Access control system, access control method and device, storage medium and product

Abstract

The invention provides an access control system, an access control method and device, a storage medium and a product, and belongs to the field of cloud computing. The system comprises an application management and control platform, and the application management and control platform is used for creating a first service agent for a first application and generating first access identity information after the first application on a first cloud service is hosted, and sending the first access identity information to the first application, the first access identity information is used for identifying the identity of the first application on the first cloud service; the first service agent is used for acquiring the first access identity information after detecting that the first application is started, generating a second access message based on the first access identity information and a first access message when receiving the first access message sent by the first application for a target object, and sending the second access message to the first service agent; and sending the second access message to the target object. According to the invention, the security of application access is improved.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to an access control system, access control method and apparatus, storage medium and product. Background Technology

[0002] With the development of cloud computing technology, more and more applications are being deployed in the cloud. In particular, for microservice-based applications, multiple applications need to call each other, making the security of inter-application access crucial. To ensure access security, it is necessary to control application access.

[0003] Microservice applications are typically deployed in Kubernetes (K8s) container clusters. Therefore, the service account (ServiceAccount) of the application in the Kubernetes container cluster is used as the access identity to control access to the application.

[0004] However, a single service account in a Kubernetes container cluster can be shared by multiple applications. This allows multiple applications to access other applications or cloud services using the same service account, compromising the security of application access. Summary of the Invention

[0005] This application provides an access control system, access control method and apparatus, storage medium and product, which can improve the security of application access. The technical solution is as follows:

[0006] In a first aspect, an access control system is provided, the system including an application management platform;

[0007] The application management platform is used to create a first service proxy for the first application and generate first access identity information after the first application is hosted on the first cloud service, and send the first access identity information to the first application. The first access identity information is used to identify the identity of the first application on the first cloud service.

[0008] The first service proxy is configured to obtain the first access identity information after detecting that the first application has started, and when it receives the first access message sent by the first application for the target object, generate the second access message based on the first access identity information and the first access message, and send the second access message to the target object.

[0009] Secondly, an access control method is provided, the method being applied to a first service proxy in the system described in the first aspect, the method comprising:

[0010] Receive the first access message for the target object sent by the first application;

[0011] Based on the first access identity information corresponding to the first application and the first access message, a second access message is generated, wherein the first access identity information is used to identify the identity of the first application on the first cloud service.

[0012] The second access message is sent to the target object.

[0013] In another possible implementation of this application, before receiving the first access message for the target object sent by the first application, the method further includes:

[0014] When the first application is detected to be launched, the first access identity information is obtained from the first application. The first access identity information is sent to the first application by the application management platform after the first application is hosted.

[0015] In another possible implementation of this application, when the first access authentication policy instructs the first application to support two-way communication authentication, the method further includes:

[0016] Send a certificate request to the application management platform. The certificate request includes the first access identity information. The certificate request is used to request the application management platform to obtain and return the first digital certificate corresponding to the first application.

[0017] The system receives the first digital certificate sent by the application management platform. The first digital certificate is used to authenticate the communication method of the first application.

[0018] In another possible implementation of this application, the target object is a second application on the first cloud service, and the step of generating a second access message based on the first access identity information corresponding to the first application and the first access message includes:

[0019] The first access identity information is injected into the first access message to obtain the second access message.

[0020] In another possible implementation of this application, before sending the second access message to the target object, the method further includes:

[0021] If both the first application and the second application support two-way communication authentication, a connection establishment request is sent to the second service agent. The connection request is used to request the second service agent to return the second digital certificate corresponding to the second application.

[0022] The second digital certificate is verified, and after the second digital certificate is verified, the first digital certificate is provided to the second service agent so that the second service agent can verify the first digital certificate, and after the first digital certificate is verified, a bidirectional transmission channel is established with the first service agent;

[0023] The second access message is sent to the second service agent using the bidirectional transmission channel.

[0024] In another possible implementation of this application, the target object is a second cloud service, and the step of generating a second access message based on the first access identity information corresponding to the first application and the first access message includes:

[0025] After receiving the first access message, an identity information acquisition request is sent to the application management platform. The identity information acquisition request includes the first access identity information. The identity information acquisition request is used to request the application management platform to acquire and return the temporary access identity information of the first application on the second cloud service.

[0026] After receiving the temporary access identity information sent by the application management platform, the temporary access identity information is injected into the first access message to obtain the second access message. The temporary access identity information is used to temporarily identify the identity of the first application on the second cloud service.

[0027] Thirdly, an access control method is provided, the method being applied to an application management platform in the system described in the first aspect, the method comprising:

[0028] The system receives a policy query request sent by the first service agent. The policy query request is sent by the first service agent after obtaining the first access identity information from the first application. The policy query request includes the first access identity information of the first application, which is used to identify the identity of the first application on the first cloud service.

[0029] In response to the policy query request, the first access identity information is verified;

[0030] After the first access identity information is verified, the first access authentication policy corresponding to the first application is obtained. The first access authentication policy is used to indicate the access method and access permissions of the first application to the target object.

[0031] The first access authentication policy is sent to the first service proxy to control the first application's access to the target object.

[0032] In another possible implementation of this application, before receiving the policy query request sent by the first service agent, the method further includes:

[0033] Once the first application is hosted on the application management platform, the first service agent is created for the first application and the first access identity information is generated, and the first access identity information is sent to the first application.

[0034] In another possible implementation of this application, after sending the first access authentication policy to the first service proxy, the method further includes:

[0035] When the first access authentication policy indicates that the first application supports two-way communication authentication, a certificate request sent by the first service agent is received, and the certificate request includes the first access identity information;

[0036] In response to the certificate request, a first digital certificate corresponding to the first application is obtained and sent to the first service agent. The first digital certificate is used to authenticate the communication method of the first application.

[0037] In another possible implementation of this application, when the target object requested by the first application is a second cloud service, the method further includes:

[0038] Receive an identity information acquisition request sent by the first service agent, wherein the identity information acquisition request includes the first access identity information;

[0039] Based on the first access identity information, the temporary access identity information of the first application on the second cloud service is obtained, and the temporary access identity information is sent to the second service agent. The temporary access identity information is used to temporarily identify the identity of the first application on the second cloud service.

[0040] Fourthly, an access control method is provided, the method being applied to a second service proxy in the system described in the first aspect, the method comprising:

[0041] Receive a second access message sent by the first service agent. The second access message contains the first access identity information of the first application. The first access identity information is used to identify the identity of the first application on the first cloud service.

[0042] The second access message is sent to the second application.

[0043] In another possible implementation of this application, where both the first application and the second application support bidirectional communication authentication, before receiving the second access message sent by the first service proxy, the method further includes:

[0044] Receive the connection establishment request sent by the first service agent;

[0045] In response to the connection establishment request, the second digital certificate corresponding to the second application is provided to the first service agent so that the first service agent can verify the second digital certificate, and after the second digital certificate is verified, the first digital certificate is provided to the second service agent.

[0046] The first digital certificate is verified, and a two-way transmission channel is established with the first service agent after the first digital certificate is verified.

[0047] The receipt of the second access message sent by the first service agent includes:

[0048] The second access message sent by the first service agent is received using the bidirectional transmission channel.

[0049] Fifthly, an access control device is provided, the device being disposed in a first service agent in the system described in the first aspect, the device comprising:

[0050] The receiving module is used to receive the first access message for the target object sent by the first application;

[0051] The generation module is used to generate a second access message based on the first access identity information corresponding to the first application and the first access message, wherein the first access identity information is used to identify the identity of the first application on the first cloud service.

[0052] The sending module is used to send the second access message to the target object.

[0053] Sixthly, an access control device is provided, the device being disposed in the application management platform of the system described in the first aspect, the device comprising:

[0054] The receiving module is configured to receive a policy query request sent by the first service agent. The policy query request is sent by the first service agent after obtaining the first access identity information from the first application. The policy query request includes the first access identity information of the first application, which is used to identify the identity of the first application on the first cloud service.

[0055] The verification module is used to verify the first access identity information in response to the policy query request;

[0056] The acquisition module is used to acquire the first access authentication policy corresponding to the first application after the first access identity information is verified. The first access authentication policy is used to indicate the access method and access permissions of the first application to the target object.

[0057] The sending module is used to send the first access authentication policy to the first service proxy in order to control the first application's access to the target object.

[0058] In a seventh aspect, an access control device is provided, the device being disposed in a second service proxy in the system described in the first aspect, the device comprising:

[0059] The receiving module is used to receive a second access message sent by the first service agent. The second access message contains the first access identity information of the first application. The first access identity information is used to identify the identity of the first application on the first cloud service.

[0060] The sending module is used to send the second access message to the second application.

[0061] Eighthly, a computer-readable storage medium is provided, wherein at least one computer program is stored therein, and the at least one computer program, when executed by a processor, is capable of implementing the access control method of the second aspect, or the access control method of the third aspect, or the access control method of the fourth aspect.

[0062] Ninthly, a computer program product is provided, the computer program product comprising a computer program, which, when executed by a processor, is capable of implementing the access control method described in the second aspect, or the access control method described in the third aspect, or the access control method described in the fourth aspect.

[0063] The beneficial effects of the technical solutions provided in this application are:

[0064] This application provides an access control system that includes an application management platform. This platform configures service proxies for applications hosted on it and generates access identity information. This access identity information identifies the application on a first cloud service, and different applications have different access identity information. This prevents multiple applications on the first cloud service from using the same access identity to access other applications, thus improving application access security. Taking a first application as an example, after the first application is hosted on the application management platform, the platform creates a first service proxy for it and generates first access identity information. This first access identity information is then sent to the first application to identify it on the first cloud service. When the first application starts, the first service proxy retrieves the first access identity information corresponding to the first application. Upon receiving a first access message from the first application targeting a target object, the proxy generates a second access message based on the first access identity information and sends it to the target object. This allows the target object to perform authentication, permission management, and other operations on the first application, further improving access security. Attached Figure Description

[0065] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0066] Figure 1 This is an architecture diagram of an access control system provided in an embodiment of this application;

[0067] Figure 2 This is a schematic diagram of three access scenarios provided in the embodiments of this application;

[0068] Figure 3 This is a flowchart of an access control method provided in an embodiment of this application;

[0069] Figure 4 This is a flowchart of an access control method provided in an embodiment of this application;

[0070] Figure 5 This is a schematic diagram of the structure of an access control device provided in an embodiment of this application;

[0071] Figure 6 This is a schematic diagram of another access control device provided in an embodiment of this application;

[0072] Figure 7This is a schematic diagram of another access control device provided in an embodiment of this application;

[0073] Figure 8 A structural block diagram of an electronic device provided in an exemplary embodiment of this application is shown. Detailed Implementation

[0074] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0075] It is understood that the terms "each," "multiple," and "any" used in the embodiments of this application, etc., mean that "multiple" includes two or more, "each" refers to each of the corresponding multiples, and "any" refers to any one of the corresponding multiples. For example, multiple words include 10 words, and "each word" refers to each of the 10 words, while "any word" refers to any one of the 10 words.

[0076] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0077] Before implementing the embodiments of this application, the terms involved in the embodiments of this application will be explained first.

[0078] Microservices: A monolithic application is broken down into multiple applications based on its functionality. Each application can be a microservice, and multiple microservices work together to achieve the functionality of the monolithic application.

[0079] Monolithic application: also known as a monolithic system or monolithic architecture, refers to an application that couples together various functions, modules, and components in a system. This application can be packaged into a war.jar file, which can be deployed using a container.

[0080] Kubernetes, abbreviated as K8s, is an abbreviation formed by replacing the eight characters "ubernete" in its name. Kubernetes is an open-source application used to manage containerized applications across multiple hosts in a cloud platform. Kubernetes aims to make deploying containerized applications simple and efficient, providing a mechanism for application deployment, planning, updating, and maintenance.

[0081] Sidecar pattern: A design pattern commonly used in microservice architectures, this pattern allows the separation of core application functionalities from auxiliary functionalities (such as logging, configuration management, network communication, etc.). In this design pattern, each microservice main container has a "sidecar" container running auxiliary functionalities, much like a sidecar next to a motorcycle. The sidecar container shares the same lifecycle and network space as the main container.

[0082] Cloud computing refers to the delivery and usage model of IT infrastructure, meaning obtaining necessary resources in an on-demand and easily scalable manner through a network. In a broader sense, cloud computing also refers to the delivery and usage model of services, meaning obtaining necessary services in an on-demand and easily scalable manner through a network. These services can be IT and software related, internet-related, or other services. Cloud computing is a product of the development and integration of traditional computer and network technologies such as grid computing, distributed computing, parallel computing, utility computing, network storage technologies, virtualization, and load balancing.

[0083] With the development of the internet, real-time data streams, and the diversification of connected devices, as well as the demands for search services, social networks, mobile commerce, and open collaboration, cloud computing has developed rapidly. Unlike previous parallel distributed computing, cloud computing will revolutionize the entire internet model and enterprise management model from a conceptual standpoint.

[0084] With the development of cloud computing technology, more and more microservice applications are deployed in the cloud. Typically, these microservice applications are deployed in Kubernetes container clusters in the cloud. If access between applications within the Kubernetes container cluster is not controlled, access messages sent by any application may be intercepted or forged externally, leading to attacks on a large number of microservice applications within the Kubernetes container cluster. To protect the access of various applications in the cloud, access control is necessary. Currently, Istio is used to control application access. This method generally uses the application's service account (ServiceAccount) in the Kubernetes container cluster as the access identity when the application accesses other applications, and then controls application access based on this access identity.

[0085] However, this method has the following problems:

[0086] First, the access identity is singular.

[0087] Since a service account in a Kubernetes container cluster can be shared by multiple applications, if multiple applications use the same service account to access it, it is impossible to restrict the access permissions of each application at the application level, thereby ensuring the security of each application's access.

[0088] Second point: Limitations of strategy rules

[0089] Because the service account used in the Kubernetes container cluster is used as the access identity of the application, the access authentication rules are strongly associated with the resources in the Kubernetes container cluster (such as namespace, label, serviceaccount, etc.). This requires users to fully understand the application topology, application additional attributes and identity authentication policy specifications in the Kubernetes container cluster when configuring policies, which has a high learning cost and poor scalability.

[0090] In addition, this method does not support more granular authentication of the services provided by the application. For example, for certain internal interfaces with high security requirements provided by the application, only some internal applications are allowed to access them, without making more granular distinctions between the allowed applications.

[0091] Thirdly, the operation and maintenance are quite difficult.

[0092] To achieve access control for each application at the application level, a unique service account needs to be created for each application. This requires users to fully understand Istio's authentication and authorization mode. Furthermore, for some higher-level security requirements (such as using an external CA (Certificate Authority) or an external identity authentication service), a full understanding of Istio's external component access and maintenance methods is required. This makes the method unfavorable for operation and maintenance management and increases the complexity of access permission management.

[0093] Fourthly, the application environment is limited.

[0094] When using Istio as a provider of secure access to services, applications that need to access each other are all published in the same Istio environment. Applications published for different PaaS (Platform as a Service) platforms are not universal.

[0095] To address the problems existing in related technologies, this application provides an access control system. This system includes an application management platform. When an application is hosted, the application management platform creates a service proxy for the application and generates access identity information for the application, then sends the generated access identity information to the application. Upon detecting that an application has started, the service proxy obtains the access identity information corresponding to the application. When the application needs to access other applications, it injects the application's access identity information into the access message, thereby authenticating the application during access to other applications. When other applications need to access the application, it authenticates their access based on their access identity information. This application achieves non-intrusive injection of access identity information into outgoing traffic and intercepts ingoing traffic for authentication through a service proxy, ensuring the security of both ingoing and outgoing traffic. Furthermore, the application management platform supports configuring access authentication policies for applications based on service metadata provided by the access identity information, thereby controlling application access at the service interface and parameter levels. The configuration of access authentication policies also supports extending the service protocol types for access control. In addition, the method of this application is independent of infrastructure. As long as the underlying resources of the application can be managed by the application management platform, it can support application access policy management across PaaS platforms, across infrastructures, and across clouds, thus expanding the scope of application.

[0096] Figure 1 An access control system provided in an embodiment of this application is shown; see [link to relevant documentation]. Figure 1 The system includes an application management platform. This platform includes an authentication and authorization module, which provides identity authentication and authorization functions to the First Cloud service. This module mainly includes the application lifecycle control plane, the application identity authentication service access plane, and the application lifecycle control plane itself. The following sections will provide a detailed explanation of the application lifecycle control plane, the application identity authentication service access plane, and the application lifecycle control plane.

[0097] Lifecycle Control Plane: Once any application on the First Cloud Service is hosted on the application management platform, the Lifecycle Control Plane automatically creates a service proxy for that application. This service proxy can be a Sidecar container in a Kubernetes container cluster or a network proxy service on a cloud server. After creating the service proxy, the Lifecycle Control Plane can also generate access identity information for the application based on its application identifier (such as the application name) by calling a third-party identity authentication system and send this access identity information to the application. This access identity information is used to uniquely identify the application on the First Cloud Service and can be in the form of a token. Throughout the entire lifecycle of the application deployment, the Lifecycle Control Plane non-intrusively issues access identity information for the hosted application. This access identity information is stored in the application. After the application starts, the service proxy detects the application startup, retrieves the application's access identity information from the application, and injects this access identity information into the traffic (such as access packets) sent by the application when it accesses other applications or other cloud services. This access identity information can be injected via file mounting. Generally speaking, the access identity information obtained by the service proxy from the application is time-sensitive, and the service proxy needs to continuously maintain this access identity information to ensure its validity.

[0098] Application Identity Authentication Service Access Interface: This interface is responsible for connecting to various types of identity authentication systems, which are typically third-party. These systems include access control systems (such as IAM (Identity and Access Management)), identity authentication systems (OIDC Server), and certificate authorization systems (such as CA (Certificate Authority)). It can provide different authentication services to applications. The Application Identity Authentication Service Access Interface also supports providing default services hosted by the application management platform to users.

[0099] Application access control plane: This provides a policy configuration interface. Users can configure access authentication policies for applications, including whitelists / blacklists of allowed applications, whether to enable two-way communication authentication, and supported fine-grained access parameters (including service interfaces and parameters). Users can also update and delete configured access authentication policies. Depending on the type of access authentication service configured by the user, various identity authentication policies are supported, such as JWT (JSON Web Token) authentication, two-way communication authentication between applications (e.g., mTLS (Mutual Transport Layer Security) authentication), and authentication based on other IAM identity authentication systems.

[0100] like Figure 1 As shown, the application management platform hosts multiple applications, including Application 1 and Application 2. Application 1 and Application 2 have the same status; both can initiate access or be passively accessed. The service proxy created for Application 1 in the application lifecycle control plane is called the First Service Proxy, and the service proxy created for Application 2 is called the Second Service Proxy. The functions of the First Service Proxy and the Second Service Proxy are the same, and the functions of the service proxy will be described in detail below. The main functions of the service proxy in this application are as follows:

[0101] Request interception: It can intercept access messages entering the application and access messages sent by the application to achieve non-intrusive secure communication and permission verification for the application.

[0102] Identification and maintenance of access identity information: Responsible for identifying access identity information injected into the application by the application management platform, obtaining access identity information from the application, and continuously maintaining access identity information to ensure its validity.

[0103] Digital certificate application and rotation: Responsible for sending certificate application requests carrying access identity information to the application permission management control plane of the application management platform to support two-way secure communication between applications.

[0104] Subscription access authentication policy: Responsible for subscribing to the user's access authentication policy configured for the application on the application permission management control plane of the application management platform.

[0105] Permission verification: After receiving the access message sent by the application, the access permissions of the application are verified according to the subscribed access authentication policy.

[0106] In addition to the functions mentioned above, the service agent in this application also supports the following capabilities:

[0107] It has the ability to interact with the application management platform: Based on this interaction capability, it can obtain the access authentication policy configured on the application management platform for the current access identity information, as well as digital certificates, temporary access identity information for accessing other cloud services, etc.

[0108] Message interception capability: Based on this interception capability, access messages sent to applications and access messages sent by applications can be intercepted and modified. For example, when it is detected that an application is accessing the OpenAPI of other cloud services, the application's access message can be intercepted, and the application management platform can be obtained to obtain temporary access identity information. The obtained temporary access identity information can be injected into the intercepted access message, so that access to other cloud services can be achieved without AK / SK (Access Key ID / Secret Access Key).

[0109] Encrypted transmission function: It can provide a TLS encrypted communication port and support mTLS communication with the service proxy of the peer application.

[0110] based on Figure 1 The application lifecycle control plane of the application management platform configures access identity information for managed applications. It can control traffic flowing out of the application (e.g., access packets to other applications on the same cloud service), traffic flowing into the application (e.g., access packets to other applications on the same cloud service), and traffic from the application accessing other cloud services (e.g., access packets to other cloud services). The following will combine... Figure 2 Here is a detailed explanation of the access control scenarios for the above-mentioned traffic types:

[0111] The first scenario involves access control for traffic flowing out of the application.

[0112] See Figure 2 For application A and application B hosted on the application management platform, when application A needs to access application B, application A can send an access message for application B. Service proxy A, corresponding to application A, intercepts this access message and non-intrusively injects application A's access identity information into the intercepted access message. This injected access message is then sent to service proxy B, corresponding to application B. Service proxy B receives the access message from service proxy A and verifies application A's access identity information. Only after confirming that application A's access identity information is trustworthy will it continue to receive and process access messages.

[0113] The second scenario involves access control for traffic accessing other cloud services.

[0114] See Figure 2 For application A hosted on the application management platform, when application A needs to access other cloud services, it can send an access message for those services. Service proxy A, corresponding to application A, intercepts this message and, based on application A's access identity information, retrieves temporary access identity information from the application management platform. This temporary access identity information is time-sensitive, generated by the cloud service to be accessed, and obtained by the application management platform from that service based on application A's access identity information. Upon obtaining this temporary access identity information, service proxy A injects it into the intercepted access message, thus accessing other cloud services based on this injected temporary access identity information. Because the temporary access identity information can identify application A on the other cloud services, there is no need to configure AK / SK in plaintext, avoiding data leakage during AK / SK configuration and improving application access security. This access scenario can be used for... Figure 2The scenario of application A accessing cloud services as indicated by link 2.

[0115] The third scenario involves access control for traffic flowing into the application.

[0116] See Figure 2 For application A hosted on the application management platform, when other applications need to access application A, the service proxy A corresponding to application A receives the access message sent by the service proxy corresponding to the other application. If application A has configured an access authentication policy, the service proxy A determines whether the received access message is allowed based on the access authentication policy. If the access message is allowed, the service proxy A sends the access message to application A, thereby enabling access to application A.

[0117] An application embodiment provides an access control system, which may include an application management platform. This application management platform can... Figure 1 The application management platform shown has Figure 1 This illustrates all the functions of the application management platform. Multiple applications are hosted on this platform, including Application 1 and Application 2. When Application 1 is hosted on the platform, the application lifecycle control plane creates a first service proxy for Application 1 and generates first access identity information for it. This first access identity information is used to identify Application 1 on the first cloud service. The first access identity information is then sent to Application 1 for storage. When creating the first access identity information for Application 1, the application lifecycle control plane can obtain Application 1's application identifier (e.g., application name) and provide it to a third-party authentication system. The third-party authentication system processes the application identifier to obtain Application 1's first access identity information. Similarly, when Application 2 is hosted on the platform, the application lifecycle control plane creates a second service proxy for Application 2 and generates second access identity information for it. This second access identity information is used to identify Application 2 on the first cloud service. When the application lifecycle control plane creates second access identity information for a second application, it can obtain the application identifier of the second application (such as the application name), provide the application identifier of the second application to the third-party identity authentication system, and the third-party identity authentication system processes the application identifier of the second application to obtain the second access identity information of the second application.

[0118] Taking the first application as an example, the first service proxy corresponding to the first application will monitor the status of the first application in real time. Upon detecting that the first application has started, the first service proxy will obtain the first access identity information corresponding to the first application. When the first application needs to access a target object, it can send a first access message for the target object. After receiving the first access message sent by the first application, the first service proxy can generate a second access message based on the first access identity information and the first access message, and then send the second access message to the target object. The target object can be a second application on a first cloud service, or it can be a second cloud service itself, etc.

[0119] In another embodiment of this application, the application management platform also provides the ability to configure access authentication policies for hosted applications. Based on this capability, users can configure access authentication policies for hosted applications on the application management platform. Taking the first application as an example, after the first application is hosted, the application permission management control surface in the application management platform can provide a policy configuration interface. This policy configuration interface provides various controls for configuring access permissions for the first application. Based on these controls, users can configure whitelists / blacklists of allowed applications, whether to support bidirectional transmission authentication between applications, fine-grained access parameters, etc. Based on the user's configuration operations on the policy configuration interface, the first access authentication policy configured for the first application can be obtained. This first access authentication policy is used to indicate the access method and access permissions of the first application to the target object.

[0120] In another embodiment of this application, after the first service agent obtains the first access identity information corresponding to the first application, it will also send a policy query request to the application access control plane of the application management platform. The policy query request includes the first access identity information, etc. When the policy query request sent by the first service agent is received, the application access control plane verifies the first access identity information. If the first access identity information matches the first access identity information of the first application stored in the application management platform, it is determined that the first access identity information sent by the first service agent passes the verification. After the first access identity information passes the verification, the application access control plane obtains the first access authentication policy and sends the first access authentication policy to the first service agent.

[0121] In another embodiment of this application, if the first access authentication policy instructs the first application to support two-way communication authentication, after receiving the first access authentication policy, the first service agent will also send a certificate application request to the application permission management control plane of the application management platform. This certificate application request includes the first access identity information, etc. The application permission management control plane receives the certificate application request and, in response, verifies the first access identity information. When the first access identity information passes verification, it obtains the first digital certificate corresponding to the first application and then sends the first digital certificate to the first service agent. This first digital certificate is used to authenticate the communication method of the first application. When the application permission management control plane obtains the first digital certificate corresponding to the first application, it can send a certificate application request carrying the first access identity information to the certificate authority through the application identity authentication service access plane. In response to the certificate application request, the certificate authority generates a first digital certificate for the first application and sends the first digital certificate to the application identity authentication service access plane, which then sends it to the application permission management control plane. Finally, the application permission management control plane sends the first digital certificate to the first service agent.

[0122] In another embodiment of this application, when the target object is a second application on a first cloud service, after receiving the first access message, the first service agent can non-intrusively inject the first access identity information into the first access message to obtain the second access message.

[0123] In another embodiment of this application, when the target object is a second application on a first cloud service, the system further includes a second service proxy, which is a service proxy corresponding to the second application. When both the first and second applications support bidirectional communication authentication, the first service proxy can send a connection establishment request to the second service proxy. In response to the connection establishment request, the second service proxy provides the second digital certificate corresponding to the second application to the first service proxy. The first service proxy verifies the second digital certificate, and after successful verification, provides the first digital certificate to the second service proxy. After obtaining the first digital certificate, the second service proxy verifies it, and after successful verification, establishes a bidirectional transmission channel with the first service proxy. Then, the first service proxy uses the bidirectional transmission channel to send the second access message to the second service proxy. In this application, the first application has a built-in root certificate, which the first service proxy can obtain to verify the second digital certificate. The second application also has a built-in root certificate, which the second service proxy can also obtain to verify the first digital certificate. Compared to secure access links between applications, using a bidirectional transmission channel enhances transmission security.

[0124] Furthermore, if the second application does not support two-way communication authentication, or if the second application supports two-way communication authentication but the first digital certificate fails verification, or if the second application supports two-way communication authentication but the second digital certificate fails verification, then the first application and the second application will no longer use the service proxy to communicate, but will instead fall back to the secure access link based on the first access identity information.

[0125] In another embodiment of this application, when the second application is configured with a second access authentication policy, after receiving the second access message, the second service proxy will also verify whether the first application has access rights to the second application based on the second access authentication policy. If it is determined that the first application has access rights, the second access message will be sent to the second application. When verifying whether the first application has access rights to the second application, the second service proxy can obtain the access parameters of the first application from the second access message, and then determine whether the access parameters of the first application are access parameters supported by the second access authentication policy. If the access parameters of the first application are access parameters supported by the second access authentication policy, it is determined that the first application has access rights. Verifying the access rights of the application through the access authentication policy improves the security of application access. Moreover, the access authentication policy can be set at the parameter granularity, thus providing finer control granularity.

[0126] In another embodiment of this application, the target object may also be a second cloud service, which is a different cloud service from the first cloud service. When it is detected that the first application calls the service interface of the second cloud service and sends a first access message, the first service proxy receives the first access message and, after receiving the first access message, can send an identity information acquisition request to the application permission management control plane of the application management platform. The identity information acquisition request includes the first access identity information. After receiving the identity information acquisition request, the application permission management control plane of the application management platform obtains the temporary access identity information of the first application on the second cloud service based on the first access identity information, and sends the temporary access identity information to the first service proxy. The first service proxy receives the temporary access identity information and injects it into the first access message to obtain a second access message, and then sends the second access message to the second cloud service. When the application permission management control plane obtains the temporary access identity information of the first application on the second cloud service, it can apply for the temporary access identity information corresponding to the first access identity information from the connected identity permission management service interface (such as RAM) through the application identity authentication service access plane. The temporary access identity information has a certain time limit and is used to temporarily identify the identity of the first application on the second cloud service.

[0127] This application provides an access control method. Taking a second application as an example, the method can be executed by an application management platform, a first service proxy, and a second service proxy. See [link to documentation]. Figure 3 The method flow provided in this application embodiment includes:

[0128] 301. After the first application is hosted on the application management platform, the application management platform creates a first service agent for the first application and generates first access identity information, and sends the first access identity information to the first application.

[0129] In this embodiment, when an application instance is created for any application on the application management platform, that is, the application is hosted on the application management platform. After the application is hosted on the application management platform, the application lifecycle control plane of the application management platform automatically creates a service proxy for the application. Taking the first application as an example, when the first application is hosted on the application management platform, the application lifecycle control plane of the application management platform creates a first service proxy for the first application.

[0130] After creating the first service proxy for the first application, the application lifecycle control plane can also obtain the application identifier of the first application, such as the application name, and then call the third-party identity authentication system to generate the first access identity information for the first application, and then send the first access identity information to the first application.

[0131] 302. The application management platform provides a policy configuration interface. Based on the policy configuration interface, the first access authentication policy configured for the first application is obtained.

[0132] To provide finer-grained control over access to the first application, the application management platform's application permission management control plane will also provide a policy configuration interface. Based on this interface, users can configure a first access authentication policy for the first application. This policy instructs the first application on its access methods and permissions to the second application, including the whitelist / blacklist of allowed applications, whether to enable two-way communication authentication, and supported fine-grained access parameters (including service interfaces, service parameters, etc.). The application permission management control plane obtains the first access authentication policy configured by the user for the first application by detecting the user's configuration operations. Since the first access authentication policy is configured by the user, the user can expand the parameters and interfaces supported by the first application during the configuration process.

[0133] Furthermore, to facilitate subsequent applications, the application permission management control plane will also store the first access authentication policy corresponding to the first application. When storing the first access authentication policy, the application permission management control plane can store the first access identity information, application identifier, and the corresponding first access authentication policy of the first application.

[0134] It should be noted that steps 301 and 302 above are explained using the first application as an example. In fact, the above operations are performed on any application (including the second application) hosted on the application management platform, and will not be explained one by one here.

[0135] 303. When the first application is detected to be running, the first service agent obtains the first access identity information from the first application and sends a policy query request to the application management platform.

[0136] In this embodiment, the first service agent can monitor the status of the first application. Upon detecting that the first application has started, the first service agent can obtain the first access identity information from the first application. To control access to the first application, the first service agent will also send a policy query request to the application permission management control plane of the application management platform to query the first access authentication policy corresponding to the first application. The policy query request may include the first access identity information, application identifier, etc.

[0137] 304. Upon receiving a policy query request from the first service agent, the application management platform responds to the policy query request by verifying the first access identity information.

[0138] When a policy query request is received from the first service agent, the application permission management control plane of the application management platform can obtain the first access identity information of the first application stored in the first application based on the application identifier of the first application. Then, based on the first access identity information of the first application stored in the first application, the first access identity information carried in the policy query request is verified. If the first access identity information carried in the policy query request is consistent with the first access identity information of the first application stored in the first application, it is determined that the first access identity information carried in the policy query request has passed the verification.

[0139] 305. After the first access identity information is verified, the application management platform obtains the first access authentication policy corresponding to the first application and sends the first access authentication policy to the first service agent.

[0140] 306. Upon receiving the first access authentication policy, the first service agent, in accordance with the first access authentication policy instructing the first application to support two-way communication authentication, sends a certificate request to the application management platform.

[0141] Upon receiving the first access authentication policy, the first service agent can parse it to determine whether the first application supports two-way communication authentication. If the first access authentication policy indicates that the first application supports two-way communication authentication, it can send a certificate request to the application permission management control plane of the application management platform to obtain the first digital certificate corresponding to the first application. The certificate request may include first access identity information, etc. The first digital certificate is used to authenticate the communication method of the first application.

[0142] 307. Upon receiving a certificate application request from the first service agent, the application management platform responds to the certificate application request by obtaining the first digital certificate corresponding to the first application and sending the first digital certificate to the first service agent.

[0143] Upon receiving a certificate request from the first service agent, the application management control surface of the application management platform verifies the first access identity information carried in the certificate request. If the first access identity information is verified, it can send a certificate request carrying the first access identity information to the certificate authority through the application identity authentication service access surface. In response to this certificate request, the certificate authority generates a first digital certificate corresponding to the first application and sends the first digital certificate to the application identity authentication service access surface, which then forwards it to the application permission management control surface. Upon receiving the first digital certificate from the certificate authority, the application permission management control surface of the application management platform sends the first digital certificate to the first service agent.

[0144] It should be noted that steps 303 to 307 above are illustrated using the example of the first service agent obtaining the first access authentication policy and the first digital certificate. When other applications hosted on the application management platform are started, the corresponding service agents will also obtain the corresponding access authentication policies and digital certificates, which will not be explained in detail here.

[0145] 308. The first service agent receives the first access message sent by the first application for the second application, injects the first access identity information into the first access message, and obtains the second access message.

[0146] When the first application needs to access the second application, it can send a first access message for the second application. This first access message may include the first application's application identifier, etc. The first service proxy intercepts the first access message and directly injects the first access identity information into it, thus obtaining a second access message. Because the second access message contains the first access identity information, authentication and access permission checks can be performed during subsequent accesses.

[0147] 309. If both the first application and the second application support bidirectional communication authentication and both the first digital certificate and the second digital certificate are verified, the first service agent bidirectional transmission channel will send the second access message to the second service agent.

[0148] When both the first and second applications support bidirectional communication authentication, the first service proxy can send a connection establishment request to the second service proxy. In response, the second service proxy provides the second digital certificate corresponding to the second application to the first service proxy. The first service proxy verifies the second digital certificate, and upon successful verification, provides the first digital certificate to the second service proxy. After obtaining the first digital certificate, the second service proxy verifies it, and upon successful verification, establishes a bidirectional transmission channel with the first service proxy. The first service proxy then uses this bidirectional transmission channel to send the second access message to the second service proxy. In this application, the first application has a built-in root certificate, which the first service proxy can obtain to verify the second digital certificate. The second application also has a built-in root certificate, which the second service proxy can also obtain to verify the first digital certificate. Compared to secure access links between applications, using a bidirectional transmission channel enhances transmission security.

[0149] Furthermore, if the second application does not support two-way communication authentication, or if the second application supports two-way communication authentication but the first digital certificate fails verification, or if the second application supports two-way communication authentication but the second digital certificate fails verification, then the first application and the second application will no longer use the service proxy to communicate, but will instead fall back to the secure access link based on the first access identity information.

[0150] 310. If the second application has configured a second access authentication policy and the first application has access permissions to the second application, the second service agent will send the second access message to the second application.

[0151] When the second application is configured with a second access authentication policy, the second service proxy will determine whether the first application has access rights based on the second access authentication policy before sending the second access message to the second application. Once it is determined that the first application has access rights, the second access message will be sent to the second application. Specifically, when the second service proxy determines whether the first application has access rights based on the second access authentication policy, it can obtain the access parameters of the first application from the second access message, and then determine whether the access parameters of the first application are access parameters supported by the second access authentication policy. If the access parameters of the first application are access parameters supported by the second access authentication policy, then it is determined that the first application has access rights. Verifying application access rights through the access authentication policy improves the security of application access.

[0152] All of the above-mentioned optional technical solutions can be combined in any way to form the optional embodiments of this application, and will not be described in detail here.

[0153] This application provides an access control method. Taking a second cloud service as an example, the method can be executed by an application management platform, a first service proxy, and a second service proxy. See [link to documentation]. Figure 4 The method flow provided in this application embodiment includes:

[0154] 401. After the first application is hosted on the application management platform, the application management platform creates a first service agent for the first application and generates first access identity information, and sends the first access identity information to the first application.

[0155] The specific implementation method of this step is the same as that of step 301 above. Please refer to step 301 above for details, which will not be repeated here.

[0156] 402. The application management platform provides a policy configuration interface. Based on the policy configuration interface, the first access authentication policy configured for the first application is obtained.

[0157] The specific implementation method of this step is the same as that of step 302 above. Please refer to step 302 above for details, which will not be repeated here.

[0158] 403. When the first application is detected to be running, the first service agent obtains the first access identity information from the first application and sends a policy query request to the application management platform.

[0159] The specific implementation method of this step is the same as that of step 303 above. Please refer to step 303 above for details, which will not be repeated here.

[0160] 404. Upon receiving a policy query request from the first service agent, the application management platform responds to the policy query request by verifying the first access identity information.

[0161] The specific implementation method of this step is the same as that of step 304 above. Please refer to step 304 above for details, which will not be repeated here.

[0162] 405. After the first access identity information is verified, the application management platform obtains the first access authentication policy corresponding to the first application and sends the first access authentication policy to the first service agent.

[0163] The specific implementation method of this step is the same as that of step 305 above. Please refer to step 305 above for details, which will not be repeated here.

[0164] 406. Upon receiving the first access authentication policy, the first service agent, in accordance with the first access authentication policy instructing the first application to support two-way communication authentication, sends a certificate request to the application management platform.

[0165] The specific implementation method of this step is the same as that of step 306 above. Please refer to step 306 above for details, which will not be repeated here.

[0166] 407. Upon receiving a certificate application request from the first service agent, the application management platform responds to the certificate application request by obtaining the first digital certificate corresponding to the first application and sending the first digital certificate to the first service agent.

[0167] The specific implementation method of this step is the same as that of step 307 above. Please refer to step 307 above for details, which will not be repeated here.

[0168] 408. The first service agent receives the first access message for the second cloud service and sends an identity information acquisition request to the application management platform.

[0169] When the first application needs to access the second cloud service, the first application can send a first access message for the second cloud service. The first access message may include the application identifier of the first application, etc. The first service proxy intercepts the first access message and sends an identity information acquisition request to the application permission management control plane of the application management platform. The identity information acquisition request includes the first access identity information, etc.

[0170] 409. Upon receiving an identity information retrieval request from the first service agent, the application management platform obtains the temporary access identity information of the first application on the second cloud service based on the first access identity information, and sends the temporary access identity information to the first service agent.

[0171] Upon receiving an identity information retrieval request from the first service agent, the application permission management control plane of the application management platform obtains the temporary access identity information of the first application on the second cloud service based on the first access identity information, and sends the temporary access identity information to the first service agent. The second service agent receives the temporary access identity information and injects it into the first access message to obtain the second access message, which is then sent to the first cloud service. Specifically, when obtaining the temporary access identity information of the first application on the second cloud service, the application permission management control plane can apply for the temporary access identity information corresponding to the first access identity information from the connected identity and permission management service interface (such as RAM) through the application identity authentication service access plane. This temporary access identity information has a certain time limit and is used to temporarily identify the identity of the first application on the second cloud service.

[0172] 410. After receiving the temporary access identity information sent by the application management platform, the first service agent injects the temporary access identity information into the first access message to obtain the second access message, and sends the second access message to the second cloud service.

[0173] After receiving the temporary access identity information sent by the application permission management control plane of the application management platform, the first service agent injects the temporary access identity information into the first access message to obtain the second access message, and then sends the second access message to the second cloud service. Because the first access identity information is added to the second access message, identity authentication and access permission verification can be performed in subsequent accesses.

[0174] This application proposes a solution for application-level security policy control via an application management platform. The platform automatically generates access identity information for each application upon creation. This access identity information is used to identify the application during subsequent accesses, ensuring application access security. Furthermore, this access identity information is automatically generated, eliminating the need for user maintenance and reducing access control costs.

[0175] In addition, the application management platform of this application includes an application identity authentication service access surface that supports connection to various types of authentication service interfaces, and offers a variety of authentication methods.

[0176] In addition, the application management platform provides a unified entry point for identity authentication and permission policy configuration. Any application created on the PaaS platform or infrastructure managed and connected to the application management platform can use the solution in this application for access control.

[0177] In addition, applications hosted and deployed on the application management platform can configure authentication policies at the application level, as well as at the interface and parameter level, based on service metadata.

[0178] Please refer to Figure 5 It shows a schematic diagram of the structure of an access control device provided in an embodiment of this application, the device being disposed in Figure 1 In the first service agent of the system shown, the device can be implemented by software, hardware, or a combination of both, and can be all or part of the electronic device. The device includes:

[0179] The receiving module 501 is used to receive the first access message for the target object sent by the first application;

[0180] The generation module 502 is used to generate a second access message based on the first access identity information corresponding to the first application and the first access message, wherein the first access identity information is used to identify the identity of the first application on the first cloud service.

[0181] The sending module 503 is used to send the second access message to the target object.

[0182] In another embodiment of this application, the device further includes:

[0183] The acquisition module is used to acquire the first access identity information from the first application after the first application is detected to be launched. The first access identity information is sent to the first application by the application management platform after the first application is hosted.

[0184] In another embodiment of this application, the sending module is further configured to send a policy query request to the application management platform. The policy query request includes the first access identity information. The policy query request is used to request the application management platform to obtain and return the first access authentication policy after the first access identity information passes verification.

[0185] The receiving module is further configured to receive the first access authentication policy, which is used to indicate the access method and access permissions of the first application to the target object.

[0186] In another embodiment of this application, the first access authentication policy indicates that the first application supports two-way communication authentication. The sending module is further configured to send a certificate application request to the application management platform. The certificate application request includes the first access identity information. The certificate application request is used to request the application management platform to obtain and return the first digital certificate corresponding to the first application.

[0187] The receiving module is further configured to receive the first digital certificate sent by the application management platform, wherein the first digital certificate is used to authenticate the communication method of the first application.

[0188] In another embodiment of this application, the target object is a second application on the first cloud service, and the generation module is used to inject the first access identity information into the first access message to obtain the second access message.

[0189] In another embodiment of this application, the apparatus further includes:

[0190] The sending module is further configured to send a connection establishment request to the second service agent when both the first application and the second application support bidirectional communication authentication. The connection request is used to request the second service agent to return the second digital certificate corresponding to the second application.

[0191] The verification module is used to verify the second digital certificate;

[0192] The sending module is further configured to provide the first digital certificate to the second service agent after the second digital certificate has been verified, so that the second service agent can verify the first digital certificate;

[0193] The connection module is used to establish a bidirectional transmission channel with the first service agent after the first digital certificate has been verified.

[0194] The sending module is also used to send the second access message to the second service agent using the bidirectional transmission channel.

[0195] In another embodiment of this application, the target object is a second cloud service. The generation module is further configured to, after receiving the first access message, send an identity information acquisition request to the application management platform. The identity information acquisition request includes the first access identity information. The identity information acquisition request is used to request the application management platform to acquire and return temporary access identity information of the first application on the second cloud service. After receiving the temporary access identity information sent by the application management platform, the temporary access identity information is injected into the first access message to obtain the second access message. The temporary access identity information is used to temporarily identify the identity of the first application on the second cloud service.

[0196] Please refer to Figure 6 It shows a schematic diagram of the structure of an access control device provided in an embodiment of this application, wherein the device is disposed in Figure 1 In the application management platform of the system shown, this device can be implemented through software, hardware, or a combination of both, becoming all or part of the electronic device. The device includes:

[0197] The receiving module 601 is used to receive a policy query request sent by the first service agent. The policy query request is sent by the first service agent after obtaining the first access identity information from the first application. The policy query request includes the first access identity information of the first application, which is used to identify the identity of the first application on the first cloud service.

[0198] Verification module 602 is used to verify the first access identity information in response to the policy query request;

[0199] The acquisition module 603 is used to acquire the first access authentication policy corresponding to the first application after the first access identity information passes the verification. The first access authentication policy is used to indicate the access method and access permissions of the first application to the target object.

[0200] The sending module 604 is used to send the first access authentication policy to the first service proxy in order to control the first application's access to the target object.

[0201] In another embodiment of this application, the device further includes:

[0202] A module is created to create the first service proxy for the first application after the first application is hosted on the application management platform.

[0203] The generation module is used to generate the first access identity information;

[0204] The sending module is used to send the first access identity information to the first application.

[0205] In another embodiment of this application, the device further includes:

[0206] Provide a module for providing a policy configuration interface;

[0207] The acquisition module is further configured to acquire, based on the policy configuration interface, a first access authentication policy configured for the first application, wherein the first access authentication policy is used to indicate the access method and access permissions of the first application to the target object.

[0208] In another embodiment of this application, the receiving module is configured to receive a certificate request sent by the first service agent when the first access authentication policy indicates that the first application supports two-way communication authentication, wherein the certificate request includes the first access identity information;

[0209] The acquisition module is also configured to, in response to the certificate application request, acquire the first digital certificate corresponding to the first application;

[0210] The sending module is further configured to send the first digital certificate to the first service agent, wherein the first digital certificate is used to authenticate the communication method of the first application.

[0211] In another embodiment of this application, when the target object requested by the first application is a second cloud service, the receiving module is further configured to receive an identity information acquisition request sent by the first service agent, wherein the identity information acquisition request includes the first access identity information;

[0212] The acquisition module is also used to acquire temporary access identity information of the first application on the second cloud service based on the first access identity information;

[0213] The sending module is further configured to send the temporary access identity information to the second service agent, wherein the temporary access identity information is used to temporarily identify the identity of the first application on the second cloud service.

[0214] Please refer to Figure 7 It shows a schematic diagram of the structure of an access control device provided in an embodiment of this application, wherein the device is disposed in Figure 1 In the second service agent of the system shown, the device is implemented by software, hardware, or a combination of both, and becomes all or part of the electronic device. The device includes:

[0215] The receiving module 701 is used to receive a second access message sent by the first service agent. The second access message is injected with the first access identity information of the first application. The first access identity information is used to identify the identity of the first application on the first cloud service.

[0216] The sending module 702 is used to send the second access message to the second application.

[0217] In another embodiment of this application, where both the first application and the second application support bidirectional communication authentication, the device further includes:

[0218] The receiving module is also used to receive a connection establishment request sent by the first service agent;

[0219] The sending module is further configured to, in response to the connection establishment request, provide the second digital certificate corresponding to the second application to the first service agent, so that the first service agent can verify the second digital certificate, and after the second digital certificate is verified, provide the first digital certificate of the first application to the second service agent.

[0220] The verification module is used to verify the first digital certificate;

[0221] The connection module is used to establish a bidirectional transmission channel with the first service agent after the first digital certificate has been verified.

[0222] The receiving module is also configured to receive the second access message sent by the first service agent using a bidirectional transmission channel.

[0223] In another embodiment of this application, when the second application is configured with a second access authentication policy, the apparatus further includes:

[0224] The verification module is used to verify whether the first application has access rights to the second application based on the second access authentication policy.

[0225] The sending module is further configured to send the second access message to the second application when it is determined that the first application has access rights.

[0226] Figure 8 This diagram illustrates a structural block diagram of an electronic device 800 provided in an exemplary embodiment of this application. Typically, the electronic device 800 includes a processor 801 and a memory 802.

[0227] The processor 801 can be implemented in at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 801 may also include a main processor and a coprocessor; the main processor is a processor for processing data in the wake-up state, and the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 801 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 801 may also include an artificial intelligence processor for handling computational operations related to machine learning.

[0228] The memory 802 may include one or more computer-readable storage media, which may be non-transitory computer-readable storage media, such as CD-ROM (Compact Disc Read-Only Memory), ROM, RAM (Random Access Memory), magnetic tape, floppy disk, and optical data storage devices. The computer-readable storage medium stores at least one computer program, which, when executed, enables the implementation of an access control method.

[0229] Of course, the aforementioned electronic device may also include other components, such as input / output interfaces and communication components. Input / output interfaces provide an interface between the processor and peripheral interface modules, which can be output devices, input devices, etc. Communication components are configured to facilitate wired or wireless communication between the electronic device and other devices.

[0230] Those skilled in the art will understand that Figure 8The structure shown does not constitute a limitation on the electronic device 800, and may include more or fewer components than shown, or combine certain components, or use different component arrangements.

[0231] This application provides a computer-readable storage medium storing at least one computer program, which, when executed by a processor, can implement the above-described access control method.

[0232] This application provides a computer program product, which includes a computer program that, when executed by a processor, can implement the above-mentioned control method.

[0233] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0234] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. An access control system, characterized in that, The system includes an application management platform; The application management platform is used to create a first service proxy for the first application and generate first access identity information after the first application is hosted on the first cloud service, and send the first access identity information to the first application. The first access identity information is used to identify the identity of the first application on the first cloud service. The first service proxy is configured to obtain the first access identity information after detecting that the first application has started, and when it receives the first access message sent by the first application for the target object, generate a second access message based on the first access identity information and the first access message, and send the second access message to the target object.

2. The system according to claim 1, characterized in that, The application management platform is also used to provide a policy configuration interface after the first application is hosted, and to obtain a first access authentication policy configured for the first application based on the policy configuration interface. The first access authentication policy is used to indicate the access method and access permissions of the first application to the target object.

3. The system according to claim 2, characterized in that, The first service agent is also used to send a policy query request to the application management platform after obtaining the first access identity information, the policy query request including the first access identity information; The application management platform is also used to respond to the policy query request, verify the first access identity information, obtain the first access authentication policy after the first access identity information passes the verification, and send the first access authentication policy to the first service proxy.

4. The system according to claim 3, characterized in that, The first service agent is also used to send a certificate request to the application management platform when the first access authentication policy indicates that the first application supports two-way communication authentication. The certificate request includes the first access identity information. The application management platform is also used to respond to the certificate application request, obtain the first digital certificate corresponding to the first application, and send the first digital certificate to the first service agent. The first digital certificate is used to authenticate the communication method of the first application.

5. The system according to claim 4, characterized in that, The target object is a second application on the first cloud service, and the first service proxy is also used to inject the first access identity information into the first access message to obtain the second access message.

6. The system according to claim 5, characterized in that, The system further includes: a second service agent, which is the service agent corresponding to the second application; The first service proxy is also used to send a connection establishment request to the second service proxy when both the first application and the second application support two-way communication authentication; The second service agent is used to provide the second digital certificate corresponding to the second application to the first service agent in response to the connection establishment request; The first service agent is also used to verify the second digital certificate, and after the second digital certificate is verified, to provide the first digital certificate to the second service agent; The second service agent is also used to verify the first digital certificate, and after the first digital certificate is verified, to establish a bidirectional transmission channel with the first service agent; The first service agent is also used to send the second access message to the second service agent using the bidirectional transmission channel.

7. The system according to claim 6, characterized in that, If the second application is configured with a second access authentication policy, the second service proxy is also used to verify whether the first application has access rights to the second application based on the second access authentication policy. When it is determined that the first application has access rights, the second access message is sent to the second application.

8. The system according to claim 4, characterized in that, The target object is a second cloud service, and the first service agent is also used to send an identity information acquisition request to the application management platform after receiving the first access message. The identity information acquisition request includes the first access identity information. The application management platform is also used to, upon receiving the identity information acquisition request, obtain the temporary access identity information of the first application on the second cloud service based on the first access identity information, and send the temporary access identity information to the second service agent; The second service agent is also used to inject the temporary access identity information into the first access message to obtain the second access message, wherein the temporary access identity information is used to temporarily identify the identity of the first application on the second cloud service.

9. An access control method, characterized in that, The method is applied to a first service agent in the system according to any one of claims 1 to 8, the method comprising: Receive the first access message for the target object sent by the first application; Based on the first access identity information corresponding to the first application and the first access message, a second access message is generated, wherein the first access identity information is used to identify the identity of the first application on the first cloud service. The second access message is sent to the target object.

10. The method according to claim 9, characterized in that, Before generating the second access message based on the first access identity information corresponding to the first application and the first access message, the method further includes: Send a policy query request to the application management platform. The policy query request includes the first access identity information. The policy query request is used to request the application management platform to obtain and return the first access authentication policy after the first access identity information passes the verification. The first access authentication policy is received, which is used to indicate the access method and access permissions of the first application to the target object.

11. An access control method, characterized in that, The method is applied to the application management platform in any one of claims 1 to 8, and the method includes: The system receives a policy query request sent by the first service agent. The policy query request is sent by the first service agent after obtaining the first access identity information from the first application. The policy query request includes the first access identity information of the first application, which is used to identify the identity of the first application on the first cloud service. In response to the policy query request, the first access identity information is verified; After the first access identity information is verified, the first access authentication policy corresponding to the first application is obtained. The first access authentication policy is used to indicate the access method and access permissions of the first application to the target object. The first access authentication policy is sent to the first service proxy to control the first application's access to the target object.

12. The method according to claim 11, characterized in that, After sending the first access identity information to the first application, the method further includes: Provides a policy configuration interface; Based on the policy configuration interface, the first access authentication policy configured for the first application is obtained. The first access authentication policy is used to indicate the access method and access permissions of the first application to the target object.

13. An access control method, characterized in that, The method is applied to a second service agent in the system of claim 6 or 7, and the method includes: Receive a second access message sent by the first service agent. The second access message contains the first access identity information of the first application. The first access identity information is used to identify the identity of the first application on the first cloud service. The second access message is sent to the second application.

14. The method according to claim 13, characterized in that, If the second application is configured with a second access authentication policy, the step of sending the second access message to the second application further includes: Based on the second access authentication policy, verify whether the first application has access rights to the second application; Once it is determined that the first application has access rights, the second access message is sent to the second application.

15. An access control device, characterized in that, The device is disposed in the first service agent of the system according to any one of claims 1 to 8, the device comprising: The receiving module is used to receive the first access message for the target object sent by the first application; The generation module is used to generate a second access message based on the first access identity information corresponding to the first application and the first access message, wherein the first access identity information is used to identify the identity of the first application on the first cloud service. The sending module is used to send the second access message to the target object.

16. An access control device, characterized in that, The device is disposed in the application management platform of the system according to any one of claims 1 to 8, and the device comprises: The receiving module is configured to receive a policy query request sent by the first service agent. The policy query request is sent by the first service agent after obtaining the first access identity information from the first application. The policy query request includes the first access identity information of the first application, which is used to identify the identity of the first application on the first cloud service. The verification module is used to verify the first access identity information in response to the policy query request; The acquisition module is used to acquire the first access authentication policy corresponding to the first application after the first access identity information is verified. The first access authentication policy is used to indicate the access method and access permissions of the first application to the target object. The sending module is used to send the first access authentication policy to the first service proxy in order to control the first application's access to the target object.

17. An access control device, characterized in that, The device is disposed in the second service agent of the system of claim 6 or 7, the device comprising: The receiving module is used to receive a second access message sent by the first service agent. The second access message contains the first access identity information of the first application. The first access identity information is used to identify the identity of the first application on the first cloud service. The sending module is used to send the second access message to the second application.

18. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one computer program, which, when executed by a processor, is capable of implementing the access control method as described in claim 9 or 10, or the access control method as described in claim 11 or 12, or the access control method as described in claim 13 or 14.

19. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, can implement the access control method as described in claim 9 or 10, or the access control method as described in claim 11 or 12, or the access control method as described in claim 13 or 14.

Images