Cloud service access method and cloud system based on cloud computing technology

Abstract

The application provides a cloud service access method and a cloud system based on cloud computing technology. The method is applied to the cloud system, the cloud system comprises a first cloud management platform and a second cloud management platform, the first cloud management platform and a first data center are arranged in a first region, the second cloud management platform and a second data center are arranged in a second region, and the method comprises the following steps: the first cloud management platform sends a security token to a client according to security token request information sent by the client, the security token comprises a first region identifier; after the first cloud management platform receives a first cloud service access request, it is judged that the first region identifier included in the security token carried by the first cloud service access request indicates that the first region is consistent with the first region where the cloud service of the first data center is located, and the client is allowed to access the cloud service of the first data center. The cloud service access method provided by the application can enhance the isolation of different regions in the cloud system and reduce systematic risks.

Description

Technical Field

[0001] This application relates to the field of cloud computing, specifically to a cloud service access method and cloud system based on cloud computing technology. Background Technology

[0002] On cloud management platforms, cloud services typically provide services to their users through application programming interfaces (APIs). To ensure that the cloud management platform can authenticate and verify the legitimacy of user identities, users need to carry corresponding credentials when accessing cloud service APIs. These credentials used to access cloud service APIs are collectively referred to as security tokens.

[0003] In existing technologies, security tokens are usually carried directly in user requests. The cloud management platform can directly obtain the user's security token. If the cloud management platform of one region in the cloud system is compromised, the attacker can obtain a large number of users' security tokens and use them to attack other regions in the cloud system, leading to systemic risks. Summary of the Invention

[0004] This application provides a cloud service access method and cloud system based on cloud computing technology, which can enhance the isolation of different areas in the cloud system and reduce systemic risks.

[0005] A first aspect provides a cloud service access method based on cloud computing technology. This method is applied to a cloud system, which includes a first cloud management platform, a second cloud management platform, a first data center, and a second data center. The first cloud management platform and the first data center are located in a first region, and the second cloud management platform and the second data center are located in a second region. The first cloud management platform manages the cloud services of the first data center, and the second cloud management platform manages the cloud services of the second data center. The method includes: the first cloud management platform receiving a security token request from a client, the security token request including a first region identifier, the first region identifier indicating the first region; the first cloud management platform sending a security token to the client according to the security token request, wherein the security token includes the first region identifier; the first cloud management platform receiving a first cloud service access request from the client for the cloud services of the first data center, the first cloud service access request carrying the security token; and the first cloud management platform determining that the first region indicated by the first region identifier included in the security token carried in the first cloud service access request is consistent with the first region where the cloud services of the first data center are located, and allowing the client to access the cloud services of the first data center.

[0006] This application provides a cloud service access method in which the client declares the authorized areas that the security token can access when applying for a security token. The cloud management platform adds the declaration of the authorized areas to the security token issued to the client, so that when the authorized areas are attacked, other areas of the cloud system will not be affected, thereby enhancing the isolation between different areas of the cloud system and reducing systemic risks.

[0007] The client can be a device used by an individual, enterprise, school, hospital, or government agency to access cloud services. This client can also be referred to as a user, tenant, user device, or tenant device; this application does not limit the specific name.

[0008] In one possible implementation scenario, the cloud system includes four regions: ap-east-1, ap-south-1, ap-west-1, and ap-west-2, with the first region identified as ap-east-1. If a user wants the security token obtained in this request to be used only to access cloud services in the ap-east-1 region, they can include the authorized region field `aud_regions = [ap-east-1]` in the security token request information to indicate that the security token can only be used to access cloud services in the ap-east-1 region. In this way, even if the security token is leaked, it will not affect the user's data in the ap-south-1, ap-west-1, and ap-west-2 regions.

[0009] In another possible implementation scenario, the cloud system includes regions ap-east-1, ap-south-1, ap-west-1, and ap-west-2. The first region is identified as ap-east-1, and the second region is identified as ap-south-1. The second region identifier is used to indicate the second region. If the user wants the security token obtained in this request to be used only to access cloud services in the ap-east-1 and ap-south-1 regions, then the authorized region field aud_regions = [ap-east-1, ap-south-1] can be included in the security token request information to indicate that the security token can only be used to access cloud services in the ap-east-1 and ap-south-1 regions.

[0010] For example, the first cloud service access request can be transmitted via protocols such as Hypertext Transfer Protocol (HTTP), Hypertext Transfer Protocol Secure (HTTPS), or File Transfer Protocol (FTP). The security token can be carried in the HTTP header, HTTPS header, or FTP header, and this application does not impose any restrictions on this.

[0011] In some possible implementations, the security token request information may also include one or more of the following: user information, session-related information, and digital signature.

[0012] In some possible implementations, the security token can be an Open Auth Access Token (OAuth Access Token).

[0013] For example, a client can send a first cloud service access request to a first cloud management platform via the API of the first data center's cloud service. The security token carried in the first cloud service access request includes a first region identifier. The first region identifier is ap-east-1, which indicates the ap-east-1 region, meaning the first region where the first data center's cloud service is located is ap-east-1. Upon receiving the first cloud service access request, the first cloud management platform determines that the first region indicated by the first region identifier in the security token carried in the first cloud service access request is consistent with the first region where the first data center's cloud service is located, both being ap-east-1. Therefore, the first cloud management platform allows the client to access the first data center's cloud service.

[0014] In conjunction with the first aspect, in some implementations of the first aspect, the security token request information does not include any region identifier other than the first region identifier. The method further includes: the second cloud management platform receiving a second cloud service access request sent by the client for the cloud service of the second data center, the second cloud service access request carrying the security token; the second cloud management platform determining that the first region indicated by the first region identifier included in the security token carried by the second cloud service access request is inconsistent with the second region where the cloud service of the second data center is located, and rejecting the client's access to the cloud service of the second data center.

[0015] Cloud services include, but are not limited to, Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS), Function as a Service (FaaS), storage services, network services, and database services.

[0016] In some possible implementations, the security token can be carried in the header of the second cloud service access request. For example, the second cloud service access request can be transmitted via protocols such as HTTP, HTTPS, or FTP, and the security token can be carried in the HTTP header, HTTPS header, or FTP header; this application does not impose any restrictions on this.

[0017] For example, the region identifier field in the security token can be used to identify the range of regions that the security token can access. For instance, if the first region is identified as ap-esat-1, the aud_regions=[ap-esat-1] in the security token indicates that the cloud services of the data center in the ap-east-1 region can be accessed through the security token.

[0018] For example, a client can send a second cloud service access request to the second cloud management platform via the API of the second data center's cloud service. The security token carried in the second cloud service access request includes a first region identifier of ap-east-1, which indicates the first region ap-east-1. However, the second region where the cloud service of the second data center is located is ap-south-1. After receiving the second cloud service access request, the second cloud management platform determines that the first region indicated by the first region identifier in the security token carried in the second cloud service access request is inconsistent with the second region where the cloud service of the second data center is located. Therefore, the second cloud management platform refuses the client's access to the cloud service of the second data center.

[0019] This application provides a cloud service access method in which a client carries a security token with an authorized region declaration when accessing a cloud service. When the authorized region does not include the region where the cloud service to be accessed by the client is located, the cloud management platform can refuse the client access to the cloud service. This ensures that if the authorized region is attacked, other regions of the cloud system will not be affected, thereby enhancing the isolation between different regions of the cloud system and reducing systemic risks.

[0020] In conjunction with the first aspect, in some implementations of the first aspect, the security token request information further includes a second region identifier, and the security token further includes the second region identifier, which is used to indicate the second region. The method further includes: the second cloud management platform receiving a second cloud service access request sent by the client for the cloud service of the second data center, the second cloud service access request carrying the security token; the second cloud management platform determining that the second region indicated by the second region identifier included in the security token carried by the second cloud service access request is consistent with the second region where the cloud service of the second data center is located, and allowing the client to access the cloud service of the second data center.

[0021] In some possible implementations, the security token can be carried in the header of the second cloud service access request. For example, the second cloud service access request can be transmitted via protocols such as HTTP, HTTPS, or FTP, and the security token can be carried in the HTTP header, HTTPS header, or FTP header; this application does not impose any restrictions on this.

[0022] For example, a client can send a second cloud service access request to the second cloud management platform via the API of the second data center's cloud service. The security token carried in the second cloud service access request includes a first region identifier and a second region identifier. The first region identifier is ap-east-1, and the second region identifier is ap-south-1. ap-east-1 indicates the first region ap-east-1, and ap-south-1 indicates the second region ap-south-1. The second region where the cloud service of the second data center is located is ap-south-1. After receiving the second cloud service access request, the second cloud management platform determines that the second region indicated by the second region identifier in the security token carried in the second cloud service access request is consistent with the second region where the cloud service of the second data center is located, both being ap-south-1. Therefore, the second cloud management platform allows the client to access the cloud service of the second data center.

[0023] For example, a client can send a second cloud service access request to the second cloud management platform via the API of the second data center's cloud service. The security token carried in the second cloud service access request includes a first region identifier, a second region identifier, and a third region identifier. The first region identifier is ap-east-1, the second region identifier is ap-south-1, and the third region identifier is ap-west-1. ap-east-1 indicates the first region ap-east-1, ap-south-1 indicates the second region ap-south-1, and ap-west-1 indicates the third region ap-west-1. The second region where the second data center's cloud service is located is ap-south-1. After receiving the second cloud service access request, the second cloud management platform determines that the second region indicated by the second region identifier in the security token carried in the second cloud service access request is consistent with the second region where the second data center's cloud service is located, both being ap-south-1. Therefore, the second cloud management platform allows the client to access the second data center's cloud service.

[0024] In other possible implementations, the second cloud management platform allows the client to access the cloud services of the second data center only if the second region indicated by the second region identifier in the security token carried in the second cloud service access request matches the second region where the cloud service of the second data center is located, and if the signature verification of the security token is correct. Correct signature verification of the security token means that the second cloud management platform verifies that the security token was issued to the client by the first cloud management platform, which belongs to the same cloud system as the second cloud management platform.

[0025] This application provides a cloud service access method in which a client carries a security token with an authorized region declaration when accessing a cloud service. The cloud management platform will only allow the client to access the cloud service if the authorized region includes the region where the cloud service to be accessed is located. This ensures that if the authorized region is attacked, other regions of the cloud system will not be affected, thereby enhancing the isolation between different regions of the cloud system and reducing systemic risks.

[0026] In conjunction with the first aspect, in some implementations of the first aspect, the first cloud management platform is connected to the second cloud management platform, or: the cloud system further includes a central cloud management platform, the first cloud management platform and the second cloud management platform are connected to the central cloud management platform, and the central cloud management platform is used to manage the first cloud management platform and the second cloud management platform.

[0027] This application provides a cloud service access method in which the first cloud management platform and the second cloud management platform can be directly interconnected or centrally managed, which can be applied to different application scenarios and has high flexibility.

[0028] In some possible implementations, the cloud system, including the cloud management platform and data centers, covers multiple regions. The probability of attacking the first region is higher than that of other regions within the multiple regions. For example, if the cloud services in the first region are of high sensitivity, such as for geographical or political reasons, and it is desired that a malicious attack on the first region will not affect cloud resources and data in other regions, then the client can use a security token with the first region's identifier when accessing cloud services in the first region, thus limiting the use of the security token to the first region.

[0029] Secondly, a cloud service access method based on cloud computing technology is provided. This method is applied to a cloud system, which includes a first cloud management platform, a second cloud management platform, a first data center, and a second data center. The first cloud management platform and the first data center are located in a first region, and the second cloud management platform and the second data center are located in a second region. The first cloud management platform manages the cloud services of the first data center, and the second cloud management platform manages the cloud services of the second data center. The method includes: the first cloud management platform receiving security token request information sent by a client, the security token request information including a first region identifier, the first region identifier indicating the first region; the first cloud management platform sending a security token to the client according to the security token request information, wherein the security token includes the first region identifier and a second encryption result obtained by encrypting a first encryption result using the public key of the first cloud management platform. The encryption result includes the result obtained by encrypting the first region identifier; the first cloud management platform receives a first cloud service access request sent by the client for the cloud service of the first data center, the first cloud service access request carrying the first region identifier, the second encryption result, and the first signature of the security token, the first signature being encrypted using a first encryption algorithm based on the first encryption result; the first cloud management platform determines that the first region indicated by the first region identifier carried in the first cloud service access request is consistent with the first region where the cloud service of the first data center is located, and the first cloud management platform uses its private key to decrypt the second encryption result to obtain the first encryption result, generates a second signature based on the first encryption result using a second encryption algorithm identical to the first encryption algorithm, determines that the first signature carried in the first cloud service access request is consistent with the second signature, and allows the client to access the cloud service of the first data center.

[0030] This application provides a cloud service access method in which the client declares the authorized areas that the security token can access when applying for a security token. The cloud management platform adds the declaration of the authorized areas to the security token issued to the client, so that when the authorized areas are attacked, other areas of the cloud system will not be affected, thereby enhancing the isolation between different areas of the cloud system and reducing systemic risks.

[0031] The client can be a device used by an individual, enterprise, school, hospital, or government agency to access cloud services. This client can also be referred to as a user, tenant, user device, or tenant device; this application does not limit the specific name.

[0032] In one possible implementation scenario, the cloud system includes four regions: ap-east-1, ap-south-1, ap-west-1, and ap-west-2, with the first region identified as ap-east-1. If a user wants the security token obtained in this request to be used only to access cloud services in the ap-east-1 region, they can include the authorized region field `aud_regions = [ap-east-1]` in the security token request information to indicate that the security token can only be used to access cloud services in the ap-east-1 region. In this way, even if the security token is leaked, it will not affect the user's data in the ap-south-1, ap-west-1, and ap-west-2 regions.

[0033] In another possible implementation scenario, the cloud system includes regions ap-east-1, ap-south-1, ap-west-1, and ap-west-2. The first region is identified as ap-east-1, and the second region is identified as ap-south-1. The second region identifier is used to indicate the second region. If the user wants the security token obtained in this request to be used only to access cloud services in the ap-east-1 and ap-south-1 regions, then the authorized region field aud_regions = [ap-east-1, ap-south-1] can be included in the security token request information to indicate that the security token can only be used to access cloud services in the ap-east-1 and ap-south-1 regions.

[0034] For example, the first cloud service access request can be transmitted via protocols such as HTTP, HTTPS, or FTP, and the first region identifier, the second encryption result, and the first signature of the security token can be carried in the HTTP header, HTTPS header, or FTP header. This application does not impose any restrictions on this.

[0035] In some possible implementations, the security token request information may also include one or more of the following: user information, session-related information, and digital signature.

[0036] In some possible implementations, the security token can be in the form of an access key, which contains a triple of [AccessKeyId, SecretAccessKey, SessionToken]. AccessKeyId indicates the user's identity information, SecretAccessKey is the core security key used to generate the request signature, and SessionToken is a temporary token used to enhance the security of temporary access. The cloud service access method provided in this application can be applied to different types of security tokens, has a wide range of applicable scenarios, and can enhance the isolation between different areas of the cloud system in different scenarios, reducing systemic risks.

[0037] For example, the security token includes a key-value pair of a first region identifier and a second encryption result. For instance, the security token includes "ap-east-1":"derivation_key.ap-east-1", where ap-east-1 represents the first region identifier, derivation_key.ap-east-1 represents the second encryption result, derivation_key.ap-east-1 = Enc(ap-east-1_pub_key, kRegion1), where Enc represents the encryption algorithm, ap-east-1_pub_key represents the public key of the first cloud management platform, and kRegion1 represents the first encryption result, which includes the result obtained by encrypting the first region identifier.

[0038] For example, a client can send a first cloud service access request to a first cloud management platform via the API of the cloud service of a first data center. The security token carried in the first cloud service access request includes a first region identifier, a second encryption result, and a first signature. Upon receiving the first cloud service access request, the first cloud management platform determines that the first region indicated by the first region identifier carried in the first cloud service access request is consistent with the first region where the cloud service of the first data center is located. Furthermore, the first cloud management platform uses its private key ap-east-1_pri_key to decrypt the second encryption result to obtain a first encryption result kRegion1. Based on the first encryption result kRegion1, it generates a second signature using the same second encryption algorithm as the first encryption algorithm. The platform then determines that the first signature carried in the first cloud service access request is consistent with the second signature, allowing the client to access the cloud service of the first data center. It should be understood that the first cloud management platform possesses a public-private key pair for asymmetric encryption, for example, the public key is ap-east-1_pub_key and the private key is ap-east-1_pri_key. Encryption using the public key can be decrypted using the corresponding private key, and vice versa.

[0039] In conjunction with the second aspect, in some implementations of the second aspect, the security token request information does not include any region identifier other than the first region identifier. The method further includes: the second cloud management platform receiving a second cloud service access request sent by the client for the cloud service of the second data center, the second cloud service access request carrying the first region identifier, the second encryption result, and the first signature; the second cloud management platform determining that the first region indicated by the first region identifier carried in the second cloud service access request is inconsistent with the second region where the cloud service of the second data center is located, and rejecting the client's access to the cloud service of the second data center.

[0040] Cloud services include, but are not limited to, IaaS, PaaS, SaaS, FaaS, storage services, network services, database services, etc.

[0041] In some possible implementations, the first region identifier, the second encryption result, and the first signature can be carried in the header of the second cloud service access request. For example, the second cloud service access request can be transmitted via protocols such as HTTP, HTTPS, or FTP, and the first region identifier, the second encryption result, and the first signature can be carried in the HTTP header, HTTPS header, or FTP header; this application does not impose any restrictions on this.

[0042] For example, the client can send a second cloud service access request to the second cloud management platform via the API of the second data center's cloud service. The second cloud service access request carries a first region identifier, a second encryption result, and a first signature. After receiving the second cloud service access request, the second cloud management platform determines that the first region ap-east-1 indicated by the first region identifier carried in the second cloud service access request is inconsistent with the second region ap-south-1 where the cloud service of the second data center is located, and therefore refuses the client's access to the cloud service of the second data center.

[0043] This application provides a cloud service access method in which the cloud service access request sent by the client declares the authorized area that the security token can access. When the authorized area does not include the area where the cloud service to be accessed by the client is located, the cloud management platform can refuse the client access to the cloud service. This ensures that if the authorized area is attacked, other areas of the cloud system will not be affected, thereby enhancing the isolation between different areas of the cloud system and reducing systemic risks.

[0044] In conjunction with the second aspect, in some implementations of the second aspect, the security token request information further includes a second region identifier, and the security token further includes a fourth encryption result obtained by encrypting the third encryption result using the public key of the second cloud management platform. The third encryption result includes the result obtained by encrypting the second region identifier, which is used to indicate the second region. The method further includes: the second cloud management platform receiving a second cloud service access request sent by the client for the cloud service of the second data center. The second cloud service access request carries the second region identifier, the fourth encryption result, and a third signature of the security token. The third signature is encrypted using a third encryption algorithm based on the third encryption result. The second cloud management platform determines that the second region indicated by the second region identifier carried in the second cloud service access request is consistent with the second region where the cloud service of the second data center is located. The second cloud management platform decrypts the fourth encryption result using its private key to obtain the third encryption result. Based on the third encryption result, it generates a fourth signature using the same fourth encryption algorithm as the third encryption algorithm. It determines that the third signature carried in the second cloud service access request is consistent with the fourth signature, and allows the client to access the cloud service of the second data center.

[0045] In some possible implementations, the second region identifier, the fourth encryption result, and the third signature can be carried in the header of the second cloud service access request. For example, the second cloud service access request can be transmitted via protocols such as HTTP, HTTPS, or FTP, and the second region identifier, the fourth encryption result, and the third signature can be carried in the HTTP header, HTTPS header, or FTP header; this application does not impose any restrictions on this.

[0046] For example, the security token includes a key-value pair of a second region identifier and a fourth encryption result. For instance, the security token includes "ap-south-1":"derivation_key.ap-south-1", where ap-south-1 represents the second region identifier, derivation_key.ap-south-1 represents the fourth encryption result, derivation_key.ap-south-1 = Enc(ap-south-1_pub_key, kRegion2), where Enc represents the encryption algorithm, ap-south-1_pub_key represents the public key of the second cloud management platform, and kRegion2 represents the third encryption result, which includes the result obtained by encrypting the second region identifier.

[0047] For example, a client can send a second cloud service access request to the second cloud management platform via the API of the second data center's cloud service. This access request carries a second region identifier, a fourth encryption result, and a third signature. Upon receiving the access request, the second cloud management platform determines that the second region indicated by the second region identifier in the request matches the second region where the cloud service in the second data center is located. The platform then uses its private key, ap-south-1_pri_key, to decrypt the fourth encryption result, obtaining a third encryption result, kRegion2. Based on kRegion2, it uses the same fourth encryption algorithm as the third encryption algorithm to generate a fourth signature. The platform then determines that the third signature in the access request matches the fourth signature, allowing the client to access the cloud service in the second data center. It should be understood that the second cloud management platform possesses asymmetric encryption public-private key pairs, such as ap-south-1_pub_key for the public key and ap-south-1_pri_key for the private key. Encryption using the public key can be decrypted using the corresponding private key, and vice versa.

[0048] This application provides a cloud service access method in which the cloud service access request sent by the client declares the authorized area that the security token can access. The cloud management platform will only allow the client to access the cloud service if the authorized area includes the area where the cloud service to be accessed by the client is located. This ensures that if the authorized area is attacked, other areas of the cloud system will not be affected, thereby enhancing the isolation between different areas of the cloud system and reducing systemic risks.

[0049] In conjunction with the second aspect, in some implementations of the second aspect, the first cloud management platform is connected to the second cloud management platform, or: the cloud system further includes a central cloud management platform, the first cloud management platform and the second cloud management platform are connected to the central cloud management platform, and the central cloud management platform is used to manage the first cloud management platform and the second cloud management platform.

[0050] This application provides a cloud service access method in which the first cloud management platform and the second cloud management platform can be directly interconnected or centrally managed, which can be applied to different application scenarios and has high flexibility.

[0051] In some possible implementations, the cloud system, including the cloud management platform and data centers, covers multiple regions. The probability of attacking the first region is higher than that of other regions within the multiple regions. For example, if the cloud services in the first region are of high sensitivity, such as for geographical or political reasons, and it is desired that a malicious attack on the first region will not affect cloud resources and data in other regions, then the client can use a security token with the first region's identifier when accessing cloud services in the first region, thus limiting the use of the security token to the first region.

[0052] Thirdly, a cloud system is provided, including a first cloud management platform, a second cloud management platform, a first data center, and a second data center. The first cloud management platform and the first data center are located in a first region, and the second cloud management platform and the second data center are located in a second region. The first cloud management platform manages the cloud services of the first data center, and the second cloud management platform manages the cloud services of the second data center. The first cloud management platform is configured to receive a security token request from a client, the security token request including a first region identifier, which indicates the first region. The first cloud management platform is further configured to send a security token to the client based on the security token request, wherein the security token includes the first region identifier. The first cloud management platform is further configured to receive a first cloud service access request from the client for the cloud services of the first data center, the first cloud service access request carrying the security token. The first cloud management platform is further configured to determine that the first region indicated by the first region identifier included in the security token carried in the first cloud service access request is consistent with the first region where the cloud services of the first data center are located, and to allow the client to access the cloud services of the first data center.

[0053] In conjunction with the third aspect, in some implementations of the third aspect, the security token request information does not include any region identifier other than the first region identifier; the second cloud management platform is configured to receive a second cloud service access request sent by the client for the cloud service of the second data center, the second cloud service access request carrying the security token; the second cloud management platform is further configured to determine that the first region indicated by the first region identifier included in the security token carried in the second cloud service access request is inconsistent with the second region where the cloud service of the second data center is located, and to refuse the client access to the cloud service of the second data center.

[0054] In conjunction with the third aspect, in some implementations of the third aspect, the security token request information further includes a second region identifier, and the security token further includes the second region identifier, which is used to indicate the second region; the second cloud management platform is used to receive a second cloud service access request sent by the client for the cloud service of the second data center, the second cloud service access request carrying the security token; the second cloud management platform is also used to determine that the second region indicated by the second region identifier included in the security token carried by the second cloud service access request is consistent with the second region where the cloud service of the second data center is located, and to allow the client to access the cloud service of the second data center.

[0055] In conjunction with the third aspect, in some implementations of the third aspect, the first cloud management platform is connected to the second cloud management platform, or: the cloud system further includes a central cloud management platform, the first cloud management platform and the second cloud management platform are connected to the central cloud management platform, and the central cloud management platform is used to manage the first cloud management platform and the second cloud management platform.

[0056] The beneficial effects of the third aspect and any possible implementation of the third aspect correspond to the beneficial effects of the first aspect and any possible implementation of the first aspect, which will not be elaborated further.

[0057] Fourthly, a cloud system is provided, including a first cloud management platform, a second cloud management platform, a first data center, and a second data center. The first cloud management platform and the first data center are located in a first region, and the second cloud management platform and the second data center are located in a second region. The first cloud management platform manages the cloud services of the first data center, and the second cloud management platform manages the cloud services of the second data center. The first cloud management platform is used to receive security token request information sent by a client. The security token request information includes a first region identifier, which indicates the first region. The first cloud management platform is also used to send a security token to the client according to the security token request information. The security token includes the first region identifier and a second encryption result obtained by encrypting a first encryption result using the public key of the first cloud management platform. The first encryption result includes encryption of the first region identifier. The encrypted result; the first cloud management platform is further configured to receive a first cloud service access request sent by the client for the cloud service of the first data center, the first cloud service access request carrying the first region identifier, the second encryption result and the first signature of the security token, the first signature being encrypted based on the first encryption result using a first encryption algorithm; the first cloud management platform is further configured to determine that the first region indicated by the first region identifier carried by the first cloud service access request is consistent with the first region where the cloud service of the first data center is located, and the first cloud management platform uses its private key to decrypt the second encryption result to obtain the first encryption result, generates a second signature based on the first encryption result using a second encryption algorithm identical to the first encryption algorithm, determines that the first signature carried by the first cloud service access request is consistent with the second signature, and allows the client to access the cloud service of the first data center.

[0058] In conjunction with the fourth aspect, in some implementations of the fourth aspect, the security token request information does not include any region identifier other than the first region identifier; the second cloud management platform is configured to receive a second cloud service access request sent by the client for the cloud service of the second data center, the second cloud service access request carrying the first region identifier, the second encryption result, and the first signature; the second cloud management platform is further configured to determine that the first region indicated by the first region identifier carried in the second cloud service access request is inconsistent with the second region where the cloud service of the second data center is located, and to refuse the client's access to the cloud service of the second data center.

[0059] In conjunction with the fourth aspect, in some implementations of the fourth aspect, the security token request information further includes a second region identifier, and the security token further includes a fourth encryption result obtained by encrypting the third encryption result using the public key of the second cloud management platform. The third encryption result includes the result obtained by encrypting the second region identifier, which is used to indicate the second region. The second cloud management platform is used to receive a second cloud service access request sent by the client for the cloud service of the second data center. The second cloud service access request carries the second region identifier, the fourth encryption result, and a third signature of the security token. The third signature is encrypted using a third encryption algorithm based on the third encryption result. The second cloud management platform is also used to determine that the second region indicated by the second region identifier carried in the second cloud service access request is consistent with the second region where the cloud service of the second data center is located. The second cloud management platform decrypts the fourth encryption result using its private key to obtain the third encryption result, generates a fourth signature based on the third encryption result using the same fourth encryption algorithm as the third encryption algorithm, and determines that the third signature carried in the second cloud service access request is consistent with the fourth signature, thus allowing the client to access the cloud service of the second data center.

[0060] In conjunction with the fourth aspect, in some implementations of the fourth aspect, the first cloud management platform is connected to the second cloud management platform, or: the cloud system further includes a central cloud management platform, the first cloud management platform and the second cloud management platform are connected to the central cloud management platform, and the central cloud management platform is used to manage the first cloud management platform and the second cloud management platform.

[0061] The beneficial effects of the fourth aspect and any possible implementation of the fourth aspect correspond to the beneficial effects of the second aspect and any possible implementation of the second aspect, which will not be elaborated further.

[0062] Fifthly, a computing device cluster is provided, comprising at least one computing device, each computing device including a processor and a memory; the processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the computing device cluster to perform the method described in the first aspect or any possible implementation thereof, or to cause the computing device cluster to perform the method described in the second aspect or any possible implementation thereof.

[0063] Optionally, the processor can be a general-purpose processor, which can be implemented in hardware or software. When implemented in hardware, the processor can be a logic circuit, integrated circuit, etc.; when implemented in software, the processor can be a general-purpose processor that reads software code stored in memory. This memory can be integrated into the processor or located outside the processor and exist independently.

[0064] In a sixth aspect, a computer program product containing instructions is provided, which, when executed by a cluster of computing devices, cause the cluster of computing devices to perform the method as described in the first aspect and any implementation thereof, or cause the cluster of computing devices to perform the method described in the second aspect or any possible implementation thereof.

[0065] In a seventh aspect, a computer-readable storage medium is provided, comprising computer program instructions that, when executed by a cluster of computing devices, cause the cluster of computing devices to perform a method as described in the first aspect and any implementation thereof, or cause the cluster of computing devices to perform a method as described in the second aspect or any possible implementation thereof.

[0066] As examples, these computer-readable storage devices include, but are not limited to, one or more of the following: read-only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), flash memory, electrically EPROM (EEPROM), and hard drive.

[0067] Alternatively, as one implementation method, the aforementioned storage medium can specifically be a non-volatile storage medium. Attached Figure Description

[0068] Figure 1 This is a schematic diagram illustrating an application scenario of a cloud service access method provided in an embodiment of this application.

[0069] Figure 2 This is a schematic diagram illustrating an application scenario of another cloud service access method provided in this application embodiment.

[0070] Figure 3 This is an exemplary flowchart of a cloud service access method provided in an embodiment of this application.

[0071] Figure 4 This is an exemplary flowchart of another cloud service access method provided in the embodiments of this application.

[0072] Figure 5 This is an exemplary flowchart of another cloud service access method provided in the embodiments of this application.

[0073] Figure 6 This is an exemplary flowchart of another cloud service access method provided in the embodiments of this application.

[0074] Figure 7 This is a schematic block diagram of the computing device 700 provided in the embodiments of this application.

[0075] Figure 8 This is a schematic diagram of the architecture of a computing device cluster provided in this application.

[0076] Figure 9 This is a schematic diagram showing the connection between the computing devices 700A and 700B provided in this application via a network. Detailed Implementation

[0077] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort should fall within the scope of protection of this application.

[0078] In the embodiments of this application, the words "exemplary," "for example," etc., are used to indicate that they are examples, illustrations, or descriptions. Any embodiment or design that is described as "exemplary" in this application should not be construed as being more preferred or advantageous than other embodiments or design options. Specifically, the use of the term "exemplary" is intended to present the concept in a concrete manner.

[0079] The business scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0080] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature.

[0081] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0082] In this application, "at least one" means one or more, and "more than one" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A alone, A and B simultaneously, and B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0083] To facilitate understanding of the embodiments of this application, some definitions involved in this application will be briefly explained first.

[0084] 1. Security Token: In cloud computing scenarios, a temporary session token issued by the cloud management platform to users. Users can use the security token to call cloud service APIs and access cloud resources they have purchased.

[0085] 2. Hash-based message authentication code (HMAC): A message authentication mechanism that combines a cryptographic hash function and a key to verify the integrity and authenticity of a message.

[0086] 3. Key derivation function (KDF): A cryptographic function used to generate multiple keys from a raw key (usually a short input, such as a password or shared key), typically used in encryption, authentication and other applications.

[0087] Figure 1 This is a schematic diagram illustrating an application scenario of a cloud service access method provided in an embodiment of this application.

[0088] This application scenario includes a client 110, an internet connection 120, and a cloud system 130. The cloud system 130 includes a first cloud management platform 140, a second cloud management platform 150, a first data center 141, and a second data center 151. The first cloud management platform 140 and the first data center 141 are located in a first region, while the second cloud management platform 150 and the second data center 151 are located in a second region. The first cloud management platform 140 manages the cloud services of the first data center 141, and the second cloud management platform 150 manages the cloud services of the second data center 151. The first cloud management platform 140 and the second cloud management platform 150 are connected.

[0089] It should be understood that cloud system 130 can also cover areas other than the first and second regions. This illustration is merely an example and should not be construed as a limitation of this application. Client 110 can be a device used by individuals, enterprises, schools, hospitals, or administrative agencies to access cloud services. Client 110 can also be referred to as a user, tenant, user device, or tenant device; this application does not limit the specific name.

[0090] Each of the first data center 141 and the second data center 151 includes multiple servers, each containing cloud service resources to provide corresponding cloud services to users. The data centers comprise a basic resource pool of multiple servers, using virtualization technology to support the cloud management platform in building an elastic and scalable cloud environment. The first cloud management platform 140 and the second cloud management platform 150, among other cloud management platforms, provide computing, networking, and storage capabilities based on hardware and software resources. Through the network "cloud," they remotely process and analyze massive amounts of data before returning it to users, featuring large-scale, distributed, virtualized, highly available, scalable, on-demand service, and secure characteristics. The cloud management platform enables the rapid provision and release of configurable computing resources with minimal management overhead and low interaction complexity between users and service providers.

[0091] The Internet 120 can include the public internet. In some possible implementations, the first cloud management platform 140 and the second cloud management platform 150 have the same domain name but different public internet protocol (IP) addresses. The first cloud management platform 140 and the second cloud management platform 150 can be located in different geographical regions; for example, the first cloud management platform 140 is located in geographical region a, and the second cloud management platform 150 is located in geographical region b. Client 110 sends a domain name access request to a public domain name resolution server. The domain name access request carries the public IP address of client 110, and the request requests the return of the public IP address corresponding to the domain name. If the domain name resolution server analyzes that the IP address range to which client 110's public IP address belongs is located in geographical region a, it returns the public IP address of the first cloud management platform 140 in geographical region a to client 110. If the domain name resolution server analyzes that the IP address range to which client 110's public IP address belongs is located in geographical region b, it returns the public IP address of the second cloud management platform 150 in geographical region b to client 110.

[0092] In some other possible implementations, the first cloud management platform 140 and the second cloud management platform 150 are configured with different domain names and different public IP addresses. The domain name resolution server records the correspondence between the two sets of domain names and public IP addresses. The client 110 uses the target domain name to access the corresponding cloud management platform.

[0093] Figure 2 This is a schematic diagram illustrating an application scenario of another cloud service access method provided in this application embodiment.

[0094] This application scenario includes a client 110, an internet connection 120, and a cloud system 130. The cloud system 130 includes a first cloud management platform 140, a second cloud management platform 150, a central cloud management platform 180, a first data center 141, and a second data center 151. The first cloud management platform 140 and the first data center 141 are located in a first region, while the second cloud management platform 150 and the second data center 151 are located in a second region. The first cloud management platform 140 manages the cloud services of the first data center 141, and the second cloud management platform 150 manages the cloud services of the second data center 151. The first cloud management platform 140 and the second cloud management platform 150 are connected to the central cloud management platform 180, which manages both platforms. Further details of this application scenario can be found in [link to relevant documentation]. Figure 1 This application will not repeat the details here.

[0095] In cloud system 130, cloud services typically provide services to their users through application programming interfaces (APIs). To ensure that cloud services can authenticate and verify the legitimacy of user identities, users need to carry corresponding credentials when accessing cloud service APIs. These credentials used to access cloud service APIs are collectively referred to as security tokens. Security tokens are usually obtained by users through corresponding credentials. For example, when a user logs in to the cloud management platform's console page, the console, after verifying the user's username, password, and multi-factor authentication, helps the user obtain a security token in the background to facilitate subsequent access to cloud service APIs initiated from the console page. As another example, when a user's application calls a cloud service API, the application typically uses its X.509 certificate, OpenID connect token (OIDC Token), or other machine identity credentials to obtain a security token from the cloud management platform before initiating access to other cloud service APIs. Through this mechanism, the cloud management platform can effectively manage and control access to its cloud services, ensuring that only authenticated users and applications can perform the corresponding operations, thereby improving overall security and reliability.

[0096] Security tokens issued by different cloud management platforms may take different forms. For example, on some cloud management platforms, security tokens are in the form of OAuth Access Tokens, while on others they are in the form of AccessKeys. An AccessKey contains a triple of [AccessKeyId, SecretAccessKey, SessionToken].

[0097] In existing technologies, the use and verification methods for OAuth Access Token-type security tokens are relatively simple for both users and cloud services. During user interaction, the user only needs to include the security token in the request message's protocol, such as the HTTP header, when calling the cloud service API; no additional signing of the request message is required. During the cloud service's verification of the security token's legitimacy, since the security token itself carries a signature generated by the cloud management platform using its private key, upon receiving the API request, the cloud service only needs to retrieve the security token from the corresponding HTTP header and verify the signature's legitimacy using the cloud management platform's public key. If the security token is confirmed to be a legitimate security token issued by the cloud management platform, the request is considered valid, and the user's access request to the cloud service is granted.

[0098] For security tokens in the form of AccessKey, the user usage and cloud service verification methods are relatively more complex. AccessKey security tokens consist of a triple [AccessKeyId, SecretAccessKey, SessionToken]. AccessKeyId indicates the user's identity information, SecretAccessKey is the core security key used to generate request signatures, and SessionToken is a temporary token used to enhance the security of temporary access.

[0099] During user interaction, the SecretAccessKey is used to generate a request signature using the algorithm in Table 1. The SecretAccessKey undergoes four HMAC-SHA256 calculations, each combined with cloud name, date, region information, service information, and request type data to derive a final key kSigning used to generate the signature. Finally, kSigning is combined with HMAC-SHA256 to standardize the request signature. <string-to-sign>The process involves signing (generating a message authentication code). This can be viewed as the original key, SecretAccessKey, undergoing four key "derivations." Each HMAC-SHA256 function can be considered a KDF (Key Validation Function), and the derived key is ultimately used to sign the request. When a user initiates a request to a cloud service, they need to include a security token in the form of an AccessKey in the request message. For example, the HTTP header can include the triple [AccessKeyId, Signature, SessionToken].

[0100] Table 1

[0101]

[0102]

[0103] The process of a user generating a signature for a request message is irreversible but reproducible. Therefore, the cloud management platform verifies the legitimacy of the request message in the same way the user generates the signature: it obtains the SecretAccessKey corresponding to the AccessKeyId, executes the same algorithm as the user's signature generation, and compares the generated signature with the signature carried by the user in the request message. If the two signatures are completely identical, the request message is considered legitimate. In this verification method, the cloud service needs to obtain the SecretAccessKey corresponding to the AccessKeyId. Since the SecretAccessKey is the core key of the security token in the form of an AccessKey, it is not directly transmitted or carried in the request. Currently, mainstream cloud management platforms encrypt the SecretAccessKey and place it in the SessionToken. Since the request message carries the SessionToken, the cloud service can decrypt it from the SessionToken to obtain the SecretAccessKey, and then execute the algorithm described above, which is exactly the same as the user's signature generation process.

[0104] OAuth Access Tokens have weak security capabilities, mainly in the following ways: (1) Access to cloud service APIs only requires a security token. Obtaining a security token means that you can access a large number of cloud service APIs as a user. The leakage of security tokens will lead to serious security risks. (2) Security tokens are carried directly in the request. Cloud services can directly obtain users' security tokens. If cloud services in a region are compromised, attackers can obtain a large number of users' security tokens to attack other regions, leading to systemic risks.

[0105] AccessKey-based security tokens offer better security than OAuth Access Tokens, primarily because: (1) the triple [AccessKeyId, SecretAccessKey, SessionToken] must be used together, and there is no security risk if a single SessionToken or SecretAccessKey is leaked; (2) its core key, SecretAccessKey, is not directly carried in the request, reducing the risk of SecretAccessKey leakage. However, it still has the following problems: although SecretAccessKey is not directly carried in the request, it is encrypted and placed in the SessionToken, while the SessionToken is directly carried in the request. Furthermore, since each region's cloud service (or identity authentication service) has the ability to decrypt the SessionToken and obtain the SecretAccessKey, an attack on one region of the cloud system may also affect the security of other regions of the cloud system.

[0106] This application provides a cloud service access method in which the client declares the authorized areas that the security token can access when applying for a security token. The cloud management platform adds the declaration of the authorized areas to the security token issued to the client, so that when the authorized areas are attacked, other areas of the cloud system will not be affected, thereby enhancing the isolation between different areas of the cloud system and reducing systemic risks.

[0107] Figure 3 This is an exemplary flowchart of a cloud service access method provided in an embodiment of this application.

[0108] 310, the first cloud management platform 140 receives the security token request information sent by client 110.

[0109] Client 110 sends a security token request to the first cloud management platform 140. This security token request includes a first region identifier, which indicates a first region. The first cloud management platform 140 receives the security token request from client 110. Optionally, the security token request may also include other region identifiers, such as a second region identifier.

[0110] In one possible implementation scenario, the cloud system includes four regions: ap-east-1, ap-south-1, ap-west-1, and ap-west-2, with the first region identified as ap-east-1. If a user wants the security token obtained in this request to be used only to access cloud services in the ap-east-1 region, they can include the authorized region field `aud_regions = [ap-east-1]` in the security token request information to indicate that the security token can only be used to access cloud services in the ap-east-1 region. In this way, even if the security token is leaked, it will not affect the user's data in the ap-south-1, ap-west-1, and ap-west-2 regions.

[0111] In another possible implementation scenario, the cloud system includes regions ap-east-1, ap-south-1, ap-west-1, and ap-west-2. The first region is identified as ap-east-1, and the second region is identified as ap-south-1. The second region identifier is used to indicate the second region. If the user wants the security token obtained in this request to be used only to access cloud services in the ap-east-1 and ap-south-1 regions, then the authorized region field aud_regions = [ap-east-1, ap-south-1] can be included in the security token request information to indicate that the security token can only be used to access cloud services in the ap-east-1 and ap-south-1 regions.

[0112] For example, the first cloud management platform 140 can extend the APIGetSecurityToken used by the client 110 to obtain a security token with a region information field, allowing the client 110 to specify the range of regions that the obtained security token can access. For example, the field aud_regions = [ap-east-1,ap-east-2] can be used to specify that the security token can access cloud services in the ap-east-1 and ap-east-2 regions, and the field aud_regions = [ap-east-1] can be used to specify that the security token can access cloud services in the ap-east-1 region.

[0113] For example, the security token request information can be GetSecurityToken(aud regions=ap-east-1) or AssumeAgency(aud regions=ap-east-1). This application does not restrict the name of the API for obtaining the security token.

[0114] In some possible implementations, the security token request information may also include one or more of the following: user information, session-related information, and digital signature.

[0115] 320, the first cloud management platform 140 sends a security token to the client 110.

[0116] The first cloud management platform 140 sends a security token to the client 110 based on the security token request information. The security token includes the first region identifier; optionally, the security token may also include other region identifiers. The security token issued by the first cloud management platform 140 to the client 110 can be a security token in the form of an OAuth Access Token, and the first region identifier can be a field in the security token.

[0117] 330, the First Cloud Management Platform 140 receives the First Cloud Service access request.

[0118] The first cloud management platform 140 receives a first cloud service access request sent by the client 110 for the cloud services of the first data center 141, and the first cloud service access request carries a security token.

[0119] For example, client 110 can send the first cloud service access request to first cloud management platform 140 through the cloud service API of first data center 141. The first cloud service access request can be transmitted via protocols such as HTTP, HTTPS, or FTP, and the security token can be carried in the HTTP header, HTTPS header, or FTP header; this application does not impose any restrictions on this.

[0120] 340, the first cloud management platform 140 determines whether the regional information is consistent.

[0121] If the first cloud management platform 140 determines that the first region indicated by the first region identifier included in the security token carried in the first cloud service access request is consistent with the first region where the cloud service of the first data center 141 is located, then the first cloud management platform 140 allows the client 110 to access the cloud service of the first data center 141. Otherwise, it denies the client 110 access to the cloud service of the first data center 141.

[0122] For example, the security token in the form of an OAuth Access Token issued by the first cloud management platform 140 to the client 110 includes a first region identifier of ap-east-1. ap-east-1 indicates the first region ap-east-1, meaning the first region where the cloud service of the first data center 141 is located is ap-east-1. After receiving the first cloud service access request, the first cloud management platform 140 determines that the first region indicated by the first region identifier in the security token carried in the first cloud service access request is consistent with the first region where the cloud service of the first data center 141 is located, both being ap-east-1. Therefore, the first cloud management platform 140 allows the client 110 to access the cloud service of the first data center 141.

[0123] Figure 4 This is an exemplary flowchart of another cloud service access method provided in the embodiments of this application.

[0124] 410, the second cloud management platform 150 receives the second cloud service access request.

[0125] Client 110 sends a second cloud service access request to the second cloud management platform 150 for cloud services in the second data center 151. This second cloud service access request carries a security token in the form of an OAuth Access Token issued to client 110 by the first cloud management platform 140 in step 320. The second cloud management platform 150 receives the second cloud service access request.

[0126] For example, client 110 can send the second cloud service access request to second cloud management platform 150 through the cloud service API of second data center 151.

[0127] In some possible implementations, the security token can be carried in the header of the second cloud service access request. For example, the second cloud service access request can be transmitted via protocols such as HTTP, HTTPS, or FTP, and the security token can be carried in the HTTP header, HTTPS header, or FTP header; this application does not impose any restrictions on this.

[0128] The second cloud management platform 150 receives the second cloud service access request and extracts the security token from the second cloud service access request. For example, the security token is carried in the header of the second cloud service access request, and the second cloud management platform 150 extracts the security token from the header of the second cloud service access request.

[0129] 420, the second cloud management platform 150 determines whether the regional information is consistent.

[0130] In some possible implementation scenarios, the security token request information does not include any region identifiers other than the first region identifier. The second cloud management platform 150 determines that the first region indicated by the first region identifier in the security token carried by the second cloud service access request is inconsistent with the second region where the cloud service of the second data center 151 is located, and refuses the client 110 to access the cloud service of the second data center 151.

[0131] For example, the security token carried in the second cloud service access request includes the authorization region field aud_regions = [ap-east-1], where the first region identifier is ap-east-1, and ap-east-1 is used to indicate the first region ap-east-1. However, the second region where the cloud service of the second data center 151 is located is the ap-south-1 region. After receiving the second cloud service access request, the second cloud management platform 150 determines that the first region indicated by the first region identifier in the security token carried in the second cloud service access request is inconsistent with the second region where the cloud service of the second data center 151 is located. Therefore, the second cloud management platform 150 refuses the client 110 to access the cloud service of the second data center 151.

[0132] In other possible implementation scenarios, the security token request information also includes a second region identifier, and the security token also includes a second region identifier, which is used to indicate a second region. The second cloud management platform 150 determines that the second region indicated by the second region identifier in the security token carried by the second cloud service access request is consistent with the second region where the cloud service of the second data center 151 is located, and allows the client 110 to access the cloud service of the second data center 151.

[0133] For example, the security token carried in the second cloud service access request includes the authorization region field aud_regions = [ap-east-1, ap-south-1], that is, the security token includes a first region identifier and a second region identifier, the first region identifier being ap-east-1 and the second region identifier being ap-south-1. ap-east-1 indicates the first region ap-east-1, and ap-south-1 indicates the second region ap-south-1. The second region where the cloud service of the second data center 151 is located is the ap-south-1 region. After receiving the second cloud service access request, the second cloud management platform 150 determines that the second region indicated by the second region identifier included in the security token carried in the second cloud service access request is consistent with the second region where the cloud service of the second data center 151 is located, both being the ap-south-1 region. Therefore, the second cloud management platform 150 allows the client 110 to access the cloud service of the second data center 151.

[0134] For example, the security token carried in the second cloud service access request includes the authorization region field aud_regions = [ap-east-1, ap-south-1, ap-west-1]. That is, the security token includes a first region identifier, a second region identifier, and a third region identifier. The first region identifier is ap-east-1, the second region identifier is ap-south-1, and the third region identifier is ap-west-1. ap-east-1 indicates the first region ap-east-1, ap-south-1 indicates the second region ap-south-1, and ap-west-1 indicates the third region ap-west-1. The second region where the cloud service of the second data center 151 is located is the ap-south-1 region. After receiving the second cloud service access request, the second cloud management platform 150 determines that the second region indicated by the second region identifier included in the security token carried in the second cloud service access request is consistent with the second region where the cloud service of the second data center 151 is located, both being the ap-south-1 region. Therefore, the second cloud management platform 150 allows the client 110 to access the cloud service of the second data center 151.

[0135] Figure 5 This is an exemplary flowchart of another cloud service access method provided in the embodiments of this application.

[0136] 510, The first cloud management platform 140 receives a security token request message sent by client 110.

[0137] Client 110 sends a security token request to the first cloud management platform 140. This security token request includes a first region identifier, which indicates a first region. The first cloud management platform 140 receives the security token request from client 110. Optionally, the security token request may also include other region identifiers, such as a second region identifier.

[0138] In one possible implementation scenario, the cloud system includes four regions: ap-east-1, ap-south-1, ap-west-1, and ap-west-2, with the first region identified as ap-east-1. If a user wants the security token obtained in this request to be used only to access cloud services in the ap-east-1 region, they can include the authorized region field `aud_regions = [ap-east-1]` in the security token request information to indicate that the security token can only be used to access cloud services in the ap-east-1 region. In this way, even if the security token is leaked, it will not affect the user's data in the ap-south-1, ap-west-1, and ap-west-2 regions.

[0139] In another possible implementation scenario, the cloud system includes regions ap-east-1, ap-south-1, ap-west-1, and ap-west-2. The first region is identified as ap-east-1, and the second region is identified as ap-south-1. The second region identifier is used to indicate the second region. If the user wants the security token obtained in this request to be used only to access cloud services in the ap-east-1 and ap-south-1 regions, then the authorized region field aud_regions = [ap-east-1, ap-south-1] can be included in the security token request information to indicate that the security token can only be used to access cloud services in the ap-east-1 and ap-south-1 regions.

[0140] For example, the security token request information can be GetSecurityToken(aud regions=ap-east-1) or AssumeAgency(aud regions=ap-east-1). This application does not restrict the name of the API for obtaining the security token.

[0141] In some possible implementations, the security token request information may also include one or more of the following: user information, session-related information, and digital signature.

[0142] 520, the first cloud management platform 140 sends a security token to the client 110.

[0143] The first cloud management platform 140 sends a security token to the client 110 based on the security token request information. The security token includes a first region identifier and a second encryption result obtained by encrypting a first encryption result using the public key of the first cloud management platform 140. The first encryption result includes the result obtained by encrypting the first region identifier. Optionally, the security token may also include other region identifiers and encryption results obtained using the public keys of other cloud management platforms. The security token issued by the first cloud management platform 140 to the client 110 can be a security token in the form of an AccessKey, and the first region identifier can be a field in the security token.

[0144] The security token in AccessKey format includes a triple [AccessKeyId, SecretAccessKey, SessionToken]. The first cloud management platform 140 no longer directly puts the SecretAccessKey into the SessionToken. Instead, it first derives the SecretAccessKey using KDF combined with the first region identifier, and then encrypts it using the public key from the asymmetric key pair held only by the first cloud management platform 140 before putting it into the SessionToken. For example, the algorithm flow is shown in Table 2. The first region identifier is ap-east-1, used to indicate the first region. `derivation_key1.ap-east-1` is the second encryption result obtained by encrypting the first encryption result using the public key of the first cloud management platform 140. The first encryption result includes the result obtained by encrypting the first region identifier. `ap-east-1_pub_key` represents the public key of the first cloud management platform 140, and `kRegion1` represents the first encryption result. The SessionToken may include `derivation_key1.ap-east-1`, but no longer directly includes the SecretAccessKey.

[0145] Table 2

[0146]

[0147] Optionally, the security token request information also includes a second region identifier, and the security token also includes a fourth encryption result obtained by encrypting the third encryption result using the public key of the second cloud management platform 150. The third encryption result includes the result obtained by encrypting the second region identifier. As shown in Table 3, `derivation_key.ap-south-1` is the fourth encryption result obtained by encrypting the third encryption result using the public key of the second cloud management platform 150, the second region identifier is `ap-south-1`, which indicates the second region, `ap-south-1_pub_key` is the public key of the second cloud management platform 150, and `kRegion2` is the third encryption result. The SessionToken can include `derivation_key.ap-east-1` and `derivation_key.ap-south-1`, and no longer directly includes `SecretAccessKey`.

[0148] Table 3

[0149]

[0150] It should be understood that the HMAC-SHA256 algorithm used in Tables 2 and 3 is merely an example, and other KDFs, such as HMAC-SHA1 and HMAC-SHA512, can also be used; this application does not impose any restrictions on them. The derivation methods and steps are also merely examples, and it is only necessary that the derivation process includes a region identifier; this application does not impose any restrictions on them.

[0151] Table 4 shows an example of a SessionToken in an AccessKey-type security token provided in this application embodiment. The public key of the first region ap-east-1 is ap-east-1_pub_key, and the private key is ap-east-1_pri_key. The public key of the second region ap-south-1 is ap-south-1_pub_key, and the private key is ap-south-1_pri_key.

[0152] Table 4

[0153]

[0154] At 530, the First Cloud Management Platform (140) received a request to access the First Cloud service.

[0155] The first cloud management platform 140 receives a first cloud service access request sent by the client 110 for the cloud service of the first data center 141. The first cloud service access request carries a first area identifier and a second encryption result in the security token, and also carries a first signature of the security token. The first signature is encrypted using a first encryption algorithm based on the first encryption result.

[0156] For example, client 110 can send the first cloud service access request to first cloud management platform 140 through the cloud service API of first data center 141. The first cloud service access request can be transmitted via protocols such as HTTP, HTTPS, or FTP. The first region identifier, second encryption result, and first signature can be carried in the HTTP header, HTTPS header, or FTP header, and this application does not impose any restrictions on this.

[0157] For example, the first cloud service access request can initiate an API call to the cloud service of the first data center 141 by carrying the triple [AccessKeyId, Signature1, SessionToken]. The first signature, Signature1, can be obtained from Table 5.

[0158] Table 5

[0159]

[0160] 540, the first cloud management platform 140 determines whether the regional information and encryption results are consistent.

[0161] After receiving the first cloud service access request, if the SessionToken does not directly contain the SecretAccessKey, it indicates that the first cloud service access request contains a region declaration.

[0162] The first cloud management platform 140 determines that the first region ap-east-1 indicated by the first region identifier ap-east-1 carried in the first cloud service access request is consistent with the first region ap-east-1 where the cloud service of the first data center 141 is located. The first cloud management platform 140 uses the private key ap-east-1_pri_key of the first cloud management platform to decrypt the second encryption result derivative_key.ap-east-1 to obtain the first encryption result kRegion1. Based on the first encryption result kRegion1, the second encryption algorithm with the same second encryption algorithm as the first encryption algorithm is used to generate the second signature Signature2, for example, the second signature Signature2 is obtained through Table 6. The first cloud service access request carries the first signature Signature1 and the second signature Signature2 to be consistent, and the client 110 is allowed to access the cloud service of the first data center 141.

[0163] Table 6

[0164]

[0165] Because each `derivation_key` field in the SessionToken is encrypted using the public key of the corresponding region, each region can only decrypt its own region's derived key, `kRegion`. Furthermore, since the derivation process is irreversible, the cloud management platform and all cloud services within each region cannot obtain the original `SecretAccessKey`. Therefore, even if one region is attacked, it will not affect other regions of the cloud system, enhancing the isolation between different regions within the cloud system and reducing systemic risks.

[0166] Figure 6 This is an exemplary flowchart of another cloud service access method provided in the embodiments of this application.

[0167] 610, the second cloud management platform 150 receives the second cloud service access request.

[0168] Client 110 sends a second cloud service access request to the second cloud management platform 150 for the cloud services of the second data center 151. The second cloud service access request carries a first region identifier ap-east-1, a second encryption result derivative_key.ap-east-1, and a first signature Signature1. The second cloud management platform 150 receives the second cloud service access request.

[0169] For example, the first region identifier ap-east-1 and the second encryption result derivative_key.ap-east-1 carried in the second cloud service access request can be in the form of a key-value pair, such as "ap-east-1":"derivation_key.ap-east-1".

[0170] For example, client 110 can send the second cloud service access request to second cloud management platform 150 through the cloud service API of second data center 151.

[0171] In some possible implementations, the first region identifier ap-east-1, the second encryption result derivative_key.ap-east-1, and the first signature Signature1 can be carried in the header of the second cloud service access request. For example, the second cloud service access request can be transmitted via protocols such as HTTP, HTTPS, or FTP, and the first region identifier ap-east-1, the second encryption result derivative_key.ap-east-1, and the first signature Signature1 can be carried in the HTTP header, HTTPS header, or FTP header; this application does not impose any restrictions on this.

[0172] The second cloud management platform 150 receives the second cloud service access request and extracts the first region identifier ap-east-1, the second encryption result derivative_key.ap-east-1, and the first signature Signature1 from the second cloud service access request. For example, the first region identifier ap-east-1, the second encryption result derivative_key.ap-east-1, and the first signature Signature1 are carried in the header of the second cloud service access request, and the second cloud management platform 150 extracts these three information from the header of the second cloud service access request.

[0173] Optionally, the security token request information in step 510 may further include the second region identifier ap-south-1, and the security token may also include a fourth encryption result, derivative_key.ap-south-1, obtained by encrypting the third encryption result kRegion2 using the public key ap-south-1_pub_key of the second cloud management platform 150. The third encryption result kRegion2 includes the result obtained by encrypting the second region identifier ap-south-1, which is used to indicate the second region ap-south-1. The second cloud service access request also carries the second region identifier ap-south-1, the fourth encryption result derivative_key.ap-south-1, and the third signature, Signature3, of the security token. The third signature, Signature3, is encrypted based on the third encryption result kRegion2 using a third encryption algorithm. Table 7 shows the calculation process of the third signature, Signature3.

[0174] Table 7

[0175]

[0176] 620, the second cloud management platform 150 determines whether the regional information and encryption results are consistent.

[0177] In some possible implementation scenarios, the security token request information does not include any region identifiers other than the first region identifier ap-east-1. The second cloud management platform 150 determines that the first region ap-east-1 indicated by the first region identifier ap-east-1 carried in the second cloud service access request is inconsistent with the second region ap-south-1 where the cloud service of the second data center 151 is located, and refuses the client 110 to access the cloud service of the second data center 151.

[0178] In other possible implementation scenarios, the security token request information also includes a second region identifier ap-south-1, and the security token also includes a fourth encryption result, derivative_key.ap-south-1, obtained by encrypting the third encryption result kRegion2 using the public key ap-south-1_pub_key of the second cloud management platform 150, as shown in Table 3. The third encryption result kRegion2 includes the result obtained by encrypting the second region identifier ap-south-1, which is used to indicate the second region ap-south-1. The second cloud service access request also carries the second region identifier ap-south-1, the fourth encryption result derivative_key.ap-south-1, and the third signature Signature3. The second cloud management platform 150 determines that the second region indicated by the second region identifier ap-south-1 carried in the second cloud service access request is consistent with the second region where the cloud service of the second data center 151 is located, both being the ap-south-1 region. Furthermore, the second cloud management platform 150 uses its private key ap-south-1_pri_key to decrypt the fourth encryption result derivative_key.ap-south-1 to obtain the third encryption result kRegion2. Based on the third encryption result kRegion2, it uses the same fourth encryption algorithm as the third encryption algorithm to generate the fourth signature Signature4, for example, obtained through Table 8. It then determines that the third signature Signature3 carried in the second cloud service access request is consistent with the fourth signature Signature4, and allows the client 110 to access the cloud service of the second data center 151. Otherwise, it denies the client 110 access to the cloud service of the second data center 151.

[0179] Table 8

[0180]

[0181] The embodiments of this application do not limit the specific encryption algorithms and encryption processes used in the first, second, third, and fourth encryption algorithms.

[0182] The following will combine Figures 7-9 The embodiments of the device described in this application are described in detail below. It should be understood that the descriptions of the method embodiments correspond to the descriptions of the device embodiments; therefore, any parts not described in detail can be referred to the foregoing method embodiments.

[0183] The cloud service access method provided in this application can be executed by a computing device, which can also be referred to as a computer system. It includes a hardware layer, an operating system layer running on top of the hardware layer, and an application layer running on the operating system layer. The hardware layer includes hardware such as processing units, memory, and memory control units; the functions and structure of this hardware will be described in detail later. The operating system can be any one or more computer operating systems that implement business processing through processes, such as Linux, Unix, Android, iOS, or Windows. The application layer includes applications such as browsers, address books, word processing software, and instant messaging software. Optionally, the computer system can be a handheld device such as a smartphone, or a terminal device such as a personal computer; this application does not particularly limit this, as long as the method provided in this application can be used. The executing entity of the cloud service access method provided in this application can be a computing device, or a functional module within the computing device capable of calling and executing programs.

[0184] The following is combined with Figure 7 This application provides a detailed description of a computing device provided in an embodiment.

[0185] Figure 7 This is a schematic diagram of the architecture of a computing device provided in an embodiment of this application. The computing device 700 can be a server, a computer, or other device with computing capabilities. Figure 7 The computing device 700 shown includes a processor 720, a memory 730, a communication interface 740, and a bus 710. The processor 720, memory 730, and communication interface 740 communicate with each other via the bus 710. The computing device 700 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device 700.

[0186] The bus 710 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be divided into address buses, data buses, control buses, etc. For ease of representation, Figure 7 The bus 710 may be represented by a single line, but this does not mean that there is only one bus or one type of bus. The bus 710 may include a path for transmitting information between various components of the computing device 700 (e.g., memory 730, processor 720, communication interface 740).

[0187] The processor 720 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0188] The memory 730 may include volatile memory, such as random access memory (RAM). The processor 740 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0189] The memory 730 stores executable program code, and the processor 720 executes the executable program code to implement the cloud service access method described in the above embodiments. That is, the memory 730 stores instructions for executing the cloud service access method described in the above embodiments.

[0190] Alternatively, the memory 730 may store executable program code, which the processor 720 executes to implement the cloud service access method described in the above embodiments. That is, the memory 730 may store instructions for executing the cloud service access method described in the embodiments.

[0191] The communication interface 740 uses transceiver modules, such as, but not limited to, network interface cards and transceivers, to enable communication between the computing device 700 and other devices or communication networks.

[0192] The above-described structure of the computing device 700 is merely illustrative and is not intended to limit the application. The computing device 700 in this application includes various hardware components in existing computer systems. For example, the computing device 700 may also include other memories besides the memory 730, such as disk storage. Those skilled in the art should understand that the computing device 700 may also include other devices necessary for normal operation. Furthermore, depending on specific needs, those skilled in the art should understand that the above-described computing device 700 may also include hardware devices for implementing other additional functions. Moreover, those skilled in the art should understand that the above-described computing device 700 may only include the devices necessary for implementing the embodiments of this application, and may not necessarily include... Figure 7 All the devices shown.

[0193] Figure 8 This is a schematic diagram of the architecture of a computing device cluster provided in an embodiment of this application.

[0194] The computing device cluster includes at least one computing device. This computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0195] like Figure 8 As shown, the computing device cluster includes at least one computing device 700. The memory 730 in one or more computing devices 700 in the computing device cluster may store the same instructions for executing the cloud service access method described in the above embodiments.

[0196] In some possible implementations, the memory 730 of one or more computing devices 700 in the computing device cluster may also store partial instructions for executing the cloud service access method described in the above embodiments. In other words, a combination of one or more computing devices 700 can jointly execute instructions for executing the cloud service access method described in the above embodiments.

[0197] It should be noted that the memory 730 in different computing devices 700 in the computing device cluster can store different instructions, which are used to execute some functions of the computing device 700 respectively.

[0198] In some possible implementations, one or more computing devices in a computing device cluster can be connected via a network. This network can be a wide area network (WAN) or a local area network (LAN), etc. Figure 9 One possible implementation method is shown. Figure 9 This is a schematic diagram illustrating the connection between computing devices 700A and 700B via a network, as provided in an embodiment of this application. The two computing devices 700A and 700B are connected via a network. Specifically, they are connected to the network through communication interfaces in each computing device.

[0199] Figure 9 The connection method between the computing device clusters shown may be to consider that the cloud service access method provided in this application requires the issuance of security tokens to a large number of users, and therefore consider to delegate some functions to the computing device 700B.

[0200] It should be understood that Figure 9 The functions of the computing device 700A shown can also be performed by multiple computing devices 700. Similarly, the functions of the computing device 700B can also be performed by multiple computing devices 700.

[0201] In this embodiment, a computer program product containing instructions is also provided. The computer program product may be software or program products containing instructions that can run on a computing device or be stored on any available medium. When the computer program product runs on at least one computing device, it causes the computing device to execute the cloud service access method provided above.

[0202] In this embodiment, a computer program product containing instructions is also provided. The computer program product may be software or program products containing instructions capable of running on a computing device cluster or stored on any available medium. When run by the computing device cluster, it causes the computing device cluster to execute the cloud service access method provided above.

[0203] In this embodiment, a computer-readable storage medium is also provided. This computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that, when executed on a computing device, cause the computing device to perform the cloud service access method described above.

[0204] In this embodiment, a computer-readable storage medium is also provided. This computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that, when executed by a cluster of computing devices, cause the cluster of computing devices to perform the cloud service access method described above.

[0205] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0206] Those skilled in the art will recognize that the functions and algorithmic steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented using electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0207] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the devices and computing device clusters described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0208] In the several embodiments provided in this application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0209] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0210] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0211] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A cloud service access method based on cloud computing technology, characterized in that, The method is applied to a cloud system, which includes a first cloud management platform, a second cloud management platform, a first data center, and a second data center. The first cloud management platform and the first data center are located in a first region, and the second cloud management platform and the second data center are located in a second region. The first cloud management platform manages the cloud services of the first data center, and the second cloud management platform manages the cloud services of the second data center. The method includes: The first cloud management platform receives a security token request message sent by the client. The security token request message includes a first region identifier, which is used to indicate the first region. The first cloud management platform sends a security token to the client based on the security token request information, wherein the security token includes the first region identifier; The first cloud management platform receives a first cloud service access request sent by the client for the cloud service of the first data center, and the first cloud service access request carries the security token. The first cloud management platform determines that the first region indicated by the first region identifier included in the security token carried in the first cloud service access request is consistent with the first region where the cloud service of the first data center is located, and allows the client to access the cloud service of the first data center.

2. The method according to claim 1, characterized in that, The security token request information does not include any region identifiers other than the first region identifier, and the method further includes: The second cloud management platform receives a second cloud service access request sent by the client for the cloud service of the second data center, and the second cloud service access request carries the security token. The second cloud management platform determines that the first region indicated by the first region identifier included in the security token carried in the second cloud service access request is inconsistent with the second region where the cloud service of the second data center is located, and refuses the client access to the cloud service of the second data center.

3. The method according to claim 1, characterized in that, The security token request information further includes a second region identifier, and the security token further includes the second region identifier, which is used to indicate the second region. The method further includes: The second cloud management platform receives a second cloud service access request sent by the client for the cloud service of the second data center, and the second cloud service access request carries the security token. The second cloud management platform determines that the second region indicated by the second region identifier included in the security token carried in the second cloud service access request is consistent with the second region where the cloud service of the second data center is located, and allows the client to access the cloud service of the second data center.

4. The method according to any one of claims 1 to 3, characterized in that, The first cloud management platform is connected to the second cloud management platform, or: The cloud system also includes a central cloud management platform, to which the first cloud management platform and the second cloud management platform are connected, and the central cloud management platform is used to manage the first cloud management platform and the second cloud management platform.

5. A cloud service access method based on cloud computing technology, characterized in that, The method is applied to a cloud system, which includes a first cloud management platform, a second cloud management platform, a first data center, and a second data center. The first cloud management platform and the first data center are located in a first region, and the second cloud management platform and the second data center are located in a second region. The first cloud management platform manages the cloud services of the first data center, and the second cloud management platform manages the cloud services of the second data center. The method includes: The first cloud management platform receives a security token request message sent by the client. The security token request message includes a first region identifier, which is used to indicate the first region. The first cloud management platform sends a security token to the client based on the security token request information. The security token includes the first region identifier and a second encryption result obtained by encrypting the first encryption result using the public key of the first cloud management platform. The first encryption result includes the result obtained by encrypting the first region identifier. The first cloud management platform receives a first cloud service access request sent by the client for the cloud service of the first data center. The first cloud service access request carries the first region identifier, the second encryption result and the first signature of the security token. The first signature is encrypted using the first encryption algorithm based on the first encryption result. The first cloud management platform determines that the first region indicated by the first region identifier carried in the first cloud service access request is consistent with the first region where the cloud service of the first data center is located. The first cloud management platform uses its private key to decrypt the second encryption result to obtain the first encryption result. Based on the first encryption result, it generates a second signature using a second encryption algorithm that is the same as the first encryption algorithm. It determines that the first signature carried in the first cloud service access request is consistent with the second signature and allows the client to access the cloud service of the first data center.

6. The method according to claim 5, characterized in that, The security token request information does not include any region identifiers other than the first region identifier, and the method further includes: The second cloud management platform receives a second cloud service access request sent by the client for the cloud services of the second data center. The second cloud service access request carries the first region identifier, the second encryption result, and the first signature. The second cloud management platform determines that the first region indicated by the first region identifier carried in the second cloud service access request is inconsistent with the second region where the cloud service of the second data center is located, and refuses the client access to the cloud service of the second data center.

7. The method according to claim 5, characterized in that, The security token request information further includes a second region identifier, and the security token further includes a fourth encryption result obtained by encrypting the third encryption result using the public key of the second cloud management platform. The third encryption result includes the result obtained by encrypting the second region identifier, which is used to indicate the second region. The method further includes: The second cloud management platform receives a second cloud service access request sent by the client for the cloud service of the second data center. The second cloud service access request carries the second region identifier, the fourth encryption result, and the third signature of the security token. The third signature is encrypted using a third encryption algorithm based on the third encryption result. The second cloud management platform determines that the second region indicated by the second region identifier carried in the second cloud service access request is consistent with the second region where the cloud service of the second data center is located. The second cloud management platform uses its private key to decrypt the fourth encryption result to obtain the third encryption result. Based on the third encryption result, it generates a fourth signature using the same fourth encryption algorithm as the third encryption algorithm. It determines that the third signature carried in the second cloud service access request is consistent with the fourth signature, and allows the client to access the cloud service of the second data center.

8. The method according to any one of claims 5 to 7, characterized in that, The first cloud management platform is connected to the second cloud management platform, or: The cloud system also includes a central cloud management platform, to which the first cloud management platform and the second cloud management platform are connected, and the central cloud management platform is used to manage the first cloud management platform and the second cloud management platform.

9. A cloud system, characterized in that, It includes a first cloud management platform, a second cloud management platform, a first data center, and a second data center. The first cloud management platform and the first data center are located in a first region, and the second cloud management platform and the second data center are located in a second region. The first cloud management platform is used to manage the cloud services of the first data center, and the second cloud management platform is used to manage the cloud services of the second data center. The first cloud management platform is used to receive security token request information sent by the client. The security token request information includes a first region identifier, which is used to indicate the first region. The first cloud management platform is further configured to send a security token to the client based on the security token request information, wherein the security token includes the first region identifier; The first cloud management platform is also used to receive a first cloud service access request sent by the client for the cloud service of the first data center, the first cloud service access request carrying the security token. The first cloud management platform is further configured to determine that the first region indicated by the first region identifier included in the security token carried in the first cloud service access request is consistent with the first region where the cloud service of the first data center is located, and to allow the client to access the cloud service of the first data center.

10. The cloud system according to claim 9, characterized in that, The security token request information does not include any region identifiers other than the first region identifier; The second cloud management platform is used to receive a second cloud service access request sent by the client for the cloud service of the second data center, the second cloud service access request carrying the security token; The second cloud management platform is further configured to determine that the first region indicated by the first region identifier included in the security token carried in the second cloud service access request is inconsistent with the second region where the cloud service of the second data center is located, and to refuse the client access to the cloud service of the second data center.

11. The cloud system according to claim 9, characterized in that, The security token request information also includes a second region identifier, and the security token also includes the second region identifier, which is used to indicate the second region; The second cloud management platform is used to receive a second cloud service access request sent by the client for the cloud service of the second data center, the second cloud service access request carrying the security token; The second cloud management platform is further configured to determine that the second region indicated by the second region identifier included in the security token carried in the second cloud service access request is consistent with the second region where the cloud service of the second data center is located, and to allow the client to access the cloud service of the second data center.

12. The cloud system according to any one of claims 9 to 11, characterized in that, The first cloud management platform is connected to the second cloud management platform, or: The cloud system also includes a central cloud management platform, to which the first cloud management platform and the second cloud management platform are connected, and the central cloud management platform is used to manage the first cloud management platform and the second cloud management platform.

13. A cloud system, characterized in that, It includes a first cloud management platform, a second cloud management platform, a first data center, and a second data center. The first cloud management platform and the first data center are located in a first region, and the second cloud management platform and the second data center are located in a second region. The first cloud management platform is used to manage the cloud services of the first data center, and the second cloud management platform is used to manage the cloud services of the second data center. The first cloud management platform is used to receive security token request information sent by the client. The security token request information includes a first region identifier, which is used to indicate the first region. The first cloud management platform is further configured to send a security token to the client according to the security token request information, wherein the security token includes the first region identifier and a second encryption result obtained by encrypting the first encryption result using the public key of the first cloud management platform, and the first encryption result includes the result obtained by encrypting the first region identifier; The first cloud management platform is also configured to receive a first cloud service access request sent by the client for the cloud service of the first data center. The first cloud service access request carries the first region identifier, the second encryption result and the first signature of the security token. The first signature is encrypted using a first encryption algorithm based on the first encryption result. The first cloud management platform is further configured to determine that the first region indicated by the first region identifier carried in the first cloud service access request is consistent with the first region where the cloud service of the first data center is located, and the first cloud management platform uses the private key of the first cloud management platform to decrypt the second encryption result to obtain the first encryption result, and generates a second signature based on the first encryption result using a second encryption algorithm that is the same as the first encryption algorithm, and determines that the first signature carried in the first cloud service access request is consistent with the second signature, and allows the client to access the cloud service of the first data center.

14. The cloud system according to claim 13, characterized in that, The security token request information does not include any region identifiers other than the first region identifier; The second cloud management platform is used to receive a second cloud service access request sent by the client for the cloud service of the second data center. The second cloud service access request carries the first region identifier, the second encryption result and the first signature. The second cloud management platform is further configured to determine that the first region indicated by the first region identifier carried in the second cloud service access request is inconsistent with the second region where the cloud service of the second data center is located, and to refuse the client's access to the cloud service of the second data center.

15. The cloud system according to claim 13, characterized in that, The security token request information also includes a second region identifier, and the security token also includes a fourth encryption result obtained by encrypting the third encryption result using the public key of the second cloud management platform. The third encryption result includes the result obtained by encrypting the second region identifier, which is used to indicate the second region. The second cloud management platform is used to receive a second cloud service access request sent by the client for the cloud service of the second data center. The second cloud service access request carries the second region identifier, the fourth encryption result, and the third signature of the security token. The third signature is encrypted using a third encryption algorithm based on the third encryption result. The second cloud management platform is further configured to determine that the second region indicated by the second region identifier carried in the second cloud service access request is consistent with the second region where the cloud service of the second data center is located, and the second cloud management platform uses the private key of the second cloud management platform to decrypt the fourth encryption result to obtain the third encryption result, and generates a fourth signature based on the third encryption result using the same fourth encryption algorithm as the third encryption algorithm, and determines that the third signature carried in the second cloud service access request is consistent with the fourth signature, and allows the client to access the cloud service of the second data center.

16. The cloud system according to any one of claims 13 to 15, characterized in that, The first cloud management platform is connected to the second cloud management platform, or: The cloud system also includes a central cloud management platform, to which the first cloud management platform and the second cloud management platform are connected, and the central cloud management platform is used to manage the first cloud management platform and the second cloud management platform.

17. A computing device cluster, characterized in that, It includes at least one computing device, each computing device including a processor and memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the cluster of computing devices to perform the method as described in any one of claims 1 to 4, or to cause the cluster of computing devices to perform the method as described in any one of claims 5 to 8.

18. A computer program product containing instructions, characterized in that, When the instruction is executed by the computing device cluster, it causes the computing device cluster to perform the method as described in any one of claims 1 to 4, or causes the computing device cluster to perform the method as described in any one of claims 5 to 8.

19. A computer-readable storage medium, characterized in that, Includes computer program instructions that, when executed by a cluster of computing devices, cause the cluster of computing devices to perform the method as described in any one of claims 1 to 4, or cause the cluster of computing devices to perform the method as described in any one of claims 5 to 8.

Images