified by the user. The environmental variables corresponding to the Pod container, the Docker container and the physical machine have different features (for example, different key fields), and the type of the registration container can be obtained through the environmental variables.

[0091] Specifically, when the registration container is determined to be a Pod container, the network address unique identifier of the registration container can be taken as the first identity feature. The network address unique identifier can be generated based on the namespace and service name of the Pod, and is used for service discovery and communication within the cluster. For example, the network address unique identifier can be formed by combining the Pod name, the namespace of the Pod, the service domain within the Kubernetes cluster and the like. In actual use, the arrangement and combination of the above fields can be set as needed, and other custom fields can also be combined before and after the above fields. On the one hand, the network address unique identifier can be widely supported, such as CoreDNS plug-in, kubeDNS plug-in, dnsmasq plug-in, skyDNS plug-in, lstioDNS plug-in, Kube-router plug-in, clilium plug-in, ExternalDNS plug-in, Kube2sky plug-in and the like. On the other hand, the generation mechanism of the namespace and service name of the Pod is in the Kubernetes kernel, so that the network address unique identifier is bound to the specific Pod container and cannot be modified by the user at will. Once modified, other nodes cannot access the device, and the network address unique identifier will be restored after restart. Therefore, the network address unique identifier is set as the first identity feature of the Pod container, which can prevent the user from modifying it at will, so that the first identity feature is bound to the registration container.

[0092] When the registration container is determined to be a Docker container, the unique identifier (CONTAINER ID) of the registration container can be taken as the first identity feature. The unique identifier is generated by the Docker operating system kernel and cannot be modified by the user, and has uniqueness. Therefore, the unique identifier is set as the first identity feature of the Docker container, which can prevent the user from modifying it at will, so that the first identity feature is uniquely bound to the registration container.

[0093] When the registration container is determined to be a physical machine, the physical address of the registration container can be taken as the first identity feature. The physical address is generated by the physical machine and cannot be modified by the user, and has uniqueness. Therefore, the physical address is set as the first identity feature of the physical machine, which can prevent the user from modifying it at will, so that the first identity feature is uniquely bound to the registration container.

[0094] Compared with taking only the physical address as the identity, the embodiment can effectively prevent the user from abusing the cloud database resources by changing the physical address of the non-physical machine (such as the Pod container or the Docker container) by judging the type of the registered container and generating the first identity feature bound to the registered container.

[0095] In some embodiments of the authentication method of the present application, as shown in Figure 3 the type of the registered container is obtained according to the environment feature, and the method comprises:

[0096] S131, judging whether the pod field is contained in the key field of the environment feature;

[0097] S132, if the pod field is contained, determining that the type of the registered container is the Pod container;

[0098] S133, if the pod field is not contained, judging whether the docker field is contained in the key field of the environment feature;

[0099] S134, if the docker field is contained, determining that the type of the registered container is the Docker container;

[0100] S135, if the docker field is not contained, determining that the type of the registered container is the physical machine.

[0101] The key field of the kernel file of the Pod container contains the pod field but does not contain the docker field. The key field of the kernel file of the Docker container contains the docker field but does not contain the pod field. The key field of the kernel file of the physical machine does not contain the pod field and the docker field. By querying the key field, the type of the registered container can be quickly and accurately judged, thereby providing the basis for extracting the first identity feature.

[0102] In some embodiments of the authentication method of the present application, as shown in Figure 4 the unique identity corresponding to the registered container is generated according to the first identity feature, and the method comprises:

[0103] S211, obtaining a random identity code;

[0104] S212, persisting the random identity code;

[0105] S213, combining the first identity feature and the persisted random identity code to generate the identity by using a preset confusion encryption algorithm.

[0106] On the one hand, the first identity feature is usually a plaintext string, which is easy to be obtained and copied by the user. On the other hand, for some types of containers, the first identity feature is not globally unique. For example, the network address unique identifier of a certain container provided by the kubenetes platform can be the same as that of a container in another cluster.

[0107] In this embodiment, after the first identity feature is extracted, the registered container randomly generates a random string as a random identity code and saves it in the persistent directory. Using the persistent random identity code, the first identity feature and the random identity code are combined to generate an encrypted string of the same length by a preset obfuscation encryption algorithm (for example, SHA-256 algorithm), that is, an identity identifier. Since the random identity code is added, the identity identifier has a unique feature and is globally unique. At the same time, through obfuscation and encryption, the identity identifier cannot be reverse cracked. In this way, the user can be prevented from reverse cracking the first identity feature and the random identity code through the identity identifier, thereby preventing the cloud database resources from being abused.

[0108] In some embodiments of the authentication method of the present application, as shown in Figure 5 the second identity feature of the user's login container is obtained, including:

[0109] S311, obtaining the environment feature of the login container;

[0110] S312, obtaining the type of the login container according to the environment feature;

[0111] S313, if the login container is a Pod container, the network address unique identifier thereof is taken as the second identity feature;

[0112] S314, if the login container is a Docker container, the unique identifier thereof is taken as the second identity feature;

[0113] S315, if the login container is a physical machine, the physical address thereof is taken as the second identity feature.

[0114] When the user logs in the cloud database, the cloud database obtains the environment feature of the login container. The environment feature includes the environment variable bound to the login container and is read from the kernel file of the container and cannot be modified by the user.

[0115] The principle of obtaining the second identity feature of the login container by the cloud database can be similar to that of obtaining the first identity feature of the registered container, which will not be described here. Similarly, since the second identity feature cannot be modified by the user, the second identity feature is bound to the login container. In this way, the user can be prevented from pretending the login container as the registered container, thereby preventing the cloud database resources from being abused.

[0116] In some embodiments of the authentication method of the present application, as shown in Figure 6 the type of the landing container is obtained according to the environment characteristics, including:

[0117] S331, judging whether the pod field is contained in the key field of the environment characteristics;

[0118] S332, if the pod field is contained, determining that the type of the landing container is the Pod container;

[0119] S333, if the pod field is not contained, judging whether the docker field is contained in the key field of the environment characteristics;

[0120] S334, if the docker field is contained, determining that the type of the landing container is the Docker container;

[0121] S335, if the docker field is not contained, determining that the type of the landing container is the physical machine.

[0122] The principle of judging the type of the landing container through the key field of the environment characteristics can be similar to judging the type of the registered container, which will not be repeated here. By querying the key field, the type of the landing container can be quickly and accurately judged, thereby providing a basis for extracting the second identity feature.

[0123] In some embodiments of the authentication method of the present application, as shown in Figure 7 the unique to-be-verified identity identifier corresponding to the landing container is generated according to the second identity feature, including:

[0124] S411, obtaining the persistent random identity code of the landing container;

[0125] S412, combining the second identity feature and the persistent random identity code of the landing container through a preset obfuscated encryption algorithm to generate the to-be-verified identity identifier.

[0126] Only the registered container that has completed registration can log in the cloud database, and therefore, the landing container must have the persistent random identity code. The landing container can upload the random identity code to the cloud database, and the cloud database uses the same preset obfuscated encryption algorithm to combine the second identity feature obtained by the cloud database and the random identity code to generate the to-be-verified identity identifier. That is, only when the persistent random identity code is consistent with the registered container, and the second identity feature is also consistent with the first identity feature, the identity identifier and the to-be-verified identity identifier are consistent. In this way, it can be prevented that the landing container is falsely made as other containers by the user, thereby preventing the cloud database resources from being abused.

[0127] In some embodiments of the authentication method of the present application, as shown in Figures 8-10As shown, after the unique identity corresponding to the registration container is generated according to the first identity feature, the authentication method further comprises:

[0128] S611, uploading the identity to the cloud database;

[0129] S612, the cloud database generates an identity certificate according to the identity and stores it in the registration container.

[0130] As shown, after the unique identity corresponding to the registration container is generated according to the first identity feature, the authentication method further comprises:

[0131] S613, the cloud database generates a to-be-verified identity certificate according to the to-be-verified identity.

[0132] The authentication of the login container according to the identity and the to-be-verified identity comprises:

[0133] S614, uploading the identity certificate stored in the login container to the cloud database;

[0134] S615, judging whether the identity certificate and the to-be-verified identity certificate are consistent;

[0135] S616, if consistent, the authentication is passed;

[0136] S617, if inconsistent, the authentication fails.

[0137] Exemplarily, a identity generation file (for example, sys_sign) is set in the bin directory of the system file of the registration container, which can be a binary file. When the user registers, the identity generation file is called as part of the container-side database startup process. When the identity generation file is executed, the first identity feature (for example, calling the relevant file in the / proc / 1 / cgroup directory) is obtained and the identity is generated. The identity contains the first identity feature and has global uniqueness. Then, the registration container uploads the identity to the cloud database related module (for example, the after-sales module), and the cloud database generates an identity certificate (for example, license.dat) according to the identity. The registration container stores the identity certificate in the specified directory.

[0138] In particular, in the prior art, a license.dat is usually also set, however, the license.dat contains the physical address of the physical machine or the container name specified by the user of the non-physical machine. In the embodiment, only the physical address and the container name in the license.dat are changed to the identity, so that the original system can be used without too many changes to the system, and the existing equipment can be conveniently modified.

[0139] When a user logs in using the login container, the login container uploads the identity certificate of its designated directory to the cloud database. The cloud database uses the same method as the identity generation file to obtain the second identity feature of the login container and generate a to-be-verified identity certificate (for example, another license.dat). By comparing the identity certificate and the to-be-verified identity certificate, it can be determined whether the login container is the same container as the registration container. If it is the same container, the authentication is passed, and the login container is authorized to use the cloud database related services. If it is not the same container, the authentication fails, and the login container is refused to use the cloud database related services.

[0140] In some embodiments of the authentication method of the present application, as shown in Figure 11 The authentication method comprises:

[0141] S711, in response to the login container logging in the cloud database, judging the type of the login container;

[0142] S712, if the type of the login container is a physical machine, obtaining its physical address and performing authentication through the physical address;

[0143] S713, if the type of the login container is a non-physical machine, judging whether it has an identity certificate;

[0144] S714, if there is no identity certificate, determining that it is a user trial scenario; and calling the port of the login container to generate a trial identity certificate;

[0145] S715, if there is an identity certificate, obtaining the to-be-verified identity certificate of the login container; and performing authentication on the login container according to the identity certificate and the to-be-verified identity certificate.

[0146] Specifically, when the login container database end main process (for example, KES_MasterMain) runs, it will load the identity certificate (for example, license) related information, then call the version information tool (for example, License CheckproductDistribution) to check the version information of the product, and call the certificate checking tool (for example, License General Check) to check its identity related information (for example, GIS information, CPU information, identity certificate, random identity code, etc.). By checking the identity related information, the physical machine can be authenticated through the physical address, and the non-physical machine can be authenticated through the identity certificate. In this way, it can effectively prevent users from copying the physical address or container name of the non-physical machine to abuse cloud database resources.

[0147] The flowcharts provided by the embodiments are not intended to indicate that the operations of the methods will be executed in any particular order, or that all of the operations included in the methods will be included in every case. In addition, the methods can include additional operations. Additional changes can be made to the above-described methods within the scope of the technical ideas provided by the embodiments.

[0148] It should be understood that in some embodiments, the parts can be implemented by hardware, software, firmware or a combination thereof. In the above-described embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system.

[0149] The embodiments also provide a computer program product 10 and a computer readable storage medium 20. Figure 13 is a schematic diagram of a computer program product 10 according to an embodiment of the application, Figure 12 is a schematic diagram of a computer readable storage medium 20 according to an embodiment of the application. The computer program product 10 includes a computer program 11 which, when executed by a processor 32, implements the steps of any of the above-described authentication methods. The computer readable storage medium 20 has stored thereon the above-described computer program 11 which, when executed by the processor 32, implements the steps of any of the above-described authentication methods.

[0150] The computer program 11 for performing the operations of the present application can be in assemblies instructions, Instruction Set Architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, configuration data for integrated circuits, or in source code or object code written in any combination of one or more programming languages, all of which can be transformed by an implementation of the present application. The computer program 11 can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate array (FPGA), or programmable logic array (PLA) can execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present application.

[0151] For the description of the present embodiment, the computer program product 10 is the relevant product containing the computer program 11.

[0152] For the description of the present embodiment, the computer readable storage medium 20 is a tangible device that can retain and store the computer program 11, which can be any apparatus that can contain, store, communicate, propagate or transport the computer program 11 for use by or in connection with the instruction execution system, apparatus or device. More specific examples (a non-exhaustive list) of the computer readable storage medium 20 include the following: portable computer diskette, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, and any suitable combination of the above, or any other medium of the moment.

[0153] The computer program product 10 can be run on a computer device. The computer device can include a memory, a processor 32, and a computer program 11 stored on the memory and run on the processor 32. The computer device can be, for example, a server, a desktop computer, a notebook computer, a tablet computer, or a smartphone. In some examples, the computer device can be a cloud computing node. The computer device can be described in the general context of computer system-executable instructions, such as program modules, being executed by a computer system. Generally, program modules can include routines, programs, objects, components, logic, data structures, and the like that perform particular tasks or implement particular abstract data types. The computer device can be practiced in distributed cloud computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules can be located in local or remote computer system storage media including memory storage devices.

[0154] The computer device can include a processor 32 adapted to execute stored instructions, a memory that provides temporary storage for operating system and other instructions during execution of operations. The processor 32 can be a single core processor, a multi-core processor, a computing cluster, or any number of other configurations. The memory can include random access memory (RAM), read only memory, flash memory, or any other suitable memory systems.

[0155] The computer device can also include a network adapter / interface and an input / output (I / O) interface. The I / O interface allows for input and output of data with external devices that can be connected to the computer device. The network adapter / interface can provide for communication between the computer device and a network, typically illustrated as a communication network.

[0156] At this point, those skilled in the art will appreciate that although specific examples of the application have been herein illustrated and described, various modifications can be made within the scope and spirit of the application. Accordingly, all such modifications are intended to be part of the total aspects of the application described herein.

Claims

1. A user identity authentication method of a cloud database, characterized by, The application comprises the following steps: acquiring a first identity feature of a user registration container, the registration container including any one of a Pod container, a Docker container and a physical machine, the first identity feature being bound to the registration container; generating a unique identity corresponding to the registration container according to the first identity feature; acquiring a second identity feature of a user login container, the login container including any one of the Pod container, the Docker container and the physical machine, the second identity feature being bound to the login container; generating a unique to-be-verified identity corresponding to the login container according to the second identity feature; authenticating the login container according to the identity and the to-be-verified identity. The step of generating a unique identity corresponding to the registration container according to the first identity feature comprises the following steps: acquiring a random identity code; persisting the random identity code; combining the first identity feature and the persisted random identity code to generate the identity through a preset obfuscated encryption algorithm.

2. The authentication method of claim 1, wherein, The step of acquiring a first identity feature of a user registration container comprises the following steps: acquiring an environment feature of the registration container; obtaining the type of the registration container according to the environment feature; if the registration container is the Pod container, taking the network address unique identifier thereof as the first identity feature; if the registration container is the Docker container, taking the unique identifier thereof as the first identity feature; if the registration container is the physical machine, taking the physical address thereof as the first identity feature.

3. The authentication method of claim 2, wherein, The step of obtaining the type of the registration container according to the environment feature comprises the following steps: judging whether the pod field is contained in the key field of the environment feature; if the pod field is contained, determining that the type of the registration container is the Pod container; if the pod field is not contained, judging whether the docker field is contained in the key field of the environment feature; if the docker field is contained, determining that the type of the registration container is the Docker container; if the docker field is not contained, determining that the type of the registration container is the physical machine.

4. The authentication method of claim 1, wherein, The step of generating a unique to-be-verified identity corresponding to the login container according to the second identity feature comprises the following steps: acquiring the persisted random identity code of the login container; combining the second identity feature and the persisted random identity code of the login container to generate the to-be-verified identity through the preset obfuscated encryption algorithm.

5. The authentication method of claim 1, wherein, The step of acquiring a second identity feature of a user login container comprises the following steps: acquiring an environment feature of the login container; obtaining the type of the login container according to the environment feature; if the login container is the Pod container, taking the network address unique identifier thereof as the second identity feature; if the login container is the Docker container, taking the unique identifier thereof as the second identity feature; if the login container is the physical machine, taking the physical address thereof as the second identity feature.

6. The authentication method of claim 5, wherein, The type of the landing container is obtained according to the environment characteristics, and the type of the landing container comprises: determining whether the pod field is contained in the key field of the environment characteristics; if the pod field is contained, determining that the type of the landing container is the Pod container; if the pod field is not contained, determining whether the docker field is contained in the key field of the environment characteristics; if the docker field is contained, determining that the type of the landing container is the Docker container; if the docker field is not contained, determining that the type of the landing container is the physical machine.

7. The authentication method according to claim 1, wherein, after the unique identity corresponding to the registration container is generated according to the first identity characteristics, the authentication method further comprises: uploading the identity to the cloud database; the cloud database generates an identity certificate according to the identity and stores the identity certificate in the registration container; after the unique to-be-verified identity corresponding to the landing container is generated according to the second identity characteristics, the authentication method further comprises: the cloud database generates a to-be-verified identity certificate according to the to-be-verified identity; the landing container is authenticated according to the identity and the to-be-verified identity, and the authentication comprises: uploading the identity certificate stored in the landing container to the cloud database; determining whether the identity certificate and the to-be-verified identity certificate are consistent; if the identity certificate and the to-be-verified identity certificate are consistent, the authentication is passed; if the identity certificate and the to-be-verified identity certificate are not consistent, the authentication fails.

8. A computer-readable storage medium, characterized in that, A computer program is stored on the computer, and the computer program is executed by the processor to realize the steps of the user identity authentication method of the cloud database according to any one of claims 1 to 7.

9. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to realize the steps of the user identity authentication method of the cloud database according to any one of claims 1 to 7.

Images