Cloud service calling management method, device and system and electronic equipment

Abstract

The invention discloses a cloud service calling management method, device and system and electronic equipment, and relates to the technical field of cloud services. The method comprises the following steps: in response to a delegation creation request, creating a delegation relationship between a user main body and a first product so as to realize automatic creation of service inline delegation and simplify creation and authorization processes of cloud service delegation; in response to a temporary voucher application request sent by the first product, sending a corresponding temporary voucher to the first product based on the delegation relationship; receiving a permission verification request sent by a second product; the permission verification request is a verification request of the second product for the calling permission of the first product; based on the permission verification request, verifying the calling permission of the first product to obtain a verification result; and finally, sending a verification result to the second product, so that the second product returns a cloud service interface calling result to the first product based on the verification result, thereby realizing permission fine-grained control on internal calling of the cloud service.

Description

Technical Field

[0001] The present application relates to the field of cloud service technology, and in particular to a cloud service call management method, device, system, electronic device and medium. Background Art

[0002] The PaaS (Platform as a Service, a service model based on cloud computing) and SaaS (Software as a Service, a model for delivering software applications through a cloud platform) built by current cloud service providers based on cloud services usually need to rely on underlying infrastructure services (Infrastructure as a Service, IaaS) such as storage, network and virtualization.

[0003] Currently, PaaS and SaaS use a bus-style structure to implement internal calls to IaaS service interfaces, that is, the system manages calls to IaaS service interfaces through internal credentials and contractual relationships. This calling method has two problems: (1) The granularity of service permission control is coarse, which poses security risks. For example, when a SaaS product within a cloud service provider needs to call an internal elastic cloud host service, it only needs to verify that there is a contractual relationship between the caller's internal credentials and the interface provided by the cloud host. In this case, although the SaaS product is an internal trusted entity, the scope of data permissions that can be called is not controlled, which poses a risk of data unauthorized access; (2) Redundant registration of cloud service interfaces. Specifically, in addition to providing interfaces for external entity identity and access management, the underlying IaaS service also needs to open a separate interface for the internal call bus, resulting in redundancy of cloud service interfaces and a waste of costs. Summary of the invention

[0004] To this end, the present application provides a cloud service call management method, device, system and electronic device to solve the problem of data unauthorized access risk and IaaS service interface redundancy when the upper-level cloud service products within the system call the underlying IaaS service interface in the prior art.

[0005] In order to achieve the above-mentioned objectives, the first aspect of the present application provides a cloud service call management method, the method comprising: in response to a delegation creation request, creating a delegation relationship between a user subject and a first product; in response to a temporary credential application request sent by the first product, based on the delegation relationship, sending a corresponding temporary credential to the first product; receiving a permission verification request sent by the second product; the permission verification request is a verification request of the second product for the calling authority of the first product when the first product calls the cloud service interface provided by the second product based on the temporary credential; the first product and the second product belong to the same cloud service system; based on the permission verification request, verifying the calling authority of the first product to obtain a verification result; sending the verification result to the second product, so that the second product returns the cloud service interface call result to the first product based on the verification result.

[0006] According to the first aspect, the method further includes: creating a call restriction policy corresponding to the first product based on a delegated creation request and service configuration information, wherein the service configuration information includes a pre-agreed first product's calling authority for a cloud service interface provided by a second product.

[0007] According to the first aspect, or any implementation of the first aspect above, after creating a call restriction policy corresponding to the first product based on a delegated creation request and service configuration information, it also includes: modifying the call restriction policy corresponding to the first product in response to a delegated authority modification request.

[0008] According to the first aspect, or any one implementation method of the first aspect above, based on the permission verification request, the calling permission of the first product is verified to obtain a verification result, including: based on the permission verification request, extracting the product identity credential of the first product; according to the product identity credential of the first product, obtaining the calling restriction policy corresponding to the first product; based on the calling restriction policy, verifying the calling permission of the first product to obtain a verification result; the verification result includes verification pass information and data access permission scope, or includes verification fail information.

[0009] According to the first aspect, or any implementation of the first aspect above, after creating a delegation relationship between the user subject and the first product in response to a delegation creation request, the method also includes: deleting the delegation relationship between the user subject and the first product in response to a delegation deletion request sent by the user subject.

[0010] According to the first aspect, or any implementation of the first aspect above, the delegation creation request is a request sent by the user subject to establish an inline delegation and authorization with the first product; or, the delegation creation request is a request sent by the first product to establish an inline delegation and authorization with the user subject and itself.

[0011] The second aspect of the present application provides a cloud service call management device, which includes: a delegation management module, which is used to create a delegation relationship between a user subject and a first product in response to a first request; a temporary credential module, which is used to respond to a temporary credential application request sent by the first product and send a corresponding temporary credential to the first product based on the delegation relationship; a receiving module, which is used to receive a permission verification request sent by the second product; the permission verification request is a verification request for the second product's calling authority to the first product when the first product calls the cloud service interface provided by the second product based on the temporary credential; the first product and the second product belong to the same cloud service system; an identity authentication module, which is used to verify the calling authority of the first product based on the permission verification request and obtain a verification result; a sending module, which is used to send the verification result to the second product, so that the second product returns the cloud service interface call result to the first product based on the verification result.

[0012] The third aspect of the present application provides a cloud service system, which includes: at least one first product, at least one second product and a cloud service call management device as provided in the second aspect; the cloud service call management device is used to manage the call of the first product to the cloud service interface provided by the second product.

[0013] The fourth aspect of the present application provides an electronic device, which includes: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by one or more processors, the one or more processors implement any one of the methods in the first aspect; one or more I / O interfaces, connected between the processor and the memory, configured to implement information interaction between the processor and the memory.

[0014] A fifth aspect of the present application provides a computer-readable medium having a computer program stored thereon, which implements any one of the methods in the first aspect when the program is executed by a processor.

[0015] The present application has the following advantages: an embodiment of the present application provides a cloud service call management method, the method comprising: a cloud service call management device, in response to a delegation creation request, creates a delegation relationship between a user subject and a first product, so as to realize the automated creation of an inline delegation of a service, and simplify the creation and authorization process of a cloud service delegation; then, in response to a temporary credential application request sent by the first product, based on the delegation relationship, a corresponding temporary credential is sent to the first product, so as to realize a temporary credential issuance mechanism for a cloud service, while being able to meet the signature verification requirements of an existing cloud API; then, a permission verification request sent by a second product is received; the permission verification request is a verification request of the second product for the calling authority of the first product when the first product calls the cloud service interface provided by the second product based on the temporary credential; based on the permission verification request, the calling authority of the first product is verified to obtain a verification result; finally, the verification result is sent to the second product, so that the second product returns the cloud service interface call result to the first product based on the verification result, so as to perform fine-grained control of the authority for the internal call of the cloud service, and avoid the risk of data unauthorized access and cloud API redundancy problems in calls between services. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings are used to provide further understanding of the present application and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the present application, but do not constitute a limitation to the present application.

[0017] Figure 1 A flowchart of a cloud service call management method provided in an embodiment of the present application;

[0018] Figure 2 A schematic diagram of the composition of a call restriction strategy provided in an embodiment of the present application;

[0019] Figure 3 A schematic diagram of the structure of a cloud service call management device provided in an embodiment of the present application;

[0020] Figure 4 A schematic diagram of the structure of a cloud service system provided in an embodiment of the present application;

[0021] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the technical solutions of the present disclosure, the exemplary embodiments of the present disclosure are described below in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0023] In the absence of conflict, the various embodiments of the present disclosure and the various features therein may be combined with each other.

[0024] As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0025] The terms used in this application are only used to describe specific embodiments and are not intended to limit the present application.As used in this application, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0026] When the terms “comprising” and / or “made of…” are used in this application, it specifies the existence of the stated features, integers, steps, operations, elements and / or components, but does not exclude the existence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0027] The embodiments described in the present application may be described with reference to plan views and / or cross-sectional views by means of ideal schematic diagrams of the present application. Therefore, the exemplary illustrations may be modified according to manufacturing techniques and / or tolerances.

[0028] Unless otherwise defined, all terms (including technical and scientific terms) used in this application have the same meaning as those commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and this application, and will not be interpreted as having an idealized or overly formal meaning unless explicitly defined in this application.

[0029] The PaaS (Platform as a Service, a service model based on cloud computing) and SaaS (Software as a Service, a model for delivering software applications through a cloud platform) built by current cloud service providers based on cloud services usually need to rely on underlying infrastructure services (Infrastructure as a Service, IaaS) such as storage, network and virtualization.

[0030] Generally speaking, relevant technical solutions mainly provide identity and access management capabilities for external customers and partners, which are mainly based on identity federation, single sign-on (SSO) agent, etc. In the internal call implementation, that is, the current PaaS and SaaS use a bus-type structure in the internal call implementation of the IaaS service interface, that is, the system manages the call to the IaaS service interface through internal credentials and contractual relationships.

[0031] There are two problems with this calling method: (1) The granularity of service permission control is relatively coarse, which poses a security risk. For example, when a SaaS product within a cloud service provider needs to call an internal elastic cloud host service, it only needs to verify that there is a contractual relationship between the caller's internal credentials and the interface provided by the cloud host. In this case, although the SaaS product is an internal trusted entity, the scope of the data permissions that can be called is not controlled, which poses a risk of data unauthorized access; (2) Redundant registration of cloud service interfaces. Specifically, in addition to providing interfaces for external entity identity and access management, the underlying IaaS service also needs to open a separate interface for the internal call bus, resulting in redundancy of cloud service interfaces and a waste of manpower costs.

[0032] To this end, the embodiment of the present application provides a cloud service call management method, which includes creating cloud service inline delegation and authorization, reissuing temporary credentials, providing a trusted channel for accessing cloud APIs through temporary credentials, and performing permission verification based on temporary credentials. By implementing the embodiment provided by the present application, identity and access control can be performed on the interaction between internal cloud services, while avoiding redundant registration of multiple different interfaces for cloud services.

[0033] Figure 1 A flow chart of a cloud service call management method provided in an embodiment of the present application. The cloud service call management method is applied to a cloud service call management device in a cloud service system, and the cloud service system also includes a first product and a second product. Figure 1 As shown, the cloud service call management method includes: the following steps S101-S105.

[0034] Step S101: In response to a delegation creation request, a delegation relationship between a user subject and a first product is created.

[0035] The delegation creation request is used to request the creation of a delegation relationship between the user subject and the first product. The delegation relationship means that the user allows the first product to act on behalf of the user subject, perform actions within the scope of authority, and access resources within the scope of data restrictions.

[0036] The user subject represents the cloud service user subject after logging into the cloud service system. The user subject can log into the cloud service system through a single sign-on (SSO) agent. The first product refers to the upper cloud service product in the cloud service system. For example, the first product can be a SaaS product or a PaaS product. The cloud service system also includes a second product, which refers to the lower cloud service product in the cloud service system. For example, the second product can be an IaaS product.

[0037] In the embodiments of the present application, SaaS products or PaaS products (first product) and IaaS products (second product) are used as abstract entities of internal cloud service products. The first product represents the upper-level cloud service, and the second product represents the underlying cloud service. The first product needs to call the interface of the second product to implement some user operations and scheduled operations.

[0038] The delegated creation request includes a product identity certificate and user index information of the first product, wherein the user index information is used to uniquely identify the user subject, and the product identity certificate of the first product is used to uniquely identify the first product.

[0039] In a possible implementation provided in an embodiment of the present application, the delegation creation request is a request sent by a user subject to establish an inline delegation and authorization with the first product.

[0040] In this implementation, the user subject may actively use the user index information (also referred to as user credentials) to specify a specific cloud service (first product) to establish a delegation relationship.

[0041] In another possible implementation manner provided in an embodiment of the present application, the delegation creation request is a request sent by the first product to establish an inline delegation and authorization between the user subject and itself.

[0042] In this implementation, the first product can request the user's authorization through a pop-up window in the application. After the user authorizes the authorization, the first product sends a delegation creation request to the cloud service call management device to initiate a request to automatically create a cloud service inline delegation and authorization. In this embodiment of the present application, creating a cloud service inline delegation and authorization represents that the user allows the first product to act on behalf of the user subject, perform actions within the scope of authority, and access resources within the scope of data restrictions.

[0043] In a possible implementation provided by the embodiment of the present application, after the delegation relationship between the user subject and the first product is created, the user can actively delete the delegation relationship between the user subject and the first product. That is, after the delegation relationship between the user subject and the first product is created in response to the delegation creation request, the above-mentioned cloud service call management method further includes: deleting the delegation relationship between the user subject and the first product in response to the delegation deletion request sent by the user subject.

[0044] In this embodiment, the cloud service call management device provides the ability to delete the delegation relationship, allowing the user to actively delete the delegation of a specific cloud service to actively terminate the delegation relationship.

[0045] In a possible implementation method provided in an embodiment of the present application, the above-mentioned cloud service call management method also includes: while creating a delegation relationship between the user subject and the first product, the cloud service call management device also creates a call restriction policy corresponding to the first product based on the delegation creation request and service configuration information, and completes the authorization.

[0046] The service configuration information includes the pre-agreed first product's permission to call the cloud service interface provided by the second product. The cloud service interface can be called a cloud API, which refers to the Representational State Transfer (REST) ​​application programming interface (API) provided by the cloud service product and registered in accordance with the cloud service vendor's open interface standard. External customers can use identity credentials to access the interface in a secure manner.

[0047] Figure 2 A schematic diagram of the composition of a call restriction strategy provided in an embodiment of the present application. The call restriction strategy corresponding to the first product is completed through a JSON statement, such as Figure 2 As shown in the figure, the JSON statement consists of four parts: effect, action, resource, and condition.

[0048] Among them, the authorization effect is used to specify whether the authorization effect is allowed or denied. It is a required element and includes two values: Allow and Deny. Action refers to the specific operation permissions on resources. It is a required element and its value is a mapping of cloud service operations. Resource refers to the resource that the policy acts on. It is an optional element used to limit the scope of data that can be authorized to call. Condition refers to the condition for the authorization to take effect. It is an optional element. The condition can be, for example, restricting the source IP and other states.

[0049] In this embodiment, the cloud service call management device allows the first product and the user entity to establish a delegation relationship, and automatically generate a call restriction policy corresponding to the first product based on the agreed authority scope between the first product and the second product and the authority scope granted by the user to the first product, and automatically complete the granting of call permissions to the first product.

[0050] In a possible implementation provided by an embodiment of the present application, the call restriction policy corresponding to the first product has the ability to be modified after being generated. After creating the call restriction policy corresponding to the first product based on the delegated creation request and the service configuration information, the cloud service call management method further includes: modifying the call restriction policy corresponding to the first product in response to the delegated authority modification request.

[0051] The delegation authority modification request is a request for adjusting the call restriction policy corresponding to the first product.

[0052] In one example, the delegated authority modification request may be actively sent by the user subject to the cloud service call management device. For example, if the user subject wants to actively increase or decrease the resource call permission of the first product, the delegated authority modification request may be sent to the cloud service call management device to increase or decrease the resource call permission of the first product by adjusting the call restriction policy corresponding to the first product.

[0053] In another example, the delegation authority modification request may also be sent by the first product to the cloud service call management device after obtaining the user's credit. For example, the first product requests the user to increase the resource call authority of the first product through a pop-up window in the application. After the user confirms, the first product requests to modify the call restriction policy based on the user's credit.

[0054] In another example, the delegated authority modification request may also be sent by the first product to the cloud service call management device when the service configuration information changes. Since the service configuration information includes the pre-agreed first product's call permission for the cloud service interface provided by the second product, when the service configuration information changes, the first product sends the delegated authority modification request to the call management device to modify the call restriction policy accordingly.

[0055] In the above implementation, the call restriction policy corresponding to the first product has the capability of being modified after being generated, so that the authorization scope for the first product has the capability of being narrowed or expanded.

[0056] In the embodiment of the present application, after the delegation relationship is established between the first product and the user subject, when the user uses the first product to operate, or when the first product executes a scheduled task, the first product needs to call the cloud service interface provided by the second product. When the first product calls the cloud service interface provided by the second product, the first product sends a temporary credential application request to the cloud service call management device.

[0057] Step S102: In response to the temporary credential application request sent by the first product, a corresponding temporary credential is sent to the first product based on the delegation relationship.

[0058] The temporary credential application request is a request for obtaining a temporary credential based on the trust relationship (delegation relationship) between the first product and the user subject. The temporary credential application request includes the product identity credential of the first product, the user index information of the user subject, and the delegation information between the first product and the user subject.

[0059] Temporary credentials comply with the encryption and signature verification capabilities of the existing cloud API infrastructure. After the validity period expires, they will automatically become invalid to ensure the short-term validity of temporary credentials.

[0060] It should be noted that the temporary credential can also provide auditing capabilities to record the actual user of the temporary credential and pass it to the second product to ensure that the actual operator using the temporary credential can be audited.

[0061] In the embodiment of the present application, after obtaining the temporary credentials, the first product can use the temporary credentials to call the cloud API interface provided by the second product. The cloud API interface here refers to the cloud API interface provided by the second product that can be directly called by the user based on his own credentials (user identity index or user identity credentials), rather than the internal bus interface.

[0062] When the second product receives the call request from the first product, it sends a permission verification request to the cloud service call management device to verify the identity and access rights of the caller. It should be noted that this step is consistent with the reaction of the second product when the user directly calls the cloud API interface based on his own credentials. The second product verifies the identity and access rights of the caller in the same way (rather than through the internal bus interface). The same way here means that similar to the general user's need to call the required interface within the scope of identity authority, the first product can only call the required interface within the scope of delegated authority, and the cloud service call management device will also implement authority judgment with the same logic and capabilities.

[0063] Step S103: receiving a permission verification request sent by the second product.

[0064] The permission verification request is a verification request of the second product for the calling permission of the first product when the first product calls the cloud service interface provided by the second product based on the temporary credential. The first product and the second product belong to the same cloud service system.

[0065] It can be understood that in the cloud service call management method, when the second product determines the calling authority of the first product, it is consistent with the interface used when determining the calling authority of the external user, and both are confirmed to the cloud service call management device provided in the embodiment of the present application without the need to set up a separate bus. Therefore, this method can not only perform fine-grained control of the permissions of internal calls to cloud services, avoid the risk of data unauthorized calls between services, but also solve the problem of cloud API redundancy.

[0066] Step S104: Based on the permission verification request, verify the calling permission of the first product to obtain a verification result.

[0067] The verification result includes verification pass information and data access permission scope, or verification fail information.

[0068] In a possible implementation method provided in an embodiment of the present application, the above-mentioned step of verifying the calling authority of the first product based on the authority verification request and obtaining the verification result (the above-mentioned step S103) includes: the following steps 1 to 3.

[0069] Step 1: Based on the permission verification request, extract the product identity certificate of the first product.

[0070] Step 2: Obtain a call restriction policy corresponding to the first product based on the product identity certificate of the first product.

[0071] Step 3: Based on the call restriction policy, verify the call permission of the first product to obtain a verification result.

[0072] In this implementation, after verifying the calling permission of the first product, it is determined whether the first product has passed the verification, and if the first product has passed the verification, the scope of the data access permission of the first product is determined to generate a verification result. In this implementation, when the first product is allowed to call the second product, fine-grained permission control of the first product is completed according to the mapping action of the first product calling the cloud API interface and the data scope when calling.

[0073] Step S105: Send the verification result to the second product, so that the second product returns the cloud service interface call result to the first product based on the verification result.

[0074] In one embodiment, when the verification result includes verification pass information and data access permission scope, the second product returns the cloud API call result to the first product based on the data access permission scope in the verification result.

[0075] In another embodiment, when the verification result includes verification failure information, the second product returns a prompt message of no calling authority to the first product based on the verification result.

[0076] The step division of the above methods is only for clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this application; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this application.

[0077] An embodiment of the present application provides a cloud service call management method, the method comprising: a cloud service call management device, in response to a delegation creation request, creates a delegation relationship between a user subject and a first product, so as to realize the automated creation of an inline delegation of a service, and simplify the creation and authorization process of a cloud service delegation; then, in response to a temporary credential application request sent by the first product, based on the delegation relationship, sends a corresponding temporary credential to the first product, so as to realize a temporary credential issuance mechanism for a cloud service, while being able to meet the signature verification requirements of an existing cloud API; then, receives a permission verification request sent by a second product; the permission verification request is a verification request of the second product for the calling authority of the first product when the first product calls a cloud service interface provided by the second product based on the temporary credential; based on the permission verification request, verifies the calling authority of the first product and obtains a verification result; finally, sends the verification result to the second product, so that the second product returns the cloud service interface call result to the first product based on the verification result, so as to perform fine-grained control of the authority for internal calls of the cloud service, and avoid the risk of data unauthorized access and cloud API redundancy problems in calls between services.

[0078] In a second aspect, an embodiment of the present application provides a cloud service call management device. Figure 3 A schematic diagram of the structure of a cloud service call management device provided in an embodiment of the present application. Figure 3 As shown, the device includes: a delegated management module 31, a temporary credential module 32, a receiving module 33, an identity authentication module 34 and a sending module 35.

[0079] The entrustment management module 31 is used to create an entrustment relationship between the user subject and the first product in response to the first request.

[0080] In an embodiment of the present application, the cloud service call management device further includes a rights management module. While the delegation management module is creating a delegation relationship between the user subject and the first product, the rights management module is used to create a call restriction policy corresponding to the first product based on the delegation creation request and service configuration information, and complete the authorization.

[0081] The temporary credential module 32 is used to respond to the temporary credential application request sent by the first product and send the corresponding temporary credential to the first product based on the delegation relationship.

[0082] In the embodiment of the present application, the temporary credential module provides the ability to issue temporary credentials with a specific validity period. When generating a temporary credential, the temporary credential module will initiate a verification of the delegation relationship to the delegation management module.

[0083] The receiving module 33 is used to receive the permission verification request sent by the second product.

[0084] Among them, the permission verification request is a verification request of the second product for the calling authority of the first product when the first product calls the cloud service interface provided by the second product based on temporary credentials; the first product and the second product belong to the same cloud service system.

[0085] The identity authentication module 34 is used to verify the calling authority of the first product based on the authority verification request and obtain a verification result.

[0086] In an embodiment of the present application, the identity authentication module provides general identity authentication and access control capabilities, which are consistent with the capabilities provided to users, that is, it has both identity authentication and access control capabilities for external users and identity authentication and access control capabilities for internal cloud service products.

[0087] In the embodiment of the present application, the identity authentication module mainly makes judgments based on the call restriction policy. The identity authentication module allows the first product to call product b, and completes fine-grained permission control of product a according to the mapping action of calling the cloud API interface, the data range during the call, and other scenarios.

[0088] The sending module 35 is used to send the verification result to the second product, so that the second product returns the cloud service interface call result to the first product based on the verification result.

[0089] It should be clear that the present application is not limited to the specific configurations and processes described in the above embodiments and shown in the figures. For the convenience and brevity of description, a detailed description of the known methods is omitted here, and the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, which will not be repeated here.

[0090] An embodiment of the present application provides a cloud service call management device, which includes: a delegation management module for responding to a delegation creation request to create a delegation relationship between a user subject and a first product, so as to realize the automated creation of service inline delegation and simplify the creation and authorization process of cloud service delegation; a temporary credential module for responding to a temporary credential application request sent by the first product, and based on the delegation relationship, sending a corresponding temporary credential to the first product to realize a temporary credential issuance mechanism for cloud services, while being able to meet the signature verification requirements of existing cloud APIs; a receiving module for receiving a permission verification request sent by a second product; a permission verification request is a verification request for the second product's calling authority to the first product when the first product calls the cloud service interface provided by the second product based on the temporary credential; an identity authentication module for verifying the calling authority of the first product based on the permission verification request and obtaining a verification result; a sending module for sending the verification result to the second product, so that the second product returns the cloud service interface call result to the first product based on the verification result, so as to perform fine-grained control of permissions for internal calls of cloud services and avoid the risk of data unauthorized access and cloud API redundancy problems in calls between services.

[0091] In a third aspect, an embodiment of the present application provides a cloud service system. Figure 4 A schematic diagram of the structure of a cloud service system provided in an embodiment of the present application. Figure 4 As shown, the cloud service system includes: at least one first product 41, at least one second product 42 and a cloud service call management device 43 as provided in the second aspect.

[0092] The cloud service call management device is used to manage the call of the first product to the cloud service interface provided by the second product.

[0093] It should be clear that the present application is not limited to the specific configurations and processes described in the above embodiments and shown in the figures. For the convenience and brevity of description, a detailed description of the known methods is omitted here, and the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, which will not be repeated here.

[0094] The cloud service system provided by the embodiment of the present application has the following advantages.

[0095] 1. A cloud service call management device is proposed. The device can make full use of the existing cloud API infrastructure and identity authentication capabilities, and perform fine-grained control of permissions for internal calls to cloud services, avoiding the risk of data unauthorized access and cloud API redundancy problems in calls between services. In this application, fine-grained control of permissions is implemented for internal calls to cloud services, avoiding the risk of data unauthorized access and cloud API redundancy problems that may exist in calls between services. This fine-grained control is an innovation in ensuring system security, especially in a cloud computing environment, where this demand becomes increasingly important.

[0096] 2. It provides the ability to automatically create inline delegations for services, simplifies the creation and authorization process of cloud service delegations, and is scalable, providing cloud services with the ability to expand delegation permissions. Traditionally, delegation management may require manual configuration, while automated processes can improve efficiency, reduce errors, and provide greater flexibility for future expansion.

[0097] 3. Provides a temporary credential issuance mechanism suitable for cloud services, which can generate specific temporary credentials based on the delegation relationship of cloud services, and can also meet the signature verification requirements of existing cloud APIs. This mechanism not only meets security requirements, but also takes into account the actual usage scenarios in the cloud computing environment, providing the system with a more flexible and secure identity authentication method.

[0098] 4. The system is scalable and can provide cloud services with delegated authority expansion capabilities. This design takes into account future changes and growth of the system, making it more adaptable and sustainable.

[0099] The cloud service system provided in the embodiment of the present application can be applied to the security management of cloud computing environments, such as public clouds, private clouds, and hybrid clouds, and provides fine-grained permission control for internal calls to cloud services, thereby enhancing the security of the overall system. Temporary credential management can also be applied to security authentication scenarios with validity periods. For example, in scenarios where security authentication of cloud services is required, a temporary credential issuance mechanism suitable for cloud services is provided to meet security verification requirements under different delegation relationships. The system can also protect internal data privacy: through fine-grained permission control, it helps to avoid the risk of data unauthorized access and protect the privacy of user and business data. It is suitable for application scenarios with high requirements for data privacy, such as medical scenarios, financial scenarios, etc.

[0100] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 5The electronic device includes: one or more processors 501; a memory 502, on which one or more programs are stored. When the one or more programs are executed by one or more processors, the one or more processors implement any one of the above-mentioned cloud service call management methods; one or more I / O interfaces 503, connected between the processor and the memory, and configured to realize information interaction between the processor and the memory.

[0101] Among them, the processor 501 is a device with data processing capabilities, including but not limited to a central processing unit (CPU); the memory 502 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory (FLASH); the I / O interface (read-write interface) 503 is connected between the processor 501 and the memory 502, and can realize information interaction between the processor 501 and the memory 502, including but not limited to a data bus (Bus), etc.

[0102] In some embodiments, the processor 501 , the memory 502 , and the I / O interface 503 are connected to each other through a bus, and further connected to other components of the computing device.

[0103] This embodiment also provides a computer-readable medium on which a computer program is stored. When the program is executed by a processor, the cloud service call management method provided in this embodiment is implemented. To avoid repeated description, the specific steps of the cloud service call management method are not repeated here.

[0104] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the invented method described above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0105] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0106] Those skilled in the art will understand that although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features from different embodiments is meant to be within the scope of the present embodiment and to form different embodiments.

[0107] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present application, but the present application is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and substance of the present application, and these modifications and improvements are also considered to be within the scope of protection of the present application.

Claims

1. A cloud service call management method, characterized in that: The method comprises: In response to the delegation creation request, creating a delegation relationship between the user subject and the first product; In response to the temporary credential application request sent by the first product, based on the delegation relationship, sending a corresponding temporary credential to the first product; receiving a permission verification request sent by the second product; the permission verification request is a verification request of the second product for the calling permission of the first product when the first product calls the cloud service interface provided by the second product based on the temporary credential; the first product and the second product belong to the same cloud service system; Based on the permission verification request, verify the calling permission of the first product to obtain a verification result; The verification result is sent to the second product, so that the second product returns a cloud service interface call result to the first product based on the verification result.

2. The method according to claim 1, characterized in that The method further comprises: Based on the delegated creation request and the service configuration information, a call restriction policy corresponding to the first product is created, wherein the service configuration information includes a pre-agreed calling permission of the first product to the cloud service interface provided by the second product.

3. The method according to claim 2, characterized in that After creating the call restriction policy corresponding to the first product based on the delegated creation request and the service configuration information, the method further includes: In response to the delegation authority modification request, the call restriction policy corresponding to the first product is modified.

4. The method according to claim 2 or 3, characterized in that: The verifying the calling authority of the first product based on the authority verification request to obtain a verification result includes: Based on the permission verification request, extracting a product identity credential of the first product; Obtaining a call restriction policy corresponding to the first product according to the product identity certificate of the first product; Based on the call restriction policy, the call permission of the first product is verified to obtain a verification result; the verification result includes verification pass information and data access permission range, or includes verification fail information.

5. The method according to claim 1, characterized in that After creating the delegation relationship between the user subject and the first product in response to the delegation creation request, the method further includes: In response to the delegation deletion request sent by the user subject, the delegation relationship between the user subject and the first product is deleted.

6. The method according to claim 1, characterized in that The delegation creation request is a request sent by the user subject for establishing an inline delegation and authorization with the first product; Alternatively, the delegation creation request is a request sent by the first product to establish inline delegation and authorization between the user principal and itself.

7. A cloud service call management device, characterized in that: The device comprises: A delegation management module, configured to create a delegation relationship between the user subject and the first product in response to the first request; a temporary credential module, configured to respond to a temporary credential application request sent by the first product and send a corresponding temporary credential to the first product based on the delegation relationship; a receiving module, configured to receive a permission verification request sent by a second product; the permission verification request is a verification request of the second product for the calling permission of the first product when the first product calls the cloud service interface provided by the second product based on the temporary credential; the first product and the second product belong to the same cloud service system; An identity authentication module, used to verify the calling authority of the first product based on the authority verification request and obtain a verification result; The sending module is used to send the verification result to the second product, so that the second product returns the cloud service interface call result to the first product based on the verification result.

8. A cloud service system, characterized in that: The system comprises: at least one first product, at least one second product and the cloud service call management device according to claim 7; The cloud service call management device is used to manage the call of the first product to the cloud service interface provided by the second product.

9. An electronic device, characterized in that: include: one or more processors; A storage device having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 7; One or more I / O interfaces are connected between the processor and the memory and are configured to implement information interaction between the processor and the memory.

10. A computer-readable medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images