Access control method based on cloud computing technology, and cloud system

Abstract

Provided in the present application are an access control method based on cloud computing technology, and a cloud system. The cloud system comprises a cloud management platform and at least one cloud service, wherein the cloud management platform is used for managing a cloud data center, the cloud data center comprises a plurality of servers, and the plurality of servers are used for providing resources for the at least one cloud service. The method comprises: a first cloud service among at least one cloud service receiving a first access request, which is input by a user, wherein the first access request is used for making a request to execute a first operation on the first cloud service; in response to the first access request, the first cloud service sending a first authentication request to a cloud management platform; in response to the first authentication request, the cloud management platform authenticating the first access request, so as to determine that a user does not have permission to execute the first operation on the first cloud service; and the cloud management platform displaying first information by means of a user interface, so as to indicate a reason for which the user does not have permission to execute the first operation on the first cloud service. The technical solution can provide more effective assistance for a user to solve the permission problem.

Description

Access control methods and cloud systems based on cloud computing technology

[0001] This application claims priority to Chinese Patent Application No. 202510125991.4, filed on January 26, 2025, entitled "Access Control Method and Cloud System Based on Cloud Computing Technology", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of cloud computing, and more specifically, to an access control method and cloud system based on cloud computing technology. Background Technology

[0003] Cloud service providers typically use unified identity and access management (IAM) services to authenticate and manage user traffic access behavior. Compared to traditional role-based access control (RBAC), attribute-based access control (ABAC) provides IAM service policies with more global and service-defined conditional attributes. This allows tenants to control permissions based on various attributes such as subject, session, and request attributes, thus providing IAM services with more flexible and fine-grained access control capabilities.

[0004] However, the flexible and fine-grained access control capabilities come with increased system complexity and a greater difficulty and learning curve for ordinary users to utilize IAM services. Specifically, because ABAC provides more diverse conditions for IAM service policies, when a user's access request is denied by the IAM service based on a certain policy, the feedback information received by the user may not be able to effectively help the user resolve the permission issue.

[0005] Therefore, how to provide effective guidance to users when their access requests are denied has become a pressing technical problem that needs to be solved. Summary of the Invention

[0006] This application provides an access control method and cloud system based on cloud computing technology, which can display the specific reason why the access request is not authorized in the feedback information of the access request, thereby providing effective help to users to solve permission problems and improving user experience.

[0007] Firstly, an access control method based on cloud computing technology is provided. This method is applied to a cloud system, which includes a cloud management platform and at least one cloud service. The cloud management platform manages a cloud data center, which includes multiple servers, and the multiple services provide resources to the at least one cloud service. The method includes: a first cloud service receiving a first access request input by a user, the first access request requesting to perform a first operation on the first cloud service; the first cloud service responding to the first access request sending a first authentication request to the cloud management platform; the cloud management platform authenticating the first access request in response to the first authentication request to determine that the user does not have permission to perform the first operation on the first cloud service; and the cloud management platform displaying first information through a user interface, the first information indicating the reason why the user does not have permission to perform the first operation on the first cloud service.

[0008] According to the technical solution provided in this application, by displaying the reasons why the access request was not authorized, users can obtain clear guidance on resolving permission issues based on the obtained response information, thereby improving the efficiency of problem-solving. Furthermore, this solution presents guidance on resolving permission issues to users in an intuitive way, thus shielding them from the internal complexity of the system, reducing the impact of system complexity on user experience, and improving overall user experience.

[0009] In conjunction with the first aspect, in some implementations of the first aspect, the cloud management platform determines, based on the first policy, that the user does not have permission to perform the first operation on the first cloud service. The first information includes first sub-information, and the first sub-information indicates the annotation of the first policy through natural language.

[0010] According to the above technical solution, the policy annotation information that denies the user's access request can be displayed to the user in natural language, which makes it easier for the user to understand the reason for the lack of permission, thereby improving the location efficiency and user experience.

[0011] In conjunction with the first aspect, in some implementations of the first aspect, the first sub-information includes the purpose of the first strategy and / or the solution when the first strategy takes effect.

[0012] According to the above technical solution, the annotation information of the strategy displayed to the user may include the purpose of the strategy and / or the solution of the strategy.

[0013] In conjunction with the first aspect, in some implementations of the first aspect, the first strategy includes at least one annotation field, the value of which is first sub-information. The cloud management platform responds to the first authentication request by authenticating the first access request, including: the cloud management platform determining, according to the first strategy, that the user does not have permission to perform the first operation on the first cloud service; the cloud management platform obtaining the first sub-information according to at least one annotation field in the first strategy; and the cloud management platform sending the first sub-information to the first cloud service.

[0014] According to the above technical solution, the annotation information that needs to be displayed to the user can be pre-configured in the corresponding policy file, so that when the cloud management platform rejects the user's access request according to the policy, it can directly obtain the annotation information that needs to be displayed from the policy file, thereby improving the feedback efficiency.

[0015] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: the cloud management platform receiving a policy creation request input by a tenant, the policy creation request including first sub-information; and the cloud management platform generating a first policy in response to the policy creation request.

[0016] According to the above technical solution, when an administrator (the tenant or a user granted management privileges by the tenant) creates a policy, they can annotate the policy using natural language, so that the cloud management platform can display the annotation information that the administrator wants to display to the tenant when there is no permission to respond.

[0017] In conjunction with the first aspect, in some implementations of the first aspect, the cloud management platform determines, based on the second policy, that the user does not have permission to perform the first operation on the first cloud service. The first information includes the second sub-information, which indicates the conditions under which the second policy takes effect through natural language.

[0018] According to the above technical solution, the effective conditions of the policy that denies the user's access request can be displayed to the user through natural language, thereby reducing the difficulty of understanding the user caused by the complexity of fine-grained policy syntax, and improving the positioning efficiency and user experience.

[0019] In conjunction with the first aspect, in some implementations of the first aspect, the second strategy includes at least one condition field, which includes a condition key, an operator, and a condition value. The second sub-information includes a first part, a second part, and a third part, wherein the first part is generated based on the condition key, the second part is generated based on the operator, and the third part is generated based on the condition value.

[0020] Based on the above technical solution, the semantics of the condition fields in the strategy file can be translated into natural language.

[0021] In conjunction with the first aspect, in certain implementations of the first aspect, the cloud management platform authenticates the first access request in response to the first authentication request, including: the cloud management platform determining, according to the second policy, that the user does not have permission to perform the first operation on the first cloud service; the cloud management platform determining the first part based on the mapping relationship between condition keys and natural language; the cloud management platform determining the second part based on the mapping relationship between operators and natural language; the cloud management platform determining the third part based on the condition value, the third part including the condition value; the cloud management platform generating second sub-information based on the first part, the second part, and the third part; and the cloud management platform sending the second sub-information to the first cloud service.

[0022] According to the above technical solution, the mapping relationship between condition keys and operators and the display information of natural language can be predefined, thereby mapping the code in the policy file to the associated natural language through the mapping method, which can improve the parsing and translation efficiency of the policy file.

[0023] In conjunction with the first aspect, in some implementations of the first aspect, at least one condition field includes multiple condition values, and a third part is determined based on the condition values, including: determining the logical relationship between the multiple condition values ​​based on operators; and determining the third part based on the logical relationship and the multiple condition values, wherein the third part includes the multiple condition values ​​and the logical relationship expressed in natural language.

[0024] Based on the above technical solution, the content of multiple condition values ​​can be displayed more clearly through natural language.

[0025] In conjunction with the first aspect, in some implementations of the first aspect, at least one cloud service further includes a second cloud service, the first operation includes a first sub-operation performed on the first cloud service and a second sub-operation performed on the second cloud service, and the first information includes third sub-information, which is used to indicate that the user does not have permission to perform the second sub-operation on the second cloud service.

[0026] According to the above technical solution, when an access request depends on multiple services, the user can be shown which of the multiple services the access request was denied because it lacks access permission, thereby improving location efficiency and user experience.

[0027] In conjunction with the first aspect, in certain implementations of the first aspect, the cloud management platform authenticates the first access request in response to the first authentication request, including: the cloud management platform sending a first response message to the first cloud service, the first response message indicating that the user has permission to perform a first sub-operation on the first cloud service; the first cloud service sending a second access request to the second cloud service in response to the first response message, the second access request requesting to perform a second sub-operation on the second cloud service; the second cloud service sending a second authentication request to the cloud management platform in response to the second access request; the cloud management platform sending a second response message to the second cloud service in response to the second authentication request, the second response message indicating that the user does not have permission to perform a second sub-operation on the second cloud service; the second cloud service sending a third response message to the first cloud service, the third response message indicating that the user does not have permission to perform a second sub-operation on the second cloud service; and the first cloud service generating third sub-information based on the third response message, the third sub-information including the third response message.

[0028] According to the above technical solution, each service will include feedback information received from other services when generating feedback information, thereby ensuring that unauthorized response information is not lost during multiple service forwarding calls.

[0029] In conjunction with the first aspect, in some implementations of the first aspect, the third response information is also used to indicate the reason why the user does not have permission to perform the second sub-operation on the second cloud service, and the third sub-information is used to indicate the reason why the user does not have permission to perform the second sub-operation on the second cloud service.

[0030] Based on the above technical solution, users can be further shown the specific reasons why they do not have permission to access a particular service among the multiple services they depend on, thereby providing clearer guidance for users to resolve the permission issue.

[0031] Secondly, a cloud system is provided, comprising a cloud management platform and at least one cloud service. The cloud management platform manages a cloud data center, which includes multiple servers, and the multiple services provide resources for the at least one cloud service. The cloud system includes: a first cloud service for receiving a first access request input by a user, the first access request requesting to perform a first operation on the first cloud service; the first cloud service further for sending a first authentication request to the cloud management platform in response to the first access request; the cloud management platform for authenticating the first access request in response to the first authentication request to determine that the user does not have permission to perform the first operation on the first cloud service; and the cloud management platform further for displaying first information through a user interface, the first information indicating the reason why the user does not have permission to perform the first operation on the first cloud service.

[0032] In conjunction with the second aspect, in some implementations of the second aspect, the cloud management platform determines, based on the first policy, that the user does not have permission to perform the first operation on the first cloud service. The first information includes first sub-information, and the first sub-information indicates the annotation of the first policy through natural language.

[0033] In conjunction with the second aspect, in some implementations of the second aspect, the first sub-information includes the purpose of the first strategy and / or the solution when the first strategy takes effect.

[0034] In conjunction with the second aspect, in some implementations of the second aspect, the first strategy includes at least one annotation field, the value of which is first sub-information. The cloud management platform is used to: determine, according to the first strategy, that the user does not have permission to perform the first operation on the first cloud service; obtain the first sub-information according to at least one annotation field in the first strategy; and send the first sub-information to the first cloud service.

[0035] In conjunction with the second aspect, in some implementations of the second aspect, the cloud management platform is also used to: receive a policy creation request input by a tenant, the policy creation request including first sub-information; and generate a first policy in response to the policy creation request.

[0036] In conjunction with the second aspect, in some implementations of the second aspect, the cloud management platform determines, based on the second policy, that the user does not have permission to perform the first operation on the first cloud service. The first information includes the second sub-information, which indicates the conditions under which the second policy takes effect through natural language.

[0037] In conjunction with the second aspect, in some implementations of the second aspect, the second strategy includes at least one condition field, which includes a condition key, an operator, and a condition value. The second sub-information includes a first part, a second part, and a third part, wherein the first part is generated based on the condition key, the second part is generated based on the operator, and the third part is generated based on the condition value.

[0038] In conjunction with the second aspect, in some implementations of the second aspect, the cloud management platform is used to: determine, according to the second policy, that the user does not have permission to perform the first operation on the first cloud service; determine the first part according to the mapping relationship between the condition key and natural language; determine the second part according to the mapping relationship between the operator and natural language; determine the third part according to the condition value, the third part including the condition value; generate the second sub-information according to the first part, the second part and the third part; and send the second sub-information to the first cloud service.

[0039] In conjunction with the second aspect, in some implementations of the second aspect, at least one condition field includes multiple condition values, and the cloud management platform is used to: determine the logical relationship between the multiple condition values ​​based on the operator; and determine a third part based on the logical relationship and the multiple condition values, wherein the third part includes the multiple condition values ​​and the logical relationship expressed in natural language.

[0040] In conjunction with the second aspect, in some implementations of the second aspect, at least one cloud service further includes a second cloud service, the first operation includes a first sub-operation performed on the first cloud service and a second sub-operation performed on the second cloud service, and the first information includes third sub-information, which is used to indicate that the user does not have permission to perform the second sub-operation on the second cloud service.

[0041] In conjunction with the second aspect, in certain implementations of the second aspect, the cloud management platform is used to: send a first response message to a first cloud service, the first response message indicating that the user has permission to perform a first sub-operation on the first cloud service; the first cloud service is used to: respond to the first response message by sending a second access request to a second cloud service, the second access request requesting to perform a second sub-operation on the second cloud service; the second cloud service is used to: respond to the second access request by sending a second authentication request to the cloud management platform; the cloud management platform is also used to: respond to the second authentication request by sending a second response message to the second cloud service, the second response message indicating that the user does not have permission to perform a second sub-operation on the second cloud service; the second cloud service is also used to: send a third response message to the first cloud service, the third response message indicating that the user does not have permission to perform a second sub-operation on the second cloud service; the first cloud service is also used to: generate third sub-information based on the third response message, the third sub-information including the third response message.

[0042] In conjunction with the second aspect, in some implementations of the second aspect, the third response information is also used to indicate the reason why the user does not have permission to perform the second sub-operation on the second cloud service. The third sub-information is used to indicate the reason why the user does not have permission to perform the second sub-operation on the second cloud service.

[0043] Thirdly, a computing device is provided, including a processor and a memory, wherein the memory is used to store instructions, and the processor is used to call and execute the instructions from the memory, causing the computing device to perform the method of the first aspect or any possible implementation thereof.

[0044] Fourthly, a computing device cluster is provided, including at least one computing device, each computing device including a processor and a memory, wherein the memory is used to store instructions, and the processor is used to call and execute the instructions from the memory, causing the computing device cluster to perform the method in the first aspect or any possible implementation of the first aspect.

[0045] Optionally, the processor can be a general-purpose processor, which can be implemented in hardware or software. When implemented in hardware, the processor can be a logic circuit, integrated circuit, etc.; when implemented in software, the processor can be a general-purpose processor that reads software code stored in memory, which can be integrated into the processor or exist independently outside the processor.

[0046] Fifthly, a chip is provided that acquires and executes instructions to implement the method in the first aspect or any possible implementation of the first aspect.

[0047] Optionally, as one implementation, the chip includes a processor and a data interface, through which the processor reads instructions stored in the memory and executes the method in the first aspect or any possible implementation of the first aspect.

[0048] Optionally, as one implementation, the chip may further include a memory storing instructions, and the processor is used to execute the instructions stored in the memory. When the instructions are executed, the processor is used to perform the method in the first aspect or any possible implementation of the first aspect.

[0049] In a sixth aspect, a computer program product containing instructions is provided, which, when executed by a computing device or a cluster of computing devices, causes the computing device or the cluster of computing devices to perform the method described in the first aspect or any possible implementation thereof.

[0050] In a seventh aspect, a computer-readable storage medium is provided, including computer program instructions that, when executed by a computing device or a cluster of computing devices, cause the computing device or the cluster of computing devices to perform the method described in the first aspect or any possible implementation thereof.

[0051] As examples, these computer-readable storage media include, but are not limited to, one or more of the following: read-only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), flash memory, electrically EPROM (EEPROM), and hard drive.

[0052] Alternatively, as one implementation method, the aforementioned storage medium can specifically be a non-volatile storage medium. Attached Figure Description

[0053] Figure 1 is a schematic diagram of the structure of an IAM strategy provided in an embodiment of this application.

[0054] Figure 2 is a schematic diagram of a conditional operation logic provided in an embodiment of this application.

[0055] Figure 3 is a schematic diagram of an IAM strategy.

[0056] Figure 4 is a schematic diagram of a service call chain.

[0057] Figure 5 is a schematic diagram of a cloud system provided in an embodiment of this application.

[0058] Figure 6 is a schematic diagram of the system architecture of an embodiment of this application.

[0059] Figure 7 is a schematic flowchart of an access control method provided in an embodiment of this application.

[0060] Figure 8 is a schematic diagram of an IAM strategy provided in an embodiment of this application.

[0061] Figure 9 is a schematic diagram of the structure of a PDP provided in an embodiment of this application.

[0062] Figure 10 is a schematic diagram of the structure of a PAP provided in an embodiment of this application.

[0063] Figure 11 is a schematic diagram of another PDP provided in an embodiment of this application.

[0064] Figure 12 is a schematic diagram of a service call chain provided in an embodiment of this application.

[0065] Figure 13 is a schematic flowchart of another access control method provided in an embodiment of this application.

[0066] Figure 14 is a schematic flowchart of another access control method provided in an embodiment of this application.

[0067] Figure 15 is a schematic structural block diagram of a cloud system provided in an embodiment of this application.

[0068] Figure 16 is a schematic structural block diagram of a computing device provided in an embodiment of this application.

[0069] Figure 17 is a schematic structural block diagram of a computing device cluster provided in an embodiment of this application.

[0070] Figure 18 is a schematic structural block diagram of another computing device cluster provided in an embodiment of this application. Detailed Implementation

[0071] The technical solutions in this application will now be described with reference to the accompanying drawings.

[0072] This application will present various aspects, embodiments, or features relating to systems comprising multiple devices, components, modules, etc. It should be understood and appreciated that individual systems may include additional devices, components, modules, etc., and / or may not include all devices, components, modules, etc. discussed in conjunction with the accompanying drawings. Furthermore, combinations of these approaches are also possible.

[0073] Furthermore, in the embodiments of this application, the words "exemplary," "for example," etc., are used to indicate that they are examples, illustrations, or descriptions. Any embodiment or design scheme described as "exemplary" in this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the term "exemplary" is intended to present the concept in a concrete manner.

[0074] In the embodiments of this application, "corresponding" and "corresponding" can sometimes be used interchangeably. It should be noted that when the distinction is not emphasized, their intended meanings are consistent.

[0075] The network architecture and business scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0076] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0077] In this application, "at least one" means one or more, and "more than one" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A alone, A and B simultaneously, and B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0078] To better illustrate the solutions of the embodiments of this application, the terms that may be involved in the embodiments of this application are explained below.

[0079] 1. Unified identity and access management (IAM).

[0080] IAM is a security service that provides access control, authentication, and permissions management. Tenants can use IAM to create and manage users, authorize or deny their access to resources, improve account and resource security by setting permission policies, and provide a variety of secure access credentials.

[0081] In this context, "resources" refers to the resources related to the technical services provided by cloud service providers to tenants via the internet, based on their needs. These resources include computing power, storage capacity, and databases, and can be simply referred to as cloud resources. Cloud service providers offer cloud service resources to tenants via the internet, allowing tenants to manage and use the technical services provided by the providers without having to purchase, own, or maintain physical data centers and servers.

[0082] A tenant refers to an organization or individual that rents cloud service resources from a cloud service provider. This organization or individual has the ability to use and manage the rented cloud service resources, such as authorizing users (such as users within the organization or other users) to use some or all of the cloud service resources as needed. A user refers to an organization or individual that accesses cloud service resources. Users can include the tenant itself, or other organizations or individuals that the tenant grants access to the cloud service resources to.

[0083] 2. Attribute-based access control (ABAC).

[0084] ABAC defines an IAM access control model that determines whether a subject's operation is authorized by evaluating the subject, resource, requested operation, and the attributes associated with the current environment.

[0085] The method for determining whether an access request is authorized based on the ABAC access control model is to translate the access request into a set of input attributes, then query the access control policies set by the administrator (the cloud service tenant itself or a user created by the tenant with management privileges), and calculate the access control evaluation result of the input attribute set according to the policy evaluation logic. The result can include allowing or denying the access request.

[0086] Furthermore, access requests can be denied in two ways: implicit denial and explicit denial. Implicit denial indicates that the access request has not been explicitly authorized by the administrator, while explicit denial indicates that the access request is explicitly restricted by the administrator.

[0087] 3. Access strategy language.

[0088] Access policy language specifically describes the access control policies expected by administrators and users (for IAM services, access control policies can also be called IAM policies). It is a collection of policy permission statements used to express possible access behaviors and indicate the expected results of access behaviors.

[0089] Taking IAM policy as an example, Figure 1 shows a schematic diagram of the structure of an IAM policy. For instance, an IAM policy may include a policy version number and policy permission statements, where there may be one or more policy permission statements to represent different authorization items. Each policy permission statement may include, but is not limited to, one or more of the following elements:

[0090] Effect: Indicates the effective result of this policy permission statement, including either "allow" or "deny". If multiple policy permission statements have conflicting effects, "deny" takes precedence over "allow".

[0091] Action: Indicates the specific action involved in the access request for which the policy permission statement takes effect.

[0092] Resource: Indicates the resource involved in the access request for which this policy permission statement takes effect.

[0093] Condition: This indicates the conditions under which the policy permission statement takes effect. A condition can specifically include a condition key and a condition value, and may also include operators. The condition key represents the name of the variable involved in the condition. The condition value and operator restrict the value and / or range of values ​​for which the condition takes effect. For example, in numerical operations, operators can include: equal (NumberEquals), not equal (NumberNotEquals), less than (NumberLessThan), less than or equal to (NumberLessThanEquals), greater than (NumberGreaterThan), and greater than or equal to (NumberGreaterThanEquals). Furthermore, for conditions with multiple condition values, the set of condition values ​​can be restricted by adding prefixes before the operators. For example, adding the prefix "ForAllValues" before an operator indicates that the condition key needs to satisfy every single condition value for the condition to take effect; adding the prefix "ForAnyValue" before an operator indicates that the condition key needs to satisfy at least one condition value for the condition to take effect.

[0094] Each policy permission statement can include one or more conditions. For policy permission statements with multiple conditions, the operation logic is as shown in Figure 2. For multiple condition values ​​of the same condition key, the "or" operation logic is used, meaning the variable corresponding to the condition key returns "true" if it matches any one of the condition values ​​according to the condition operator. If the operator is a negation operator (e.g., "not equal"), the "and" operation logic is used, meaning the variable corresponding to the condition key returns "true" only if it matches all the condition values ​​according to the condition operator. The "and" operation logic is used between different condition keys under the same operator, and also between different operators; that is, the condition only takes effect if each condition key returns "true".

[0095] Based on the structure of the IAM policy described above, Figure 3 shows a schematic diagram of an IAM policy. According to the example of the IAM policy shown in Figure 3, the meaning is: when a request is made for an image of type Linux in an Elastic Cloud Server (ECS), the access request to create an ECS cloud server will be rejected.

[0096] For ease of explanation, the IAM policy examples in the following embodiments will all follow the above structure. However, it should be understood that the access policy language applicable to the technical solution of this application is not limited to this. The IAM policy mentioned in the technical solution of this application can also have any other structure, as long as it can appropriately and correctly express the possible access behaviors and the expected results of the access behaviors. Furthermore, the service used to implement the access control of this application is not limited to IAM services, that is, the access policy can be other policies besides IAM policies, including but not limited to service control policies, virtual private cloud (VPC) end-node policies, etc., which can correspondingly have different access policy language structures.

[0097] 4. Application Programming Interface (API).

[0098] APIs enable data exchange and function calls between different systems, services, and / or devices, greatly facilitating cross-platform and cross-system integration and interaction. As the core mechanism for communication between systems, services, and / or devices, the quality of their response design directly affects the efficiency and accuracy of data exchange. To ensure that API responses can effectively convey information, the following key points should be fully considered.

[0099] First, structured design of response data is the cornerstone of information transmission. Using standardized formats, such as JavaScript Object Notation (JSON), ensures data clarity and consistency, facilitating parsing and use by the caller. The response should include necessary fields, such as the data body, status code, and error message, to guarantee the integrity and accuracy of the information, enabling the caller to obtain the required information accurately and effectively utilize the data.

[0100] Secondly, the explicit use of Hypertext Transfer Protocol (HTTP) status codes is crucial. Status codes provide direct feedback on the outcome of request processing. For example, a 200 status code indicates a successful request, 400 series status codes indicate client-side errors, and 500 series status codes indicate server-side errors. Correctly using status codes clearly conveys the request's processing result, helping the caller understand the response's meaning, perform appropriate follow-up actions, and improve problem-solving efficiency.

[0101] Furthermore, when an API request encounters an error, the response should include detailed error information, including but not limited to the error code, error description, and possible solutions. This not only helps the caller quickly locate the problem but also provides guidance on fixing the error, ensuring timely resolution and improving system stability and user experience.

[0102] Furthermore, version control of response data is an indispensable part of API design. As the API iterates and upgrades, the structure and content of the response data may change. Labeling response data with version numbers or dates ensures backward compatibility, allowing callers to choose the appropriate API version based on their needs, achieving a smooth transition and avoiding compatibility issues caused by version updates.

[0103] Finally, the scalability of response data is crucial for adapting to evolving business needs. As business requirements change, API response data may require the addition of new fields or adjustments to the structure of existing fields. Therefore, API design should possess strong scalability, allowing for flexible addition or modification of the response data structure without impacting existing callers. This ensures the API can continuously meet the needs of business development, enhancing the system's flexibility and adaptability.

[0104] As a service provided by cloud service providers to authenticate and authorize user traffic access behavior, the IAM service ultimately presents the relevant information to the user. Therefore, a well-designed API response is equally important. Compared to traditional RBAC, ABAC provides more global conditional attributes and service-custom conditional attributes for IAM service policies. This allows tenants to control permissions based on various attributes such as subject attributes, session attributes, and request attributes, thus providing IAM service with more flexible and fine-grained access control capabilities. Taking the IAM policy shown in Figure 3 as an example, administrators (the tenant themselves or users granted administrative privileges by the tenant) can add access control policies to certain attributes of ECS access requests to determine fine-grained user permissions. Furthermore, the IAM service also provides more diverse policy types, including, but not limited to, resource-based policies and organization-based service control policies, in addition to basic identity policies.

[0105] However, the flexible and fine-grained access control capabilities come with increased system complexity and a greater difficulty and learning curve for ordinary users when using IAM services. A specific problem arising from this increased system complexity is that when a user's access request to a service is denied due to insufficient permissions, the information contained in the response may not help the user resolve the permission issue. For example, when a user's access to an API is denied due to IAM authentication, the response message might read: "The user does not have sufficient permissions. Please contact the corresponding administrator to grant you the necessary permissions." More specifically, the user might also receive the following information regarding this request:

[0106] Principal: Refers to the identity information assigned by the IAM service to the user who sent this access request;

[0107] Access execution action: refers to the authorization item information in IAM abstraction for the operation requested by the user in this access request;

[0108] Accessed resource: refers to the resource information of the service requested by the user in this access request in the IAM abstraction;

[0109] Policy type: refers to the type of policy that causes the user's access request to be denied, including but not limited to identity policy, resource policy, etc.

[0110] Based on the above information, when an access request is implicitly denied, the response message received by the user might be: "Because no policy of ${policy_type} allows this access to execute operation ${action}, the principal ${principal} does not have permission to access and execute operation ${action} on resource ${resource}." When an access request is explicitly denied, the response message received by the user might be: "Because policy of ${policy_type} explicitly denies this access to execute operation ${action}, the principal ${principal} does not have permission to access and execute operation ${action} on resource ${resource}." In the actual display, ${policy_type} will be replaced with the specific policy type of the policy that denies this access request, ${action} will be replaced with the specific access operation requested, ${principal} will be replaced with the specific principal of this access request, and ${resource} will be replaced with the specific resource to be accessed in this access request.

[0111] Regardless of the type of response information mentioned above, they are all relatively technical for users and require a certain learning curve. Because ABAC provides more diverse conditions for IAM service policies, when a user's access request is rejected by the IAM service based on a certain policy, the user may not be able to understand why their access request was rejected based on the received feedback information. Therefore, the feedback information cannot effectively help the user seek assistance and / or resolve permission issues.

[0112] Furthermore, user access requests may rely on multiple services to complete. A user initiates an access request to a service, and the receiving service needs to make complex calls between multiple services to execute the request. This makes it more difficult for the user to understand why the access request was denied in the response information, because the user cannot obtain the authentication response information from the backend chain of the directly accessed service. As an example, Figure 4 illustrates a service call chain. As shown in Figure 4, a user requests service A to perform an access operation, which actually depends on an access operation to service B. Completing the access operation to service B requires the participation of ECS (Elastic Compute Service), for example, service B will create an ECS cloud server for the tenant. In the chain shown in Figure 4, since the user's access request to service A actually involves three services, service A, service B, and the ECS all need to initiate authentication requests to the policy decision point (PDP) after receiving the access request. As shown in Figure 4, the user has access permissions to service A and service B, but lacks ECS-related permissions. Therefore, when service B calls the ECS API to request the creation of a user's ECS cloud server, it will receive a request rejection response. However, this information is very easy to lose in the call chain. If even one service in the chain encapsulates the authentication rejection response, the user will not be able to obtain specific permission information when receiving the permission failure prompt. In this case, the user can only know from the received response that service A ultimately rejected its access request, but cannot pinpoint that the access request was rejected because the user does not have permission to access the ECS.

[0113] In view of this, embodiments of this application provide an access control method based on cloud computing technology, which can display the specific reason why the access request is not authorized in the feedback information of the access request, thereby providing effective assistance to users in resolving permission issues and improving user experience.

[0114] The access control method provided in this application embodiment can be applied to a cloud system, which may include a cloud management platform and one or more cloud services. Figure 5 shows a schematic diagram of the cloud system provided in this application embodiment. As shown in Figure 5, the cloud management platform 510 is used to manage the cloud data center 530, which may include multiple servers. The servers in the cloud data center 530 may include cloud service resources (hereinafter referred to as "resources"), used to provide tenants with one or more of the aforementioned cloud services (not shown in Figure 5).

[0115] The cloud management platform 510 provides access interfaces (such as a console or application program interface, API). Tenants can use client 520 to remotely access the access interface to register a cloud account and password on the cloud management platform and log in to the cloud management platform 510. After the cloud management platform 510 successfully authenticates the cloud account and password, the tenant can further pay to select and purchase virtual machines of specific specifications (processor, memory, disk) on the cloud management platform. After successful payment and purchase, the cloud management platform 510 provides the remote login account and password for the purchased virtual machine. Client 520 can remotely log in to the virtual machine and manage it.

[0116] Cloud service tenants can include, but are not limited to, individuals, businesses, schools, hospitals, and government agencies.

[0117] The cloud management platform 510 can also provide tenants with other access control services, including but not limited to user consoles, compute management services, network management services, storage management services, authentication services, and image management services. The user console provides an interface or API for interaction with tenants; the compute management service manages servers running virtual machines and containers, as well as bare metal servers; the network management service manages network services (such as gateways and firewalls); the storage management service manages storage services (such as data bucket services); the authentication service manages tenant account passwords; and the image management service manages virtual machine images. This application does not specifically limit these services.

[0118] The cloud management platform 510 can also provide IAM services to tenants. Optionally, the IAM service can be implemented by policy administration points (PAPs) and policy decision points (PDPs) deployed in the cloud data center 530 (not shown in Figure 5). The PAP can be used to receive IAM policy generation requests from tenants and generate corresponding IAM policies in response to these requests. The PAP can also interact with storage-related cloud services (such as object storage service (OBS)) to store and / or retrieve generated IAM policies. Furthermore, the PAP can be used to provide the corresponding IAM policies to the PDP when the PDP authenticates access requests.

[0119] PDP can be used to receive and respond to authentication requests for access, and authenticate the access request according to the IAM policy in the response, thereby allowing or denying the access request. The authentication request may include at least one or more of the following three types of attributes: identity attributes, environment attributes, and resource attributes. PDP can authenticate the access request based on these attributes. Furthermore, PDP can interact with storage services and / or storage devices used to store system data to obtain system data, and combine this system data with the authentication of the access request. For simplicity, the term "database" is used below to refer to the aforementioned storage services and / or storage devices used to store system data; however, it should be understood that the technical solution of this application is not limited to this, and other storage services and / or storage devices, such as OBS buckets, can also be used to store system data.

[0120] Optionally, the PAP and PDP can be distributed across multiple servers in the cloud data center 530, or centrally configured on one of the servers in the cloud data center 530.

[0121] The authentication request received by the PDP can be initiated by a cloud service within the cloud system. In scenarios where a cloud service initiates an authentication request to the PDP, this cloud service can also be referred to as a policy enforcement point (PEP). Upon receiving an access request, the PEP can collect one or more of the aforementioned identity attributes, environment attributes, and resource attributes, and then initiate an authentication request to the PDP. After receiving the authentication response from the PDP, the PEP performs subsequent operations based on the result of the authentication response: if the authentication response is a denial, it sends a response to the initiator of the access request (the user or the preceding cloud service on the call chain); if the authentication response is an allowance and there are no subsequent dependent cloud services on the call chain, it executes the access request; if the authentication response is an allowance and there are subsequent dependent cloud services on the call chain, it sends the corresponding access request to that dependent cloud service.

[0122] Figure 6 shows a schematic diagram of the system architecture of an embodiment of this application.

[0123] The architecture shown in Figure 6 can be applied to the cloud system shown in Figure 5. Optionally, PAP 610 and PDP 620 shown in Figure 6 can be components of the cloud management platform 510 shown in Figure 5. Specifically, PAP 610 and PDP 620 can be components of the IAM services provided by the cloud management platform 510. Optionally, PEP 630 shown in Figure 6 can be one or more cloud services deployed on multiple servers in the cloud data center 530 in the system shown in Figure 5.

[0124] Administrators (the tenant themselves or users granted administrative privileges by the tenant) can create and manage access control policies through PAP 610. Member users can initiate access requests to cloud services through PEP 630. When an access request relies on the collaboration of multiple PEP 630s, the PEP 630 currently receiving the access request can forward the request to the dependent PEP 630s. Each PEP 630 receiving the access request will initiate an authentication request to PDP 620. After receiving the authentication request from PEP 630, PDP 620 can retrieve policies from PAP 610, and optionally retrieve the necessary system data from the database, to authenticate the access request and send the authentication response back to the PEP 630 that initiated the authentication request. PEP 630 performs subsequent operations based on the received authentication response and sends response information to the initiator of the access request (member user or other PEP 630).

[0125] In order to provide effective guidance information to users when their access requests are denied, the technical solution of this application has made the following three improvements based on the system architecture shown in Figure 6.

[0126] Firstly, the syntax of IAM policies has been extended, allowing the addition of new fields to store policy annotation information. Optionally, PDP can be improved to support retrieving annotation information when parsing IAM policies. Optionally, PAP can be improved to support administrators adding this annotation information when creating IAM policies.

[0127] Secondly, the PDP can add the ability to parse the conditions in the IAM strategy into natural language. Optionally, the database used to store system data can be improved accordingly to store the display information corresponding to each condition key.

[0128] Thirdly, a new API authentication error response protocol can be added between PEPs to instruct PEPs to pass through the information according to the new protocol after receiving an authentication response from PDP indicating that the PEP does not have permission.

[0129] The access control method provided in this application will be described in detail below with reference to Figure 7. Optionally, the method shown in Figure 7 can be applied to the cloud system shown in Figure 5. As shown in Figure 7, the method includes the following steps.

[0130] Step S710: The first cloud service receives the first access request input by the user.

[0131] For example, in step S710, a user can log in to the cloud management platform through a client to request access to a cloud service. Specifically, a tenant can enter a first access request to request the execution of a first operation on a first cloud service among one or more cloud services in the cloud system. Optionally, step S710 can be executed by PEP 630. Optionally, the cloud service requested in the first access request can include, but is not limited to, applications, services, microservices, servers, databases, or virtual machines, etc., and this application does not specifically limit this.

[0132] In some possible implementations, the access request entered by the user can also be received by the cloud management platform, which then forwards it to the corresponding cloud service.

[0133] Step S720: The first cloud service responds to the first access request by sending a first authentication request to the cloud management platform.

[0134] For example, in step S720, after receiving the first access request, the first cloud service can request the IAM service provided by the cloud management platform to authenticate the first access request. Specifically, the first cloud service can send a first authentication request to the PDP 620, which can be used to request the PDP 620 to determine whether the user has permission to perform the first operation on the first cloud service.

[0135] Optionally, the first authentication request may include attribute information related to the first access request, including but not limited to identity attributes, environment attributes, and / or resource attributes.

[0136] Step S730: The cloud management platform responds to the first authentication request by authenticating the first access request.

[0137] For example, in step S730, the cloud management platform can respond to the first authentication request initiated by the cloud service for the first access request and authenticate the first access request. Optionally, step S730 can be executed by the IAM service provided by the cloud management platform, for example, by PDP 620 in the IAM service.

[0138] For example, the PDP 620 can request the IAM policy related to the first cloud service accessed in the first access request from the PAP 610, and determine the authentication response based on the IAM policy and the attribute information included in the first authentication request. Optionally, the PDP 620 can also request system data and perform authentication in conjunction with the system data in the first access request.

[0139] The authentication result can include allowing or denying the first access request. Based on the authentication result, the PDP 620 can send the authentication response to the corresponding cloud service.

[0140] If the authentication result is a denial of the first access request, meaning the user is determined to lack permission to perform the first operation on the first cloud service, the authentication response may include the reason why the user lacks permission to perform the first operation on the first cloud service. This reason may include one or more of the following: a comment in natural language on the policy for denying the first access request, the conditions under which the policy for denying the first access request takes effect, expressed in natural language, and / or which of the multiple cloud services involved in the first access request the user lacks permission to access. Optionally, the above three items can be implemented through the three improvements described above, and their specific implementation methods will be introduced later through embodiments, which will not be repeated here.

[0141] Step S740: The cloud management platform displays the first information through the user interface.

[0142] For example, in step S740, after the first cloud service receives the authentication response that the first access request is denied, the cloud management platform provides a visual user interface, on which first information can be displayed. The first information is used to prompt the user that it does not have permission to perform the first operation on the first cloud service.

[0143] In some possible technical solutions, the first information may include natural language annotations of the IAM policy for denying the first access request.

[0144] For example, the PDP 620 might determine based on a first policy that a user does not have permission to perform a first operation on a first cloud service. In this case, the first information might include first sub-information, which uses natural language to indicate a commentary on the first policy. Optionally, the first sub-information might include, but is not limited to, the purpose of the first policy and / or the solution when the first policy takes effect.

[0145] Optionally, the above solution can be implemented by extending the syntax of the IAM policy. The extended IAM policy can include at least one comment field, the value of which can be the comment information that needs to be displayed to the user. As an example, and not a limitation, the at least one comment field can include "description" and / or "solution," where the value of the "description" field can be used to describe the purpose of the authorization policy, and the value of the "solution" field can be used to suggest how to resolve the issue if the authorization policy is denied. Figure 8 shows a schematic diagram of an IAM policy with extended syntax. If a user's access request is denied by the IAM policy shown in Figure 8, the information the user sees on the user interface will include the following: "It is forbidden to specify Linux as the system type of the image when creating an ECS cloud server," and "If you have any questions, please contact the IAM administrator XXX."

[0146] It should be understood that the above "description" and / or "solution" are merely illustrative examples of the annotation fields. The annotation fields may be expanded with other content according to the actual needs of the tenant, and this application does not make any specific limitations on this.

[0147] Optionally, the PDP 620 can be adapted to the above extension. Figure 9 illustrates an embodiment of the PDP 620 provided in this application, whose policy parsing module can adapt to the extended policy language syntax. The PDP 620 shown in Figure 9 can be used to execute the above step S730. For example, in step S730, after determining that the user does not have permission to perform the first operation on the first cloud service according to the first policy, the policy parsing module can obtain the first sub-information, i.e., the natural language annotation information to be displayed to the user, based on the value of at least one annotation field of the first policy, and send the first sub-information to the first cloud service. Optionally, the above steps may not affect the existing authentication logic of the PDP 620.

[0148] Optionally, PAP 610 can also be adapted to the above extensions, thereby supporting administrators in creating IAM policies with at least one annotation field. Figure 10 illustrates an embodiment of PAP 610 provided in this application, whose policy verification module can adapt to the extended policy language syntax. As an example, PAP 610 can receive a policy creation request input by a tenant. The policy creation request may include first sub-information, and PAP 610 can generate a first policy with an annotation field in response to the policy creation request.

[0149] Using the above technical solution, administrators can annotate policies using natural language. Ultimately, when a user receives an access denied response, this annotation information can be obtained, making it easier for the user to understand the reason for the access denied, thus improving location efficiency and user experience.

[0150] In some possible technical solutions, the first information may include the conditions under which the policy of denying the first access request takes effect, expressed in natural language.

[0151] For example, the PDP 620 might determine that a user lacks permission to perform a first operation on a first cloud service based on a second policy. In this case, the first information could include second sub-information, which uses natural language to indicate the conditions under which the second policy takes effect. It should be understood that the second policy can be the same as or a different policy from the first policy. As an example, the second sub-information could include a first part, a second part, and a third part, where the first part could be generated based on the condition key of the condition field in the second policy, the second part could be generated based on the operators (and prefixes) of the condition field in the second policy, and the third part could be generated based on the condition value of the condition field in the second policy.

[0152] Optionally, the above solution can be implemented by adding the ability to parse the conditions in the IAM policy into natural language to the PDP 620. Figure 11 shows an embodiment of the PDP 620 provided in this application, which can add an error response policy parsing module to the calculation response module. The PDP 620 shown in Figure 11 can be used to execute the above step S730. For example, in step S730, after the PDP 620 determines that the user does not have permission to perform the first operation on the first cloud service according to the second policy, the calculation response module can additionally parse the matched policy and perform structured parsing of its "condition" field. The PDP 620 can obtain the condition key, operator (and prefix), and condition value of the "condition" field and map this information accordingly.

[0153] The condition key can be mapped to the natural language display information in the system data. The PDP 620 can determine the first part of the second sub-information based on this mapping. Optionally, the database used to store the system data can also be adapted to add extended fields to describe the display information of the condition key. Figure 11 shows an example of the display information of the extended condition key in the system data. As shown in Figure 11, the system data refers to the condition key named "ecs:OsType", whose corresponding condition value is of type string. The corresponding English display information is "Operating system type of the image in the ECS request", and the corresponding Chinese display information is "Requesting the operating system type of the image in the ECS". Taking the Chinese display information as an example, when the condition key of the matched IAM policy is ecs:OsType, the content displayed in the first part of the second information is: "Requesting the operating system type of the image in the ECS".

[0154] Operators (and prefixes) can have a mapping relationship with predefined natural language operator display information. The PDP 620 can determine the second part of the second sub-information based on this mapping relationship and the operators (and prefixes). Taking numeric operators as an example, the natural language mapping for the operator "NumberEquals" can be "equal to", and the natural language mapping for the operator "NumberNotEquals" can be "not equal to". Optionally, if the operator has a prefix, the prefix can also be mapped to natural language and added before the first part of the second sub-information. For example, the natural language mapping for the prefix "ForAnyValue" can be "any", and the natural language mapping for the prefix "ForAllValues" can be "all". For example, for the combined condition of "ForAnyValue" and "NumberNotEquals", the generated second sub-information could be: "Any XXX is not equal to: YYY", where XXX can be replaced with the natural language display information corresponding to the condition key, and YYY can be replaced with the condition value.

[0155] Condition values ​​can be used as the third part of the second sub-information. For example, in a single-condition-valued condition, the PDP 620 can directly use that condition value as the third part of the second sub-information. As another example, in a multi-condition-valued condition, the third part can include the multiple condition values ​​and the logical relationships between them expressed in natural language. Optionally, these logical relationships can be determined based on operators. As an example, if the condition contains a negation operator (e.g., "NotEquals"), the multiple condition values ​​can be connected using natural language expressing parallel logical relationships such as "and" or "AND"; otherwise, the multiple condition values ​​can be connected using natural language expressing selection logical relationships such as "OR".

[0156] After generating the contents of the first, second, and third parts respectively, the PDP 620 can generate the second sub-information, which is the effective condition in natural language form that needs to be displayed to the user, and send the second sub-information to the first cloud service. As an example, based on the content of the condition field in the IAM policy shown in Figure 8, combined with the system information shown in Figure 11, if the user's access request is rejected by the IAM policy, the information the user sees on the user interface will include the following: "The operating system type of the requested image in the ECS is equal to: Linux".

[0157] With the above technical solution, when a user receives a response message indicating that they do not have permission to access, the semantics of the matched access control policy can be clearly understood, alleviating the difficulty of understanding caused by the complexity of IAM fine-grained policy syntax, and improving the efficiency of location and user experience.

[0158] In some possible technical solutions, the first information may include information indicating which of the multiple cloud services the user does not have permission to access in connection with the first access request.

[0159] For example, the first operation requested by a user to be performed on a first cloud service through a first access request may also depend on a second cloud service among multiple cloud services provided by the cloud system. For instance, the first operation can be broken down into a first sub-operation performed on the first cloud service and a second sub-operation performed on the second cloud service. As an example, the first information may include third sub-information, which indicates that the user does not have permission to perform the second sub-operation on the second cloud service. It should be understood that the first sub-operation may be the same as or different from the first operation, and this application does not specifically limit this.

[0160] Optionally, the above solution can be implemented by adding an API authentication error response protocol between cloud services (i.e., PEPs). As shown in Figure 12, PEP 630 can be adapted to the above protocol, that is, a new API authentication error response protocol is added to PEP 630. In scenarios where a cloud service requests authentication from a PDP, when the cloud service determines that the authentication result is rejected, it can transmit the PDP's authentication response information in its returned API response according to the above protocol. In scenarios where a cloud service forwards a user's access request to a dependent cloud service for cross-service calls, when the cloud service determines that the authentication result is rejected, it can add a field to its returned API response according to the above protocol to integrate the response information sent by the dependent cloud service to that cloud service. Optionally, if the response information sent by the dependent cloud service to this cloud service also integrates response information from other dependent cloud services, then this information is also integrated and retained.

[0161] As an example, after the first cloud service initiates an authentication request for the first sub-operation to the PDP 620, the PDP 620 can send a first response message to the first cloud service, indicating that the user has permission to perform the first sub-operation on the first cloud service. Upon receiving the first response message, the first cloud service can send a second access request to the second cloud service, requesting permission to perform the second sub-operation on the second cloud service. Upon receiving the second access request, the second cloud service can send a second authentication request to the PDP 620. The PDP 620 can respond to the second authentication request by sending a second response message to the second cloud service, indicating that the user does not have permission to perform the second sub-operation on the second cloud service. After receiving the second response message returned by the PDP, the second cloud service can send a third response message to the first cloud service, indicating that the user does not have permission to perform the second sub-operation on the second cloud service. Afterwards, the first cloud service can generate third sub-information to be displayed to the user based on the third response message; the third sub-information includes the entire content of the third response message. Optionally, the third response information may also include the reason why the user does not have permission to perform the second sub-operation on the second cloud service. This reason may include, but is not limited to, one or more of the reasons described in the foregoing embodiments, and will not be elaborated here.

[0162] It should be understood that the first and second cloud services mentioned above are merely illustrative examples. The API authentication response protocol provided in this solution can also be applied to scenarios where two or more services make cross-service calls, such as the scenario shown in Figure 12. In the scenario shown in Figure 12, a user's access request to service A depends on service B, and service A's dependency request to service B depends on ECS. When the user does not have permission to access ECS, ECS will send this information back to service B. The response information that service B sends back to service A includes both the information that access to service B is denied and the information that the user does not have permission to access ECS. Similarly, the response information that service A displays to the user includes both the information that service A's access request is denied and all the response information that service B sends back to service A, that is, the information that service B's access is denied and the information that the user does not have permission to access ECS.

[0163] The above technical solution ensures that unauthorized response information is not lost during multiple service forwarding calls. This allows the user to be shown which of the dependent services lacked access permission specifically because the access request was denied, improving troubleshooting efficiency and user experience.

[0164] The technical solution provided in this application displays the reasons why access requests are unauthorized to users, enabling them to obtain clear guidance on resolving permission issues based on the received response information, thereby improving problem-solving efficiency. Furthermore, this solution presents guidance on resolving permission issues to users in an intuitive way, thus shielding them from the internal complexity of the system, reducing the impact of system complexity on user experience, and improving overall user experience.

[0165] It should be understood that the above-described scheme for displaying the reason why the access request is not authorized to the user can be used alone or in combination. The following description, with reference to Figures 13 and 14, uses two specific embodiments as examples.

[0166] Figure 13 shows a flowchart of an access control method provided in this application. In the scenario shown in Figure 13, the administrator intends to restrict users' access permissions to ECS-related resources.

[0167] Administrators can create and annotate policies through the console. The console forwards the policy creation request to PAP, thereby creating a policy with annotation fields. As an example, the policy content created by the administrator in this embodiment can be as shown in Figure 8.

[0168] When a user sends an access request to an ECS instance to access related resources, the ECS instance can act as a PEP (Programmer's Authentication Point) to request authentication from the PDP (Programmer's Access Point). The PDP retrieves the policy from the PAP (Programmer's Access Point) to calculate the authentication result, which may include policies created by the administrator, as shown in Figure 8. When the authentication result calculated by the PDP according to the policy shown in Figure 8 is explicit denial, the PDP can parse the policy to obtain the annotation information included in its annotation field. Furthermore, the PDP can retrieve system data from the database and parse the conditions for the above policy to take effect based on the system data, thereby calculating and generating a natural language representation of these conditions. The PDP can return the annotation information and the natural language representation of the policy's effective conditions as part of the response information to the ECS instance. The ECS instance can then display information indicating insufficient access permissions to the user based on the response returned by the PDP. As an example, assuming the user requests to perform a cloud service creation operation on resource #C that provides ECS services, the response information displayed to the user may include the following:

[0169] "Because the identity policy explicitly denies this access operation ecs:cloudServers:createServers, under the current conditions, the identity subject XX does not have permission to access and execute the operation ecs:cloudServers:createServers on resource #C; "

[0170] The requested operating system type for the image in the ECS instance is Linux.

[0171] When creating an ECS cloud server, it is prohibited to specify Linux as the system type of the image;

[0172] If you have any questions, please contact IAM administrator XXX.

[0173] Figure 14 shows a flowchart of an access control method provided in this application. In the scenario shown in Figure 14, the administrator still intends to restrict users' access to ECS-related resources. However, this time the user does not directly request access to the ECS, but rather access to ECS-related resources is involved in a subsequent call chain of access service A. In this scenario, when the user's access request is forwarded to the ECS, access will be denied.

[0174] Administrators can create policies and add comments to them via the console, as shown in Figure 13. This step is omitted in Figure 14; please refer to Figure 13 and related explanations for details. As an example, the policy content created by the administrator in this embodiment can also be as shown in Figure 8.

[0175] When a user sends an access request to service A, service A can act as a PEP to request authentication from the PDP. After the PDP obtains the policy from the PAP and determines that the user has permission to perform operation #1 on resource #A related to service A, service A can forward the user's access request to service B. Similarly, after receiving an access request, service B can act as a PEP to request authentication from the PDP. After the PDP obtains the policy from the PAP and determines that the user has permission to perform operation #2 on resource #B related to service B, service B can forward the user's access request to the ECS. After receiving the access request, the ECS acts as a PEP to request authentication from the PDP. The authentication process of the PDP can be referred to the relevant explanation in Figure 13, which will not be repeated here.

[0176] When the authentication result calculated by the PDP according to the policy shown in Figure 8 is explicit denial, the PDP can return the comment information and the natural language representation of the conditions under which the policy takes effect as part of the response information to the ECS. The ECS can determine from the response returned by the PDP that the user does not have permission to access the service, and therefore generate response information based on the response returned by the PDP and return it to service B. Service B can integrate the response returned by the ECS into its own response information and return it to service A. Service A can integrate the response returned by service B into its own response information to display information indicating insufficient access permissions to the user. As an example, the final response information displayed to the user may include the following:

[0177] "Because the identity policy explicitly denies this access operation #1, subject XX does not have permission to access and execute operation #1 on resource #A under the current conditions;

[0178] Because the identity policy explicitly denies this access operation #2, under the current conditions, identity subject XX does not have permission to access and execute operation #2 on resource #B;

[0179] Because the identity policy explicitly denies this access operation ecs:cloudServers:createServers, under the current conditions, the identity subject XX does not have permission to access and execute the operation ecs:cloudServers:createServers on resource #C;

[0180] The requested operating system type for the image in the ECS instance is Linux.

[0181] When creating an ECS cloud server, it is prohibited to specify Linux as the system type of the image;

[0182] If you have any questions, please contact IAM administrator XXX.

[0183] The above description, with reference to Figures 7 to 14, illustrates an embodiment of the access control method provided in this application. The following description, with reference to Figures 15 to 18, illustrates an embodiment of the access control apparatus provided in this application.

[0184] Figure 15 shows a schematic structural diagram of a cloud system 1500 provided in an embodiment of this application. The cloud system may include a cloud management platform and at least one cloud service. The cloud management platform is used to manage a cloud data center, which includes multiple servers, and the multiple services are used to provide resources for at least one cloud service.

[0185] As shown in Figure 15, the cloud system 1500 includes: a transceiver module 1510, an authentication module 1520, and a display module 1530. Optionally, the transceiver module can be deployed on a first cloud service in at least one cloud service within the cloud system. Optionally, the authentication module 1520 and / or the display module 1530 can be deployed on a cloud management platform within the cloud system.

[0186] Specifically, the transceiver module 1510 is used to receive a first access request input by the user, the first access request being used to request the execution of a first operation on the first cloud service.

[0187] Specifically, the transceiver module 1510 is also used to send a first authentication request to the cloud management platform in response to the first access request.

[0188] Specifically, the authentication module 1520 is used to authenticate the first access request in response to the first authentication request, so as to determine that the user does not have permission to perform the first operation on the first cloud service.

[0189] Specifically, the display module 1530 is used to display first information through a user interface, the first information being used to indicate the reason why the user does not have permission to perform the first operation on the first cloud service.

[0190] Optionally, the cloud management platform determines that the user does not have permission to perform the first operation on the first cloud service according to the first policy. The first information includes the first sub-information, and the first sub-information indicates the annotation of the first policy through natural language.

[0191] Optionally, the first sub-information includes the purpose of the first strategy and / or the solution when the first strategy takes effect.

[0192] Optionally, the authentication module 1520 is specifically used to determine, according to the first policy, that the user does not have permission to perform the first operation on the first cloud service; to obtain the first sub-information according to at least one annotation field in the first policy; and to send the first sub-information to the first cloud service.

[0193] Optionally, the system 1500 may also include a policy management module (not shown in the figure) for receiving a policy creation request input by a tenant, the policy creation request including first sub-information; and generating a first policy in response to the policy creation request.

[0194] Optionally, the cloud management platform determines that the user does not have permission to perform the first operation on the first cloud service according to the second policy. The first information includes the second sub-information, which indicates the conditions for the second policy to take effect through natural language.

[0195] Optionally, the second strategy includes at least one condition field, which includes a condition key, an operator, and a condition value. The second sub-information includes a first part, a second part, and a third part, wherein the first part is generated based on the condition key, the second part is generated based on the operator, and the third part is generated based on the condition value.

[0196] Optionally, the authentication module 1520 is specifically used to determine, according to the second strategy, that the user does not have permission to perform the first operation on the first cloud service; determine the first part according to the mapping relationship between the condition key and natural language; determine the second part according to the mapping relationship between the operator and natural language; determine the third part according to the condition value, the third part including the condition value; generate the second sub-information according to the first part, the second part and the third part; and send the second sub-information to the first cloud service.

[0197] Optionally, the authentication module 1520 is also specifically used to determine the logical relationship of multiple condition values ​​based on the operator; and to determine a third part based on the logical relationship and the multiple condition values, wherein the third part includes the multiple condition values ​​and the logical relationship expressed in natural language.

[0198] Optionally, at least one cloud service further includes a second cloud service, the first operation includes a first sub-operation performed on the first cloud service and a second sub-operation performed on the second cloud service, and the first information includes third sub-information, which is used to indicate that the user does not have permission to perform the second sub-operation on the second cloud service.

[0199] Optionally, the cloud system 1500 also includes a second transceiver module (not shown in the figure) deployed on the second cloud service. The authentication module 1520 is specifically used to send a first response message to the first cloud service, the first response message indicating that the user has permission to perform a first sub-operation on the first cloud service; the transceiver module 1510 is also used to send a second access request to the second cloud service in response to the first response message, the second access request requesting to perform a second sub-operation on the second cloud service; the second transceiver module is used to send a second authentication request to the cloud management platform in response to the second access request; the authentication module 1520 is specifically used to send a second response message to the second cloud service in response to the second authentication request, the second response message indicating that the user does not have permission to perform a second sub-operation on the second cloud service; the second transceiver module is used to send a third response message to the first cloud service, the third response message indicating that the user does not have permission to perform a second sub-operation on the second cloud service; the transceiver module 1510 is also used to generate third sub-information based on the third response message, the third sub-information including the third response message.

[0200] Optionally, the third response information is also used to indicate the reason why the user does not have permission to perform the second sub-operation on the second cloud service. The third sub-information is used to indicate the reason why the user does not have permission to perform the second sub-operation on the second cloud service.

[0201] It should be understood that the cloud system 1500 can be used to execute any access control method provided in the embodiments of this application. For specific implementation, please refer to the description of the access control method embodiments provided in this application in Figures 7 to 14, which will not be repeated here.

[0202] All of the above modules can be implemented in software or hardware. For example, the implementation of authentication module 1520 will be described below. Similarly, the implementation of transceiver module 1510 and display module 1530 can refer to the implementation of authentication module 1520.

[0203] As an example of a software functional unit, the authentication module 1520 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, or a container. Further, the aforementioned computing instance may be one or more. For example, the authentication module 1520 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region or in different regions. Further, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one or more geographically proximate data centers. Typically, a region may include multiple AZs.

[0204] Similarly, multiple hosts / virtual machines / containers used to run this code can be distributed within the same Virtual Private Cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Communication between two VPCs within the same region, as well as between VPCs in different regions, requires a communication gateway to be set up within each VPC to enable interconnection between VPCs.

[0205] As an example of a hardware functional unit, the authentication module 1520 may include at least one computing device, such as a server. Alternatively, the authentication module 1520 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be implemented using a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), generic array logic (GAL), or any combination thereof.

[0206] The authentication module 1520 includes multiple computing devices that can be distributed within the same region or in different regions. Similarly, the authentication module 1520 can be distributed within the same Availability Zone (AZ) or in different AZs. Likewise, the authentication module 1520 can be distributed within the same Virtual Private Cloud (VPC) or in multiple VPCs. These multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0207] It should be noted that, in other embodiments, the transceiver module 1510, the authentication module 1520, and the display module 1530 can be used to execute any step in the above access control method. The steps implemented by the transceiver module 1510, the authentication module 1520, and the display module 1530 can be specified as needed. By implementing different steps in the above access control method through the transceiver module 1510, the authentication module 1520, and the display module 1530, all functions of the cloud system 1500 can be realized.

[0208] This application also provides a computing device 100. As shown in FIG16, the computing device 100 includes: a bus 102, a processor 104, a memory 106, and a communication interface 108. The processor 104, the memory 106, and the communication interface 108 communicate with each other via the bus 102. The computing device 100 may be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device 100.

[0209] Bus 102 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, only one line is used in Figure 16, but this does not imply that there is only one bus or one type of bus. Bus 102 can include pathways for transmitting information between various components of computing device 100 (e.g., memory 106, processor 104, communication interface 108).

[0210] The processor 104 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0211] The memory 106 may include volatile memory, such as random access memory (RAM). The memory 106 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0212] The memory 106 stores executable program code, and the processor 104 executes this executable program code to implement the functions of the aforementioned transceiver module, authentication module, and display module, thereby implementing the aforementioned access control method. That is, the memory 106 stores instructions for executing the aforementioned access control method.

[0213] The communication interface 108 uses a command distribution module, such as, but not limited to, a network interface card or a transceiver, to enable communication between the computing device 100 and other devices or communication networks.

[0214] This application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0215] As shown in Figure 17, the computing device cluster includes at least one computing device 100. The memory 106 of one or more computing devices 100 in the computing device cluster may store the same instructions for executing the access control method described above.

[0216] In some possible implementations, the memory 106 of one or more computing devices 100 in the computing device cluster may also store partial instructions for executing the aforementioned access control method. In other words, a combination of one or more computing devices 100 can jointly execute the instructions for executing the aforementioned access control method.

[0217] It should be noted that the memory 106 in different computing devices 100 within the computing device cluster can store different instructions, each used to execute a portion of the functions of the aforementioned cloud system platform. That is, the instructions stored in the memory 106 of different computing devices 100 can implement the functions of one or more modules among the transceiver module, authentication module, and display module.

[0218] In some possible implementations, one or more computing devices in a computing device cluster can be connected via a network. This network can be a wide area network (WAN) or a local area network (LAN), etc. Figure 18 illustrates one possible implementation. As shown in Figure 18, two computing devices 100A and 100B are connected via a network. Specifically, they are connected to the network through communication interfaces in each computing device. In this type of possible implementation, the memory 106 in computing device 100A stores instructions for performing the functions of the transceiver module. Simultaneously, the memory 106 in computing device 100B stores instructions for performing the functions of the authentication module and the display module.

[0219] It should be understood that the functions of computing device 100A shown in Figure 14 can also be performed by multiple computing devices 100. Similarly, the functions of computing device 100B can also be performed by multiple computing devices 100.

[0220] This application also provides a chip, which includes a processor and a data interface. The processor reads instructions stored in the memory through the data interface to execute the access control method described above.

[0221] This application also provides a computer program product containing instructions. The computer program product may be a software or program product containing instructions, capable of running on a computing device or stored on any usable medium. When the computer program product runs on at least one computing device, it causes the at least one computing device to perform the access control method described above.

[0222] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium capable of being stored by a computing device, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the access control method described above.

[0223] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0224] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of this application.

Claims

1. An access control method based on cloud computing technology, characterized in that, The method is applied to a cloud system, the cloud system including a cloud management platform and at least one cloud service, the cloud management platform for managing a cloud data center, the cloud data center including multiple servers, the multiple services for providing resources to the at least one cloud service, and the method comprising: The first cloud service in the at least one cloud service receives a first access request input by the user, the first access request being used to request the execution of a first operation on the first cloud service; In response to the first access request, the first cloud service sends a first authentication request to the cloud management platform. The cloud management platform responds to the first authentication request by authenticating the first access request to determine that the user does not have permission to perform the first operation on the first cloud service; The cloud management platform displays first information through a user interface, which indicates why the user does not have permission to perform the first operation on the first cloud service.

2. The method according to claim 1, characterized in that, The cloud management platform determines that the user does not have permission to perform the first operation on the first cloud service according to the first policy. The first information includes first sub-information, which indicates the annotation of the first policy in natural language.

3. The method according to claim 2, characterized in that, The first sub-information includes the purpose of the first strategy and / or the solution when the first strategy takes effect.

4. The method according to claim 2 or 3, characterized in that, The first strategy includes at least one annotation field, the value of which is the first sub-information. The cloud management platform, in response to the first authentication request, authenticates the first access request, including: According to the first policy, the cloud management platform determines that the user does not have permission to perform the first operation on the first cloud service; The cloud management platform obtains the first sub-information based on at least one annotation field in the first strategy; The cloud management platform sends the first sub-information to the first cloud service.

5. The method according to claim 4, characterized in that, The method further includes: The cloud management platform receives a policy creation request input by a tenant, and the policy creation request includes the first sub-information; The cloud management platform generates the first policy in response to the policy creation request.

6. The method according to any one of claims 1 to 5, characterized in that, The cloud management platform determines, according to the second policy, that the user does not have permission to perform the first operation on the first cloud service. The first information includes second sub-information, which indicates the conditions under which the second policy takes effect through natural language.

7. The method according to claim 6, characterized in that, The second strategy includes at least one condition field, the at least one condition field including a condition key, an operator and a condition value, and the second sub-information includes a first part, a second part and a third part, the first part being generated based on the condition key, the second part being generated based on the operator and the third part being generated based on the condition value.

8. The method according to claim 7, characterized in that, The cloud management platform responds to the first authentication request by authenticating the first access request, including: According to the second policy, the cloud management platform determines that the user does not have permission to perform the first operation on the first cloud service; The cloud management platform determines the first part based on the mapping relationship between the condition key and natural language; The cloud management platform determines the second part based on the mapping relationship between the operators and natural language; The cloud management platform determines the third part based on the condition value, and the third part includes the condition value; The cloud management platform generates the second sub-information based on the first part, the second part, and the third part; The cloud management platform sends the second sub-information to the first cloud service.

9. The method according to claim 8, characterized in that, The at least one condition field includes multiple condition values, and determining the third part based on the condition values ​​includes: The logical relationship between the multiple condition values ​​is determined based on the operator; The third part is determined based on the logical relationship and the plurality of condition values, wherein the third part includes the plurality of condition values ​​and the logical relationship expressed in natural language.

10. The method according to any one of claims 1 to 9, characterized in that, The at least one cloud service further includes a second cloud service, the first operation includes a first sub-operation performed on the first cloud service and a second sub-operation performed on the second cloud service, the first information includes third sub-information, the third sub-information being used to indicate that the user does not have permission to perform the second sub-operation on the second cloud service.

11. The method according to claim 10, characterized in that, The cloud management platform responds to the first authentication request by authenticating the first access request, including: The cloud management platform sends a first response information to the first cloud service, the first response information being used to indicate that the user has permission to perform the first sub-operation on the first cloud service; In response to the first response information, the first cloud service sends a second access request to the second cloud service, the second access request being used to request the execution of the second sub-operation on the second cloud service; In response to the second access request, the second cloud service sends a second authentication request to the cloud management platform; In response to the second authentication request, the cloud management platform sends a second response message to the second cloud service. The second response message is used to indicate that the user does not have permission to perform the second sub-operation on the second cloud service. The second cloud service sends a third response message to the first cloud service, the third response message being used to indicate that the user does not have permission to perform the second sub-operation on the second cloud service; The first cloud service generates the third sub-information based on the third response information, and the third sub-information includes the third response information.

12. The method according to claim 11, characterized in that, The third response information is also used to indicate the reason why the user does not have permission to perform the second sub-operation on the second cloud service.

13. A cloud system, characterized in that, The cloud system includes a cloud management platform and at least one cloud service. The cloud management platform is used to manage a cloud data center. The cloud data center includes multiple servers. The multiple services are used to provide resources for the at least one cloud service. The cloud system includes: The first cloud service is used to receive a first access request input by the user, and the first access request is used to request to perform a first operation on the first cloud service. The first cloud service is also used to send a first authentication request to the cloud management platform in response to the first access request; The cloud management platform is used to authenticate the first access request in response to the first authentication request, so as to determine that the user does not have permission to perform the first operation on the first cloud service; The cloud management platform is also used to display first information through a user interface, the first information being used to indicate the reason why the user does not have permission to perform the first operation on the first cloud service.

14. The cloud system according to claim 13, characterized in that, The cloud management platform determines that the user does not have permission to perform the first operation on the first cloud service according to the first policy. The first information includes first sub-information, which indicates the annotation of the first policy in natural language.

15. The cloud system according to claim 13, characterized in that, The first sub-information includes the purpose of the first strategy and / or the solution when the first strategy takes effect.

16. The cloud system according to claim 14 or 15, characterized in that, The first strategy includes at least one annotation field, the value of which is the first sub-information, and the cloud management platform is used for: According to the first strategy, it is determined that the user does not have permission to perform the first operation on the first cloud service; The first sub-information is obtained based on at least one annotation field in the first strategy; Send the first sub-information to the first cloud service.

17. The cloud system according to claim 16, characterized in that, The cloud management platform is also used for: Receive a policy creation request input by a tenant, wherein the policy creation request includes the first sub-information; The first policy is generated in response to the policy creation request.

18. The cloud system according to any one of claims 13 to 17, characterized in that, The cloud management platform determines, according to the second policy, that the user does not have permission to perform the first operation on the first cloud service. The first information includes second sub-information, which indicates the conditions under which the second policy takes effect through natural language.

19. The cloud system according to claim 18, characterized in that, The second strategy includes at least one condition field, the at least one condition field including a condition key, an operator and a condition value, and the second sub-information includes a first part, a second part and a third part, the first part being generated based on the condition key, the second part being generated based on the operator and the third part being generated based on the condition value.

20. The cloud system according to claim 19, characterized in that, The cloud management platform is used for: According to the second strategy, it is determined that the user does not have permission to perform the first operation on the first cloud service; The first part is determined based on the mapping relationship between the condition keys and natural language; The second part is determined based on the mapping relationship between the operators and natural language; The third part is determined based on the condition value, and the third part includes the condition value; The second sub-information is generated based on the first part, the second part, and the third part; Send the second sub-information to the first cloud service.

21. The cloud system according to claim 20, characterized in that, The at least one condition field includes multiple condition values, and the cloud management platform is used for: The logical relationship between the multiple condition values ​​is determined based on the operator; The third part is determined based on the logical relationship and the plurality of condition values, wherein the third part includes the plurality of condition values ​​and the logical relationship expressed in natural language.

22. The cloud system according to any one of claims 13 to 21, characterized in that, The at least one cloud service further includes a second cloud service, the first operation includes a first sub-operation performed on the first cloud service and a second sub-operation performed on the second cloud service, the first information includes third sub-information, the third sub-information being used to indicate that the user does not have permission to perform the second sub-operation on the second cloud service.

23. The cloud system according to claim 22, characterized in that, The cloud management platform is used to: send a first response information to the first cloud service, wherein the first response information is used to indicate that the user has permission to perform the first sub-operation on the first cloud service; The first cloud service is configured to: send a second access request to the second cloud service in response to the first response information, wherein the second access request is configured to request the execution of the second sub-operation on the second cloud service; The second cloud service is used to: send a second authentication request to the cloud management platform in response to the second access request; The cloud management platform is also configured to: send a second response information to the second cloud service in response to the second authentication request, wherein the second response information is used to indicate that the user does not have permission to perform the second sub-operation on the second cloud service; The second cloud service is further configured to: send a third response message to the first cloud service, the third response message being used to indicate that the user does not have permission to perform the second sub-operation on the second cloud service; The first cloud service is further configured to: generate the third sub-information based on the third response information, wherein the third sub-information includes the third response information.

24. The cloud system according to claim 23, characterized in that, The third response information is also used to indicate the reason why the user does not have permission to perform the second sub-operation on the second cloud service.

25. A computing device, characterized in that, It includes a processor and a memory, the processor being configured to execute instructions stored in the memory to cause the computing device to perform the method as described in any one of claims 1 to 12.

26. A computing device cluster, characterized in that, It includes at least one computing device, each computing device including a processor and memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the cluster of computing devices to perform the method as described in any one of claims 1 to 12.

27. A computer program product, characterized in that, Includes instructions that, when executed by a computing device or a cluster of computing devices, cause the computing device or the cluster of computing devices to perform the method as described in any one of claims 1 to 12.

28. A computer-readable storage medium, characterized in that, Includes computer program instructions that, when executed by a computing device or cluster of computing devices, cause the computing device or cluster of computing devices to perform the method as described in any one of claims 1 to 12.

Images