Public cloud access method, device, system, equipment, medium and program product

Abstract

The embodiment of the invention discloses a public cloud access method, device, system and equipment, a medium and a program product, relates to the technical field of data transmission, and improves the security of public cloud access. The method comprises the following steps: in response to a received credential acquisition request of a service identity to a target cloud, downloading an access credential corresponding to the service identity from a management station of the target cloud; the access credential corresponding to the service identity is used for the target cloud to authenticate the client corresponding to the service identity; uploading the access credential to a storage device; the storage device is used for sending configuration information to a client corresponding to the service identity after the access credential is stored, and the configuration information is used for indexing and determining the access credential corresponding to the service identity from the storage device; and the client corresponding to the service identity is used for obtaining the access credential corresponding to the service identity from the storage device through the configuration information, sending the access credential to the target cloud to apply for authentication, and accessing the target cloud after the authentication of the target cloud is passed.

Description

Technical Field

[0001] This application relates to the field of data transmission technology, and in particular to public cloud access methods, apparatus, systems, devices, media, and program products. Background Technology

[0002] Currently, public cloud refers to cloud services provided by third-party providers to users. Different providers offer cloud resources and computing power to tenants. Tenants can use allocated cloud servers to connect their businesses to the internet. After logging into the public cloud's management console, tenants can download their access credentials from the relevant page and save them locally. To access the allocated cloud servers, the tenant's client can send an access request to the public cloud by calling the OpenAPI (Open Application Programming Interface). This request includes the access credentials downloaded from the public cloud's management console. The public cloud authenticates and authorizes the client based on the received access request. If authentication is successful, the client can run the corresponding business processes through the public cloud.

[0003] In related technologies, the process of downloading access credentials by logging into the public cloud management console by tenants involves manual operation, which poses a significant risk of access credential leakage or loss. This can lead to security issues when tenants subsequently log into the client to access the public cloud due to leaked or lost access credentials. Summary of the Invention

[0004] This application provides a public cloud access method, apparatus, system, device, medium, and program product, which improves the security of public cloud access.

[0005] Firstly, this application provides a public cloud access method, executed by a management device, comprising: in response to receiving a credential acquisition request from a service identity for a target cloud, downloading access credentials corresponding to the service identity from the management console of the target cloud; the access credentials corresponding to the service identity being used by the target cloud to authenticate the client corresponding to the service identity; uploading the access credentials to a storage device; the storage device being used to send configuration information to the client corresponding to the service identity after storing the access credentials, the configuration information being used to index and determine the access credentials corresponding to the service identity from the storage device; the client corresponding to the service identity being used to obtain the access credentials corresponding to the service identity from the storage device through the configuration information, and then requesting authentication by sending the access credentials to the target cloud, and accessing the target cloud after successful authentication by the target cloud.

[0006] Understandably, the management device downloads the access credentials corresponding to the service identity from the target cloud and stores them on a storage device. Clients with the service identity can then retrieve these credentials from the storage device. These credentials are used by the target cloud to authenticate the client before accessing it. The client can then send an access request containing the credentials to the target cloud. After successful authentication, the client can access the target cloud normally. This avoids the security risk of leakage that can occur when users directly log in to the target cloud's management console and create and download the corresponding access credentials, thus improving the security of target cloud access.

[0007] In one possible implementation, in response to receiving a credential retrieval request from the service identity to the target cloud, the access credentials corresponding to the service identity are downloaded from the management console of the target cloud, including: determining the service identity corresponding to the user; if the user logs into the management device through the service identity and receives a credential retrieval request from the service identity to the target cloud, initializing the access address of the target cloud; and communicating with the target cloud according to the access address of the target cloud to download the access credentials corresponding to the service identity from the target cloud.

[0008] Understandably, users, i.e. tenants, can register a service identity on the management device. If a user logs into the management device with a service identity, and the management device receives a request from the service identity to obtain access credentials for the target cloud, the management device initializes the access address of the target cloud. Instead of the tenant manually logging into the management console of the target cloud, the management device directly accesses the target cloud, communicates with the target cloud, and downloads the access credentials corresponding to the service identity from the target cloud. This avoids the security risks caused by manual downloading of access credentials and the loss or leakage of access credentials due to human error.

[0009] In one possible implementation, the configuration information includes the identifier of the target cloud and the identifier of the service identity.

[0010] Understandably, after the management device uploads access credentials to the storage device, the storage device needs to generate corresponding configuration information and return the configuration information to the client corresponding to the service identity. This allows the client to retrieve the corresponding access credentials from the storage device based on the configuration information. The target cloud identifier and service identity identifier in the configuration information can be used to index the corresponding access credentials in the storage device.

[0011] In one possible implementation, uploading access credentials to a storage device includes: encrypting the access credentials; and uploading the encrypted access credentials to the storage device.

[0012] Understandably, in order to ensure the security of access credentials during transmission to the storage device, the management device encrypts the access credentials before sending them to the storage device.

[0013] In one possible implementation, the method further includes: deleting the access credentials corresponding to the downloaded service identity.

[0014] Understandably, since the management device caches the access credentials locally after downloading them from the target cloud, to ensure the security of the access credentials and prevent them from being leaked, the locally cached access credentials can be deleted after the access credentials are uploaded to a dedicated storage device, thereby improving the security of the access credentials.

[0015] In one possible implementation, the method further includes: in response to receiving a request to reacquire access credentials for a service identity, determining the target cloud that needs to re-request access credentials; downloading the access credentials corresponding to the service identity from the target cloud; and uploading the re-downloaded access credentials to a storage device, so that the storage device replaces the access credentials with the re-downloaded access credentials.

[0016] Understandably, after the management device has uploaded the access credentials corresponding to the service identity to the storage device, in order to update the access credentials corresponding to the service identity, the access credentials corresponding to the service identity can be downloaded again from the target cloud, and the newly downloaded access credentials can be uploaded to the storage device to replace the previous access credentials corresponding to the service identity. This allows the access credentials to be updated quickly in the event of leakage or forgetting, and ensures that the client's business processes are not affected during the update.

[0017] In one possible implementation, if a service identity requests the credentials of at least two target clouds under a specified group, the configuration information also includes the group identifier of the target cloud. The configuration information is different for different target clouds. The configuration information is used to index from the storage device to determine the access credentials of the at least two target clouds for which the service identity is requested that correspond to the configuration information.

[0018] Understandably, when a client corresponding to a service identity needs to connect to multiple public clouds, it can apply for access credentials in batches, thus improving the efficiency of applying for access credentials.

[0019] In one possible implementation, the client corresponding to the service identity includes an integrated software development kit (SDK). The configuration items of the integrated SDK include configuration information. The integrated SDK is used to initialize the credential retrieval task. Through the configuration information in the configuration items of the integrated SDK, the credential retrieval task is executed to obtain the access credentials corresponding to the configuration information from the storage device.

[0020] Understandably, after integrating the SDK into client-side services, clients can directly obtain access credentials corresponding to the service identity from the storage device, thereby ensuring that clients can securely access the public cloud using these credentials.

[0021] In one possible implementation, the access credentials include an access key identity AK and a secret access key SK.

[0022] Secondly, this application provides a public cloud access method, which is executed by a client corresponding to the service identity, and the method includes:

[0023] In response to the storage device storing the access credentials, the system receives configuration information returned by the storage device. This configuration information is used to index and determine the access credentials corresponding to the service identity from the storage device. The access credentials are uploaded to the storage device by the management device. In response to receiving a credential retrieval request from the service identity for the target cloud, the management device downloads the access credentials corresponding to the service identity from the management console of the target cloud. It also retrieves the access credentials corresponding to the configuration information from the storage device and sends the access credentials to the target cloud so that the target cloud can authenticate the client using the access credentials. If the target cloud successfully authenticates the client corresponding to the service identity, the client can access the target cloud.

[0024] Understandably, the management device downloads the access credentials corresponding to the service identity from the target cloud and stores them on a storage device. Clients with the service identity can then retrieve these credentials from the storage device. These credentials are used by the target cloud to authenticate the client before accessing it. The client can then send an access request containing the credentials to the target cloud. After successful authentication, the client can access the target cloud normally. This avoids the security risk of leakage that can occur when users directly log in to the target cloud's management console and create and download the corresponding access credentials, thus improving the security of target cloud access.

[0025] In one possible implementation, obtaining access credentials corresponding to the configuration information from the storage device includes: initializing a credential retrieval task through an integrated software development kit (SDK); and executing the credential retrieval task using the configuration information in the configuration items of the integrated SDK to obtain the access credentials corresponding to the configuration information from the storage device.

[0026] Understandably, after integrating the SDK into client-side services, clients can directly obtain access credentials corresponding to the service identity from the storage device, thereby ensuring that clients can securely access the public cloud using these credentials.

[0027] In one possible implementation, the management device is used to determine the service identity corresponding to the user; when the user logs into the management device through the service identity and the management device receives a request from the service identity to obtain credentials for the target cloud, the management device is used to initialize the access address of the target cloud, communicate with the target cloud according to the access address of the target cloud, and download the access credentials corresponding to the service identity from the target cloud.

[0028] Understandably, users, i.e. tenants, can register a service identity on the management device. If a user logs into the management device with a service identity, and the management device receives a request from the service identity to obtain access credentials for the target cloud, the management device initializes the access address of the target cloud. Instead of the tenant manually logging into the management console of the target cloud, the management device directly accesses the target cloud, communicates with the target cloud, and downloads the access credentials corresponding to the service identity from the target cloud. This avoids the security risks caused by manual downloading of access credentials and the loss or leakage of access credentials due to human error.

[0029] In one possible implementation, the configuration information includes the identifier of the target cloud and the identifier of the service identity.

[0030] Understandably, after the management device uploads access credentials to the storage device, the storage device needs to generate corresponding configuration information and return the configuration information to the client corresponding to the service identity. This allows the client to retrieve the corresponding access credentials from the storage device based on the configuration information. The target cloud identifier and service identity identifier in the configuration information can be used to index the corresponding access credentials in the storage device.

[0031] In one possible implementation, the management device encrypts the access credentials and uploads the encrypted access credentials to the storage device.

[0032] Understandably, in order to ensure the security of access credentials during transmission to the storage device, the management device encrypts the access credentials before sending them to the storage device.

[0033] In one possible implementation, the management device is further configured to, in response to receiving a request to re-acquire access credentials for a service identity, determine the target cloud that requires re-acquiring access credentials; re-download the access credentials corresponding to the service identity from the target cloud; and upload the re-downloaded access credentials to a storage device, so that the storage device replaces the access credentials with the re-downloaded access credentials.

[0034] Understandably, after the management device has uploaded the access credentials corresponding to the service identity to the storage device, in order to update the access credentials corresponding to the service identity, the access credentials corresponding to the service identity can be downloaded again from the target cloud, and the newly downloaded access credentials can be uploaded to the storage device to replace the previous access credentials corresponding to the service identity. This allows the access credentials to be updated quickly in the event of leakage or forgetting, and ensures that the client's business processes are not affected during the update.

[0035] In one possible implementation, if a service identity requests the credentials of at least two target clouds under a specified group, the configuration information also includes the group identifier of the target cloud. The configuration information is different for different target clouds. The configuration information is used to index from the storage device to determine the access credentials of the at least two target clouds for which the service identity is requested that correspond to the configuration information.

[0036] Understandably, when a client corresponding to a service identity needs to connect to multiple public clouds, it can apply for access credentials in batches, thus improving the efficiency of applying for access credentials.

[0037] Thirdly, embodiments of this application provide a management device for executing any of the public cloud access methods provided in the first aspect above.

[0038] In one possible implementation, embodiments of this application can divide the management device into functional modules according to the method provided in the first aspect above. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing module. For example, embodiments of this application can divide the management device into a download module and an upload module, etc., according to their functions. The descriptions of the possible technical solutions and beneficial effects of the various functional modules described above can be found in the technical solutions provided in the first aspect above or its corresponding possible implementations, and will not be repeated here.

[0039] Fourthly, this application provides a public cloud access system, comprising: a management device, configured to, in response to receiving a credential acquisition request from a service identity for a target cloud, download access credentials corresponding to the service identity from the management console of the target cloud; the access credentials corresponding to the service identity are used by the target cloud to authenticate a client corresponding to the service identity; and upload the access credentials to a storage device; the storage device, configured to, after storing the access credentials, send configuration information to the client corresponding to the service identity, the configuration information being used to index and determine the access credentials corresponding to the service identity from the storage device; the client corresponding to the service identity, configured to, in response to the storage device storing the access credentials, receive the configuration information returned by the storage device, obtain the access credentials corresponding to the configuration information from the storage device; send the access credentials to the target cloud, so that the target cloud authenticates the client using the access credentials; and if the target cloud successfully authenticates the client corresponding to the service identity, access the target cloud.

[0040] Fifthly, embodiments of this application provide a computing device comprising a processor and a memory, the processor being coupled to the memory; the memory is used to store computer instructions which are loaded and executed by the processor to enable the computing device to implement the public cloud access method as described above.

[0041] In a sixth aspect, embodiments of this application provide a computer-readable storage medium storing at least one computer program instruction, which is loaded and executed by a processor to implement the public cloud access method as described above.

[0042] In a seventh aspect, embodiments of this application provide a computer program product including computer instructions stored in a computer-readable storage medium. A processor of a computing device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computing device cluster to perform the public cloud access method provided in the various optional implementations of the first aspect or the various optional implementations of the second aspect.

[0043] For a detailed description of aspects three through seven and their various implementations in this application, please refer to the detailed description in aspect one and its various implementations or aspect two and its various implementations; and for a detailed description of the beneficial effects of aspects three through seven and their various implementations, please refer to the beneficial effect analysis in aspect one and its various implementations or aspect two and its various implementations, which will not be repeated here.

[0044] These or other aspects of this application will become more readily apparent in the following description. Attached Figure Description

[0045] Figure 1 This is a schematic diagram illustrating a public cloud access scenario according to an exemplary embodiment;

[0046] Figure 2 This is a schematic diagram of a system architecture according to an exemplary embodiment;

[0047] Figure 3 This is a schematic diagram of the hardware architecture of a computing device according to an exemplary embodiment;

[0048] Figure 4 This is a flowchart illustrating a public cloud access method according to an exemplary embodiment;

[0049] Figure 5 yes Figure 4 The illustrated embodiment is a flowchart illustrating a process for authenticating business processes and target clouds using an SDK.

[0050] Figure 6 yes Figure 4 The illustrated embodiment is a schematic diagram of an interface for querying a list of buckets in OBS by connecting to a vendor's public cloud via an SDK.

[0051] Figure 7 yes Figure 4 The illustrated embodiment is a schematic diagram of a process for updating access credentials;

[0052] Figure 8 yes Figure 4 The illustrated embodiment is a flowchart illustrating a batch download of access credentials.

[0053] Figure 9 yes Figure 4 The illustrated embodiment is a schematic diagram of a target cloud management console page displaying access credentials;

[0054] Figure 10 A schematic diagram of the structure of a management device 500 provided in an exemplary embodiment of this application is shown. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0056] In this article, "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0057] Furthermore, in the description of this application, unless otherwise stated, "multiple" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of a single item or a plurality of items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0058] Furthermore, to facilitate a clear description of the technical solutions in the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish identical or similar items with substantially the same function and effect. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and that "first" and "second" are not necessarily different. Meanwhile, in the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is being used as an example, illustration, or description. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of terms such as "exemplary" or "for example" is intended to present related concepts in a concrete manner for ease of understanding.

[0059] First, the application scenarios of the embodiments of this application will be introduced by way of example.

[0060] Currently, public cloud providers offer access credentials to tenants (users). These credentials can be cloud platform access keys, which include an access key ID (AK) and a secret access key (SK). Users must manually log in to the public cloud (cloud provider) console to download the access credentials. Access credentials can only be downloaded initially upon creation; subsequently, only the AK can be viewed, not the SK. If the downloaded access credentials are forgotten, the user must recreate the corresponding access credentials and download them again. Public clouds have a limit on the number of access credentials; for example, a tenant is only allowed to create a maximum of two access credentials. When a client running business processes sends a request to call the public cloud's OpenAPI, the client can use the access credentials to encrypt the request and calculate a digest. This digest is then included in the request header of the Hypertext Transfer Protocol (HTTP) request sent to the public cloud (i.e., the server). The server decrypts the digest in the request header to authenticate and authorize the client. If the client's identity is successfully authenticated, the client can communicate normally with the server, allowing the server to run the client's business processes.

[0061] Taking a cloud server as an example, the authentication process using AK / SK can be as follows: The cloud server needs to verify the identity of the sender of a request using AK / SK encryption. AK can be used to identify the user, and SK can be the key used by the user to encrypt the authentication string and by the cloud provider to verify the authentication string. SK needs to be kept secret. AK / SK can use symmetric encryption and decryption. After receiving a user's request, the cloud server system can generate an authentication string using the same SK and authentication mechanism as the AK, and compare it with the authentication string included in the user's request. If the authentication strings are the same, the system considers the user to have the specified operation permissions and executes the relevant operation. If the authentication strings are different, the system will ignore the operation and return an error code. The system then checks whether the user's request contains an authorization authentication string. If it does, the next step is executed. Based on the HTTP request information, a signature string is generated using the same algorithm. The signature string generated by the server is compared with the string provided by the user. If the content is inconsistent, authentication is considered to have failed, and the request is rejected. If the content is consistent, authentication is successful, and the system will operate according to the user's request content.

[0062] In related technologies, users manually log in to a cloud provider's management console, create and download their corresponding access credentials on the corresponding page of the management console, and can save the downloaded access credentials locally. The downloaded access credentials can be used by multiple clients. Clients can use the access credentials to pass the cloud provider's authentication and authorization, and call the cloud provider's OpenAPI to run the client's business processes.

[0063] This method of manually logging into the cloud provider's management console to download access credentials may lead to a lack of unified management of public cloud accounts—that is, user accounts used to log into the public cloud management console. These accounts may be maintained in different systems and operational logs, and manual storage and transfer of accounts could pose a risk of data leakage. In other words, the person logging into the cloud provider's management console to obtain access credentials may not be a tenant of that cloud provider, and consequently, the person downloading the access credentials may also not be a tenant of that cloud provider, leading to public cloud access security risks. On the other hand, since downloaded access credentials are permanently valid, if the client runs without problems but the access credentials are forgotten or lost, it may affect the normal operation of the client's business processes. Another scenario is that public clouds have a limit on the number of access credentials that can be created. When the limit for the number of users has been reached, the issued access credentials must be forgotten before new access credentials can be requested for that user. However, directly deleting existing access credentials during normal business process operation can disrupt the normal operation of the business processes. In addition, since the tenant uses the same public cloud account to directly log in to the public cloud management console to download the tenant's corresponding access credentials, the multiple clients used by the tenant to access and communicate with the public cloud all use the downloaded access credentials for authentication. Since the multiple clients may need different business processes running on the public cloud, there is a possibility that the public cloud cannot modify the access permission policy for some clients of the same user. In other words, if one client updates the account's permission policy, it will affect all clients using that account.

[0064] In view of this, this application provides a public cloud access method. A management device can download access credentials corresponding to a service identity from the target cloud and store them in a storage device. The client corresponding to the service identity can retrieve access credentials from the storage device for authentication by the target cloud before accessing it. The client can send an access request containing the access credentials to the target cloud. After successful authentication, the client can access the target cloud normally. This avoids the security risk of leakage that can occur when users directly log in to the target cloud's management console and create and download corresponding access credentials on the page, thus improving the security of target cloud access.

[0065] For example, Figure 1 This is a schematic diagram illustrating a public cloud access scenario provided in an embodiment of this application. For example... Figure 1As shown, in a public cloud access scenario, there are service requesters, management device 10, storage device 20, service clients, and the public cloud. Management device 10 can be hardware devices including but not limited to computing devices, computing device clusters, servers, etc.; storage device 20 can be hardware devices including but not limited to computing devices, computing device clusters, servers, databases, storage media, etc.; service clients can be clients running on the same or different computing devices.

[0066] The management device 10 can also be a software program running on the hardware device. For example, the management device 10 can be an account management service, and the storage device 20 can be a third-party data center, such as a sensitive configuration management center. Figure 1 As shown, if applicants for Service 1, Service 2, and Service 3 each apply to the management device 10 to register a service identity, the management device 10 can register the service identities corresponding to the applicants for Service 1, Service 2, and Service 3. If the management device 10 receives a request from a service identity to obtain access credentials for the public cloud (target cloud), the management device 10 can apply to the public cloud for access credentials corresponding to each service identity. For example, for the service identity corresponding to the applicant for Service 1, it can obtain access credential 1; for the service identity corresponding to the applicant for Service 2, it can obtain access credential 2; and for the service identity corresponding to the applicant for Service 3, it can obtain access credential 3. Then, management device 10 can upload the acquired access credentials to storage device 20 for storage. Storage device 20 can store access credentials 1, 2, and 3 respectively. Storage device 20 can generate configuration information corresponding to each access credential and send it to the client corresponding to the service identity. For example, the configuration information for access credential 1 can be sent to the client corresponding to service one, the configuration information for access credential 2 can be sent to the client corresponding to service two, and the configuration information for access credential 3 can be sent to the client corresponding to service three. Each client can retrieve the corresponding access credentials from the storage device according to the received configuration information using its integrated SDK. This allows the client to send HTTP requests to the target cloud's OpenAPI via the SDK. The HTTP request header includes the access credentials. The target cloud can authenticate the client according to the access credentials. After successful authentication, the client with the corresponding service identity can access the target cloud normally and use the target cloud to run the corresponding services.

[0067] The system architecture of the embodiments of this application will be described below as an example.

[0068] Specifically, taking the management device as an account management service and the storage device as a sensitive configuration center as an example. Figure 2 This is a schematic diagram of a system architecture provided in an embodiment of this application. For example... Figure 2 As shown, the account management service can include two modules: service information management and public cloud account and credential management. The public cloud access system can include account management service, sensitive configuration center and service (client).

[0069] In this process, service applicants can apply to create access credentials through the account management service's management console (S21). The account management service will automatically determine the target cloud address to be requested based on the applicant's service identity through the service information management module (S22). The account management service can initialize a client connection to the corresponding target cloud to apply for access credentials through the public cloud account and credential management module, download the corresponding access credentials from the target cloud, and encrypt and cache them locally (e.g., in the local memory of the server where the account management service is located) (S23). The account management service will then upload the downloaded access credentials to the sensitive configuration center through the public cloud account and credential management module. The configuration center encrypts and stores access credentials and generates corresponding configuration information (also known as sensitive configuration coordinates) based on the service identity. It then returns the configuration information to the service (client) corresponding to the service identity (S24). The service integration SDK automatically obtains the latest access credentials from the sensitive configuration center (S25). The SDK can initialize a scheduled task to periodically initialize the client, communicate with the sensitive configuration center, and download the corresponding access credentials from the sensitive configuration center to the cache according to the configuration information. When the user needs to communicate with the target cloud's OpenAPI, it can generate a digest for authentication based on the access credentials in the cache, and place it in the HTTP header to complete the authentication and authorization between the business service and the public cloud vendor (S26).

[0070] The hardware architecture of the embodiments of this application will be described exemplarily below.

[0071] Figure 3 This is a schematic diagram of the hardware architecture of a computing device provided in an embodiment of this application. Figure 3 As shown, the computing device 30 includes at least: a memory 31, a processor 32, and a bus 33.

[0072] The memory 31 can be used to store the logic code corresponding to the public cloud access method provided in the embodiments of this application, or in other words, the memory 31 can store the logic code corresponding to the execution of a certain step by the computing device 30 described in the following embodiments. The memory 31 may also include a storage device.

[0073] Processor 32 can be used to run logic code.

[0074] Optionally, the computing device 30 can be a terminal device or a server. The terminal device can include computers, mobile terminals, tablets, laptops, desktop computers, all-in-one computers, augmented reality (AR) devices, virtual reality (VR) devices, mixed reality (MR) devices, extended reality (ER) devices, personal digital assistants (PDAs), ultra-mobile personal computers (UMPCs), etc. The server can include cluster servers, etc.

[0075] Optionally, the memory 31 may include random access memory (RAM), read-only memory (ROM), etc.

[0076] Optionally, the processor 32 can be a central processing unit (CPU) or other general-purpose processor, application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), digital signal processor (DSP), or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0077] Optionally, bus 33 can be a peripheral component interconnect (PCI) bus or a peripheral component interconnect express (PCIe) bus, etc. For ease of illustration, Figure 3 The bus 33 is represented by only one line, but this does not mean that there is only one bus or one type of bus. The bus 33 may include a path for transmitting information between various components of the computing device 30 (e.g., memory 31, processor 32).

[0078] in addition, Figure 1 The management device 10 or storage device 20 shown can be used as Figure 3 The structural implementation of the computing device shown.

[0079] It should be noted that the application scenarios and system architectures described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of system architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0080] Figure 4 This is a flowchart illustrating a public cloud access method provided in an embodiment of this application. This public cloud access method can be implemented by, for example... Figure 1 , Figure 2 The public cloud access system shown is executed, or is performed by... Figure 3 The computing device 30 shown executes the public cloud access method, which includes the following steps:

[0081] S101, in response to receiving the service identity's credential acquisition request for the target cloud, the management device downloads the access credentials corresponding to the service identity from the management console of the target cloud.

[0082] In this embodiment of the application, after receiving a request from the service identity requesting access credentials for the target cloud, the management device can communicate with the management console of the target cloud to download the access credentials corresponding to the service identity.

[0083] In this context, user service identities are categorized according to the different services that need to run on the target cloud. In other words, different business processes correspond to different service identities for their respective clients.

[0084] For example, if there is a service 1 and a service 2, when the access credential applicant registers the service identity on the management device, he / she needs to enter the corresponding service (client) into the management device. The service identity corresponding to service 1 is service identity 1, and the service identity corresponding to service 2 is service identity 2. The identifier of the service identity corresponding to each service identity can be a universally unique identifier (UUID).

[0085] In one possible implementation, the service identity corresponding to the user is determined; if the user logs into the management device through the service identity and receives a credential acquisition request for the target cloud from the service identity, the access address of the target cloud is initialized; based on the access address of the target cloud, communication is established with the target cloud to download the access credentials corresponding to the service identity from the target cloud.

[0086] The user's service identity can be determined by registering an account. The user can obtain a unique identifier (account) for the service by entering the service identifier. The user logs into the management console of the management device with the registered service identity. When the management console receives a request for the service identity to obtain credentials for the target cloud, it obtains the access address of the target cloud and communicates with the target cloud according to the access address to request the creation of access credentials corresponding to the service identity. The access credentials are then downloaded to the local machine of the management device.

[0087] S102, the management device uploads the access credentials to the storage device.

[0088] In this embodiment of the application, after the management device downloads the access credentials corresponding to the service identity to its local machine, it can upload the access credentials to the storage device.

[0089] To ensure the security of access credentials, they can be uploaded to a more secure storage device to prevent them from being leaked locally and affecting the normal operation of subsequent business processes.

[0090] In one possible implementation, the management device may encrypt the access credentials and then upload the encrypted access credentials to the storage device. The encryption method is not limited here.

[0091] In addition, after uploading access credentials to the storage device, the management device can delete the access credentials corresponding to the downloaded service identity. This means that after storing the access credentials on the storage device, the management device can delete the locally cached access credentials, thereby preventing access credential leakage on the management device and ensuring the security of public cloud access.

[0092] S103, the storage device returns configuration information to the client corresponding to the service identity.

[0093] In this embodiment of the application, the storage device can return configuration information to the client corresponding to the service identity after receiving the access credentials corresponding to the storage service identity.

[0094] The configuration information may include the identifier of the target cloud and the identifier of the service identity.

[0095] For example, the specific format of the configuration information can consist of a fixed prefix, the identifier of the target cloud, the identifier of the service identity (the UUID of the account corresponding to the service identity), and a random number. For instance, the fixed prefix can be CredentialV2 / Tenant, the identifier of the target cloud is XX Cloud, the UUID of the login account corresponding to service identity 1 is 12346, and the random number is abc. Then the generated configuration information would be CredentialV2 / Tenant / XXCloud / 12346 / abc.

[0096] S104, the client corresponding to the service identity obtains the access credentials corresponding to the configuration information from the storage device.

[0097] In this embodiment of the application, the client corresponding to the service identity can obtain the access credentials corresponding to the configuration information from the storage device according to the configuration information.

[0098] The client corresponding to the service identity may include the integration SDK.

[0099] In one possible implementation, a credential retrieval task is initialized by integrating a Software Development Kit (SDK); the credential retrieval task is executed using the configuration information in the configuration items of the integrated SDK, and the access credentials corresponding to the configuration information are retrieved from the storage device.

[0100] Specifically, the SDK can initialize a scheduled task, which can be a credential retrieval task. According to the credential retrieval task, it can periodically communicate with the storage device. Based on the configuration information in the SDK's configuration items, it can periodically and automatically retrieve the latest access credentials corresponding to the service identity from the storage device and encrypt and cache them.

[0101] S105, the client corresponding to the service identity sends access credentials to the target cloud.

[0102] In this embodiment of the application, when the client corresponding to the service identity needs to call the OpenAPI to communicate with the target cloud, a digest for authentication can be generated based on the access credentials in the cache, and placed in the request header of the HTTP request and sent to the target cloud along with the HTTP request.

[0103] For example, Figure 5 This is a schematic diagram illustrating a process for authenticating business processes and target clouds using an SDK, as described in an embodiment of this application. Figure 5 As shown, the client's business process integrates the SDK. The SDK can initialize a scheduled task, which periodically enables communication between the client and the storage device. Based on sensitive information in the SDK configuration (e.g., CredentialV2 / Tenant / XXCloud / 12346 / abc), the SDK automatically retrieves the latest access credentials from the storage device and encrypts and caches them (S31). When the business process needs to communicate with the target cloud's OpenAPI, the SDK can generate a digest for authentication based on the cached access credentials and send it to the business process (S32). The business process puts the digest into the HTTP header of the HTTP request sent to the target cloud's OpenAPI, and the business process completes authentication and authorization with the target cloud's OpenAPI (S33).

[0104] In one possible scenario, if the access credentials for a service identity are stolen due to a hacker attack or improper storage, and it is necessary to reapply for access credentials and delete the leaked credentials in order to mitigate the damage, the management device can respond to the service identity's request to re-obtain access credentials by identifying the target cloud where the access credentials need to be re-obtained; downloading the access credentials corresponding to the service identity from the target cloud; and uploading the re-downloaded access credentials to the storage device, so that the storage device can replace the re-downloaded access credentials with the new ones.

[0105] After integrating the SDK into the business applications, secure and compliant access to public cloud OpenAPIs can be directly achieved. If it's necessary to query a bucket list in a vendor's Object Storage Service (OBS) public cloud service, the interface displayed when connecting to that vendor's public cloud service via the SDK will look like this: Figure 6 As shown in the image, this interface can display the region, authorization, date, and query response results.

[0106] For example, Figure 7 This is a schematic diagram illustrating a process for updating access credentials according to an embodiment of this application. Figure 7 As shown. Business personnel log in to the management service of the management device using the service identity identifier (UUID account). On the management console page, they can initiate a re-request for access credentials (S41). Based on the service identity identifier (UUID account), such as 12345, the original configuration information is retrieved from the storage device, such as CredentialV2 / Tenant / XXCloud / 12346 / abc (S42). Then, the management service determines the target cloud as XX Cloud based on the target cloud identifier field in the configuration information, initializes the access address of the target cloud, completes the application for the corresponding XX Cloud, and downloads the access credentials corresponding to the service identity. The access credentials can be encrypted and cached in the server's local memory (S43). The management service can upload the newly requested cached access credentials to the storage device while keeping the configuration information unchanged, such as CredentialV2 / Tenant / XXCloud / 12346 / abc. The original access credentials are deleted and replaced with the newly requested access credentials (S44). The management device deletes the original access credentials of the service identity to the target cloud, ensuring that only one access credential is available for each service identity. When a user needs to communicate with the OpenAPI, a digest for authentication can be generated based on the access credentials in the SDK cache. If a 401 error occurs with the access credentials, a cache refresh is triggered to ensure that the business can obtain the latest access credentials (S45).

[0107] In one possible scenario, in order to request access credentials from multiple public cloud vendors in batches, if a service identity receives a request to obtain credentials for at least two target clouds under a specified group, the configuration information also includes the group identifier of the target cloud. The configuration information corresponding to different target clouds is different. The configuration information is used to index from the storage device to determine the access credentials corresponding to the configuration information in the at least two target clouds requested by the service identity.

[0108] For example, Figure 8 This is a schematic diagram illustrating a process for batch downloading access credentials according to an embodiment of this application. Figure 8 As shown, business personnel can use the service identity identifier (UUID account) as their login account to select the corresponding cloud vendor group in the account management service and apply for cloud vendor access credentials in batches (S51). For example, XX Cloud and YY Cloud can be set up as a vendor group 1, with the identifier of vendor group 1 being CloudGroup1, the identifier of XX Cloud being XXCloud, and the identifier of YY Cloud being YYCloud. The account management service will initialize the cloud vendor access address based on the account logged in by the business personnel, complete the application with the corresponding cloud vendor, and download the access credentials (S52). For example, following the steps in S51, the management device will log in to the XX Cloud management console and the YY Cloud management console respectively to create and download access credentials. The management device will upload the access credentials to the storage device (S53). Subsequently, the storage device can generate unique access credentials based on a fixed prefix, the identifier of the target cloud (cloud vendor identifier), the group identifier, the login account UUID, and a random number, and return the configuration information corresponding to the service identity to the client. For example, the two configuration information can be: CredentialV2 / Tenant / CloudGroup1 / XXCloud / 12346 / abc and CredentialV2 / Tenant / CloudGroup1 / YYCloud / 12346 / efg.

[0109] In one possible implementation, the target cloud's management console displays the access credentials created after the application is submitted via a webpage.

[0110] Specifically, Figure 9 This is a schematic diagram of a page displaying access credentials on the management console of a target cloud, as described in an embodiment of this application. Figure 9 As shown, the page includes controls for creating new access credentials, as well as access credential IDs, usage status, public cloud status, last usage time, access credential creation time, and last modification time. It also includes controls for modifying, deactivating, and deleting access credentials.

[0111] In summary, by downloading access credentials corresponding to the service identity from the target cloud through the management device and storing these credentials on a storage device, the client corresponding to the service identity can retrieve the access credentials used by the target cloud for client authentication before accessing the target cloud. The client can then send an access request containing the access credentials to the target cloud, and after successful authentication, the client can access the target cloud normally. This avoids the security risk of leakage that can occur when users directly log in to the target cloud's management console and create and download the corresponding access credentials on the page, thus improving the security of target cloud access.

[0112] The foregoing primarily describes the solutions of the embodiments of this application from a methodological perspective. It is understood that, in order to achieve the aforementioned functions, the management device includes at least one of the hardware structures and software modules corresponding to the execution of each function. Those skilled in the art should readily recognize that, based on the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0113] This application embodiment can divide the management device into functional units according to the above method example. For example, each function can be divided into a separate functional unit, or two or more functions can be integrated into one processing unit. The integrated unit can be implemented in hardware or as a software functional unit. It should be noted that the unit division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods.

[0114] For example, Figure 10 This illustration shows a schematic diagram of a management device 500 provided in an exemplary embodiment of this application. The management device 500 is applied in a computing device, or the management device 500 may be a computing device. The management device 500 includes:

[0115] Download module 510 is used to download the access credentials corresponding to the service identity from the management console of the target cloud in response to receiving a credential acquisition request for the service identity; the access credentials corresponding to the service identity are used by the target cloud to authenticate the client corresponding to the service identity.

[0116] The upload module 520 is used to upload the access credentials to a storage device; the storage device is used to send configuration information to the client corresponding to the service identity after storing the access credentials, the configuration information being used to index and determine the access credentials corresponding to the service identity from the storage device; the client corresponding to the service identity is used to obtain the access credentials corresponding to the service identity from the storage device through the configuration information, and then request authentication by sending the access credentials to the target cloud, and access the target cloud after the target cloud authenticates the client.

[0117] For example, combining Figure 4 Download module 510 can be used to perform tasks such as... Figure 4 As shown in S101, the upload module 520 can be used to perform, for example... Figure 4 S102 is shown.

[0118] In one possible implementation, the download module 510 is further configured to determine the service identity corresponding to the user; if the user logs into the management device through the service identity and receives a credential acquisition request for the target cloud from the service identity, initialize the access address of the target cloud; and communicate with the target cloud according to the access address of the target cloud to download the access credentials corresponding to the service identity from the target cloud.

[0119] In one possible implementation, the configuration information includes the identifier of the target cloud and the identifier of the service identity.

[0120] In one possible implementation, the upload module 520 is further configured to encrypt the access credentials and upload the encrypted access credentials to the storage device.

[0121] In one possible implementation, the apparatus further includes a deletion module for deleting the access credentials corresponding to the downloaded service identity.

[0122] In one possible implementation, the device further includes:

[0123] The re-acquisition module is configured to, in response to receiving a request from the service identity to re-acquire the access credentials, determine the target cloud that needs to re-request the access credentials; re-download the access credentials corresponding to the service identity from the target cloud; and upload the re-downloaded access credentials to the storage device, so that the storage device replaces the access credentials with the re-downloaded access credentials.

[0124] In one possible implementation, if a request to obtain credentials for at least two target clouds under a specified group is received by the service identity, the configuration information further includes the group identifier of the target cloud, wherein the configuration information corresponding to different target clouds is different, and the configuration information is used to index from the storage device to determine the access credentials corresponding to the configuration information in the at least two target clouds requested by the service identity.

[0125] In one possible implementation, the client corresponding to the service identity includes an Integrated Software Development Kit (SDK). The configuration items of the SDK include the configuration information. The SDK is used to initialize a credential acquisition task. Using the configuration information in the SDK's configuration items, the credential acquisition task is executed to retrieve the access credential corresponding to the configuration information from the storage device. For a detailed description of the above-mentioned optional methods, please refer to the foregoing method embodiments; they will not be repeated here. Furthermore, explanations of any of the management devices provided above and descriptions of their beneficial effects can be found in the corresponding method embodiments described above; they will not be repeated here.

[0126] This application also provides a computer program product containing instructions. The computer program product may be a software or program product containing instructions, capable of running on a computing device or stored on any usable medium. When the computer program product is run on at least one computing device, it causes the at least one computing device to perform a performance optimization method.

[0127] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center that includes one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to perform a digital resource management method or to perform a performance optimization method.

[0128] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. A public cloud access method, characterized in that, The method is performed by a management device, and the method includes: In response to receiving a request from a service identity to obtain credentials for a target cloud, the system downloads the access credentials corresponding to the service identity from the management console of the target cloud; the access credentials corresponding to the service identity are used by the target cloud to authenticate the client corresponding to the service identity. The access credentials are uploaded to a storage device. The storage device is used to send configuration information to the client corresponding to the service identity after storing the access credentials. The configuration information is used to index and determine the access credentials corresponding to the service identity from the storage device. The client corresponding to the service identity is used to obtain the access credentials corresponding to the service identity from the storage device through the configuration information, and then send the access credentials to the target cloud to apply for authentication. After the target cloud authenticates the client, the client accesses the target cloud.

2. The method according to claim 1, characterized in that, The step of responding to a request from a service identity to obtain credentials for a target cloud, and downloading the access credentials corresponding to the service identity from the management console of the target cloud, includes: Determine the service identity corresponding to the user; If a user logs into the management device using the service identity and receives a credential retrieval request for the target cloud from the service identity, the access address of the target cloud is initialized. Based on the access address of the target cloud, communicate with the target cloud and download the access credentials corresponding to the service identity from the target cloud.

3. The method according to claim 1 or 2, characterized in that, The configuration information includes the identifier of the target cloud and the identifier of the service identity.

4. The method according to any one of claims 1 to 3, characterized in that, Uploading the access credentials to the storage device includes: The access credentials are encrypted. The encrypted access credentials are uploaded to the storage device.

5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: Delete the access credentials corresponding to the downloaded service identity.

6. The method according to any one of claims 1 to 5, characterized in that, The method further includes: In response to receiving a request from the service identity to reacquire the access credentials, determine the target cloud that needs to re-request the access credentials; Re-download the access credentials corresponding to the service identity from the target cloud; The re-downloaded access credentials are uploaded to the storage device, so that the storage device replaces the original access credentials with the re-downloaded access credentials.

7. The method according to any one of claims 1 to 6, characterized in that, If a request to obtain credentials for at least two target clouds under a specified group is received by the service identity, the configuration information further includes the group identifier of the target cloud, wherein the configuration information corresponding to different target clouds is different, and the configuration information is used to index from the storage device to determine the access credentials corresponding to the configuration information in the at least two target clouds requested by the service identity.

8. The method according to any one of claims 1 to 7, characterized in that, The client corresponding to the service identity includes an integrated software development kit (SDK). The configuration items of the integrated SDK include the configuration information. The integrated SDK is used to initialize a credential acquisition task. Through the configuration information in the configuration items of the integrated SDK, the credential acquisition task is executed to obtain the access credentials corresponding to the configuration information from the storage device.

9. A method for accessing a public cloud, characterized in that, The method is executed by the client corresponding to the service identity, and the method includes: In response to the storage device completing the storage of access credentials, configuration information returned by the storage device is received. The configuration information is used to index and determine the access credentials corresponding to the service identity from the storage device. The access credentials are uploaded to the storage device by the management device. The management device is used to download the access credentials corresponding to the service identity from the management console of the target cloud in response to receiving a credential retrieval request for the target cloud based on the service identity. Obtain the access credentials corresponding to the configuration information from the storage device; Send the access credentials to the target cloud so that the target cloud can authenticate the client using the access credentials; If the target cloud authenticates the client corresponding to the service identity, the client can access the target cloud.

10. The method according to claim 9, characterized in that, The step of obtaining the access credentials corresponding to the configuration information from the storage device includes: Obtain the task by initializing credentials through the integrated software development kit (SDK); The credential retrieval task is executed using the configuration information in the configuration items of the integrated SDK to retrieve the access credentials corresponding to the configuration information from the storage device.

11. The method according to claim 9 or 10, characterized in that, The management device is used to determine the service identity corresponding to the user; when the user logs into the management device through the service identity and the management device receives a credential acquisition request for the target cloud based on the service identity, the management device is used to initialize the access address of the target cloud, communicate with the target cloud based on the access address of the target cloud, and download the access credentials corresponding to the service identity from the target cloud.

12. The method according to any one of claims 9 to 11, characterized in that, The configuration information includes the identifier of the target cloud and the identifier of the service identity.

13. The method according to any one of claims 9 to 12, characterized in that, The management device is used to encrypt the access credentials and upload the encrypted access credentials to the storage device.

14. The method according to any one of claims 9 to 13, characterized in that, The management device is also used to delete the access credentials corresponding to the downloaded service identity.

15. The method according to any one of claims 9 to 14, characterized in that, The management device is further configured to, in response to receiving a request from the service identity to re-acquire the access credentials, determine the target cloud that needs to re-apply for the access credentials; Re-download the access credentials corresponding to the service identity from the target cloud; The re-downloaded access credentials are uploaded to the storage device, so that the storage device replaces the original access credentials with the re-downloaded access credentials.

16. The method according to any one of claims 9 to 15, characterized in that, If a request to obtain credentials for at least two target clouds under a specified group is received by the service identity, the configuration information further includes the group identifier of the target cloud, wherein the configuration information corresponding to different target clouds is different, and the configuration information is used to index from the storage device to determine the access credentials corresponding to the configuration information in the at least two target clouds requested by the service identity.

17. A management device, characterized in that, The device includes: The download module is used to respond to a request from a service identity to obtain credentials for a target cloud, and to download the access credentials corresponding to the service identity from the management console of the target cloud; the access credentials corresponding to the service identity are used by the target cloud to authenticate the client corresponding to the service identity. An upload module is used to upload the access credentials to a storage device; the storage device is used to send configuration information to the client corresponding to the service identity after storing the access credentials, the configuration information being used to index and determine the access credentials corresponding to the service identity from the storage device; the client corresponding to the service identity is used to obtain the access credentials corresponding to the service identity from the storage device through the configuration information, and then request authentication by sending the access credentials to the target cloud, and access the target cloud after the target cloud authenticates the access credentials.

18. A public cloud access system, characterized in that, The system includes: A management device is configured to, in response to receiving a request from a service identity to obtain credentials for a target cloud, download access credentials corresponding to the service identity from the management console of the target cloud; the access credentials corresponding to the service identity are used by the target cloud to authenticate the client corresponding to the service identity; and upload the access credentials to a storage device. The storage device is configured to send configuration information to the client corresponding to the service identity after storing the access credentials, wherein the configuration information is used to index and determine the access credentials corresponding to the service identity from the storage device; The client corresponding to the service identity is configured to, in response to the storage device storing the access credentials, receive configuration information returned by the storage device, retrieve the access credentials corresponding to the configuration information from the storage device, send the access credentials to the target cloud so that the target cloud can authenticate the client using the access credentials, and if the target cloud successfully authenticates the client corresponding to the service identity, access the target cloud.

19. A computing device, characterized in that, The computing device includes a processor and a memory, wherein the processor of the computing device is configured to execute instructions stored in the memory of the computing device to cause the computing device to perform the public cloud access method as described in any one of claims 1 to 8.

20. A computing device, characterized in that, The computing device includes a processor and a memory, wherein the processor of the computing device is configured to execute instructions stored in the memory of the computing device to cause the computing device to perform the public cloud access method as described in any one of claims 9 to 16.

21. A computer-readable storage medium, characterized in that, It includes computer program instructions, which, when executed by a cluster of computing devices, enable the cluster to perform the public cloud access method as described in any one of claims 1 to 8.

22. A computer-readable storage medium, characterized in that, It includes computer program instructions, which, when executed by a cluster of computing devices, enable the cluster to perform the public cloud access method as described in any one of claims 9 to 16.

23. A computer program product, characterized in that, The computer program product includes instructions that, when executed by a computing device cluster, cause the computing device cluster to perform the public cloud access method as described in any one of claims 1 to 8.

24. A computer program product, characterized in that, The computer program product includes instructions that, when executed by a computing device cluster, cause the computing device cluster to perform the public cloud access method as described in any one of claims 9 to 16.

Images