Access credential management and control method, device, system and equipment, computer program product and storage medium

Abstract

The embodiment of the invention provides an access credential management and control method, device, system and equipment, a computer program product and a storage medium. In the embodiment of the invention, different management and control devices are respectively associated with different application clusters, and for the management and control device associated with any application cluster, an acquisition request which is initiated in the application cluster and is used for acquiring an access credential is pre-processed by the management and control device associated with the application cluster, so that the access credential can be acquired by the management and control device associated with the application cluster. The management and control device can respond to part of the acquisition requests in the application cluster, and the part of the acquisition requests do not need to be responded by an access credential issuing system any more; moreover, different application clusters are respectively associated with different management and control devices, so that a multi-point pressure sharing architecture can be realized. The architecture not only can effectively share the request response pressure of an access credential issuing system, but also can avoid the problem of high concurrency of requests on a single point location, thereby ensuring the management efficiency on the single point location. Therefore, the management and control efficiency of the access credentials can be effectively improved.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to an access credential management method, apparatus, system, device, computer program product, and storage medium. Background Technology

[0002] With the rapid development of cloud-native technologies, more and more enterprises are choosing to apply container technology to their production environments. This rapid development has also created new security needs, such as how applications deployed in Kubernetes environments can securely obtain temporary access credentials for accessing cloud resources, avoiding security issues caused by the leakage of permanent access credentials.

[0003] To address this issue, applications currently need to request temporary access credentials from the cloud provider's Security Token Service (STS) based on the OpenID Connect (OIDC) protocol. The STS then issues temporary access credentials to the application, which can then use these credentials to access the necessary cloud resources.

[0004] However, this solution often leads to high concurrency issues on the STS, which cannot provide temporary access credentials to the application in a timely manner, resulting in low efficiency in the management of temporary access credentials and potentially causing application malfunctions. Summary of the Invention

[0005] This application provides a method, apparatus, system, device, computer program product, and storage medium for managing access credentials, thereby improving the efficiency of access credential management.

[0006] This application provides an access credential management method applicable to any one of multiple management devices, where different management devices are associated with different application clusters, including:

[0007] If any application in the associated application cluster initiates a first acquisition request, the first acquisition request is intercepted. The first acquisition request is used to request access credentials.

[0008] If the first acquisition request meets the credential issuance requirements, and an access credential is found for the application, the access credential is sent back to the application; if an access credential cannot be found for the application, a second acquisition request is sent to the access credential issuance system so that the access credential issuance system can issue an access credential for the application.

[0009] This application embodiment also provides a control device, which is any one of a plurality of control devices, and different control devices are associated with different application clusters. The control device includes an interception unit, a search unit, and a request unit.

[0010] The interception unit is used to intercept the first acquisition request when it detects that any application in the associated application cluster initiates a first acquisition request, the first acquisition request being used to request access credentials.

[0011] The search unit is configured to, if it determines that the first acquisition request meets the credential issuance requirements, and if an access credential is found for the application, then send the access credential back to the application.

[0012] The requesting unit is configured to send a second acquisition request to the access credential issuing system when it is impossible to find access credentials for the application, so as to issue access credentials for the application through the access credential issuing system.

[0013] This application also provides an access credential management system, including multiple management devices and an access credential issuance system. Different management devices are associated with different application clusters, and any one management device is used to execute the aforementioned access credential management method.

[0014] This application also provides a computing device, including: a memory, a processor, and a communication component;

[0015] The memory is used to store one or more computer instructions;

[0016] The processor is coupled to the memory and the communication component and is used to execute one or more computer instructions to perform the aforementioned access credential control method.

[0017] This application also provides a computer-readable storage medium for storing computer instructions, which, when executed by one or more processors, cause the one or more processors to perform the aforementioned access credential control method.

[0018] This application also provides a computer program product, including a computer program that, when executed by one or more processors, causes the one or more processors to execute the aforementioned access credential control method.

[0019] In this embodiment, a different management and control device is associated with each application cluster. Based on this, for any management and control device associated with an application cluster, if it detects a first request from any application within the cluster to obtain access credentials, it can intercept the first request. If the first request meets the credential issuance requirements, it searches for access credentials for the application. If an access credential is found, it is issued to the application. If no access credential is found, a second request is sent to the access credential issuance system to issue access credentials to the application. Accordingly, access requests for access credentials occurring within the application cluster are pre-processed by the management and control device associated with the application cluster. This allows the management and control device to respond to some access requests within the application cluster, eliminating the need for the access credential issuance system to respond to these requests. Furthermore, since different management and control devices are associated with different application clusters, a multi-point load-sharing architecture can be implemented. This architecture not only effectively distributes the request response pressure on the access credential issuance system but also avoids high concurrency issues at a single point, thus ensuring management efficiency at that single point. This can effectively improve the efficiency of managing access credentials. Attached Figure Description

[0020] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0021] Figure 1 A flowchart illustrating an access credential control method provided for an exemplary embodiment of this application;

[0022] Figure 2 A logical diagram illustrating an access credential control method provided for an exemplary embodiment of this application;

[0023] Figure 3 A logical schematic diagram of an access credential control method provided as another exemplary embodiment of this application;

[0024] Figure 4 A flowchart illustrating an access credential control method provided as another exemplary embodiment of this application;

[0025] Figure 5 A logical schematic diagram of an access credential control method provided as another exemplary embodiment of this application;

[0026] Figure 6 A flowchart illustrating an access credential control method provided as another exemplary embodiment of this application;

[0027] Figure 7 A schematic diagram of method logic in an exemplary application scenario provided as yet another exemplary embodiment of this application;

[0028] Figure 8 A schematic diagram of the structure of a control device provided as another exemplary embodiment of this application;

[0029] Figure 9 A schematic diagram of the structure of an access credential control system provided as another exemplary embodiment of this application;

[0030] Figure 10 This is a schematic diagram of the structure of a computing device provided as another exemplary embodiment of this application. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0032] Before proceeding with a detailed description of the technical solutions provided in the various embodiments of this application, the following is a brief explanation of several technical concepts involved in this application.

[0033] OpenID Connect (OIDC) is an authentication layer built on top of OpenAuthorization 2.0 (OAuth 2.0). OAuth 2.0 is an industry-standard protocol for authorization that defines a set of standards for obtaining and using access tokens to authorize access to protected resources on a user resource server. OIDC adds specific information and processes to OAuth 2.0, enabling it to be more than just an authorization protocol; it can also be used for user authentication, allowing client applications to obtain information about authenticated users and share this identity information across different websites and services.

[0034] A Kubernetes cluster is a collection of nodes that run containerized applications. These nodes can be physical servers or virtual machines, and together they form a distributed system for hosting and managing containerized applications. These nodes can be divided into master nodes and worker nodes. The master node is the control center of the Kubernetes cluster, responsible for the management and control of the entire cluster; the worker nodes are the nodes that run containers and applications. Worker nodes receive instructions from the master node and manage the Pods and containers on the node.

[0035] A cloud provider's Security Token Service (STS) is a service or component that provides temporary access credentials, allowing users or applications to securely access cloud resources using temporarily generated access credentials without directly using long-term keys.

[0036] Temporary access credentials are temporary identity credentials generated by an identity authentication and authorization service (such as STS) with a specific validity period and access permissions. They are used to verify the identity and permissions of an application when calculating signatures or accessing resources. For example, in a Kubernetes cluster, temporary access credentials can be assigned to each container group Pod, allowing each Pod to use the assigned temporary access credentials to access the cloud resources it needs.

[0037] During their research, the inventors discovered that current methods for applications to request access credentials typically involve sending a first retrieval request to the Service Provider Trust (STS) based on the OIDC protocol. The STS then provides the application with the necessary access credentials, enabling the application to access required cloud resources. However, when all applications in multiple application clusters under the same account send the first retrieval request to the STS, it can easily lead to excessive concurrency issues, preventing the STS from providing access credentials to the applications in a timely manner and resulting in inefficient access credential management.

[0038] Therefore, this embodiment proposes an access credential management scheme to improve the efficiency of access credential management.

[0039] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0040] Figure 1 This is a flowchart illustrating an access credential control method provided as an exemplary embodiment of this application. Figure 2This is a logical schematic diagram of an access credential management method provided for an exemplary embodiment of this application. The method can be executed by any one of the multiple management devices proposed in this embodiment. Different management devices can be associated with different application clusters. The management device can be implemented as a combination of software and / or hardware, and can be a computing cluster or a standalone server. (Reference) Figure 1 The method includes:

[0041] Step 100: If any application in the associated application cluster initiates a first acquisition request, the first acquisition request is intercepted. The first acquisition request is used to request access credentials.

[0042] Step 101: If the first acquisition request meets the credential issuance requirements, and if the application finds an access credential, then the access credential is sent back to the application.

[0043] Step 102: If access credentials cannot be found for the application, a second retrieval request is sent to the access credential issuing system to issue access credentials for the application through the access credential issuing system.

[0044] This embodiment proposes deploying separate management and control devices for different application clusters requiring services from the access credential issuance system. That is, one management and control device is deployed for each application cluster. Thus, this embodiment achieves a multi-point load-sharing architecture based on the management and control devices deployed separately for multiple application clusters. Each deployed management and control device can be understood as a single point of access.

[0045] It is understood that in this embodiment, a control device focuses on managing access credentials for its own associated application cluster, without interfering with the management of other application clusters. This embodiment does not limit the deployment method of the control device; several exemplary deployment schemes will be provided later, but will not be elaborated upon here.

[0046] In this embodiment, the application cluster is a computing cluster capable of automating a series of operations such as application deployment, scaling, and maintenance. The type of application cluster and the processing tasks it handles are not limited. For example, the type of application cluster in this embodiment may include the aforementioned Kubernetes cluster, and the processing tasks handled by the application cluster include, but are not limited to, Spark and gene workflow tasks. The access credential issuance system is a component used to issue temporary access credentials to applications. For example, the access credential issuance system in this embodiment may be the aforementioned STS.

[0047] During their research, the inventors discovered that many application clusters have high-concurrency requirements for processing tasks. That is, a single processing task needs to launch a large number of processing processes concurrently (for example, in a Kubernetes cluster, this means launching a large number of container pods), with concurrency reaching tens of thousands or even higher. As described in the background section, traditional solutions for such high-concurrency processing tasks require tens of thousands of concurrent requests to the access credential issuance system, leading to the high-concurrency problem on the access credential issuance system mentioned in the background section.

[0048] In this regard, the access credential management method proposed in this embodiment can particularly solve the problem of access credential management efficiency in the above-mentioned high-concurrency scenarios.

[0049] refer to Figure 1 In step 100, the control device can monitor first acquisition requests for access credentials occurring within the application cluster. Furthermore, if any application issues a first acquisition request, the control device can intercept that first acquisition request.

[0050] Thus, in this embodiment, any first acquisition request occurring within the application cluster can be intercepted by the control device.

[0051] For example, if the application cluster is a Kubernetes cluster, for any application, after receiving a processing task, the multiple Pods that need to be started will issue the aforementioned first acquisition request. In this embodiment, the management device can intercept the first acquisition requests issued by each Pod started by the processing task.

[0052] In this embodiment, the first acquisition request may be issued in accordance with the aforementioned Open Authentication Protocol (OIDC). Of course, this embodiment is not limited to this. Other protocols may also be used between the application and the control device to interact with the acquisition request, as long as both parties have a consistent understanding of the first acquisition request.

[0053] In step 101, the control device may first determine whether the first acquisition request meets the credential issuance requirements. Here, the control device will only search for access credentials for the application if it is determined that the first acquisition request meets the credential issuance requirements. If it is determined that the first acquisition request does not meet the credential issuance requirements, the control device will not need to search for access credentials for the application. In this case, optionally, the control device may return an issuance failure notification to the application, or the control device may directly refuse to continue responding to the first acquisition request. The handling scheme for this case is not limited here.

[0054] The credential issuance requirement can be used to verify the legitimacy of the first access request. Legitimacy indicates that the application represented by the first access request is genuine and that the application is qualified to request access credentials. Verification of legitimacy includes, but is not limited to, verifying the authenticity of the application's identity, the validity of the information contained in the first access request, and the completeness of the information contained in the first access request. If the first access request is determined to contain complete, valid, and authentic information, the first access request can be deemed legitimate, and the search for access credentials for the application can continue. The access credentials requested by the application are temporary identity credentials with an expiration date and access permissions, used to verify the application's identity and permissions when accessing cloud resources. Cloud resources refer to various resources needed and used in the cloud computing environment corresponding to the application, including but not limited to computing resources, storage resources, network resources, and database resources.

[0055] In this embodiment, the control device may pre-store some access credentials as the basis for the search operation performed by the control device in step 101. This embodiment does not limit the source or storage method of these access credentials. However, these access credentials in this embodiment may include access credentials required by the application.

[0056] Based on this, the search results can be divided into two categories: "access credentials found" and "access credentials not found". The following will explain these two categories respectively.

[0057] In one case, refer to Figure 1 In step 101, it is proposed that if access credentials are found for the application, the access credentials can be directly fed back to the application. In this way, the access credentials are found for the application by the control device, eliminating the need to request access credentials from the access credential issuing system, shortening the response time of the first acquisition request, and enabling the application to obtain the required access credentials in a timely manner.

[0058] In another case, refer to Figure 1 In step 102, it is proposed that if access credentials cannot be found for the application, a second retrieval request is sent to the access credential issuing system to issue access credentials for the application through the access credential issuing system.

[0059] An access credential issuance system is a component specifically designed to issue temporary access credentials, serving multiple application clusters. The system configures appropriate access permissions for each application within these clusters and generates temporary access credentials based on the permissions and their configured expiration dates. A temporary access credential is a credential that allows the system to grant a specified access permission to an application; it can be understood as a key for an application to obtain that permission. The system stores the association between applications and temporary access credentials. When the temporary access credential for any application expires, the system automatically generates a new one. This ensures that the system always associates access credentials with different applications, guaranteeing that it can issue appropriate access credentials to all applications within the application cluster it serves.

[0060] like Figure 2 As shown, the communication connection between the application cluster and the access credential issuance system allows the control device to send a second retrieval request to the access credential issuance system when it cannot find access credentials for the application. This second retrieval request can be issued in accordance with the aforementioned Open Authentication Protocol (OIDC). For example, a second retrieval request based on the OIDC protocol may include an OIDC Token, identity provider name, access role name, etc. However, this embodiment is not limited to this; other protocols can also be used for the interaction of retrieval requests between the application and the control device, as long as both parties have a consistent understanding of the second retrieval request. After receiving the second retrieval request, the access credential issuance system can issue appropriate access credentials for the application based on the stored association between the application and access credentials.

[0061] In summary, this embodiment proposes associating different management and control devices with different application clusters. Based on this, for any management and control device associated with an application cluster, if it detects a first request from any application within the cluster to obtain access credentials, it can intercept the first request. If the first request meets the credential issuance requirements, it searches for access credentials for the application. If an access credential is found, it is issued to the application. If no access credential is found, a second request is sent to the access credential issuance system to issue access credentials to the application. Accordingly, access credential requests occurring within the application cluster are pre-processed by the management and control device associated with the application cluster. This allows the management and control device to respond to some access requests within the application cluster, eliminating the need for the access credential issuance system to respond to these requests. Furthermore, since different management and control devices are associated with different application clusters, a multi-point load-sharing architecture can be implemented. This architecture not only effectively distributes the request and response pressure of the access credential issuance system, but also avoids high concurrency issues at a single point of failure, ensuring the efficiency of control at that point of failure, and thus effectively improving the efficiency of control over access credentials.

[0062] In the above or following embodiments, various implementation methods can be used to find access credentials for the application. The following provides an optional implementation method.

[0063] This alternative implementation introduces the concept of "access roles" to reduce the workload of configuring access permissions for a large number of applications. An access role is a virtual user; different access permissions are configured for different access roles, and access credentials are generated for each access role based on the configured access permissions to establish an association between the access role and the access credentials. Unlike applications, which are physical users, access roles need to be played by a trusted physical user. Once the role is successfully played, the physical user obtains the access credentials associated with the access role they are playing. Thus, there is no need to configure access permissions separately for each application; simply specifying the access role in the application's request is sufficient to obtain the access credentials associated with that role, thereby granting the application the access permissions corresponding to those credentials.

[0064] Based on this, when an application initiates its first access request, it can indicate the target access role it corresponds to in the first access request.

[0065] As mentioned earlier, the control device can pre-store some access credentials as a basis for lookup. In this optional implementation, these access credentials can be historical access credentials involved in responding to historical access requests; that is, historical access credentials are used as the basis for lookup. It is understood that these historical access credentials are associated with historical access requests, and the historical access requests indicate the access role corresponding to the application that initiated the historical access request. Therefore, each historical access credential can be labeled with its corresponding access role, and the control device will also store the corresponding access role for each historical access credential when storing these historical access credentials.

[0066] In this optional implementation, when the control device searches for access credentials for an application, it can parse the target access role corresponding to the application from the first acquisition request. Based on the target access role, a matching access credential can be found for the application from the stored historical access credentials. It is understood that each historical access credential pre-stored by the control device is associated with an access role. Based on this, a target historical access credential matching the target access role can be found according to the association between historical access credentials and access roles, and the found target historical access credential is determined as the access credential matching the application. The historical access credential can be stored in a preset storage space, which is a storage space associated with the application cluster. This preset storage space can be deployed inside or outside the control device, and its storage format includes, but is not limited to, hard drives, optical discs, and cloud storage.

[0067] By retrieving matching access credentials for applications from stored historical access credentials, the process of sending requests to the access credential issuance system and waiting for a response is eliminated, significantly reducing the time spent searching for access credentials and improving the efficiency of access credential management. Especially in large-scale task scenarios, where thousands of applications may simultaneously request the same access credential, pre-storing the required access credentials helps the access credential issuance system intercept thousands of requests, alleviating its management pressure and further improving access credential management efficiency.

[0068] It should be noted that access credentials are temporary credentials, valid only for a specified period. Access credentials retrieved from the stored historical access credentials may be expired and cannot be used. Therefore, after retrieving the target historical access credential associated with the target access role from the stored historical access credentials, the validity of the retrieved target historical access credential can be verified. For example, the timestamp carried by the target historical access credential can be used to determine whether the target historical access credential has expired. If it is determined that the target historical access credential has not expired, then it is identified as the access credential matching the application.

[0069] In practical applications, by checking whether the target historical access credentials have expired, expired access credentials can be avoided from being fed back to the application. This effectively prevents application anomalies caused by the inability to obtain the required cloud resources due to the use of expired access credentials. In this way, the accuracy of access credential issuance is improved, which can ensure the normal operation of the application.

[0070] Additionally, if the target historical access credential has expired, it can be removed from the stored historical access credentials. By cleaning up expired historical access credentials, the timeliness of the stored historical access credentials can be guaranteed. However, this cleanup method heavily relies on the initiation of the first acquisition request. When the frequency of the first acquisition request is low, it cannot promptly clean up expired historical access credentials and those no longer needed by the application.

[0071] To improve this issue, a validity period can be associated with each historical access credential when storing them. For any given historical access credential, it is monitored whether it is within its associated validity period. If it is detected that the historical access credential is not within its validity period, it is removed from the stored historical access credentials. By configuring validity periods for access credentials, expired access credentials can be proactively cleaned up, solving the problem of untimely cleanup caused by passively cleaning up expired access credentials through the first acquisition request. It also eliminates the step of checking whether the found historical access credentials have expired, thereby improving the efficiency and accuracy of access credential management.

[0072] Of course, when searching for access credentials for an application, the search method can be flexibly selected. For example, the application can also search for access credentials that match the account information carried in the first acquisition request. This embodiment is not limited to this, and no further examples will be given here.

[0073] In the above or following embodiments, various implementation methods can be used for the application to send a second acquisition request to the access credential issuance system.

[0074] In one alternative implementation, the control device may extract the application's identity information from the first acquisition request, the identity information indicating an access role; based on this, a second acquisition request is created based on the access role, and the second acquisition request is sent according to the access role indicated by the application.

[0075] In this optional implementation, the control device creates a new acquisition request for the application based on the first acquisition request, serving as the second acquisition request. As mentioned earlier, there is a correlation between access roles and access credentials. It can be understood that the access role is key to obtaining access credentials for the application, and the access role indicated in the identity information can be used to characterize the access credentials required by the application. Creating a second acquisition request based on the access role ensures that the second acquisition request accurately describes the access credentials required by the application. Furthermore, sending the second acquisition request to the access credential issuance system according to the access role indicated by the application demonstrates that the control device is sending the second acquisition request to the access credential issuance system using the application's identity; in essence, the control device is requesting access credentials from the access credential issuance system on behalf of the application.

[0076] In this way, the application sends a second retrieval request to the access credential issuance system using its own identity. The access credential issuance system is unaware of the reconstruction of the retrieval request and does not need to modify its internal logic. This allows the access credential issuance system to continue issuing access credentials to the application according to its original credential issuance logic. The credential issuance will not be affected by the change of the request initiator, which can effectively improve the accuracy of access credential control.

[0077] Of course, other implementation methods can also be used to send the second acquisition request to the access credential issuance system. For example, the first acquisition request can be directly used as the second acquisition request, while the first acquisition request is forwarded to the access credential issuance system. This embodiment does not limit the method of sending the second acquisition request, and no further examples will be given here.

[0078] As mentioned earlier, the control device can use historical access credentials as a basis for lookup. In this optional implementation, it is further proposed that after sending a second acquisition request to the access credential issuance system to request the issuance of an access credential, the device can also receive the access credential issued by the access credential issuance system in response to the second acquisition request, and feed the access credential back to the application as a response to the first acquisition request. Furthermore, the received access credential can be stored as a historical access credential, and the access role corresponding to the historical access credential can be marked. Technical details regarding storing historical access credentials can be found in the relevant descriptions in the foregoing embodiments, and will not be repeated here.

[0079] In this embodiment, various methods can be used to implement the feedback and storage of access credentials. For example, after receiving the access credential issued by the access credential issuing system for the application, the control device can first copy the received access credential, then send the received access credential to the application, and store the copied access credential in a preset storage space. Alternatively, the control device can directly store the received access credential in the preset storage space, and then retrieve the access credential from the preset storage space and send it to the application. The above are only two exemplary methods, and this embodiment is not limited to them, and will not be exhaustive.

[0080] In practical applications, access credentials issued by the access credential issuance system are stored as historical access credentials, and the access roles corresponding to these historical access credentials are marked. This serves two purposes: firstly, access roles can be used as indexes to support the lookup of access credentials, thereby effectively improving the efficiency of access credential lookup; secondly, it effectively adapts to existing access control mechanisms (Resource Access Management, RAM), ensuring that when applications use the obtained access credentials to access cloud resources, the access credentials comply with the requirements of existing access control mechanisms, thus guaranteeing that applications can access the required cloud resources without obstacles.

[0081] It is worth mentioning that when storing access credentials as historical access credentials, corresponding elimination conditions can also be configured for historical access credentials, so that the control device can promptly delete historical access credentials that meet the elimination conditions.

[0082] Optionally, a threshold for the duration of continuous idle time can be preset for historical access credentials. Based on this, for any historical access credential, if the duration of continuous idle time for the historical access credential exceeds the preset threshold, the historical access credential is cleared. The number of continuous idle time thresholds can be one or more. A uniform threshold can be preset for all historical access credentials, or a different threshold can be set for each historical access credential when storing them. This embodiment does not limit this approach.

[0083] Of course, other schemes can be used to configure the elimination conditions. For example, the cumulative idle time of historical access credentials can be used as the elimination condition, or the historical access credentials can be expired as the elimination condition. This embodiment does not limit this.

[0084] Therefore, by configuring a continuous idle time threshold for stored historical access credentials, unnecessary historical access credentials can be promptly removed from applications, preventing the retention of unnecessary access credentials. This not only reduces the storage pressure on historical access credentials but also reduces the workload required for control devices to search for access credentials, thereby improving the efficiency of access credential management.

[0085] In the above or below embodiments, various implementation methods can be used to determine whether the first acquisition request meets the credential issuance requirements.

[0086] In one optional determination method, the identity information carried in the first acquisition request can be obtained. Based on the target access role and validity period contained in the identity information, it can be determined whether the first acquisition request meets the credential issuance requirements. The identity information carried in the first acquisition request can be used to describe the identity of the application. This identity information includes, but is not limited to, validity period, target access role, and account information. The validity period characterizes the effective period of the identity information, the target access role characterizes the access role corresponding to the access credential requested by the application, and the account information characterizes the service account corresponding to the application cluster in which the application resides. The account information typically describes the application's service provider.

[0087] In this judgment method, if the identity information carried in the first acquisition request has expired, it indicates that the identity information has expired and the validity of the identity information cannot be guaranteed; if the target access role indicated in the identity information is inconsistent with the access role bound to the application, it indicates that the target access role contained in the first acquisition request is not the access role of the application, and may be stolen by the application from other applications, and the authenticity of the target access role cannot be guaranteed.

[0088] Therefore, if the identity information carried in the first acquisition request has expired and / or the target access role indicated in the identity information is inconsistent with the access role bound to the application, it indicates that the application represented by the first acquisition request is not genuine and the application is not qualified to request access credentials. The first acquisition request can be deemed illegitimate, that is, it can be determined that the first acquisition request does not meet the credential issuance requirements. In this case, the control device can return an issuance failure notification to the application, or the control device can directly refuse to continue responding to the first acquisition request. No specific handling method is specified for this situation.

[0089] If the identity information carried in the first acquisition request has not expired and the target access role indicated in the identity information is consistent with the access role bound to the application, it indicates that the application represented by the first acquisition request is real and the application is qualified to request access credentials. Therefore, the first acquisition request can be deemed legal, that is, it can be determined that the first acquisition request meets the credential issuance requirements.

[0090] It should be understood that this judgment method is merely exemplary, and this embodiment is not limited to it. As long as the legality of the first acquisition request can be verified, no further examples will be given here.

[0091] In practical applications, by determining whether the first access request meets the credential issuance requirements, requests that do not meet the requirements can be filtered out and identified as illegitimate. The control device intercepts all illegitimate requests, which not only helps the access credential issuance system alleviate the control pressure on the first access requests but also avoids responding to illegitimate requests, improving the efficiency and security of access credential control.

[0092] In addition, to further improve the efficiency of access credential management, after intercepting the first acquisition request, it can be checked whether the first acquisition request carries identity information. If it does not carry identity information, it indicates that the information contained in the first acquisition request is incomplete, and it can be directly determined that the first acquisition request does not meet the credential issuance requirements without further parsing of the identity information, thus reducing the workload of the judgment process and improving the efficiency of access credential management.

[0093] In the above or below embodiments, the control device may include a first interception component to intercept a first acquisition request initiated by any application within the application cluster.

[0094] Figure 3 This is a logical diagram illustrating an access credential control method as provided in another exemplary embodiment of this application. (See diagram below.) Figure 3 As shown, the management and control device includes a first interception component, which intercepts the first acquisition request when it detects any application initiating a first acquisition request. It should be noted that the management and control device including the first interception component is not limited to deployment within the application cluster; it can also be deployed outside the application cluster, as long as communication between the management and control device and the application cluster can be guaranteed. When the management and control device is located outside the application system, a load balancer can be built for the management and control device to improve the concurrent processing capability of the first interception component within the management and control device.

[0095] In this embodiment, the first interception component can be used to intercept and respond to the first acquisition request within the application cluster. The first interception component includes interception logic, lookup logic, and request logic. Based on the interception logic, the first interception component can intercept the first acquisition request if it detects that any application in the application cluster has initiated the first acquisition request. Based on the lookup logic, if it is determined that the first acquisition request meets the credential issuance requirements, it can search for access credentials for the application from its own storage space. Based on the request logic, if the access credentials cannot be found, it can send a second acquisition request to the access credential issuance system for the application, so that the access credential issuance system can issue access credentials for the application.

[0096] The specific implementation details of using the first interception component to find access credentials for the application can be found in the description of the control device finding access credentials for the application in the previous embodiments, and will not be repeated here.

[0097] Figure 4 This is a flowchart illustrating an access credential control method as provided in another exemplary embodiment of this application. Figure 4 As shown, after the first interception component intercepts the first acquisition request initiated by any application in the application cluster, the following steps can be performed to determine the access credentials for the application.

[0098] 1. Use the first interception component to determine whether the first acquisition request carries identity information;

[0099] 2. If no identity information is carried, the application is deemed not to meet the credential issuance requirements;

[0100] 3. If it carries identity information, the first interception component is used to determine whether the identity information has expired and whether the target access role indicated in the identity information is consistent with the access role bound to the application.

[0101] 4. If the identity information has expired and / or the target access role is inconsistent with the access role bound to the application, the application is determined to be non-compliant with the credential issuance requirements.

[0102] 5. If the identity information has not expired and the target access role is consistent with the access role bound to the application, then the application is determined to meet the credential issuance requirements, and the access credential is retrieved for the application from the storage space of the first interception component.

[0103] 6. If access credentials are found for the application, the access credentials are returned to the application so that the application can access the required cloud resources based on the access credentials;

[0104] 7. If access credentials cannot be found for the application, the first interception component sends a second acquisition request to the access credential issuing system to issue access credentials for the application through the access credential issuing system; the first interception component receives the access credentials provided by the access credential issuing system and feeds the access credentials back to the application so that the application can access the required cloud resources based on the access credentials.

[0105] It's worth noting that the first interception component also sends the second retrieval request to the access credential issuance system using the application's identity. The first interception component requests access credentials from the access credential issuance system on behalf of the application. Furthermore, after receiving the access credentials from the access credential issuance system, the first interception component can save the access credentials to its own storage space so that when it receives the same retrieval request subsequently, it can promptly retrieve the access credentials for the application from its own storage space.

[0106] Accordingly, in this embodiment, the first interception component is endowed with request interception capability and credential lookup capability. Based on this capability, the first interception component can intercept most of the first acquisition requests for the access credential issuance system, thereby alleviating the traffic pressure on the access credential issuance system. Furthermore, it can also find suitable access credentials for the application in a timely manner, thereby improving the management efficiency of access credentials.

[0107] In the above or below embodiments, the control device further includes a second interception component, which can be deployed on a service node within the application cluster.

[0108] Figure 5 This is a logical diagram illustrating an access credential control method as another exemplary embodiment of this application. Figure 5 As shown, the control device can be deployed within an application cluster, which contains multiple service nodes. The deployment locations of the control device and the service nodes within the application cluster are independent of each other. The control device includes multiple second interception components, which can extend outside the control device via wired or wireless means. Different second interception components can be deployed on different service nodes within the application cluster. The second interception components are used to intercept and respond to first acquisition requests initiated by their respective service nodes. The control device can monitor first acquisition requests initiated by any application on a service node through the second interception components, and intercept the first acquisition request when it is detected that any application on the service node where the second interception component is located initiates a first acquisition request. Of course, it is not necessary to deploy the second interception component on every service node; the second interception components can be flexibly deployed according to actual needs and node scale.

[0109] Similar to the first interception component, the second interception component also includes interception logic, lookup logic, and request logic. Based on the monitoring logic, the second interception component can intercept a first acquisition request if it detects that any application on its service node has initiated such a request. Based on the lookup logic, it can look up access credentials for the application if it determines that the first acquisition request meets the credential issuance requirements. However, the request logic in the second interception component is not entirely the same as that in the first interception component. If the second interception component cannot find access credentials for the application, it can send a third acquisition request to the first interception component to continue searching for access credentials for the application through the first interception component. The technical details of searching for access credentials through the first interception component can be found in the description of the first interception component in the foregoing embodiments, and will not be repeated here.

[0110] Figure 6 This is a flowchart illustrating an access credential control method as provided in another exemplary embodiment of this application. Figure 6 As shown, after the second interception component intercepts the first acquisition request issued by any application on its own service node, the following steps can be performed to determine the access credentials for the application.

[0111] 1. Use the second interception component to determine whether the first acquisition request carries identity information;

[0112] 2. If no identity information is carried, the application is deemed not to meet the credential issuance requirements;

[0113] 3. If it carries identity information, the second interception component is used to determine whether the identity information has expired and whether the target access role indicated in the identity information is consistent with the access role bound to the application.

[0114] 4. If the identity information has expired and / or the target access role is inconsistent with the access role bound to the application, the application is determined to be non-compliant with the credential issuance requirements.

[0115] 5. If the identity information has not expired and the target access role is consistent with the access role bound to the application, then the application is determined to meet the credential issuance requirements, and the access credentials for the application are retrieved from the storage space of the second interception component.

[0116] 6. If the access credentials are found for the application in the storage space of the second interception component, the access credentials are sent back to the application using the second interception component;

[0117] 7. If the access credentials for the application cannot be found in the storage space of the second interception component, the second interception component sends a third retrieval request to the first interception component to retrieve the access credentials for the application from the storage space of the first interception component.

[0118] 8. If the access credentials for the application are found in the storage space of the first interception component, the access credentials are sent back to the second interception component so that the second interception component sends the access credentials back to the application.

[0119] 9. If the access credentials for the application cannot be found in the storage space of the first interception component, the first interception component sends a second acquisition request to the access credential issuance system to issue access credentials for the application through the access credential issuance system.

[0120] 10. The first interception component receives the access credentials provided by the access credential issuing system and sends the access credentials back to the second interception component, so that the second interception component sends the access credentials back to the application.

[0121] It's worth noting that the first interception component sends a second retrieval request to the access credential issuance system using the application's identity, and the second interception component also sends a third retrieval request to the first interception component using the application's identity. In other words, both the first and second interception components request access credentials on behalf of the application. Furthermore, the first interception component can save the access credentials returned by the access credential issuance system to its own storage space, and the second interception component can save the access credentials returned by the first interception component to its own storage space. The second interception component can then return the access credentials to the application, allowing the application to access the necessary cloud resources based on those credentials.

[0122] Optionally, a monitoring service and monitoring interface can be deployed on the service node for the second interception component. Based on this, any application on the service node can be monitored through the monitoring service. If any user initiates a first acquisition request, the second interception component can be triggered to intercept the first acquisition request, and the first acquisition request issued by the application can be sent to the second interception component through the monitoring interface.

[0123] By configuring a separate monitoring service and interface for each service node, access credentials can be controlled simultaneously for multiple service nodes, improving the efficiency of access credential management. Furthermore, using different monitoring interfaces for different service nodes ensures that initial retrieval requests from different service nodes do not interfere with each other, improving the accuracy of access credential management.

[0124] In summary, in this embodiment, deploying the second interception component on a service node basis can help the first interception component share the interception burden, allowing the first acquisition request to be processed in a timely manner, thereby improving the efficiency of access credential management. When the second interception component cannot find the access credential, the first interception component is used first to find the access credential for the application, reducing the management burden on the access credential issuance system and further improving the efficiency of access credential management.

[0125] Figure 7 This is a schematic diagram illustrating the method logic in an exemplary application scenario, as provided in yet another exemplary embodiment of this application. (Reference) Figure 7 In this exemplary application scenario, the application cluster uses a Kubernetes cluster, the access permission issuance system uses a Security Token Service (STS), and multiple Pods are deployed for each application within the Kubernetes cluster. A first interception component is deployed at the traffic ingress and egress points of the Kubernetes cluster, and a second interception component is deployed on each service node within the Kubernetes cluster.

[0126] Based on this, the following example, using a request issued by Pod1 in a Kubernetes cluster, illustrates the implementation process of the access credential management method provided in this embodiment:

[0127] 1. Pod1 on service node A sends Request 1;

[0128] 2. The second interception component on service node A intercepts request 1;

[0129] 3. The second interception component checks whether the request 1 carries an OIDC Token. If an OIDC Token exists, it extracts the validity period information, OIDC Issuer information, Token signature information, etc. from the OIDC Token to further check the legality of the OIDC Token.

[0130] 4. If the OIDC Token is determined to be invalid, the current request will be terminated, and a termination signal will be sent to Pod1.

[0131] 5. If the OIDC Token is found to be valid, extract the corresponding service account information from the OIDC Token and parse out the other access credential-related parameters from request 1.

[0132] 6. Check the storage space of the second interception component to see if there is an expired access credential that matches the service account information and the parameters related to the access credential.

[0133] 7. If the credentials exist, the second interception component will send the found access credentials back to Pod1;

[0134] 8. If it does not exist, the second interception component constructs Request 2 based on the OIDC Token and access credential parameters, and sends Request 2 to the first interception component;

[0135] 9. The first interception component searches its storage space for an unexpired access credential that matches the service account information and the parameters related to the access credential.

[0136] 10. If it exists, the first interception component will send the found access credentials to the second interception component. The second interception component will store the access credentials in its own storage space and send the access credentials back to Pod1.

[0137] 11. If it does not exist, the first interception component constructs Request 3 based on the OIDC Token and access credential related parameters, and sends Request 3 to STS so that STS can issue access credentials for Pod1.

[0138] 12. The first interception component receives the access credential issued by STS, stores the access credential in its own storage space, and sends the access credential back to the second interception component. The second interception component stores the access credential in its own storage space and sends the access credential back to Pod1.

[0139] In this exemplary application scenario, based on the first and second interception components provided in this embodiment, the following technical effects can be achieved:

[0140] 1. By deploying a first interception component for each application cluster, a multi-point pressure-sharing architecture can be achieved. This architecture can not only effectively distribute the request and response pressure of the access credential issuance system, but also avoid high concurrency issues on a single point, thereby ensuring the efficiency of access credential management.

[0141] 2. Deploy a second interception component for each service node within the application cluster. The second interception component can further reduce the request and response pressure on the first interception component, enabling the application to determine access credentials more quickly, thereby improving the efficiency of access credential management.

[0142] 3. Both the first and second interception components have added OIDC Token verification. Only after successful verification will the access credential be retrieved from the storage space. This can effectively prevent the leakage of access credentials and ensure the security of access credentials. If the verification fails, the request response will be terminated directly to avoid wasting STS service resources due to receiving a large number of invalid requests.

[0143] It should be noted that the execution subject of each step of the method provided in the above embodiments can be the same device, or the method can be executed by different devices. For example, the execution subject of steps 100 to 102 can be device A; or the execution subject of steps 100 and 101 can be device A, and the execution subject of step 102 can be device B; and so on.

[0144] Furthermore, in some of the processes described in the above embodiments and accompanying drawings, multiple operations appear in a specific order. However, it should be clearly understood that these operations may not be executed in the order they appear in this document, or they may be executed in parallel. The operation numbers, such as 100, 101, etc., are merely used to distinguish different operations and do not represent any execution order. Additionally, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel. It should be noted that the descriptions such as "first" and "second" in this document are used to distinguish different messages, devices, modules, etc., and do not represent a sequential order, nor do they limit "first" and "second" to different types.

[0145] Figure 8 This is a schematic diagram of a control device provided as another exemplary embodiment of this application. (See diagram below.) Figure 8 As shown, the dedicated control device is associated with the application cluster, and the control device includes an interception unit, a search unit, and a request unit;

[0146] The interception unit is used to intercept the first acquisition request when it is detected that any application in the application cluster initiates the first acquisition request. The first acquisition request is used to request access credentials.

[0147] The lookup unit is used to look up access credentials for the application when it is determined that the first acquisition request meets the credential issuance requirements, and to return the access credentials to the application when they are found.

[0148] The request unit is used to send a second acquisition request to the access credential issuing system when the access credential cannot be found for the application, so as to issue access credential for the application through the access credential issuing system.

[0149] In this embodiment, the control device used is any one of multiple control devices, and different control devices can be associated with different application clusters.

[0150] In an optional embodiment, the interception unit may include a first interception module, and the interception unit is further configured to intercept the first acquisition request when the first interception module detects that any application in the application cluster has initiated a first acquisition request.

[0151] In an optional embodiment, the interception unit may include a second interception module. The application cluster associated with the control device includes service nodes. The interception unit is further configured to intercept the first acquisition request when the second interception module detects that any application on the service node associated with the second interception module initiates a first acquisition request.

[0152] In an optional embodiment, the interception unit may include a first interception module and a second interception module. The interception unit is further configured to: intercept the first acquisition request when the second interception module detects that any application on the service node associated with the second interception module initiates a first acquisition request; and if the first acquisition request meets the credential issuance requirements, search for access credentials for the application; if the second interception module cannot find access credentials for the application, then send a third acquisition request to the first interception module using the second interception module, so that the first interception module can continue to search for access credentials for the application.

[0153] It is worth noting that the technical details of the various embodiments of the control device mentioned above can be found in the description of the control device in the foregoing method embodiments. To save space, they will not be repeated here, but this should not cause any loss to the scope of protection of this application.

[0154] Figure 9 This is a schematic diagram of the structure of an access credential management system provided as another exemplary embodiment of this application. For example... Figure 9 As shown, the access credential management system includes multiple management devices and an access credential issuance system. Different management devices are associated with different application clusters, and any management device can execute the steps in the above method embodiments. For technical details regarding the various embodiments of the management devices, please refer to the relevant descriptions of the management devices in the foregoing method embodiments. To save space, these details are not repeated here, but this should not diminish the scope of protection of this application.

[0155] Figure 10 This is a schematic diagram of the structure of a computing device provided as another exemplary embodiment of this application. For example... Figure 10 As shown, the computing device includes: a memory 10, a processor 11, and a communication component 12.

[0156] Processor 11, coupled to memory 10, is used to execute computer programs in memory 10 for:

[0157] If the communication component 12 detects that any application in the application cluster served by the computing device initiates a first acquisition request, the first acquisition request is used to request access credentials.

[0158] If the first retrieval request meets the credential issuance requirements, and an access credential is found for the application, the access credential is sent back to the application; if an access credential cannot be found for the application, a second retrieval request is sent to the access credential issuance system to issue an access credential for the application through the access credential issuance system.

[0159] In an optional embodiment, during the process of looking up access credentials for the application, processor 11 is further configured to:

[0160] From the first retrieval request, parse the target access role corresponding to the application;

[0161] Based on the target access role, the application searches for matching access credentials from the stored historical access credentials.

[0162] In an optional embodiment, during the process of searching for a matching access credential for the application from the stored historical access credentials based on the target access role, the processor 11 is further configured to:

[0163] From the stored historical access credentials, find the target historical access credentials associated with the target access role;

[0164] If the target historical access credential has not expired, the target historical access credential will be identified as the access credential that matches the application.

[0165] In an optional embodiment, during the process of the application sending a second acquisition request to the access credential issuance system, the processor 11 is further configured to:

[0166] Extract the application's identity information from the first retrieval request; the identity information indicates the access role.

[0167] Based on the identity information, a second access request is created to send the second access request according to the access role indicated by the application.

[0168] In an optional embodiment, the processor 11 is further configured to:

[0169] Receive the access credential issued by the access credential issuing system in response to the second acquisition request;

[0170] The access credentials are sent back to the application as a response to the first access request;

[0171] Store the access credentials as historical access credentials and mark the access role corresponding to the historical access credentials.

[0172] In an optional embodiment, the processor 11 is further configured to:

[0173] For any historical access credential, if the continuous idle time of the historical access credential has exceeded the preset continuous idle time threshold, the historical access credential will be cleared.

[0174] In an optional embodiment, the processor 11 includes a first interception component. During the process of intercepting the first acquisition request upon detecting that any application initiates a first acquisition request, the processor 11 is further configured to:

[0175] The first interception component intercepts the first retrieval request when it detects that any application has initiated the first retrieval request.

[0176] In an optional embodiment, a second interception component is deployed on the service nodes included in the application cluster. The second interception component is used to intercept the first acquisition request when it detects that any application on its own service node initiates a first acquisition request, and to look up access credentials for the application. The processor 11 is further used to:

[0177] If the second interception component fails to find access credentials for the application, it will continue to search for access credentials for the application.

[0178] In one optional embodiment, a monitoring service is deployed for the second interception component. When the monitoring service detects that any application on its service node initiates a first acquisition request, the second interception component intercepts the first acquisition request.

[0179] In an optional embodiment, the processor 11 is further configured to:

[0180] If the identity information carried in the first acquisition request has not expired and the target access role indicated in the identity information is consistent with the access role bound to the application, then the first acquisition request is determined to meet the credential issuance requirements.

[0181] Furthermore, such as Figure 10 As shown, the computing device also includes other components such as a power supply component 13. Figure 10 The diagram only shows some components and does not mean that the computing device includes only these components. Figure 10 The components shown.

[0182] It is worth noting that the technical details of the above embodiments of the computing device can be found in the descriptions of the operation of the computing device in the aforementioned embodiments of the access credential control method. To save space, these details will not be repeated here, but this should not cause any loss to the scope of protection of this application.

[0183] Accordingly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed, can implement the steps in the above method embodiments.

[0184] Accordingly, this application also provides a computer program product, which contains a computer program that, when executed, can perform the steps in the above method embodiments.

[0185] The above Figure 10 The memory in a computer is used to store computer programs and can be configured to store various other data to support operation on a computing platform. Examples of this data include instructions for any application or method operating on the computing platform, contact data, phone book data, messages, pictures, videos, etc. The memory can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disks, or optical disks.

[0186] The above Figure 10 The communication component is configured to facilitate wired or wireless communication between the device containing the communication component and other devices. The device containing the communication component can access wireless networks based on communication standards, such as WiFi, 2G, 3G, 4G / LTE, 5G, or combinations thereof. In one exemplary embodiment, the communication component receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, the communication component further includes a Near Field Communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID), Infrared Data Association (IrDA) technology, Ultra-Wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0187] The above Figure 10 The power supply component provides power to the various components of the device in which it resides. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which it resides.

[0188] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0189] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0190] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0191] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0192] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0193] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0194] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0195] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0196] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0197] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for controlling access credentials, characterized in that, The method is applicable to any one of multiple control devices, where different control devices are associated with different application clusters. The method includes: If any application in the associated application cluster initiates a first acquisition request, the first acquisition request is intercepted. The first acquisition request is used to request access credentials. If the first acquisition request meets the credential issuance requirements, and an access credential is found for the application, then the access credential is issued to the application. If no access credentials can be found for the application, a second retrieval request is sent to the access credential issuing system to issue access credentials for the application through the access credential issuing system.

2. The method according to claim 1, characterized in that, Finding access credentials for the application includes: From the first acquisition request, parse the target access role corresponding to the application; Based on the target access role, a matching access credential is found for the application from the stored historical access credentials.

3. The method according to claim 2, characterized in that, Based on the target access role, the application is searched for a matching access credential from the stored historical access credentials, including: From the stored historical access credentials, find the target historical access credentials associated with the target access role; If the target historical access credential has not expired, then the target historical access credential is determined to be an access credential that matches the application.

4. The method according to claim 1, characterized in that, Sending a second acquisition request to the access credential issuance system for the application includes: Extract the application's identity information from the first acquisition request, the identity information indicating an access role; Based on the identity information, a second acquisition request is created to send the second acquisition request according to the access role indicated by the application.

5. The method according to claim 4, characterized in that, Also includes: Receive the access credential issued by the access credential issuance system in response to the second acquisition request; The access credentials are sent back to the application as a response to the first acquisition request; The access credentials are stored as historical access credentials, and the access role corresponding to the historical access credentials is marked.

6. The method according to claim 5, characterized in that, Also includes: For any historical access credential, if the continuous idle time of the historical access credential has exceeded a preset continuous idle time threshold, then the historical access credential is cleared.

7. The method according to claim 1, characterized in that, The control device includes a first interception component, which, upon detecting that any application within the application cluster initiates a first acquisition request, intercepts the first acquisition request, including: The first interception component intercepts the first acquisition request when it detects that any application in the application cluster initiates a first acquisition request.

8. The method according to claim 1, characterized in that, The control device includes a second interception component, which is deployed on a service node in the application cluster. Upon detecting that any application within the application cluster initiates a first acquisition request, the second interception component intercepts the first acquisition request, including: When the second interception component detects that any application on the service node where the second interception component is located initiates a first acquisition request, it intercepts the first acquisition request.

9. The method according to claim 8, characterized in that, The control device includes a first interception component for finding access credentials for the application, including: The second interception component is used to find access credentials for the application; If access credentials cannot be found for the application, a third retrieval request is sent from the second interception component to the first interception component so that the first interception component can continue to search for access credentials for the application.

10. The method according to claim 8, characterized in that, A monitoring service is deployed for the second interception component. When the second interception component detects that any application on its service node initiates a first acquisition request, it intercepts the first acquisition request, including: The monitoring service monitors any application on its service node. If any user initiates a first retrieval request, the second interception component is triggered to intercept the first retrieval request.

11. The method according to claim 1, characterized in that, Also includes: If the identity information carried in the first acquisition request has not expired and the target access role indicated in the identity information is consistent with the access role bound to the application, then the first acquisition request is determined to meet the credential issuance requirements.

12. A control device, characterized in that, The control device is any one of multiple control devices, and different control devices are associated with different application clusters. The control device includes an interception unit, a search unit, and a request unit. The interception unit is used to intercept the first acquisition request when it detects that any application in the associated application cluster initiates a first acquisition request, the first acquisition request being used to request access credentials. The search unit is configured to, if it determines that the first acquisition request meets the credential issuance requirements, and if an access credential is found for the application, then send the access credential back to the application. The requesting unit is configured to send a second acquisition request to the access credential issuing system when it is impossible to find access credentials for the application, so as to issue access credentials for the application through the access credential issuing system.

13. An access credential control system, characterized in that, It includes multiple control devices and an access credential issuance system, with different control devices associated with different application clusters, and any one control device is used to execute the access credential control method according to any one of claims 1-11.

14. A computing device, characterized in that, Includes memory, processor, and communication components; The memory is used to store one or more computer instructions; The processor is coupled to the memory and the communication component and is used to execute one or more computer instructions for performing the access credential management method according to any one of claims 1-11.

15. A computer-readable storage medium for storing computer instructions, characterized in that, When the computer instructions are executed by one or more processors, the one or more processors perform the access credential management method according to any one of claims 1-11.

16. A computer program product, characterized in that, The method includes a computer program, wherein when the computer program is executed by a processor, the processor is caused to perform the access credential control method according to any one of claims 1-11.

Images