Access control method, access credential generation method, and access control system

Abstract

One or more embodiments of the present disclosure provide an access control method, an access credential generation method, and an access control system, capable of being applied to a cloud platform. Specifically, an internal trusted network range of a platform corresponding to a target account can be acquired to generate an address whitelist for the target account; and an access credential is generated for the target account on the basis of the address whitelist. A cloud platform gateway receives an access request sent by the target account, and then extracts the address whitelist of the target account from the access credential carried in the access request; and in response to a source address of the access request not matching the address whitelist, the cloud platform gateway determines that the access request does not pass address authentication, and intercepts the access request. The solution can effectively prevent an attacker from accessing a cloud platform via an unauthorized network after the leakage of an access credential, thereby improving the security of the cloud platform, and achieving platform-level access credential security management.

Description

Access control methods, access credential generation methods, and access control systems Technical Field

[0001] This disclosure relates to the field of cloud technology, and more particularly to an access control method, an access credential generation method, and an access control system. Background Technology

[0002] An account is the basic identity credential for accessing and using the cloud platform. Each account is associated with specific permissions and resources, enabling users to deploy, manage, and access resources based on their account permissions.

[0003] Currently, accounts typically use AK (Access Key) as the core credential for accessing cloud platforms. However, AKs are at risk of being leaked. If an attacker steals an AK, they may launch an attack on the cloud platform, posing a significant security risk to it. Summary of the Invention

[0004] In view of the above, one or more embodiments of this disclosure provide the following technical solutions.

[0005] According to a first aspect of one or more embodiments of this disclosure, an access control method is proposed, applied to a cloud platform gateway, comprising: receiving an access request sent by a target account, the access request carrying access credentials; extracting an address whitelist of the target account from the access credentials, the address whitelist being used to record a trusted network range corresponding to the target account; obtaining the source address of the access request; and, in response to the source address not matching the address whitelist, determining that the access request has failed address authentication, and intercepting the access request.

[0006] According to a second aspect of one or more embodiments of this disclosure, an access credential generation method is proposed, applied to an access control unit deployed in a cloud platform, comprising: obtaining a trusted network range corresponding to a target account, generating an address whitelist for the target account; generating access credentials for the target account based on the address whitelist, so that the target account can initiate an access request based on the access credentials, wherein the cloud platform gateway performs access control on the access request based on the aforementioned access control method.

[0007] According to a third aspect of one or more embodiments of this disclosure, an access control system is provided, applied to a cloud platform, wherein a cloud platform gateway and an access control unit are deployed in the cloud platform, wherein the access control unit is configured to obtain a trusted network range corresponding to a target account, generate an address whitelist for the target account, and generate access credentials for the target account based on the address whitelist; the cloud platform gateway is configured to receive an access request sent by the target account, the access request carrying the access credentials; extract the address whitelist of the target account from the access credentials; obtain the source address of the access request; and, in response to the source address not matching the address whitelist, determine that the access request has failed address authentication and intercept the access request.

[0008] According to a fourth aspect of one or more embodiments of the present disclosure, an electronic device is provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor performs the executable instructions to implement the steps of the method as described in the first or second aspect above.

[0009] According to a fifth aspect of one or more embodiments of the present disclosure, a computer-readable storage medium is provided that stores computer instructions thereon, which, when executed by a processor, implement the steps of the method as described in the first or second aspect above.

[0010] According to a sixth aspect of one or more embodiments of the present disclosure, a computer program product is provided, including a computer program / instructions that, when executed by a processor, implement the steps of the method as described in the first or second aspect above.

[0011] As can be seen from the above embodiments, after receiving an access request from a target account, the cloud platform gateway of this disclosure can extract the address whitelist from the access credentials carried in the access request. If it is determined that the source address of the access request does not match the address whitelist, it can be concluded that the network initiating the access request is not within the trusted network range, and thus the access request can be intercepted.

[0012] Therefore, this disclosure adds the address whitelist of the target account to the target account's access credentials. This allows the cloud platform gateway to extract the address whitelist from the whitelist when it receives an access request carrying the access credentials. The gateway then performs address authentication on the access request based on the source address of the access request and the address whitelist. If the address authentication fails, the access request will still be blocked even if it can be authenticated by the key pair. This effectively prevents attackers from using unauthorized networks to access the cloud platform after the access credentials are leaked, thereby improving the security of the cloud platform. Attached Figure Description

[0013] Figure 1 is a schematic diagram of the architecture of an access control system provided in an exemplary embodiment.

[0014] Figure 2 is a flowchart of an access control method provided in an exemplary embodiment.

[0015] Figure 3 is a flowchart of an access credential generation method provided in an exemplary embodiment.

[0016] Figure 4 is a flowchart of another access credential generation method provided in an exemplary embodiment.

[0017] Figure 5 is a schematic diagram of an access credential generation method provided in an exemplary embodiment.

[0018] Figure 6 is a flowchart of another access control method provided in an exemplary embodiment.

[0019] Figure 7 is a schematic diagram of the structure of a device provided in an exemplary embodiment.

[0020] Figure 8 is a block diagram of an access control device provided in an exemplary embodiment.

[0021] Figure 9 is a block diagram of an access credential generation apparatus provided in an exemplary embodiment. Detailed Implementation

[0022] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data shall comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points shall be provided for users to choose to authorize or refuse.

[0023] An account is the basic identity credential for accessing and using the cloud platform. Each account is associated with specific permissions and resources, enabling users to deploy, manage, and access resources based on their account permissions.

[0024] Currently, accounts typically use AKs as the core credentials for accessing cloud platforms. However, AKs are at risk of being leaked. After stealing an AK, attackers may launch attacks on the cloud platform, posing a significant security risk to it.

[0025] For example, developers may overlook the sensitivity of AK, especially if they hardcode it into the code for convenience during development. Once the code is made public, the AK will be exposed.

[0026] For example, attackers might try to steal an AK through phishing, exploiting software vulnerabilities, or credential stuffing attacks.

[0027] To address the aforementioned issues, this disclosure provides an access control and access credential generation scheme that can add the trusted network range corresponding to an account to the account's access credentials. When an account accesses a cloud platform, the cloud platform gateway performs address authentication on the source address used by the account based on the trusted network address range in the access credentials. This can effectively avoid the security risks caused by unauthorized use of the account by attackers after the access credentials are leaked.

[0028] This disclosure will now describe the solution in detail with reference to specific embodiments.

[0029] Figure 1 is a schematic diagram of the architecture of an access control system provided in an exemplary embodiment. As shown in Figure 1, the system may include an electronic device 11, an access control unit 12, a cloud platform gateway 13, and a cloud platform backend server 14.

[0030] Electronic device 11 can be a PC (Personal Computer), mobile phone, tablet device, laptop computer, PDA (Personal Digital Assistants), wearable device (such as smart glasses, smartwatch, etc.), etc. In some scenarios, electronic device 11 can also be a physical server. One or more embodiments disclosed herein do not limit this.

[0031] During operation, the electronic device can run client-side programs provided by the cloud platform to access the cloud platform. These client-side applications can be launched and run on the electronic device. These client-side programs can be native applications installed on the electronic device, or they can be mini-programs, quick apps, or other similar forms. Alternatively, when using web technologies such as HTML5, the relevant functions can be achieved through a browser-displayed page. This browser can be a standalone browser application or a browser module embedded in some applications.

[0032] Access control unit 12 is typically a service provided by a cloud platform to help users manage identity and access permissions. For example, it can generate and issue access credentials for registered accounts, which can then be added to access requests for authentication when accessing the cloud platform. Access control unit 12 can be a physical server, or it can be a virtual machine, container, or other carrier.

[0033] The cloud platform gateway 13 is a key component in the cloud platform architecture, providing various functions to ensure the efficient, secure, and stable operation of cloud services. For example, the cloud platform gateway 13 can implement security policies such as access control. For instance, after receiving an access request from electronic device 11, the cloud platform gateway 13 can authenticate the access request based on the access credentials carried in the request. If authentication is successful, the access request can be sent to the cloud platform backend server 14; if authentication fails, the cloud platform gateway 13 can intercept the access request. The cloud platform gateway 13 can be a physical server, or it can be a virtual machine, container, or other carrier.

[0034] The cloud platform backend server 14 can be a physical server containing an independent host, or it can be a virtual server hosted by a host cluster. During operation, the cloud platform backend server 14 can provide various cloud services to logged-in accounts.

[0035] As for the network for interaction between electronic device 11 and access control unit 12, electronic device 11 and cloud platform gateway 13, and cloud platform gateway 13 and cloud platform backend server 14, the communication can be implemented using wired or wireless networks based on the communication methods supported by the corresponding devices. This disclosure does not impose any restrictions on this.

[0036] Figure 2 is a flowchart of an access control method provided in an exemplary embodiment.

[0037] Please refer to Figure 2. The access control method provided in this embodiment can be applied to cloud platform gateways, such as the core gateway of a cloud platform, and includes the following steps.

[0038] Step 202: Receive an access request sent by the target account, wherein the access request carries access credentials.

[0039] In this embodiment, the target account is usually an account that has been registered in the cloud platform. Specifically, it can be a tenant account or a non-tenant account, such as a service account, resource account, or operation and maintenance account used to manage and operate the cloud platform.

[0040] In this embodiment, when the target account sends an access request, it typically includes an access credential for authentication, which includes an access key AK. Of course, in actual implementation, the access request may also include a signature, which is usually obtained by encrypting the request content using an SK (Secret Access Key). The processing and implementation of this part can be found in related technologies, and will not be elaborated upon here.

[0041] Step 204: Extract the address whitelist of the target account from the access credentials. The address whitelist is used to record the trusted network range corresponding to the target account.

[0042] Based on the aforementioned step 202, after receiving the access request, the cloud platform gateway can extract the address whitelist of the target account from the access credentials carried in the access request in order to perform address authentication on the access request.

[0043] The address whitelist can be pre-added to the AK (Access Detector) to record the trusted network range corresponding to the target account. This whitelist may include the underlying network address within the cloud platform and the VPC (Virtual Private Cloud) network address. The address whitelist can be added by the cloud platform's access control unit when generating the AK; the specific generation scheme will be described in detail in subsequent embodiments.

[0044] Step 206: Obtain the source address of the access request.

[0045] In this embodiment, after receiving the access request, the cloud platform gateway can also obtain the source address of the access request from the access request. The source address is usually the original IP address when the access request was initiated.

[0046] It is worth noting that the action of obtaining the source address in this step can be performed after step 204, before step 204 extracting the address whitelist, or in parallel with step 204 extracting the address whitelist. Step 206 does not restrict the execution order of the source address extraction action.

[0047] Step 208: In response to the source address not being matched in the address whitelist, it is determined that the access request has failed address authentication, and the access request is blocked.

[0048] In this embodiment, it can be determined whether the source address matches the address whitelist extracted in step 204. If the source address does not match the address whitelist, it indicates that the network initiating the access request is not within the trusted network range, and thus it can be determined that the access request has not passed address authentication. In this case, regardless of whether the access request has passed key pair authentication, the access request can be directly intercepted.

[0049] If the source address matches the address whitelist, it indicates that the network initiating the access request belongs to the trusted network range. Therefore, access control can be performed on the access request based on the key pair authentication result of the access request, which is compatible with the original key pair authentication process and realizes joint authentication of address authentication and key pair authentication.

[0050] The key pair authentication process may include: finding the SK corresponding to the AK in the access request, then encrypting the request content using the SK, and determining whether the encryption result matches the signature carried in the access request. If they match, the access request is determined to have passed key pair authentication; if they do not match, the access request is determined to have failed key pair authentication.

[0051] In this embodiment, if the access request is authenticated via address, and also via key pair authentication, the access request can be forwarded to the cloud platform backend server. If the access request is not authenticated via key pair authentication, even if it has been authenticated via address, the access request must be intercepted.

[0052] As can be seen from the above description, after receiving an access request from a target account, the cloud platform gateway of this disclosure can extract the address whitelist from the access credentials carried in the access request. If it is determined that the source address of the access request does not match the address whitelist, it indicates that the network initiating the access request is not within the trusted network range, and thus the access request can be intercepted.

[0053] Therefore, this disclosure adds the address whitelist of the target account to the target account's access credentials. This allows the cloud platform gateway to extract the address whitelist from the whitelist when it receives an access request carrying the access credentials. The gateway then performs address authentication on the access request based on the source address of the access request and the address whitelist. If the address authentication fails, the access request will still be blocked even if it can be authenticated by the key pair. This effectively prevents attackers from using unauthorized networks to access the cloud platform after the access credentials are leaked, thereby improving the security of the cloud platform.

[0054] This disclosure also provides an access credential generation scheme that can be applied to an access control unit deployed in a cloud platform. The access control unit can be an IAM service (Identity and Access Management) deployed in the cloud platform, and its physical carrier can be a server or a server cluster.

[0055] Figure 3 is a flowchart of an access credential generation method provided in an exemplary embodiment.

[0056] Please refer to Figure 3. The access credential generation method may include the following steps.

[0057] Step 302: Obtain the trusted network range corresponding to the target account, and generate an address whitelist for the target account.

[0058] In this embodiment, the trusted network range may include the underlying network address within the cloud platform and the VPC network address.

[0059] The underlying network addresses within the cloud platform are typically used by the platform's internal infrastructure services. These addresses can be planned and configured during the cloud platform deployment phase and are usually private network addresses, ensuring security and reliability. During subsequent operation of the cloud platform, additional underlying network addresses can be added as needed.

[0060] A VPC network address is a network address for a Virtual Private Cloud. When obtaining the VPC network address corresponding to a target account, you can first query the VPC identifier (e.g., VPC ID) of the VPC to which the target account belongs based on the VPC service, and then obtain the VPC network address corresponding to the target account based on the VPC identifier. The VPC network address can be configured through operation and maintenance methods.

[0061] In this embodiment, after obtaining the underlying network address and VPC network address within the cloud platform, a corresponding address whitelist can be generated.

[0062] It should be noted that the address concepts such as "internal underlying network address of cloud platform" and "VPC network address" described in this disclosure can be exact network addresses or address ranges. Similarly, the addresses recorded in the address whitelist can include exact network addresses or network address ranges, and this disclosure does not impose any special restrictions on this.

[0063] Step 304: Generate access credentials for the target account based on the address whitelist, so that the target account can initiate an access request based on the access credentials.

[0064] Based on the aforementioned step 302, after generating the address whitelist, the address whitelist can be added to all AKs of the target account to generate access credentials for the target account, and the access credentials can be sent to the target account for address authentication when the target account accesses the cloud platform.

[0065] The address authentication process can be referred to in the embodiment shown in Figure 2 above. The cloud platform gateway determines whether the source address of the access request matches the aforementioned address whitelist. If it does not match, it can be determined that the address authentication has failed. If the source address of the access request matches the aforementioned address whitelist, it can be determined that the address authentication has passed.

[0066] As can be seen from the above description, this disclosure adds the address whitelist of the target account to the access credentials of the target account. This allows the cloud platform gateway to extract the address whitelist from the target account's access request after receiving the access request carrying the access credentials. The gateway can then perform address authentication on the access request based on the address whitelist. If the address authentication fails, the access request will be blocked. This effectively prevents attackers from using unauthorized networks to access the cloud platform after the access credentials are leaked, thereby improving the security of the cloud platform.

[0067] The specific implementation of this disclosure will be described in detail below from two aspects: access credential generation and access control. I. Access Credential Generation

[0068] In this embodiment, for newly registered accounts, access credentials can be generated and issued after successful registration, serving as the basis for subsequent access to the cloud platform. For existing accounts, access credentials can be regenerated and issued when they are updated.

[0069] The timing of access credential updates includes: when the AK is rotated regularly, when the AK is detected to be leaked, or when an audit finds a high security risk. The processing and implementation of this part can be referred to relevant technologies, and will not be elaborated on in this disclosure.

[0070] Figure 4 is a flowchart of another access credential generation method provided in an exemplary embodiment, and Figure 5 is a schematic diagram of an access credential generation method provided in an exemplary embodiment.

[0071] Please refer to Figures 4 and 5. The access credential generation method described in this embodiment can be applied to access control units deployed in a cloud platform and may include the following steps.

[0072] Step 402: Query the account type of the target account in the account center.

[0073] In this embodiment, the target account is an account that needs to be issued access credentials, such as the newly registered account mentioned above, or an account that needs to update its access credentials.

[0074] In this embodiment, before generating access credentials for the target account, it can be determined whether the target account is a critical account. For example, the account type of the target account can be queried in the Account and Authentication Service (AAS). The account type can include critical accounts and non-critical accounts.

[0075] The account type can be marked in the following two ways.

[0076] For new accounts, after the new account is created, it can be determined whether the new account is a key account. If the new account is determined to be a key account, its type can be marked as a key account.

[0077] Specifically, new account creation events in the account center can be monitored, such as database changes. If a new account is detected, the VPC service on the cloud platform can be used to query whether the new account is used by a VPC network. If so, the VPC service can return the VPC identifier to which the new account belongs. Then, the corresponding VPC declaration can be queried based on the VPC identifier, and it can be determined whether the new account is declared as a critical account in the VPC declaration. If it is declared as a critical account, its account type can be marked as a critical account. If it is not declared as a critical account, its account type can be marked as a non-critical account, or no marking can be applied to its account type.

[0078] In practical implementation, the VPC declaration can be extended by adding a trust flag and key accounts to the VPC declaration, in addition to VPC name, VPC interface, and other VPC information. The trust flag indicates whether the VPC is a trusted VPC; generally, only trusted VPCs are allowed to have key accounts configured. If the trust flag in the VPC declaration is "yes," key accounts can be added, such as adding the account name. The number of key accounts added to the VPC declaration can be one or more. If the trust flag in the VPC declaration is "no," it means that the VPC is not a trusted VPC, and correspondingly, no key accounts are configured. The trust flag and key accounts can be added in key-value pairs; this disclosure does not impose any special restrictions on this.

[0079] When configuring a VPC declaration, for a trusted VPC, you can configure all its accounts as critical accounts, or you can configure only some accounts with higher access permissions as critical accounts, because if these accounts with higher access permissions are stolen by attackers, they will pose a greater security risk to the cloud platform.

[0080] For accounts already created in the account center, the accounts maintained in the account center can be periodically traversed, and accounts with specified attributes can be marked as critical accounts. These accounts with specified attributes are typically those with higher access permissions, such as operations and maintenance accounts, resource accounts, and service accounts.

[0081] Step 404: If the target account is a critical account, obtain the trusted network range corresponding to the target account and generate an address whitelist for the target account.

[0082] Step 406: Generate access credentials for the target account based on the address whitelist, so that the target account can initiate an access request based on the access credentials.

[0083] Based on the query results of step 402 above, if the target account is a critical account, the trusted network range corresponding to the target account can be obtained to generate an address whitelist for it.

[0084] On the one hand, the underlying network address within the cloud platform can be obtained as a trusted internal network range. This internal network address is typically planned and configured during the cloud platform deployment phase, and is a private network address, ensuring security and reliability. The obtained internal network address is the same for different target accounts.

[0085] On the other hand, it's possible to obtain the VPC network address of the target account's VPC. VPC network addresses are typically configured during the design phase and are generally secure and reliable. For example, the corresponding VPC network address can be obtained based on the VPC identifier.

[0086] Specifically, the entire network address of the VPC network can be used as the trusted VPC network range to generate an address whitelist, or a portion of the addresses in the entire VPC network can be used as the trusted VPC network range to generate an address whitelist. For the same VPC, different trusted VPC network ranges can be configured for different key accounts under it, thereby achieving fine-grained management.

[0087] In this embodiment, after obtaining the trusted network range corresponding to the target account, a corresponding address whitelist can be generated. Each network address in the address whitelist is usually marked with a corresponding network type, that is, each network address will be marked as an internal underlying network address of the cloud platform or a VPC network address. For VPC network addresses, the corresponding VPC identifier can be added to the address whitelist as well.

[0088] Optionally, if all network addresses of the VPC network are trusted VPC networks, you can simply record the VPC identifier in the address whitelist without adding the corresponding VPC network address.

[0089] In this embodiment, the address whitelist can be added to all AKs of the target account to generate access credentials for the target account. The generated access credentials can be sent to the target account so that the target account can carry them and perform address authentication when accessing the cloud platform in the future.

[0090] As described above, this embodiment can generate an address whitelist only for key accounts and add it to the access credentials of these key accounts. Subsequently, when key accounts access the cloud platform, they will carry these access credentials for address authentication by the cloud platform gateway. This embodiment only issues access credentials with the address whitelist to key accounts, eliminating the need to issue such credentials to all cloud platform accounts, thus achieving a balance between cloud platform processing load and security. Specifically, generating an address whitelist only for key accounts reduces the processing load on the cloud platform, such as saving resources for generating the whitelist and reducing the pressure on the gateway for address authentication. Furthermore, it ensures that if the access credentials of key accounts are leaked, attackers using unauthorized networks to access the cloud platform can be identified and blocked by the cloud platform network, thereby ensuring secure access for key accounts with high access privileges and improving the security of the cloud platform. II. Access Control

[0091] Figure 6 is a flowchart of another access control method provided in an exemplary embodiment.

[0092] Please refer to Figure 6. The access control method described can be applied to a cloud platform gateway and includes the following steps.

[0093] Step 602: Receive an access request sent by the target account, wherein the access request carries access credentials.

[0094] In this embodiment, the cloud platform gateway can receive access requests from the target account forwarded by the SLB (Server Load Balancer) device. Of course, in other examples, if the SLB function is not used, the SLB device can be omitted for load balancing of access requests.

[0095] Step 604: Extract the address whitelist of the target account from the access credentials.

[0096] Based on step 602 above, upon receiving the access request, it can be first determined whether the access credentials include an address whitelist. For example, it can be determined whether the AK carries an address whitelist.

[0097] If the access credentials include an address whitelist, it means that the access request needs to be authenticated by address. The address whitelist can be obtained, and subsequent steps can be performed.

[0098] If the access credentials do not include an address whitelist, it means that address authentication is not required for the access request. Key pair authentication can be performed on the access request with reference to relevant technologies, and access control can be performed on the access request based on the key pair authentication result.

[0099] Step 606: Determine whether the access request carries a VPC identifier.

[0100] In this embodiment, for access requests carrying an address whitelist, it can be determined whether the access request carries a VPC identifier, such as a VPC ID.

[0101] Step 608: If the access request carries a VPC identifier, then determine whether the source address of the access request matches a VPC network address in the address whitelist.

[0102] Based on the judgment result of step 606 above, if the access request carries a VPC identifier, it can be indicated that this access belongs to VPC access. It can be determined whether the source address of the access request matches the VPC network address in the address whitelist. If it matches, it can be indicated that this access comes from a trusted VPC network, and step 612 can be executed.

[0103] If the source address of the access request does not match the VPC network address in the address whitelist, it indicates that the access is not from a trusted VPC network, and step 614 can be executed. It should be noted that when determining whether a VPC network address matches, it is usually necessary to compare whether the VPC identifier carried in the access request is the same as the VPC identifier in the address whitelist. If they are different, it indicates that the access request comes from an untrusted VPC, and the access request can be directly blocked. If they are the same, the determination of whether the source address matches the VPC network address can continue. In actual implementation, if the access request carries a VPC identifier, it can first be determined whether the VPC identifier carried in the access request is the same as the VPC identifier in the address whitelist, and if they are the same, the determination of whether the source address matches can be performed.

[0104] In other examples, if the address whitelist does not record the VPC network address corresponding to the VPC identifier, it means that the entire VPC network corresponding to the VPC identifier is a trusted network. If the VPC identifier carried by the access request is the same as the VPC identifier in the address whitelist, it can be said that the access comes from a trusted VPC network, and step 612 can be executed without having to determine whether the source address is hit.

[0105] Step 610: If the access request does not carry a VPC identifier, determine whether the source address of the access request matches the underlying network address of the cloud platform in the address whitelist.

[0106] Based on the judgment result of step 606 above, if the access request does not carry a VPC identifier, it can be concluded that this access does not belong to VPC access, and it can be determined whether the source address of the access request matches the underlying network address of the cloud platform in the address whitelist.

[0107] If the source address matches the underlying network address inside the platform, it indicates that the access originated from the underlying network inside the cloud platform, which is secure and reliable, and step 612 can be executed.

[0108] If the source address does not match the underlying network address within the platform, it indicates that the access is not from a trusted network, and step 614 can be executed.

[0109] Step 612: If the match is successful, it is determined that the access request has passed address authentication, and access control is performed on the access request based on the authentication result of the key pair of the access request.

[0110] In this step, if the source address of the access request matches the address whitelist, regardless of the situation, it indicates that the access request originates from a trusted network. This confirms that the access request has passed address authentication, and access control can be implemented based on the key pair authentication result of the access request. For example, if key pair authentication succeeds, the access request can be forwarded to the backend server; if key pair authentication fails, the access request can be intercepted.

[0111] Step 614: If the access request fails to pass address authentication, the access request is blocked.

[0112] In this step, if the source address of the access request does not match the address whitelist, it indicates that the access request is not from a trusted network. To ensure the security of the cloud platform, the access request can be directly intercepted regardless of whether it can be authenticated by the key pair.

[0113] In this process, key pair authentication can be performed in parallel with address authentication, or key pair authentication can be performed first and then address authentication can be performed, or address authentication can be performed first and key pair authentication can be performed if address authentication is successful. This disclosure does not impose any special restrictions on this.

[0114] It should be noted that in this embodiment, if an SLB device is deployed, the transmission of the access request source address and VPC identifier can be achieved by deploying the PPV2 (Proxy Protocol Version 2) protocol. The processing and implementation of this part can be referred to relevant technologies, and will not be described in detail here.

[0115] As can be seen from the above description, this disclosure adds the address whitelist of the target account to the access credentials of the target account. This allows the cloud platform gateway to extract the address whitelist from the whitelist after receiving an access request carrying the access credentials. The gateway then performs address authentication on the access request based on the source address of the access request and the address whitelist. If the address authentication fails, the access request will still be blocked even if it can be authenticated by the key pair. This effectively prevents attackers from using unauthorized networks to access the cloud platform after the access credentials are leaked, thereby improving the security of the cloud platform.

[0116] Figure 7 is a schematic structural diagram of a device provided in an exemplary embodiment. Referring to Figure 7, at the hardware level, the device includes a processor 702, an internal bus 704, a network interface 706, a memory 708, and a non-volatile memory 710, and may also include other hardware required for its functions. One or more embodiments of this disclosure can be implemented in software, for example, the processor 702 reads the corresponding computer program from the non-volatile memory 710 into the memory 708 and then runs it. Of course, in addition to software implementation, one or more embodiments of this disclosure do not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0117] Please refer to Figure 8. The access control device 800 can be applied to the device shown in Figure 7 to implement the technical solution of this disclosure. The access control device 800 may include: a request receiving module 802, which receives an access request sent by a target account, the access request carrying access credentials; an address extraction module 804, which extracts an address whitelist of the target account from the access credentials, the address whitelist being used to record the trusted network range corresponding to the target account; an address judgment module 806, which obtains the source address of the access request; and an address authentication module 808, which, in response to the source address not matching the address whitelist, determines that the access request has failed address authentication and intercepts the access request.

[0118] Optionally, the address authentication module 808, in response to the source address matching the address whitelist, determines that the access request has passed address authentication, and performs access control on the access request based on the key pair authentication result of the access request.

[0119] Optionally, the address whitelist includes VPC network addresses and underlying network addresses within the cloud platform. The process of determining that the access request has failed address authentication in response to the source address not matching the address whitelist includes: if the access request carries a VPC identifier, determining that the access request has failed address authentication in response to the source address not matching the VPC network address in the address whitelist; if the access request does not carry the VPC identifier, determining that the access request has failed address authentication in response to the source address not matching the underlying network address within the cloud platform in the address whitelist.

[0120] Optionally, the address whitelist records the VPC identifier to which the VPC network address belongs. The address authentication module 808, when the access request carries a VPC identifier, compares the VPC identifier carried in the access request with the VPC identifier recorded in the address whitelist; if the VPC identifier carried in the access request is the same as the VPC identifier recorded in the address whitelist, it executes the step of determining that the access request has failed address authentication in response to the source address not matching the VPC network address in the address whitelist.

[0121] Optionally, if the address authentication module 808 determines that the access credentials do not include the address whitelist, it performs access control on the access request based on the key pair authentication result of the access request.

[0122] Referring to Figure 9, the access credential generation device 900 can also be applied to the device shown in Figure 7 to implement the technical solution of this disclosure. The access credential generation device 900 may include: a list generation module 902, which obtains the trusted network range corresponding to the target account and generates an address whitelist for the target account; and a credential generation module 904, which generates access credentials for the target account based on the address whitelist, so that the target account can initiate an access request based on the access credentials. The cloud platform gateway performs access control on the access request based on the aforementioned access control method of this disclosure.

[0123] Optionally, the device 900 further includes: an account determination module 906, used to query the account type of the target account in the account center; and when the account type of the target account is a critical account, the list generation module 902 performs the step of obtaining the trusted network range corresponding to the target account.

[0124] Optionally, the process of marking account types in the account center includes: listening to new account creation events in the account center; in response to the creation of a new account, querying the VPC declaration corresponding to the VPC to which the new account belongs; and in response to the new account being declared as a key account in the VPC declaration, marking the account type of the new account as a key account.

[0125] Optionally, the process of marking account types in the account center includes: traversing the account center and marking the account type of an account with a specified attribute in the account center as a key account.

[0126] Optionally, the process of obtaining the trusted network range corresponding to the target account includes: obtaining the underlying network address inside the cloud platform as the trusted network range corresponding to the target account.

[0127] Optionally, the process of obtaining the trusted network range corresponding to the target account includes: querying the VPC declaration corresponding to the VPC to which the target account belongs, so as to obtain the pre-declared VPC network address from the VPC declaration as the trusted network range corresponding to the target account.

[0128] Based on the same concept as the methods described above, this disclosure also provides an electronic device, including: a processor; a memory for storing processor-executable instructions; wherein the processor executes the executable instructions to implement the steps of the method as described in any of the above embodiments.

[0129] Based on the same concept as the methods described above, this disclosure also provides a computer-readable storage medium having computer instructions stored thereon that, when executed by a processor, implement the steps of the methods as described in any of the above embodiments.

[0130] Based on the same concept as the methods described above, this disclosure also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the methods as described in any of the above embodiments.

Claims

1. An access control method applied to a cloud platform gateway, comprising: Receive an access request sent by the target account, wherein the access request carries access credentials; The address whitelist of the target account is extracted from the access credentials, and the address whitelist is used to record the trusted network range corresponding to the target account; Obtain the source address of the access request; In response to the source address not being matched in the address whitelist, it is determined that the access request has failed address authentication, and the access request is blocked.

2. The method according to claim 1, further comprising: In response to the source address matching the address whitelist, it is determined that the access request has passed address authentication, and access control is performed on the access request based on the key pair authentication result of the access request.

3. The method according to claim 1, wherein the address whitelist includes Virtual Private Cloud (VPC) network addresses and underlying network addresses within the cloud platform, and the process of determining that the access request has failed address authentication in response to the source address not matching the address whitelist includes: If the access request carries a VPC identifier, and the source address does not match the VPC network address in the address whitelist, it is determined that the access request has failed address authentication. If the access request does not carry the VPC identifier, in response to the source address not matching the underlying network address of the cloud platform in the address whitelist, it is determined that the access request has failed address authentication.

4. The method according to claim 3, wherein the address whitelist records the VPC identifier to which the VPC network address belongs, and the method further includes: If the access request carries a VPC identifier, compare the VPC identifier carried in the access request with the VPC identifier recorded in the address whitelist; If the VPC identifier carried in the access request is the same as the VPC identifier recorded in the address whitelist, the step of determining that the access request has failed address authentication is executed in response to the source address not matching the VPC network address in the address whitelist.

5. The method according to any one of claims 1-4, further comprising: If the access credentials do not include the address whitelist, then access control is applied to the access request based on the key pair authentication result of the access request.

6. An access credential generation method, applied to an access control unit deployed in a cloud platform, comprising: Obtain the trusted network range corresponding to the target account, and generate an address whitelist for the target account; Based on the address whitelist, access credentials are generated for the target account, so that the target account can initiate an access request based on the access credentials, wherein the cloud platform gateway performs access control on the access request based on the access control method of any one of claims 1-5.

7. The method according to claim 6, further comprising: In the account center, query the account type of the target account; If the target account is a critical account, the step of obtaining the trusted network range corresponding to the target account is performed.

8. The method according to claim 7, wherein the account type marking process in the account center includes: Listen for new account creation events in the account center; In response to the creation of a new account, query the VPC declaration corresponding to the VPC to which the new account belongs; In response to the new account being declared as a critical account in the VPC declaration, the account type of the new account is marked as a critical account.

9. The method according to claim 7, wherein the account type marking process in the account center includes: Iterate through the account center and mark the account type of accounts with specified attributes as key accounts.

10. The method according to claim 6, wherein the process of obtaining the trusted network range corresponding to the target account includes: Obtain the underlying network address within the cloud platform as the trusted network range corresponding to the target account.

11. The method according to claim 6, wherein the process of obtaining the trusted network range corresponding to the target account includes: Query the VPC identifier of the VPC to which the target account belongs; The corresponding VPC network address is obtained based on the VPC identifier and used as the trusted network range corresponding to the target account.

12. An access control system applied to a cloud platform, wherein a cloud platform gateway and an access control unit are deployed in the cloud platform, wherein, The access control unit is used to obtain the trusted network range corresponding to the target account, generate an address whitelist for the target account, and generate access credentials for the target account based on the address whitelist. The cloud platform gateway is used to receive access requests sent by the target account, the access requests carrying the access credentials; and to extract the address whitelist of the target account from the access credentials. Obtain the source address of the access request; In response to the source address not being matched in the address whitelist, it is determined that the access request has failed address authentication, and the access request is blocked.

13. An electronic device, comprising: processor; Memory for storing processor-executable instructions; wherein the processor performs operations by executing the executable instructions: Receive an access request sent by the target account, wherein the access request carries access credentials; The address whitelist of the target account is extracted from the access credentials, and the address whitelist is used to record the trusted network range corresponding to the target account; Obtain the source address of the access request; In response to the source address not being matched in the address whitelist, it is determined that the access request has failed address authentication, and the access request is blocked.

14. The electronic device of claim 13, further comprising: In response to the source address matching the address whitelist, it is determined that the access request has passed address authentication, and access control is performed on the access request based on the key pair authentication result of the access request.

15. The electronic device according to claim 13, wherein the address whitelist includes Virtual Private Cloud (VPC) network addresses and underlying network addresses within the cloud platform, and the process of determining that the access request has failed address authentication in response to the source address not matching the address whitelist includes: If the access request carries a VPC identifier, and the source address does not match the VPC network address in the address whitelist, it is determined that the access request has failed address authentication. If the access request does not carry the VPC identifier, in response to the source address not matching the underlying network address of the cloud platform in the address whitelist, it is determined that the access request has failed address authentication.

16. The electronic device according to claim 15, wherein the address whitelist records the VPC identifier to which the VPC network address belongs, and the operation further includes: If the access request carries a VPC identifier, compare the VPC identifier carried in the access request with the VPC identifier recorded in the address whitelist; If the VPC identifier carried in the access request is the same as the VPC identifier recorded in the address whitelist, the step of determining that the access request has failed address authentication is executed in response to the source address not matching the VPC network address in the address whitelist.

17. The electronic device according to any one of claims 13-16, wherein the operation further comprises: If the access credentials do not include the address whitelist, then access control is applied to the access request based on the key pair authentication result of the access request.

18. An electronic device comprising: processor; Memory for storing processor-executable instructions; wherein the processor performs operations by executing the executable instructions: Obtain the trusted network range corresponding to the target account, and generate an address whitelist for the target account; Based on the address whitelist, access credentials are generated for the target account, so that the target account can initiate an access request based on the access credentials, wherein the cloud platform gateway performs access control on the access request based on the access control method of any one of claims 1-5.

19. A computer-readable storage medium having stored thereon computer instructions that, when executed by a processor, implement the steps of the method as claimed in any one of claims 1-11.

20. A computer program product comprising a computer program / instructions that, when executed by a processor, implement the steps of the method as claimed in any one of claims 1-11.

Images