Credential management system, credential acquisition method and related device

Abstract

The invention discloses a credential management system, a credential acquisition method and a related device, and belongs to the technical field of cloud computing. The credential management system is applied to a cloud management platform, and the cloud management platform comprises a first credential management node and a second credential management node. The target service node sends a service authentication request to the first credential management node; the first credential management node sends a first token to the target service node under the condition that the first credential management node verifies that the target service node is a legal cloud service node; and the target service node obtains the first credential information from the first credential management node based on the first token. A first credential management node is set to provide a credential management service for a plurality of cloud service nodes, so that a second credential management node provides the credential management service for a customer, and meanwhile, the service credential of the second credential management node can be managed through the first credential management node. And the credential information of the cloud service node and the client can be comprehensively managed.

Description

[0001] This application claims the priority of a Chinese patent application with the application number 202311713709.1 and the invention title "A Method, Device and Other Equipment for Credential Management" filed on December 13, 2023, the entire content of which is incorporated herein by reference. Technical Field

[0002] This application relates to the field of cloud computing technology, and particularly to a credential management system, a credential acquisition method and related devices. Background Art

[0003] With the rapid development of cloud computing technology, not only cloud services provided by cloud service providers but also various services of tenants are deployed on the cloud management platform. As the most direct and critical assets in data security, service credentials of cloud services and / or access credentials of services need to be securely stored and protected to ensure the data security of the entire cloud management platform.

[0004] In the related art, to ensure the security of credential information of customers (i.e., tenants and / or users of tenants of the cloud management platform), such as access credentials for services under the cloud and service credentials involved in services on the cloud, tenants can purchase third-party credential management software by themselves, and then manually host their own credential information in the third-party credential management software and maintain the running state of the third credential management software. This solution requires users to configure and maintain the third-party credential management software by themselves, and the implementation cost of the solution is relatively high. If the customer side of the cloud management platform provides a credential management service, customers can also use this credential management service to host their own credential information. However, as a cloud service itself, the storage, permission, auditing, encryption, message notification and other capabilities of the credential management service are provided by other cloud services. That is, there is a service call chain between the credential management service and other cloud services, and there may be a scenario of circular dependency, resulting in other cloud services being unable to use the credential management service for credential management.

[0005] Based on this, there is an urgent need for a credential management solution that can effectively manage service credentials of various cloud services in the cloud management platform and access credentials of customers' own services. Summary of the Invention

[0006] This application provides a credential management system, a credential acquisition method and related devices, which can effectively manage service credentials of various cloud services in the cloud management platform and access credentials of customers' own services. The technical solutions are as follows:

[0007] In a first aspect, a credential management system is provided, which is applied to a cloud management platform. The cloud management platform includes a first credential management node and multiple cloud service nodes. The first credential management node is used to manage a first type of credentials, and the first type of credentials includes service credentials of the multiple cloud service nodes. The multiple cloud service nodes further include a second credential management node, and the second credential management node is used to manage a second type of credentials, and the second type of credentials includes business credentials of customers.

[0008] In the credential management system provided in this application, a target service node is used to send a service authentication request to the first credential management node. The target service node is any one of the multiple cloud service nodes, and the service authentication request carries service identity information of the target service node. The first credential management node is used to, in response to the service authentication request, send a first token to the target service node when verifying that the target service node is a legitimate cloud service node based on the service identity information. The target service node is further used to, based on the first token, send a first credential acquisition request to the first credential management node, and the first credential acquisition request is used to request to obtain service credentials of the target service node. The first credential management node is further used to, in response to the first credential acquisition request, send first credential information to the target service node, and the first credential information includes service credentials of the target service node.

[0009] That is to say, for any cloud service node in the cloud management platform, its service credentials can be hosted in the first credential management node, and the first credential management node manages the service credentials of each cloud service node. Among them, each cloud service node corresponds to a service identity information. When a target service node among the multiple cloud service nodes needs to use its own service credentials, it can send a service authentication request to the first credential management node based on its own service identity information. When the first credential management node verifies that the target service node is a legitimate cloud service node, it sends a first token to the target service node, so that the target service node can send a first credential acquisition request to the first credential management node based on the first token to obtain the service credentials of the target service node from the first credential management node. Thus, by setting up the first credential management node, credential management services can be provided for multiple cloud service nodes, so that while the second credential management node provides credential management services for customers, the service credentials of the second credential management node can be managed through the first credential management node. In this way, the credential information of cloud service nodes and customers can be comprehensively managed, and the credential management efficiency is improved.

[0010] Optionally, the target service node is any one of the multiple cloud service nodes other than the second credential management node, and the second type of credential further includes an access credential for a first application, where the first application is provided by the cloud management platform to the customer and can be accessed by the target service node.

[0011] In the credential management system provided in this application, the target service node is further configured to send a second credential acquisition request to the second credential management node based on the service credential, where the second credential acquisition request is used to request the access credential for the first application; the second credential management node is configured to, in response to the second credential acquisition request, send second credential information to the target service node when confirming the legal identity of the target service node, where the second credential information includes the access credential for the first application; the target service node is further configured to access the first application based on the access credential for the first application.

[0012] That is to say, after obtaining its own service credential, the target service node can also continue to access the second credential management node based on its own service credential to obtain the access credential for the first application from the second credential management node.

[0013] Optionally, the cloud management platform further includes a unified identity authentication node, where the unified identity authentication node is configured to verify the legal identities of the multiple cloud service nodes, and the service credential of the target service node includes the identity authentication credential of the target service node.

[0014] In the credential management system provided in this application, the target service node is further configured to send an identity authentication request to the unified identity authentication node based on the identity authentication credential; the unified identity authentication node is configured to, in response to the identity authentication request, send a second token to the target service node when verifying the legal identity of the target service node based on the authentication identity credential; the target service node is further configured to send the second credential acquisition request to the second credential management node, and the second credential acquisition request carries the second token.

[0015] That is to say, as cloud service nodes, the mutual access between the target service node and the second credential management node is realized based on the token provided by the unified identity authentication node.

[0016] Optionally, in the credential management system provided in this application, the target service node is further configured to send an identity authentication request to the unified identity authentication node based on the identity authentication credential; the unified identity authentication node is further configured to, in response to the identity authentication request, send a third token to the target service node when verifying the legal identity of the target service node based on the authentication identity credential; the target service node is further configured to send a credential trusteeship request to the second credential management node, where the credential trusteeship request carries the third token and the access credential of the first application, so that the second credential management node stores the access credential of the first application.

[0017] That is, for the target service node, it can entrust the access credential for accessing the first application to the second credential management node. In this way, the target service node no longer stores the access credential of the first application itself and can obtain it from the second credential management node when it needs to access the first application. In this way, the security of the credential information of the target service node is ensured.

[0018] Optionally, the cloud management platform further includes a plurality of service nodes, and the plurality of cloud service nodes further include service trusteeship nodes.

[0019] In the credential management system provided in this application, if the target service node is the service trusteeship node, the target service node is further configured to receive a third credential acquisition request sent by a target service node, where the target service node is a service node among the plurality of service nodes that deploys the target service of the customer; the target service node is further configured to, in response to the third credential acquisition request, send a fourth credential acquisition request to the second credential management node, where the fourth credential acquisition request is used to request to obtain the service credential of the target service; the second credential management node is further configured to, in response to the fourth credential acquisition request, send third credential information to the target service node when confirming the legal identity of the target service node, where the third credential information includes the service credential of the target service; the target service node is further configured to send the third credential information to the target service node.

[0020] Optionally, the cloud management platform further includes a unified identity authentication node, and the unified identity authentication node is configured to verify the legal identities of the plurality of cloud service nodes.

[0021] In the credential management system provided by this application, the target service node is further configured to send a token acquisition request to the unified identity authentication node, where the token acquisition request carries the service identifier of the target service; the unified identity authentication node is further configured to, in response to the token acquisition request, send a fourth token to the target service node when verifying that the target service node is a customer-trusted service node based on the service identifier; the target service node is further configured to send the fourth credential acquisition request to the second credential management node, where the fourth credential acquisition request carries the fourth token.

[0022] That is to say, for a customer or a business node of the customer, the customer can entrust its credential acquisition operation to the business hosting node, and the business hosting node can obtain the hosted business credentials from the second credential management node on behalf of the customer.

[0023] Optionally, the first type of credential further includes an access credential for a second application, where the second application is an application that is invisible to the customer in the cloud management platform but can be accessed by the target service node.

[0024] It can be seen that as an internal credential management node of the cloud management platform, the first credential management node can not only manage the service credentials of multiple cloud service nodes but also manage the access credentials of applications invisible to the customer. In this way, through the first credential management node, the security of the credential information of the cloud service nodes and the first application in the cloud management platform is ensured.

[0025] Optionally, in the credential management system provided by this application, the first credential management node is further configured to: receive a service identity configuration request sent by a target service deployment device, where the service identity configuration request carries the device information of the target service deployment device, the service information of the target service node, and node information; if it is determined that the target service deployment device is a trusted service deployment device based on the device information, generate service identity information for the target service node based on the service information and the node information; and send the service identity information to the target service deployment device, so that the target service deployment device configures the service identity information in the target service node.

[0026] That is, for the target service node, when it requests to obtain a service credential from the first credential management node, the first credential management node needs to authenticate its identity. Based on this, when deploying the target service node, the target service deployment device applies for service identity information in the first credential management node on behalf of the target service node and pre-sets the service identity information in the target service node. In this way, when the target service node accesses the first credential management node based on its service identity information, the first credential management node can accurately identify the identity of each target service node based on the service identity information to provide it with service credentials related to data security.

[0027] In a second aspect, a credential acquisition method is provided, which is applied to a target service node among a plurality of cloud service nodes included in a cloud management platform. The cloud management platform further includes a first credential management node, and the first credential management node is used to manage a first type of credentials, and the first type of credentials includes service credentials of the plurality of cloud service nodes. The plurality of cloud service nodes further includes a second credential management node, and the second credential management node is used to manage a second type of credentials, and the second type of credentials includes business credentials of customers. The method includes:

[0028] Sending a service authentication request to the first credential management node, where the service authentication request carries the service identity information of the target service node, and the target service node is any one of the plurality of cloud service nodes; receiving a first token sent by the first credential management node, where the first token is sent by the first credential management node when it verifies that the target service node is a legitimate cloud service node based on the service identity information; based on the first token, sending a first credential acquisition request to the first credential management node, where the first credential acquisition request is used to request to obtain the service credential of the target service node; receiving first credential information sent by the first credential management node, and the first credential information includes the service credential of the target service node.

[0029] Optionally, the target service node is any one of the plurality of cloud service nodes other than the second credential management node, and the second type of credentials further includes access credentials of a first application, and the first application is an application provided by the cloud management platform to the customer and accessible by the target service node. The method further includes: based on the service credential of the target service node, sending a second credential acquisition request to the second credential management node, where the second credential acquisition request is used to request to obtain the access credential of the first application; receiving second credential information sent by the second credential management node, where the second credential information is sent when the second credential management node confirms the legitimate identity of the target service node, and the second credential information includes the access credential of the first application; accessing the first application based on the access credential of the first application.

[0030] Optionally, the cloud management platform further includes a unified identity authentication node for verifying the legal identities of the multiple cloud service nodes. The service credentials of the target service node include the identity authentication credentials of the target service node. The sending of the second credential acquisition request to the second credential management node based on the service credentials of the target service node includes: sending an identity authentication request to the unified identity authentication node based on the identity authentication credentials; receiving a second token sent by the unified identity authentication node, where the second token is sent when the unified identity authentication node verifies the legal identity of the target service node based on the authenticated identity credentials; and sending the second credential acquisition request to the second credential management node, where the second credential acquisition request carries the second token.

[0031] Optionally, before sending the second credential acquisition request to the second credential management node based on the service credentials of the target service node, the method further includes: sending an identity authentication request to the unified identity authentication node based on the identity authentication credentials; receiving a third token sent by the unified identity authentication node, where the third token is sent when the unified identity authentication node verifies the legal identity of the target service node based on the authenticated identity credentials; and sending a credential trusteeship request to the second credential management node, where the credential trusteeship request carries the third token and the access credentials of the first application, so that the second credential management node stores the access credentials of the first application.

[0032] Optionally, the cloud management platform further includes multiple business nodes, and the multiple cloud service nodes further include a business trusteeship node. The method further includes: if the target service node is the business trusteeship node, receiving a third credential acquisition request sent by a target business node, where the target business node is a business node among the multiple business nodes that deploys the target business of the customer; in response to the third credential acquisition request, sending a fourth credential acquisition request to the second credential management node, where the fourth credential acquisition request is used to request the business credentials of the target business; receiving third credential information sent by the second credential management node, where the third credential information is sent when the second credential management node confirms the legal identity of the target service node, and the third credential information includes the business credentials of the target business; and sending the third credential information to the target business node.

[0033] Optionally, the cloud management platform further includes a unified identity authentication node for verifying the legitimate identities of the multiple cloud service nodes; the sending of a fourth credential acquisition request to the second credential management node includes: sending a token acquisition request to the unified identity authentication node, where the token acquisition request carries the service identifier of the target service; receiving a fourth token sent by the unified identity authentication node, where the fourth token is sent by the unified identity authentication node when it verifies that the target service node is a customer-trusted service node based on the service identifier; and sending a fourth credential acquisition request to the second credential management node, where the fourth credential acquisition request carries the fourth token.

[0034] Optionally, the first type of credential further includes an access credential for a second application, where the second application is an application that is invisible to the customer in the cloud management platform but can be accessed by the target service node.

[0035] In a third aspect, a credential acquisition method is provided, which is applied to a first credential management node included in a cloud management platform. The cloud management platform further includes multiple cloud service nodes. The first credential management node is used to manage a first type of credential, and the first type of credential includes service credentials of the multiple cloud service nodes. The multiple cloud service nodes further include a second credential management node, and the second credential management node is used to manage a second type of credential, and the second type of credential includes business credentials of a customer. The method includes:

[0036] Receiving a service authentication request sent by a target service node, where the service authentication request carries service identity information of the target service node, and the target service node is any one of the multiple cloud service nodes; in response to the service authentication request, when it is verified that the target service node is a legitimate cloud service node based on the service identity information, sending a first token to the target service node; receiving a first credential acquisition request sent by the target service node, where the first credential acquisition request carries the first token; and in response to the first credential acquisition request, sending first credential information to the target service node, where the first credential information includes the service credential of the target service node.

[0037] Optionally, the method further includes: receiving a service identity configuration request sent by a target service deployment device, where the service identity configuration request carries device information of the target service deployment device, service information of the target service node, and node information; if it is determined that the target service deployment device is a trusted service deployment device based on the device information, then generating service identity information of the target service node based on the service information and the node information; and sending the service identity information to the target service deployment device so that the target service deployment device configures the service identity information in the target service node.

[0038] Fourthly, a credential acquisition device is provided. The credential acquisition device has a function of implementing the behavior of the credential acquisition method in the second aspect above. The credential acquisition device includes at least one module, and the at least one module is used to implement the credential acquisition method provided in the second aspect above.

[0039] Fifthly, a credential acquisition device is provided. The credential acquisition device has a function of implementing the behavior of the credential acquisition method in the third aspect above. The credential acquisition device includes at least one module, and the at least one module is used to implement the credential acquisition method provided in the third aspect above.

[0040] Sixthly, a computing device cluster is provided. The computing device cluster includes at least one computing device, and each computing device includes a processor and a memory. The processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the steps of the credential acquisition method described in the second aspect above, or executes the steps of the credential acquisition method described in the third aspect above.

[0041] Optionally, each computing device may further include a communication bus, and the communication bus is used to establish a connection between the processor and the memory of each computing device.

[0042] Seventhly, a computer-readable storage medium is provided. The storage medium includes computer program instructions, and when the computer program instructions are executed by a computing device cluster, the computing device cluster is caused to execute the steps of the credential acquisition method described in the second aspect above, or execute the steps of the credential acquisition method described in the third aspect above.

[0043] Eighthly, a computer program product including instructions is provided. When the instructions are run by a computing device cluster, the computing device cluster is caused to execute the steps of the credential acquisition method described in the second aspect above, or execute the steps of the credential acquisition method described in the third aspect above.

[0044] The technical effects obtained in the second to eighth aspects above are similar to those obtained by the corresponding technical means in the first aspect, and will not be elaborated here. Description of the Drawings

[0045] Figure 1 is a schematic diagram of a credential management solution in a related art provided by an embodiment of the present application;

[0046] Figure 2 is a schematic diagram of another credential management solution in a related art provided by an embodiment of the present application;

[0047] Figure 3It is a schematic structural diagram of a cloud management platform provided by an embodiment of the present application;

[0048] Figure 4 It is a schematic flow diagram of a credential acquisition method provided by an embodiment of the present application;

[0049] Figure 5 It is a schematic flow diagram of a process for configuring service identity information provided by an embodiment of the present application;

[0050] Figure 6 It is a schematic flow diagram of a process for a service node to obtain an application access credential provided by an embodiment of the present application;

[0051] Figure 7 It is a flowchart of another credential acquisition method provided by an embodiment of the present application;

[0052] Figure 8 It is a schematic structural diagram of a credential management system provided by an embodiment of the present application;

[0053] Figure 9 It is a schematic flow diagram of yet another credential acquisition method provided by an embodiment of the present application;

[0054] Figure 10 It is a schematic structural diagram of a credential acquisition device provided by an embodiment of the present application;

[0055] Figure 11 It is a schematic structural diagram of another credential acquisition device provided by an embodiment of the present application;

[0056] Figure 12 It is a schematic structural diagram of a computing device provided by an embodiment of the present application;

[0057] Figure 13 It is a schematic structural diagram of a computing device cluster provided by an embodiment of the present application;

[0058] Figure 14 It is a schematic diagram of the network connection relationship of a computing device provided by an embodiment of the present application. Detailed implementation manners

[0059] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the following will further describe the embodiments of the present application in detail with reference to the accompanying drawings.

[0060] For ease of understanding, before explaining the credential management solution provided by the embodiments of the present application in detail, the terms, application scenarios, and implementation environments involved in the embodiments of the present application will be introduced first.

[0061] First, the terms involved in the embodiments of the present application will be introduced.

[0062] Credentials: Sensitive data such as usernames, login accounts, passwords, security tokens, etc., which are used to verify user identities and authorize access.

[0063] Credential hosting: Credential hosting is a service used to manage and protect sensitive data such as usernames, passwords, and security tokens. By entrusting credential information to a professional hosting service provider, enterprises can reduce the risk of data leakage and enhance security. The hosting service provider usually provides a secure platform for storing, managing, and protecting credential information. This platform can encrypt the storage of credentials, perform retrieval queries, and rotate credentials to ensure the security and availability of the data.

[0064] Credential retrieval / query: Credential query refers to the process of retrieving and obtaining stored credential information. When conducting a credential query, corresponding query conditions or keywords usually need to be provided to retrieve the required credential information from the database or system storing the credential information. Among them, the query conditions can be determined according to specific requirements and scenarios, such as by username, internet protocol (IP) address, login account, device identifier, etc. Through credential query, users can quickly find the required credential information for authentication and authorized access based on this credential information.

[0065] Credential rotation: Credential rotation refers to the process of regularly replacing or updating credential information to ensure system security. That is to say, the purpose of credential rotation is to reduce the risk of credentials being cracked or leaked by regularly replacing them. In some cases, if credentials are not replaced for a long time, they may be cracked or stolen by hackers or malicious users, posing a threat to the system. Therefore, regularly performing credential rotation is an effective security measure to improve system security.

[0066] Secondly, a brief introduction to the application scenario of the embodiments of the present application is given.

[0067] With the rapid development of cloud computing technology, not only cloud services provided by cloud service providers but also various businesses of customers (including tenants of the cloud management platform and / or users of the tenants) are deployed on the cloud management platform. The service credentials of cloud services and / or access credentials of businesses, as the most direct and critical assets in data security, need to be securely stored and protected to ensure the data security of the entire cloud management platform.

[0068] Among them, for customers, their credential information not only includes cloud credentials such as access credentials to accessible cloud services and business credentials of their own cloud-based businesses but also includes business credentials of the customers' off-cloud businesses, etc. When managing the credentials of customers, usually the following two credential management schemes are included:

[0069] In the first credential management scheme, seeFigure 1 , the introduction of third-party credential management software requires customers to separately download, deploy, and maintain it, which is only visible within the customer's own network domain. Specifically, customers independently purchase third-party credential management software on the network, complete payment and download separately, and then, based on the operation and maintenance requirements of the third-party credential management software, complete network configuration, the setup of computing nodes and databases, etc. After completing the prerequisite conditions required for the operation of the third-party credential management software, it is possible to perform initialization deployment, configuration, and use according to the installation guide of the third-party credential management software, and independently complete the construction of data disaster recovery capabilities.

[0070] However, the above first credential management solution requires users to independently complete the deployment, configuration, and maintenance of the third-party credential management software, resulting in a relatively high threshold and cost for using the solution. Moreover, third-party credential management software generally only supports the management of general credentials, has poor extensibility, weak cloud ecosystem capabilities, and cannot integrate various credential sources for automatic hosting and rotation. In addition, since the third-party credential management software runs within the customer's network domain, when the third-party credential management software manages the customer's cloud credentials, it cannot reuse the general capabilities such as cloud monitoring, alerting, and auditing of the cloud management platform.

[0071] In the second credential management solution, refer to Figure 2 , the cloud management platform can provide a credential management service to customers, and tenants can enter their own credential information into this credential management service to achieve credential hosting. Among them, the credential management service, as a cloud service, is responsible for its operation and maintenance, update, expansion, etc. by the cloud management platform.

[0072] However, when the credential management service manages credentials, its capabilities such as storage, permissions, auditing, encryption, and message notification are provided by other cloud services, resulting in a service call chain between this credential management service and other cloud services (such as database services, middleware services, big data services, etc.), and there may be a scenario of circular dependency, thus causing these other cloud services with circular dependency relationships to be unable to use this credential management service to host their own credential information.

[0073] Based on this, the embodiments of the present application provide a credential management solution applied to a cloud management platform. The cloud management platform includes a first credential management node and a second credential management node. The service credentials of multiple cloud service nodes are managed through the first credential management node, and the business credentials of customers are managed through the second credential management node. In this way, it is possible to store and manage both the credential information of cloud services and the credential information of customers, and ensure the security of credential management.

[0074] Finally, the implementation environment involved in the embodiments of the present application is introduced.

[0075] As Figure 3As shown in the figure, the cloud management platform includes a first credential management node and multiple cloud service nodes. The first credential management node is used to manage the first type of credentials, and the first type of credentials includes service credentials of multiple cloud service nodes. The multiple cloud service nodes further include a second credential management node, and the second credential management node is used to manage the second type of credentials, and the second type of credentials includes business credentials of customers.

[0076] Among them, to ensure the overall security of the credential management service, the above-mentioned first credential management node can be deployed in the internal network of the cloud management platform, visible to the administrators of the cloud management platform and the cloud services deployed on the cloud management platform, so that the administrators of the cloud management platform can entrust the service credentials of the cloud service nodes to the first credential management node, and each cloud service node can obtain the corresponding service credentials from the first credential management node. Of course, the first credential management node deployed in this internal network is invisible to the customers of the cloud management platform. The above-mentioned second credential management node can be deployed in the external network of the cloud management platform and is visible to the customers of the cloud management platform, so that the customers of the cloud management platform can entrust their own business credentials to the second credential management node and obtain the corresponding business credentials from the second credential management node when needed.

[0077] In the embodiment of the present application, the first credential management node in the cloud management platform is used to manage the service credentials of multiple cloud service nodes, and provides credential management services such as credential hosting, credential query, and credential rotation for the multiple cloud service nodes in the cloud management platform. The second credential management node itself is a kind of cloud service node, and its service credentials can be hosted in the first credential management node. In this way, the credential management of all cloud service nodes in the cloud management platform can be realized through the first credential management node. In addition, the second credential management node, as a kind of cloud service node, is used to manage the business credentials of customers. In this way, through the second credential management node, the cloud management platform can provide credential management services such as credential hosting, credential query, and credential rotation for all customers, and ensure the security of customer credentials by virtue of the computing, storage, auditing and other capabilities of the cloud management platform itself.

[0078] In some embodiments, the implementation process of hosting the service credentials of the cloud service nodes in the first credential management node can be as follows: the administrators of each cloud service in the cloud management platform enter service credentials such as the management account and internal access account of the corresponding cloud service into the first credential management node, so as to realize hosting the service credentials of each cloud service node in the first credential management node.

[0079] In some embodiments, the implementation process of hosting the business credentials of customers in the second credential management node can be as follows: the customers enter their own business credentials into the second credential management node, so as to realize hosting the business credentials in the second credential management node.

[0080] Optionally, for the second credential management node, the second type of credentials managed by it also includes access credentials of the first application, which is an application provided to the customer by the cloud management platform and accessible by multiple cloud service nodes. The embodiment of the present application does not limit the number, type and other information of the first application.

[0081] In other words, the first application is an external application in the cloud management platform, which is an application provided by the cloud management platform to customers, but multiple cloud service nodes deployed by the cloud management platform itself can also access these external applications. Based on this, the cloud service administrator needs to enter the access credentials of each external application accessible by the cloud service into the second credential management node, so as to host the access credentials of the external application on the second credential management node.

[0082] Optionally, for the first credential management node, the first type of credentials managed by it also includes access credentials for a second application, where the second application is an application that is invisible to customers in the cloud management platform but accessible to multiple cloud service nodes. This embodiment of the application does not limit the number, type, and other information of the second application.

[0083] In other words, the second application is an internal application in the cloud management platform, which is deployed in the internal network and is invisible to the customers of the cloud management platform. At this time, the access credentials of the internal application can be hosted in the first credential management node deployed in the internal network.

[0084] It can be seen that in the embodiment of the present application, the service credentials of the cloud service nodes in the cloud management platform and the access credentials of the internal applications are all hosted in the first credential management node in the internal network; the business credentials of the customers of the cloud management platform and the access credentials of the external applications visible to the customers are all hosted in the second credential management node in the external network. In this way, through the combination of the first credential management node and the second credential management node, not only can the service credentials of the cloud service nodes be managed, but also credential management services can be provided to customers; moreover, when performing credential management, the credentials used in the internal network and the external network of the cloud management platform are managed separately, ensuring the security of credential management.

[0085] It should be understood that the above-mentioned cloud management platform can be a server cluster or distributed system composed of multiple physical servers, or it can be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), as well as big data and artificial intelligence platforms, or it can be a cloud computing service center.

[0086] Moreover, the above-mentioned cloud management platform provided in the embodiments of the present application is only an example. Other existing or future possible cloud management platforms that can be applied to the embodiments of the present application should also be included within the protection scope of the embodiments of the present application and are hereby incorporated herein by reference.

[0087] It should be noted that the application scenarios and implementation environments described in the embodiments of the present application are for more clearly explaining the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those of ordinary skill in the art can know that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are equally applicable to similar technical problems.

[0088] Next, an explanation will be given first to the credential acquisition method provided in the embodiments of the present application.

[0089] Figure 4 is a flowchart of a credential acquisition method provided in the embodiments of the present application. This method is applied to Figure 3 the target service node among multiple cloud service nodes included in the cloud management platform shown. As Figure 3 shown, the cloud management platform includes multiple cloud service nodes and a first credential management node. The first credential management node is used to manage the first type of credentials, and the first type of credentials includes service credentials of multiple cloud service nodes; the multiple cloud service nodes further include a second credential management node, and the second credential management node is used to manage the second type of credentials, and the second type of credentials includes business credentials of customers. Please refer to Figure 4 The credential acquisition method provided in the embodiments of the present application includes the following steps.

[0090] Step 401: The target service node sends a service authentication request to the first credential management node, and the service authentication request carries the service identity information of the target service node.

[0091] Among them, the target service node is any one of the multiple cloud service nodes.

[0092] It should be noted that in the case where the service credentials of multiple cloud service nodes in the cloud management platform are entrusted to the first credential management node, the first credential management node stores the service credentials of multiple cloud service nodes. When any one of the multiple cloud service nodes needs to use its own service credentials, it can obtain its own service credentials from the first credential management node through steps 401 - 405.

[0093] In a possible implementation, the implementation process of step 401 may be as follows: The target service node, based on its own service identity information, calls the application programming interface (API) of the first credential management node to send a service authentication request to the first credential management node. The service authentication request carries the service identity information of the target service node.

[0094] The service identity information is the identity information generated by the first credential management node for the target service node based on the service information and node information of the target service node. The service identity information is configured in the target service node by the target service deployment device, and the target service deployment device is a service deployment device trusted by the first credential management node.

[0095] In some embodiments, referring to Figure 5 , the implementation process of configuring the service identity information of the target service node may include the following steps.

[0096] Step 501: When deploying the target service node, the target service deployment device sends a service identity configuration request to the first credential management node. The service identity configuration request carries the device information of the target service deployment device, the service information of the target service node, and the node information.

[0097] It should be noted that deploying the target service node can be understood as adding a new target service node, or as deploying the target service on an existing cloud service node. The embodiments of the present application do not limit this, aiming to define that each cloud service node corresponds to a service information and node information, and a unique service identity information.

[0098] Optionally, the target service deployment device may send the service identity configuration request in an encrypted manner to ensure the security of the information carried in the request.

[0099] The device information of the target service deployment device may be a device identifier, a device identity document (ID), etc. Similarly, the service information of the target service node may be a service identifier, a service ID, etc., and the node information may also be a node identifier, a node ID, etc. The embodiments of the present application do not limit this.

[0100] Step 502: The first credential management node receives the service identity configuration request sent by the target service deployment device. If it determines that the target service deployment device is a trusted service deployment device based on the device information, it generates the service identity information of the target service node based on the service information and node information.

[0101] Among them, when the target service deployment device is a service deployment device trusted by the first credential management node, the first credential management node will generate service identity information for the target service node that requests to configure identity information based on the request of the target service deployment device; conversely, when the target service deployment device is not a service deployment device trusted by the first credential management node, the first credential management node will not generate service identity information for the target service node that requests to configure identity information by the target service deployment device.

[0102] Optionally, a trusted device list is stored in the first credential management node, and the trusted device list includes device information of multiple service deployment devices trusted by the first credential management node. Based on this, when the first credential management node receives a service identity configuration request sent by the target service deployment device, it can determine whether the target service deployment device is a trusted service deployment device by querying the trusted device list based on the device information carried in the service identity configuration request.

[0103] Among them, the trusted device list is the trusted whitelist of the first credential management node.

[0104] Optionally, the device information of the service deployment device stored in the trusted device list may further include the public key of the asymmetric key corresponding to the service deployment device, so that when the first credential management and multiple service deployment devices transmit data / information, the data / information can be encrypted using the public key to ensure communication security.

[0105] In a possible implementation manner, if the device information carried in the service identity configuration request is the same as the device information of any one service deployment device stored in the trusted device list, it is determined that the target service deployment device is a trusted service deployment device; if it is different from the device information of each service deployment device stored in the trusted device list, it is determined that the target service deployment device is not a trusted service deployment device, and at this time, the process ends and the subsequent steps of generating service identity information are not executed.

[0106] As an example, the trusted device list of the first credential management node is configured by the administrator of the first credential management node, that is, the device information of the target service deployment device can be added to the trusted device list of the first credential management node to make the target service deployment device a service deployment device trusted by the first credential management node.

[0107] In a possible implementation manner, the service identity information generated by the first credential management node for the target service node includes service name, asymmetric key private key, identity ID, access address information of the first credential management system, etc.

[0108] Among them, the access address information of the first credential management system can be the API interface information of the first credential management node, so that the target service node can call the corresponding API interface based on the API interface information to access the first credential management node.

[0109] Optionally, the first credential management node stores the asymmetric key public key corresponding to each service identity information.

[0110] Step 503: The first credential management node sends the service identity information to the target service deployment device.

[0111] Optionally, the first credential management node can also use the same encryption method as in step 501 above to send the service identity information to the target service deployment device to ensure the security of the service identity information.

[0112] As an example, the encryption method is determined through negotiation between the first credential management node and the target service deployment device; or when the administrator adds the device information of the target service deployment device to the trusted device list of the first credential management node, the encryption method and public key for communication between the first credential management node and the target service deployment device are also configured in the trusted device list.

[0113] Step 504: The target service deployment device receives the service identity information and configures the service identity information in the target service node.

[0114] That is, after receiving the service identity information sent by the first credential management node, the target service deployment device configures the service identity information in the target service node during the process of deploying the target service node.

[0115] Optionally, the target service deployment device writes the service identity information into the memory of the target service node, so that the target service node can read the service identity information from the memory when starting to run.

[0116] Step 402: The first credential management node receives the service authentication request sent by the target service node, and in response to the service authentication request, when verifying that the target service node is a legitimate cloud service node based on the service identity information, sends a first token to the target service node.

[0117] It should be noted that when the target service node is any cloud service node in the cloud management platform, when it obtains its own service credential from the first credential management node, the first credential management node will authenticate the identity of the target service node, that is, determine whether the target service node has the right to access the first credential management node by verifying its service identity information to request the acquisition of service credentials.

[0118] In a possible implementation, since the service identity information is generated by the first credential management node for the cloud service node, the first credential management node also stores the service identity information of the cloud service node. Based on this, when the first credential management node receives a service authentication request sent by the target service node, it determines whether it stores the same service identity information based on the service identity information carried in the service authentication request. If it stores the same service identity information, it determines that the target service node is a legitimate cloud service node; if it does not store the same service identity information, it determines that the target service node is not a legitimate cloud service node.

[0119] If the first credential management node determines that the target service node is not a legitimate cloud service node based on the service identity information verification, the first credential management node does not send the first token to the target service node. In the absence of the first token, the target service node has no right to use the credential management service provided by the first credential management node and cannot obtain service credentials from the first credential management node.

[0120] Step 403: The target service node receives the first token sent by the first credential management node and sends a first credential acquisition request to the first credential management node based on the first token. The first credential acquisition request is used to request the service credentials of the target service node.

[0121] Among them, the first credential acquisition request carries the first token.

[0122] Optionally, when the service credentials of the target service node include multiple credentials, the first credential acquisition request also carries the credential identifier of the specified credential to request to obtain the specified credential from the first credential management node.

[0123] Step 404: The first credential management node receives the first credential acquisition request sent by the target service node and, in response to the first credential acquisition request, sends the first credential information to the target service node. The first credential information includes the service credentials of the target service node.

[0124] Among them, the service credentials of the target service node can be all the credentials of the target service node or part of the credentials of the target service node, such as the specified credential requested by the target service node. The embodiments of the present application do not limit the type and quantity of the service credentials of the target service node.

[0125] Step 405: The target service node receives the first credential information sent by the first credential management node.

[0126] After receiving the first credential information, the target service node can access relevant cloud service nodes and applications according to the first credential information. The embodiments of the present application do not limit the timing and object of the target service node using the first credential information, aiming to illustrate that the target service node can obtain its own service credential from the first credential management node.

[0127] For the credential acquisition method shown in the above embodiments, the target service node is any one of multiple cloud service nodes, and it specifically includes the following three cases:

[0128] In the first case, the target service node is the second credential management node.

[0129] In this case, as a kind of cloud service node itself, the service credential of the second credential management node can be hosted in the first credential management node. When the service credential is needed, the second credential management node can obtain the service credential from the first credential management node in the manner of steps 401 - 405 above.

[0130] The implementation process of the second credential management node obtaining the service credential from the first credential management node can refer to the above method embodiments and will not be elaborated here.

[0131] In the second case, the target service node is any cloud service node other than the second credential management node.

[0132] Among them, the second type of credential managed by the second credential management node also includes the access credential of the first application. The first application is provided by the cloud management platform to the customer and can be accessed by the target service node. Therefore, after obtaining its own service credential, the target service node can continue to access the second credential management node based on its own service credential to obtain the access credential of the first application from the second credential management node.

[0133] Based on this, please refer to Figure 6 , the implementation process of the target service node accessing the first application can include the following steps.

[0134] Step 601: The target service node sends a second credential acquisition request to the second credential management node based on the service credential of the target service node. The second credential acquisition request is used to request the access credential of the first application.

[0135] Among them, the second credential acquisition request carries the application identifier of the first application.

[0136] In some embodiments, the cloud management platform further includes a unified identity authentication node, which is used to verify the legal identities of multiple cloud service nodes. In the case where the unified identity authentication node verifies the legal identities of cloud service nodes, the cloud service nodes can access each other.

[0137] Among them, the unified identity authentication node serves as the identity authentication node among multiple cloud service nodes. When a certain cloud service node needs to access other cloud service nodes, it needs to first perform identity verification in the unified identity authentication node, and then access other cloud service nodes based on the token provided by the unified identity authentication node. That is to say, the various cloud service nodes access each other based on the token provided by the unified identity authentication node.

[0138] In a possible implementation manner, the service credential of the target service node includes the identity authentication credential of the target service node. The implementation process of step 601 can be as follows: The target service node sends an identity authentication request to the unified identity authentication node based on its own identity authentication credential; receives the second token sent by the unified identity authentication node, where the second token is sent by the unified identity authentication node when verifying the legal identity of the target service node based on the authentication identity credential; and sends a second credential acquisition request to the second credential management node, where the second credential acquisition request carries the second token.

[0139] That is to say, before the target service node sends a second credential acquisition request to the second credential management node, it needs to first perform identity verification in the unified identity authentication node. After obtaining the second token provided by the unified identity authentication node, it accesses the second credential management node based on the second token.

[0140] Step 602: The second credential management node receives the second credential acquisition request, and when confirming the legal identity of the target service node, sends the second credential information to the target service node, where the second credential information includes the access credential of the first application.

[0141] Since the unified identity authentication node is the identity authentication node recognized by multiple cloud service nodes, when the second credential acquisition request carries the second token sent by the unified identity authentication node, the second credential management node determines that the target service node has been authenticated and its identity is legal based on the second token, and sends the second credential information to the target service node.

[0142] Step 603: The target service node receives the second credential information sent by the second credential management node, where the second credential information includes the access credential of the first application.

[0143] Step 604: The target service node accesses the first application based on the access credential of the first application.

[0144] In the above second case, the second credential management node can not only manage the business credentials of the customer, but also manage the access credentials of each cloud service node to the first application. The target service node does not need to store the access credentials of the first application in the cloud management platform. When accessing the first application, the target service node can obtain the access credentials of the first application from the second credential management node. In this way, the security of the application access credentials of each cloud service node in the cloud management platform is improved.

[0145] In some embodiments, the target service node can also actively host the access credentials of the first application that it needs to access in the second credential management node. Before performing the above step 601, the implementation process of the target service node hosting the application access credentials can be as follows: sending an identity authentication request to the unified identity authentication node based on the identity authentication credentials; receiving a third token sent by the unified identity authentication node, where the third token is sent by the unified identity authentication node when verifying the legal identity of the target service node based on the authentication identity credentials; sending a credential hosting request to the second credential management node, where the credential hosting request carries the third token and the access credentials of the first application, so that the second credential management node stores the access credentials of the first application.

[0146] In the third case, the cloud management platform further includes a plurality of business nodes, and the plurality of cloud service nodes further include a business hosting node. At this time, the target service node can be the business hosting node.

[0147] In this case, the business hosting node can be used to replace the customer to obtain the business credentials from the second credential management node, and the customer does not need to store any root credential information.

[0148] Please refer to Figure 7 , the implementation process of the target service node replacing the customer to obtain the business credentials can include the following steps.

[0149] Step 701: The target service node receives a third credential acquisition request sent by the target business node, where the target business node is the business node that deploys the target business of the customer among the plurality of business nodes.

[0150] Optionally, the third credential acquisition request carries the business identifier of the target business.

[0151] Step 702: In response to the third credential acquisition request, the target service node sends a fourth credential acquisition request to the second credential management node, where the fourth credential acquisition request is used to request the acquisition of the business credentials of the target business.

[0152] Since the business credentials of the customer are hosted on the second credential management node, and the business hosting node itself is a cloud service, it needs to perform identity verification before accessing the second credential management node, that is, it needs to perform identity verification in the unified identity authentication node first, so as to access the second credential management node based on the token provided by the unified identity authentication node.

[0153] In a possible implementation, the implementation process of step 702 can be as follows: The business hosting node sends a token acquisition request to the unified identity authentication node, and the token acquisition request carries the business identifier of the target business; receives the fourth token sent by the unified identity authentication node, and the fourth token is sent by the unified identity authentication node when it verifies that the target service node is a customer-trusted service node based on the business identifier; sends a fourth credential acquisition request to the second credential management node, and the fourth credential acquisition request carries the fourth token.

[0154] For the unified identity authentication node, when the customer performs identity authentication in the unified identity authentication node, the unified identity authentication node can authorize the business hosting node with the credential management right of its own target business in the unified identity authentication node, that is, mark the business hosting node as a trusted service node of the customer in the unified identity authentication node. When the business hosting node is a customer-trusted service node, if the business hosting node accesses the unified identity authentication node, the unified identity authentication node can send a fourth token to the business hosting node, so that the business hosting node can access the second credential management node on behalf of the customer to obtain the business credentials of the target business.

[0155] Step 703: The second credential management node receives the fourth credential acquisition request, and when confirming the legal identity of the target service node, sends third credential information to the target service node, and the third credential information includes the business credentials of the target business.

[0156] Receive the third credential information sent by the second credential management node, and the third credential information is sent by the second credential management node when it confirms the legal identity of the target service node, and the third credential information includes the business credentials of the target business.

[0157] Step 704: The target service node receives the third credential information and sends the third credential information to the target business node.

[0158] In the third case described above, when a target service node on the customer cloud needs to use the service credentials of the target service, the target service node obtains a token from the unified identity authentication node on behalf of the customer and accesses the second credential management node to obtain the service credentials of the target service and feedback them to the target service node. In this way, in the case where the target service node can obtain service credentials on behalf of the customer, the customer itself does not need to store service credentials or the identity authentication credentials for accessing the unified identity authentication node, further ensuring the security of the customer's own service credentials.

[0159] In the embodiment of the present application, for any cloud service node in the cloud management platform, its service credentials can be hosted in the first credential management node, and the first credential management node manages the service credentials of each cloud service node. Among them, each cloud service node corresponds to a service identity information. When the target service node among multiple cloud service nodes needs to use its own service credentials, it can send a service authentication request to the first credential management node based on its own service identity information. When the first credential management node verifies that the target service node is a legitimate cloud service node, it sends a first token to the target service node, so that the target service node can send a first credential acquisition request to the first credential management node based on the first token to obtain the service credentials of the target service node from the first credential management node. It can be seen that by setting up the first credential management node, a credential management service can be provided for multiple cloud service nodes, so that while the second credential management node provides a credential management service for the customer, the service credentials of the second credential management node can be managed through the first credential management node. In this way, the credential information of cloud service nodes and customers can be comprehensively managed, improving the credential management efficiency.

[0160] Based on the credential acquisition method shown in the above embodiments, the embodiment of the present application further provides a credential management system, which is applied to a cloud management platform. The cloud management platform includes a first credential management node and multiple cloud service nodes. The first credential management node is used to manage the first type of credentials, and the first type of credentials includes the service credentials of multiple cloud service nodes. The multiple cloud service nodes further include a second credential management node, and the second credential management node is used to manage the second type of credentials, and the second type of credentials includes the service credentials of customers.

[0161] In the credential management system provided by the embodiments of the present application, a target service node is configured to send a service authentication request to a first credential management node. The target service node is any one of multiple cloud service nodes, and the service authentication request carries the service identity information of the target service node. The first credential management node is configured to, in response to the service authentication request, send a first token to the target service node when verifying that the target service node is a legitimate cloud service node based on the service identity information. The target service node is further configured to send a first credential acquisition request to the first credential management node based on the first token. The first credential acquisition request is used to request the service credential of the target service node. The first credential management node is further configured to, in response to the first credential acquisition request, send first credential information to the target service node. The first credential information includes the service credential of the target service node.

[0162] Optionally, the target service node is any one of the multiple cloud service nodes except the second credential management node. The second type of credential further includes the access credential of a first application. The first application is provided by the cloud management platform to customers and can be accessed by the target service node.

[0163] Based on this, in the credential management system provided by the embodiments of the present application, the target service node is further configured to send a second credential acquisition request to the second credential management node based on the service credential. The second credential acquisition request is used to request the access credential of the first application. The second credential management node is configured to, in response to the second credential acquisition request, send second credential information to the target service node when confirming the legitimate identity of the target service node. The second credential information includes the access credential of the first application. The target service node is further configured to access the first application based on the access credential of the first application.

[0164] Optionally, the cloud management platform further includes a unified identity authentication node. The unified identity authentication node is configured to verify the legitimate identities of multiple cloud service nodes. The service credential of the target service node includes the identity authentication credential of the target service node.

[0165] Based on this, in the credential management system provided by the embodiments of the present application, the target service node is further configured to send an identity authentication request to the unified identity authentication node based on the identity authentication credential. The unified identity authentication node is configured to, in response to the identity authentication request, send a second token to the target service node when verifying the legitimate identity of the target service node based on the authentication identity credential. The target service node is further configured to send a second credential acquisition request to the second credential management node. The second credential acquisition request carries the second token.

[0166] Optionally, in this credential management system, the target service node is further configured to send an identity authentication request to the unified identity authentication node based on the identity authentication credential; the unified identity authentication node is further configured to, in response to the identity authentication request, send a third token to the target service node when verifying the legal identity of the target service node based on the authentication identity credential; the target service node is further configured to send a credential trusteeship request to the second credential management node, where the credential trusteeship request carries the third token and the access credential of the first application, so that the second credential management node stores the access credential of the first application.

[0167] Optionally, the cloud management platform further includes a plurality of service nodes, and the plurality of cloud service nodes further include service hosting nodes.

[0168] Based on this, in the credential management system provided in the embodiment of this application, if the target service node is a service hosting node, the target service node is further configured to receive a third credential acquisition request sent by the target service node, where the target service node is a service node that deploys the target service of the customer among the plurality of service nodes; the target service node is further configured to, in response to the third credential acquisition request, send a fourth credential acquisition request to the second credential management node, where the fourth credential acquisition request is used to request the acquisition of the service credential of the target service; the second credential management node is further configured to, in response to the fourth credential acquisition request, send third credential information to the target service node when confirming the legal identity of the target service node, where the third credential information includes the service credential of the target service; the target service node is further configured to send the third credential information to the target service node.

[0169] Optionally, the cloud management platform further includes a unified identity authentication node, and the unified identity authentication node is configured to verify the legal identities of the plurality of cloud service nodes.

[0170] Based on this, in the credential management system provided in the embodiment of this application, the target service node is further configured to send a token acquisition request to the unified identity authentication node, where the token acquisition request carries the service identifier of the target service; the unified identity authentication node is further configured to, in response to the token acquisition request, send a fourth token to the target service node when verifying that the target service node is a customer-trusted service node based on the service identifier; the target service node is further configured to send a fourth credential acquisition request to the second credential management node, and the fourth credential acquisition request carries the fourth token.

[0171] Optionally, in the credential management system provided in the embodiment of this application, the first type of credential further includes the access credential of the second application, where the second application is an application that is invisible to the customer in the cloud management platform but can be accessed by the target service node.

[0172] Optionally, in the credential management system provided by the embodiments of the present application, the first credential management node is further configured to: receive a service identity configuration request sent by a target service deployment device, where the service identity configuration request carries the device information of the target service deployment device, the service information of the target service node, and the node information; if it is determined that the target service deployment device is a trusted service deployment device based on the device information, generate service identity information of the target service node based on the service information and the node information; and send the service identity information to the target service deployment device, so that the target service deployment device configures the service identity information in the target service node.

[0173] It should be noted that the credential management system provided in the above embodiments and the embodiments of the credential acquisition method belong to the same concept. For the specific implementation process, please refer to the above method embodiments, which will not be elaborated here.

[0174] To facilitate understanding of the credential management system and the credential acquisition method provided by the embodiments of the present application, the overall implementation logic of the credential management solution provided by the embodiments of the present application will be exemplarily described below.

[0175] As described above, the cloud management platform includes a first credential management node, a second credential management node, a unified identity authentication node, and a target service node. Here, the target service node refers to the cloud service nodes other than the second credential management node among the multiple cloud service nodes included in the cloud management platform.

[0176] See Figure 8 , the credential administrator of the cloud management platform (or the administrator of the first credential management node) adds the service deployment devices inside the cloud management platform to the access whitelist in the first credential management node, so that the service deployment devices can access the first credential management node, apply for service identity information on behalf of the cloud service nodes, and pre-set the service identity information to the cloud service nodes when deploying services.

[0177] In some embodiments, the first credential management node is used to manage the first type of credentials, which includes service credentials of multiple cloud service nodes and access credentials of a second application. The second application is an application that is not visible to customers in the cloud management platform but can be accessed by the target service node.

[0178] Among them, the second application can also be called an internal application, which refers to an application that is not visible on the tenant side.

[0179] Based on this, the administrators of the cloud service nodes and the second application can enter the management accounts of the cloud services and the credential information of the internal application into the first credential management node for easy hosting and rotation. When needed, the cloud service nodes can directly call the API interface of the first credential management node through the configured service identity information to obtain the credentials from the first credential management node, instead of directly storing the credentials.

[0180] In some embodiments, the second credential management node is used to manage the second type of credentials, which includes the business credentials of the customer and the access credentials of the first application. The first application is provided by the cloud management platform to the customer and can be accessed by the target service node.

[0181] Among them, the first application can also be referred to as an external application, which refers to an application visible on the tenant side.

[0182] Based on this, the customer can enter their credential information into the second credential management node for hosting and rotation. When needed, after authentication through the unified identity authentication node on the cloud, the customer can access the second credential management node to obtain the hosted credentials from the second credential management node, without having to keep the credential information by themselves.

[0183] Optionally, during the process of managing credentials, the first credential management node and the second credential management node can also regularly update the credentials they host to the credential source (i.e., the service node and application that generate the credentials) to complete the full automation rotation of the credentials. In this way, not only can the credentials be managed, but also rotated and updated, thus ensuring the security of the credential information.

[0184] Next, in combination with Figure 9 , for Figure 8 , an exemplary description of the interaction process between the target service node, the first credential management node, the second credential management node, and the unified identity authentication node will be given.

[0185] See Figure 9 , when the target service node is a cloud service node other than the second credential management node among the multiple cloud service nodes included in the cloud management platform, the credential acquisition method of the embodiments of the present application includes the following steps:

[0186] Step 901: Add the service deployment device to the trusted white list of the first credential management node.

[0187] Among them, the trusted white list can specifically be a trusted device list, which is used to store the device information of the service deployment devices trusted by the first credential management node.

[0188] Step 902: When the service deployment device deploys the target service node, it sends a service identity configuration request to the first credential management node on behalf of the target service node, requesting the first credential management node to configure service identity information for the target service node.

[0189] Among them, the service identity configuration request carries service information and node information.

[0190] Step 903: If it is determined based on the device information that the target service deployment device is a trusted service deployment device, the first credential management node generates service identity information for the target service node based on the service information and node information, and sends the service identity information of the target service node to the service deployment device.

[0191] Step 904: The service deployment device configures the service identity information in the target service node.

[0192] It should be understood that the above steps 902 - 904 are the implementation process of configuring the service identity information of the target service node. For its implementation details, reference can also be made to the relevant content in the previous Figure 5 embodiment, which will not be elaborated here.

[0193] Step 905: The target service node obtains its own service credential from the first credential management node based on the service identity information.

[0194] Step 906: The first credential management node performs identity authentication on the target service node based on the service identity information. When verifying that the target service node is a legitimate cloud service node, it returns the service credential to the target service node.

[0195] It should be understood that steps 905 and 906 are the implementation process for the target service node to obtain the service credential from the first credential node, and it is the same as the content in the previous Figure 4 embodiment. Therefore, for its specific implementation details, reference can be made to the content of steps 401 - 405 in the previous text, which will not be elaborated here.

[0196] Among them, the service credential of the target service node includes an identity authentication credential.

[0197] Step 907: The target service node obtains a token from the unified identity authentication node based on the identity authentication credential.

[0198] Step 908: When the unified identity authentication node verifies that the identity of the target service node passes based on the identity authentication credential, it returns the token to the target service node.

[0199] Step 909: The target service node accesses the second credential management node based on the token to request the access credential of the first application.

[0200] Step 910: The second credential management node returns the access credential of the first application to the target service node.

[0201] Step 911: The target service node accesses the first application based on the access credential of the first application.

[0202] It should be noted that steps 907 - step 11 are the implementation process for the target service node to obtain the access credentials of the first application from the second credential node to access the first application, which is the same as the content in the Figure 6 embodiment above. Therefore, for the specific implementation details thereof, reference can be made to the content of steps 601 - step 604 in the previous text, which will not be elaborated here.

[0203] In some embodiments, as Figure 8 shown, the cloud services of the customer can also be in the form of delegation. The business hosting node can obtain a temporary token on its behalf from the unified identity authentication node, and use the temporary token to obtain the hosted business credentials from the second credential management node, so as to achieve the cloud-native security state where no sensitive credentials need to be built in for the cloud services.

[0204] Among them, for the specific implementation process of the business hosting node obtaining the business credentials on behalf of, reference can be made to the relevant content of the Figure 7 embodiment above, which will not be elaborated here.

[0205] Figure 10 FIG. is a schematic structural diagram of a credential acquisition device provided by an embodiment of the present application. The credential acquisition device can be implemented by software, hardware, or a combination of both to form part or all of the target service node. As described above, among the multiple cloud service nodes included in the cloud management platform, the target service node, the cloud management platform further includes a first credential management node for managing the first type of credentials, the first type of credentials including the service credentials of multiple cloud service nodes, and the multiple cloud service nodes further include a second credential management node for managing the second type of credentials, the second type of credentials including the business credentials of the customer. As Figure 10 shown, the credential acquisition device 1000 includes: a first authentication module 1001, a first credential request module 1002, and a first credential acquisition module 1003.

[0206] The first authentication module 1001 is configured to send a service authentication request to the first credential management node, the service authentication request carrying the service identity information of the target service node, and the target service node being any one of the multiple cloud service nodes;

[0207] The first authentication module 1001 is further configured to receive a first token sent by the first credential management node, the first token being sent by the first credential management node when verifying that the target service node is a legitimate cloud service node based on the service identity information;

[0208] The first credential request module 1002 is configured to send a first credential acquisition request to the first credential management node based on the first token, the first credential acquisition request being used to request to obtain the service credentials of the target service node;

[0209] The first credential acquisition module 1003 is configured to receive the first credential information sent by the first credential management node, where the first credential information includes the service credential of the target service node.

[0210] Optionally, the target service node is any one of the multiple cloud service nodes except the second credential management node. The second type of credential further includes the access credential of the first application, where the first application is an application provided by the cloud management platform to the customer and accessible by the target service node. The credential acquisition device 1000 further includes:

[0211] The second credential request module is configured to send a second credential acquisition request to the second credential management node based on the service credential of the target service node, where the second credential acquisition request is used to request the access credential of the first application;

[0212] The second credential acquisition module is configured to receive the second credential information sent by the second credential management node, where the second credential information is sent when the second credential management node confirms the legal identity of the target service node, and the second credential information includes the access credential of the first application;

[0213] The resource access module is configured to access the first application based on the access credential of the first application.

[0214] Optionally, the cloud management platform further includes a unified identity authentication node, where the unified identity authentication node is configured to verify the legal identities of the multiple cloud service nodes, and the service credential of the target service node includes the identity authentication credential of the target service node;

[0215] The second credential request module is specifically configured to:

[0216] Send an identity authentication request to the unified identity authentication node based on the identity authentication credential;

[0217] Receive the second token sent by the unified identity authentication node, where the second token is sent when the unified identity authentication node verifies the legal identity of the target service node based on the authentication identity credential;

[0218] Send a second credential acquisition request to the second credential management node, where the second credential acquisition request carries the second token.

[0219] Optionally, the credential acquisition device 1000 further includes:

[0220] The second authentication module is configured to send an identity authentication request to the unified identity authentication node based on the identity authentication credential;

[0221] The second authentication module is further configured to receive the third token sent by the unified identity authentication node, where the third token is sent when the unified identity authentication node verifies the legal identity of the target service node based on the authentication identity credential;

[0222] A credential hosting module, configured to send a credential hosting request to a second credential management node, where the credential hosting request carries a third token and an access credential of a first application, so that the second credential management node stores the access credential of the first application.

[0223] Optionally, the cloud management platform further includes a plurality of service nodes, and the plurality of cloud service nodes further include a service hosting node; the credential acquisition device 1000 further includes:

[0224] A receiving module, configured to, if the target service node is a service hosting node, receive a service credential acquisition request sent by the target service node, where the target service node is a service node in the plurality of service nodes that deploys a target service of a customer, and the service credential acquisition request carries a service identifier of the target service;

[0225] A third credential request module, configured to, in response to the service credential acquisition request, send a third credential acquisition request to the second credential management node, where the third credential acquisition request is used to request to acquire the service credential of the target service;

[0226] A third credential acquisition module, configured to receive third credential information sent by the second credential management node, where the third credential information is sent by the second credential management node when confirming the legal identity of the target service node, and the third credential information includes the service credential of the target service;

[0227] A sending module, configured to send the third credential information to the target service node.

[0228] Optionally, the cloud management platform further includes a unified identity authentication node, and the unified identity authentication node is configured to verify the legal identities of the plurality of cloud service nodes;

[0229] The third credential request module is specifically configured to:

[0230] Send a token acquisition request to the unified identity authentication node, where the token acquisition request carries the service identifier of the target service;

[0231] Receive a fourth token sent by the unified identity authentication node, where the fourth token is sent by the unified identity authentication node when verifying that the target service node is a customer-trusted service node based on the service identifier;

[0232] Send a third credential acquisition request to the second credential management node, where the third credential acquisition request carries the fourth token.

[0233] Optionally, the first type of credential further includes an access credential of a second application, where the second application is an application that is invisible to the customer in the cloud management platform but can be accessed by the target service node.

[0234] In the above-mentioned credential acquisition device 1000, the first authentication module, the first credential request module, and the first credential acquisition module can all be implemented by software or by hardware. Exemplarily, next, taking the first authentication module as an example, the implementation manner of the first authentication module will be introduced. Similarly, the implementation manners of the first credential request module and the first credential acquisition module can refer to the implementation manner of the first authentication module.

[0235] Taking the module as an example of a software functional unit, the first authentication module may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the first authentication module may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers for running this code may be distributed in the same region or in different regions. Further, the multiple hosts / virtual machines / containers for running this code may be distributed in the same availability zone (AZ) or in different AZs, and each AZ includes one data center or multiple geographically proximate data centers. Among them, generally one region may include multiple AZs.

[0236] Similarly, the multiple hosts / virtual machines / containers for running this code may be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Among them, generally one VPC is set within one region. For cross-region communication between two VPCs within the same region and between VPCs in different regions, a communication gateway needs to be set in each VPC, and the interconnection between VPCs is realized through the communication gateway.

[0237] Taking the module as an example of a hardware functional unit, the first authentication module may include at least one computing device, such as a server, etc. Or, the A module may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). Among them, the above-mentioned PLD may be implemented by a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0238] The multiple computing devices included in the first authentication module can be distributed in the same region or in different regions. The multiple computing devices included in the first authentication module can be distributed in the same availability zone (AZ) or in different AZs. Similarly, the multiple computing devices included in the first authentication module can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Among them, the multiple computing devices can be any combination of computing devices such as servers, application-specific integrated circuits (ASICs), programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), and generic array logic (GALs).

[0239] It should be noted that in other embodiments, the first authentication module can be used to execute any step in the credential acquisition method, the first credential request module can be used to execute any step in the credential acquisition method, and the first credential acquisition module can be used to execute any step in the credential acquisition method. The steps to be implemented by the first authentication module, the first credential request module, and the first credential acquisition module can be specified as needed. By implementing different steps in the credential acquisition method through the first authentication module, the first credential request module, and the first credential acquisition module respectively, all functions of the credential acquisition apparatus 1000 can be realized.

[0240] In the embodiments of the present application, for any cloud service node in the cloud management platform, its service credential can be hosted in the first credential management node, and the first credential management node manages the service credentials of each cloud service node. Among them, each cloud service node corresponds to a service identity information. When the target service node among multiple cloud service nodes needs to use its own service credential, it can send a service authentication request to the first credential management node based on its own service identity information. When the first credential management node verifies that the target service node is a legitimate cloud service node, it sends a first token to the target service node, so that the target service node can send a first credential acquisition request to the first credential management node based on the first token to obtain the service credential of the target service node from the first credential management node.

[0241] It can be seen that by setting the first credential management node, a credential management service can be provided for multiple cloud service nodes, so that while the second credential management node provides a credential management service for customers, the service credential of the second credential management node can be managed through the first credential management node. In this way, the credential information of cloud service nodes and customers can be comprehensively managed, improving the credential management efficiency.

[0242] It should be noted that: when the credential acquisition device provided in the above embodiment acquires the service credential of the target service node from the first credential management node, only the division of the above functional modules is used for illustration. In actual applications, the above functions can be allocated to different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the credential acquisition device provided in the above embodiment and the embodiment of the credential acquisition method belong to the same concept. For the specific implementation process, please refer to the method embodiment, which will not be elaborated here.

[0243] Figure 11 FIG. 4 is a schematic structural diagram of another credential acquisition device provided by an embodiment of the present application. The credential acquisition device is included in a first credential management node included in a cloud management platform. The cloud management platform further includes a plurality of cloud service nodes. The first credential management node is used to manage first-class credentials, and the first-class credentials include service credentials of a plurality of cloud service nodes. The plurality of cloud service nodes further include a second credential management node, and the second credential management node is used to manage second-class credentials, and the second-class credentials include business credentials of customers. As Figure 11 shown, the credential acquisition device 1100 includes: a first receiving module 1101, a service authentication module 1102, and a first sending module 1103.

[0244] The first receiving module 1101 is configured to receive a service authentication request sent by a target service node. The service authentication request carries service identity information of the target service node, and the target service node is any one of the plurality of cloud service nodes;

[0245] The service authentication module 1102 is configured to, in response to the service authentication request, send a first token to the target service node when verifying that the target service node is a legitimate cloud service node based on the service identity information;

[0246] The above first receiving module 1101 is further configured to receive a first credential acquisition request sent by the target service node, and the first credential acquisition request carries the first token;

[0247] The first sending module 1103 is configured to, in response to the first credential acquisition request, send first credential information to the target service node, and the first credential information includes the service credential of the target service node.

[0248] Optionally, the credential acquisition device 1100 further includes:

[0249] A second receiving module, configured to receive a service identity configuration request sent by a target service deployment device, where the service identity configuration request carries device information of the target deployment device, service information of the target service node, and node information;

[0250] An identity configuration module, configured to generate service identity information of a target service node based on service information and node information if it is determined, based on device information, that a target service deployment device is a trusted service deployment device;

[0251] A second sending module, configured to send the service identity information to the target service deployment device, so that the target service deployment device configures the service identity information in the target service node.

[0252] In an embodiment of the present application, for any cloud service node in a cloud management platform, its service credentials can be hosted in a first credential management node, and the first credential management node manages the service credentials of each cloud service node. Each cloud service node corresponds to a service identity information. After the cloud service node sends a service authentication request to the first credential management node based on its own service identity information, the first credential management node sends a first token to the target service node when verifying that the target service node is a legal cloud service node, so that the target service node can send a first credential acquisition request to the first credential management node based on the first token to acquire the service credentials of the target service node from the first credential management node. It can be seen that by setting the first credential management node, credential management services can be provided for multiple cloud service nodes, so that while the second credential management node provides credential management services for customers, the service credentials of the second credential management node can be managed by the first credential management node. In this way, the credential information of cloud service nodes and customers can be comprehensively managed, improving the credential management efficiency.

[0253] It should be noted that: when the credential acquisition device provided in the above embodiment authenticates the service identity information of the cloud service node and feeds back the service credentials, only the above-mentioned division of each functional module is used for illustration. In practical applications, the above functions can be assigned to different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the credential acquisition device provided in the above embodiment and the embodiment of the credential acquisition method belong to the same concept, and the specific implementation process is detailed in the above method embodiment, which will not be repeated here.

[0254] In the above device embodiment, the first receiving module, the service authentication module, and the first sending module can all be implemented by software or by hardware. The implementation manners of each module can refer to the relevant introductions in the previous Figure 10 embodiments and will not be repeated here.

[0255] The present application also provides a computing device, such as Figure 12As shown, the computing device 100 includes: a bus 102, a processor 104, a memory 106, and a communication interface 108. Among them, the processor 104, the memory 106, and the communication interface 108 communicate with each other through the bus 102. The computing device 100 can be a server or a terminal. It should be understood that the present application does not limit the number of processors and memories in the computing device 100.

[0256] The bus 102 can be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the sake of convenience of representation, Figure 12 only one line is used to represent it in the figure, but it does not mean that there is only one bus or one type of bus. The bus 104 can include a path for transmitting information between various components of the computing device 100 (for example, the memory 106, the processor 104, and the communication interface 108).

[0257] The processor 104 can include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0258] The memory 106 can include volatile memory, such as random access memory (RAM). The processor 104 can also include non-volatile memory, such as read-only memory (ROM), flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0259] The memory 106 stores executable program codes. The processor 104 executes the executable program codes to respectively implement the functions of the foregoing first authentication module, first credential request module, and first credential acquisition module, thereby implementing the credential acquisition method executed by the foregoing target service node. That is, the memory 106 stores instructions for executing the credential acquisition method corresponding to the foregoing target service node.

[0260] Alternatively, executable code is stored in the memory 106, and the processor 104 executes the executable code to respectively implement the functions of the foregoing first receiving module, service authentication module, and first sending module, thereby implementing the credential acquisition method executed by the foregoing first credential management node. That is, instructions for executing the credential acquisition method corresponding to the foregoing first credential management node are stored on the memory 106.

[0261] The communication interface 103 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 100 and other devices or communication networks.

[0262] The embodiment of the present application further provides a computing device cluster, which includes at least one computing device. The computing device may be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device may also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.

[0263] As Figure 13 shown, the computing device cluster includes at least one computing device 100. Instructions for executing the credential acquisition method may be stored in the memory 106 of one or more of the computing devices 100 in the computing device cluster.

[0264] In some possible implementation manners, partial instructions for executing the credential acquisition method may also be respectively stored in the memory 106 of one or more of the computing devices 100 in the computing device cluster. In other words, a combination of one or more computing devices 100 may jointly execute the instructions for executing the credential acquisition method.

[0265] It should be noted that the memories 106 in different computing devices 100 in the computing device cluster may store different instructions, which are respectively used to execute partial functions of the credential acquisition device. Taking the instructions stored in the memory 106 for executing partial functions of the foregoing credential acquisition device 1000 as an example, the instructions stored in the memories 106 of different computing devices 100 may implement the functions of one or more of the first authentication module, the first credential request module, and the first credential acquisition module.

[0266] In some possible implementation manners, one or more computing devices in the computing device cluster may be connected through a network. Among them, the network may be a wide area network or a local area network, etc. Figure 14 shows a possible implementation manner. As Figure 14As shown, two computing devices 100A and 100B are connected via a network. Specifically, they are connected to the network through the communication interfaces in each computing device. In this type of possible implementation, the memory 106 in computing device 100A stores instructions for executing the functions of the first authentication module. At the same time, the memory 106 in computing device 100B stores instructions for executing the functions of the first credential request module and the first credential acquisition module.

[0267] Figure 14 The connection method between the computing device clusters shown can be considered. Since the credential management method provided in this application needs to manage the service credentials of cloud service nodes, the first credential management node not only needs to authenticate the cloud service nodes, but also needs to respond to the requests of the cloud service nodes and feedback their service credentials when the authentication is passed. Therefore, it is considered to hand over the functions of the first authentication module involved in the authentication process to computing device 100A for execution, and hand over the functions implemented by the first credential request module and the first credential acquisition module to computing device 100B for execution, so as to deploy the service authentication function and the service credential management function on different computing devices.

[0268] It should be understood that Figure 14 the functions of computing device 100A shown in can also be completed by multiple computing devices 100. Similarly, the functions of computing device 100B can also be completed by multiple computing devices 100.

[0269] The embodiments of this application also provide another computing device cluster. The connection relationship between the computing devices in this computing device cluster can be similarly referred to Figure 13 and Figure 14 the connection method of the described computing device cluster. The difference is that the memory 106 in one or more computing devices 100 in this computing device cluster can store the same instructions for executing the credential acquisition method executed by the above-mentioned target service node.

[0270] In some possible implementation manners, the memory 106 in one or more computing devices 100 in this computing device cluster can also respectively store partial instructions for executing the credential acquisition method executed by the above-mentioned target service node. In other words, a combination of one or more computing devices 100 can jointly execute the instructions for executing the credential acquisition method executed by the above-mentioned target service node.

[0271] It should be noted that the memories 106 in different computing devices 100 in the computing device cluster can store different instructions for executing partial functions of the credential management system. That is, the instructions stored in the memories 106 in different computing devices 100 can implement the functions of one or more of the credential management device 1000 and the credential acquisition device 11000.

[0272] In addition, what is provided by the embodiments of the present application Figures 12 - 14 Only by way of example, the memory 106 includes a first authentication module, a first credential request module, and a first credential acquisition module, which does not constitute a limitation on the instructions that can be stored in the memory 106. That is, Figures 12 - 14 The memory 106 shown may also include a first receiving module, a service authentication module, and a first sending module, and the embodiments of the present application do not limit this.

[0273] The embodiments of the present application also provide a computer-readable storage medium. The computer-readable storage medium may be any available medium that a computing device can store or a data storage device such as a data center that includes one or more available media. The available medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid-state drive), etc. The computer-readable storage medium includes instructions that direct the computing device to perform the steps of the credential acquisition method shown in the above embodiments.

[0274] The embodiments of the present application also provide a computer program product containing instructions. The computer program product may be software or a program product that contains instructions and can run on a computing device or be stored in any available medium. When the computer program product runs on at least one computing device, at least one computing device is caused to perform the steps of the credential acquisition method shown in the above embodiments.

[0275] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, computer, server, or data center to another website, computer, server, or data center in a wired manner (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or a wireless manner (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer, or a data storage device such as a server or data center that includes one or more integrated available media. The available media can be magnetic media (such as floppy disks, hard disks, magnetic tapes), optical media (such as digital versatile discs (DVDs)), or semiconductor media (such as solid state disks (SSDs)), etc. It should be noted that the computer-readable storage medium mentioned in the embodiments of the present application can be a non-volatile storage medium, in other words, a non-transitory storage medium.

[0276] It should be understood that the "plurality" mentioned herein refers to two or more. In the description of the embodiments of the present application, unless otherwise specified, " / " means "or". For example, A / B can mean A or B; the "and / or" herein is merely a description of the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, in order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, terms such as "first" and "second" are used to distinguish the same items or similar items with basically the same functions and effects. Those skilled in the art can understand that the terms "first" and "second" do not limit the quantity and execution order, and the terms "first" and "second" do not necessarily mean different.

[0277] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data for analysis, stored data, displayed data, etc.), and signals involved in the embodiments of this application are all authorized by the user or fully authorized by all parties, and the collection, use, and processing of relevant data need to comply with the relevant laws, regulations, and standards of relevant countries and regions.

[0278] The above are the embodiments provided by this application, which are not intended to limit this application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of this application shall be included within the protection scope of this application.

Claims

1. A credential management system, characterized in that: Applied in a cloud management platform, the cloud management platform includes a first credential management node and multiple cloud service nodes, the first credential management node is used to manage a first type of credentials, the first type of credentials includes service credentials of the multiple cloud service nodes, the multiple cloud service nodes also include a second credential management node, the second credential management node is used to manage a second type of credentials, the second type of credentials includes the customer's business credentials; A target service node, used to send a service authentication request to the first credential management node, wherein the target service node is any one of the multiple cloud service nodes, and the service authentication request carries service identity information of the target service node; The first credential management node is configured to, in response to the service authentication request, send a first token to the target service node when the target service node is verified to be a legitimate cloud service node based on the service identity information; The target service node is further used to send a first credential acquisition request to a first credential management node based on the first token, where the first credential acquisition request is used to request to acquire the service credential of the target service node; The first credential management node is further used to send first credential information to the target service node in response to the first credential acquisition request, where the first credential information includes the service credentials of the target service node.

2. The system according to claim 1, characterized in that The target service node is any one of the multiple cloud service nodes except the second credential management node, the second type of credentials also includes access credentials of a first application, the first application is an application provided by the cloud management platform to the customer and accessible by the target service node; The target service node is further used to send a second credential acquisition request to the second credential management node based on the service credential, where the second credential acquisition request is used to request to obtain the access credential of the first application; The second credential management node is configured to send second credential information to the target service node in response to the second credential acquisition request and upon confirming the legal identity of the target service node, wherein the second credential information includes the access credential of the first application; The target service node is further used to access the first application based on the access credentials of the first application.

3. The system according to claim 2, characterized in that The cloud management platform further includes a unified identity authentication node, the unified identity authentication node is used to verify the legal identities of the multiple cloud service nodes, and the service credentials of the target service node include the identity authentication credentials of the target service node; The target service node is further configured to send an identity authentication request to the unified identity authentication node based on the identity authentication credential; The unified identity authentication node is configured to send a second token to the target service node in response to the identity authentication request, while verifying the legal identity of the target service node based on the authentication identity credential; The target service node is further used to send the second credential acquisition request to the second credential management node, where the second credential acquisition request carries the second token.

4. The system according to claim 3, characterized in that The target service node is further configured to send an identity authentication request to the unified identity authentication node based on the identity authentication credential; The unified identity authentication node is further configured to, in response to the identity authentication request, send a third token to the target service node when verifying the legal identity of the target service node based on the authentication identity credential; The target service node is also used to send a credential hosting request to the second credential management node, where the credential hosting request carries the third token and the access credentials of the first application, so that the second credential management node stores the access credentials of the first application.

5. The system according to claim 1, characterized in that The cloud management platform also includes a plurality of business nodes, and the plurality of cloud service nodes also include a business hosting node; If the target service node is the business hosting node, the target service node is further used to receive a third credential acquisition request sent by a target business node, where the target business node is a business node among the multiple business nodes where the target business of the customer is deployed; The target service node is further configured to send a fourth credential acquisition request to the second credential management node in response to the third credential acquisition request, wherein the fourth credential acquisition request is used to request to acquire the service credential of the target service; The second credential management node is further configured to, in response to the fourth credential acquisition request, send third credential information to the target service node when confirming the legal identity of the target service node, wherein the third credential information includes the service credential of the target service; The target service node is further configured to send the third credential information to the target service node.

6. The system according to claim 5, characterized in that The cloud management platform also includes a unified identity authentication node, which is used to verify the legal identities of the multiple cloud service nodes; The target service node is further configured to send a token acquisition request to the unified identity authentication node, wherein the token acquisition request carries a service identifier of the target service; The unified identity authentication node is further configured to respond to the token acquisition request and, if the target service node is verified as the customer trusted service node based on the business identifier, send a fourth token to the target service node; The target service node is further used to send the fourth credential acquisition request to the second credential management node, and the fourth credential acquisition request carries the fourth token.

7. The system according to any one of claims 1 to 6, characterized in that: The first type of credentials also includes access credentials for a second application, where the second application is an application that is invisible to the customer in the cloud management platform but accessible to the target service node.

8. The system according to any one of claims 1 to 7, characterized in that: The first credential management node is also used to: Receive a service identity configuration request sent by a target service deployment device, wherein the service identity configuration request carries device information of the target service deployment device, service information and node information of the target service node; If it is determined based on the device information that the target service deployment device is a trusted service deployment device, then generating service identity information of the target service node based on the service information and the node information; The service identity information is sent to the target service deployment device, so that the target service deployment device configures the service identity information in the target service node.

9. A method for obtaining credentials, characterized in that: The method is applied to a target service node among a plurality of cloud service nodes included in a cloud management platform, wherein the cloud management platform further includes a first credential management node, the first credential management node is used to manage a first type of credentials, the first type of credentials includes service credentials of the plurality of cloud service nodes, the plurality of cloud service nodes further include a second credential management node, the second credential management node is used to manage a second type of credentials, the second type of credentials includes business credentials of customers; the method includes: Sending a service authentication request to the first credential management node, the service authentication request carrying the service identity information of the target service node, the target service node being any one of the multiple cloud service nodes; Receive a first token sent by the first credential management node, where the first token is sent when the first credential management node verifies that the target service node is a legitimate cloud service node based on the service identity information; Based on the first token, send a first credential acquisition request to the first credential management node, where the first credential acquisition request is used to request to acquire the service credential of the target service node; Receive first credential information sent by the first credential management node, where the first credential information includes service credentials of the target service node.

10. The method according to claim 9, characterized in that The target service node is any one of the multiple cloud service nodes except the second credential management node, the second type of credential also includes access credentials of a first application, the first application is an application provided by the cloud management platform to the customer and accessible by the target service node, and the method further includes: Based on the service credential of the target service node, sending a second credential acquisition request to the second credential management node, where the second credential acquisition request is used to request to obtain the access credential of the first application; Receive second credential information sent by the second credential management node, where the second credential information is sent when the second credential management node confirms the legal identity of the target service node, and the second credential information includes access credentials of the first application; The first application is accessed based on the access credentials of the first application.

11. The method according to claim 10, characterized in that The cloud management platform further includes a unified identity authentication node, the unified identity authentication node is used to verify the legal identities of the multiple cloud service nodes, and the service credentials of the target service node include the identity authentication credentials of the target service node; The sending a second credential acquisition request to the second credential management node based on the service credential of the target service node includes: Based on the identity authentication credentials, sending an identity authentication request to the unified identity authentication node; receiving a second token sent by the unified identity authentication node, where the second token is sent by the unified identity authentication node when verifying the legal identity of the target service node based on the authentication identity credential; Send the second credential acquisition request to the second credential management node, where the second credential acquisition request carries the second token.

12. The method according to claim 11, characterized in that Before sending the second credential acquisition request to the second credential management node based on the service credential of the target service node, the method further includes: Based on the identity authentication credentials, sending an identity authentication request to the unified identity authentication node; Receiving a third token sent by the unified identity authentication node, where the third token is sent by the unified identity authentication node when verifying the legal identity of the target service node based on the authentication identity credential; A credential escrow request is sent to the second credential management node, where the credential escrow request carries the third token and the access credentials of the first application, so that the second credential management node stores the access credentials of the first application.

13. The method according to claim 9, characterized in that The cloud management platform further includes a plurality of business nodes, and the plurality of cloud service nodes further include a business hosting node; the method further includes: If the target service node is the business hosting node, receiving a third credential acquisition request sent by a target business node, the target business node being a business node where the target business of the customer is deployed among the multiple business nodes; In response to the third credential acquisition request, sending a fourth credential acquisition request to the second credential management node, wherein the fourth credential acquisition request is used to request to obtain the service credential of the target service; Receive third credential information sent by the second credential management node, where the third credential information is sent when the second credential management node confirms the legal identity of the target service node, and the third credential information includes the business credentials of the target business; The third credential information is sent to the target service node.

14. The method according to claim 13, characterized in that The cloud management platform also includes a unified identity authentication node, which is used to verify the legal identities of the multiple cloud service nodes; The sending a fourth credential acquisition request to the second credential management node includes: Sending a token acquisition request to the unified identity authentication node, wherein the token acquisition request carries the service identifier of the target service; receiving a fourth token sent by the unified identity authentication node, where the fourth token is sent by the unified identity authentication node when verifying that the target service node is the customer-trusted service node based on the service identifier; A fourth credential acquisition request is sent to the second credential management node, wherein the fourth credential acquisition request carries the fourth token.

15. The method according to any one of claims 9 to 14, characterized in that: The first type of credentials also includes access credentials for a second application, where the second application is an application that is invisible to the customer in the cloud management platform but accessible to the target service node.

16. A method for obtaining credentials, characterized in that: A first credential management node is applied to a cloud management platform, the cloud management platform further includes multiple cloud service nodes, the first credential management node is used to manage a first type of credentials, the first type of credentials includes service credentials of the multiple cloud service nodes, the multiple cloud service nodes further include a second credential management node, the second credential management node is used to manage a second type of credentials, the second type of credentials includes the business credentials of the customer; the method includes: Receive a service authentication request sent by a target service node, where the service authentication request carries service identity information of the target service node, and the target service node is any one of the multiple cloud service nodes; In response to the service authentication request, sending a first token to the target service node when verifying that the target service node is a legitimate cloud service node based on the service identity information; Receive a first credential acquisition request sent by the target service node, where the first credential acquisition request carries the first token; In response to the first credential acquisition request, first credential information is sent to the target service node, where the first credential information includes service credentials of the target service node.

17. The method according to claim 16, characterized in that The method further comprises: Receive a service identity configuration request sent by a target service deployment device, wherein the service identity configuration request carries device information of the target service deployment device, service information and node information of the target service node; If it is determined based on the device information that the target service deployment device is a trusted service deployment device, then generating service identity information of the target service node based on the service information and the node information; The service identity information is sent to the target service deployment device, so that the target service deployment device configures the service identity information in the target service node.

18. A credential acquisition device, characterized in that: A target service node included in a plurality of cloud service nodes included in a cloud management platform, wherein the cloud management platform further includes a first credential management node, the first credential management node is used to manage a first type of credentials, the first type of credentials includes service credentials of the plurality of cloud service nodes, the plurality of cloud service nodes further include a second credential management node, the second credential management node is used to manage a second type of credentials, the second type of credentials includes business credentials of customers; the device includes: A first authentication module, configured to send a service authentication request to the first credential management node, wherein the service authentication request carries the service identity information of the target service node, and the target service node is any one of the multiple cloud service nodes; The first authentication module is further used to receive a first token sent by the first credential management node, where the first token is sent by the first credential management node when verifying that the target service node is a legitimate cloud service node based on the service identity information; A first credential request module, configured to send a first credential acquisition request to the first credential management node based on the first token, wherein the first credential acquisition request is used to request to acquire the service credential of the target service node; The first credential acquisition module is used to receive first credential information sent by the first credential management node, where the first credential information includes the service credential of the target service node.

19. A credential acquisition device, characterized in that: A first credential management node included in a cloud management platform, the cloud management platform further includes a plurality of cloud service nodes, the first credential management node is used to manage a first type of credentials, the first type of credentials includes service credentials of the plurality of cloud service nodes, the plurality of cloud service nodes further include a second credential management node, the second credential management node is used to manage a second type of credentials, the second type of credentials includes business credentials of customers; the device includes: A first receiving module is used to receive a service authentication request sent by a target service node, wherein the service authentication request carries service identity information of the target service node, and the target service node is any one of the multiple cloud service nodes; A service authentication module, configured to respond to the service authentication request and send a first token to the target service node if the target service node is verified to be a legitimate cloud service node based on the service identity information; The first receiving module is further configured to receive a first credential acquisition request sent by the target service node, where the first credential acquisition request carries the first token; The first sending module is used to send first credential information to the target service node in response to the first credential acquisition request, where the first credential information includes the service credential of the target service node.

20. A computing device cluster, characterized in that: The computing device cluster includes at least one computing device, each of which includes a processor and a memory; The processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster performs the steps of the credential acquisition method described in any one of claims 9-15, or the steps of the credential acquisition method described in any one of claims 16-17.

21. A computer-readable storage medium, characterized in that: It includes computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the steps of the credential acquisition method described in any one of claims 9 to 15, or the steps of the credential acquisition method described in any one of claims 16 to 17.

22. A computer program product comprising instructions, characterized in that When the instruction is executed by a computing device cluster, the computing device cluster executes the steps of the credential acquisition method described in any one of claims 9 to 15, or the steps of the credential acquisition method described in any one of claims 16 to 17.

Images