Service access method, platform and system

Abstract

A service access method and platform can be used to improve the security of authentication information and reduce the risk of user asset loss. In the method, the cloud platform first receives the indication information of the target service and the service access request sent by the computing instance, and the target service is the service requested by the service access request. Then, the cloud platform obtains the authentication information of the computing instance for the target service based on the indication information of the target service and the configuration information. Next, the cloud platform sends the service access request to the target service based on the authentication information; then, the cloud platform receives the access result from the target service, and the access result is generated by the target service in response to the service access request. Then, the cloud platform sends the access result to the computing instance.

Description

Technical Field

[0001] This application relates to the field of cloud technology, and in particular to a service access method, platform and system. Background Technology

[0002] In cloud technology, users can deploy computing instances in the cloud and utilize these instances to perform related business operations, such as data computation, data storage, and image generation. Typically, computing instances need to access relevant services when performing business operations. For example, when performing image generation operations, a computing instance needs to access image rendering services and image compositing services.

[0003] Access to a service by a compute instance requires authentication information, such as a username and password. This authentication information serves as the credentials for the compute instance to access the service and is considered an asset of the user to whom the compute instance belongs. In related technologies, the compute instance obtains the service's authentication information when accessing a service, enabling it to access the service using this information. Because compute instances are user-facing and exposed to the public internet, they are highly vulnerable to attacks, potentially leading to the leakage of service authentication information and the loss of user assets. Summary of the Invention

[0004] This application provides a service access method, platform, and system that can improve the security of authentication information and reduce the risk of user asset loss.

[0005] Firstly, a service access method executable by a cloud platform is provided. The cloud platform is connected to a computing instance and records configuration information for that computing instance. The computing instance is deployed in at least one server within an infrastructure. The infrastructure includes at least one data center, and each of the at least one data center includes multiple servers.

[0006] In this method, the cloud platform first receives an indication of a target service and a service access request from the computing instance. The target service is the service requested in the service access request. Then, based on the indication of the target service and the configuration information, the cloud platform obtains the authentication information of the computing instance for the target service. Next, based on the authentication information, the cloud platform sends the service access request to the target service. Then, the cloud platform receives an access result from the target service, which is generated by the target service in response to the service access request. Finally, the cloud platform sends the access result to the computing instance.

[0007] In this method, from the time the computing instance issues a service access request to the time it receives the access result, the computing instance does not access its authentication information for the target service. In other words, this method allows the computing instance to access the target service without accessing its authentication information. This avoids the leakage of authentication information due to attacks on the computing instance, improving the security of authentication information and reducing the risk of user asset loss.

[0008] In one possible implementation, the configuration information includes permission information of the computing instance for the target service, and the authentication information matches the permission information; obtaining the authentication information of the computing instance for the target service based on the instruction information of the target service and the configuration information includes: sending the permission information to the authentication service based on the instruction information of the target service, so that the authentication service generates the authentication information based on the permission information; and obtaining the authentication information from the authentication service.

[0009] In this implementation, the cloud platform records the permission information of computing instances for the target service. When authentication information is needed, it can be generated based on the permission information. In other words, the authentication information can be generated temporarily. This further reduces the risk of authentication information leakage and enhances its security.

[0010] In one possible implementation, the configuration information includes an interface of at least one service, the at least one service including the target service; the method further includes: identifying the interface of the target service among the interfaces of the at least one service based on the indication information of the target service; the method of sending the service access request to the target service based on the authentication information and the configuration information includes: sending the service access request to the target service through the interface of the target service based on the authentication information.

[0011] In this implementation, the interface of the target service can be identified based on the indication information of the target service. Thus, access to the target service can be achieved through its interface.

[0012] In one possible implementation, the configuration information is configured for the computing instance by the user to whom the computing instance belongs. For example, the cloud platform connects to a management platform, which is used by the user to configure the configuration information; the method further includes receiving the configuration information from the management platform.

[0013] In this implementation, users can freely configure the configuration information for the computing instance, thereby controlling the services accessible to the computing instance.

[0014] In one possible implementation, the cloud platform is an instance metadata service platform corresponding to the computing instance.

[0015] In this implementation, compute instances can access the cloud platform by accessing the instance metadata service. In other words, compute instances can access the cloud platform without authentication. This allows them to access target services through the cloud platform without requiring authentication.

[0016] Secondly, a cloud platform is provided, which is connected to computing instances in an infrastructure. The cloud platform records configuration information for the computing instances. The infrastructure includes at least one data center, each of which includes multiple servers. The computing instances are deployed on at least one server in the infrastructure. The cloud platform includes: a first receiving module, configured to receive indication information and a service access request for a target service sent by the computing instance, wherein the target service is the service requested to be accessed by the service access request; an obtaining module, configured to obtain authentication information of the computing instance for the target service based on the indication information and the configuration information; a first sending module, configured to send the service access request to the target service based on the authentication information; a second receiving module, configured to receive an access result from the target service, wherein the access result is generated by the target service in response to the service access request; and a second sending module, configured to send the access result to the computing instance.

[0017] In one possible implementation, the configuration information includes the permission information of the computing instance for the target service, and the authentication information matches the permission information; the acquisition module is used to: send the permission information to the authentication service based on the indication information of the target service, so that the authentication service generates the authentication information based on the permission information; and acquire the authentication information from the authentication service.

[0018] In one possible implementation, the configuration information includes an interface of at least one service, the at least one service including the target service; the first sending module is configured to: identify the interface of the target service among the interfaces of the at least one service based on the indication information of the target service; and send the service access request to the target service through the interface of the target service based on the authentication information.

[0019] In one possible implementation, the configuration information is configured for the computing instance by the user to whom the computing instance belongs.

[0020] In one possible implementation, the cloud platform is connected to a management platform, which is used by the user to configure the configuration information; the first receiving module is also used to receive the configuration information from the management platform.

[0021] In one possible implementation, the cloud platform is an instance metadata service platform corresponding to the computing instance.

[0022] A sixth aspect provides a service access system, comprising: infrastructure including at least one data center, each of the at least one data center including multiple servers, wherein at least one server of the infrastructure is configured with a computing instance; a cloud platform connected to the computing instance and storing configuration information for the computing instance; wherein the computing instance is configured to: send indication information of a target service and a service access request to the cloud platform, the target service being the service requested to be accessed by the service access request; the cloud platform is configured to: obtain authentication information of the computing instance for the target service based on the indication information of the target service and the configuration information; send the service access request to the target service based on the authentication information; receive an access result from the target service, the access result being generated by the target service in response to the service access request; and send the access result to the computing instance.

[0023] The beneficial effects of aspects two through six can be found in the above description of the beneficial effects of aspect one, and will not be repeated here. Attached Figure Description

[0024] Figure 1 This is a schematic diagram of a system provided in an embodiment of this application;

[0025] Figure 2 This is a schematic diagram of a system provided in an embodiment of this application;

[0026] Figure 3 This is a flowchart of a service access method provided in an embodiment of this application;

[0027] Figure 4 This is a flowchart of another service access method provided in an embodiment of this application;

[0028] Figure 5 This is a schematic diagram of the structure of a cloud platform provided in an embodiment of this application;

[0029] Figure 6 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application;

[0030] Figure 7 This is a schematic diagram of the structure of a computing device cluster provided in an embodiment of this application;

[0031] Figure 8 This is a schematic diagram of the structure of a computing device cluster provided in an embodiment of this application. Detailed Implementation

[0032] The solutions provided in the embodiments of this application will now be described with reference to the accompanying drawings. In the embodiments of this application, "multiple" refers to two or more objects, and "various types" refers to two or more types. Terms such as "first," "second," etc., are only used to distinguish similar objects and are not necessarily used to describe a specific order or number of objects.

[0033] To facilitate understanding of the solutions provided in the embodiments of this application, the technical terms that may be involved in the embodiments of this application will be introduced first.

[0034] Cloud technology refers to a managed service that unifies a series of resources such as hardware, software, and networks within a wide area network or local area network to enable data computing, storage, processing, and sharing.

[0035] A cloud platform is a collection of hardware and software resources. Typically, a cloud platform operates across multiple regions, each containing at least one data center, and each data center houses the hardware and software resources. Cloud service providers establish one or more cloud platforms. Cloud platforms can deploy services, such as instance metadata services. Compute instances can access these services within the cloud platform.

[0036] Management platform: Also known as cloud management platform, it is a platform provided by cloud service providers for interacting with users. Users can register an account on the management platform and rent computing instances in the infrastructure managed by the management platform.

[0037] Infrastructure: This refers to the facilities used to provide cloud resources. Infrastructure may include at least one cloud data center, each with multiple servers. Servers in the infrastructure can be used to deploy compute instances or serve as compute instances themselves.

[0038] A service, also known as a cloud service, refers to a service deployed by a service provider to enable related business operations. Services can include image rendering services, image compositing services, model inference services, and data storage services. For example, a service can be provided by an application (APP), which can run on a compute instance. Service providers can deploy compute instances in the infrastructure, and then deploy applications within those compute instances. Services can be divided into basic services and non-basic services. Basic services are fundamental computer functions, such as computing and communication services. Non-basic services, also known as cloud services, are not fundamental computer functions; examples include image rendering services, image compositing services, and model inference services.

[0039] Service interface: This refers to the interface through which a service is invoked or accessed. One service interface corresponds to one service. In some embodiments, a service interface can be an application programming interface (API). In some embodiments, a service interface can be a uniform resource locator (URL).

[0040] Authentication information refers to information used to match a user's identity or permissions and to identify the access permissions granted to a service, such as username, password, or token. Authentication is required to access a service; only after successful authentication can access the service. Authentication is performed using authentication information.

[0041] Permission information refers to information that indicates a user's identity or permissions. Permission information is matched with authentication information, or in other words, authentication information is matched with the user's identity or permissions represented by that authentication information.

[0042] Instance Metadata Service: This is a service suite for the rapid and automated deployment of compute instances. The Instance Metadata Service comprises multiple services. Its primary purpose is to enable compute instances to access the Instance Metadata Service without authentication, based on a secure and trustworthy access link, to obtain the information needed for compute instance initialization and achieve rapid initialization. During initial startup, the operating system of the compute instance to be initialized can interact with the Instance Metadata Service without authentication information or the compute instance identifier to quickly obtain the information required for initialization, such as the compute instance identifier, configuration information, system login information, and software configuration information. This allows the compute instance to quickly complete initialization, thereby enabling rapid business scaling. Once initialized, the compute instance provides users with basic services such as computing services.

[0043] Instance metadata service platform: refers to the platform that deploys instance metadata services. The access link between this platform and the compute instances is secure and reliable. The compute instances can access the services deployed in the instance metadata service platform without authentication information.

[0044] Authentication service: This is a service used to verify permission information and generate authentication information corresponding to that permission information.

[0045] Public network: Also known as the Internet, it is a globally interconnected network that enables interconnection between different Internet service providers (ISPs). The core characteristics of the public network are its global reach and openness; any user with the appropriate permissions and devices can access it. Each device connected to the public network has a unique public Internet Protocol (IP) address, and devices can directly communicate with each other using their public IP addresses.

[0046] A compute instance, also known as a virtual computing device or virtual computing instance, refers to a complete computer system simulated by software, possessing a complete hardware system and running in a completely isolated environment. The hardware system of a compute instance is a virtual hardware system derived from physical hardware. A complete compute instance has an independent virtual computing system (e.g., a central processing unit (CPU)) and a virtual disk. Compute instances that need to communicate with the outside world also have independent virtual network interface cards (NICs). Typical compute instances include virtual machines (VMs), containers, and elastic cloud servers (ECS).

[0047] Compute instances typically provide users with basic services such as computing and can be used to perform fundamental tasks. If users need to perform more complex tasks, such as image generation, they must access related services through the compute instance, such as image rendering and image compositing services. Access to these services by the compute instance requires authentication information so that the service can authenticate the compute instance.

[0048] In related technologies, computing instances need to obtain authentication information when accessing services; that is, computing instances need access to authentication information. On the public internet, computing instances are exposed, and therefore, they are vulnerable to attacks such as server-side request forgery (SSRF) attacks and operating system attacks. By attacking the computing instance, the authentication information accessed by the computing instance can be obtained, leading to the leakage of authentication information and causing loss of user assets.

[0049] This application provides a service access method that allows a computing instance to access a service without accessing its authentication information, thereby fundamentally preventing authentication information leakage due to attacks on the computing instance. The method can be executed by a cloud platform that records configuration information for the computing instance. First, the cloud platform receives a service access request and a target service indication from the computing instance. The target service is the service requested by the computing instance. Next, the cloud platform obtains the authentication information of the target service based on the target service indication. Then, the cloud platform sends the service access information to the target service based on the authentication information to achieve access. Finally, the cloud platform receives the access result from the target service and sends it back to the computing instance. This access result is generated by the target service in response to the service access request. Thus, the computing instance can access the target service without accessing its authentication information. The computing instance does not have access to authentication information, and attacks on the computing instance also have no way to access the authentication information, thus fundamentally avoiding the leakage of authentication information due to attacks on the computing instance.

[0050] Next, the service access method provided in the embodiments of this application will be introduced.

[0051] Figure 1 A system 100 for implementing this method is shown. The system includes a cloud platform 110, infrastructure 120, and at least one service, such as service 130, service 140, etc.

[0052] Infrastructure 120 includes at least one data center, and each data center may include multiple servers. The servers in each data center constitute the servers in infrastructure 120. The servers in infrastructure 120 can be used by users to deploy computing instances, such as computing instance 121. Computing instance 121 may be deployed on at least one server in infrastructure 120.

[0053] Compute instance 121 is used to run the user's business components to execute the user's business logic. The user owning compute instance 121 is the user who possesses the necessary permissions, such as usage rights, for compute instance 121. Compute instance 121 may be purchased or leased by this user. Alternatively, compute instance 121 may be created by this user using relevant resources within infrastructure 120.

[0054] In some embodiments, cloud platform 110 and / or the at least one service are deployed on servers within infrastructure 120. In some embodiments, cloud platform 110 and / or the at least one service may be located outside of infrastructure 120.

[0055] Cloud platform 110 is connected to each of the at least one service. Cloud platform 110 is connected to compute instance 121 in infrastructure 120 and records configuration information for compute instance 121. This configuration information is also called service access configuration information for compute instance 121. With this configuration information, cloud platform 110 can be used to enable compute instance 121 to access any of the at least one service.

[0056] In some embodiments, the configuration information is configured by the user to which compute instance 121 belongs for compute instance 121. The user can configure the configuration information of compute instance 121 before, during, or after the creation of compute instance 121.

[0057] In some embodiments, such as Figure 2 As shown, system 100 also includes a management platform 122. The management platform 122 is used for user management of computing instance 121, such as creating computing instance 121 in infrastructure 120 through the management platform 122, and configuring configuration information for computing instance 121 through the management platform 122. The management platform 122 can send the configuration information for computing instance 121 to cloud platform 110. Cloud platform 110 can record the configuration information for computing instance 121.

[0058] In one example of this embodiment, cloud platform 110 may provide a configuration API to management platform 122. The configuration API is used to provide a configuration interface to users through management platform 122. Users can configure configuration information for compute instance 121 in management platform 122 through the configuration interface. Through this configuration API, management platform 122 can send configuration information for compute instance 121 to cloud platform 110.

[0059] In some embodiments, the configuration information for computing instance 121 may include permission information for computing instance 121 for each of the at least one service. For example... Figure 2 As shown, system 100 also includes authentication service 150. Authentication service 150 generates authentication information for computing instance 121 for the service based on the permission information in the service provided by computing instance 121. The authentication information generated for the service by computing instance 121 can be referred to as the authentication information of computing instance 121 for the service, which is the authentication information required for computing instance 121 to access the service.

[0060] In some embodiments, the configuration information for computing instance 121 may include authentication information for computing instance 121 for each of the at least one service.

[0061] In some embodiments, the configuration information for computing instance 121 may include the interface of the at least one service. In one example, the interface may be an API. In another example, the interface may be a URL.

[0062] When a service needs to be accessed, computing instance 121 can send a service access request for the service and the service instruction information to cloud platform 110 so that access to the service can be achieved through cloud platform 110.

[0063] In some embodiments, computing instance 121 can access the service through cloud platform 110 without authentication. That is, computing instance 121 can send service access requests and instructions to cloud platform 110 without having relevant authentication information, so as to access the service through cloud platform 110.

[0064] In some embodiments, cloud platform 110 may provide an access API to computing instance 121. Computing instance 121 can use this access API to send service access requests and indication information to cloud platform 110. For example, this access API does not require authentication; that is, computing instance 121 can use this access API to send service access requests and indication information to cloud platform 110 without needing relevant authentication information, thereby enabling access to services through cloud platform 110.

[0065] In some embodiments, cloud platform 110 may be an instance metadata service platform, thereby enabling compute instance 121 to access the instance metadata platform without authentication information, so as to access services through cloud platform 110.

[0066] The foregoing example illustrates the system 100 provided in this application embodiment. Next, the service access method provided in this application embodiment will be described in conjunction with system 100. This method can be executed by the cloud platform 110.

[0067] In some embodiments, such as Figure 3 As shown, the method includes the following steps.

[0068] First, in step 301, the user can configure configuration information for computing instance 121 on management platform 122. Management platform 122 can send this configuration information to cloud platform 110 in step 302. After receiving the configuration information, cloud platform 110 can execute step 303 to record the configuration information.

[0069] Compute instance 121 can issue access to a target service (e.g., service 130). Access to the target service can be made through cloud platform 110, and the relevant steps are as follows.

[0070] Compute instance 121 can send indication information of a target service and a service access request to cloud platform 110. The target service is the service requested in the service access request. The indication information of the target service is information used to identify or distinguish the target service, such as the target service's identifier (ID) or name. Through step 104, cloud platform 110 can receive the indication information of the target service and the service access request sent by compute instance 121.

[0071] Next, the cloud platform 110 can execute step 305, identifying the permission information of the computing instance 121 for the target service based on the indication information of the target service. For the computing instance 121, the user can configure permission information for each service in at least one service. The at least one service includes the target service. The permission information configured for the service of the computing instance 121 can be referred to as the permission information of the computing instance 121 for that service. The permission information of the computing instance 121 for different services can be the same or different. Taking services 130 and 140 as examples, the permission information of the computing instance 121 for service 130 is administrator, and the permission information of the computing instance 121 for service 140 is ordinary user. Alternatively, the permission information of the computing instance 121 for service 130 is ordinary user, and the permission information of the computing instance 121 for service 140 is ordinary user. The permission information of a service and the indication information of that service are related. In step 305, the cloud platform 110 can identify the permission information corresponding to the target service based on this relationship and the indication information of the target service.

[0072] After identifying the permission information corresponding to the target service, the cloud platform 110 can execute step 306 to obtain the authentication information of the computing instance 121 for the target service based on the permission information. The authentication information of the computing instance 121 for the target service refers to the authentication information that enables the target service to respond to service access requests originating from the computing instance 121 and generate access results.

[0073] In some embodiments, such as Figure 3As shown, cloud platform 110 can obtain authentication information through authentication service 150. Specifically, cloud platform 110 can send the permission information of computing instance 121 for the target service to authentication service 150. Authentication service 150 can generate authentication information for computing instance 121 for the target service based on the permission information of computing instance 121 for the target service. For example, the authentication information can be an account and password. Authentication service 150 can generate an account with that permission information and its corresponding password based on the permission information of computing instance 121 for the target service. For example, if the permission information is for an administrator, the generated account will have administrator privileges and belong to the administrator account.

[0074] After obtaining the authentication information for the target service from compute instance 121, cloud platform 110 can execute step 307, sending the service access request received from compute instance 121 to the target service based on the authentication information. Specifically, cloud platform 110 can request the target service to authenticate the authentication information; after successful authentication, cloud platform 110 sends the access request to the target service. For example, the authentication information can be a username and password, which cloud platform 110 can use to log in to the target service. After logging into the target service using the username and password, cloud platform 110 can send the service access request to the target service.

[0075] In some embodiments, the configuration information for computing instance 121 includes an interface to at least one service, which includes a target service. For example, the interface may be an API or a URL. In step 307, the cloud platform 110 can identify the interface of the target service from among the interfaces of the at least one service based on the indication information of the target service. Then, based on the authentication information, the service access request is sent to the target service through the interface of the target service. The interface of the service and the indication information of the service are associated. Based on this association and the indication information of the target service, the interface of the target service can be identified.

[0076] When the cloud platform 110 successfully authenticates using this authentication information, the target service, upon receiving the service access request, can execute step 308 to respond to the service access request and generate an access result. For example, if the service access request is a reasoning request (e.g., answering a question in a response scenario), and the target service is a model reasoning service (e.g., a large language model (LLM) reasoning service), the target service can respond to the reasoning request by performing a reasoning task (e.g., the LLM generates an answer to the question) and obtain a reasoning result (e.g., the answer to the question). This reasoning result is the access result of the service access request.

[0077] The target service can send the access result to the cloud platform 110. The cloud platform 110 can receive the access result from the target service via step 309. Then, the cloud platform 110 can execute step 310 to send the access result to the compute instance 121. This completes the access of the compute instance 121 to the target service.

[0078] Therefore, through the service access method provided in this application embodiment, a computing instance can access a service without accessing its authentication information for that service, thereby preventing the leakage of authentication information due to attacks on the computing instance from the source. Furthermore, users do not need to configure the computing instance's authentication information for the service; they only need to configure the computing instance's permission information for the service, thus reducing the user's workload and the risk of incorrect authentication information configuration.

[0079] Based on the above description, this application also provides another service access method. This method can be applied to a cloud platform connected to computing instances in an infrastructure. The cloud platform records configuration information for the computing instances. The infrastructure includes at least one data center, each of which includes multiple servers. The computing instance is deployed on at least one server in the infrastructure. Specifically, the cloud platform can be implemented with reference to the above description of cloud platform 110, the infrastructure can be implemented with reference to the above description of infrastructure 120, and the computing instance can be implemented with reference to the above description of computing instance 121.

[0080] like Figure 4 As shown, the method includes the following steps.

[0081] First, in step 401, the cloud platform receives the target service indication information and service access request sent by the computing instance. The target service is the service requested in the service access request. For related implementation methods, please refer to the above section. Figure 3 The implementation of step 304 is described below.

[0082] Next, in step 402, the cloud platform obtains the authentication information of the computing instance for the target service based on the indication information and configuration information of the target service.

[0083] In some embodiments, the configuration information includes permission information for the computing instance regarding the target service, which matches the authentication information. The cloud platform can first send the permission information to the authentication service based on the indication information of the target service, so that the authentication service can generate the authentication information based on the permission information. Then, the cloud platform obtains the authentication information from the authentication service. For related implementation methods, please refer to the above description. Figure 3 The implementation of step 306 is described below.

[0084] In some embodiments, the configuration information includes authentication information for the computing instance for each of at least one service. The cloud platform can identify the authentication information for the computing instance for the target service in the configuration information based on the indication information for the target service.

[0085] Secondly, in step 403, the cloud platform, based on the authentication information of the computing instance for the target service, sends the service access request to the target service. The relevant implementation method can be found in the above description. Figure 3 The implementation of step 307 is described below.

[0086] In some embodiments, the configuration information may include an interface to at least one service, and the at least one service may include the target service. For example, the interface may be an API or a URL. The cloud platform may identify the interface of the target service from among the interfaces of the at least one service based on the indication information of the target service. In step 403, the cloud platform may send the access request to the target service through the interface of the target service based on the authentication information of the computing instance for the target service.

[0087] Next, in step 404, the cloud platform receives the access result from the target service. This access result is generated by the target service in response to the service access request. For related implementation methods, please refer to the above section. Figure 3 The implementation of steps 308 and 309 is described below.

[0088] Then, in step 405, the cloud platform sends the access result to the computing instance. The relevant implementation method can be found in the section above. Figure 3 The implementation of step 310 is described below.

[0089] In some embodiments, the configuration information is configured for the computing instance by the user to whom the computing instance belongs. In one example of this embodiment, the cloud platform connects to a management platform, which is used by the user to configure the configuration information. The cloud platform can receive the configuration information from the management platform.

[0090] Therefore, through the service access method provided in this application embodiment, a computing instance can access a service without accessing its authentication information, thereby preventing the leakage of authentication information due to attacks on the computing instance. Furthermore, since the leakage of authentication information is avoided, users do not need to configure restriction policies for authentication information, such as limiting the scope of permissions, to avoid such leakage, thus reducing user workload and the risk of incorrect authentication information configuration.

[0091] Based on the above description, this application also provides a cloud platform 500. The cloud platform 500 is connected to computing instances in an infrastructure. The cloud platform 500 records configuration information for the computing instances. The infrastructure includes at least one data center, and each of the at least one data center includes multiple servers. The computing instances are deployed on at least one server in the infrastructure. Figure 5 As shown, the cloud platform 500 includes:

[0092] The first receiving module 510 is used to receive the indication information of the target service and the service access request sent by the computing instance, wherein the target service is the service requested to be accessed by the service access request.

[0093] The acquisition module 520 is used to acquire the authentication information of the computing instance for the target service based on the indication information of the target service and the configuration information;

[0094] The first sending module 530 is used to send the service access request to the target service based on the authentication information;

[0095] The second receiving module 540 is configured to receive an access result from the target service, wherein the access result is generated by the target service in response to the service access request;

[0096] The second sending module 550 is used to send the access result to the computing instance.

[0097] In some embodiments, the configuration information includes permission information of the computing instance for the target service, and the authentication information matches the permission information; the acquisition module 520 is configured to: send the permission information to the authentication service based on the indication information of the target service, so that the authentication service generates the authentication information based on the permission information; and acquire the authentication information from the authentication service.

[0098] In some embodiments, the configuration information includes an interface of at least one service, the at least one service including the target service; the first sending module 530 is configured to: identify the interface of the target service among the interfaces of the at least one service based on the indication information of the target service; and send the service access request to the target service through the interface of the target service based on the authentication information.

[0099] In some embodiments, the configuration information is configured by the user to which the computing instance belongs for the computing instance.

[0100] In one example of this embodiment, the cloud platform 500 is connected to a management platform, wherein the management platform is used by the user to configure the configuration information; the first receiving module 510 is further used to receive the configuration information from the management platform.

[0101] In some embodiments, the cloud platform is an instance metadata service platform corresponding to the computing instance.

[0102] The first receiving module 510, the acquisition module 520, the first sending module 530, the second receiving module 540, and the second sending module 550 can all be implemented in software or in hardware. For example, the implementation of the first receiving module 510 will be described below. Similarly, the implementation of the acquisition module 520, the first sending module 530, the second receiving module 540, and the second sending module 550 can refer to the implementation of the first receiving module 510.

[0103] As an example of a software functional unit, the first receiving module 510 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the aforementioned computing instance may be one or more. For example, the first receiving module 510 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region or in different regions. Further, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one or more geographically proximate data centers. Typically, a region may include multiple AZs.

[0104] Similarly, multiple hosts / virtual machines / containers used to run this code can be distributed within the same Virtual Private Cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Communication between two VPCs within the same region, as well as between VPCs in different regions, requires a communication gateway to be set up within each VPC to enable interconnection between VPCs.

[0105] As an example of a hardware functional unit, the first receiving module 510 may include at least one computing device, such as a server. Alternatively, the first receiving module 510 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be implemented using a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), generic array logic (GAL), or any combination thereof.

[0106] The multiple computing devices included in the first receiving module 510 can be distributed in the same region or in different regions. Similarly, the multiple computing devices included in the first receiving module 510 can be distributed in the same Availability Zone (AZ) or in different AZs. Likewise, the multiple computing devices included in the first receiving module 510 can be distributed in the same Virtual Private Cloud (VPC) or in multiple VPCs. These multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0107] It should be noted that, in other embodiments, the first receiving module 510 can be used to perform... Figure 4 In any step of the method shown, module 520 can be used to execute... Figure 4 The first sending module 530 can be used to execute any step in the method shown. Figure 4 The second receiving module 540 can be used to perform any step in the method shown. Figure 4 The second sending module 550 can be used to execute any step in the method shown. Figure 4 Any step in the method shown. The steps implemented by the first receiving module 510, the acquisition module 520, the first sending module 530, the second receiving module 540, and the second sending module 550 can be specified as needed, and implemented by the first receiving module 510, the acquisition module 520, the first sending module 530, the second receiving module 540, and the second sending module 550 respectively. Figure 4 The different steps in the method shown implement all the functions of the cloud platform 500.

[0108] This application also provides a computing device 600. For example... Figure 6As shown, the computing device 600 includes a bus 602, a processor 604, a memory 606, and a communication interface 608. The processor 604, the memory 606, and the communication interface 608 communicate with each other via the bus 602. The computing device 600 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device 600.

[0109] Bus 602 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be divided into address buses, data buses, control buses, etc. For ease of representation, Figure 6 The bus 602 may be represented by a single line, but this does not mean that there is only one bus or one type of bus. The bus 602 may include a path for transmitting information between various components of the computing device 600 (e.g., memory 606, processor 604, communication interface 608).

[0110] Processor 604 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0111] Memory 606 may include volatile memory, such as random access memory (RAM). Memory 606 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0112] The memory 606 stores executable program code, and the processor 604 executes the executable program code to implement the functions of the aforementioned first receiving module 510, acquisition module 520, first sending module 530, second receiving module 540, and second sending module 550, thereby achieving... Figure 4 The method shown. That is, the memory 606 stores the method for execution. Figure 4 The instructions for the method shown.

[0113] The communication interface 608 uses transceiver modules, such as, but not limited to, network interface cards and transceivers, to enable communication between the computing device 600 and other devices or communication networks.

[0114] This application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0115] like Figure 7 As shown, the computing device cluster includes at least one computing device 600. The memory 606 of one or more computing devices 600 in the computing device cluster may store the same memory for executing... Figure 4 The instructions for the method shown.

[0116] In some possible implementations, the memory 606 of one or more computing devices 600 in the computing device cluster may also store memory for execution. Figure 4 The instructions of the method shown are partial. In other words, a combination of one or more computing devices 600 can jointly execute instructions for performing... Figure 4 The instructions for the method shown.

[0117] It should be noted that the memory 606 in different computing devices 600 within the computing device cluster can store different instructions, each used to execute a portion of the functions of the cloud platform 500. That is, the instructions stored in the memory 606 of different computing devices 600 can implement the functions of one or more modules among the first receiving module 510, the acquisition module 520, the first sending module 530, the second receiving module 540, and the second sending module 550.

[0118] In some possible implementations, one or more computing devices in a computing device cluster can be connected via a network. This network can be a wide area network (WAN) or a local area network (LAN), etc. Figure 8 One possible implementation is shown. For example... Figure 8 As shown, two computing devices 600A and 600B are connected via a network. The connection to the network is achieved through communication interfaces in each computing device. In this possible implementation, the memory 606 of computing device 600A stores instructions for executing the functions of the first receiving module 510 and the acquisition module 520. Simultaneously, the memory 606 of computing device 600B stores instructions for the functions of the first transmitting module 530, the second receiving module 540, and the second transmitting module 550.

[0119] It should be understood that Figure 8 The functions of computing device 600A shown can also be performed by multiple computing devices 600. Similarly, the functions of computing device 600B can also be performed by multiple computing devices 600.

[0120] This application also provides another computing device cluster. The connection relationships between the computing devices in this computing device cluster can be similarly referred to... Figure 7 and Figure 8 The connection method of the computing device cluster. The difference is that the memory 606 in one or more computing devices 600 within this computing device cluster can store the same information for execution. Figure 4 The instructions for the method shown.

[0121] In some possible implementations, the memory 606 of one or more computing devices 600 in the computing device cluster may also store memory for execution. Figure 4 The instructions of the method shown are partial. In other words, a combination of one or more computing devices 600 can jointly execute instructions for performing... Figure 4 The instructions for the method shown.

[0122] This application also provides a computer program product containing instructions. The computer program product may be a software or program product containing instructions, capable of running on a computing device or stored on any usable medium. When the computer program product is run on at least one computing device, it causes the at least one computing device to perform... Figure 4 The method shown.

[0123] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a host migration device such as a data center that includes one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute... Figure 4 The method shown.

[0124] This application also provides a service access system. The system includes: infrastructure including at least one data center, each data center including multiple servers, and at least one server in the infrastructure deploying a computing instance; a cloud platform connected to the computing instance and storing configuration information for the computing instance; wherein the computing instance is configured to: send indication information of a target service and a service access request to the cloud platform, the target service being the service requested in the service access request; the cloud platform is configured to: obtain authentication information of the computing instance for the target service based on the indication information of the target service and the configuration information; send the service access request to the target service based on the authentication information; receive an access result from the target service, the access result being generated by the target service in response to the service access request; and send the access result to the computing instance.

[0125] The computing instance and cloud platform can be implemented by referring to the above descriptions of computing instance 121 and cloud platform 110, respectively, and will not be repeated here.

[0126] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of this application.

Claims

1. A service access method, characterized in that, The method is applied to a cloud platform connected to computing instances in an infrastructure. The cloud platform records configuration information for the computing instances. The infrastructure includes at least one data center, each of the at least one data center including multiple servers. The computing instances are deployed on at least one server in the infrastructure. The method includes: Receive the target service indication information and service access request sent by the computing instance, wherein the target service is the service requested to be accessed by the service access request; Based on the indication information of the target service and the configuration information, obtain the authentication information of the computing instance for the target service; Based on the authentication information, the service access request is sent to the target service; Receive access results from the target service, whereby the access results are generated by the target service in response to the service access request; The access result is sent to the computing instance.

2. The method according to claim 1, characterized in that, The configuration information includes the permission information of the computing instance for the target service, and the authentication information matches the permission information. The step of obtaining authentication information for the computing instance for the target service based on the indication information and the configuration information of the target service includes: Based on the instruction information of the target service, the permission information is sent to the authentication service so that the authentication service can generate the authentication information based on the permission information; The authentication information is obtained from the authentication service.

3. The method according to claim 1 or 2, characterized in that, The configuration information includes an interface for at least one service, and the at least one service includes the target service; The method further includes: identifying the interface of the target service among the interfaces of the at least one service based on the indication information of the target service; Sending the service access request to the target service based on the authentication information and the configuration information includes: sending the service access request to the target service through the interface of the target service based on the authentication information.

4. The method according to any one of claims 1-3, characterized in that, The configuration information is configured by the user to which the computing instance belongs for the computing instance.

5. The method according to claim 4, characterized in that, The cloud platform is connected to a management platform, wherein the management platform is used by the user to configure the configuration information; The method further includes receiving the configuration information from the management platform.

6. The method according to any one of claims 1-5, characterized in that, The cloud platform is the instance metadata service platform corresponding to the computing instance.

7. A cloud platform, characterized in that, The cloud platform is connected to computing instances in the infrastructure. The cloud platform records configuration information for the computing instances. The infrastructure includes at least one data center, and each of the at least one data center includes multiple servers. The computing instances are deployed on at least one server in the infrastructure. The cloud platform includes: The first receiving module is used to receive indication information of a target service and a service access request sent by the computing instance, wherein the target service is the service requested to be accessed by the service access request. The acquisition module is used to acquire the authentication information of the computing instance for the target service based on the indication information of the target service and the configuration information; The first sending module is used to send the service access request to the target service based on the authentication information; The second receiving module is used to receive an access result from the target service, wherein the access result is generated by the target service in response to the service access request; The second sending module is used to send the access result to the computing instance.

8. The cloud platform according to claim 7, characterized in that, The configuration information includes the permission information of the computing instance for the target service, and the authentication information matches the permission information. The acquisition module is used for: Based on the instruction information of the target service, the permission information is sent to the authentication service so that the authentication service can generate the authentication information based on the permission information; The authentication information is obtained from the authentication service.

9. The cloud platform according to claim 7 or 8, characterized in that, The configuration information includes an interface for at least one service, and the at least one service includes the target service; The first sending module is used for: Based on the indication information of the target service, identify the interface of the target service among the interfaces of the at least one service; Based on the authentication information, the service access request is sent to the target service through the target service's interface.

10. The cloud platform according to any one of claims 7-9, characterized in that, The configuration information is configured by the user to which the computing instance belongs for the computing instance.

11. The cloud platform according to claim 10, characterized in that, The cloud platform is connected to a management platform, wherein the management platform is used by the user to configure the configuration information; The first receiving module is further configured to: receive the configuration information from the management platform.

12. The cloud platform according to any one of claims 7-11, characterized in that, The cloud platform is the instance metadata service platform corresponding to the computing instance.

13. A computing device cluster, characterized in that, It includes at least one computing device, each computing device including a processor and memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the cluster of computing devices to perform the method as described in any one of claims 1 to 6.

14. A computer-readable storage medium, characterized in that, It includes computer program instructions, which, when executed by a cluster of computing devices, perform the method as described in any one of claims 1 to 6.

15. A computer program product containing instructions, characterized in that, When the instructions are executed by a cluster of computer devices, the cluster of computer devices performs the method as described in any one of claims 1 to 6.

16. A service access system, characterized in that, The system includes: The infrastructure includes at least one data center, each of the at least one data center including multiple servers, and at least one server of the infrastructure having a computing instance deployed thereon; A cloud platform that is connected to the computing instance and records configuration information for the computing instance; in, The computational example is used for: Send the target service indication information and service access request to the cloud platform, wherein the target service is the service requested to be accessed by the service access request; The cloud platform is used for: Based on the indication information of the target service and the configuration information, obtain the authentication information of the computing instance for the target service; Based on the authentication information, the service access request is sent to the target service; Receive access results from the target service, whereby the access results are generated by the target service in response to the service access request; The access result is sent to the computing instance.

Images