Authentication method, device, system and storage medium for cloud gateway

Abstract

The application discloses an authentication method, device and system for a cloud gateway and a storage medium, and belongs to the technical field of computers. The method comprises the following steps: receiving a first service request sent by a front end, wherein the first service request comprises a session identifier and a tenant identifier; in the case where it is detected that session information corresponding to the session identifier is invalid, sending a query to an edge gateway, the query comprising the session identifier and the tenant identifier, wherein the edge gateway verifies the validity of a local session of an edge server according to the session identifier and the tenant identifier; in the case where the local session is valid, obtaining a user identifier returned by the edge gateway; querying a cloud service authority level of the user according to the tenant identifier and the user identifier; establishing a cloud session synchronized with the local session according to the cloud service authority level; forwarding the first service request to a cloud server; and forwarding data returned by the cloud server in response to the first service request to the front end. The application is used for improving the use experience of users.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically to an authentication method, apparatus, system, and storage medium for a cloud gateway. Background Technology

[0002] In cloud-edge-device collaborative systems, a common architecture is centralized management in the cloud and multi-tenant distributed execution at the edge. Under this architecture, operators must complete separate authentication processes to access both cloud and edge services to ensure data security for multiple tenants. Currently, even after authentication at the edge, operators still need to re-authenticate when accessing cloud services. The relatively independent authentication processes at the edge and cloud result in multiple authentication attempts for operators accessing both simultaneously, negatively impacting user experience. Summary of the Invention

[0003] The purpose of this application is to provide an authentication method, apparatus, system, storage medium, and program product for a cloud gateway, in order to solve the problem of poor user experience in the prior art.

[0004] To achieve the above objectives, the first aspect of this application provides an authentication method for a cloud gateway, the authentication method comprising: Receive the first service request sent by the front end, wherein the first service request includes a session identifier and a tenant identifier; If the session information corresponding to the session identifier is found to be invalid, a query is sent to the edge gateway. The query includes the session identifier and the tenant identifier. The edge gateway verifies the validity of the local session of the edge server based on the session identifier and the tenant identifier. If the local session is valid, obtain the user identifier returned by the edge gateway; Query the user's cloud service permission level based on the tenant identifier and user identifier; Establish a cloud session that is synchronized with the local session based on the cloud service permission level; The first service request is forwarded to the cloud server; The data returned by the cloud server in response to the first service request is forwarded to the front end.

[0005] In this embodiment of the application, the authentication method further includes: if the session information corresponding to the session identifier is detected to be valid, forwarding the first service request to the cloud server; and forwarding the data returned by the cloud server in response to the first service request to the front end.

[0006] In this embodiment of the application, sending a query to the edge gateway includes: determining the edge gateway authentication interface corresponding to the tenant identifier; and forwarding the session identifier and the tenant identifier to the edge gateway corresponding to the edge gateway authentication interface to send a query to the edge gateway.

[0007] In this embodiment of the application, after forwarding the data returned by the cloud server in response to the first service request to the front end, the authentication method further includes: obtaining a second service request sent by the front end, the second service request including a request domain name and a tenant identifier to be verified; determining a first tenant identifier associated with the request domain name; verifying the tenant identifier to be verified according to the first tenant identifier to obtain a first verification result; receiving the second service request if the first verification result is a successful verification; and rejecting the second service request if the first verification result is a failed verification.

[0008] In this embodiment of the application, after receiving the second service request, the process includes: determining a second tenant identifier associated with the cloud session; verifying the tenant identifier to be verified based on the second tenant identifier to obtain a second verification result; processing the second service request if the second verification result is successful; and rejecting the second service request if the second verification result is unsuccessful.

[0009] In this embodiment of the application, the authentication method further includes: receiving a session identifier corresponding to the local session sent by the edge gateway when the edge gateway detects that the local session has been cleared; and clearing the cloud session corresponding to the session identifier.

[0010] A second aspect of this application provides a cloud gateway, comprising: a memory configured to store instructions; and a processor configured to retrieve instructions from the memory and, when executing the instructions, to implement the authentication method for the cloud gateway described above.

[0011] A third aspect of this application provides an authentication system, comprising: a cloud gateway as described above; a cloud server communicating with the cloud gateway; an edge gateway; and an edge server communicating with the edge gateway.

[0012] A fourth aspect of this application provides a machine-readable storage medium storing instructions that cause a machine to perform the authentication method for a cloud gateway described above.

[0013] The fifth aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the authentication method for a cloud gateway described above.

[0014] The above technical solution receives a first service request from the front end, which includes a session identifier and a tenant identifier. If the session information corresponding to the session identifier is found to be invalid, a query is sent to the edge gateway. This query also includes the session identifier and the tenant identifier. The edge gateway verifies the validity of the local session on the edge server based on the session identifier and the tenant identifier. Furthermore, compared to existing technologies, this eliminates the need for separate authentication at the edge and cloud. With a valid local session, the cloud gateway can obtain the user identifier returned by the edge gateway, query the user's cloud service permission level based on the tenant identifier and the user identifier, and establish a cloud session synchronized with the local session based on this cloud service permission level. The first service request can be forwarded to the cloud server, and the data returned by the cloud server in response to the first service request can be forwarded to the front end. This eliminates the need for re-authentication at the cloud while completing authentication at the edge, improving the user experience for operators.

[0015] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description

[0016] The accompanying drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the following detailed description to explain the embodiments of this application, but do not constitute a limitation on the embodiments of this application. In the drawings: Figure 1 The illustration shows a flowchart of an authentication method for a cloud gateway according to an embodiment of this application; Figure 2 The illustration shows a flowchart of another authentication method for a cloud gateway according to an embodiment of this application; Figure 3 This illustration schematically depicts a cloud data update process according to an embodiment of this application; Figure 4 The diagram illustrates a three-layer anti-tampering verification system according to an embodiment of this application. Figure 5 This illustration shows a schematic diagram of data distribution based on the MQ bridging service according to an embodiment of this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0018] It should be noted that the acquisition, transmission, storage, use, and processing of data in the technical solution of this application all comply with relevant laws and regulations. In the embodiments of this application, certain existing industry solutions such as software, components, and models may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0019] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0020] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0021] Figure 1 The illustration schematically shows a flowchart of an authentication method for a cloud gateway according to an embodiment of this application. Figure 1 As shown in the figure, this application provides an authentication method for a cloud gateway. This authentication method is applied to a cloud gateway and may include the following steps: Step S101: Receive the first service request sent by the front end, wherein the first service request includes a session identifier and a tenant identifier.

[0022] In step S102, if the session information corresponding to the session identifier is detected to be invalid, a query is sent to the edge gateway. The query includes the session identifier and the tenant identifier. The edge gateway verifies the validity of the local session of the edge server based on the session identifier and the tenant identifier.

[0023] Step S103: If the local session is valid, obtain the user identifier returned by the edge gateway.

[0024] Step S104: Query the user's cloud service permission level based on the tenant identifier and user identifier.

[0025] Step S105: Establish a cloud session that is synchronized with the local session based on the cloud service permission level.

[0026] Step S106: Forward the first service request to the cloud server.

[0027] Step S107: Forward the data returned by the cloud server in response to the first service request to the front end.

[0028] The first service request is understood to be the initial business access request message initiated by the front-end device to the cloud, used for the first access to cloud services. This request may include a session identifier and a tenant identifier. The session identifier is the credential information used for user login authentication; each session is assigned a unique session identifier. The tenant identifier is the identity information used to distinguish different tenants in a multi-tenant architecture. Session information includes relevant information bound to the session identifier, such as tenant information, login time, and device information. Session information expiration can include session information corresponding to the session identifier expiring, active logout, cache clearing, or abnormal destruction. The edge gateway is a boundary management component deployed locally, used to verify the identity of service requests received locally. The edge server is a server deployed locally, capable of storing local session-related information and communicating with the edge gateway. The local session is the session data stored on the edge server. The user identifier is the identification information of the end-user's personal account. The cloud service permission level is the business access permission level defined on the cloud side; different users under the same tenant may have the same or different cloud service permission levels. The cloud gateway is a boundary management component deployed in the cloud, used to verify the identity of service requests received from the cloud. A cloud server is a server deployed in the cloud. A cloud session is session data stored on the cloud server. A front-end is the terminal application used by the user.

[0029] Specifically, the cloud gateway can receive a first service request sent by the front end. This first service request carries a session identifier and a tenant identifier. If the cloud gateway detects that the session information corresponding to the session identifier is invalid, it can verify the validity of the local session stored in the edge server with the edge gateway based on the session identifier and the tenant identifier. That is, if the cloud gateway determines that the session information corresponding to the session identifier in the cloud server is invalid, it performs a back-to-origin query on the edge gateway to determine whether the edge gateway has a local session corresponding to the session identifier. If it exists, the local session is considered valid; otherwise, it is considered invalid. At this point, if the local session is valid, the cloud gateway can obtain the user identifier returned by the edge gateway. Further, it queries the user's cloud service permission level based on the tenant identifier and the user identifier. In other words, the cloud gateway can determine the tenant permission level corresponding to the tenant identifier in a multi-tenant architecture based on the tenant identifier, and determine the user's cloud service permission level under that tenant based on the user identifier. Based on this, the cloud gateway can establish a cloud session synchronized with the local session according to the cloud service permission level, filtering out session information that cannot be viewed by the user's cloud service permission level, thus preventing unauthorized tampering by the user. Based on this, the cloud gateway can forward the first service request to the cloud server, forward the data returned by the cloud server in response to the first service request to the front end, and synchronize the data to the cloud session.

[0030] The above technical solution receives a first service request from the front end, which includes a session identifier and a tenant identifier. If the session information corresponding to the session identifier is found to be invalid, a query is sent to the edge gateway. This query also includes the session identifier and the tenant identifier. The edge gateway verifies the validity of the local session on the edge server based on the session identifier and the tenant identifier. Furthermore, compared to existing technologies, this eliminates the need for separate authentication at the edge and cloud. With a valid local session, the cloud gateway can obtain the user identifier returned by the edge gateway, query the user's cloud service permission level based on the tenant identifier and the user identifier, and establish a cloud session synchronized with the local session based on this cloud service permission level. The first service request can be forwarded to the cloud server, and the data returned by the cloud server in response to the first service request can be forwarded to the front end. This eliminates the need for re-authentication at the cloud while completing authentication at the edge, improving the user experience for operators.

[0031] In this embodiment of the application, the authentication method further includes: if the session information corresponding to the session identifier is detected to be valid, forwarding the first service request to the cloud server; and forwarding the data returned by the cloud server in response to the first service request to the front end.

[0032] It can be understood that valid session information means that the session information corresponding to the session identifier is in a valid state that is not expired and can be used for authentication normally.

[0033] Specifically, when the cloud gateway detects that the session information corresponding to the session identifier is valid, it indicates that the cloud gateway has already logged in and the authentication information is valid. At this point, there is no need to initiate a query to the edge gateway; the cloud gateway can process the first service request in the cloud. Based on this, the cloud gateway can forward the first service request to the cloud server and forward the data returned by the cloud server in response to the first service request to the front end. This technical solution ensures the continuity of user service access by allowing the cloud gateway to process the first service request in the cloud without initiating a query to the edge gateway, eliminating the need for repeated login authentication and improving the user experience.

[0034] In this embodiment of the application, sending a query to the edge gateway includes: determining the edge gateway authentication interface corresponding to the tenant identifier; and forwarding the session identifier and the tenant identifier to the edge gateway corresponding to the edge gateway authentication interface to send a query to the edge gateway.

[0035] It can be understood that the edge gateway authentication interface is a service interface used at the edge gateway for session validity verification. Each tenant corresponds to one edge gateway authentication interface, realizing tenant isolation in a multi-tenant architecture.

[0036] Specifically, the cloud gateway can determine the edge gateway authentication interface corresponding to the tenant identifier and forward the session identifier and tenant identifier to the edge gateway corresponding to the edge gateway authentication interface to send a query to the edge gateway. In this way, the cloud gateway forwards the session identifier and tenant identifier to the edge gateway authentication interface that matches the tenant identifier, which can realize tenant-level directed routing and access isolation, avoiding the risk of cross-tenant access unauthorized access in multi-tenant scenarios.

[0037] In this embodiment of the application, after forwarding the data returned by the cloud server in response to the first service request to the front end, the authentication method further includes: obtaining a second service request sent by the front end, the second service request including a request domain name and a tenant identifier to be verified; determining a first tenant identifier associated with the request domain name; verifying the tenant identifier to be verified according to the first tenant identifier to obtain a first verification result; receiving the second service request if the first verification result is a successful verification; and rejecting the second service request if the first verification result is a failed verification.

[0038] It can be understood that the second service request is a business access request initiated after the first service request. The second service request may include, but is not limited to, a request domain name and a tenant identifier to be verified. The first tenant identifier is a pre-set tenant identifier uniquely bound to the request domain name. The request domain name is the domain name address used by the front-end to access the service. Each request domain name is bound to one tenant, that is, each request domain name corresponds to one first tenant identifier. The tenant identifier to be verified is the tenant identifier to be verified in the second service request. The first verification result is the result obtained after verifying the tenant identifier to be verified based on the request domain name.

[0039] Specifically, after the cloud gateway forwards the data returned by the cloud server in response to the first service request to the front end, the cloud gateway can obtain the second service request sent by the front end. The cloud gateway can also query the cloud server for the first tenant identifier associated with the request domain name in the second service request. Thus, the cloud gateway can verify the tenant identifier to be verified based on the first tenant identifier, i.e., determine whether the tenant identifier to be verified matches the first tenant identifier, and obtain the first verification result. If the cloud gateway determines that the tenant identifier to be verified matches the first tenant identifier, it means the first verification result is successful, and the cloud gateway can accept the second service request. However, if the cloud gateway determines that the tenant identifier to be verified does not match the first tenant identifier, it means the second service request is a cross-tenant access request, i.e., the first verification result is unsuccessful. In this case, to achieve tenant-level data isolation in a multi-tenant architecture, the cloud gateway can reject the second service request. The above technical solution, by introducing the request domain name in the second service request to verify the tenant identifier to be verified, can effectively prevent tenant identifier forgery and cross-tenant access, achieving cloud access security in multi-tenant scenarios.

[0040] In this embodiment of the application, after receiving the second service request, the process includes: determining a second tenant identifier associated with the cloud session; verifying the tenant identifier to be verified based on the second tenant identifier to obtain a second verification result; processing the second service request if the second verification result is successful; and rejecting the second service request if the second verification result is unsuccessful.

[0041] It can be understood that the second tenant identifier is the tenant identifier pre-bound to the currently established cloud session. The second verification result is the result obtained after verifying the tenant identifier to be verified based on the cloud session.

[0042] Specifically, if the first verification result is successful, the cloud gateway can further determine the second tenant identifier associated with the cloud session. Based on the second tenant identifier, it performs a second verification on the tenant identifier to be verified, i.e., determines whether the tenant identifier to be verified is consistent with the second tenant identifier, thus obtaining a second verification result. If the cloud gateway determines that the tenant identifier to be verified is consistent with the second tenant identifier, the second verification result is successful, and the cloud gateway can process the second service request. However, if the cloud gateway determines that the tenant identifier to be verified is inconsistent with the second tenant identifier, the second service request is a cross-tenant access request, i.e., the second verification result is unsuccessful. In this case, to achieve tenant-level data isolation in a multi-tenant architecture, the cloud gateway can reject the second service request. This technical solution, by introducing the second tenant identifier bound to the cloud session and performing a second verification on the tenant identifier to be verified, can achieve tenant consistency verification at the session level, preventing cross-tenant unauthorized access caused by malicious tampering of tenant identifiers.

[0043] In this embodiment of the application, the authentication method further includes: receiving a session identifier corresponding to the local session sent by the edge gateway when the edge gateway detects that the local session has been cleared; and clearing the cloud session corresponding to the session identifier.

[0044] Specifically, when the cloud gateway detects that the edge gateway has cleared a local session, it can receive a session identifier corresponding to that local session from the edge gateway. Based on this identifier, the cloud gateway can clear the cloud session corresponding to the session identifier. When the cloud gateway determines that the edge gateway has destroyed a local session, it simultaneously clears the corresponding cloud session, avoiding data inconsistency issues where the local session has expired while the cloud session remains valid. This achieves a one-time clear, global invalidation, improving access security for multi-tenants.

[0045] One specific embodiment of this application provides an authentication method for a cloud gateway. This method includes: a front-end can be deployed at the edge, where user login and page operations can be completed on the front-end page at the edge. The front-end requests the edge gateway (i.e., the local gateway) or the cloud gateway based on the affiliation of the corresponding functional modules. The user can enter their account and password on the front-end at the factory side to generate a login request, which is sent to the edge gateway. The edge gateway can perform authentication based on locally synchronized user login data. After successful login authentication, the edge gateway can create a local session and generate a list of accessible menus based on the user's permissions, returning this list to the front-end. At this point, the user has completed login authentication with the edge gateway.

[0046] Based on this, such as Figure 2 As shown, when a user interacts with a cloud-based function module on the front end, the front end can generate a first service request, and this first service request carries a session identifier and a tenant identifier (such as...). Figure 2 (The session ID and tenant ID in the code) The frontend can also forward the first service request to the cloud gateway. The cloud gateway can verify the validity of the cloud session based on the first service request at the interceptor layer. If the cloud session is valid, the cloud gateway forwards the first service request to the cloud server (i.e., ...). Figure 2 In the cloud services (in the context of cloud services), the cloud server responds to the first service request by returning the retrieved data to the cloud gateway, which then forwards the data to the front end. However, if the cloud session is invalid or does not exist, the cloud gateway can query the routing table based on the tenant ID in the request to find the edge gateway authentication interface corresponding to that tenant. The cloud gateway can then forward the session ID and tenant ID from the first service request to the edge gateway corresponding to that edge gateway authentication interface, thus performing a back-to-origin query. The edge gateway then forwards the session ID and tenant ID to the edge server (e.g., ...). Figure 2 In the context of edge services, the edge server can verify the validity of a local session based on the session ID. If the local session is valid, the edge server can send the user ID and tenant ID to the edge gateway. The edge gateway can encrypt the user ID and tenant ID and send the encrypted user ID and tenant ID to the cloud gateway. The cloud gateway can decrypt the encrypted user ID and tenant ID and query the cloud permission system to obtain the user's cloud service permission level. Furthermore, the cloud gateway can construct a cloud session based on the cloud service permission level, synchronizing the cloud session with the local session and implementing cloud login authentication. Based on this, the cloud gateway can forward the first service request to the cloud server and forward the data returned by the cloud server in response to the first service request to the front end.

[0047] If a user initiates a logout at the edge frontend, the frontend can simultaneously call the logout interface of the edge gateway and the cloud gateway. After the edge gateway clears the local session, it will send the session ID corresponding to the local session to the cloud gateway. The cloud gateway can then clear the corresponding cloud session based on the session ID, thus achieving synchronous destruction of sessions at both the cloud and edge.

[0048] like Figure 3 As shown, the cloud centrally maintains basic data such as organizational structure, role permissions, and menu resources. Modifications to this basic data all request the cloud gateway. The cloud server periodically distributes relevant data to the factory according to the factory's organizational structure, and the edge establishes a data copy (i.e., ...). Figure 3 The data copies of Factory A, Factory B, and Factory C facilitate login authentication and permission checks at the edge.

[0049] like Figure 4As shown, after login authentication is implemented in the cloud, the cloud can assign a subdomain and tenant ID to each edge factory. The frontend can generate a second service request, which carries the request domain and the tenant identifier to be verified. The cloud gateway first checks whether the tenant ID bound to the request domain and the tenant identifier to be verified match, and verifies whether the tenant identifier to be verified is forged (i.e., ...). Figure 4 The first layer of the cloud gateway (based on this) allows it to intercept attacks that tamper with DNS settings and point to other domains. Domain names are bound to tenant IDs; if a domain name is tampered with and doesn't match the corresponding tenant, it's directly blocked. If the tenant ID bound to the requested domain name matches the tenant identifier to be verified, the cloud gateway then checks whether the tenant identifier bound to the cloud session matches the tenant identifier to be verified (i.e.,...). Figure 4 The second layer (in the context of multi-tenant architecture) allows the cloud gateway to intercept attacks that forge tenant IDs. Tenant IDs within a cloud session are immutable; if a forged tenant ID does not match the tenant identifier bound to the cloud session, its access is directly blocked. The cloud gateway can also intercept attacks that steal other users' session IDs. Since sessions are bound to specific tenants, stolen sessions can only access the resources of their corresponding tenant and cannot bypass authorization across tenant boundaries. If the tenant identifier bound to the cloud session matches the tenant identifier to be verified, the cloud gateway completes the verification process and forwards the second service request to the backend service for processing. The backend service can also use the tenant ID and user ID as filtering conditions to achieve information isolation in a multi-tenant architecture (i.e.,...). Figure 4 (The third layer in the process). For attack scenarios where a direct connection to the backend bypasses gateway verification, the cloud gateway can refuse to serve the request because its session lacks context.

[0050] In addition, such as Figure 5 As shown, cloud, edge, and client devices can each deploy corresponding message queue (MQ) servers on the intranet. Simultaneously, MQ bridging services are deployed on both the cloud and edge devices. Based on this, the edge device writes the tenant ID through the MQ bridging service, and the corresponding MQ bridging service on the cloud determines and distributes data to the corresponding edge device based on the tenant ID, achieving precise data forwarding based on the tenant ID. The MQ bridging service provides a receiving HTTP interface; received and forwarded messages are then written to the locally deployed MQ server, ensuring both stability and eliminating the need to modify business logic.

[0051] Based on this, this application constructs a technical system under a cloud-edge-device multi-tenant architecture, with tenant identification as the core, cloud-edge collaboration as the foundation, and end-to-end session and data management. Through single sign-on and seamless switching, it avoids the problems of multiple logins and lag during switching common in traditional solutions, achieving one-time authentication and end-to-end access, improving user operation smoothness and enhancing the user experience. Furthermore, tenant identification is used throughout the entire process to achieve information isolation between tenants.

[0052] This application also provides a cloud gateway, including: a memory configured to store instructions; and a processor configured to retrieve instructions from the memory and, when executing the instructions, to implement the authentication method for the cloud gateway described above.

[0053] This application also provides an authentication system, including: a cloud gateway as described above; a cloud server communicating with the cloud gateway; an edge gateway; and an edge server communicating with the edge gateway.

[0054] This application also provides a machine-readable storage medium storing instructions that cause a machine to execute the authentication method for a cloud gateway described above.

[0055] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the authentication method for a cloud gateway described above.

[0056] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0057] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0058] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1The function specified in one or more boxes.

[0059] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0060] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0061] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0062] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0063] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0064] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. An authentication method for a cloud gateway, characterized in that, include: Receive a first service request sent by the front end, wherein the first service request includes a session identifier and a tenant identifier; If the session information corresponding to the session identifier is detected to be invalid, a query is sent to the edge gateway. The query includes the session identifier and the tenant identifier, wherein the edge gateway verifies the validity of the local session of the edge server based on the session identifier and the tenant identifier. If the local session is valid, obtain the user identifier returned by the edge gateway; Query the user's cloud service permission level based on the tenant identifier and the user identifier; Establish a cloud session synchronized with the local session based on the cloud service permission level; Forward the first service request to the cloud server; The data returned by the cloud server in response to the first service request is forwarded to the front end.

2. The authentication method according to claim 1, characterized in that, The authentication method further includes: If the session information corresponding to the session identifier is found to be valid, the first service request is forwarded to the cloud server; The data returned by the cloud server in response to the first service request is forwarded to the front end.

3. The authentication method according to claim 1, characterized in that, Sending a query to the edge gateway includes: Determine the edge gateway authentication interface corresponding to the tenant identifier; The session identifier and the tenant identifier are forwarded to the edge gateway corresponding to the edge gateway authentication interface in order to send a query to the edge gateway.

4. The authentication method according to claim 1, characterized in that, After forwarding the data returned by the cloud server in response to the first service request to the front end, the authentication method further includes: Obtain the second service request sent by the front end, the second service request including the request domain name and the tenant identifier to be verified; Determine the first tenant identifier associated with the requested domain name; Based on the first tenant identifier, the tenant identifier to be verified is verified to obtain a first verification result; If the first verification result is successful, the second service request will be received. If the first verification result is that the verification fails, the second service request is rejected.

5. The authentication method according to claim 4, characterized in that, After receiving the second service request, the process includes: Determine the second tenant identifier associated with the cloud session; The tenant identifier to be verified is verified based on the second tenant identifier to obtain a second verification result; If the second verification result is successful, the second service request will be processed. If the second verification result is that the verification fails, the second service request is rejected.

6. The authentication method according to claim 1, characterized in that, The authentication method further includes: If the edge gateway is detected to have cleared the local session, the edge gateway shall send the session identifier corresponding to the local session. The cloud session corresponding to the session identifier is cleared.

7. A cloud gateway, characterized in that, include: The memory is configured to store instructions; as well as The processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the authentication method for a cloud gateway according to any one of claims 1 to 6.

8. An authentication system, characterized in that, include: The cloud gateway according to claim 7; The cloud server communicates with the cloud gateway; Edge gateway; The edge server communicates with the edge gateway.

9. A machine-readable storage medium, characterized in that, The machine-readable storage medium stores instructions for causing the machine to perform the authentication method for a cloud gateway according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the authentication method for a cloud gateway according to any one of claims 1 to 6.

Images