Policy preview method based on cloud management platform and cloud management platform

Abstract

The invention discloses a strategy previewing method based on a cloud management platform and the cloud management platform, which are beneficial for tenants to formulate access control strategies with higher quality, and the cloud management platform authenticates the tenants based on the access control strategies, so that a better effect can be achieved. The method comprises the steps that a cloud management platform receives a first access control strategy and assignment information input by a tenant through an editing interface, the first access control strategy comprises a first parameter to be assigned, and the first access control strategy is used for the cloud management platform to authenticate the tenant; if the assignment information contains a first numerical value set by the tenant for the first parameter, the cloud management platform assigns the first parameter in the first access control strategy based on the first numerical value to obtain an assigned second parameter and a second access control strategy containing the second parameter; and the cloud management platform displays a second access control strategy to the tenant through the preview interface, wherein the second access control strategy is used for indicating that the cloud management platform successfully or unsuccessfully authenticates the tenant.

Description

[0001] This application claims priority to a Chinese patent application filed on October 19, 2023 with application number 202311360093.4 and application name “A policy variable preview method based on a cloud management platform and a cloud management platform”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The embodiments of the present application relate to the field of cloud technology, and in particular to a policy preview method based on a cloud management platform and a cloud management platform. Background Art

[0003] In a cloud service system, when a tenant accesses a cloud management platform, the cloud management platform usually needs to authenticate the tenant first. Therefore, the attribute-based access control (ABAC) mechanism comes into being. This mechanism defines an access control mechanism for tenants. This mechanism can authenticate tenants through preset access control policies to allow or deny tenant access based on the authentication results.

[0004] In related technologies, access control policies are usually formulated in advance by tenants. After receiving the access control policies formulated in advance by the tenants, the cloud management platform will store the access control policies formulated by the tenants. Then, when the tenants subsequently access the cloud management platform, that is, when the tenants send requests to the cloud management platform, the cloud management platform can use the requests to process the access control policies, thereby obtaining the processed access control policies. Then, the cloud management platform can determine whether the authentication of the tenant is successful based on the content expressed in the processed access control policies.

[0005] In the above process, when the tenant sends the designated access control policy to the cloud management platform, the cloud management platform often only performs a grammatical check on the access control policy so that the tenant can formulate a grammatically correct access control policy. In this way, the factors considered in the access control policy check are relatively simple. Therefore, the authentication of the tenant based on the access control policy obtained in this way is often not effective. Summary of the invention

[0006] The embodiment of the present application provides a policy preview method based on a cloud management platform and a cloud management platform, which is conducive to tenants to formulate better access control policies. Therefore, the cloud management platform can authenticate tenants based on these access control policies and achieve better results.

[0007] A first aspect of an embodiment of the present application provides a policy preview method based on a cloud management platform, the method comprising:

[0008] When a tenant has a need to formulate an access control policy, the cloud management platform can provide the tenant with an editing interface, so that the tenant can send the first access control policy formulated by the tenant and the assignment information to the editing interface, so that the cloud management platform receives the first access control policy and the assignment information sent by the tenant through the editing interface. It should be noted that the first access control policy formulated by the tenant can be presented as a first text written by the tenant, and the first text contains a first parameter to be assigned. The content described in the first text is usually the content in which the tenant instructs the cloud management platform how to authenticate the tenant. Since the first parameter has not yet been assigned, these contents are usually to be supplemented.

[0009] After obtaining the first access control policy and assignment information formulated by the tenant, the cloud management platform can detect whether the assignment information contains the first value set by the tenant for the first parameter. If the assignment information contains the first value, the cloud management platform can use the first value to assign the first parameter in the first access control policy, thereby obtaining the assigned second parameter and the second access control policy containing the second parameter. At this point, the cloud management platform has completed the simulation assignment for the first access control, thereby obtaining the second access control policy.

[0010] After obtaining the second access control policy, the cloud management platform can provide a preview interface to the tenant to display the second access control policy to the tenant through the preview interface, so that the tenant can determine whether the cloud management platform's simulated authentication for itself is successful based on the content of the second access control policy, and then determine whether the first access control policy formulated by itself is available.

[0011] It can be seen from the above method that the cloud management platform can be combined with the first access control policy. In the above process, after the cloud management platform completes the simulation assignment of the first access control policy formulated by the tenant using the assignment information formulated by the tenant, the obtained second access control policy is displayed to the tenant in a visual interface (i.e., preview interface). Therefore, the cloud management platform can not only display to the tenant the content of the second access control policy that has not changed compared with the first access control policy, but also display to the tenant the content of the second access control policy that has changed compared with the first access control policy. The tenant can check whether the content that has not changed (i.e., the content that describes how the cloud management platform set by the tenant authenticates the tenant) has syntax problems, and can also confirm whether the content that has changed (i.e., the replaced parameters, such as the second parameter that replaces the first parameter) meets the tenant's needs and the factors considered. In this way, the inspection of the first access control policy can consider more comprehensive factors, and the first access control policy obtained by this method can be used to authenticate the tenant, which can have a better effect.

[0012] In a possible implementation, if the assignment information includes a first value set by the tenant for the first parameter, the cloud management platform assigns a value to the first parameter in the first access control policy based on the first value, and obtains the assigned second parameter and the second access control policy including the second parameter, including: if the assignment information includes the first value, and the first access control policy does not include the second value set by the tenant for the first parameter, the cloud management platform assigns a value to the first parameter in the first access control policy based on the first value, and obtains the assigned second parameter and the second access control policy including the second parameter. In the aforementioned implementation, after obtaining the first access control policy and the assignment information formulated by the tenant, the cloud management platform can detect whether the assignment information includes the first value set by the tenant for the first parameter and whether the first access control policy includes the second value set by the tenant for the first parameter. If the assignment information includes the first value, and the first access control policy does not include the second value, the cloud management platform can directly use the first value to assign a value to the first parameter in the first access control policy, thereby obtaining the assigned second parameter and the second access control policy including the second parameter. It can be seen from this that if the tenant only specifies the set value (i.e., the first numerical value) of the parameter in the access control policy to be assigned (i.e., the first access control policy) in the assignment information formulated by the tenant, the cloud management platform uses this set value to simulate the assignment of the parameter, thereby obtaining the assigned access control policy (i.e., the second access control policy). Therefore, both the cloud management platform and the tenant can determine whether the cloud management platform's simulated authentication of the tenant is successful based on the content of the assigned access control policy, and then determine whether the access control policy formulated by the tenant is available.

[0013] In a possible implementation, if the assignment information includes a first value set by the tenant for the first parameter, the cloud management platform assigns a value to the first parameter in the first access control policy based on the first value, and obtains the assigned second parameter and the second access control policy including the second parameter, including: if the assignment information includes the first value, and the first access control policy includes the second value set by the tenant for the first parameter, the cloud management platform assigns a value to the first parameter in the first access control policy based on the first value, and obtains the assigned second parameter and the second access control policy including the second parameter. In the aforementioned implementation, after obtaining the first access control policy and the assignment information formulated by the tenant, the cloud management platform can detect whether the assignment information includes the first value set by the tenant for the first parameter and whether the first access control policy includes the second value set by the tenant for the first parameter. If the assignment information includes the first value, and the first access control policy includes the second value, since the priority of the second value is lower than the priority of the first value, the cloud management platform can use the first value to assign a value to the first parameter in the first access control policy, and obtain the assigned second parameter and the second access control policy including the second parameter. It can be seen from this that if the tenant not only specifies the set value of the parameter in the access control policy to be assigned in the assignment information it formulates, but also specifies the default value of the parameter (i.e., the second value) in the access control policy to be assigned, the cloud management platform will preferentially use this set value to simulate the assignment of the parameter, thereby obtaining the assigned access control policy. Therefore, both the cloud management platform and the tenant can determine whether the cloud management platform's simulated authentication of the tenant is successful based on the content of the assigned access control policy, and then determine whether the access control policy formulated by the tenant is available.

[0014] In one possible implementation, the method further includes: if the assignment information does not include the first value, and the first access control policy includes the second value set by the tenant for the first parameter, the cloud management platform assigns the first parameter in the first access control policy based on the second value, and obtains the assigned third parameter and the third access control policy including the third parameter; the cloud management platform displays the third access control policy to the tenant through a preview interface, and the third access control policy is used to indicate whether the cloud management platform successfully or failed to authenticate the tenant. In the aforementioned implementation, if the assignment information does not include the first value, the cloud management platform can detect whether the first access control policy includes the second value set by the tenant for the first parameter. If the first access control policy includes the second value, the cloud management platform can use the second value to assign the first parameter in the first access control policy, thereby obtaining the assigned third parameter and the third access control policy including the third parameter. At this point, the cloud management platform has completed the simulated assignment for the first access control, thereby obtaining the third access control policy. After obtaining the third access control policy, the cloud management platform can provide a preview interface to the tenant to display the third access control policy to the tenant through the preview interface, so that the tenant can determine whether the first access control policy it has formulated is available based on the content of the third access control policy. It can be seen that if the tenant does not formulate the set value of the parameter in the access control policy to be assigned in the assignment information formulated by it, and only specifies the default value of the parameter in the access control policy to be assigned, the cloud management platform uses this default value to simulate the assignment of the parameter, thereby obtaining the assigned access control policy (i.e., the third access control policy). Therefore, the cloud management platform and the tenant can determine whether the simulated authentication of the cloud management platform for the tenant is successful based on the content of the assigned access control policy, and then determine whether the access control policy formulated by the tenant is available.

[0015] In a possible implementation, the method further includes: if the assignment information does not include the first value, and the first access control policy does not include the second value set by the tenant for the first parameter, the cloud management platform displays the assignment result to the tenant through a preview interface, the assignment result includes the position of the first parameter in the first access control policy and the notification information for the failure of the assignment of the first parameter, and the assignment result is used to indicate that the cloud management platform has failed to authenticate the tenant. In the aforementioned implementation, if the first access control policy does not include the second value, the cloud management platform can directly determine that the simulation assignment for the first access control policy cannot be completed, and also directly determine that the simulation authentication for the tenant has failed. In response to this situation, the cloud management platform can generate an assignment result for indicating this situation, the assignment result includes the position of the first parameter in the first access control policy and the notification information for indicating the failure of the assignment for the first parameter, so a preview interface can be provided to the tenant to display the assignment result to the tenant through the preview interface. Then, after viewing the assignment result, the tenant can determine that the first access control policy it has formulated is unavailable, and then readjust the first access control policy and / or the assignment information. It can be seen from this that if the tenant does not specify the set value of the parameter in the access control policy to be assigned in the assignment information it has formulated, and does not specify the default value of the parameter in the access control policy to be assigned, the cloud management platform will not be able to complete the simulated assignment, which is equivalent to the failure of the simulated authentication for the tenant. Therefore, the cloud management platform can notify the tenant of this situation so that the tenant can determine that the access control policy it has formulated is unavailable and readjust the access control policy and / or assignment information.

[0016] In a possible implementation, the method further includes: the cloud management platform performs semantic analysis on the second parameter based on preset semantic rules to obtain a first semantic analysis result of the second parameter; if the first semantic analysis result is used to indicate that the second parameter conforms to the semantic rule, the second access control policy is used to indicate that the cloud management platform successfully authenticates the tenant; if the first semantic analysis result is used to indicate that the second parameter does not conform to the semantic rule, the second access control policy is used to indicate that the cloud management platform fails to authenticate the tenant; the cloud management platform displays the first semantic analysis result to the tenant through a preview interface. In the above implementation, after obtaining the second access control policy, the cloud management platform can obtain the preset semantic rules, and perform semantic analysis on the second parameter included in the second access control policy based on the preset semantic rules, thereby obtaining the first semantic analysis result of the second parameter. If the first semantic analysis result is used to indicate that the second parameter conforms to the preset semantic rules, it is equivalent to indicating that there is no semantic problem in the second access control policy, so the cloud management platform can determine that the simulated authentication for the tenant is successful; if the first semantic analysis result is used to indicate that the second parameter does not conform to the semantic rule, it is equivalent to indicating that there is a semantic problem in the second access control policy, so the cloud management platform can determine that the simulated authentication for the tenant fails. Then, the cloud management platform can display the first semantic analysis result to the tenant through a preview interface for the tenant to view, so as to determine whether the first access control policy formulated by the tenant is available. It can be seen that if the cloud management platform determines that the content of the second access control policy changed compared with the first access control policy has a semantic problem (such as the second parameter that replaces the first parameter does not conform to the preset semantic rules), it can also inform the tenant through a visual interface, so that the tenant can make targeted adjustments to the first access control policy and / or assignment information formulated by the tenant in response to this situation, thereby improving the user experience and policy adjustment efficiency.

[0017] In a possible implementation, the method further includes: the cloud management platform performs semantic analysis on the third parameter based on preset semantic rules to obtain a second semantic analysis result of the third parameter; if the second semantic analysis result is used to indicate that the third parameter conforms to the semantic rule, the third access control policy is used to indicate that the cloud management platform successfully authenticates the tenant; if the second semantic analysis result is used to indicate that the third parameter does not conform to the semantic rule, the third access control policy is used to indicate that the cloud management platform fails to authenticate the tenant; the cloud management platform displays the second semantic analysis result to the tenant through a preview interface. In the above implementation, after obtaining the third access control policy, the cloud management platform can obtain the preset semantic rules, and perform semantic analysis on the third parameter contained in the third access control policy based on the preset semantic rules, thereby obtaining the second semantic analysis result of the third parameter. If the second semantic analysis result is used to indicate that the third parameter conforms to the preset semantic rules, it is equivalent to indicating that there is no semantic problem with the third access control policy, so the cloud management platform can determine that the simulated authentication for the tenant is successful; if the second semantic analysis result is used to indicate that the third parameter does not conform to the semantic rule, it is equivalent to indicating that there is a semantic problem with the third access control policy, so the cloud management platform can determine that the simulated authentication for the tenant fails. Then, the cloud management platform can display the second semantic analysis result to the tenant through the preview interface for the tenant to view, so as to determine whether the third access control policy formulated by the tenant is applicable. It can be seen that if the cloud management platform determines that the content of the third access control policy changed compared with the first access control policy has a semantic problem (such as the third parameter that replaces the first parameter does not conform to the preset semantic rules), it can also inform the tenant through a visual interface, so that the tenant can make targeted adjustments to the first access control policy and / or assignment information formulated by the tenant in response to this situation, thereby improving the user experience and policy adjustment efficiency.

[0018] A second aspect of an embodiment of the present application provides a cloud management platform, which includes: a receiving module, which is used to receive a first access control policy and assignment information input by a tenant through an editing interface, the first access control policy including a first parameter to be assigned, and the first access control policy is used for the cloud management platform to authenticate the tenant; an assignment module, which is used to assign a first parameter in the first access control policy based on the first value if the assignment information includes a first value set by the tenant for the first parameter, to obtain an assigned second parameter and a second access control policy including the second parameter; and a display module, which is used to display the second access control policy to the tenant through a preview interface, and the second access control policy is used to indicate whether the cloud management platform has successfully or failed to authenticate the tenant.

[0019] In one possible implementation, an assignment module is used to assign a first parameter in the first access control policy based on the first value if the assignment information includes a first value and the first access control policy does not include a second value set by the tenant for the first parameter, to obtain an assigned second parameter and a second access control policy including the second parameter.

[0020] In one possible implementation, an assignment module is used to assign a first parameter in the first access control policy based on the first value if the assignment information includes a first value and the first access control policy includes a second value set by the tenant for the first parameter, to obtain the assigned second parameter and a second access control policy including the second parameter.

[0021] In one possible implementation, the assignment module is also used to assign the first parameter in the first access control policy based on the second value if the assignment information does not include the first value and the first access control policy includes the second value set by the tenant for the first parameter, so as to obtain the assigned third parameter and the third access control policy including the third parameter; the display module is also used to display the third access control policy to the tenant through a preview interface, and the third access control policy is used to indicate whether the cloud management platform has successfully or failed to authenticate the tenant.

[0022] In one possible implementation, the assignment module is also used to display the assignment result to the tenant through a preview interface if the assignment information does not include the first value and the first access control policy does not include the second value set by the tenant for the first parameter. The assignment result includes the position of the first parameter in the first access control policy and notification information indicating the failure of the assignment to the first parameter. The assignment result is used to indicate that the cloud management platform has failed to authenticate the tenant.

[0023] In one possible implementation, the cloud management platform also includes: a semantic analysis module, which is used to perform semantic analysis on the second parameter based on preset semantic rules to obtain a first semantic analysis result of the second parameter; if the first semantic analysis result is used to indicate that the second parameter complies with the semantic rules, then the second access control policy is used to indicate that the cloud management platform has successfully authenticated the tenant; if the first semantic analysis result is used to indicate that the second parameter does not comply with the semantic rules, then the second access control policy is used to indicate that the cloud management platform has failed to authenticate the tenant; a display module, which is also used to display the first semantic analysis result to the tenant through a preview interface.

[0024] In one possible implementation, the cloud management platform also includes: a semantic analysis module, which is used to perform semantic analysis on the third parameter based on preset semantic rules to obtain a second semantic analysis result of the third parameter; if the second semantic analysis result is used to indicate that the third parameter complies with the semantic rules, then the third access control policy is used to indicate that the cloud management platform has successfully authenticated the tenant; if the second semantic analysis result is used to indicate that the third parameter does not comply with the semantic rules, then the third access control policy is used to indicate that the cloud management platform has failed to authenticate the tenant; a display module, which is also used to display the second semantic analysis result to the tenant through a preview interface.

[0025] A third aspect of an embodiment of the present application provides a computing device cluster, the computing device cluster includes at least one computing device, each computing device includes a processor and a memory: the memory is used to store instructions; the processor is used to enable the computing device cluster to execute the method described in the first aspect or any possible implementation method of the first aspect according to the instructions.

[0026] A fourth aspect of an embodiment of the present application provides a computer storage medium, which stores one or more instructions. When the instructions are executed by one or more computers, the one or more computers implement the method described in the first aspect or any possible implementation method of the first aspect.

[0027] A fifth aspect of the embodiments of the present application provides a computer program product, which stores instructions. When the instructions are executed by a computer, the computer implements the method described in the first aspect or any possible implementation method of the first aspect.

[0028] In an embodiment of the present application, when a tenant needs to formulate an access control policy, the cloud management platform can provide an editing interface to the tenant so that the tenant can input the first access control policy and assignment information formulated by the tenant into the editing interface, so the cloud management platform can receive the first access control policy and assignment information from the tenant through the editing interface, wherein the first access control policy includes the first parameter to be assigned, and the first access control policy can be used for the cloud management platform to simulate the authentication of the tenant. Then, the cloud management platform can detect whether the assignment information includes the first value set by the tenant for the first parameter. If the assignment information includes the first value, the cloud management platform simulates the assignment of the first parameter in the first access control policy based on the first value, thereby obtaining the assigned second parameter and the second access control policy containing the second parameter. Then, the cloud management platform can display the second access control policy to the tenant through the preview interface, so the tenant can determine whether the simulated authentication of the cloud management platform for itself is successful based on the content of the second access control policy, and then determine whether the first access control policy formulated by itself is available. In the above process, the cloud management platform can be combined with the first access control policy. In the above process, after the cloud management platform completes the simulation assignment of the first access control policy formulated by the tenant using the assignment information formulated by the tenant, the cloud management platform displays the obtained second access control policy to the tenant in a visual interface (i.e., preview interface). Therefore, the cloud management platform can not only show the tenant the content of the second access control policy that has not changed compared with the first access control policy, but also show the tenant the content of the second access control policy that has changed compared with the first access control policy. The tenant can check whether the content that has not changed (i.e., the content that describes how the cloud management platform set by the tenant authenticates the tenant) has syntax problems, and can also confirm whether the changed content (i.e., the replaced parameters, such as the second parameter that replaces the first parameter) meets the tenant's needs and the factors considered. In this way, the check on the first access control policy can consider more comprehensive factors, and the first access control policy obtained by checking in this way is used to authenticate the tenant, which can have a better effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 A schematic diagram of the structure of a cloud service system provided in an embodiment of the present application;

[0030] Figure 2 A schematic diagram of a cloud management platform-based policy preview method provided in an embodiment of the present application;

[0031] Figure 3 A schematic diagram of a tenant interface provided in an embodiment of the present application;

[0032] Figure 4 Another schematic diagram of a tenant interface provided in an embodiment of the present application;

[0033] Figure 5 Another schematic diagram of a tenant interface provided in an embodiment of the present application;

[0034] Figure 6 A schematic diagram of the structure of the cloud management platform provided in the embodiment of the present application;

[0035] Figure 7 A schematic diagram of a structure of a computing device provided in an embodiment of the present application;

[0036] Figure 8 A schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application;

[0037] Fig. 9 A schematic diagram of computer devices in a computer cluster provided in an embodiment of the present application being connected via a network. DETAILED DESCRIPTION

[0038] The embodiment of the present application provides a policy preview method based on a cloud management platform and a cloud management platform, which is conducive to tenants to formulate better access control policies. Therefore, the cloud management platform can authenticate tenants based on these access control policies and achieve better results.

[0039] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0040] In a cloud service system, when a tenant accesses a cloud management platform, the cloud management platform usually needs to authenticate the tenant first. Therefore, an attribute-based access control mechanism comes into being. This mechanism defines an access control mechanism for tenants. This mechanism can authenticate tenants through preset access control policies to allow or deny tenant access based on the authentication results.

[0041] In related technologies, access control policies are usually formulated in advance by tenants. After receiving the access control policies formulated in advance by the tenants, the cloud management platform will store the access control policies formulated by the tenants. Then, when the tenants subsequently access the cloud management platform, that is, when the tenants send requests to the cloud management platform, the cloud management platform can use the requests to process the access control policies, thereby obtaining the processed access control policies. Then, the cloud management platform can determine whether the authentication of the tenant is successful based on the content expressed in the processed access control policies.

[0042] In the above process, when the tenant sends the designated access control policy to the cloud management platform, the cloud management platform often only performs a grammatical check on the access control policy so that the tenant can formulate a grammatically correct access control policy. In this way, the factors considered in the access control policy check are relatively simple. Therefore, the authentication of the tenant based on the access control policy obtained in this way is often not effective.

[0043] Furthermore, in the related technology, the cloud management platform will simulate the access control policy formulated by the tenant. The management platform can notify the tenant whether there is a problem with the access control policy formulated by the tenant based on the simulated access control policy (for example, whether the syntax is correct, etc.). If there is a problem, the cloud management platform cannot tell the tenant what problem has occurred in the access control policy it has formulated. This is a black box for the tenant. The tenant can only rewrite a new access control policy but cannot make improvements only to the places where the problem occurs, resulting in a poor tenant experience.

[0044] In order to solve the above problems, the embodiment of the present application provides a policy preview method based on a cloud management platform, which can be implemented through a cloud service system. Figure 1 A schematic diagram of the structure of the cloud service system provided in the embodiment of the present application is as follows: Figure 1 As shown in the figure, the cloud service system includes the infrastructure that can provide cloud services and the cloud management platform that manages these infrastructures. The cloud management platform and infrastructure are introduced separately below:

[0045] The cloud management platform can coordinate the management of multiple cloud instances in the entire cloud service system (for example, create a dedicated cloud instance for a tenant. When a tenant accesses the cloud management platform and sends a request, the cloud management platform authenticates the tenant based on the request. After successful authentication, the cloud instance can be called to provide cloud services to the tenant, etc.). It can also be open to tenants outside the system and respond to their requests. For example, the cloud management platform can provide various interfaces such as login interface, editing interface and preview interface for access by the tenant's client (for example, the terminal device used by the tenant or the browser on the terminal device, etc.). Among them, the cloud management platform can authenticate the tenant's client through the login interface, and after successful authentication, the tenant's client can be allowed to log in to the cloud management platform. For another example, the cloud management platform can also allow the tenant's client to send the tenant's access control policy to be assigned (the access control policy usually contains one or more parameters to be assigned) and assignment information (the assignment information can contain the values ​​set by the tenant for the parameters to be assigned in the access control policy) to the cloud management platform through the editing interface. Then, the cloud management platform can assign values ​​to the parameters to be assigned in the access control policy to be assigned based on the assignment information, thereby obtaining the assigned access control policy. For another example, the cloud management platform can also send the assigned access control policy to the tenant's client through the preview interface, so that the assigned access control policy can be displayed on the client for the tenant to view and use.

[0046] The infrastructure includes multiple cloud instances created by the cloud management platform for tenants. It should be noted that for any one of the multiple cloud instances, the cloud instance can be presented in a variety of ways, for example, the cloud instance can be a physical server designated by the cloud management platform, or a virtual machine (VM) created by the cloud management platform on a physical server through virtualization technology, or a container (docker) created by the cloud management platform on a physical server through virtualization technology, or a micro virtual machine (microVM) created by the cloud management platform on a physical server through virtualization technology, or a container (docker) created by the cloud management platform on a physical server through virtualization technology, or a bare metal server designated by the cloud management platform, etc.

[0047] Furthermore, these multiple cloud instances can be set up at one or more sites, and the sites can be presented in various forms. For example, one or more sites can be multiple regions in the infrastructure. For another example, one or more sites can be multiple availability zones in the infrastructure. For another example, one or more sites can be at least one edge site and at least one central cloud site in the infrastructure, and so on.

[0048] It should be noted that after the cloud management platform displays the assigned access control policy to the tenant for viewing, if the tenant confirms that the assigned access control policy is available, the cloud management platform will store the access control policy to be assigned formulated by the tenant and mark it as the tenant-specific access control policy. When the tenant subsequently accesses the cloud management platform and sends a request, the cloud management platform extracts the values ​​of the parameters to be assigned in the access control policy to be assigned from the request, and assigns these parameters based on these values. If the assignment is successful, the access control policy that has been assigned again can be obtained. The cloud management platform can determine whether the authentication of the tenant is successful or failed based on the content of the access control policy that has been assigned again. If the authentication is successful, the cloud instance can be called to provide cloud services to the tenant in response to the tenant's request. If the assignment fails, the cloud management platform determines that the authentication of the tenant has failed and rejects the tenant's request.

[0049] It can be seen that after receiving the access control policy to be assigned and the assignment information formulated by the tenant, the cloud management platform can use the access control policy to be assigned and the assignment information to complete the simulated assignment, so as to display the assigned access control policy obtained by the simulated assignment to the tenant for preview. After the tenant browses and determines that the assigned access control policy obtained by the simulated assignment is available, the cloud management platform can store the access control policy to be assigned formulated by the tenant, and when the tenant's request is subsequently received, the cloud management platform can use the access control policy to be assigned and the tenant's request to complete the actual assignment, so as to determine whether the authentication for the tenant is successful based on the access control policy obtained by the re-assignment, and thus determine whether to respond to the tenant's request. In order to further understand this process, the following is combined with Figure 2 To further describe this process, Figure 2 A schematic diagram of a policy preview method based on a cloud management platform provided in an embodiment of the present application, such as Figure 2 As shown, the method includes:

[0050] 201. The cloud management platform receives a first access control policy and assignment information input by a tenant through an editing interface. The first access control policy includes a first parameter to be assigned. The first access control policy is used by the cloud management platform to authenticate the tenant.

[0051] In this embodiment, when a tenant has a need to formulate an access control policy, the cloud management platform can provide an editing interface to the client used by the tenant (for example, the access control policy input field and the simulation assignment input field of the tenant interface, etc.), so the tenant can send the first access control policy formulated by the tenant (which can also be understood as the access control policy to be assigned) and assignment information (which can also be understood as information related to the simulation assignment) to the editing interface through the client, so that the cloud management platform receives the first access control policy and assignment information sent by the tenant's client through the editing interface.

[0052] It should be noted that the first access control policy formulated by the tenant can be presented as a first text written by the tenant. The first text contains one or more first parameters to be assigned (which can also be understood as variables to be assigned). The content described in the first text is usually the content in which the tenant instructs the cloud management platform how to authenticate the tenant. Since the first parameter has not yet been assigned, these contents need to be supplemented.

[0053] For example, Figure 3 As shown ( Figure 3 A schematic diagram of a tenant interface provided in an embodiment of the present application) When a tenant needs to formulate an access control policy, the tenant can log in to the cloud management platform so that the cloud management platform can provide the tenant interface to the tenant. Then, the tenant can enter the access control policy to be assigned in the access control policy input field of the tenant interface:

[0054]

[0055] Based on the access control policy to be assigned, the content described in the policy is to detect whether the tenant's identity document (ID) is correct and whether the name of the policy "foo" is correct, so as to determine whether the tenant is allowed to create the policy "foo". It can be seen that the policy contains two parameters to be assigned, one parameter is the tenant ID "g:DomainId", and the other parameter is the policy "foo", and the default value of this parameter is "bar".

[0056] In addition, tenants can also enter simulation assignment information in the simulation assignment input field of the tenant interface:

[0057]

[0058]

[0059] Based on the simulated value assignment information, the tenant sets the value "xyz" for the parameter of the tenant ID "g:DomainId", and the tenant sets the value "abc" for the parameter of the policy "foo".

[0060] 202. The cloud management platform detects whether the value assignment information includes a first value set by the tenant for the first parameter.

[0061] After obtaining the first access control policy and assignment information formulated by the tenant, the cloud management platform can detect whether the assignment information contains the first value set by the tenant for the first parameter. If so, execute step 203; if not, execute step 205.

[0062] 203. If the assignment information includes the first value, the cloud management platform assigns a first parameter in the first access control policy based on the first value to obtain the assigned second parameter and a second access control policy including the second parameter.

[0063] If the assignment information includes the first value, the cloud management platform can use the first value to assign the first parameter in the first access control policy (for example, replace the first parameter with the first value, etc.), thereby obtaining the assigned second parameter (for example, replace the first value of the first parameter, etc.) and the second access control policy including the second parameter (which can also be understood as the assigned access control policy). At this point, the cloud management platform has completed the simulated assignment for the first access control, thereby obtaining the second access control policy.

[0064] It should be noted that the second access control policy obtained by the cloud management platform through simulated assignment can be presented as a second text obtained by the simulated assignment. The second text contains one or more second parameters to be assigned (which can also be understood as assigned variables). The content described in the second text is usually the content in which the tenant instructs the cloud management platform how to authenticate the tenant. Since the second parameter has been assigned, these contents have been completed. Furthermore, the cloud management platform can determine whether the simulated authentication for the tenant is successful based on whether there are semantic problems with these contents.

[0065] Specifically, the cloud management platform can obtain the second access control policy in the following ways:

[0066] (1) After obtaining the first access control policy and assignment information formulated by the tenant, the cloud management platform can detect whether the assignment information contains the first value set by the tenant for the first parameter and whether the first access control policy contains the second value set by the tenant for the first parameter.

[0067] (2) If the assignment information includes a first value and the first access control policy does not include a second value, the cloud management platform may directly use the first value to assign a first parameter in the first access control policy, thereby obtaining the assigned second parameter and a second access control policy including the second parameter.

[0068] (3) If the assignment information includes a first numerical value and the first access control policy includes a second numerical value, since the priority of the second numerical value is lower than the priority of the first numerical value, the cloud management platform can use the first numerical value to assign a first parameter in the first access control policy to obtain the assigned second parameter and a second access control policy including the second parameter.

[0069] Still like Figure 3In the example shown, after obtaining the access control policy to be assigned and the simulated assignment information, the cloud management platform can first parse the policy, that is, determine the position of each string in the policy (for example, the parameter "g:DomainId" is from the 7th row, 11th column to the 7th row, 24th column in the policy, etc.), and traverse each string to extract the two parameters to be assigned, "g:DomainId" and "foo", from the policy. Then, the cloud management platform can detect whether the simulated assignment information contains the set values ​​of "g:DomainId" and "foo", and whether the policy contains the default values ​​of "g:DomainId" and "foo".

[0070] Since the simulation assignment information contains the set value of "g:DomainId" and the access control policy to be assigned does not contain the default value of "g:DomainId", the cloud management platform can extract the set value "xyz" of "g:DomainId" from the simulation assignment information, replace "g:DomainId" with "xyz", and then record the following information: the parameter "g:DomainId" from row 7, column 11 to row 7, column 24 in the policy is replaced by the set value "xyz" from row 2, column 3 to row 2, column 22 in the simulation assignment information.

[0071] Since the simulated assignment information contains the set value of "foo", and the access control policy to be assigned contains the default value of "foo", and the priority of the set value is higher than the priority of the default value, the cloud management platform can extract the set value "xyz" of "foo" from the simulated assignment information, and replace "foo" with "abc", and then record the following information: the parameter "foo" from the 33rd column of the 7th row to the 45th column of the 7th row in the policy is replaced with the set value "abc". In this way, the cloud management platform can obtain the assigned access control policy.

[0072] It should be understood that in this embodiment, if the number of the first parameters is multiple, the above situation (2) and situation (3) may appear at the same time, or only one of them may appear. If the number of the first parameter is one, usually only one of situation (2) and situation (3) appears.

[0073] 204. The cloud management platform displays the second access control policy to the tenant through a preview interface. The second access control policy is used to indicate whether the cloud management platform successfully or failed to authenticate the tenant.

[0074] After obtaining the second access control policy, the cloud management platform can provide a preview interface (e.g., a preview window and a reminder window on the tenant interface, etc.) to the tenant's client to display the second access control policy on the tenant's client through the preview interface, so that the tenant can determine whether the first access control policy it has formulated is available based on the content of the second access control policy. If the tenant determines that the first access control policy is available, it can inform the cloud management platform through its client, so that the cloud management platform stores the first access control policy and uses the first access control policy as the basis for subsequent authentication of the tenant.

[0075] Still like Figure 3 In the example shown, after obtaining the assigned access control policy, the cloud management platform can display the assigned access control policy in the preview window of the user interface:

[0076]

[0077] Then, the tenant can browse the assigned access control policy in the preview window to determine whether the access control policy it has formulated is available.

[0078] Specifically, the cloud management platform can determine whether the simulated authentication for the tenant is successful based on whether there is a semantic problem in the content of the second access control policy, and display the corresponding result on the tenant's client through the preview interface to inform the tenant of the result, so that the tenant can more accurately determine whether the first access control policy it has formulated is applicable. The cloud management platform can inform the tenant whether the simulated authentication is successful in the following ways:

[0079] After obtaining the second access control policy, the cloud management platform can obtain preset semantic rules (these semantic rules may include expression specifications that each parameter in the access control policy needs to meet, etc.), and perform semantic analysis on the second parameter contained in the second access control policy based on the preset semantic rules, thereby obtaining the first semantic analysis result of the second parameter. If the first semantic analysis result is used to indicate that the second parameter complies with the preset semantic rules, it is equivalent to indicating that there is no semantic problem with the second access control policy, so the cloud management platform can determine that the simulated authentication for the tenant is successful. If the first semantic analysis result is used to indicate that the second parameter does not comply with the semantic rules, it is equivalent to indicating that there is a semantic problem with the second access control policy, so the cloud management platform can determine that the simulated authentication for the tenant has failed.

[0080] Then, the cloud management platform can display the first semantic analysis result on the tenant's client through the preview interface for the tenant to view and use. Generally, if the first semantic analysis result is used to indicate that the second parameter meets the preset semantic rules, the tenant will consider the first access control policy it has formulated to be usable and inform the cloud management platform. If the first semantic analysis result is used to indicate that the second parameter does not meet the semantic rules, the tenant will consider the first access control policy it has formulated to be unusable, and the tenant can adjust the first access control policy and / or the assignment information.

[0081] Still like Figure 3 In the example shown, after obtaining the assigned access control policy, the cloud management platform can obtain the preset semantic rules and detect whether "xyz" and "abc" meet the expression specifications contained in these rules based on these rules. Since "xyz" and "abc" are both correct expressions, the cloud management platform can display in the reminder window of the tenant interface: "xyz" and "abc" are both correct expressions. In this way, the tenant can determine that the access control policy to be assigned is available.

[0082] 205. If the assignment information does not include the first value, the cloud management platform detects whether the first access control policy includes the second value set by the tenant for the first parameter.

[0083] If the assignment information does not include the first value, the cloud management platform may detect whether the first access control policy includes the second value set by the tenant for the first parameter. If so, step 206 is executed; if not, step 208 is executed.

[0084] 206. If the first access control policy includes the second value, the cloud management platform assigns a value to the first parameter in the first access control policy based on the second value to obtain an assigned third parameter and a third access control policy including the third parameter.

[0085] If the first access control policy includes the second value, the cloud management platform can use the second value to assign a value to the first parameter in the first access control policy (for example, replace the first parameter with the second value, etc.), thereby obtaining an assigned third parameter (for example, replacing the second value of the first parameter, etc.) and a third access control policy including the third parameter (which can also be understood as an assigned access control policy). At this point, the cloud management platform has completed the simulated assignment for the first access control, thereby obtaining the third access control policy.

[0086] It should be noted that the third access control policy obtained by the cloud management platform through simulated assignment can be presented as a third text obtained by the simulated assignment. The third text contains one or more third parameters to be assigned (which can also be understood as assigned variables). The content described in the third text is usually the content in which the tenant instructs the cloud management platform how to authenticate the tenant. Since the third parameter has been assigned, these contents have been supplemented and completed. Furthermore, the cloud management platform can determine whether the simulated authentication for the tenant is successful based on whether there are semantic problems with these contents.

[0087] For example, Figure 4 As shown ( Figure 4 Another schematic diagram of the tenant interface provided in the embodiment of the present application) When the tenant needs to formulate an access control policy, the tenant can log in to the cloud management platform so that the cloud management platform can provide the tenant interface to the tenant. Then, the tenant can enter the access control policy to be assigned in the access control policy input field of the tenant interface:

[0088]

[0089] Based on the access control policy to be assigned, the content described in the policy is to detect whether the value of "foo" in the tenant's request is less than 123bar, so as to determine whether to process the tenant's request. It can be seen that the policy contains a parameter "bar" to be assigned, and the default value of this parameter is "NaN".

[0090] In addition, tenants can also enter simulation assignment information in the simulation assignment input field of the tenant interface:

[0091] {

[0092] }

[0093] It can be seen that the simulation assignment information entered by the tenant is blank.

[0094] After obtaining the access control policy to be assigned and the simulated assignment information, the cloud management platform can first parse the policy, that is, determine the position of each string in the policy, and traverse each string to extract the parameter "bar" to be assigned from the policy. Then, the cloud management platform can detect whether the simulated assignment information contains the set value of "bar" and whether the policy contains the default value of "bar".

[0095] Since the simulated assignment information does not contain the set value of "bar", and the access control policy to be assigned contains the default value of "bar", the cloud management platform can extract the default value "NaN" of "bar" from the access control policy to be assigned, replace "bar" with "NaN", and then record the corresponding information. In this way, the cloud management platform can obtain the assigned access control policy.

[0096] 207. The cloud management platform displays the third access control policy to the tenant through a preview interface. The third access control policy is used to indicate whether the cloud management platform successfully or failed to authenticate the tenant.

[0097] After obtaining the third access control policy, the cloud management platform can provide a preview interface to the tenant's client to display the third access control policy on the tenant's client through the preview interface, so that the tenant can determine whether the first access control policy it has formulated is available based on the content of the third access control policy. If the tenant determines that the first access control policy is available, it can inform the cloud management platform through its client, so that the cloud management platform stores the first access control policy and uses the first access control policy as the basis for subsequent authentication of the tenant.

[0098] Still like Figure 4 In the example shown, after obtaining the assigned access control policy, the cloud management platform can display the assigned access control policy in the preview window of the user interface:

[0099]

[0100] Then, the tenant can browse the assigned access control policy in the preview window to determine whether the access control policy it has formulated is available.

[0101] Specifically, the cloud management platform can determine whether the simulated authentication for the tenant is successful based on whether there is a semantic problem in the content of the third access control policy, and display the corresponding result on the tenant's client through the preview interface to inform the tenant of the result, so that the tenant can more accurately determine whether the first access control policy it has formulated is applicable. The cloud management platform can inform the tenant whether the simulated authentication is successful in the following ways:

[0102] After obtaining the third access control policy, the cloud management platform can obtain the preset semantic rules, and perform semantic analysis on the third parameter contained in the third access control policy based on the preset semantic rules, thereby obtaining the second semantic analysis result of the third parameter. If the second semantic analysis result is used to indicate that the third parameter complies with the preset semantic rules, it is equivalent to indicating that there is no semantic problem with the third access control policy, so the cloud management platform can determine that the simulated authentication for the tenant is successful. If the second semantic analysis result is used to indicate that the third parameter does not comply with the semantic rules, it is equivalent to indicating that there is a semantic problem with the third access control policy, so the cloud management platform can determine that the simulated authentication for the tenant has failed.

[0103] Then, the cloud management platform can display the second semantic analysis result on the tenant's client through the preview interface for the tenant to view and use. Generally, if the second semantic analysis result is used to indicate that the third parameter meets the preset semantic rules, the tenant will consider the first access control policy it has formulated to be usable and inform the cloud management platform. If the second semantic analysis result is used to indicate that the third parameter does not meet the semantic rules, the tenant will consider the first access control policy it has formulated to be unusable, and the tenant can adjust the first access control policy and / or assignment information.

[0104] Still like Figure 4 In the example shown, after obtaining the assigned access control policy, the cloud management platform can obtain the preset semantic rules and detect whether "123NaN" complies with the expression specifications contained in these rules based on these rules. Since "123NaN" is an incorrect expression, the cloud management platform can display "123NaN" in the reminder window of the tenant interface. In this way, the tenant can determine that the access control policy to be assigned is unavailable, and then readjust the policy and / or simulate the assignment system information.

[0105] 208. If the first access control policy does not include the second value, the cloud management platform displays the assignment result to the tenant through a preview interface. The assignment result includes the position of the first parameter in the first access control policy and the failure of assignment to the first parameter. The assignment result is used to indicate that the cloud management platform has failed to authenticate the tenant.

[0106] If the first access control policy does not include the second value, the cloud management platform cannot assign a value to the first parameter, so the cloud management platform can directly determine that the simulated assignment to the first access control policy cannot be completed, and directly determine that the simulated authentication for the tenant has failed. In response to this situation, the cloud management platform can generate an assignment result to indicate this situation. The assignment result includes the position of the first parameter in the first access control policy and notification information indicating the failure of the assignment to the first parameter. Therefore, a preview interface can be provided to the tenant's client to display the assignment result on the tenant's client through the preview interface. Then, after viewing the assignment result, the tenant can determine that the first access control policy it has formulated is unavailable, and then readjust the first access control policy and / or assignment information.

[0107] For example, Figure 5 As shown ( Figure 5 Another schematic diagram of the tenant interface provided in the embodiment of the present application) When the tenant needs to formulate an access control policy, the tenant can log in to the cloud management platform so that the cloud management platform can provide the tenant interface to the tenant. Then, the tenant can enter the access control policy to be assigned in the access control policy input field of the tenant interface:

[0108]

[0109] Based on the access control policy to be assigned, the content described in the policy is to detect whether the value of "foo" in the tenant's request is less than 123bar, so as to determine whether to process the tenant's request. It can be seen that the policy contains a parameter "bar" to be assigned.

[0110] In addition, tenants can also enter simulation assignment information in the simulation assignment input field of the tenant interface:

[0111] {

[0112] }

[0113] It can be seen that the simulation assignment information entered by the tenant is blank.

[0114] After obtaining the access control policy to be assigned and the simulated assignment information, the cloud management platform can first parse the policy, that is, determine the position of each string in the policy, and traverse each string to extract the parameter "bar" to be assigned from the policy. Then, the cloud management platform can detect whether the simulated assignment information contains the set value of "bar" and whether the policy contains the default value of "bar".

[0115] Since the simulated assignment information does not contain the set value of "bar", and the access control policy to be assigned does not contain the default value of "bar", the cloud management platform cannot replace "bar", and the following assignment result is displayed in the preview window of the user interface: the replacement of "bar" in the 3rd row, 18th column to 20th column of the policy failed. In this way, the tenant can determine that the access control policy to be assigned is unavailable, and then readjust the policy and / or simulated assignment system information.

[0116] In an embodiment of the present application, when a tenant needs to formulate an access control policy, the cloud management platform can provide an editing interface to the tenant so that the tenant can input the first access control policy and assignment information formulated by the tenant into the editing interface, so the cloud management platform can receive the first access control policy and assignment information from the tenant through the editing interface, wherein the first access control policy includes the first parameter to be assigned, and the first access control policy can be used for the cloud management platform to simulate the authentication of the tenant. Then, the cloud management platform can detect whether the assignment information includes the first value set by the tenant for the first parameter. If the assignment information includes the first value, the cloud management platform simulates the assignment of the first parameter in the first access control policy based on the first value, thereby obtaining the assigned second parameter and the second access control policy containing the second parameter. Then, the cloud management platform can display the second access control policy to the tenant through the preview interface, so the tenant can determine whether the simulated authentication of the cloud management platform for itself is successful based on the content of the second access control policy, and then determine whether the first access control policy formulated by itself is available. In the above process, the cloud management platform can be combined with the first access control policy. In the above process, after the cloud management platform completes the simulation assignment of the first access control policy formulated by the tenant using the assignment information formulated by the tenant, the cloud management platform displays the obtained second access control policy to the tenant in a visual interface (i.e., preview interface). Therefore, the cloud management platform can not only show the tenant the content of the second access control policy that has not changed compared with the first access control policy, but also show the tenant the content of the second access control policy that has changed compared with the first access control policy. The tenant can check whether the content that has not changed (i.e., the content that describes how the cloud management platform set by the tenant authenticates the tenant) has syntax problems, and can also confirm whether the changed content (i.e., the replaced parameters, such as the second parameter that replaces the first parameter) meets the tenant's needs and the factors considered. In this way, the check on the first access control policy can consider more comprehensive factors, and the first access control policy obtained by checking in this way is used to authenticate the tenant, which can have a better effect.

[0117] Furthermore, if the cloud management platform determines that there is a semantic problem in the changes made to the second access control policy or the third access control policy compared to the first access control policy (such as the second parameter that replaces the first parameter or the third parameter that replaces the first parameter does not conform to the preset semantic rules), it can also inform the tenant through a visual interface (i.e., a preview interface) so that the tenant can make targeted adjustments to the first access control policy and / or assignment information formulated by it based on this situation, thereby improving user experience and policy adjustment efficiency.

[0118] The above is a detailed description of the policy preview method based on the cloud management platform provided in the embodiment of the present application. The cloud management platform provided in the embodiment of the present application will be introduced below. Figure 6A schematic diagram of the structure of the cloud management platform provided in the embodiment of the present application is shown in FIG. Figure 6 As shown, the cloud management platform includes:

[0119] The receiving module 601 is used to receive the first access control policy and assignment information input by the tenant through the editing interface, the first access control policy includes the first parameter to be assigned, and the first access control policy is used for the cloud management platform to authenticate the tenant; for example, the receiving module 601 can be used to implement Figure 2 Step 201 in the illustrated embodiment.

[0120] The assignment module 602 is used to assign a value to the first parameter in the first access control policy based on the first value if the assignment information includes a first value set by the tenant for the first parameter, to obtain an assigned second parameter and a second access control policy including the second parameter; for example, the assignment module 602 can be used to implement Figure 2 Step 202 and step 203 in the illustrated embodiment.

[0121] The display module 603 is used to display the second access control policy to the tenant through the preview interface. The second access control policy is used to indicate whether the cloud management platform successfully or failed to authenticate the tenant. For example, the display module 603 can be used to implement Figure 2 Step 204 in the illustrated embodiment.

[0122] In one possible implementation, the assignment module 602 is used to assign a first parameter in the first access control policy based on the first value if the assignment information includes a first value and the first access control policy does not include a second value set by the tenant for the first parameter, to obtain an assigned second parameter and a second access control policy including the second parameter.

[0123] In one possible implementation, the assignment module 602 is used to assign a first parameter in the first access control policy based on the first value if the assignment information includes a first value and the first access control policy includes a second value set by the tenant for the first parameter, to obtain the assigned second parameter and a second access control policy including the second parameter.

[0124] In one possible implementation, the assignment module 602 is also used to assign the first parameter in the first access control policy based on the second value if the assignment information does not include the first value and the first access control policy includes the second value set by the tenant for the first parameter, so as to obtain the assigned third parameter and the third access control policy including the third parameter; the display module 603 is also used to display the third access control policy to the tenant through a preview interface, and the third access control policy is used to indicate whether the cloud management platform has successfully or failed to authenticate the tenant.

[0125] In one possible implementation, the assignment module 602 is also used to display the assignment result to the tenant through a preview interface if the assignment information does not include the first value and the first access control policy does not include the second value set by the tenant for the first parameter. The assignment result includes the position of the first parameter in the first access control policy and notification information indicating the failure of the assignment for the first parameter. The assignment result is used to indicate that the cloud management platform has failed to authenticate the tenant.

[0126] In one possible implementation, the cloud management platform also includes: a semantic analysis module, which is used to perform semantic analysis on the second parameter based on preset semantic rules to obtain a first semantic analysis result of the second parameter; if the first semantic analysis result is used to indicate that the second parameter complies with the semantic rule, then the second access control policy is used to indicate that the cloud management platform has successfully authenticated the tenant; if the first semantic analysis result is used to indicate that the second parameter does not comply with the semantic rule, then the second access control policy is used to indicate that the cloud management platform has failed to authenticate the tenant; a display module 603 is also used to display the first semantic analysis result to the tenant through a preview interface.

[0127] In one possible implementation, the cloud management platform also includes: a semantic analysis module, which is used to perform semantic analysis on the third parameter based on preset semantic rules to obtain a second semantic analysis result of the third parameter; if the second semantic analysis result is used to indicate that the third parameter complies with the semantic rules, then the third access control policy is used to indicate that the cloud management platform has successfully authenticated the tenant; if the second semantic analysis result is used to indicate that the third parameter does not comply with the semantic rules, then the third access control policy is used to indicate that the cloud management platform has failed to authenticate the tenant; a display module 603 is also used to display the second semantic analysis result to the tenant through a preview interface.

[0128] It should be noted that the information interaction, implementation process, etc. between the modules / units of the above-mentioned device are based on the same concept as the method embodiment of the present application, and the technical effects they bring are the same as those of the method embodiment of the present application. For specific contents, please refer to the description in the method embodiment shown above in the embodiment of the present application, and will not be repeated here.

[0129] See also Figure 7 , Figure 7 A schematic diagram of a computing device provided in an embodiment of the present application. Figure 7 As shown, the computing device 700 (which can be used to present the aforementioned cloud management platform) includes: a processor 701, a memory 702, a communication interface 703 and a bus 704. The processor 701, the memory 702 and the communication interface 703 are coupled via a bus (not marked in the figure). The memory 702 stores instructions. When the execution instructions in the memory 702 are executed, the computing device 700 executes the method executed by the cloud management platform in the above method embodiment.

[0130] The computing device 700 may be one or more integrated circuits configured to implement the above method, such as one or more application specific integrated circuits (ASIC), or one or more digital signal processors (DSP), or one or more field programmable gate arrays (FPGA), or a combination of at least two of these integrated circuit forms. For another example, when the unit in the device can be implemented in the form of a processing element scheduler, the processing element can be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call a program. For another example, these units can be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0131] The processor 701 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. A general-purpose processor may be a microprocessor or any conventional processor.

[0132] The memory 702 may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories. Among them, the nonvolatile memory may be a read-only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0133] The memory 702 stores executable program codes, and the processor 701 executes the executable program codes to respectively implement the functions of the aforementioned receiving module, assignment module, and display module, thereby implementing the aforementioned policy preview method based on the cloud management platform. That is, the memory 702 stores instructions for executing the aforementioned policy preview method based on the cloud management platform.

[0134] The communication interface 703 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 700 and other devices or a communication network.

[0135] In addition to the data bus, the bus 704 may also include a power bus, a control bus, a status signal bus, etc. The bus may be a peripheral component interconnect express (PCIe) bus, or an extended industry standard architecture (EISA) bus, a unified bus (Ubus or UB), a compute express link (CXL), a cache coherent interconnect for accelerators (CCIX), etc. The bus may be divided into an address bus, a data bus, a control bus, etc.

[0136] See also Figure 8 , Figure 8 A schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application. Figure 8 As shown, the computing device cluster 800 includes at least one computing device 700 .

[0137] like Figure 8 As shown, the computing device cluster 800 includes at least one computing device 700. The memory 702 in one or more computing devices 700 in the computing device cluster 800 may store the same instructions for executing the above-mentioned policy preview method based on the cloud management platform.

[0138] In some possible implementations, the memory 702 of one or more computing devices 700 in the computing device cluster 800 may also respectively store partial instructions for executing the above-mentioned policy preview method based on the cloud management platform. In other words, the combination of one or more computing devices 700 can jointly execute the above-mentioned policy preview method based on the cloud management platform.

[0139] It should be noted that the memory 702 in different computing devices 700 in the computing device cluster 800 can store different instructions, which are respectively used to execute part of the functions of the above-mentioned cloud management platform. That is, the instructions stored in the memory 702 in different computing devices 700 can implement the functions of one or more modules of the receiving module, the assignment module, the display module, etc.

[0140] In some possible implementations, one or more computing devices 700 in the computing device cluster 800 may be connected via a network, which may be a wide area network or a local area network.

[0141] See also Fig. 9 , Fig. 9 A schematic diagram of computer devices in a computer cluster provided in an embodiment of the present application being connected via a network. Fig. 9 As shown, two computing devices 700A and 700B are connected via a network. Specifically, they are connected to the network via a communication interface in each computing device.

[0142] In a possible implementation, the memory in the computing device 700A stores instructions for executing functions of the receiving module and the like. Meanwhile, the memory in the computing device 700B stores instructions for executing functions of the assigning module and the displaying module and the like.

[0143] It should be understood that Fig. 9 The functions of the computing device 700A shown in FIG. 7 may also be completed by multiple computing devices. Similarly, the functions of the computing device 700B may also be completed by multiple computing devices.

[0144] The embodiment of the present application also relates to a computer storage medium, in which a program for signal processing is stored. When the program is run on a computer, the computer executes the following steps: Figure 2 The steps performed by the cloud management platform in the illustrated embodiment.

[0145] The present application also relates to a computer program product, which stores instructions, which, when executed by a computer, enable the computer to execute the following Figure 2 The steps performed by the cloud management platform in the illustrated embodiment.

[0146] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0147] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0148] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0149] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0150] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk and other media that can store program code.

Claims

1. A policy preview method based on a cloud management platform, characterized in that: The method comprises: The cloud management platform receives a first access control policy and assignment information input by the tenant through an editing interface, wherein the first access control policy includes a first parameter to be assigned, and the first access control policy is used by the cloud management platform to authenticate the tenant; If the assignment information includes a first value set by the tenant for the first parameter, the cloud management platform assigns a value to the first parameter in the first access control policy based on the first value to obtain an assigned second parameter and a second access control policy including the second parameter; The cloud management platform displays the second access control policy to the tenant through a preview interface, where the second access control policy is used to indicate whether the cloud management platform succeeds or fails in authenticating the tenant.

2. The method according to claim 1, characterized in that If the assignment information includes a first value set by the tenant for the first parameter, the cloud management platform assigns a value to the first parameter in the first access control policy based on the first value, and obtains the assigned second parameter and a second access control policy including the second parameter, including: If the assignment information includes the first value and the first access control policy does not include the second value set by the tenant for the first parameter, the cloud management platform assigns the first parameter in the first access control policy based on the first value to obtain the assigned second parameter and a second access control policy including the second parameter.

3. The method according to claim 1 or 2, characterized in that: If the assignment information includes a first value set by the tenant for the first parameter, the cloud management platform assigns a value to the first parameter in the first access control policy based on the first value, and obtains the assigned second parameter and a second access control policy including the second parameter, including: If the assignment information includes the first value, and the first access control policy includes the second value set by the tenant for the first parameter, the cloud management platform assigns the first parameter in the first access control policy based on the first value to obtain the assigned second parameter and a second access control policy including the second parameter.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: If the assignment information does not include the first value, and the first access control policy includes a second value set by the tenant for the first parameter, the cloud management platform assigns the first parameter in the first access control policy based on the second value to obtain an assigned third parameter and a third access control policy including the third parameter; The cloud management platform displays the third access control policy to the tenant through the preview interface, and the third access control policy is used to indicate whether the cloud management platform succeeds or fails in authenticating the tenant.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: If the assignment information does not include the first value, and the first access control policy does not include the second value set by the tenant for the first parameter, the cloud management platform displays the assignment result to the tenant through the preview interface, and the assignment result includes the position of the first parameter in the first access control policy and notification information for failure to assign the first parameter, and the assignment result is used to indicate that the cloud management platform has failed to authenticate the tenant.

6. The method according to claim 2 or 3, characterized in that: The method further comprises: The cloud management platform performs semantic analysis on the second parameter based on preset semantic rules to obtain a first semantic analysis result of the second parameter; if the first semantic analysis result is used to indicate that the second parameter conforms to the semantic rule, then the second access control policy is used to indicate that the cloud management platform has successfully authenticated the tenant; if the first semantic analysis result is used to indicate that the second parameter does not conform to the semantic rule, then the second access control policy is used to indicate that the cloud management platform has failed to authenticate the tenant; The cloud management platform displays the first semantic analysis result to the tenant through the preview interface.

7. The method according to claim 4, characterized in that The method further comprises: The cloud management platform performs semantic analysis on the third parameter based on preset semantic rules to obtain a second semantic analysis result of the third parameter; if the second semantic analysis result is used to indicate that the third parameter conforms to the semantic rule, the third access control policy is used to indicate that the cloud management platform has successfully authenticated the tenant; if the second semantic analysis result is used to indicate that the third parameter does not conform to the semantic rule, the third access control policy is used to indicate that the cloud management platform has failed to authenticate the tenant; The cloud management platform displays the second semantic analysis result to the tenant through the preview interface.

8. A cloud management platform, characterized in that: The cloud management platform includes: A receiving module, configured to receive a first access control policy and assignment information input by a tenant through an editing interface, wherein the first access control policy includes a first parameter to be assigned, and the first access control policy is used by the cloud management platform to authenticate the tenant; an assignment module, configured to assign a value to the first parameter in the first access control policy based on the first value if the assignment information includes a first value set by the tenant for the first parameter, to obtain an assigned second parameter and a second access control policy including the second parameter; A display module is used to display the second access control policy to the tenant through a preview interface, and the second access control policy is used to indicate whether the cloud management platform successfully or failed to authenticate the tenant.

9. The cloud management platform according to claim 8, characterized in that: The assignment module is used to: If the assignment information includes the first value and the first access control policy does not include the second value set by the tenant for the first parameter, the first parameter in the first access control policy is assigned based on the first value to obtain the assigned second parameter and a second access control policy including the second parameter.

10. The cloud management platform according to claim 8 or 9, characterized in that: The assignment module is used to: If the assignment information includes the first value, and the first access control policy includes the second value set by the tenant for the first parameter, the first parameter in the first access control policy is assigned based on the first value to obtain the assigned second parameter and a second access control policy including the second parameter.

11. The cloud management platform according to any one of claims 8 to 10, characterized in that: The assignment module is further configured to, if the assignment information does not include the first value and the first access control policy includes a second value set by the tenant for the first parameter, assign the first parameter in the first access control policy based on the second value to obtain an assigned third parameter and a third access control policy including the third parameter; The display module is further used to display the third access control policy to the tenant through the preview interface, and the third access control policy is used to indicate whether the cloud management platform succeeds or fails in authenticating the tenant.

12. The cloud management platform according to any one of claims 8 to 11, characterized in that: The assignment module is further used to display the assignment result to the tenant through the preview interface if the assignment information does not include the first value and the first access control policy does not include the second value set by the tenant for the first parameter, the assignment result including the position of the first parameter in the first access control policy and notification information indicating the failure of the assignment of the first parameter, and the assignment result is used to indicate that the cloud management platform has failed to authenticate the tenant.

13. The cloud management platform according to claim 9 or 10, characterized in that: The cloud management platform also includes: A semantic analysis module, configured to perform semantic analysis on the second parameter based on a preset semantic rule to obtain a first semantic analysis result of the second parameter; if the first semantic analysis result is used to indicate that the second parameter conforms to the semantic rule, then the second access control policy is used to indicate that the cloud management platform has successfully authenticated the tenant; if the first semantic analysis result is used to indicate that the second parameter does not conform to the semantic rule, then the second access control policy is used to indicate that the cloud management platform has failed to authenticate the tenant; The display module is further used to display the first semantic analysis result to the tenant through the preview interface.

14. The cloud management platform according to claim 11, characterized in that: The cloud management platform also includes: A semantic analysis module, configured to perform semantic analysis on the third parameter based on preset semantic rules to obtain a second semantic analysis result of the third parameter; if the second semantic analysis result is used to indicate that the third parameter conforms to the semantic rule, then the third access control policy is used to indicate that the cloud management platform has successfully authenticated the tenant; if the second semantic analysis result is used to indicate that the third parameter does not conform to the semantic rule, then the third access control policy is used to indicate that the cloud management platform has failed to authenticate the tenant; The display module is further used to display the second semantic analysis result to the tenant through the preview interface.

15. A computing device cluster, characterized in that: The computing device cluster includes at least one computing device, each computing device including a processor and a memory: The memory is used to store instructions; The processor is configured to cause the computing device cluster to execute the method according to any one of claims 1 to 7 according to the instructions.

16. A computer storage medium, characterized in that: The computer storage medium stores one or more instructions, which, when executed by one or more computers, enable the one or more computers to implement the method of any one of claims 1 to 7.

17. A computer program product, characterized in that The computer program product stores instructions, and when the instructions are executed by a computer, the computer implements the method according to any one of claims 1 to 7.

Images