A cloud management platform-based access control method and cloud management platform

Abstract

The application discloses a cloud management platform-based access control method and a cloud management platform, and is beneficial to reduce the cost required by the cloud management platform for managing access control. The method comprises the following steps: when a tenant needs to access a target application, the tenant can send an application access request of the tenant to an access interface provided by the cloud management platform. Since the application access is used to indicate the target application in the plurality of applications, the cloud management platform can acquire a preset mapping table based on the request. The mapping table records the binding relationship between a plurality of applications and a plurality of identity credentials. One application in the plurality of applications can be bound with at least one identity credential in the plurality of identity credentials. Then, the cloud management platform can determine at least one identity credential bound with the target application from the mapping table, and select a target identity credential from the at least one identity credential, so as to access the target application based on the target identity credential, thereby meeting the application access demand of the tenant.

Description

Technical Field

[0001] This application relates to the field of cloud technology, and in particular to an access control method based on a cloud management platform and a cloud management platform. Background Technology

[0002] With the rapid development of cloud technology, more and more tenants are choosing cloud resources provided by cloud providers to deploy their applications. When tenants access applications in the cloud, they often need the cloud provider to provide identity credentials that allow them to successfully access the application.

[0003] In related technologies, a cloud service system may include a cloud management platform and infrastructure. The infrastructure can be used to deploy multiple applications specified by a tenant. These multiple applications may belong to multiple tenant accounts, and they typically correspond to multiple access permissions. Therefore, the cloud management platform can apply for multiple identity credentials for these applications based on their respective accounts and access permissions. In this way, when a tenant needs to access a particular application, the cloud management platform can access the application using the corresponding identity credentials based on the account and access permissions associated with that application.

[0004] In the above process, since multiple identity credentials are applied for and stored according to dimensions such as account and operation permissions, the cost of managing identity credentials on the cloud management platform is high, and the operation complexity when tenants use identity credentials to access applications is also high. Summary of the Invention

[0005] This application provides an access control method and a cloud management platform based on a cloud management platform, which helps to reduce the cost required for cloud management platforms to manage access control.

[0006] A first aspect of this application provides an access control method based on a cloud management platform. The cloud management platform implementing this method manages infrastructure that provides cloud services to tenants. This infrastructure may include one or more cloud instances, which may run multiple applications accessible to the tenants. The method includes:

[0007] When a tenant needs to access a target application among these multiple applications, the tenant can input the application access request set by the tenant into the access interface provided by the cloud management platform. Therefore, the cloud management platform can receive the application access request sent by the tenant through the access interface. The application access request is used to indicate the target application to be accessed by the user.

[0008] After receiving an application access request, the cloud management platform can determine the target application that the tenant needs to access based on the request. Therefore, the cloud management platform can obtain a pre-set mapping table, which records the binding relationship between multiple applications and multiple identity credentials. Any one of these multiple applications can be bound to at least one of these identity credentials.

[0009] After obtaining the mapping table, the cloud management platform can retrieve at least one identity credential bound to the target application from the mapping table, and select the target identity credential from the at least one identity credential bound to the target application. Subsequently, the cloud management platform can use the target identity credential to access the target application, thereby satisfying the tenant's access requirements for the target application.

[0010] As can be seen from the above methods, the cloud management platform can record the binding relationship between multiple applications and multiple identity credentials in a unified mapping table. In other words, the cloud management platform manages identity credentials in a unified way from the application dimension, which helps to reduce the cost of managing identity credentials for the cloud management platform. Moreover, when a tenant accesses a target application, they only need to directly specify the target application. Therefore, the cloud management platform can directly select the target identity credential that can be used to access the target application from the mapping table to access the target application quickly and accurately. This helps to reduce the complexity of the operations required for tenants to access the target application and improves the tenant experience.

[0011] In one possible implementation, the method further includes: a cloud management platform receiving an identity configuration request sent by a tenant through a configuration interface, wherein the identity configuration request instructs the tenant to obtain multiple identity credentials for multiple applications; the cloud management platform generating multiple identity credentials based on the identity configuration request and displaying the multiple applications and multiple identity credentials to the tenant through the configuration interface; and the cloud management platform receiving a binding relationship sent by the tenant through the configuration interface and recording the binding relationship in a mapping table, wherein the binding relationship is generated by the tenant based on multiple applications and multiple identity credentials. In the aforementioned implementation, when a tenant needs to set multiple identity credentials for these multiple applications, the tenant can input the identity configuration request set by the tenant into the configuration interface provided by the cloud management platform. Therefore, the cloud management platform can receive the identity configuration request sent by the tenant through the configuration interface, and the identity configuration request instructs the tenant to obtain multiple identity credentials for multiple applications. Upon receiving an identity configuration request, the cloud management platform can generate multiple identity credentials for these applications based on the request. It then presents these applications and credentials to the tenant through a configuration interface, allowing the tenant to build the binding relationships between them. This binding relationship is then provided to the cloud management platform via the configuration interface, enabling the platform to record it in a pre-created mapping table. Therefore, the cloud management platform can work with the tenant to build a mapping table that records the binding relationships between multiple applications and multiple identity credentials. This facilitates the cloud management platform in accurately selecting the target identity credential for accessing the target application from the mapping table.

[0012] In one possible implementation, the method further includes: for any one of the multiple applications, the cloud management platform obtains and records the priority of at least one identity credential bound to the application. Specifically, for any identity credential bound to the application, the higher the priority of the identity credential, the less operational authority the cloud management platform has over the application when accessing it based on the identity credential. In the aforementioned implementation, for any one of the multiple applications, the cloud management platform can generate its own priority or have it provided by the tenant to the cloud management platform for at least one identity credential bound to the application. Therefore, the cloud management platform can record the priority of at least one identity credential bound to the application. Specifically, for any identity credential bound to the application, the higher the priority of the identity credential, the less operational authority the cloud management platform has over the application when accessing it based on the identity credential; conversely, the lower the priority of the identity credential, the greater the operational authority the cloud management platform has over the application when accessing it based on the identity credential. Therefore, the cloud management platform can set priorities for each identity credential bound to each application. Subsequently, when the cloud management platform selects identity credentials for the applications that the tenant needs to access, it can select identity credentials according to their priority.

[0013] In one possible implementation, the cloud management platform selects the target identity credential from at least one identity credential bound to the target application. This includes: when the application access request does not specify a target identity credential, the cloud management platform determines the highest-priority identity credential among the at least one identity credential bound to the target application as the target identity credential. In the aforementioned implementation, if the application access request only indicates the target application but does not specify a target identity credential, the cloud management platform can determine the highest-priority identity credential among the at least one identity credential bound to the target application as the target identity credential. In this way, the cloud management platform can subsequently use the target identity credential to successfully access the target application.

[0014] In one possible implementation, the cloud management platform selecting the target identity credential from at least one identity credential bound to the target application includes: when the application access request indicates a target identity credential, the cloud management platform determines the target identity credential from at least one identity credential bound to the target application. In the aforementioned implementation, if the application access request not only indicates the target application but also indicates a target identity credential, the cloud management platform determines the target identity credential from at least one identity credential bound to the target application. In this way, the cloud management platform can subsequently successfully access the target application using the target identity credential.

[0015] In one possible implementation, the method further includes: for any one of multiple applications, the cloud management platform obtains the validity period of at least one identity credential bound to the application; after the validity period expires, the cloud management platform generates at least one new identity credential and replaces the at least one identity credential bound to the application with the at least one new identity credential. In the aforementioned implementation, for any one of multiple applications serving a tenant, after determining that the validity period of at least one identity credential bound to that application has expired, the cloud management platform can generate at least one new identity credential to replace the original at least one identity credential. Therefore, the cloud management platform also sets an validity period for identity credentials. Once the validity period expires, the cloud management platform can promptly generate a new identity credential to replace the original identity credential, ensuring that the application is always bound to an identity credential within its validity period. This automatically renews identity credentials without the need for staff intervention and reduces the complexity of the process.

[0016] In one possible implementation, the target identity credential is a first-format identity credential. The cloud management platform accesses the target application based on this target identity credential by: converting the target identity credential to obtain a converted target identity credential, wherein the converted target identity credential is a second-format identity credential, and the first and second formats are different formats; and then the cloud management platform accesses the target application based on the converted target identity credential. In the aforementioned implementation, if the target identity credential is a first-format identity credential, and the target application cannot be accessed using the first-format identity credential but can be accessed using the second-format identity credential, the cloud management platform performs a format conversion on the target identity credential to obtain a converted target identity credential, which is a second-format identity credential. Then, the cloud management platform can use the converted target identity credential to access the target application. Therefore, the cloud management platform can support multiple types of identity credentials, including first-format and second-format identity credentials, etc. If an identity credential of a certain format bound to an application cannot be used to access that application, the cloud management platform can convert it to another format identity credential for accessing the application. In this way, various types of applications can be deployed in the cloud to meet the diverse access needs of tenants, thereby improving the user experience.

[0017] In one possible implementation, the multiple applications include at least one of the following: applications provided by the cloud management platform to the tenant and the tenant's applications.

[0018] A second aspect of this application provides a cloud management platform for managing infrastructure that provides cloud services to tenants. The infrastructure includes cloud instances running multiple applications accessible to the tenants. The cloud management platform includes: a first receiving module for receiving application access requests sent by tenants through an access interface, wherein the application access request indicates a target application among the multiple applications; a first obtaining module for obtaining a preset mapping table based on the application access request, wherein the mapping table records the binding relationships between multiple applications and multiple identity credentials, and one of the multiple applications is bound to at least one of the multiple identity credentials; a determining module for determining at least one identity credential bound to the target application based on the mapping table, and selecting a target identity credential from the at least one identity credential bound to the target application; and an access module for accessing the target application based on the target identity credential.

[0019] In one possible implementation, the cloud management platform further includes: a second receiving module, used to receive an identity configuration request sent by a tenant through a configuration interface, wherein the identity configuration request is used to instruct the tenant to obtain multiple identity credentials for multiple applications; a generation module, used to generate multiple identity credentials based on the identity configuration request, and to display multiple applications and multiple identity credentials to the tenant through the configuration interface; and a third receiving module, used to receive a binding relationship sent by the tenant through the configuration interface, and to record the binding relationship in a mapping table, wherein the binding relationship is generated by the tenant based on multiple applications and multiple identity credentials.

[0020] In one possible implementation, the cloud management platform further includes: a second acquisition module, used to acquire the priority of at least one identity credential bound to any one of the multiple applications, and record the priority of at least one identity credential bound to the application, wherein for any identity credential bound to the application, the higher the priority of the identity credential, the smaller the operation permissions that the cloud management platform has for the application when accessing the application based on the identity credential.

[0021] In one possible implementation, the determining module is configured to: determine the highest priority identity credential among at least one identity credential bound to the target application as the target identity credential, in the case where the application access request does not indicate the target identity credential.

[0022] In one possible implementation, the determining module is configured to: determine the target identity credential from at least one identity credential bound to the target application, provided that the application access request indicates the target identity credential.

[0023] In one possible implementation, the cloud management platform further includes: a third acquisition module, used to acquire the validity period of at least one identity credential bound to any one of the multiple applications; and a replacement module, used to generate at least one new identity credential after the validity period expires, and use the at least one new identity credential to replace the at least one identity credential bound to the application.

[0024] In one possible implementation, the target identity credential is an identity credential in a first format. The access module is used to: convert the target identity credential to obtain a converted target identity credential, wherein the converted target identity credential is an identity credential in a second format, and the first format and the second format are different formats; and access the target application based on the converted target identity credential.

[0025] In one possible implementation, the multiple applications include at least one of the following: applications provided by the cloud management platform to the tenant and the tenant's applications.

[0026] A third aspect of this application provides a computing device cluster, which includes at least one computing device, each computing device including a processor and a memory: the memory is used to store instructions; the processor is used to cause the computing device cluster to perform the method described in the first aspect or any possible implementation of the first aspect according to the instructions.

[0027] A fourth aspect of this application provides a computer storage medium storing one or more instructions that, when executed by one or more computers, cause the one or more computers to perform the method described in the first aspect or any possible implementation of the first aspect.

[0028] A fifth aspect of this application provides a computer program product storing instructions that, when executed by a computer, cause the computer to perform the method described in the first aspect or any possible implementation of the first aspect.

[0029] In this embodiment, when a tenant needs to access a target application, the tenant can send an application access request to the access interface provided by the cloud management platform. Since application access is used to indicate the target application among multiple applications, the cloud management platform can obtain a pre-set mapping table based on the request. This mapping table records the binding relationships between multiple applications and multiple identity credentials. One of these applications can be bound to at least one of these identity credentials. Then, the cloud management platform can determine the at least one identity credential bound to the target application from the mapping table and select the target identity credential from these at least one identity credential to access the target application based on the target identity credential, thereby satisfying the tenant's application access needs. In the aforementioned process, the cloud management platform can record the binding relationships between multiple applications and multiple identity credentials in a unified mapping table. That is, the cloud management platform manages identity credentials uniformly from the application dimension, which helps reduce the cost of managing identity credentials for the cloud management platform. Moreover, when a tenant accesses a target application, they only need to directly specify the target application. Therefore, the cloud management platform can directly select the target identity credential that can be used to access the target application from the mapping table to quickly and accurately access the target application. This helps reduce the complexity of the operations required for tenants to access the target application and improves the tenant experience. Attached Figure Description

[0030] Figure 1 A schematic diagram of the structure of the cloud service system provided in the embodiments of this application;

[0031] Figure 2 Another structural diagram of the cloud management platform provided in the embodiments of this application;

[0032] Figure 3 A flowchart illustrating an access control method based on a cloud management platform provided in an embodiment of this application;

[0033] Figure 4 This is another schematic diagram of the cloud service system provided in the embodiments of this application;

[0034] Figure 5 This is another schematic diagram of the cloud service system provided in the embodiments of this application;

[0035] Figure 6 Another structural diagram of the cloud management platform provided in the embodiments of this application;

[0036] Figure 7 A schematic diagram of the structure of a computing device provided in an embodiment of this application;

[0037] Figure 8 A schematic diagram of the structure of a computing device cluster provided in an embodiment of this application;

[0038] Figure 9A schematic diagram showing computer devices in a computer cluster 900 provided in this application embodiment connected via a network. Detailed Implementation

[0039] This application provides an access control method and a cloud management platform based on a cloud management platform, which helps to reduce the cost required for cloud management platforms to manage access control.

[0040] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms are interchangeable where appropriate; this is merely a way of distinguishing objects with the same attributes in the embodiments of this application. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, so that a process, method, system, product, or apparatus that comprises a series of elements is not necessarily limited to those elements, but may include other elements not explicitly listed or inherent to those processes, methods, products, or apparatuses.

[0041] With the rapid development of cloud technology, more and more tenants are choosing cloud resources provided by cloud providers to deploy their applications. When tenants access applications in the cloud, they often need the cloud provider to provide identity credentials that allow them to successfully access the application.

[0042] In related technologies, a cloud service system may include a cloud management platform and infrastructure. The infrastructure can be used to deploy multiple applications specified by a tenant. These applications may belong to multiple accounts of the tenant, and each application typically corresponds to multiple access permissions. Therefore, the cloud management platform can apply for multiple identity credentials for these applications based on their respective accounts and access permissions. In other words, applications under different accounts have different identity credentials, and applications with different access permissions also have different identity credentials. Thus, when a tenant needs to access an application, the cloud management platform can access the application using the corresponding identity credentials based on the account and access permissions (usually determined by the tenant).

[0043] In the above process, since multiple identity credentials are applied for and stored according to dimensions such as account and operation permissions, the cost of managing identity credentials on the cloud management platform is high, and the operation complexity when tenants use identity credentials to access applications is also high.

[0044] Furthermore, the types of identity credentials supported by the cloud management platform are relatively limited. If some applications require other types of identity credentials to access them, the cloud management platform cannot ensure that tenants can successfully access these applications, resulting in a poor tenant experience.

[0045] Furthermore, since identity credentials are usually short-term credentials, once they expire, developers need to log in to the platform to ensure their renewal, which leads to a large workload for staff and increases the complexity of the work.

[0046] To address the aforementioned issues, this application provides an access control method based on a cloud management platform, which can be implemented through a cloud service system. Figure 1 A schematic diagram of the cloud service system provided in the embodiments of this application is shown below. Figure 1 As shown, a cloud service system includes the infrastructure that provides cloud services and a cloud management platform that manages this infrastructure. The cloud management platform and the infrastructure are described separately below:

[0047] A cloud management platform can centrally manage the infrastructure of the entire cloud service system (for example, according to a tenant's instructions, multiple cloud instances can be created using the infrastructure, and these cloud instances can run multiple applications specified by the tenant to meet the tenant's application access needs, etc.). The cloud management platform can also be open to tenants outside the cloud service system and respond to their requests. For example, the cloud management platform can provide various interfaces such as login, configuration, and access interfaces for tenant clients (e.g., the terminal devices used by the tenant or the browsers on those devices) to access. Specifically, the cloud management platform can authenticate a tenant's client through the login interface, allowing the tenant's client to log in after successful authentication. Furthermore, the cloud management platform can also allow the tenant's client to send an identity configuration request to the cloud management platform through the configuration interface. Since the identity configuration request instructs the tenant to apply for multiple identity credentials for multiple applications, the cloud management platform can apply for multiple identity credentials for these applications based on the request, establish a binding relationship between these applications and these identity credentials, and record it in a pre-defined mapping table. For example, the cloud management platform can also allow the tenant's client to send the tenant's application access request to the cloud management platform through the access interface. Since the application access is used to indicate the target application among these multiple applications, the cloud management platform can obtain the aforementioned mapping table based on the request, determine at least one identity credential bound to the target application from the mapping table, and select the target identity credential from these at least one identity credential to access the target application based on the target identity credential, thereby satisfying the tenant's application access requirements.

[0048] The infrastructure comprises multiple cloud instances created by the cloud management platform. Each of these cloud instances occupies a certain amount of computing resources (e.g., central processing unit (CPU) and graphics processing unit (GPU), etc.), a certain amount of storage resources (e.g., memory and disk), and a certain amount of network resources (e.g., network interface cards, etc.). Therefore, these multiple cloud instances as a whole possess a large number of resources, and thus, they can work together to provide high-quality remote services to tenants.

[0049] Furthermore, these multiple cloud instances can be used to run multiple applications specified by the tenant. These applications can be applications provided to the tenant by the cloud management platform (also known as cloud-native applications or cloud services, etc.), or applications owned by the tenant, etc. There are no specific restrictions here.

[0050] Furthermore, such as Figure 2 As shown ( Figure 2 (This is another structural diagram of the cloud management platform provided in this application embodiment). The cloud management platform may include an identity and access management center and a command line interface (CLI). The CLI may include an interface, a configuration module, a mapping module, and an access control module. The interface may include the aforementioned login interface, configuration interface, and access interface, etc. After receiving an identity configuration request from a tenant sent by the configuration interface, the configuration module can log in to IAM to obtain information about these multiple applications (e.g., the type, name, operation permissions, and account of these multiple applications, etc.) since the request indicates multiple applications specified by the tenant. Based on this information, the configuration module generates multiple identity credentials to obtain the binding relationship between these multiple applications and these multiple identity credentials according to the tenant's requirements, and records these binding relationships in the mapping table of the mapping module. After receiving an application access request from a tenant sent by the access interface, the access control module can obtain a mapping table from the mapping module, obtain at least one identity credential bound to the target application from the mapping table, and select a target identity credential from these at least one identity credential to access the target application based on the target identity credential.

[0051] Furthermore, multiple cloud instances in the infrastructure can be presented in various ways. For example, these multiple cloud instances can be physical servers selected by the cloud management platform in the infrastructure; they can also be bare metal servers (BMS) selected by the cloud management platform in the infrastructure; they can also be virtual machines (VMs) created by the cloud management platform on physical servers using virtualization technology; they can also be containers created by the cloud management platform on physical servers using virtualization technology; they can also be micro VMs created by the cloud management platform on physical servers using virtualization technology, and so on.

[0052] Furthermore, for multiple cloud instances in the infrastructure, these instances can be deployed on the same site or different sites. These sites can be presented in various forms, such as one or more regions within the infrastructure, one or more availability zones (AZs) within the infrastructure, one or more data centers (DCs) within the infrastructure, one or more server rooms within the infrastructure, or one or more racks within the infrastructure.

[0053] Based on the aforementioned cloud service system, when a tenant needs to access a target application, the tenant can send an application access request to the access interface provided by the cloud management platform. Since application access is used to indicate the target application among multiple applications, the cloud management platform can obtain a pre-defined mapping table based on this request. This mapping table records the binding relationships between multiple applications and multiple identity credentials. One of these applications can be bound to at least one of these identity credentials. Then, the cloud management platform can determine the at least one identity credential bound to the target application from the mapping table and select the target identity credential from these at least one identity credential to access the target application, thereby satisfying the tenant's application access needs. In the aforementioned process, the cloud management platform can record the binding relationships between multiple applications and multiple identity credentials in a unified mapping table. In other words, the cloud management platform manages identity credentials uniformly from the application dimension, which helps reduce the cost of managing identity credentials for the cloud management platform. Furthermore, when a tenant accesses a target application, they only need to directly specify the target application. Therefore, the cloud management platform can directly select the target identity credential that can be used to access the target application from the mapping table to quickly and accurately access the target application. This helps reduce the complexity of the operations required for tenants to access the target application and improves the tenant experience. To further understand the workflow of the cloud management platform, the following section combines... Figure 3 This workflow will be described in further detail. Figure 3 A flowchart illustrating an access control method based on a cloud management platform provided in an embodiment of this application is shown below. Figure 3 As shown, this method can be achieved through, as Figure 1 The illustrated cloud service system implementation includes infrastructure that provides cloud services to tenants and a cloud management platform that manages this infrastructure. This infrastructure may contain one or more cloud instances, which may run multiple applications accessible to the tenants. The method includes:

[0054] 301. The cloud management platform receives application access requests sent by tenants through the access interface. The application access request is used to indicate the target application among multiple applications.

[0055] In this embodiment, when a tenant needs to access a target application deployed on a cloud instance, the cloud management platform can provide an access interface to the tenant's client (e.g., an application selection bar and an identity credential selection bar on the tenant's interface). Therefore, the tenant can input the application access request set by the tenant into the access interface through their client. In this way, the cloud management platform can receive the application access request sent by the tenant's client through the access interface, where the application access request indicates the target application to be accessed by the user.

[0056] Specifically, application access requests can be presented in the following ways: (1) Application access requests not only indicate the target application that the tenant needs to access, but also indicate the target identity credentials that the tenant has selected for the target application. (2) Application access requests only indicate the target application that the tenant needs to access, without indicating the target identity credentials.

[0057] More specifically, since the multiple applications running on a cloud instance may include at least one of the applications provided by the cloud management platform to the tenant and the tenant's applications, the target application that the tenant needs to access may be at least one of the applications provided by the cloud management platform to the tenant and the tenant's applications.

[0058] For example, when a tenant needs to access a target application (e.g., application 1 deployed in a cloud instance), the tenant can log in to the cloud management platform. The CLI of the cloud management platform can provide a tenant interface, which includes an application selection bar. The tenant can enter the target application they want to access as application 1 in the application selection bar. Of course, the tenant can also enter the identity credential 1 selected by the tenant for application 1 in the identity credential selection bar, or they can leave the identity credential selection bar blank.

[0059] In this way, the information entered by the tenant in the application selection field and the identity credential selection field can be aggregated into an application access request and sent to the CLI. Therefore, the application access request can be used to instruct both application 1 and identity credential 1, or it can be used solely to instruct application 1.

[0060] 302. The cloud management platform obtains a pre-set mapping table based on the application access request. The mapping table is used to record the binding relationship between multiple applications and multiple identity credentials. One of the multiple applications is bound to at least one of the multiple identity credentials.

[0061] Upon receiving an application access request, the cloud management platform can parse the request to determine the target application that the tenant needs to access. Therefore, the cloud management platform can obtain a pre-defined mapping table. This mapping table records the binding relationships between multiple applications and multiple identity credentials within the cloud instance, and within these binding relationships, any one of these applications can be bound to at least one of these identity credentials.

[0062] Specifically, prior to step 301, the cloud management platform may also perform the following operations:

[0063] When a tenant needs to set up multiple identity credentials for multiple applications deployed on a cloud instance, the cloud management platform provides a configuration interface to the tenant's client. The tenant can then input the identity configuration request they set up into the configuration interface (e.g., the configuration request field and application-identity credential binding field in the tenant's interface) through their client. In this way, the cloud management platform can receive the identity configuration request sent by the tenant's client through the configuration interface. This identity configuration request instructs the tenant to provide multiple identity credentials for multiple applications from the cloud management platform.

[0064] Upon receiving the identity configuration request, the cloud management platform can parse the request to determine that multiple identity credentials need to be configured for these applications. Therefore, the cloud management platform can generate multiple identity credentials for these applications and display them to the tenant through the configuration interface for the tenant to manually bind.

[0065] After viewing these multiple applications and identity credentials, tenants can construct the binding relationships between them and input these binding relationships into the configuration interface provided by the cloud management platform through their client. In this way, the cloud management platform can receive the binding relationships between these applications and identity credentials sent by the tenant's client through the configuration interface and record these binding relationships in a pre-created mapping table.

[0066] As in the example above, such as Figure 4 As shown ( Figure 4 (This is another structural diagram of the cloud service system provided in the embodiments of this application). When a tenant needs to set multiple identity credentials for its designated application 1, application 2 and application 3, the tenant can log in to the cloud management platform. The CLI of the cloud management platform can provide a tenant interface for the tenant. The tenant interface includes a configuration request bar. The tenant can enter an identity configuration request in the configuration request bar. This request is used to instruct the tenant to set identity credentials for the application serving the tenant.

[0067] In this way, the CLI can receive identity configuration requests sent by tenants through the configuration request bar. After receiving the identity configuration request, the CLI can determine that the tenant needs to set multiple identity credentials for its applications. Therefore, the CLI can log in to the IAM center and send an information retrieval request to the IAM center. Based on this request, the IAM center will return an information retrieval result to the CLI, which indicates that the applications serving the tenant are Application 1, Application 2, and Application 3. Based on this result, the CLI can generate identity credentials 1 to 9 and display Application 1 to Application 3 and identity credentials 1 to 9 in the display bar for the tenant to view.

[0068] After browsing the display, tenants can enter the following binding relationships in the Application-Identity Credential Binding field according to their needs: Identity Credentials 1 to 3 are bound to Application 1, Identity Credentials 4 to 6 are bound to Application 2, and Identity Credentials 7 to 9 are bound to Application 3. In this way, the CLI can receive the binding relationships specified by the tenant through the Application-Identity Credential Binding field and record them in the mapping table.

[0069] More specifically, the cloud management platform can also perform the following operations:

[0070] For any one of the multiple applications, the cloud management platform obtains the priority of at least one identity credential bound to that application and records the priority of at least one identity credential bound to that application.

[0071] It should be noted that the priority of at least one identity credential bound to the application can be provided to the cloud management platform by the tenant, or it can be generated by the cloud management platform itself. For any identity credential bound to the application, the higher the priority of the identity credential, the less operational authority the cloud management platform has over the application when accessing it based on that identity credential; conversely, the lower the priority of the identity credential, the greater the operational authority the cloud management platform has over the application when accessing it based on that identity credential.

[0072] For the other applications among these multiple applications, the cloud management platform can also perform similar operations as it would on the application. Therefore, the cloud management platform can record the priority of multiple identity credentials bound to these multiple applications.

[0073] Continuing with the example above, the tenant can enter the binding relationship in the Application-Identity Credential Binding field, along with the priority of Identity Credential 1 through Identity Credential 3. For Application 1, Identity Credential 1 has the highest priority, followed by Identity Credential 2, and then Identity Credential 3. This means that when the cloud management platform accesses Application 1 based on Identity Credential 1, it has the lowest possible access permissions (e.g., only read operations). When accessing Application 1 based on Identity Credential 2, it has higher access permissions (e.g., only read and modify operations). When accessing Application 1 based on Identity Credential 3, it has higher access permissions (e.g., only read, modify, and delete operations). Similarly, the tenant can also enter the priority of Identity Credential 4 through Identity Credential 6, and the priority of Identity Credential 7 through Identity Credential 9, which will not be elaborated further here.

[0074] 303. The cloud management platform determines at least one identity credential bound to the target application based on the mapping table, and selects the target identity credential from the at least one identity credential bound to the target application.

[0075] After obtaining the mapping table, the cloud management platform can retrieve at least one identity credential bound to the target application from the mapping table, and select one of the identity credentials bound to the target application as the target identity credential for the cloud management platform to access the target application in the future.

[0076] Specifically, the cloud management platform can determine the target identity credentials in several ways:

[0077] (1) If the application access request is only used to indicate the target application, but the application access request is not used to indicate the target identity credential, it means that the tenant has not specified the target identity credential for the target application. Therefore, the cloud management platform can determine the identity credential with the highest priority among at least one identity credential bound to the target application as the target identity credential for the cloud management platform to access the target application in the future.

[0078] (2) If the application access request is used not only to indicate the target application, but also to indicate the target identity credential, it means that the tenant has specified the target identity credential for the target application. Therefore, the cloud management platform determines the target identity credential from at least one identity credential bound to the target application.

[0079] As in the example above, such as Figure 5 As shown ( Figure 5 (This is another schematic diagram of the cloud service system provided in this application embodiment). After receiving an application access request, the CLI can parse the application access request to determine that the tenant needs to access application 1. Then, the CLI can obtain a preset mapping table and determine identity credentials 1 to 3 bound to application 1 from the mapping table. If the application access request also indicates identity credential 1, the CLI can directly obtain identity credential 1 as the target identity credential. If the application access request does not indicate identity credential 1, the CLI can obtain the priority of directly obtaining identity credential 1 to the priority of identity credential 3. Since identity credential 1 has the highest priority among these three identity credentials, the cloud management platform can use identity credential 1 as the target identity credential.

[0080] 304. The cloud management platform accesses the target application based on the target identity credentials.

[0081] Once the target identity credentials are obtained, the cloud management platform can use them to access the target application, thereby meeting the tenant's access needs for the target application.

[0082] Specifically, the cloud management platform can access the target application in the following ways:

[0083] When the target identity credential is a first-format identity credential (e.g., an account and password format), if the target application cannot be accessed using the first-format identity credential but can be accessed using a second-format identity credential, the first and second formats are different. Based on this, the cloud management platform performs a format conversion on the target identity credential to obtain a converted target identity credential (e.g., a token format), where the converted target identity credential is the second-format identity credential.

[0084] Once the converted target identity credentials are obtained, the cloud management platform can use them to access the target application, thereby meeting the tenant's access needs for the target application.

[0085] Continuing with the example above, after identifying credential 1 as the target credential, since credential 1 is a format 1 credential (e.g., credential 1 consists of account 1 and password 1), if application 1 can be accessed using a format 1 credential, the CLI can directly use credential 1 to access application 1. If application 1 cannot be accessed using a format 1 credential, but can be accessed using a format 2 credential, the CLI can convert the format of credential 1 to obtain a converted credential 1 (e.g., a token 1), which is a format 2 credential. Therefore, the CLI can directly use the converted credential 1 to access application 1.

[0086] More specifically, the cloud management platform can also perform the following operations:

[0087] For any one of the multiple applications serving a tenant, the cloud management platform can obtain the expiration date of at least one identity credential bound to that application. After the expiration date, the cloud management platform can generate at least one new identity credential, unbind the at least one identity credential bound to the application from the application, and bind the at least one new identity credential to the application, thereby replacing the original at least one identity credential with the new one.

[0088] Therefore, if a tenant subsequently needs to access the application, the cloud management platform can select one of these at least one new identity credentials to allow the cloud management platform to access the application on behalf of the tenant. The cloud management platform can perform similar operations on the other applications among these multiple applications, which will not be elaborated upon here.

[0089] Continuing with the example above, the CLI can request the validity period of identity credentials 1 to 3 bound to application 1 from the IAM center and record this validity period. The CLI can determine in real time whether the validity period has expired. If so, the CLI can generate identity credentials 10 to 12 (i.e., the aforementioned new identity credentials) and request the validity period of identity credentials 10 to 12 from the IAM center and record it. Then, the CLI can unbind identity credentials 1 to 3 from application 1, bind identity credentials 10 to 12 to application 1, and update the new binding relationship in the mapping table. Therefore, when a tenant needs to access application 1 again, the CLI can select identity credentials 10 to 12 to access application 1.

[0090] The CLI can also perform similar operations for identity credentials 4 to 5 bound to application 2, and identity credentials 7 to 9 bound to application 3, which will not be elaborated here.

[0091] In this embodiment, when a tenant needs to access a target application, the tenant can send an application access request to the access interface provided by the cloud management platform. Since application access is used to indicate the target application among multiple applications, the cloud management platform can obtain a pre-set mapping table based on the request. This mapping table records the binding relationships between multiple applications and multiple identity credentials. One of these applications can be bound to at least one of these identity credentials. Then, the cloud management platform can determine the at least one identity credential bound to the target application from the mapping table and select the target identity credential from these at least one identity credential to access the target application based on the target identity credential, thereby satisfying the tenant's application access needs. In the aforementioned process, the cloud management platform can record the binding relationships between multiple applications and multiple identity credentials in a unified mapping table. That is, the cloud management platform manages identity credentials uniformly from the application dimension, which helps reduce the cost of managing identity credentials for the cloud management platform. Moreover, when a tenant accesses a target application, they only need to directly specify the target application. Therefore, the cloud management platform can directly select the target identity credential that can be used to access the target application from the mapping table to quickly and accurately access the target application. This helps reduce the complexity of the operations required for tenants to access the target application and improves the tenant experience.

[0092] Furthermore, in this embodiment, the cloud management platform supports multiple types of identity credentials, including first-format and second-format credentials, etc. If a certain format of identity credential bound to an application cannot be used to access that application, the cloud management platform can convert it into another format of identity credential for accessing the application. In this way, various types of applications can be deployed in the cloud to meet the diverse access needs of tenants, thereby improving the user experience.

[0093] Furthermore, in this embodiment of the application, the cloud management platform also sets an expiration date for the identity credential. Once the expiration date has passed, the cloud management platform can promptly generate a new identity credential to replace the original identity credential, so that the application is always bound to an identity credential within the validity period. This can automatically generate the renewal of the identity credential without the need for staff intervention and can also reduce the complexity of the work.

[0094] The above is a detailed description of the access control method based on a cloud management platform provided in the embodiments of this application. The cloud management platform provided in the embodiments of this application will be described below. Figure 6 Another structural diagram of the cloud management platform provided in the embodiments of this application is shown below. Figure 6 As shown, the cloud management platform is used to manage the infrastructure that provides cloud services to tenants. This infrastructure includes cloud instances running multiple applications accessible to tenants. The cloud management platform includes:

[0095] The first receiving module 601 is configured to receive an application access request sent by a tenant through an access interface, wherein the application access request is used to indicate a target application among multiple applications; for example, the first receiving module 601 is configured to implement Figure 3 Step 301 in the illustrated embodiment.

[0096] The first acquisition module 602 is used to acquire a preset mapping table based on the application access request. The mapping table records the binding relationships between multiple applications and multiple identity credentials, where one application is bound to at least one identity credential. For example, the first acquisition module 602 is used to implement... Figure 3 Step 302 in the illustrated embodiment.

[0097] The determining module 603 is used to determine, based on a mapping table, at least one identity credential bound to the target application, and select a target identity credential from the at least one identity credential bound to the target application; for example, the determining module 603 is used to implement Figure 3 Step 303 in the illustrated embodiment.

[0098] Access module 604 is used to access the target application based on the target identity credentials. For example, access module 604 is used to implement... Figure 3 Step 304 in the illustrated embodiment.

[0099] In one possible implementation, the cloud management platform further includes: a second receiving module, used to receive an identity configuration request sent by a tenant through a configuration interface, wherein the identity configuration request is used to instruct the tenant to obtain multiple identity credentials for multiple applications; a generation module, used to generate multiple identity credentials based on the identity configuration request, and to display multiple applications and multiple identity credentials to the tenant through the configuration interface; and a third receiving module, used to receive a binding relationship sent by the tenant through the configuration interface, and to record the binding relationship in a mapping table, wherein the binding relationship is generated by the tenant based on multiple applications and multiple identity credentials.

[0100] In one possible implementation, the cloud management platform further includes: a second acquisition module, used to acquire the priority of at least one identity credential bound to any one of the multiple applications, and record the priority of at least one identity credential bound to the application, wherein for any identity credential bound to the application, the higher the priority of the identity credential, the smaller the operation permissions that the cloud management platform has for the application when accessing the application based on the identity credential.

[0101] In one possible implementation, the determining module 603 is configured to: determine the highest priority identity credential among at least one identity credential bound to the target application as the target identity credential, in the case where the application access request does not indicate a target identity credential.

[0102] In one possible implementation, the determining module 603 is configured to: determine the target identity credential from at least one identity credential bound to the target application, provided that the application access request indicates the target identity credential.

[0103] In one possible implementation, the cloud management platform further includes: a third acquisition module, used to acquire the validity period of at least one identity credential bound to any one of the multiple applications; and a replacement module, used to generate at least one new identity credential after the validity period expires, and use the at least one new identity credential to replace the at least one identity credential bound to the application.

[0104] In one possible implementation, the target identity credential is an identity credential in a first format. The access module 604 is used to: convert the target identity credential to obtain a converted target identity credential, wherein the converted target identity credential is an identity credential in a second format, and the first format and the second format are different formats; and access the target application based on the converted target identity credential.

[0105] In one possible implementation, the multiple applications include at least one of the following: applications provided by the cloud management platform to the tenant and the tenant's applications.

[0106] It should be noted that the information interaction and implementation process between the modules / units of the above-mentioned device are based on the same concept as the method embodiments of this application, and the resulting technical effects are the same as those of the method embodiments of this application. For details, please refer to the description in the method embodiments shown above in the embodiments of this application, and will not be repeated here.

[0107] Please see Figure 7 , Figure 7 This is a schematic diagram of a computing device provided in an embodiment of this application. Figure 7 As shown, the computing device 700 (which can be used to present the aforementioned cloud management platform) includes: a processor 701, a memory 702, a communication interface 703, and a bus 704. The processor 701, memory 702, and communication interface 703 are coupled via the bus (not shown in the figure). The memory 702 stores instructions. When the instructions in the memory 702 are executed, the computing device 700 performs the method executed by the cloud management platform in the above method embodiment.

[0108] The computing device 700 may be one or more integrated circuits configured to implement the methods described above, such as: one or more application-specific integrated circuits (ASICs), or one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs), or a combination of at least two of these forms of integrated circuits. Furthermore, when the units in the device can be implemented in the form of a processing element scheduler, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processor capable of calling programs. Alternatively, these units may be integrated together to implement a system-on-a-chip (SOC).

[0109] The processor 701 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. A general-purpose processor can be a microprocessor or any conventional processor.

[0110] The memory 702 can be volatile memory or non-volatile memory, or it can include both. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0111] The memory 702 stores executable program code, and the processor 701 executes this executable program code to implement the functions of the aforementioned first receiving module, first acquiring module, determining module, and access module, thereby realizing the aforementioned access control method based on the cloud management platform. That is, the memory 702 stores instructions for executing the aforementioned access control method based on the cloud management platform.

[0112] The communication interface 703 uses transceiver modules, such as, but not limited to, network interface cards and transceivers, to enable communication between the computing device 700 and other devices or communication networks.

[0113] In addition to the data bus, the 704 bus can also include a power bus, a control bus, and a status signal bus. The bus can be a Peripheral Component Interconnect Express (PCIe) bus, an Extended Industry Standard Architecture (EISA) bus, a Unified Bus (Ubus or UB), a Compute Express Link (CXL) bus, a Cache Coherent Interconnect for Accelerators (CCIX) bus, etc. The bus can be divided into address bus, data bus, and control bus.

[0114] Please see Figure 8 , Figure 8 This is a schematic diagram of a computing device cluster provided in an embodiment of this application. Figure 8 As shown, the computing device cluster 800 includes at least one computing device 700.

[0115] like Figure 8 As shown, the computing device cluster 800 includes at least one computing device 700. The memory 702 of one or more computing devices 700 in the computing device cluster 800 may store the same instructions for executing the aforementioned access control method based on the cloud management platform.

[0116] In some possible implementations, the memory 702 of one or more computing devices 700 in the computing device cluster 800 may also store partial instructions for executing the aforementioned access control method based on the cloud management platform. In other words, a combination of one or more computing devices 700 can jointly execute the aforementioned access control method based on the cloud management platform.

[0117] It should be noted that the memory 702 in different computing devices 700 within the computing device cluster 800 can store different instructions, which are used to execute certain functions of the aforementioned cloud management platform. That is, the instructions stored in the memory 702 of different computing devices 700 can implement the functions of one or more modules, such as the first receiving module, the first acquiring module, the determining module, and the access module.

[0118] In some possible implementations, one or more computing devices 700 in the computing device cluster 800 can be connected via a network. This network can be a wide area network (WAN) or a local area network (LAN), etc.

[0119] Please see Figure 9, Figure 9 This is a schematic diagram illustrating the network connection of computer devices in a computer cluster 900 provided in an embodiment of this application. Figure 9 As shown, the two computing devices 700A and 700B are connected via a network. Specifically, they are connected to the network through the communication interfaces in each computing device.

[0120] In one possible implementation, the memory in computing device 700A stores instructions for performing the functions of modules such as the first receiving module. Meanwhile, the memory in computing device 700B stores instructions for performing the functions of modules such as the first acquiring module, the determining module, and the access module.

[0121] It should be understood that Figure 9 The functions of computing device 700A shown can also be performed by multiple computing devices. Similarly, the functions of computing device 700B can also be performed by multiple computing devices.

[0122] This application also relates to a computer storage medium storing a program for signal processing, which, when run on a computer, causes the computer to perform actions such as... Figure 3 The steps performed by the cloud management platform in the illustrated embodiment.

[0123] This application also relates to a computer program product that stores instructions that, when executed by a computer, cause the computer to perform actions such as... Figure 3 The steps performed by the cloud management platform in the illustrated embodiment.

[0124] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0125] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0126] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0127] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0128] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. An access control method based on a cloud management platform, characterized in that, The cloud management platform is used to manage the infrastructure that provides cloud services to tenants, the infrastructure including cloud instances running multiple applications accessible to the tenants, and the method includes: The cloud management platform receives application access requests sent by the tenant through an access interface, wherein the application access requests are used to indicate the target application among the multiple applications; The cloud management platform obtains a pre-set mapping table based on the application access request. The mapping table is used to record the binding relationship between multiple applications and multiple identity credentials. One of the multiple applications is bound to at least one of the multiple identity credentials. The cloud management platform determines at least one identity credential bound to the target application based on the mapping table, and selects the target identity credential from the at least one identity credential bound to the target application. The cloud management platform accesses the target application based on the target identity credentials.

2. The method according to claim 1, characterized in that, The method further includes: The cloud management platform receives an identity configuration request sent by the tenant through a configuration interface, wherein the identity configuration request is used to instruct the tenant to obtain the multiple identity credentials for the multiple applications; The cloud management platform generates the multiple identity credentials based on the identity configuration request, and displays the multiple applications and the multiple identity credentials to the tenant through the configuration interface; The cloud management platform receives the binding relationship sent by the tenant through the configuration interface and records the binding relationship in the mapping table. The binding relationship is generated by the tenant based on the multiple applications and the multiple identity credentials.

3. The method according to claim 1 or 2, characterized in that, The method further includes: For any one of the multiple applications, the cloud management platform obtains the priority of at least one identity credential bound to the application and records the priority of at least one identity credential bound to the application. The higher the priority of any identity credential bound to the application, the less operational authority the cloud management platform has over the application when accessing the application based on the identity credential.

4. The method according to claim 3, characterized in that, The cloud management platform selects the target identity credential from at least one identity credential bound to the target application, including: If the application access request does not specify a target identity credential, the cloud management platform will determine the highest priority identity credential among at least one identity credential bound to the target application as the target identity credential.

5. The method according to claim 3, characterized in that, The cloud management platform selects the target identity credential from at least one identity credential bound to the target application, including: When the application access request indicates a target identity credential, the cloud management platform determines the target identity credential from at least one identity credential bound to the target application.

6. The method according to any one of claims 1 to 5, characterized in that, The method further includes: For any one of the multiple applications, the cloud management platform obtains the validity period of at least one identity credential bound to the application; After the expiration period, the cloud management platform generates at least one new identity credential and replaces at least one identity credential bound to the application with the at least one new identity credential.

7. The method according to any one of claims 1 to 6, characterized in that, The target identity credential is a first-format identity credential, and the cloud management platform accesses the target application based on the target identity credential, including: The cloud management platform converts the target identity credential to obtain a converted target identity credential, wherein the converted target identity credential is an identity credential in a second format, and the first format and the second format are different formats; The cloud management platform accesses the target application based on the converted target identity credentials.

8. The method according to any one of claims 1 to 7, characterized in that, The plurality of applications includes at least one of the following: applications provided by the cloud management platform to the tenant and applications provided by the tenant.

9. A cloud management platform, characterized in that, The cloud management platform is used to manage the infrastructure that provides cloud services to tenants. The infrastructure includes cloud instances running multiple applications accessible to the tenants. The cloud management platform includes: The first receiving module is configured to receive an application access request sent by the tenant through an access interface, wherein the application access request is used to indicate a target application among the plurality of applications; The first acquisition module is used to acquire a preset mapping table based on the application access request, wherein the mapping table is used to record the binding relationship between multiple applications and multiple identity credentials, and one of the multiple applications is bound to at least one of the multiple identity credentials. The determining module is used to determine at least one identity credential bound to the target application based on the mapping table, and select a target identity credential from the at least one identity credential bound to the target application. The access module is used to access the target application based on the target identity credentials.

10. The cloud management platform according to claim 9, characterized in that, The cloud management platform also includes: The second receiving module is used to receive an identity configuration request sent by the tenant through a configuration interface, wherein the identity configuration request is used to instruct the tenant to obtain the multiple identity credentials for the multiple applications; A generation module is used to generate the multiple identity credentials based on the identity configuration request, and to display the multiple applications and the multiple identity credentials to the tenant through the configuration interface; The third receiving module is used to receive the binding relationship sent by the tenant through the configuration interface and record the binding relationship in the mapping table, wherein the binding relationship is generated by the tenant based on the multiple applications and the multiple identity credentials.

11. The cloud management platform according to claim 9 or 10, characterized in that, The cloud management platform also includes: The second acquisition module is used to acquire the priority of at least one identity credential bound to any one of the plurality of applications, and record the priority of at least one identity credential bound to the application. The higher the priority of any identity credential bound to the application, the less operational authority the cloud management platform has over the application when the cloud management platform accesses the application based on the identity credential.

12. The cloud management platform according to claim 11, characterized in that, The determining module is used for: If the application access request does not specify a target identity credential, the identity credential with the highest priority among at least one identity credential bound to the target application shall be determined as the target identity credential.

13. The cloud management platform according to claim 11, characterized in that, The determining module is used for: When the application access request indicates a target identity credential, the target identity credential is determined from at least one identity credential bound to the target application.

14. The cloud management platform according to any one of claims 9 to 13, characterized in that, The cloud management platform also includes: The third acquisition module is used to acquire the validity period of at least one identity credential bound to any one of the plurality of applications. The replacement module is used to generate at least one new identity credential after the expiration date, and to replace at least one identity credential bound to the application with the at least one new identity credential.

15. The cloud management platform according to any one of claims 9 to 14, characterized in that, The target identity credential is an identity credential in a first format, and the access module is used for: The target identity credential is converted to obtain a converted target identity credential, wherein the converted target identity credential is an identity credential in a second format, and the first format and the second format are different formats; Access the target application based on the converted target identity credentials.

16. The cloud management platform according to any one of claims 9 to 15, characterized in that, The plurality of applications includes at least one of the following: applications provided by the cloud management platform to the tenant and applications provided by the tenant.

17. A computing device cluster, characterized in that, The computing device cluster includes at least one computing device, each computing device including a processor and memory: The memory is used to store instructions; The processor is configured to, according to the instructions, cause the computing device cluster to perform the method of any one of claims 1 to 8.

18. A computer storage medium, characterized in that, The computer storage medium stores one or more instructions that, when executed by one or more computers, cause the one or more computers to perform the method of any one of claims 1 to 8.

19. A computer program product, characterized in that, The computer program product stores instructions that, when executed by a computer, cause the computer to perform the method described in any one of claims 1 to 8.

Images