An identity authentication middleware applied to a PaaS platform

Abstract

The application relates to an identity authentication middleware applied to a PaaS platform, belonging to the field of data processing, and comprising the following: a user interface used for providing a user with interfaces for task creation, data uploading and application configuration; an identity authentication module used for authenticating the identity of a user based on a bilinear pairing technology; an application program interface server used for receiving an API request of the user; an orchestrator used for screening a user request initiated by the user who passes the identity authentication, and determining a resource scheduling scheme for each user request; a workflow engine used for converting the resource scheduling scheme into a workflow; an execution adapter used for converting a task description in the workflow into a specific job command; an application directory module used for storing all scientific applications and parameter templates supported by the PaaS platform; a credential management module used for managing the keys of the user and a cloud service provider; and a message system used for asynchronous communication between various components in the identity authentication middleware.

Description

Technical Field

[0001] This invention belongs to the field of data processing, and in particular relates to an authentication middleware applied to a PaaS platform. Background Technology

[0002] In traditional PaaS (Platform as a Service) platforms, user communication with the platform typically occurs via APIs, web interfaces, or other protocols. Users authenticate their identities within the platform using usernames, passwords, API keys, etc., and the platform then allocates resources, executes tasks, or provides services to the user. However, with the widespread adoption of cloud computing, traditional PaaS platforms often rely on authentication for single applications or services, lacking a unified authentication mechanism across platforms. Different services and modules may require repeated authentication, increasing system complexity and security risks.

[0003] Therefore, authentication middleware has emerged. Authentication middleware can provide a centralized authentication and authorization management mechanism to ensure that user authentication is consistent across platforms. Based on security protocols (such as bilinear pairing, OAuth, JWT, etc.), middleware can ensure that users do not have to authenticate repeatedly when accessing different services, thereby improving system efficiency and reducing security vulnerabilities.

[0004] Existing authentication middleware typically uses a username / password authentication scheme, which has relatively low security and is vulnerable to man-in-the-middle attacks or key leakage. Furthermore, existing authentication middleware usually only handles authentication, while task scheduling and resource allocation typically require a separate scheduling system. The scheduling process is often simple or static, unable to dynamically adjust based on platform load, task requirements, service quality, and other factors. Summary of the Invention

[0005] In view of the shortcomings of the prior art, the purpose of the invention is to provide an authentication middleware for PaaS platforms that uses bilinear pairing technology for authentication, can complete authentication without exposing the key, and generate session keys, which greatly improves security.

[0006] This invention proposes an authentication middleware for a PaaS platform. Users communicate with the PaaS platform through this middleware, which contains multiple cloud service providers. The authentication middleware includes:

[0007] The user interface is used to provide users with an interface for task creation, data uploading, and application configuration, and to receive user requests;

[0008] The authentication module is used to authenticate users based on bilinear pairing technology;

[0009] The application programming interface server is used to receive all API requests from users, verify access tokens, forward task scheduling, and query tasks.

[0010] The orchestrator is used to filter user requests initiated by authenticated users and determine the resource scheduling scheme for each user request.

[0011] Workflow engine, used to convert resource scheduling schemes into workflows;

[0012] The execution adapter is used to convert task descriptions in the workflow into specific job commands required by the cloud service provider in the PaaS platform for execution.

[0013] The application directory module is used to store all scientific applications supported by the PaaS platform and their parameter templates, and to save user-created task records.

[0014] The credential management module is used to manage the keys of users and cloud service providers;

[0015] The messaging system is used for asynchronous communication between components within the authentication middleware.

[0016] Furthermore, users interact with the authentication middleware through the user interface. The user interface connects to the authentication module, the user interface connects to the application programming interface (API) server, the authentication module connects to the API server, the API server connects to the orchestrator, the orchestrator connects to the messaging system, the application catalog module, and the execution adapter. The application catalog module connects to the API server, the messaging system connects to the API server, the messaging system connects to the orchestrator through the workflow engine, and the execution adapter connects to the credential management module and the application catalog module. The execution adapter converts the user's task description into specific job commands required by the cloud service provider in the PaaS platform and then sends them to the cloud service provider in the PaaS platform.

[0017] Furthermore, the authentication module is specifically used for:

[0018] Initialize the cyclic additive group and the cyclic multiplicative group, and set the bilinear mapping pairing function and the hash function;

[0019] The authentication middleware selects a random number as the master private key to calculate the public key and publishes the public key;

[0020] The authentication middleware receives registration requests from users and cloud service providers in the PaaS platform;

[0021] The authentication middleware generates private keys for users and cloud service providers in the PaaS platform, and stores the private keys locally for both users and cloud service providers.

[0022] The authentication middleware receives the user's authentication request and forwards it to the appropriate cloud service provider.

[0023] The cloud service provider generates a first intermediate value for session key generation based on the public key and bilinear pairing technology, and forwards the first intermediate value to the user through the authentication middleware;

[0024] Based on the first intermediate value, the user generates a session key, a second intermediate value, and an encrypted value, and forwards the second intermediate value and the encrypted value to the cloud service provider through the authentication middleware;

[0025] The cloud service provider calculates the session key based on the second intermediate value;

[0026] The cloud service provider retrieves and determines user information based on the session key and the encrypted value;

[0027] The cloud service provider calculates a first verification value based on the user information and sends the first verification value to the identity verification middleware;

[0028] The user calculates a second verification value and sends it to the authentication middleware;

[0029] The authentication middleware compares the first authentication value with the second authentication value; if they match, the user is allowed to access the corresponding cloud service provider; otherwise, the user is denied access to the corresponding cloud service provider.

[0030] Furthermore, the specific methods for calculating the private key include:

[0031] When the user equipment supports physically unclonable technology, it is introduced to calculate the private key based on the user's identity identifier;

[0032] When the user equipment does not support physically clonable technology, the private key is calculated solely based on the user's identity identifier.

[0033] Furthermore, the orchestrator is specifically used for:

[0034] Determine if the user has been authenticated; if so, retain the user's request; otherwise, reject the user's request.

[0035] Determine whether the current reliability of each cloud service provider is greater than the reliability threshold; if so, add the cloud service provider to the cloud service provider pool; otherwise, refuse to add the cloud service provider to the cloud service provider pool.

[0036] With the goal of minimizing the time and resource costs of completing each user request, a cloud service provider is assigned to each user request from the cloud service provider pool, forming a resource scheduling scheme for each user request.

[0037] Furthermore, the specific methods for detecting the reliability of cloud service providers are as follows:

[0038] Inject faults into the virtual machines of the cloud service provider, and determine the reliability of the cloud service provider based on the performance of the virtual machines in executing tasks after the fault injection.

[0039] Furthermore, the specific methods for determining the resource scheduling scheme include:

[0040] A target function is constructed with the goal of minimizing the time and resource costs of completing each user request.

[0041] Based on the objective function, a genetic algorithm is used to assign cloud service providers to each user request, thus forming a resource scheduling scheme for each user request.

[0042] Furthermore, resource costs are assessed using the total amount of bandwidth and memory used.

[0043] Furthermore, the workflow engine is specifically used for:

[0044] Based on the tasks and dependencies between tasks in the resource scheduling scheme, a workflow is generated.

[0045] Furthermore, the execution adapter is specifically used for:

[0046] Parse the task descriptions in the workflow;

[0047] Generate computing resource configuration commands, task execution commands, and container deployment commands based on the task description.

[0048] The beneficial effects of this invention are as follows:

[0049] (1) The authentication middleware provided by the present invention uses bilinear pairing technology for authentication, which can complete authentication without exposing the key and generate session keys, greatly improving security.

[0050] (2) The authentication middleware provided by the present invention, in addition to authentication, also integrates a workflow engine, which can transform resource scheduling schemes into specific workflows and automatically manage the dependencies and data flows between tasks. The introduction of the workflow engine can make task execution more intelligent and automated, reduce manual intervention and improve efficiency. Attached Figure Description

[0051] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts. It is obvious that the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings.

[0052] Figure 1 This is a schematic diagram of the structure of an authentication middleware applied to a PaaS platform, provided as an embodiment of the present invention.

[0053] Figure 2 This is a flowchart illustrating the workflow of an authentication module provided in an embodiment of the present invention. Detailed Implementation

[0054] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. It should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0055] Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts disclosed in this invention.

[0056] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. The terms "installed," "connected," and "linked" should be interpreted broadly; for example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal communication of two components. Those skilled in the art can understand the specific meaning of the above terms in the embodiments of this invention based on the specific circumstances.

[0057] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of methods and systems consistent with some aspects of the invention as detailed in the appended claims.

[0058] This invention proposes an authentication middleware for PaaS platforms. It addresses the shortcomings of existing authentication middleware technologies, which typically employ a "username / password" authentication scheme, resulting in relatively low security and susceptibility to man-in-the-middle attacks or key leakage. Furthermore, existing authentication middleware usually only handles authentication, requiring a separate scheduling system for task scheduling and resource allocation. This scheduling process is often simple or static, lacking the flexibility to dynamically adjust based on platform load, task requirements, service quality, and other factors.

[0059] Reference manual attached Figure 1 The diagram illustrates a structural schematic of an authentication middleware applied to a PaaS platform provided by an embodiment of the present invention.

[0060] This invention provides an authentication middleware applied to a PaaS platform. Users communicate with the PaaS platform through the authentication middleware, which contains multiple cloud service providers. The authentication middleware includes:

[0061] The user interface is used to provide users with an interface for task creation, data uploading, and application configuration, and to receive user requests.

[0062] The authentication module is used to verify user identity based on bilinear pairing technology.

[0063] The authentication middleware provided by this invention uses bilinear pairing technology for authentication, which can complete authentication without exposing the key and generate a session key, greatly improving security.

[0064] Reference manual attached Figure 2 The diagram illustrates the workflow of an authentication module provided in an embodiment of the present invention.

[0065] This invention provides a novel bilinear pairing technique for identity verification, the specific details of which are as follows: The identity verification module is specifically used for:

[0066] Initialize the cyclic additive group and the cyclic multiplicative group, and set the bilinear mapping pairing function and the hash function:

[0067]

[0068]

[0069]

[0070]

[0071]

[0072] Where G1 represents the cyclic addition group, G2 represents the cyclic multiplication group, and Z... p Let Z represent a finite field, e represent a bilinear mapping pairing function used to map elements of two cyclic additive groups G1 to a cyclic multiplicative group G2, H1 represent a first hash function used to map elements of the two cyclic additive groups G1 to the cyclic multiplicative group G2 after hashing, and H2 represent a second hash function used to map elements of the cyclic multiplicative group G2 to the finite field Z after hashing. p In the diagram, H3 represents the third hash function, used to hash the finite field Z. p The elements in the hash function are mapped to the finite field Z. p In the diagram, H4 represents the fourth hash function, used to hash the finite field Z. p The elements in the hash function are mapped to the finite field Z. p middle.

[0073] It should be noted that bilinear mapping pairing functions are a commonly used mathematical tool in modern cryptography, particularly in areas such as authentication, signatures, encryption protocols, and zero-knowledge proofs. The basic idea is to map elements of two groups to another group using a mapping function, satisfying certain specific properties.

[0074] Furthermore, a hash function is a mathematical algorithm that converts input data (which can be of any size) into a fixed-length output. It is widely used in many fields such as data integrity verification, encryption, and cryptographic signatures.

[0075] The authentication middleware selects a random number as the master private key to calculate the public key, and then publishes the public key:

[0076]

[0077] Among them, P pub represents the public key, s represents the master private key of the middleware, and P represents the generator of the cyclic addition group.

[0078] It should be noted that the master private key, serving as the middleware's private key, is used to generate the public key. The public key is public and can be used by any user or cloud service provider for subsequent authentication and encryption operations.

[0079] The authentication middleware receives registration requests from users and cloud service providers in the PaaS platform.

[0080] The authentication middleware generates private keys for users and cloud service providers in the PaaS platform, and stores the private keys locally on both the user's and the cloud service provider's devices.

[0081] Specifically, the methods for calculating the private key include:

[0082] When a user equipment supports Physical Unclonable Function (PUF), this technology is introduced to calculate the private key based on the user's identity identifier:

[0083]

[0084] Among them, S i Represents the private key of the i-th user, ID i PUF represents the identity identifier of the i-th user. i This represents the unique PUF response obtained by the i-th user through a physically non-cloning function.

[0085] It's important to note that on devices that support PUF technology, the device generates a unique hardware response, which is used to generate the user's private key. PUF technology makes private key generation device-specific, making it extremely difficult to copy.

[0086] When the user equipment does not support physically clonable technology, the private key is calculated solely based on the user's identity identifier:

[0087]

[0088] Among them, S i Represents the private key of the i-th user, ID i This represents the identity identifier of the i-th user.

[0089] Furthermore, regardless of whether the device supports PUF, the user's identity identifier is combined with a hash function to generate a private key, ensuring the user's independence and authentication on the platform.

[0090] The cloud service provider generates a first intermediate value for session key generation based on the public key and bilinear pairing technology, and forwards the first intermediate value to the user through the authentication middleware.

[0091]

[0092] Where Z represents the first intermediate value generated for the session key, e represents the bilinear mapping pairing function, and a represents the random number generated by the cloud service provider.

[0093] It should be noted that the first intermediate value generated in this way is difficult to calculate in reverse, thus enhancing security.

[0094] Based on the first intermediate value, the user generates a session key, a second intermediate value, and an encrypted value, and then forwards the second intermediate value and the encrypted value to the cloud service provider through the authentication middleware.

[0095]

[0096] Among them, K ij Let b represent the session key between the i-th user and the j-th cloud service provider, b represent the user-generated random number, K2 represent the second intermediate value in the session key calculation, and ID represent the session key. j Let w represent the identity identifier of the j-th cloud service provider, w represent the third intermediate value, and d represent the identity identifier of the j-th cloud service provider. i C1 represents the fourth intermediate value generated by the i-th user, which contains the user's identity information, and C2 represents the encrypted value containing the user's identity information. Indicates a splicing symbol. This represents the bitwise XOR symbol.

[0097] The cloud service provider calculates the session key based on the second intermediate value:

[0098]

[0099] Among them, S j This represents the private key of the j-th cloud service provider.

[0100] It should be noted that cloud service providers verify the correctness of their calculated session keys through bilinear pairing to ensure they are not vulnerable to man-in-the-middle attacks.

[0101] The cloud service provider retrieves and determines user information based on the session key and the encrypted value:

[0102]

[0103] It should be noted that by using session key decryption, cloud service providers can verify the user's identity and information, while ensuring that the data is not tampered with during the process.

[0104] The cloud service provider calculates a first verification value based on the user information and sends the first verification value to the authentication middleware:

[0105]

[0106] Among them, D ij This represents the first verification value calculated by the cloud service provider between the i-th user and the j-th cloud service provider.

[0107] The user calculates a second verification value and sends it to the authentication middleware:

[0108]

[0109] in, This represents the second verification value calculated by the user between the i-th user and the j-th cloud service provider.

[0110] The authentication middleware compares the first verification value with the second verification value. If they match, the user is allowed access to the corresponding cloud service provider. Otherwise, access to the corresponding cloud service provider is denied.

[0111] It should be noted that the verification value calculated through hashing ensures consistency between the two parties during the authentication process; any tampering will result in verification failure. Furthermore, two-factor authentication (calculated by both the cloud service provider and the user) improves the accuracy of the authentication process.

[0112] The application programming interface (API) server is used to receive all API requests from users, verify access tokens, forward task scheduling, and query tasks.

[0113] The orchestrator is used to filter user requests initiated by authenticated users and determine the resource scheduling scheme for each user request.

[0114] It should be noted that the orchestrator and subsequent workflow engine are another major innovation of this invention. Existing authentication middleware typically only handles authentication, while task scheduling and resource allocation usually require a separate scheduling system. Moreover, the scheduling process is relatively simple or static and cannot be flexibly adjusted dynamically according to factors such as platform load, task requirements, and service quality. In contrast, the authentication middleware provided by this invention integrates a workflow engine in addition to authentication. It can transform resource scheduling schemes into specific workflows and automatically manage the dependencies and data flows between tasks. The introduction of the workflow engine can make task execution more intelligent and automated, reduce manual intervention, and improve efficiency.

[0115] Optionally, the orchestrator is specifically used for:

[0116] Determine if the user is authenticated. If so, retain the user's request. Otherwise, reject the user's request.

[0117] Determine whether the current reliability of each cloud service provider is greater than the reliability threshold. If so, add the cloud service provider to the cloud service provider pool. Otherwise, refuse to add the cloud service provider to the cloud service provider pool.

[0118] Those skilled in the art can set the reliability threshold according to the actual situation, and the present invention does not impose any limitations.

[0119] Optionally, the specific methods for detecting the reliability of cloud service providers are as follows:

[0120] Inject faults into the virtual machines of the cloud service provider, and determine the reliability of the cloud service provider based on the performance of the virtual machines in executing tasks after the fault injection:

[0121]

[0122] Among them, R j f represents the reliability of the j-th cloud service provider. j The sum represents the number of times the virtual machine of the j-th cloud service provider has failed. j This represents the total number of faults injected into the virtual machine of the j-th cloud service provider.

[0123] It should be noted that by quantifying the number of failures and the total number of injected failures to calculate reliability, the recovery capability and stability of cloud service providers in the face of failures can be evaluated. The platform can dynamically select reliable cloud service providers, thereby optimizing task scheduling, reducing the impact of service interruptions or failures on users, and improving the overall stability of the system and user experience.

[0124] With the goal of minimizing the time and resource costs of completing each user request, a cloud service provider is assigned to each user request from the cloud service provider pool, forming a resource scheduling scheme for each user request.

[0125] In this invention, authentication ensures that only legitimate users can submit requests, enhancing system security. Simultaneously, by assessing the reliability of cloud service providers, only highly reliable providers are included in the resource pool, avoiding the impact of low-reliability providers on task execution and ensuring system stability. Ultimately, by optimizing time and resource costs, tasks can be allocated efficiently, reducing resource waste and improving overall system performance and response speed. This strategy ensures rational task scheduling, optimal resource utilization, and an improved user experience.

[0126] Specifically, the methods for determining resource scheduling schemes include:

[0127] To minimize the time and resource costs of completing each user request, the objective function is constructed as follows:

[0128]

[0129]

[0130]

[0131]

[0132] Where F represents the objective function, X represents the resource scheduling scheme, and x kj Indicates whether the request of the k-th user is executed by the virtual machine of the j-th cloud service provider, when x kj =1 indicates that the k-th user request is executed by the virtual machine of the j-th cloud service provider, when x kj =0 indicates that the k-th user request was not executed by the j-th cloud service provider's virtual machine, TC represents the time cost, λ1 represents the weighting coefficient of the time cost, and t kj RC represents the time cost incurred when the k-th user request is executed by the j-th cloud service provider's virtual machine, λ² represents the resource cost, and r represents the weighting coefficient of the resource cost. kj This represents the resource cost incurred when the k-th user request is executed by the virtual machine of the j-th cloud service provider, where K represents the total number of user requests and J represents the total number of cloud service providers.

[0133] Those skilled in the art can set the weighting coefficients λ1 for time cost and λ2 for resource cost according to the actual situation; this invention does not impose any limitations.

[0134] Alternatively, resource costs can be evaluated using the total amount of bandwidth and memory used:

[0135]

[0136] Among them, M kj B represents the memory used when the k-th user request is executed by the j-th cloud service provider's virtual machine. kj This represents the bandwidth used when the request from the k-th user is executed by the virtual machine of the j-th cloud service provider.

[0137] It's worth noting that defining resource cost as the sum of memory and bandwidth used by user requests on a cloud service provider's virtual machine allows for a more precise measurement of resource usage. This helps optimize task scheduling, ensuring that cloud service providers can efficiently execute tasks within resource constraints, while avoiding resource overuse or underutilization, thereby improving resource utilization, reducing costs, and ensuring system stability.

[0138] Based on the objective function, a genetic algorithm is used to assign cloud service providers to each user request, thus forming a resource scheduling scheme for each user request.

[0139] It should be noted that a genetic algorithm (GA) is an optimization algorithm that simulates the mechanisms of natural selection and inheritance, and belongs to the category of heuristic search algorithms. It seeks the optimal solution to a problem by simulating genetic operations such as natural selection, crossover, and mutation in the process of biological evolution.

[0140] Specifically, the basic steps of a genetic algorithm include: first, generating an initial population, where each individual (solution) consists of genes (parameter values). Then, evaluating the quality of each individual using a fitness function. Next, generating a new generation of the population through selection, crossover, and mutation operations, progressively optimizing the solutions within the population. Through multiple generations of evolution, genetic algorithms can search for globally optimal or near-optimal solutions, and are widely used in various fields such as function optimization, machine learning, and scheduling problems.

[0141] A workflow engine is used to convert resource scheduling schemes into workflows.

[0142] Optionally, the workflow engine is specifically used to generate workflows based on tasks and dependencies between tasks in the resource scheduling scheme.

[0143] It should be noted that the workflow engine can automatically identify and manage the dependencies between tasks, ensuring that tasks are executed in the correct order and avoiding confusion and errors in task execution.

[0144] The execution adapter is used to convert task descriptions in the workflow into specific job commands required by the cloud service provider in the PaaS platform for execution.

[0145] Optionally, the execution adapter is specifically used for:

[0146] Parse the task descriptions in the workflow.

[0147] Generate computing resource configuration commands, task execution commands, and container deployment commands based on the task description.

[0148] It should be noted that this system achieves automatic matching of tasks and resources, avoiding the complexity of manual configuration, improving resource utilization, and reducing errors and delays caused by human intervention. Furthermore, it can dynamically adjust resource configuration according to task requirements, optimizing the task execution process and thus improving the overall system efficiency and scalability.

[0149] The application directory module stores all scientific applications supported by the PaaS platform and their parameter templates, and saves user-created task records.

[0150] It's worth noting that by storing all scientific applications supported by the PaaS platform and their parameter templates in the application catalog module, and saving user-created task records, users can quickly find and select the applications and templates they need, avoiding repetitive configuration and improving work efficiency. Simultaneously, storing user task records helps the platform track historical tasks, analyze resource usage, and provide a reference for future tasks, further optimizing scheduling and resource allocation. Furthermore, the existence of the application catalog module gives the platform high scalability and flexibility, enabling it to support different types of applications and tasks, meeting diverse user needs.

[0151] The credential management module is used to manage the keys of users and cloud service providers.

[0152] The messaging system is used for asynchronous communication between components within the authentication middleware.

[0153] The following describes the specific interaction relationships between the various modules in the identity verification middleware:

[0154] Users interact with the authentication middleware through the user interface. The user interface is the direct dialogue interface, providing functions such as task creation, data uploading, and application configuration. The user interface connects to the authentication module. The authentication module receives and verifies the identity information from the user interface. This module is responsible for ensuring the legitimacy of the user's identity and generating corresponding verification information (such as access tokens). The user interface connects to the application programming interface (API) server. Through this connection, the authentication module ensures that only authenticated users can access subsequent services. After verification, the API server receives the identity information and confirms whether the user can continue making requests. The authentication module connects to the API server, which in turn connects to the orchestrator. The API server acts as an intermediary, receiving and forwarding all API requests from users. It verifies access tokens, ensures the legitimacy of requests, and passes user requests to the orchestrator to allocate resources for tasks. The orchestrator connects to the messaging system, application catalog module, and execution adapter. The orchestrator is the core of task scheduling, making decisions based on task resource requirements, execution order, and the status of the cloud service provider. Through this connection, the API server provides interface support for subsequent resource scheduling and task allocation. The application catalog module connects to the application programming interface (API) server, storing all scientific applications supported by the PaaS platform and their parameter templates, as well as recording user tasks. Its connection to the API server and orchestrator enables the application catalog to provide critical information needed for resource scheduling and task execution. The messaging system connects to the API server and, through the workflow engine, connects to the orchestrator, ensuring the flow of state during task execution. For example, once the orchestrator determines the task scheduling strategy, the messaging system transmits this decision to downstream components via the workflow engine. The execution adapter and credential management module are responsible for converting task descriptions in the workflow into specific job commands that the cloud service provider can execute. During this conversion, the execution adapter collaborates with the credential management module to ensure that the correct security credentials (such as keys) are used during task execution. The execution adapter also interacts with the application catalog module to obtain the required application parameter templates and execution requirements, ensuring that the task is correctly converted into the appropriate execution commands. After converting the user's task description into specific job commands required by the cloud service provider in the PaaS platform, the execution adapter sends it to the cloud service provider within the PaaS platform.

[0155] It's worth noting that this modular structure and the interconnectivity between modules ensure the security of tasks, optimized resource scheduling, and efficient task execution through the authentication middleware architecture. From user request to task execution, the entire process runs automatically and efficiently, minimizing human intervention.

[0156] The applicant of this invention has provided a detailed description of the embodiments of the invention in conjunction with the accompanying drawings. However, those skilled in the art should understand that the above embodiments are merely preferred embodiments of the invention. The detailed description is only intended to help readers better understand the spirit of the invention and is not intended to limit the scope of protection of the invention. On the contrary, any improvements or modifications made based on the inventive spirit of the invention should fall within the scope of protection of the invention.

[0157] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the protection scope of the present invention.

Claims

1. An authentication middleware applied to a PaaS platform, characterized in that, Users communicate with the PaaS platform through the authentication middleware, which contains multiple cloud service providers. The authentication middleware includes: The user interface is used to provide the user with an interface for task creation, data uploading, and application configuration, and to receive user requests; An authentication module is used to authenticate the user based on bilinear pairing technology; The application programming interface server is used to receive all API requests from the user, verify access tokens, forward task scheduling, and query tasks. An orchestrator is used to filter user requests initiated by authenticated users and determine a resource scheduling scheme for each user request. A workflow engine is used to convert the resource scheduling scheme into a workflow; An execution adapter is used to convert the task descriptions in the workflow into specific job commands required by the cloud service provider in the PaaS platform for execution. The application directory module is used to store all scientific applications supported by the PaaS platform and their parameter templates, and to save the task records created by the user. The credential management module is used to manage the keys of the user and the cloud service provider; A messaging system is used for asynchronous communication between the components within the authentication middleware. Specifically, the authentication module is used for: Initialize the cyclic additive group and the cyclic multiplicative group, and set the bilinear mapping pairing function and the hash function; The authentication middleware selects a random number as the master private key to calculate the public key, and publishes the public key; The authentication middleware receives registration requests from the user and the cloud service provider in the PaaS platform. The authentication middleware generates private keys for the user and the cloud service provider in the PaaS platform, and stores the private keys locally on the user's and the cloud service provider's local machines. The authentication middleware receives the user's authentication request and forwards it to the corresponding cloud service provider. The cloud service provider generates a first intermediate value for session key generation based on the public key and the bilinear pairing technology, and forwards the first intermediate value to the user through the authentication middleware. The user generates a session key, a second intermediate value, and an encrypted value based on the first intermediate value, and forwards the second intermediate value and the encrypted value to the cloud service provider through the authentication middleware; The cloud service provider calculates the session key based on the second intermediate value; The cloud service provider retrieves and determines user information based on the session key and the encrypted value; The cloud service provider calculates a first verification value based on the user information and sends the first verification value to the identity verification middleware; The user calculates a second verification value and sends the second verification value to the authentication middleware; The authentication middleware compares whether the first verification value and the second verification value are consistent; if they are, the user is allowed to access the corresponding cloud service provider; otherwise, the user is denied access to the corresponding cloud service provider.

2. The authentication middleware according to claim 1, characterized in that, The user interacts with the authentication middleware through the user interface. The user interface is connected to the authentication module and the application interface server. The authentication module is connected to the application interface server. The application interface server is connected to the orchestrator. The orchestrator is connected to the messaging system, the application catalog module, and the execution adapter. The application catalog module is connected to the application interface server. The messaging system is connected to the application interface server. The messaging system is connected to the orchestrator through the workflow engine. The execution adapter is connected to the credential management module and the application catalog module. The execution adapter converts the user's task description into specific job commands required by the cloud service provider in the PaaS platform and then sends them to the cloud service provider in the PaaS platform.

3. The authentication middleware according to claim 1, characterized in that, The specific methods for calculating the private key include: When the user equipment supports physically unclonable technology, the physically unclonable technology is introduced, and the private key is calculated based on the user's identity identifier; When the user equipment does not support the physically unclonable technology, the private key is calculated solely based on the user's identity identifier.

4. The authentication middleware according to claim 1, characterized in that, The arranger is specifically used for: Determine whether the user has passed authentication; if so, retain the user's request; otherwise, reject the user's request. Determine whether the current reliability of each cloud service provider is greater than the reliability threshold. If so, add the cloud service provider to the cloud service provider pool; Otherwise, the cloud service provider will be refused entry into the cloud service provider pool; With the goal of minimizing the time and resource costs of completing each user request, a cloud service provider is allocated to each user request in the cloud service provider pool to form a resource scheduling scheme for each user request.

5. The authentication middleware according to claim 4, characterized in that, The specific method for detecting the reliability of the cloud service provider is as follows: Fault injection is performed on the virtual machines of the cloud service provider, and the reliability of the cloud service provider is determined based on the performance of the virtual machines in executing tasks after fault injection.

6. The authentication middleware according to claim 1, characterized in that, The method for determining the resource scheduling scheme specifically includes: An objective function is constructed with the goal of minimizing the time and resource costs of completing each user request. Based on the objective function, a genetic algorithm is used to assign cloud service providers to each user request, thereby forming a resource scheduling scheme for each user request.

7. The authentication middleware according to claim 6, characterized in that, The resource cost is assessed using the total amount of bandwidth and memory used.

8. The authentication middleware according to claim 1, characterized in that, The workflow engine is specifically used for: The workflow is generated based on the tasks and dependencies between them in the resource scheduling scheme.

9. The authentication middleware according to claim 1, characterized in that, The execution adapter is specifically used for: Parse the task descriptions in the workflow; Generate computing resource configuration commands, task execution commands, and container deployment commands based on the task description.

Images