Access control method and apparatus based on public cloud technology

Abstract

Disclosed are an access control method and apparatus based on public cloud technology, which belong to the technical field of cloud services. The method comprises: a cloud management platform acquiring, from an instance creation interface, an instance creation request set by a tenant, and using infrastructure to create an identity proxy instance on the basis of the instance creation request; the identity proxy instance acquiring, from an account configuration interface, account configuration information set by the tenant, wherein the account configuration information is used for indicating a delegation of each of a plurality of accounts, the delegation of a first account is used for indicating the permission of an off-cloud application of the first account to access an in-cloud resource, the off-cloud application is deployed outside a public cloud, the in-cloud resource is deployed inside the public cloud, and the first account is any one of the plurality of accounts; and on the basis of the account configuration information, the identity proxy instance configuring corresponding delegations for the plurality of accounts. The present application reduces the management cost and maintenance cost of customers, and improves, to a certain extent, the service security in a complex scenario of multi-account resource access.

Description

Access control method and device based on public cloud technology

[0001] This application claims priority to Chinese Patent Application No. 202510227919.2, filed on February 27, 2025, entitled "Access Control Method and Apparatus Based on Public Cloud Technology", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of cloud service technology, and in particular to an access control method and apparatus based on public cloud technology. Background Technology

[0003] Identity proxy cloud services enable users to access cloud resources by using identity authentication delegation without revealing their identity credentials.

[0004] Today, enterprises typically manage multiple accounts, each with multiple cloud resources. Applications deployed outside the public cloud may utilize cloud resources from different accounts. Identity proxy cloud services require configuring multiple identity proxy instances for each account before these applications can use cloud resources from multiple accounts. Furthermore, the identity proxy cloud service needs to configure different delegations for the cloud resources of different accounts. The applications then configure the resource information of each account's identity proxy instance to obtain temporary credentials for each account, enabling them to access cloud resources from multiple accounts using these temporary credentials.

[0005] However, this solution has high management costs. Summary of the Invention

[0006] This application provides an access control method and apparatus based on public cloud technology. This application reduces customer management and maintenance costs and, to a certain extent, improves business security in complex scenarios involving multi-account resource access. The technical solution provided by this application is as follows:

[0007] Firstly, this application provides an access control method based on public cloud technology. This access control method is applied to a cloud management platform. The cloud management platform manages the infrastructure providing cloud services. The infrastructure includes servers. Servers are used to deploy instances. Instances are used to implement tenant services. The access control method based on public cloud technology includes: the cloud management platform obtaining an instance creation request set by the tenant from an instance creation interface, and creating an identity proxy instance based on the instance creation request using the infrastructure; the identity proxy instance obtaining account configuration information set by the tenant from an account configuration interface, the account configuration information indicating the delegation of each of multiple accounts, the delegation of the first account indicating the permission of the first account's external application to access resources within the cloud, the external application being deployed outside the public cloud, the resources within the cloud being deployed within the public cloud, and the first account being any one of the multiple accounts; the identity proxy instance configuring corresponding delegations for the multiple accounts based on the account configuration information.

[0008] In this method, since the tenant can indicate the delegation of each account among multiple accounts to the identity agent instance, and the identity agent instance can configure the corresponding delegation for multiple accounts according to the indication, the tenant can configure the permissions for accessing cloud resources belonging to multiple accounts for external applications with one click, which greatly reduces the management and maintenance costs of customers and improves the business security in complex scenarios of multi-account resource access to a certain extent.

[0009] In one possible implementation, before the identity proxy instance obtains the account configuration information set by the tenant from the account configuration interface, the access control method based on public cloud technology further includes: the identity proxy instance obtaining an account configuration request sent by the tenant from the account configuration interface, the account configuration request being used to request delegation for account configuration; and the identity proxy instance providing a delegation template to the tenant through the account configuration interface based on the account configuration request, the delegation template being used to prompt the tenant to enter delegations that need to be configured for multiple accounts. Correspondingly, the identity proxy instance obtaining the account configuration information set by the tenant from the account configuration interface includes: the identity proxy instance obtaining the account configuration information provided by the tenant based on the delegation template from the account configuration interface.

[0010] In this way, tenants can input multiple delegate objects and the permissions of each delegate object based on their configuration requirements. They can then configure delegates for multiple accounts using the same delegate template, without having to switch to each account individually to configure permissions for each account, thus simplifying the process of configuring delegates for accounts.

[0011] In one possible implementation, before the identity proxy instance configures corresponding delegations for multiple accounts based on account configuration information, the access control method based on public cloud technology further includes: the identity proxy instance configuring corresponding trust anchors for multiple accounts based on account configuration information. Accordingly, configuring corresponding delegations for multiple accounts based on account configuration information includes: if the first account has a trust anchor, the identity proxy instance configuring delegation for the first account based on the account configuration information.

[0012] In this way, the identity proxy instance can strengthen the trust relationship between the primary account's external cloud applications and the identity proxy instance through trust anchors, providing secure and convenient resource management capabilities for the primary account's external cloud applications and improving the security of external cloud applications when migrating to the cloud.

[0013] In one possible implementation, before the identity proxy instance configures corresponding trust anchors for multiple accounts, the access control method based on public cloud technology further includes: the identity proxy instance obtaining tenant-related organizational information, which is used to indicate the tenant and the accounts it manages. Accordingly, the identity proxy instance configures corresponding trust anchors for multiple accounts based on the account configuration information, including: when the organizational information indicates that the tenant has management permissions for the first account, the identity proxy instance configures a corresponding trust anchor for the first account based on the account configuration information.

[0014] In this way, by obtaining organizational information and configuring the corresponding trust anchor for the first account when the organizational information indicates that the tenant has administrative privileges over the first account, the identity proxy instance can provide secure and convenient resource management capabilities for the first account's off-cloud applications, thereby improving the security of off-cloud applications when migrating to the cloud. When the identity proxy instance obtains organizational information from the organization service, it can utilize the configuration convenience and reliability provided by the organization service.

[0015] In one possible implementation, the access control method based on public cloud technology further includes: an identity proxy instance receiving an access request sent by an external application, the access request carrying the identity certificate of the account to which the external application belongs, the access request being used to request access to some or all of the cloud resources of multiple accounts; and, if the identity proxy instance determines based on the access request that the account to which the external application belongs has the permission to access the cloud resources of a second account, providing the external application with credentials for accessing the cloud resources of the second account, the second account being one of some or all of the multiple accounts.

[0016] Because the identity proxy instance maintains the same trust anchor for multiple accounts, there's no need to manage different trust anchor configurations for each account. Furthermore, all delegation for multiple accounts is stored in a single configuration file. When external applications access internal cloud resources, the external application only needs to be concerned with the identity certificate of the account to which it belongs and the necessary delegation information. This allows external applications from different accounts to use a single customer certificate to obtain trust from the identity proxy cloud service under the organization administrator account, requiring only a unique configuration that stores delegation for all accounts. The external application only needs to obtain different temporary delegation credentials based on different scenarios. This simplifies configuration for data plane business administrators and reduces configuration risks.

[0017] Secondly, this application provides an access control device based on public cloud technology. This access control device is applied to a cloud management platform. The cloud management platform manages the infrastructure providing cloud services. The infrastructure includes servers. Servers are used to deploy instances. Instances are used to implement tenant services. The access control device based on public cloud technology includes: an interaction module for obtaining an instance creation request set by the tenant from an instance creation interface; and a creation module for creating an identity proxy instance using the infrastructure based on the instance creation request. The identity proxy instance obtains account configuration information set by the tenant from an account configuration interface. The account configuration information indicates the delegation of each of multiple accounts. The delegation of the first account indicates the permission of the first account's external application to access resources within the cloud. The external application is deployed outside the public cloud, and the resources within the cloud are deployed within the public cloud. The first account is any one of the multiple accounts. The identity proxy instance is also used to configure corresponding delegations for the multiple accounts based on the account configuration information.

[0018] In one possible implementation, the identity proxy instance is also used to: obtain an account configuration request sent by the tenant from the account configuration interface, the account configuration request being used to request a delegation for account configuration; based on the account configuration request, provide a delegation template to the tenant through the account configuration interface, the delegation template being used to prompt the tenant to enter the delegation that needs to be configured for multiple accounts; specifically, the identity proxy instance is used to: obtain the account configuration information provided by the tenant based on the delegation template from the account configuration interface.

[0019] In one possible implementation, the identity proxy instance is also used to configure corresponding trust anchors for multiple accounts based on account configuration information. Specifically, the identity proxy instance is used to: configure delegation for the first account based on the account configuration information, provided that the first account already has a trust anchor.

[0020] In one possible implementation, the identity proxy instance is also used to obtain tenant-related organizational information, which indicates the tenant and the accounts they manage. Accordingly, the identity proxy instance is specifically used to configure a corresponding trust anchor for the first account based on the account configuration information, provided that the organizational information indicates the tenant has management permissions for the first account.

[0021] In one possible implementation, the identity proxy instance is also used to receive access requests sent by external applications. The access requests carry the identity certificate of the account to which the external application belongs. The access requests are used to request access to some or all of the cloud resources of multiple accounts. The identity proxy instance is also used to provide the external application with credentials for accessing the cloud resources of a second account, which is one of some or all of the multiple accounts, if it is determined from the access requests that the account to which the external application belongs has the permission to access the cloud resources of a second account.

[0022] Thirdly, this application provides a computing device including a memory and a processor, wherein the memory stores program instructions and the processor executes the program instructions to implement the methods provided in the first aspect of this application and any of its possible implementations.

[0023] Fourthly, this application provides a computing device cluster, including multiple computing devices, each computing device including multiple processors and multiple memories, the multiple memories storing program instructions, and the multiple processors executing the program instructions, so that the computing device cluster implements the method provided in the first aspect of this application and any possible implementation thereof.

[0024] Fifthly, this application provides a computer-readable storage medium that is a non-volatile computer-readable storage medium, which includes program instructions that, when executed on a computing device cluster, cause the computing device cluster to implement the methods provided in the first aspect of this application and any of its possible implementations.

[0025] Sixthly, this application provides a computer program product containing instructions that, when run on a computer, cause the computer to implement the methods provided in the first aspect of this application and any of its possible implementations. Attached Figure Description

[0026] Figure 1 is a structural diagram of an implementation scenario involving an access control method based on public cloud technology provided in an embodiment of this application;

[0027] Figure 2 is a schematic diagram of the deployment of basic resources in a data center according to an embodiment of this application;

[0028] Figure 3 is a flowchart of an access control method based on public cloud technology provided in an embodiment of this application;

[0029] Figure 4 is a schematic diagram of an access control method based on public cloud technology provided in an embodiment of this application;

[0030] Figure 5 is a flowchart of another access control method based on public cloud technology provided in an embodiment of this application;

[0031] Figure 6 is a schematic diagram of the management interface of an identity proxy instance provided in an embodiment of this application;

[0032] Figure 7 is a schematic diagram of a commission template provided in an embodiment of this application;

[0033] Figure 8 is a flowchart of another access control method based on public cloud technology provided in an embodiment of this application;

[0034] Figure 9 is a flowchart of another access control method based on public cloud technology provided in an embodiment of this application;

[0035] Figure 10 is a flowchart illustrating how an identity proxy instance responds to an access request, according to an embodiment of this application.

[0036] Figure 11 is a schematic diagram of triggering an access request provided in an embodiment of this application;

[0037] Figure 12 is a schematic diagram of the structure of an access control device based on public cloud technology provided in an embodiment of this application;

[0038] Figure 13 is a schematic diagram of the structure of a computing device provided in an embodiment of this application;

[0039] Figure 14 is a schematic diagram of the structure of a computing device cluster provided in an embodiment of this application;

[0040] Figure 15 is a schematic diagram of another computing device cluster provided in an embodiment of this application. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0042] To facilitate understanding, the technologies and background involved in the embodiments of this application will be introduced below.

[0043] Cloud computing is a type of distributed computing that refers to a network that centrally manages and schedules a large number of computing and storage resources to provide on-demand services to users. These computing and storage resources are provided through clusters of computing devices located in data centers. Furthermore, cloud computing can provide users with various types of services, such as Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). Infrastructure as a Service provides virtual machines or other resources as a service to tenants. Platform as a Service provides a development platform as a service to tenants. Software as a Service provides applications (Apps) as a service to customers.

[0044] An Internet Data Center (IDC) is a facility and related service system that provides operation and maintenance for equipment that centrally collects, stores, processes, and transmits data, based on the Internet. Conceptually, it can be understood as a public, commercial Internet "server room," and it is also a professional IT service and a crucial infrastructure for the IT industry. IDC is not only a service concept but also a network concept; it constitutes part of the network infrastructure resources, like backbone networks and access networks, providing high-end data delivery and high-speed access services. Generally, a tenant's on-premises IDC can be understood as their physical server room, where the tenant utilizes existing Internet communication lines and bandwidth resources to establish a standardized, telecommunications-grade server room environment to provide comprehensive services such as server hosting, leasing, and related value-added services. A cloud data center is an Internet data center deployed using the infrastructure resources owned by cloud vendors.

[0045] A resource pool is a collection of various hardware and software resources involved in a cloud data center. Typically, resources in a resource pool can be categorized by type, such as computing resources, storage resources, and network resources.

[0046] A physical machine (PM) is the physical resource used to host virtualization technology. It is also called a physical server. Typically, a physical machine is used to deploy virtual instances. A physical machine has multiple physical devices. For example, a physical server has physical devices such as processors and memory. Multiple virtual instances can be deployed on a single physical machine, sharing the machine's physical resources. Depending on the use case, multiple virtual instances deployed on a single physical machine can belong to the same tenant or to different tenants.

[0047] Virtualization is a resource management technology. Virtualization abstracts and transforms various physical resources of a host, such as computing, network, and storage resources, breaking down the indivisible barriers between the host's physical structures. This allows tenants to utilize these resources in a better way than the original configuration. Resources obtained through virtualization are called virtualized resources, and virtualized resources are not limited by the existing physical resource deployment methods, geographical location, or physical configuration.

[0048] Virtualized resources are typically provided to tenants in the form of virtual instances. Virtual instances utilize the host's hardware resources and run on the host's operating system (OS). Applications run within the virtual instance to implement the tenant's business logic. The host's hardware resources can be allocated to one or more tenants at the virtual instance level. Different virtual instances are isolated from each other, allowing tenants to use physical resources conveniently and flexibly while maintaining security and isolation, and significantly improving the utilization of physical resources. Typically, virtual instances can be virtual machines, containers, or independent processes (such as functions). Virtual instances can also be called Elastic Compute Service (ECS) or Elastic Instances (different cloud service providers may use different names).

[0049] A virtual machine (VM) is a complete computer system with full hardware system functionality, simulated using virtualization technology and running in a completely isolated environment. A subset of the instructions in a VM can be processed on the host machine, while other instructions can be executed in a simulated manner. A VM is also called a virtual server. A VM can be viewed as a collection of virtual devices, which possess full hardware system functionality and run in a completely isolated environment. Virtual devices are created by virtualizing physical devices that can share resources. For example, a virtual processor, created by virtualizing a processor, is a virtual device. Similarly, a training card, created by virtualizing a field-programmable gate array (FPGA), is also a virtual device. For instance, the VM in this application can be a kernel-based virtual machine (KVM). Any task that can be performed on a server can also be performed in a VM. When creating a virtual machine on a server, a portion of the physical machine's hard drive and memory capacity is used as the virtual machine's hard drive and memory capacity. Each virtual machine has its own independent hard drive and operating system, and virtual machine tenants can operate the virtual machine as if it were a server. The runtime environments (such as virtual machine applications, operating systems, and virtual hardware) in different virtual machines are completely isolated, and communication between different virtual machines requires the virtual machine manager to forward network packets.

[0050] Containers utilize the namespace and cgroup technologies supported by the Linux kernel to isolate application processes and their dependencies (the runtime environment's bins / libs, specifically all files required to run the application) within an independent runtime environment. Containers provide a lightweight virtual runtime environment. Containers are created by packaging all the code, libraries, and dependencies of a tenant's application into an image. When the image is executed, it runs in a virtual runtime environment. At this point, the container is a runtime instance of the image, similar to a lightweight sandbox, which can be started, stopped, and deleted. The infrastructure for containers can be server hardware or virtual machines in the cloud (i.e., containers can also be deployed within virtual machines). The operating system uses the Linux kernel and supports namespaces and cgroups. Namespaces are used to isolate processes, while cgroups are used to allocate process resources, specifically virtual processors and memory allocated to the process. The container engine, similar to a virtual machine manager, runs within the operating system and is used to manage containers. Compared to virtual machines, which come with their own operating system, containers do not have an operating system. Instead, containers run as processes within the host machine's operating system. As a result, containers start up faster than virtual machines, making them particularly suitable for lightweight applications. Furthermore, a single host machine can run thousands of containers (processes) simultaneously.

[0051] A Public Key Infrastructure (PKI) certificate is a digital certificate used to verify the identity of an entity (such as an individual, server, or organization) in digital communications. It contains the entity's public key and information associated with that entity, such as its name and organization name, and is signed and issued by a trusted third-party authority—a Certificate Authority (CA).

[0052] Trust anchors are a key component for establishing trust relationships between external applications and identity proxy cloud services. Trust anchors store the CA information of external applications.

[0053] Application configuration is the set of permissions that external applications can use to access cloud resources. Application configuration can restrict the identity of external applications and control their access permissions to cloud resources.

[0054] Trust strategy is a trust relationship based on delegation, describing the trust relationship between the principal and the delegate.

[0055] The Identity Proxy Cloud Service, based on certificate systems such as X.509, establishes trust relationships between client certificates and CA certificates, extending identity and access management capabilities. This allows applications to operate not only in cloud environments but also across different environments, such as off-cloud workloads. It provides a new workload access solution that uses X.509 certificates to replace traditional permanent access keys (such as Permanent Access Keys (AK) and Secret Access Keys (SK)), avoiding the problems associated with permanent access keys, such as easy leakage, high risk, and the need for distribution and rotation.

[0056] Identity proxy cloud services enable users to access cloud resources without revealing their identity credentials by using identity-authenticated delegation. Identity authentication is used for identity and access management, providing secure access control for resources. It involves applications of identity delegation and authentication. Authentication is a mechanism used to verify a user's identity, which can be done using credentials or identity delegation. Authentication typically requires the use of identity authentication credentials (such as AK and SK). However, this method has security vulnerabilities because these credentials can be leaked or misused. To address this issue, identity delegation is provided. An identity delegation is an identity entity that can be granted access to resources. It allows users to access resources without needing credentials. However, identity delegation also has some limitations. For example, identity delegation can only be used in specific environments (such as specific cloud services) and cannot be used on local computers. This leads to problems, such as developers needing to use resources on their local computers but not being able to directly use identity delegation for authentication. To solve this problem, identity proxy cloud services were introduced. This technology allows users to authenticate using identity delegation on their local computers without exposing credentials or using delegation in a designated cloud service, making it easier and more secure for users to access cloud resources. Identity proxy cloud services require the following aspects:

[0057] 1. Identity proxy cloud services require the use of temporary credentials for authentication and access control. This includes, for example, authentication on a local computer. A security token is a temporary access token typically used to grant access to cloud resources for a limited time. This token is an authentication mechanism to ensure that only authenticated users or applications can access specific cloud services and resources.

[0058] 2. Use the Command Line Interface (CLI). The CLI is a command-line tool used to manage cloud resources. The Identity Agent Cloud Service uses the CLI to invoke services that generate temporary credentials and store these credentials on the local computer.

[0059] 3. The Identity Proxy Cloud Service uses a local proxy to manage temporary credentials on the local computer and uses these credentials to access resources. The local proxy can also cache accessed resources to improve access efficiency.

[0060] 4. The Identity Proxy Cloud Service employs several security measures to ensure that generated temporary credentials are not leaked or misused. For example, generated temporary credentials have an expiration date and can be revoked. The local proxy can also restrict access to resources to ensure that only authorized users can access them.

[0061] The Identity Proxy Cloud Service provides a PKI certificate-based solution for off-cloud applications to access the cloud. To use the Identity Proxy Cloud Service, on the management plane, users need to create a tenant in the cloud and enable the service. Users also need to configure their own private CA or a CA from a cloud certificate service within the Identity Proxy Cloud Service, enabling it to manage these CAs using a trust anchor. Users also need to create delegations, authorizing the Identity Proxy Cloud Service to perform operations on the cloud service. On the data plane, users need to issue client certificates for their off-cloud applications, which are signed by the certificate in the trust anchor. Off-cloud applications can use these certificates to access the Identity Proxy Cloud Service and obtain temporary credentials. The Identity Proxy Cloud Service uses the off-cloud application's client certificate to verify its legitimacy against the CA certificate in the trust anchor to establish the relationship between the off-cloud application and the cloud. Then, the off-cloud application uses the temporary credentials to access the cloud service. In addition, users can choose the delegated identity for the session. The Identity Proxy Cloud Service uses the cloud service identity to switch to this delegated identity on behalf of the off-cloud application, and the obtained temporary credentials are issued to the off-cloud application. Off-cloud applications are applications deployed off-cloud, also known as offline applications.

[0062] Today, enterprises typically manage multiple accounts, each with multiple cloud resources. Off-cloud applications may utilize cloud resources from different accounts. However, identity proxy cloud services offer a single-root solution. This requires configuring multiple identity proxy instances for each account before off-cloud applications can use cloud resources from multiple accounts. The identity proxy instance for a specific account is used to provide the identity proxy cloud service for that account. Furthermore, the identity proxy cloud service needs to configure different delegations for the cloud resources of each account. Off-cloud applications then configure the resource information of each account's identity proxy instance to obtain temporary credentials for different accounts, enabling them to access cloud resources from multiple accounts using these temporary credentials. Because this implementation requires configuring one identity proxy instance for each account, it is called the single-account instance implementation of identity proxy cloud services.

[0063] This demonstrates that identity proxy cloud services provide a solution for external applications to access the cloud through the PKI X.509 certificate authentication model under a single-account instance. However, this solution has the following main drawbacks. Drawback 1: Current single-account instance solutions increase management costs and complexity. For example, this solution requires separate configuration and management of trust anchors and application configurations for each account, increasing management costs and complexity. Furthermore, if cross-account sharing of permissions and resources is required, manual configuration of cross-account access permissions is also necessary, further increasing management difficulty. Drawback 2: Current single-account instance solutions pose high security risks. For example, because this solution requires separate configuration and management of identity trust entities and application configurations for each account, it may lead to inconsistencies or omissions in the configurations of multiple accounts within the same enterprise, thereby increasing the risk of security vulnerabilities. Therefore, how to easily and effectively migrate multi-account scenarios to the cloud is a pressing issue that needs to be addressed.

[0064] In view of this, this application provides an access control method based on public cloud technology. This method is applied to a cloud management platform. The cloud management platform manages the infrastructure providing cloud services. The infrastructure includes servers. Servers are used to deploy instances. Instances are used to implement tenant services. In this method, the cloud management platform first obtains the instance creation request set by the tenant from the instance creation interface, and creates an identity proxy instance using the infrastructure according to the instance creation request. Then, the identity proxy instance obtains the account configuration information set by the tenant from the account configuration interface. The account configuration information is used to indicate the delegation of each of the multiple accounts, and the delegation of the first account is used to indicate the permission of the first account's external application to access resources within the cloud. The external application is deployed outside the public cloud. The resources within the cloud are deployed within the public cloud. The first account is any one of the multiple accounts. Then, the identity proxy instance configures corresponding delegations for the multiple accounts based on the account configuration information.

[0065] In this method, since the tenant can indicate the delegation of each account among multiple accounts to the identity agent instance, and the identity agent instance can configure the corresponding delegation for multiple accounts according to the indication, the tenant can configure the permissions for accessing cloud resources belonging to multiple accounts for external applications with one click, which greatly reduces the management and maintenance costs of customers and improves the business security in complex scenarios of multi-account resource access to a certain extent.

[0066] This article provides a detailed introduction to the technical solution of this application from multiple perspectives, including implementation scenarios, methods and processes, hardware devices, and software devices.

[0067] The following are examples illustrating the implementation scenarios of the embodiments of this application.

[0068] Figure 1 is a structural diagram of an implementation scenario involving a logical node management method based on cloud computing technology provided in this application embodiment. As shown in Figure 1, the implementation scenario includes: a cloud system 1 and a client 2. The cloud system 1 and client 2 can establish a communication connection through a network. Optionally, this network can be the Internet or other networks; this application embodiment does not limit the specific network. Tenants can interact with the cloud system 1 through client 2. For example, a tenant can send cloud service requests and other information to the cloud system 1 through client 2. The cloud system 1 responds based on the information sent by client 2.

[0069] As shown in Figure 1, cloud system 1 includes a cloud management platform and infrastructure. The cloud management platform and infrastructure are connected via an internal network of the cloud system. In another implementation, the cloud management platform may optionally be located within the infrastructure. The cloud management platform is used to manage the infrastructure. The infrastructure is used to provide public cloud services. The infrastructure includes at least one data center (DC). The cloud management platform can connect to this at least one data center. In this case, the cloud management platform is used to manage this at least one data center. The data center deploys a large number of cloud resources owned by the cloud service provider, such as computing resources, storage resources, and network resources. Computing resources can be computing devices (such as servers) capable of providing computing power. For example, as shown in Figure 1, multiple servers are deployed in the data center. Cloud services may optionally be deployed on the servers. Cloud services are implemented by running virtual instances, hence also referred to as virtual instances deployed on servers to implement tenant services. Tenants can send cloud service requests and related information to the server through their client 2. The server can process the cloud service requests and related information and provide cloud services to the tenant based on the processed cloud service requests and related information.

[0070] The cloud management platform can be logically divided into: tenant console, compute management service, network management service, storage management service, authentication service, and image management service. The tenant console provides a user interface or application programming interface (API) for interaction with tenants. The compute management service manages servers running virtual instances and bare metal servers. The network management service manages network services (such as gateways and firewalls). The storage management service manages storage services (such as data bucket services). The authentication service manages tenant accounts and passwords. The image management service manages virtual instance images.

[0071] In the implementation scenario shown in Figure 1, a data center contains multiple servers. The servers consist of a hardware layer and a software layer. The hardware layer comprises the standard server configuration, including hardware devices such as processors, memory, network interface cards (NICs), disks, and buses. The software layer includes the operating system installed and running on the server. The operating system relative to the virtual machine can be called the host operating system. The host operating system runs a virtual machine manager (also known as a hypervisor). The virtual machine manager's role is to implement compute virtualization, network virtualization, and storage virtualization for the virtual machines, and to manage the virtual machines.

[0072] The virtual machine manager runs a cloud management platform client. This client receives control plane commands from the cloud management platform, creates virtual instances on the server based on these commands, and manages the virtual instances throughout their lifecycle. For example, the client can monitor the hardware resource usage of the server in real time and report it to the cloud management platform. When the cloud management platform confirms that a virtual instance needs to be created on a specific server, it sends a virtual instance creation command to the client on that server. Upon receiving the command, the client creates the virtual instance on that server. In this way, tenants can create, manage, log in to, and operate virtual instances through the cloud management platform.

[0073] Servers can run virtual machines of different specifications. Virtual machine specifications are categorized as: general-purpose computing, memory-optimized, ultra-large memory, etc., with specific specifications under each type. After a tenant selects a virtual machine specification, the cloud management platform selects a server in the data center that supports that specification and ensures sufficient idle hardware resources on that server. Then, it creates and configures the virtual machine with that specification on that server. Configuring servers through the cloud management platform allows for the analysis and planning of server hardware resources. Based on the server's hardware performance, it plans the corresponding computing products for the physical hardware, such as planning virtual machines of different specifications, to meet the diverse needs of different tenants. Furthermore, differentiated pricing strategies can be implemented based on the performance differences of virtual machines of different specifications. For example, high-performance virtual instances can be sold at a higher price, while ordinary performance virtual instances can be sold at a lower price, allowing tenants to purchase virtual instances as needed.

[0074] In one implementation, as shown in Figure 2, the location of infrastructure can be described by cloud resource deployment regions (regions) and availability zones (AZs). Tenants can choose to deploy cloud services based on resources within specific regions and AZs. Regions are defined based on geographical location and network latency. Using the same resource pool within the same region can be understood as sharing public services such as elastic computing, block storage, object storage, virtual private cloud (VPC) networks, elastic internet protocol (EIP) addresses, and images. Regions are divided into general-purpose regions and dedicated regions. General-purpose regions provide general cloud services to public tenants. Dedicated regions are dedicated regions that host the same type of business or provide business services to specific tenants. A region typically includes multiple AZs. Multiple AZs within a region are connected via high-speed fiber optic cables to meet the needs of tenants building high-availability systems across AZs. Computing, network, and storage resources within an AZ are logically divided into multiple clusters.

[0075] Tenants can send instructions to the cloud management platform through their client 2 to create, manage, log in to, and operate virtual instances on the server, and use the cloud services provided by these virtual instances. For example, the cloud management platform can provide an access interface. This interface can be provided either as a user interface or an API. Tenants can operate their client to remotely access the access interface to register a cloud account and password on the cloud management platform, and then log in using these accounts and passwords. The cloud management platform can also authenticate the cloud account and password. After successful authentication, the tenant can further select and purchase a virtual instance with specific specifications (processor, memory, disk) on the cloud management platform. After the tenant successfully purchases the virtual instance, the cloud management platform provides the tenant with a remote login account and password for the purchased virtual instance. The tenant can use the remote login account and password to remotely log in to the virtual instance on their client, install and run their application within the virtual instance, and use the application to implement their business operations.

[0076] Client 2 can be selected from computers, personal computers, laptops, mobile phones, smartphones, tablets, cloud servers, portable mobile terminals, multimedia players, e-book readers, wearable devices, smart home appliances, artificial intelligence devices, smart wearable devices, smart in-vehicle devices, or Internet of Things devices, etc.

[0077] In one implementation, the logical node management method based on cloud computing technology provided in this application embodiment can be implemented by running an executable program on a computing device in cloud system 1. When the logical node management method based on cloud computing technology provided in this application embodiment is applied to a cloud management platform, the server used to implement the cloud management platform can implement the logical node management method based on cloud computing technology provided in this application embodiment by running the executable program of the logical node management method based on cloud computing technology provided in this application embodiment. Furthermore, the executable program implementing the logical node management method based on cloud computing technology can optionally be presented in the form of an application installation package. After the server installs the application installation package, it can implement the logical node management method based on cloud computing technology provided in this application embodiment by running the executable program therein.

[0078] It should be understood that the above content is an exemplary description of the implementation scenarios of the access control method based on public cloud technology provided in the embodiments of this application, and does not constitute a limitation on the implementation scenarios of the access control method based on public cloud technology. Those skilled in the art will know that as business needs change, the implementation scenarios can be adjusted according to application requirements, and the embodiments of this application do not specifically limit them. Furthermore, when the access control method based on public cloud technology provided in the embodiments of this application is applied to other scenarios, the executable program of the method can also be presented in the form of an application installation package or in other ways, and the embodiments of this application do not list them all.

[0079] The following describes the implementation process of the access control method based on public cloud technology provided in this application embodiment, applied to a cloud management platform. The cloud management platform manages the infrastructure providing cloud services. The infrastructure includes servers. Servers are used to deploy instances, and instances are used to implement tenant services. The access control method based on public cloud technology provided in this application embodiment mainly includes two parts. One part is the process by which an identity proxy instance configures a delegation mechanism for external applications to access resources within the cloud according to the tenant's instructions. The other part is the process by which the identity proxy instance responds to access requests from external applications to access resources within the cloud based on the configured delegation mechanism. The process by which the identity proxy instance configures a delegation mechanism for external applications to access resources within the cloud according to the tenant's instructions will be described first, followed by the process by which the identity proxy instance responds to access requests from external applications to access resources within the cloud based on the configured delegation mechanism.

[0080] Figure 3 is a flowchart illustrating how an identity proxy instance, according to a tenant's instructions, configures a delegation mechanism for an external application to access resources within the cloud. As shown in Figure 3, the implementation process includes the following steps.

[0081] Step 301: The cloud management platform obtains the instance creation request set by the tenant from the instance creation interface, and creates an identity proxy instance using the infrastructure based on the instance creation request.

[0082] When a tenant needs to create an identity proxy instance based on infrastructure managed by the cloud management platform, they can perform a specified operation on their client to trigger an instance creation request. This allows the cloud management platform to create the identity proxy instance for the tenant under the guidance of the instance creation request. In one possible implementation, the cloud management platform can provide an instance creation interface to the tenant, which the tenant can use to trigger an instance creation request. The instance creation request carries the instance specifications. After the tenant triggers the instance creation request, the cloud management platform can obtain the instance creation request through the instance creation interface and retrieve the instance specifications from it. Once the cloud management platform obtains the specifications set by the tenant, it can select a server in the infrastructure that provides those specifications and create an identity proxy instance conforming to those specifications on the selected server. It should be noted that since the identity proxy instance in this application needs to configure corresponding delegations for multiple accounts, to support this functionality, the cloud management platform also needs to create a service association delegation when creating the identity proxy instance. Creating a service association delegation refers to the delegation between the creation of the identity association instance and the relevant cloud services required to configure corresponding delegations for multiple accounts. By creating service association delegates, when configuring corresponding delegates for multiple accounts, the relevant cloud services can be invoked using these service association delegates to achieve the purpose of configuring corresponding delegates for multiple accounts. For example, as shown in Figure 4, after a tenant triggers an instance creation request, the cloud management platform can obtain the instance creation request and create an identity proxy instance based on the instance creation request. During the creation of the identity proxy instance, a service association delegate is created between the identity proxy instance and the identity proxy cloud service, resulting in delegates such as those for accessing domain A, domain B, and domain C, thereby enabling the identity proxy instance.

[0083] In one possible implementation, the instance creation interface of this application is implemented through one or more of the following: an application programming interface (API), an interaction template, and a configuration interface. The interaction template is a template provided by the cloud management platform to tenants to implement different functions. When a tenant needs to use a certain function, the tenant can download the template to implement that function, add its relevant information to the template, and then send the template with the added tenant information back to the cloud management platform. After receiving the template with the added tenant information, the cloud management platform can obtain the function that the template needs to implement and customize the implementation of that function according to the tenant's information. The configuration interface allows tenants to operate within the configuration interface to indicate the functions they need to implement.

[0084] Step 302: The identity proxy instance obtains the account configuration information set by the tenant from the account configuration interface. The account configuration information is used to indicate the delegation of each account among multiple accounts. The delegation of the first account is used to indicate the permission of the cloud application of the first account to access cloud resources. The cloud application is deployed outside the public cloud, and the cloud resources are deployed inside the public cloud. The first account is any one of the multiple accounts.

[0085] After a tenant submits an instance creation request to the cloud management platform, it also needs to provide account configuration information to the identity proxy instance to indicate the delegation that needs to be configured for each of the multiple accounts. The delegation configured for an account can be represented by a delegation object and its permissions. The delegation object is indicated by the account. That is, the account configuration information needs to indicate multiple delegation objects and the permissions that each delegation object has. The delegation held by the first account is used to indicate the permissions of the first account's external applications to access cloud resources. Optionally, the permissions of external applications of different accounts among the multiple accounts to access cloud resources may be all the same, partially the same, or completely different. The external applications of the multiple accounts can be completely different applications, partially the same applications, or the same application.

[0086] In one example implementation scenario, the tenant is an administrator within an enterprise, capable of managing multiple functional departments (such as development, testing, operations, and product). Multiple accounts belong to these functional departments. Each functional department has its own off-cloud application, or multiple functional departments use the same off-cloud application, in which case the off-cloud applications for multiple accounts are the same application. Each functional department uses cloud resources configured for its own account, and the permissions for these cloud resources are the same, partially the same, or different. The administrator instructs any account within the multiple functional departments to access cloud resources using the off-cloud application based on the account configuration information. For example, multiple functional departments might use off-cloud applications to retrieve specified data and store the retrieved data in a public cloud Object Storage Service (OBS) bucket, and retrieve the corresponding data from the OBS bucket when needed. Each functional department needs to use the OBS bucket configured for its own account. Depending on the functional permissions of each department, their permissions for using the OBS bucket may differ. Therefore, administrators can use account configuration information to instruct cloud-based applications of any one of the multiple accounts corresponding to multiple functional departments to access the OBS bucket belonging to that account.

[0087] In one possible implementation, when a tenant needs to specify account configuration information, they can perform a designated operation on their client to provide the account configuration information to the identity proxy instance. In another possible implementation, the identity proxy instance can provide an account configuration interface to the tenant, who can then provide account configuration information to the identity proxy instance based on this interface. Correspondingly, the identity proxy instance can obtain the account configuration information through this interface and extract the information the tenant needs to transmit to the cloud management platform from it. For example, the account configuration interface of this application is implemented through one or more of the following: API, interaction template, and configuration interface.

[0088] Optionally, the identity proxy instance can provide an account configuration interface to the tenant based on the tenant's instructions. In this case, as shown in Figure 5, before the identity proxy instance obtains the account configuration information set by the tenant from the account configuration interface, the method further includes:

[0089] Step 304: The identity proxy instance obtains the account configuration request sent by the tenant from the account configuration interface. The account configuration request is used to request the delegation of account configuration.

[0090] When a tenant needs to provide account configuration information to the identity agent instance, they can perform a specified operation on their client to trigger an account configuration request. This allows the identity agent instance to provide a delegation template for configuring account configuration information to the tenant, enabling the tenant to provide the information based on this template. For example, as shown in Figure 6, the identity agent instance's management interface has an account configuration button. After logging into the management interface, the tenant can send an account configuration request to the identity management instance by clicking this button.

[0091] Step 305: Based on the account configuration request, the identity proxy instance provides a delegation template to the tenant through the account configuration interface. The delegation template is used to prompt the tenant to enter the delegation that needs to be configured for multiple accounts.

[0092] After receiving an account configuration request, the identity agent instance can provide a delegation template to the tenant, allowing the tenant to input the delegations needed to configure for multiple accounts. As described above, delegations configured for an account can be represented by a delegation object and its permissions. Therefore, the delegation template includes input fields for the delegation object and permissions of the delegation object. In this application, as shown in Figure 7, multiple configuration items are displayed in the same delegation template. The dashed box in Figure 7 represents one configuration item. Each of the multiple configuration items includes input fields for the delegation object and permissions of the delegation object. The input field for the delegation object allows the tenant to input the delegation object for which the delegation needs to be configured. The input field for the permissions of the delegation object allows the tenant to input the permissions possessed by the delegation object. For example, Figure 7 shows n configuration items. The tenant can enter the account in the input field for the delegation object of each of the n configuration items and enter the permissions possessed by the account in the input field for the permissions of the delegation object of each configuration item. Among them, the permission i configured by the tenant for account i is used to instruct the external cloud application of account i to access the cloud resources belonging to account i.

[0093] In this way, tenants can input multiple delegate objects and the permissions of each delegate object based on their configuration requirements. They can then configure delegates for multiple accounts using the same delegate template, without having to switch to each account individually to configure permissions for each account, thus simplifying the process of configuring delegates for accounts.

[0094] When the identity agent instance provides a delegation template to the tenant through the account configuration interface, as shown in Figure 5, step 302 includes step 3021: the identity agent instance obtains the account configuration information provided by the tenant based on the delegation template from the account configuration interface.

[0095] After a tenant enters the delegation information required for multiple accounts in the delegation template and submits it, the identity agent instance can obtain the account configuration information based on the delegation template from the account configuration interface. For example, as shown in Figure 7, the interface displaying the delegation template also shows a submit button. After clicking the submit button, the tenant can submit the account configuration information configured by the tenant to the identity agent instance.

[0096] When account configuration information is provided based on a delegation template, after obtaining the account configuration information based on the delegation template, the identity proxy instance needs to parse the account configuration information to obtain the permissions configured for multiple accounts. In one implementation, parsing the account configuration information can be achieved through a functional module set in the identity proxy instance. For example, as shown in Figure 4, the identity proxy instance has a mapping module for multiple accounts and permission sets. This mapping module is used to parse the account configuration information provided based on the delegation template to obtain the permissions configured for multiple accounts.

[0097] Step 303: Based on the account configuration information, the identity proxy instance configures corresponding delegations for multiple accounts.

[0098] After obtaining the account configuration information provided by the tenant, the identity proxy instance can configure corresponding delegations for multiple accounts based on this information. In one implementation, since a service-associated delegation is established between the identity proxy instance and the identity proxy cloud service, when configuring a delegation for any of the multiple accounts, the identity proxy instance can use the service-associated delegation to switch to the delegate identity of that account and configure the delegation for that account. Before using the service-associated delegation, the identity proxy instance also needs to obtain the service-associated delegation credentials and use that token to use the service-associated delegation. In another possible implementation, as shown in Figure 4, the cloud management platform can also provide a security token service, which is used to provide the identity proxy instance with credentials for service-associated delegation.

[0099] After an identity proxy instance creates corresponding delegates for multiple accounts, these delegates can be managed uniformly within the instance's configuration. This allows all delegates for multiple accounts to be stored in a single configuration, enabling cloud services to use a single configuration for each business function. Because all delegates for multiple accounts are stored in one configuration, when external applications access cloud resources, they only need to retrieve the corresponding temporary delegate credentials from this configuration based on different scenarios, without needing to concern themselves with the resource models accessed within the identity proxy instance. This simplifies configuration complexity and reduces configuration risks for data plane business administrators. Since application configuration is used to limit the identity of external applications and control their access permissions to cloud resources, it represents the set of permissions that external applications can use when accessing cloud resources. Therefore, configuring delegates for multiple accounts using the identity proxy instance is essentially configuring applications for multiple accounts. Application configuration ensures the trust relationship between the identity proxy instance and cloud resources.

[0100] In one implementation, step 303 can be achieved through a functional module set in the identity proxy instance. For example, as shown in Figure 4, the identity proxy instance has a multi-account configuration module. This multi-account configuration module is used to manage multi-account delegation, and is often used to manage the permission sets required by an application to use different account resources in a certain business scenario. Here, the multi-account configuration module is specifically used to configure corresponding delegations for multiple accounts based on account configuration information.

[0101] Optionally, before the identity proxy instance configures corresponding delegations for multiple accounts based on account configuration information, it is also necessary to configure corresponding trust anchors for multiple accounts. As shown in Figure 8, the method further includes:

[0102] Step 306: Based on the account configuration information, the identity proxy instance configures corresponding trust anchors for multiple accounts.

[0103] Configuring trust anchors for accounts using an identity proxy instance essentially involves configuring CA certificates for those accounts. Since account configuration information indicates the delegation of authority for each of multiple accounts, the identity proxy instance can configure the same CA certificate for multiple accounts when configuring trust anchors based on this information. For example, when multiple accounts belong to multiple functional departments within an enterprise, the identity proxy instance can configure the enterprise's private CA for each account to achieve the goal of configuring corresponding trust anchors for multiple accounts. By configuring corresponding trust anchors for multiple accounts, the identity proxy instance can establish trust relationships between multiple accounts and the instance itself, thereby establishing trust relationships between the external applications of these accounts and the instance. Furthermore, by configuring the same CA certificate for multiple accounts, the identity proxy instance enables multiple accounts to use the same CA certificate. Compared to the single-account instance implementation of identity proxy cloud services, the identity proxy instance provided in this application maintains the same trust anchor for multiple accounts, eliminating the need to manage different trust anchor configurations for each account, thus reducing the complexity of managing trust anchors for multiple accounts.

[0104] In one implementation, step 306 can be achieved through a functional module set in the identity proxy instance. For example, as shown in Figure 4, the identity proxy instance has a multi-account trust anchor module. This module is used to establish trust relationships between multiple accounts' external applications and the identity proxy instance, and to store the trust anchors for multiple accounts. Specifically, the multi-account trust anchor module is used to configure corresponding trust anchors for multiple accounts based on account configuration information.

[0105] Since configuring a trust anchor for an account by an identity proxy instance is equivalent to creating a trust relationship between the account and the identity proxy instance, and to ensure the effectiveness of configuring delegation for the account, it is usually necessary to implement delegation based on this trust relationship. Therefore, as shown in Figure 8, step 303 may optionally include: 3031, when the first account has a trust anchor, the identity proxy instance configures delegation for the first account based on the account configuration information, where the first account is any one of multiple accounts.

[0106] Before configuring a delegate for the first account based on the account configuration information, the identity proxy instance needs to determine whether the first account has a trust anchor. If the first account has a trust anchor, the delegate is configured for the first account based on the account configuration information. If the first account does not have a trust anchor, a trust anchor is configured for the first account first, and then a delegate is configured for the first account based on the account configuration information. If a trust anchor cannot be configured for the first account, the operation of configuring a delegate for the first account is prohibited. The identity proxy instance can determine whether the first account has a trust anchor by querying whether it stores the first account's signal anchor. In this way, the identity proxy instance can strengthen the trust relationship between the first account's external cloud applications and the identity proxy instance through trust anchors, providing secure and convenient resource management capabilities for the first account's external cloud applications and improving the security of external cloud applications migrating to the cloud.

[0107] Optionally, before the identity proxy instance configures corresponding trust anchors for multiple accounts based on account configuration information, it can also determine whether the tenant has management permissions for multiple accounts. As shown in Figure 9, the method further includes:

[0108] Step 307: The identity agent instance obtains the tenant-related organization information, which is used to indicate the tenant and the accounts it manages.

[0109] Tenant-related organizational information can be pre-stored in the cloud management platform. Before performing operations on multiple accounts, the identity agent instance can retrieve the tenant-related organizational information from the cloud management platform. In one possible implementation, the cloud management platform can have a dedicated component or service for storing tenant organizational information. For example, as shown in Figure 4, the cloud management platform can provide an organization service, and the multi-account management instance of the organization service is used to maintain tenant organizational information. The identity agent instance can synchronize tenant organizational information from the multi-account management instance. When the tenant is an enterprise administrator, the organization service is used to manage accounts and resources within the enterprise, helping the organization better manage and control the use of multiple accounts and resources. It allows the enterprise to create a master account and add other sub-accounts under that master account. The master account can assign permissions to sub-accounts, which control the services and resources that sub-accounts can access. The master account may be, for example, an enterprise administrator account, and the multiple sub-accounts may be accounts belonging to multiple functional departments within the enterprise. The relationship between the master account and the multiple sub-accounts can be described using a tree structure. In this case, the identity agent instance can retrieve the tenant-related organizational information from the organization service. When the identity agent instance obtains organizational information from the organization service, it can leverage the configuration convenience and reliability offered by the organization service. This tenant-related organizational information includes all organization information relevant to the tenant, such as organizational information identifying the tenant and the accounts it manages. Optionally, in addition to the functions mentioned above, the organization service provides several additional features, such as cross-account resource sharing, cross-account cost management, and cross-account security management. Cross-account resource sharing allows resources to be shared between different accounts within an enterprise, such as sharing object storage buckets, relational database service (RDS) databases, and elastic cloud server (ECS) instances. Cross-account cost management helps enterprises manage the costs of multiple accounts, including generating centralized invoices and cost reports. Cross-account security management helps enterprises improve account security through centralized security policies and monitoring.

[0110] It should be noted that when the identity proxy instance needs to obtain tenant-related organizational information, the identity proxy instance needs to have a delegation mechanism to obtain this information. This delegation mechanism can be provided by the tenant to the identity proxy instance. For example, when instructing the creation of the identity proxy instance, the tenant may also instruct the cloud management platform to configure the identity proxy instance to delegate the acquisition of tenant-related organizational information.

[0111] Corresponding to step 307, as shown in Figure 9, step 306 includes: 3061, when the organization information indicates that the tenant has management authority over the first account, the identity agent instance configures the corresponding trust anchor for the first account based on the account configuration information.

[0112] After obtaining the tenant's organizational information, the identity proxy instance can determine whether the organizational information indicates that the tenant has administrative privileges over the first account. If the organizational information indicates that the tenant has administrative privileges over the first account, the identity proxy instance configures the corresponding trust anchor for the first account based on the account configuration information. If the organizational information indicates that the tenant does not have administrative privileges over the first account, the identity proxy instance prohibits the operation of configuring the corresponding trust anchor for the first account. In this way, by obtaining organizational information and configuring the corresponding trust anchor for the first account when the organizational information indicates that the tenant has administrative privileges over the first account, the identity proxy instance can provide secure and convenient resource management capabilities for the first account's external applications, improving the security of external applications migrating to the cloud. When the identity proxy instance obtains organizational information from the organization service, it can utilize the configuration convenience and reliability provided by the organization service.

[0113] It should be noted that if configuring delegation for the first account does not require the first account to have a trust anchor, the operation of configuring delegation for the first account can also be performed when the organization information instructs the tenant to have management permissions for the first account. Please refer to the relevant description above for the implementation method, which will not be elaborated here.

[0114] As can be seen from the above, in the access control method based on public cloud technology provided in this application embodiment, since the tenant can indicate the delegation of each account among multiple accounts to the identity agent instance, and the identity agent instance can configure the corresponding delegation for multiple accounts according to the indication, the tenant can configure the permissions for accessing cloud resources belonging to multiple accounts for external applications with one click, which greatly reduces the management and maintenance costs of customers and improves the business security in complex scenarios of multi-account resource access to a certain extent. For example, based on this solution, the enterprise administrator can uniformly configure the application configuration of multiple accounts according to the different business needs and security requirements of multiple accounts in the enterprise, which improves the flexibility and scalability of external application access for multiple accounts.

[0115] Figure 10 is a flowchart illustrating how an identity proxy instance, based on configured delegation, responds to access requests from external applications to access resources within the cloud, according to an embodiment of this application. As shown in Figure 10, the implementation process includes the following steps.

[0116] Step 1001: The identity proxy instance receives an access request sent by an external application. The access request carries the identity certificate of the account to which the external application belongs. The access request is used to request access to some or all of the cloud resources of multiple accounts.

[0117] When an external application needs to access some or all of the cloud resources belonging to multiple accounts, it can send an access request to the identity proxy instance to request access to those resources. The access request carries the identity certificate of the account to which the external application belongs, which uniquely identifies the account to which the external application belongs. The access request can also indicate the account to which the requested cloud resource belongs. The account to which the requested cloud resource belongs indicates the delegation information required for the external application's access.

[0118] After an external application sends an access request to the identity proxy instance, the identity proxy instance can obtain the access request and retrieve the identity certificate of the account to which the external application belongs, as well as the account to which the cloud resource requested by the external application belongs, from the access request. For example, as shown in Figure 11, an external application can trigger an access request when it needs to access some or all of the cloud resources of multiple accounts. The access request carries the identity certificate of the account to which the external application belongs and the account to which the cloud resource requested by the external application belongs.

[0119] Step 1002: If the identity proxy instance determines that the account to which the external application belongs has the permission to access the cloud resources of the second account based on the access request, it provides the external application with credentials for accessing the cloud resources of the second account. The second account is one of some or all of the multiple accounts.

[0120] After receiving the access request from the external application, the identity proxy instance can authenticate the external application based on the identity certificate of the account to which the external application belongs, carried in the access request, and the trust anchor configured for the account in the identity proxy instance. Then, when the identity certificate of the external application's account is successfully authenticated, based on the delegation configured for multiple accounts by the identity proxy instance (as shown in Figure 11 for the delegations of domain A, domain B, and domain C), it determines whether the external application's account has permission to access the cloud resources of the second account. If the external application's account has permission to access the cloud resources of the second account, it provides the external application with credentials for accessing the cloud resources of the second account, enabling the external application to access the cloud resources of the second account based on these credentials.

[0121] In this embodiment, as shown in Figure 11, since the identity proxy instance maintains the same trust anchor for multiple accounts, it is not necessary to manage different trust anchor configurations for each account. Furthermore, all delegations corresponding to multiple accounts are stored in a single configuration. When an external application accesses resources within the cloud, the external application only needs to be concerned with the identity certificate of the account to which it belongs and the delegation information to be used. In this way, for external applications accessing from different accounts, each application can use a single customer certificate to obtain trust with the identity proxy cloud service under the organization administrator account, and only needs to configure a unique configuration information that stores the delegations under these multiple accounts. The external application only needs to obtain different temporary delegation credentials according to different scenarios. This simplifies the configuration difficulty and reduces the configuration risk for data plane business administrators.

[0122] As can be seen from the above, the public cloud-based access control method provided in this application is equivalent to providing a multi-account access model for applications accessing the cloud from outside the cloud. Organizational administrators can configure multi-account access for applications outside the cloud with a single click based on this model, significantly reducing customer management and maintenance costs and improving business security in complex scenarios involving multi-account resource access. Furthermore, applications outside the cloud can focus only on the permission model required by their business needs, without needing to concern themselves with the access-related resource models in the identity proxy instance, simplifying configuration for data plane business administrators and reducing configuration risks. In addition, this application can be applied not only to applications accessing the cloud from outside the cloud but also to scenarios involving other third-party authentication (such as Security Assertion Markup Language (SAML) applications and next-generation identity authentication and authorization protocols (OpenID Connect, OIDC) applications) accessing the cloud.

[0123] Furthermore, the order of steps in the access control method based on public cloud technology provided in this application can be appropriately adjusted, and steps can be added or removed as needed. Any variations that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the protection scope of this application, and therefore will not be elaborated further.

[0124] The following describes an example of a virtual device in an embodiment of this application.

[0125] The above describes the access control method based on public cloud technology according to embodiments of this application. Corresponding to the above method, embodiments of this application also provide an access control device based on public cloud technology. Figure 12 is a schematic diagram of the structure of an access control device based on public cloud technology provided in an embodiment of this application. Based on the following components shown in Figure 12, the access control device based on public cloud technology shown in Figure 12 can perform all or part of the operations shown in Figure 3 above. It should be understood that the device may include more additional components than the components shown or omit some of the components shown, and embodiments of this application do not limit this. Optionally, the access control device based on public cloud technology is applied to a cloud management platform. The cloud management platform is used to manage the infrastructure that provides cloud services. The infrastructure includes servers. Servers are used to deploy instances. Instances are used to implement tenant services. As shown in Figure 12, the access control device 120 based on public cloud technology includes:

[0126] Interaction module 1201 is used to obtain the instance creation request set by the tenant from the instance creation interface.

[0127] Module 1202 is used to create an identity proxy instance based on an instance creation request using the infrastructure. The identity proxy instance retrieves the account configuration information set by the tenant from the account configuration interface. This account configuration information indicates the delegation privileges of each of the multiple accounts. The delegation privileges of the first account indicate the permissions of the first account's external applications to access resources within the cloud. The external applications are deployed outside the public cloud, and the resources within the cloud are deployed within the public cloud. The first account can be any one of the multiple accounts. The identity proxy instance also configures corresponding delegation privileges for the multiple accounts based on the account configuration information.

[0128] In one possible implementation, the identity proxy instance is also used to: obtain an account configuration request sent by the tenant from the account configuration interface, the account configuration request being used to request a delegation for account configuration; based on the account configuration request, provide a delegation template to the tenant through the account configuration interface, the delegation template being used to prompt the tenant to enter the delegation that needs to be configured for multiple accounts; specifically, the identity proxy instance is used to: obtain the account configuration information provided by the tenant based on the delegation template from the account configuration interface.

[0129] In one possible implementation, the identity proxy instance is also used to configure corresponding trust anchors for multiple accounts based on account configuration information. Specifically, the identity proxy instance is used to: configure delegation for the first account based on the account configuration information, provided that the first account already has a trust anchor.

[0130] In one possible implementation, the identity proxy instance is also used to obtain tenant-related organizational information, which indicates the tenant and the accounts they manage. Accordingly, the identity proxy instance is specifically used to configure a corresponding trust anchor for the first account based on the account configuration information, provided that the organizational information indicates the tenant has management permissions for the first account.

[0131] In one possible implementation, the identity proxy instance is also used to receive access requests sent by external applications. The access requests carry the identity certificate of the account to which the external application belongs. The access requests are used to request access to some or all of the cloud resources of multiple accounts. The identity proxy instance is also used to provide the external application with credentials for accessing the cloud resources of a second account, which is one of some or all of the multiple accounts, if it is determined from the access requests that the account to which the external application belongs has the permission to access the cloud resources of a second account.

[0132] Both the interaction module 1201 and the creation module 1202 can be implemented in software or in hardware. For example, the implementation of the interaction module 1201 will be described below. Similarly, the implementation of the creation module 1202 can refer to the implementation of the interaction module 1201.

[0133] As an example of a software functional unit, the interaction module 1201 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the aforementioned computing instance may be one or more. For example, the interaction module 1201 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region or in different regions. Further, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one cloud data center or multiple geographically proximate cloud data centers. Typically, a region may include multiple AZs.

[0134] Similarly, multiple hosts / virtual machines / containers used to run this code can be distributed within the same Virtual Private Cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Communication between two VPCs within the same region, as well as between VPCs in different regions, requires a communication gateway to be set up within each VPC to enable interconnection between VPCs.

[0135] As an example of a hardware functional unit, the interaction module 1201 may include at least one computing device, such as a server. Alternatively, the interaction module 1201 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be implemented using a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), generic array logic (GAL), or any combination thereof.

[0136] The multiple computing devices included in the interaction module 1201 can be distributed in the same region or in different regions. Similarly, the multiple computing devices included in the interaction module 1201 can be distributed in the same Availability Zone (AZ) or in different AZs. Likewise, the multiple computing devices included in the interaction module 1201 can be distributed in the same Virtual Private Cloud (VPC) or in multiple VPCs. These multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0137] It should be noted that, in other embodiments, either the interaction module 1201 or the creation module 1202 can be used to execute any step in the access control method based on public cloud technology. The steps implemented by the interaction module 1201 and the creation module 1202 can be specified as needed. By implementing different steps in the access control method based on public cloud technology through the interaction module 1201 and the creation module 1202 respectively, all functions of the access control device based on public cloud technology can be realized.

[0138] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of each component described above can be referred to the corresponding content in the foregoing method embodiments, and will not be repeated here.

[0139] The following provides examples illustrating the basic hardware structures involved in the embodiments of this application.

[0140] This application also provides a computing device 1300. As shown in FIG13, the computing device 1300 includes: a bus 1302, a processor 1304, a memory 1306, and a communication interface 1308. The processor 1304, the memory 1306, and the communication interface 1308 communicate with each other via the bus 1302. The computing device 1300 may be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device 1300.

[0141] Bus 1302 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, only one line is used in Figure 13, but this does not imply that there is only one bus or one type of bus. Bus 1302 can include pathways for transmitting information between various components of computing device 1300 (e.g., memory 1306, processor 1304, communication interface 1308).

[0142] The processor 1304 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0143] The memory 1306 may include volatile memory, such as random access memory (RAM). The processor 1304 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0144] The memory 1306 stores executable program code, and the processor 1304 executes this executable program code to implement the functions of the aforementioned interaction module 1201 and creation module 1202, thereby realizing the access control method based on public cloud technology. That is, the memory 1306 stores instructions for executing the access control method based on public cloud technology.

[0145] The communication interface 1308 uses transceiver modules such as, but not limited to, network interface cards and transceivers to enable communication between the computing device 1300 and other devices or communication networks.

[0146] This application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0147] As shown in Figure 14, the computing device cluster includes at least one computing device 1300. The memory 1306 of one or more computing devices 1300 in the computing device cluster may store the same instructions for executing access control methods based on public cloud technology.

[0148] In some possible implementations, the memory 1306 of one or more computing devices 1300 in the computing device cluster may also store partial instructions for executing access control methods based on public cloud technology. In other words, a combination of one or more computing devices 1300 can jointly execute instructions for executing access control methods based on public cloud technology.

[0149] It should be noted that the memory 1306 in different computing devices 1300 within the computing device cluster can store different instructions, which are used to execute certain functions of the access control device based on public cloud technology. That is, the instructions stored in the memory 1306 of different computing devices 1300 can implement the functions of one or more modules in the interaction module 1201 and the creation module 1202.

[0150] In some possible implementations, one or more computing devices in a computing device cluster can be connected via a network. This network can be a wide area network (WAN) or a local area network (LAN), etc. Figure 15 illustrates one possible implementation. As shown in Figure 15, two computing devices 1300A and 1300B are connected via a network. Specifically, they are connected to the network through communication interfaces in each computing device. In this type of possible implementation, the memory 1306 in computing device 1300A stores instructions for executing the functions of the interaction module 1201. Simultaneously, the memory 1306 in computing device 1300B stores instructions for executing the functions of the creation module 1202.

[0151] The connection method between the computing device clusters shown in Figure 15 can be considered as follows: taking into account that the access control method based on public cloud technology provided in this application requires a large amount of data storage, the function implemented by the creation module 1202 is to be executed by the computing device 1300B.

[0152] It should be understood that the functions of computing device 1300A shown in Figure 15 can also be performed by multiple computing devices 1300. Similarly, the functions of computing device 1300B can also be performed by multiple computing devices 1300.

[0153] This application also provides another computing device cluster. The connection relationship between the computing devices in this computing device cluster can be similarly referred to the connection method of the computing device clusters in Figures 14 and 15. The difference is that the memory 1306 in one or more computing devices 1300 in this computing device cluster can store the same instructions for executing the access control method based on public cloud technology.

[0154] In some possible implementations, the memory 1306 of one or more computing devices 1300 in the computing device cluster may also store partial instructions for executing access control methods based on public cloud technology. In other words, a combination of one or more computing devices 1300 can jointly execute instructions for executing access control methods based on public cloud technology.

[0155] This application also provides a computer program product containing instructions. The computer program product may be a software or program product containing instructions capable of running on a computing device or stored on any usable medium. When the computer program product runs on at least one computing device, it causes the at least one computing device to perform an access control method based on public cloud technology.

[0156] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to perform an access control method based on public cloud technology, or instruct the computing device to perform an access control method based on public cloud technology.

[0157] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0158] It should be noted that all information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.), and signals involved in this application have been authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, the raw data and executable code involved in this application were obtained with full authorization.

[0159] In the embodiments of this application, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. The term "at least one" refers to one or more, and the term "multiple" refers to two or more, unless otherwise expressly defined.

[0160] In this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0161] The above description is merely an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the concept and principles of this application should be included within the protection scope of this application.

Claims

1. An access control method based on public cloud technology, characterized in that, The method is applied to a cloud management platform, which manages infrastructure providing cloud services. The infrastructure includes servers, which are used to deploy instances to implement tenant services. The method includes: The cloud management platform obtains the instance creation request set by the tenant from the instance creation interface, and creates an identity proxy instance using the infrastructure according to the instance creation request; The identity proxy instance obtains the account configuration information set by the tenant from the account configuration interface. The account configuration information is used to indicate the delegation of each account among multiple accounts. The delegation of the first account is used to indicate the permission of the cloud application of the first account to access cloud resources. The cloud application is deployed outside the public cloud, and the cloud resources are deployed inside the public cloud. The first account is any one of the multiple accounts. The identity proxy instance configures corresponding delegations for the multiple accounts based on the account configuration information.

2. The method according to claim 1, characterized in that, Before the identity proxy instance obtains the account configuration information set by the tenant from the account configuration interface, the method also... Includes, including: The identity proxy instance obtains the account configuration request sent by the tenant from the account configuration interface. The account configuration request is used to request a delegation of account configuration. Based on the account configuration request, the identity proxy instance provides a delegation template to the tenant through the account configuration interface. The delegation template is used to prompt the tenant to enter the delegation that needs to be configured for the multiple accounts. The identity proxy instance obtains the account configuration information set by the tenant from the account configuration interface, including: The identity proxy instance obtains the account configuration information provided by the tenant based on the delegation template from the account configuration interface.

3. The method according to claim 1 or 2, characterized in that, Before the identity proxy instance configures corresponding delegations for the multiple accounts based on the account configuration information, the method further includes: The identity proxy instance configures corresponding trust anchors for the multiple accounts based on the account configuration information; The identity proxy instance configures corresponding delegations for the multiple accounts based on the account configuration information, including: When the first account has a trust anchor, the identity proxy instance configures delegation for the first account based on the account configuration information.

4. The method according to claim 3, characterized in that, Before the identity proxy instance configures corresponding trust anchors for the multiple accounts, the method further includes: The identity proxy instance obtains the tenant-related organization information, which is used to indicate the tenant and the accounts it manages; The identity proxy instance configures corresponding trust anchors for the multiple accounts based on the account configuration information, including: When the organization information indicates that the tenant has management permissions for the first account, the identity proxy instance configures a corresponding trust anchor for the first account based on the account configuration information.

5. The method according to claim 1, characterized in that, The method further includes: The identity proxy instance receives an access request sent by the external application. The access request carries the identity certificate of the account to which the external application belongs. The access request is used to request access to some or all of the cloud resources of the multiple accounts. When the identity proxy instance determines, based on the access request, that the account to which the external application belongs has permission to access the cloud resources of the second account, it provides the external application with credentials for accessing the cloud resources of the second account, where the second account is one of some or all of the multiple accounts.

6. An access control device based on public cloud technology, characterized in that, The apparatus is applied to a cloud management platform, which manages the infrastructure providing cloud services. The infrastructure includes servers, which are used to deploy instances to implement tenant services. The apparatus includes: The interaction module is used to obtain the instance creation request set by the tenant from the instance creation interface; A creation module is used to create an identity proxy instance using the infrastructure based on the instance creation request. The identity proxy instance is used to obtain the account configuration information set by the tenant from the account configuration interface. The account configuration information is used to indicate the delegation of each account among multiple accounts. The delegation of the first account is used to indicate the permission of the cloud application of the first account to access cloud resources. The cloud application is deployed outside the public cloud, and the cloud resources are deployed inside the public cloud. The first account is any one of the multiple accounts. The identity proxy instance is also used to configure corresponding delegations for the multiple accounts based on the account configuration information.

7. The apparatus according to claim 6, characterized in that, The identity proxy instance is also used for: Obtain the account configuration request sent by the tenant from the account configuration interface. The account configuration request is used to request an account configuration delegation. Based on the account configuration request, a delegation template is provided to the tenant through the account configuration interface. The delegation template is used to prompt the tenant to enter the delegation that needs to be configured for the multiple accounts. The identity proxy instance is specifically used to: obtain the account configuration information provided by the tenant based on the delegation template from the account configuration interface.

8. The apparatus according to claim 6 or 7, characterized in that, The identity proxy instance is also used to configure corresponding trust anchors for the multiple accounts based on the account configuration information; The identity proxy instance is specifically used to: configure delegation for the first account based on the account configuration information, when the first account has a trust anchor.

9. The apparatus according to claim 8, characterized in that, The identity proxy instance is also used to obtain the tenant's related organization information, which is used to indicate the tenant and the accounts it manages; The identity proxy instance is specifically used to configure a corresponding trust anchor for the first account based on the account configuration information, when the organization information indicates that the tenant has management permissions for the first account.

10. The apparatus according to claim 6, characterized in that, The identity proxy instance is also used to receive access requests sent by the external cloud application. The access request carries the identity certificate of the account to which the external cloud application belongs. The access request is used to request access to some or all of the cloud resources of the multiple accounts. The identity proxy instance is also used to provide the external application with credentials for accessing the cloud resources of the second account, provided that the external application has the permission to access the cloud resources of the second account, based on the access request. The second account is one of some or all of the multiple accounts.

11. A computing device cluster, characterized in that, The system includes multiple computing devices, each comprising multiple processors and multiple memories, wherein program instructions are stored in the multiple memories, and the multiple processors execute the program instructions, causing the cluster of computing devices to implement the method described in any one of claims 1 to 5.

12. A computer-readable storage medium, characterized in that, Includes program instructions that, when executed on a computing device, cause the computing device to perform the method of any one of claims 1 to 5.

13. A computer program product containing instructions, characterized in that, When the instructions are executed by the computing device, the computing device performs the method according to any one of claims 1 to 5.

Images