Resource sharing method and computing device

Abstract

The invention provides a resource sharing method and computing equipment, a resource user can initiate an application to join a target sharing unit, and whether the resource user is allowed to join the sharing unit or not is determined by judging whether the resource user meets conditions or not; or whether the resource user is allowed to join the sharing unit or not is determined by judging whether the resource user meets the condition or not and whether the target sharing unit meets the condition or not. By means of the mode that the resource user actively applies for the sharing unit created by the target user, the service safety of the resource user can be guaranteed, and hostile attacks are avoided.

Description

Technical Field

[0001] This application relates to the field of network technology, and more specifically, to a method and computing device for resource sharing. Background Technology

[0002] To meet customers' needs for resource sharing technology, the ability to provide users with cross-account access to shared resources has been implemented. For example, through the Resource Access Manager (RAM) service, resource owners can share certain types of resources under their account with other accounts, and the shared accounts can access the shared resources. In other words, users can access shared resources across accounts through the Resource Access Manager service.

[0003] However, under the current resource-sharing model, it's evident that resource owners can share resources with any user. If a malicious resource owner initiates a large number of sharing requests to specific users, these users will receive numerous malicious invitations, potentially preventing them from recognizing legitimate requests and resulting in a large amount of invalid data on the server. Even if the number of invitations a user can accept is limited, they may still be unable to receive legitimate sharing invitations. Furthermore, if a user mistakenly accepts a malicious invitation, their own security may be compromised.

[0004] Therefore, a method for resource sharing is needed that can ensure the account security of resource users during resource sharing. Summary of the Invention

[0005] This application provides a resource sharing method that ensures the business security of resource users and avoids malicious attacks by having resource users actively request resource sharing from the target sharing unit.

[0006] Firstly, a method for resource sharing is provided. For example, this method can be applied to a cloud management platform in a cloud service system. The cloud management platform includes a resource access management system, which is used to manage user identities and resource access. The user identities include a first user and a second user.

[0007] The method includes: receiving a first request message from a first user, the first request message carrying an identifier of a sharing unit, the first request message being used to request joining the sharing unit; displaying a first sharing result to the first user, the first sharing result being determined based on a first judgment result, the first judgment result including a first result and / or a second result, the first result being used to indicate whether the first user meets a first condition, the second result being used to indicate whether the sharing unit meets a second condition, wherein the first condition includes the number of sharing units that the first user has joined being less than or equal to a first threshold, and the second condition includes the number of users that have joined the sharing unit being less than or equal to a second threshold.

[0008] In the embodiments of this application, "resources" may include, for example, at least one of computing resources, storage resources, and network resources.

[0009] In this embodiment, the first user can be understood as a "resource user," that is, the recipient of the shared resources, who can use the shared resources. The second user can be understood as a "resource owner," that is, the owner of the shared resources, who possesses the shared resources.

[0010] In this embodiment of the application, "shared unit" can also be understood as "resource sharing". For example, before or after creating a shared unit, the second user can configure the resources shared in the shared unit and the resource users. As another example, when creating a shared unit, the second user can also configure the usage permissions of the shared resources; for example, resource users may not be able to delete certain shared resources, etc.

[0011] Based on the above technical solution, in this application, a resource user can initiate an application to join a target sharing unit. Whether or not the resource user is allowed to join the sharing unit is determined by judging whether the resource user meets the conditions; or, whether or not the resource user is allowed to join the sharing unit is determined by judging whether both the resource user and the target sharing unit meet the conditions. By having the resource user proactively apply to the target sharing unit, the business security of the resource user can be guaranteed, and malicious attacks can be avoided.

[0012] In conjunction with the first aspect, in one possible implementation, if the first result indicates that the first user does not meet the first condition, the first shared result is used to indicate that the first user's joining has failed.

[0013] In conjunction with the first aspect, in one possible implementation, if the first result indicates that the first user meets the first condition and the second result indicates that the sharing unit meets the second condition, the first sharing result is used to indicate that the first user has successfully joined.

[0014] In conjunction with the first aspect, in one possible implementation, if the first result indicates that the first user meets the first condition and the second result indicates that the sharing unit does not meet the second condition, the first sharing result is used to indicate that the first user's joining has failed.

[0015] Based on the above technical solution, in this application, the sharing result can be determined by judging the first user and the sharing unit. Sharing will only be successful if both the first user and the sharing unit meet the conditions. This ensures the business security of resource users and avoids malicious attacks.

[0016] In conjunction with the first aspect, in one possible implementation, the method further includes: receiving a creation request message from a second user requesting the creation of the shared unit; and displaying the identifier of the created shared unit to the second user.

[0017] In conjunction with the first aspect, in one possible implementation, the identifier of the shared unit is sent by the second user to the first user.

[0018] Based on the above technical solution, in this application, the first user can obtain the identifier of the shared unit created by each user through some means, so that it can directly initiate a request to the target shared unit. Since it is a resource sharing request initiated by the resource user, the security of the business can be guaranteed to a certain extent and malicious attacks can be avoided.

[0019] In conjunction with the first aspect, in one possible implementation, the method includes: obtaining configuration information of a first user, the configuration information being used to instruct the first user to allow users who meet a third condition to share resources with the first user; receiving a third request message from a third user, the third request message being used to request sharing resources with the first user; and displaying a second sharing result to the third user, the second sharing result being determined based on a second judgment result, the second judgment result being used to instruct whether the third user meets the third condition, the third condition including that the user requesting resource sharing belongs to a target user set.

[0020] In conjunction with the first aspect, in one possible implementation, the target user set includes a first user, and / or the target user set is determined by the first user.

[0021] In conjunction with the first aspect, in one possible implementation, if the second judgment result indicates that the third user meets the first condition, the second sharing result is used to indicate that the third user has successfully shared; or, if the second judgment result indicates that the third user does not meet the third condition, the second sharing result is used to indicate that the third user has failed to share.

[0022] Based on the above technical solution, in this application, the first user can configure the scope of resource owners who can initiate resource sharing (i.e., configure a third condition). When a third user initiates resource sharing, the resource access management system will query whether the third user meets the third condition set by the first user. This ensures that the user sharing the resource is trustworthy, eliminates the possibility of attack, and protects the security of the resource user's account.

[0023] Secondly, a method for resource sharing is provided. For example, this method can be applied to a cloud management platform in a cloud service system. The cloud management platform includes a resource access management system for managing user identities and resource access. The user identities include a first user and a second user. The beneficial effects achieved by the method of this second aspect and any implementation thereof are described in the first aspect above and will not be repeated here.

[0024] The method includes: obtaining configuration information of a first user, which instructs the first user to allow users who meet a third condition to share resources with the first user; receiving a third request message from a third user, which requests to share resources with the first user; and displaying a second sharing result to the third user, which is determined based on a second judgment result, which instructs the third user whether the third user meets the third condition, the third condition including that the user requesting to share resources belongs to a target user set.

[0025] In conjunction with the second aspect, in one possible implementation, the target user set includes a first user, and / or the target user set is determined by the first user.

[0026] In conjunction with the second aspect, in one possible implementation, if the second judgment result indicates that the third user meets the first condition, the second sharing result is used to indicate that the third user has successfully shared; or, if the second judgment result indicates that the third user does not meet the third condition, the second sharing result is used to indicate that the third user has failed to share.

[0027] In conjunction with the second aspect, in one possible implementation, the method includes: receiving a first request message from a first user, the first request message carrying an identifier of a sharing unit, the first request message being used to request joining the sharing unit; displaying a first sharing result to the first user, the first sharing result being determined based on a first judgment result, the first judgment result including a first result and / or a second result, the first result being used to indicate whether the first user meets a first condition, the second result being used to indicate whether the sharing unit meets a second condition, wherein the first condition includes the number of sharing units that the first user has joined being less than or equal to a first threshold, and the second condition includes the number of users that have joined the sharing unit being less than or equal to a second threshold.

[0028] In conjunction with the second aspect, in one possible implementation, if the first result indicates that the first user does not meet the first condition, the first shared result is used to indicate that the first user's joining has failed.

[0029] In conjunction with the second aspect, in one possible implementation, if the first result indicates that the first user meets the first condition and the second result indicates that the sharing unit meets the second condition, the first sharing result is used to indicate that the first user has successfully joined.

[0030] In conjunction with the second aspect, in one possible implementation, if the first result indicates that the first user meets the first condition and the second result indicates that the sharing unit does not meet the second condition, the first sharing result is used to indicate that the first user's joining has failed.

[0031] In conjunction with the first aspect, in one possible implementation, the method further includes: receiving a creation request message from a second user requesting the creation of the shared unit; and displaying the identifier of the created shared unit to the second user.

[0032] In conjunction with the first aspect, in one possible implementation, the identifier of the shared unit is sent by the second user to the first user.

[0033] Thirdly, this application proposes a computing device for performing the methods described in the first or second aspect above. Specifically, the device may include units and / or modules for performing the methods proposed in this application, such as an input module and a display module.

[0034] For example, the computing device may be a server, a server cluster, or a cloud management platform in a cloud service system.

[0035] Fourthly, this application provides a computing device comprising: at least one processor for executing a computer program or instructions stored in a memory to perform the methods described in the first or second aspect above. Optionally, the device further comprises a memory for storing the computer program or instructions. Optionally, the device further comprises a communication interface through which the processor reads the computer program or instructions stored in the memory.

[0036] In one implementation, the computing device is a device for implementing the functions of the above-described method in a chip.

[0037] In another implementation, the computing device is a chip, chip system, or circuit used to implement the functions described above in a chip.

[0038] Fifthly, this application provides a processor, including: an input circuit, an output circuit, and a processing circuit. The processing circuit is used to receive signals through the input circuit and to transmit signals through the output circuit, causing the processor to execute the methods described in the first or second aspect.

[0039] In specific implementation, the processor can be one or more chips, the input circuit can be input pins, the output circuit can be output pins, and the processing circuit can be transistors, gate circuits, flip-flops, and various logic circuits. The input signal received by the input circuit can be received and input by, for example, but not limited to, a transceiver, and the signal output by the output circuit can be, for example, but not limited to, output to and transmitted by a transmitter. Furthermore, the input circuit and the output circuit can be the same circuit, which is used as both the input circuit and the output circuit at different times. This application does not limit the specific implementation of the processor and various circuits.

[0040] Unless otherwise specified, or if it does not contradict its actual function or internal logic in the relevant description, the transmission and acquisition / reception operations involved in the processor can be understood as processor output and reception, input and other operations, or as transmission and reception operations performed by radio frequency circuits and antennas. This application does not limit them in this regard.

[0041] In a sixth aspect, a processing apparatus is provided, including a processor and a memory. The processor is used to read instructions stored in the memory and to receive signals via a transceiver and transmit signals via a transmitter to execute the methods of the first or second aspect described above.

[0042] Optionally, the processor may be one or more, and the memory may be one or more.

[0043] Optionally, the memory may be integrated with the processor, or the memory may be separated from the processor.

[0044] In specific implementation, the memory can be a non-transitory memory, such as read-only memory (ROM), which can be integrated with the processor on the same chip or set on different chips. The embodiments of this application do not limit the type of memory or the way the memory and processor are set.

[0045] It should be understood that the relevant data interaction process, such as sending the first information, can be the process of the processor outputting the first information, and the receiving capability information can be the process of the processor receiving input capability information. Specifically, the data output by the processor can be sent to the transmitter, and the input data received by the processor can come from the transceiver. Here, the transmitter and the transceiver can be collectively referred to as the transceiver.

[0046] The processing device mentioned in the sixth aspect above can be one or more chips. The processor in the processing device can be implemented in hardware or software. When implemented in hardware, the processor can be a logic circuit, integrated circuit, etc.; when implemented in software, the processor can be a general-purpose processor that reads software code stored in memory. This memory can be integrated into the processor or located outside the processor and exist independently.

[0047] In a seventh aspect, a computing cluster is provided, including at least one computing device, each computing device including a processor and a memory; the processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, such that the computing device cluster performs the method described in any possible implementation of the first aspect or the second aspect.

[0048] Optionally, the processor can be a general-purpose processor, which can be implemented in hardware or software. When implemented in hardware, the processor can be a logic circuit, integrated circuit, etc.; when implemented in software, the processor can be a general-purpose processor that reads software code stored in memory. This memory can be integrated into the processor or located outside the processor and exist independently.

[0049] Eighthly, a computer-readable storage medium is provided that stores program code for execution by a device, the program code including the method for performing the first or second aspect described above.

[0050] Ninth aspect, a computer program product containing instructions is provided, which, when run on a computer, causes the computer to perform the methods of the first or second aspect described above.

[0051] In a tenth aspect, a chip system is provided, including a processor for calling and running a computer program from a memory, causing a device equipped with the chip system to perform the methods of the first or second aspect described above. Attached Figure Description

[0052] Figure 1 This is a schematic diagram of resource sharing provided in an embodiment of this application.

[0053] Figure 2This is a schematic flowchart of a resource sharing method 200 provided in an embodiment of this application.

[0054] Figure 3 This is a schematic flowchart of a resource sharing method 300 provided in an embodiment of this application.

[0055] Figure 4 This is a schematic diagram illustrating how to obtain a first judgment result according to an embodiment of this application.

[0056] Figure 5 This is a schematic diagram illustrating how to obtain a second judgment result according to an embodiment of this application.

[0057] Figure 6 This is a schematic traffic diagram of a resource sharing method 600 provided in an embodiment of this application.

[0058] Figure 7 This is a schematic diagram of a cloud service system applicable to the embodiments of this application.

[0059] Figure 8 This is a schematic block diagram of a computing device 800 provided in an embodiment of this application.

[0060] Figure 9 This is a schematic block diagram of a computing device 900 provided in an embodiment of this application.

[0061] Figure 10 This is a schematic diagram of the architecture of a computing device cluster provided in an embodiment of this application.

[0062] Figure 11 This is a schematic diagram showing the connection between computing devices 1000A and 1000B via a network according to an embodiment of this application. Detailed Implementation

[0063] The technical solutions in this application will now be described with reference to the accompanying drawings.

[0064] To facilitate understanding of the technical solutions provided in the embodiments of this application, the technical terms involved in this application are briefly introduced below. It should be noted that the introduction of technical terms in this application is only for the purpose of helping to understand the technical solutions and should not be construed as limiting the application.

[0065] 1. Resource Access Manager (RAM)

[0066] For example, resource access management can be used to control resource access permissions and manage user identities. For instance, it can include the following functions: (1) User identity management: creating, managing, and deleting user accounts, and managing user group permissions. (2) Secure authorization: granting granular permissions for resource operations to specific users or roles, rather than sharing permissions across the entire account. (3) Access control: defining who (users or roles) can access which resources and what operations they can perform. (4) Policy formulation: creating, applying, and auditing access policies to ensure the security and compliance of resource access. (5) Federated identity: integrating external identity providers, such as enterprise directory services, so that users can access cloud resources using their existing enterprise identities.

[0067] 2. Organizations Services

[0068] This feature provides enterprise users with the ability to manage multiple account relationships. It allows users to integrate multiple cloud accounts into a single organization and centrally manage all accounts within that organization. Users can unify governance policies within the organization, helping them better meet their business security and compliance needs.

[0069] An organization consists of four parts: a management account, member accounts, a root organizational unit, and organizational units (OUs). An organization has one and only one management account, several member accounts, and a tree structure consisting of a root organizational unit and multiple levels of organizational units. Member accounts can be associated with the root organizational unit or any level of organizational unit. The "root organizational unit" is located at the top of the organizational tree, and the organization is linked downwards from the root organizational unit to organizational units and accounts. "Organizational units" can be nested; an organizational unit can only have one parent organizational unit, and it can be associated with multiple child organizational units or member accounts. An organizational unit can be understood as a container or grouping unit of member accounts. For example, it can typically be mapped to a department, subsidiary, or project team within a company. "Member accounts" can be, for example, cloud accounts, which can be associated with the root organizational unit or any organizational unit. Another example is that a "member account" can be the mobile phone number of a family member, allowing family members to share data. For instance, an invitation can be issued by the management account, and the invited account can only join the organization after accepting the invitation.

[0070] To meet customer needs for resource-sharing technology, the ability to provide users with cross-account access to shared resources has been implemented. For example, through the Resource Access Manager (RAM) service, resource owners can share certain types of resources under their account with other accounts, enabling them to access the shared resources. Resource owners can also share specified resources with certain organizations or organizational units; in this case, all accounts under that organization or organizational unit can access the shared resources. For example, such as... Figure 1 As shown, account Acct3#1 shares a shared resource with account OU#1 through the resource access management service. At this time, accounts Acct#2 and Acct#3 under OU#1 can both access the shared resource. In another implementation, account Acct#1 can also directly share resources with accounts Acct#2 and / or Acct#3. Taking resource sharing in a cloud scenario as an example, the resource access management service can also provide sharing permissions for different resource types. Currently, these permissions are predefined by the cloud service to which the shared resource belongs. When accessing shared resources, resource users need to meet the permission constraints predefined by the cloud service. For example, the cloud service predefines the user's operation permission for shared resource #A as read-only; or, for example, the cloud service predefines the user's operation permission for shared resource #B as non-delete. For example, "resource user" refers to a user registered on the cloud, "shared resource" refers to the resource owner, such as cloud service resources purchased from a cloud provider, and "operation permission" refers to the operations that different resource types of cloud services are pre-registered with on the resource access management service that resource users are allowed to perform on the shared resource. For example, operation permissions include: "read permission", "write permission", "delete permission", "execute permission", "management permission", "ownership", etc.

[0071] In the current scheme, resource owners can share resources with any resource user. However, if a malicious resource owner initiates a large number of sharing requests to a specific resource user, the user will receive a large number of malicious invitations, potentially preventing them from recognizing legitimate invitations and generating a large amount of invalid data on the server. Even if the number of invitations a resource user can accept is limited, they may still be unable to receive legitimate sharing invitations. Furthermore, if a resource user mistakenly accepts a malicious invitation, their own security may be compromised.

[0072] In view of this, this application provides a resource sharing method. A resource user can initiate an application to join a target sharing unit. Whether or not the resource user is allowed to join the target sharing unit is determined by judging whether the resource user meets the conditions; or by judging whether both the resource user and the target sharing unit meet the conditions, thereby determining whether or not the resource user is allowed to join the target sharing unit. Because the resource user actively applies to the target sharing unit, the business security of the resource user can be guaranteed, and malicious attacks can be avoided.

[0073] The various technical solutions provided in the embodiments of this application can be applied to cloud service resource sharing, for example, to scenarios of sharing computing resources, storage resources, and network traffic resources, as well as to scenarios of sharing user mobile traffic.

[0074] Figure 2 This is a schematic flowchart of a resource sharing method 200 provided in this application. For example, this method can be executed by a resource access management system, or it can be executed by a server. The method includes:

[0075] 210, Receive the first request message from the first user.

[0076] For example, the first request message carries the identifier of the shared unit and is used to request to join the shared unit. This shared unit was created by the second user.

[0077] In one possible implementation, prior to step 210, the method further includes: receiving a creation request message from a second user, the creation request message being used to request the creation of the shared unit; and displaying to the second user an identifier corresponding to the created shared unit.

[0078] In this embodiment, after the second user creates the shared unit and obtains its identifier, the second user can send the identifier of the shared unit to the first user. Alternatively, it can be understood that the first user can obtain the identifier of the shared unit created by the second user through some means.

[0079] In this embodiment, the first user can be understood as a "resource user," that is, the recipient of the shared resources, who can use the shared resources. The second user can be understood as a "resource owner," that is, the owner of the shared resources, who possesses the shared resources.

[0080] In this embodiment of the application, "shared unit" can also be understood as "resource sharing". For example, before or after creating a shared unit, the second user can configure the resources shared in the shared unit and the resource users. As another example, when creating a shared unit, the second user can also configure the usage permissions of the shared resources; for example, resource users may not be able to delete certain shared resources, etc.

[0081] For example, "resources" in the embodiments of this application may include at least one of computing resources, storage resources, and network resources.

[0082] 220, Display the first sharing result to the first user.

[0083] In this embodiment of the application, the first sharing result is determined based on the first judgment result, which includes a first result and / or a second result. The first result is used to indicate whether the first user meets the first condition, and the second result is used to indicate whether the sharing unit meets the second condition.

[0084] For example, the first condition includes that the number of shared units that the first user has joined is less than or equal to a first threshold; for example, the second condition includes that the number of users that have joined the shared units created by the second user is less than or equal to a second threshold.

[0085] In one possible implementation of this application, the first threshold may be, for example, the maximum number of users allowed to join the shared unit; the second threshold may be, for example, the maximum number of shared units that the system allows the first user to join. In this case, the first and second thresholds are determined by the system's specifications. In another possible implementation, the first and second thresholds may also be reasonably designed by those skilled in the art based on the system's specifications. For example, assuming the system specifies that each user can join no more than 100 shared units, the first threshold may be, for example, 100, or those skilled in the art may specify the first threshold as 80 considering system performance. For example, assuming the system specifies that a shared unit created by a user can accommodate a maximum of 500 users, the second threshold may be, for example, 500, or those skilled in the art may specify the second threshold as 300 considering system performance.

[0086] For example, if the first result indicates that the first user does not meet the first condition, the first sharing result is used to indicate that the first user's joining failed. For example, if the first result indicates that the first user meets the first condition, the first sharing result is used to indicate that the first user's request to join the sharing unit is "in progress". Further, if the second result indicates that the sharing unit meets the second condition, the first sharing result is used to indicate that the first user's joining was successful; or, if it is determined that the sharing unit does not meet the second condition, the first sharing result is used to indicate that the first user's joining failed.

[0087] The following is combined with Figure 3 The method 300 shown details the technical solution, such as Figure 3 As shown, the method includes:

[0088] 310. The second user creates a shared unit and obtains the identifier corresponding to the created shared unit.

[0089] For example, a second user can send a creation request to the resource sharing management system to request the creation of a shared unit. After successful creation, the resource sharing system can send the identifier corresponding to the shared unit to the second user. For instance, the second user can send the identifier corresponding to the created shared unit to the first user.

[0090] In this embodiment, the second user can also configure the resource users and shared resources of the shared unit. For example, the second user can share resources #A and #B as shared resources for various resource users to use. Another example is that the second user can configure users #1, #2, #3, and #4 as resource users. Furthermore, the second user can configure usage permissions for the shared resources. For example, for resource #1, the second user can configure read permission, allowing the resource user to view the resource's content, but not delete or modify it. For example, for resource #2, the second user can configure write permission, allowing the user to modify the resource's content, but not delete it. For example, for resource #3, the second user can configure delete permission, allowing the resource user to delete the resource. For example, for resource #4, the second user can configure execute permission, allowing the resource user to execute the resource, such as running a program or script. For example, for resource #5, the second user can configure management permission, allowing the resource user to add or delete users, modify permissions, and so on.

[0091] 320, The first user requests to join the shared unit created by the second user.

[0092] For example, a first user may send a first request message to the resource access management system, the first request message including the identifier of the shared unit.

[0093] 330. Determine the first sharing result based on whether the sharing unit indicated by the first result satisfies the first condition.

[0094] In this embodiment, the resource access management system can obtain the first result in various ways. This embodiment does not limit the method of obtaining the first result. The following describes the method in conjunction with... Figure 4 This paper introduces a possible implementation method for obtaining the first result.

[0095] like Figure 4 As shown, the resource access management system can request the account quota management system to query the first user's quota, and the account quota management system returns the first user's quota to the resource access management system.

[0096] For example, the resource access management system can request the account quota management system to query the number of shared units that the first user has successfully joined. The account quota management system then returns the number of shared units that the first user has successfully joined to the resource access management system. At this point, the resource access management system determines a first result based on the obtained number of shared units that the first user has successfully joined and a first threshold.

[0097] For example, the resource access management system can request the account quota management system to query whether the number of shared units that the first user has successfully joined is within the first threshold range. The account quota management system can determine whether the first user can apply to join other shared units based on the first user's historical records of shared units, and return the first result to the resource access management system.

[0098] For example, if the first threshold is 50 and the number of shared units the first user has successfully joined is 40, then the first result is that the first user meets the first condition. For example, if the first threshold is 100 and the number of shared units the first user has successfully joined is 100, then the first result is that the first user does not meet the first condition.

[0099] In this embodiment of the application, for example, the account quota management system is used to record information about each user's joined shared units, and pre-configures a first threshold corresponding to each user. Alternatively, the account quota management system may only be used to record information about each user's joined shared units (e.g., the number of joined shared units).

[0100] In one possible implementation, the "account configuration system" can be understood as a subsystem of the "resource access management system"; in another possible implementation, the "account configuration system" can be a separate server, while the resource access management system is another server, and the two are independent of each other.

[0101] 340. If the first result indicates that the first user does not meet the first condition, the first sharing result is used to indicate that the first user's joining has failed.

[0102] 350, if the first result indicates that the first user meets the first condition, the first sharing result is determined based on whether the sharing unit indicated by the second result meets the second condition.

[0103] Alternatively, in this application, if the first user meets the first condition, a join request for the first user will be generated in the approval list. By judging whether the shared unit created by the second user meets the second condition, it will be finally determined whether to approve or reject the join request.

[0104] In one possible way, such as Figure 5 As shown, the second user logs into the resource access management system to view the current approval list, which includes the first user's request to join the shared unit. At this time, the resource access management system can request the resource quota management system to query the resource quota of the created shared unit, and the resource quota management system returns the resource quota of the shared unit.

[0105] For example, a second user can request the account quota management system to query the number of users who have successfully joined the shared unit created by the second user through the resource access management system. The resource quota management system returns the number of users who have successfully joined the shared unit created by the second user to the resource access management system. At this time, the second user in the resource access management system can determine a second result based on the number of users who have joined the created shared unit and a second threshold, and determine whether to approve or reject the first user's joining request.

[0106] For example, a second user logs into the resource access management system and requests a query from the account quota management system to determine whether the shared unit created by the second user meets the second condition. The account quota management system can then determine whether to add other users to the shared unit based on the records of users already in the shared unit and return the second result to the resource access management system. At this point, the second user can use this second result to decide whether to approve or reject the first user's joining request.

[0107] For example, if the second threshold is 1000 and the number of users who have joined the shared unit is 998, then the second judgment result is that the shared unit created by the second user satisfies the first condition. For example, if the first threshold is 1000 and the number of shared units that the first user has successfully joined is 1000, then the second judgment result is that the shared unit created by the second user does not satisfy the first condition.

[0108] In this embodiment of the application, for example, the resource quota management system is used to record the number of users who have joined the shared units created by each resource owner, and pre-configures a second threshold corresponding to each shared unit. Alternatively, the resource quota management system may only be used to record user information (e.g., the number of users who have joined) for each shared unit.

[0109] In one possible implementation, the "resource configuration system" can be understood as a subsystem of the "resource access management system"; in another possible implementation, the "resource configuration system" can be a separate server, while the resource access management system is another server, and the two are independent of each other.

[0110] Based on the above technical solution, by having resource users actively apply for resource sharing from the target sharing unit, the business security of resource users can be guaranteed and malicious attacks can be avoided.

[0111] Figure 6 This is a schematic flowchart of a resource sharing method 600 provided in this application. Method 600 can be used in conjunction with methods 200 and 300 described above. The following describes the method in conjunction with... Figure 6 The method 600 provided in this application is described below. This method can be executed, for example, by a resource access management system.

[0112] 610. Obtain the configuration information of the first user. The configuration information is used to instruct the first user to allow users who meet the third condition to share resources with the first user.

[0113] In one possible implementation, configuration information from the first user can be received. For example, the user's third condition could be a configuration command. After logging into the resource access management system, the first user can enable this configuration command. When the first user enables this configuration command, it indicates that the first user allows users who meet the third condition to share resources with the first user.

[0114] In one possible implementation, the third condition includes that the user requesting the shared resource belongs to the target user set. For example, the target user set includes the first user, and / or the target user set is determined by the first tenant. Exemplarily, the third condition could be that the first user and the second user belong to the same organization. Exemplarily, the third condition could be a user specified by the first user for resource sharing.

[0115] 620, Receive a third request message from a third user, the third request message being used to request sharing resources with the first user.

[0116] Correspondingly, the third user sends the third request message.

[0117] In one possible implementation, after step 620, the method 600 further includes: obtaining a third judgment result, which is used to indicate whether the third user meets the first condition.

[0118] In one possible implementation, a first query request message is sent to an organization server, the first query request message carrying a first condition, the first query request being used to query whether a third user meets the first condition, wherein the organization server stores a set of target users; and a first query response message is received from the organization server, the first query response message carrying a first judgment result.

[0119] 630. Display the second sharing result to the third user. The second sharing result is determined based on the second judgment result.

[0120] In this embodiment of the application, the second judgment result is used to indicate whether the third user meets the third condition, which includes that the user requesting shared resources belongs to the target user set.

[0121] In one possible implementation, if the second judgment result indicates that the third user meets the third condition, the second sharing result is used to indicate that the third user has successfully shared the resource.

[0122] In another possible implementation, if the second judgment result indicates that the third user does not meet the third condition, the second sharing result is used to indicate that the third user failed to share the resource.

[0123] In one possible application scenario, for example, method 600 can be applied to scenarios involving sharing resources among accounts within an organization or where designated users share resources. In another possible application scenario, methods 200 and 300 are applicable to scenarios involving sharing resources outside the organization.

[0124] Based on the above technical solution, in this embodiment, the first user can configure the scope of resource owners who can initiate resource sharing (i.e., the third condition). When a third user initiates resource sharing, the resource access management system will query whether the third user meets the third condition set by the first user. This ensures that the user sharing the resource is trustworthy, eliminates the possibility of attack, and protects the security of the resource user's account.

[0125] It is understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0126] Those skilled in the art will recognize that, based on the units and algorithm steps described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is implemented in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0127] This application embodiment can divide the computing device into functional modules according to the above method example. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing module. The integrated modules can be implemented in hardware or as software functional modules. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods. The following description uses the division of functional modules according to each function as an example.

[0128] Figure 7 This is a schematic diagram of a cloud service scenario to which this application applies, such as... Figure 7 As shown, this cloud scenario may include: a cloud management platform 710, the Internet 720, and a client 730. For example... Figure 7 As shown, the cloud management platform 710 is used to manage the infrastructure that provides multiple cloud services. The infrastructure includes multiple cloud data centers, each containing multiple servers, and each server containing cloud service resources to provide corresponding cloud services to tenants. In this embodiment, the cloud service resources may be cloud databases.

[0129] The cloud management platform 710 can be located in a cloud data center and provides access interfaces (such as user interfaces or application program interfaces, APIs). Tenants can use client 730 to remotely access the cloud management platform 710, register a cloud account and password, and log in. After successful authentication of the cloud account and password, the tenant can further select and purchase virtual machines with specific specifications (processor, memory, disk) on the cloud management platform 710. After successful purchase, the cloud management platform 710 provides a remote login account and password for the purchased virtual machine, and client 730 can remotely log in to the virtual machine to install and run the tenant's applications. Therefore, tenants can create, manage, log in to, and operate virtual machines in the cloud data center through the cloud management platform 710.

[0130] The cloud management platform 710 includes, but is not limited to, a tenant console, compute management services, network management services, storage management services, authentication services, and image management services. The tenant console provides an interface or API for interaction with tenants. The compute management services manage servers running virtual machines and containers, as well as bare metal servers. The network management services manage network services (such as gateways and firewalls). The storage management services manage storage services (such as data bucket services). The authentication services manage tenant account passwords. The image management services manage virtual machine images. Tenants use client 730 and can log in to the cloud management platform 710 via the internet 720 to manage their rented cloud services.

[0131] In this embodiment of the application, the cloud management platform includes a resource access management system, which is used to manage user identity and resource access. The user identity includes a first user and a second user.

[0132] Figure 8 This is a schematic block diagram of a computing device 800 provided in an embodiment of this application. As shown in the figure, the computing device 800 may include a transceiver module 810 and a display module 820. Optionally, it may also include an acquisition module 830.

[0133] The modules described above are used to execute the respective steps of the methods mentioned above, which will not be elaborated here.

[0134] It should also be understood that the computing device 800 here is embodied in the form of a functional unit. The term "unit" here may refer to application-specific integrated circuits (ASICs), electronic circuits, processors (e.g., shared processors, proprietary processors, or group processors) and memory for executing one or more software or firmware programs, integrated logic circuits, and / or other suitable components that support the described functions.

[0135] The computing device 800 in each of the above schemes has the function of implementing the corresponding steps of methods 200, 300, and 600. These functions can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions; for example, the determining unit can be replaced by a processor to execute the transmit / receive operations and related processing operations in each method embodiment. Furthermore, the determining unit can be a processing circuit.

[0136] In one possible implementation, the computing device 800 may be RAM used in the cloud management platform in the methods 200, 300 and 600 described above, and the computing device is used to perform the actions in the methods 200, 300 and 600 described above.

[0137] In one possible implementation, the computing device 800 may be a server, which is used to perform the actions in methods 200, 300 and 600 described above.

[0138] It should be pointed out that, Figure 8 The computing device in this context can be the chip or chip system corresponding to the RAM used in the cloud management platform in the aforementioned method embodiments, such as a system-on-chip (SoC). Alternatively, the computing device can be the chip or chip system corresponding to the server used in the aforementioned method embodiments.

[0139] Figure 9 This is a schematic block diagram of another computing device 900 provided in an embodiment of this application. As shown, the device 900 includes at least one processor 920. The processor 920 is coupled to a memory 930 and is used to execute instructions stored in the memory to transmit and / or receive signals. Optionally, the device 900 also includes a memory 930 for storing instructions. Optionally, the device 900 also includes a transceiver 910, which is controlled by the processor 920 to transmit and / or receive signals.

[0140] It should be understood that the processor 920 and memory 930 described above can be combined into a single processing device, with the processor 920 executing the program code stored in the memory 930 to achieve the aforementioned functions. In specific implementations, the memory 930 can be integrated into the processor 920 or independent of the processor 920.

[0141] It should also be understood that transceiver 910 may include a transceiver (or receiver) and a transmitter (or transmitter). The transceiver may further include an antenna, and the number of antennas may be one or more. Transceiver 910 may have a communication interface or interface circuitry.

[0142] Specifically, the processor 920 in device 900 may correspond to the acquisition module 830 in device 800. The transceiver 910 in device 900 may correspond to the transceiver module 810 in device 800.

[0143] As one approach, the device 900 is used to implement the steps corresponding to the computing device (or cloud management platform, or communication device in the cloud management platform) in the embodiments of methods 200, 300, and 600 above.

[0144] For example, processor 920 is used to execute computer programs or instructions stored in memory 930 to implement the steps in methods 200, 300 and 600 above.

[0145] Figure 10 This is a schematic diagram of the architecture of a computing device cluster provided in an embodiment of this application. The computing device cluster includes at least one computing device. This computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone. Figure 10 As shown, the computing device cluster includes at least one computing device 1000. The memory 1030 in one or more computing devices 1000 in the computing device cluster may store the same instructions for performing the actions executed by the RAM in embodiments 200, 300, and 600 described above.

[0146] In some possible implementations, the memory 1030 of one or more computing devices 1000 in the computing device cluster may also store partial instructions for performing the actions of the methods 200, 300, and 600 described in the above embodiments. In other words, a combination of one or more computing devices 1000 can jointly execute instructions for performing the actions described in the above embodiments.

[0147] It should be noted that the memory 1030 in different computing devices 1000 within the computing device cluster can store different instructions, which are used to execute parts of the functions of the computing device 1000. That is, the instructions stored in the memory 1030 of different computing devices 1000 can implement the functions of one or more modules of the transceiver module 810 and the display module 820.

[0148] Alternatively, the memory 1030 in different computing devices 1000 within the computing device cluster can store different instructions, which are used to execute the RAM or partial functions of the server corresponding to the aforementioned computing devices 800-900. That is, the instructions stored in the memory 1030 in different computing devices 1000 can implement the functions of one or more modules in the transceiver module 810 and the display module 820.

[0149] In some possible implementations, one or more computing devices in a computing device cluster can be connected via a network. This network can be a wide area network (WAN) or a local area network (LAN), etc. Figure 11 One possible implementation is shown. For example... Figure 11 As shown, the two computing devices 1000A and 1000B are connected via a network. Specifically, they are connected to the network through the communication interfaces in each computing device.

[0150] It should be understood that Figure 11 The functions of computing device 1000A shown can also be performed by multiple computing devices 1000. Similarly, the functions of computing device 1000B can also be performed by multiple computing devices 1000.

[0151] In this embodiment, a computer program product containing instructions is also provided. The computer program product may be a software or program product containing instructions capable of running on a computing device cluster or stored on any available medium. When run by the computing device cluster, it causes the computing device cluster to perform the methods provided above, or causes the computing device cluster to implement the functions of the apparatus provided above.

[0152] In this embodiment, a computer-readable storage medium is also provided. This computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., digital video disc (DVD)), or a semiconductor medium (e.g., a solid-state drive). The computer-readable storage medium includes instructions that, when executed on a computing device, cause the computing device to perform the method described above.

[0153] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0154] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0155] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0156] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0157] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0158] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0159] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for resource sharing, the method comprising: receiving a first request message from a first user, the first request message carrying an identifier of a sharing unit, the first request message being used to request to join the sharing unit; displaying a first sharing result to the first user, the first sharing result being determined according to a first determination result, the first determination result comprising a first result and / or a second result, the first result being used to indicate whether the first user satisfies a first condition, the second result being used to indicate whether the sharing unit satisfies a second condition, wherein the first condition comprises that a number of sharing units that the first user has joined is less than or equal to a first threshold, and the second condition comprises that a number of users that have joined the sharing unit is less than or equal to a second threshold. 2.The method of claim 1, wherein: in a case where the first result indicates that the first user does not satisfy the first condition, the first sharing result is used to indicate that the first user fails to join. 3.The method of claim 1 or 2, wherein: in a case where the first result indicates that the first user satisfies the first condition and the second result indicates that the sharing unit satisfies the second condition, the first sharing result is used to indicate that the first user succeeds to join. 4.The method of any one of claims 1 to 3, wherein: in a case where the first result indicates that the first user satisfies the first condition and the second result indicates that the sharing unit does not satisfy the second condition, the first sharing result is used to indicate that the first user fails to join.

5. The method according to any one of claims 1 to 4, characterized in that, The method further comprises: receiving a creation request message from a second user, the creation request message being used to request to create the sharing unit; displaying an identifier of the created sharing unit to the second user.

6. The method of claim 5, wherein, The identifier of the sharing unit is sent by the second user to the first user.

7. The method according to any one of claims 1 to 6, characterized in that, The method further comprises: obtaining configuration information of the first user, the configuration information being used to indicate that the first user allows a user satisfying a third condition to share a resource to the first user; receiving a third request message from a third user, the third request message being used to request to share a resource to the first user; displaying a second sharing result to the third user, the second sharing result being determined according to a second determination result, the second determination result being used to indicate whether the third user satisfies the third condition, the third condition comprising that a user requesting to share a resource belongs to a target user set.

8. The method of claim 7, wherein, The target user set comprises the first user, and / or the target user set is determined by the first user. 9.The method of claim 7 or 8, wherein: in a case where the second determination result indicates that the third user satisfies the first condition, the second sharing result is used to indicate that the third user succeeds to share, or in a case where the second determination result indicates that the third user does not satisfy the third condition, the second sharing result is used to indicate that the third user fails to share.

10. The method according to any one of claims 1 to 9, characterized in that, The method is applied to a cloud management platform in a cloud service system, the cloud management platform comprising a resource access management system configured to manage user identities and resource access, the user identities comprising the first user and a second user.

11. A computing device, comprising: The display module is configured to display a first sharing result to the first user, the first sharing result being determined according to a first determination result, the first determination result comprising a first result and / or a second result, the first result being used to indicate whether the first user meets a first condition, and the second result being used to indicate whether the shared unit meets a second condition, wherein the first condition comprises that a number of shared units that the first user has joined is less than or equal to a first threshold, and the second condition comprises that a number of users that have joined the shared unit is less than or equal to a second threshold.

12. The computing device of claim 11, wherein, in a case where the first result indicates that the first user does not meet the first condition, the first sharing result is used to indicate that the first user fails to join.

13. The computing device of claim 11 or 12, wherein, in a case where the first result indicates that the first user meets the first condition and the second result indicates that the shared unit meets the second condition, the first sharing result is used to indicate that the first user succeeds to join.

14. The computing device of any one of claims 11 to 13, wherein, in a case where the first result indicates that the first user meets the first condition and the second result indicates that the shared unit does not meet the second condition, the first sharing result is used to indicate that the first user fails to join.

15. The computing device of any one of claims 11 to 14, wherein, the transceiver module is further configured to receive a creation request message from a second user, the creation request message being used to request to create the shared unit; the display module is further configured to display an identity of the created shared unit to the second user. The identity of the shared unit is sent by the second user to the first user. The computing device further comprises an obtaining module, 16. The computing device of claim 15, wherein, the obtaining module is configured to obtain configuration information of the first user, the configuration information being used to indicate that the first user allows a user meeting a third condition to share a resource to the first user; 17. The computing device of any of claims 11 to 16, wherein, the transceiver module is further configured to receive a third request message from a third user, the third request message being used to request to share a resource to the first user; ​ ​ The display module is further configured to display a second sharing result to the third user, the second sharing result being determined according to a second determination result, the second determination result indicating whether the third user satisfies a third condition, the third condition including that the user requesting to share the resource belongs to a target user set.

18. The computing device of claim 17, wherein, The target user set includes the first user, and / or the target user set is determined by the first user.

19. The computing device of claim 17 or 18, wherein, in a case where the second determination result indicates that the third user satisfies the first condition, the second sharing result indicates that the third user shares successfully, or in a case where the second determination result indicates that the third user does not satisfy the third condition, the second sharing result indicates that the third user shares unsuccessfully.

20. The computing device of any of claims 11 to 19, wherein, The computing device is applied to a cloud management platform in a cloud service system, the cloud management platform including a resource access management system configured to manage user identities and resource access, the user identities including the first user and a second user.

21. A cluster of computing devices, characterized in that, The computing device is applied to a cloud management platform in a cloud service system, the cloud management platform including a resource access management system configured to manage user identities and resource access, the user identities including the first user and a second user. The computing device is applied to a cloud management platform in a cloud service system, the cloud management platform including a resource access management system configured to manage user identities and resource access, the user identities including the first user and a second user.

22. A computer program product comprising instructions, characterized in that, The computing device is applied to a cloud management platform in a cloud service system, the cloud management platform including a resource access management system configured to manage user identities and resource access, the user identities including the first user and a second user.

23. A computer-readable storage medium, characterized in that, The computing device is applied to a cloud management platform in a cloud service system, the cloud management platform including a resource access management system configured to manage user identities and resource access, the user identities including the first user and a second user. The computing device is applied to a cloud management platform in a cloud service system, the cloud management platform including a resource access management system configured to manage user identities and resource access, the user identities including the first user and a second user.

Images