CN110839002A - Cloud account opening, authentication and access method and device - Google Patents

Abstract

The present application discloses an account opening authentication access method, which includes: a first cloud obtains a user's first access request, wherein the first access request includes a target token, and the target token is used by an endorsement subject to authenticate the user's Generated by endorsement of user information, the first cloud belongs to the cloud alliance, and the cloud alliance includes multiple clouds; the alliance token is obtained from the alliance blockchain, and the target token and the alliance token are combined. Matching is performed to obtain a matching result, wherein the alliance blockchain can be accessed by any cloud in the cloud alliance; according to the matching result, the user is determined to be a legitimate user, and the user is allowed to access to the cloud. The above method can realize that the user of the cloud alliance can freely access the resources of any cloud in the cloud alliance.

Description

Cloud account opening, authentication and access method and device

technical field

The present application relates to cloud technology, and in particular, to a cloud account opening, authentication and access method, device and storage medium.

Background technique

With the rapid development of cloud technology, more and more clouds have appeared around the world. Different clouds may be operated by different companies. If users want to access the resources of these clouds, they must register an account on each cloud and use the account to log in to the corresponding cloud before they can access the resources of the cloud corresponding to the account. In order to break the gap between these clouds and realize the sharing of resources, people have proposed the idea of building a cloud alliance.

However, how to realize that users of the cloud alliance can freely access the resources of any cloud in the cloud alliance is an unsolved problem.

SUMMARY OF THE INVENTION

The present application provides an access method, device and storage medium, which can realize that a user of a cloud alliance can access the resources of any cloud in the cloud alliance.

In a first aspect, a user access method to the cloud is provided, including:

The first cloud obtains the user's first access request, wherein the first access request includes a target token, and the target token is generated by an endorsement subject endorsing the user information of the user, and the first cloud belong to the cloud alliance, and the cloud alliance includes multiple clouds;

Obtain the alliance token from the alliance blockchain, and match the target token with the alliance token to obtain a matching result, wherein the alliance blockchain can be used by any one of the cloud alliances cloud access;

According to the matching result, it is determined that the target user is a legitimate user, and the target user is allowed to access the first cloud.

With reference to the first aspect, in a first possible implementation manner of the first aspect, the endorsement subject includes any cloud in the cloud alliance or a third-party notary institution.

In combination with any of the foregoing manners of the first aspect, in a second possible implementation manner of the first aspect, in the case that the fourth cloud and the first cloud are the same cloud, the endorsement body includes the first cloud. A cloud; in the case that the fourth cloud and the first cloud are not the same cloud, the endorsement subject includes the fourth cloud and the first cloud.

In combination with any of the foregoing manners of the first aspect, in a third possible implementation manner of the first aspect, the method further includes: in the case that the lifetime of the alliance token is greater than the expiration period, the first cloud Regenerate a new federation token and upload the new federation token to the federation blockchain.

In combination with any of the above-mentioned manners of the first aspect, in a fourth possible implementation manner of the first aspect, the method further includes:

receiving a second access request from the user, wherein the second access request includes a target token;

The first cloud sends the user's second access request to the second cloud, where the second cloud belongs to the cloud alliance.

In a second aspect, a cloud user authentication method is provided, including:

The third cloud obtains the authentication request of the user, wherein the authentication request includes the user information of the user, the third cloud belongs to the cloud alliance, and the cloud alliance includes multiple clouds;

Send an endorsement request to the endorsement subject according to the authentication request, and receive an endorsement result returned by the endorsement subject, where the endorsement request includes the user information, and the endorsement result is that the endorsement subject performs an endorsement on the user information. the result obtained by the endorsement;

generating a target token for the target user according to the endorsement result;

The target token is uploaded to the consortium blockchain as a consortium token, and the consortium blockchain can be accessed by any cloud in the cloud consortium.

With reference to the second aspect, in a second possible implementation manner of the second aspect, the endorsement subject includes any cloud in the cloud alliance or a third-party notary institution.

In combination with any of the foregoing manners of the second aspect, in a third possible implementation manner of the second aspect, the method further includes:

An expiration period of the alliance token is determined, wherein the expiration period is used to invalidate the alliance token when the life cycle of the alliance token is greater than the expiration period.

In combination with any of the foregoing manners of the second aspect, in a fourth possible implementation manner of the second aspect, the user information includes one or more of an alliance account number, a password, and an alliance identification.

A third aspect provides an account opening method for a cloud user, including:

The fourth cloud receives an account opening request from a user, wherein the account opening cloud belongs to a cloud alliance, and the cloud alliance includes multiple clouds;

generating user information for the user according to the account opening request;

Send an endorsement request to the endorsement subject, and receive an endorsement result returned by the endorsement subject, where the endorsement request includes the user information, and the endorsement result is the result obtained by the endorsement subject endorsing the user information;

The endorsement result is uploaded to the consortium blockchain according to the endorsement result, and the consortium blockchain can be accessed by any cloud in the cloud consortium.

With reference to the third aspect, in a first possible implementation manner of the third aspect, the endorsement subject includes any cloud in the cloud alliance or a third-party notary institution.

In combination with the foregoing one manner of the third aspect, in a second possible implementation manner of the third aspect, the user information includes one or more of an alliance account number, a password, and an alliance identifier.

In a fourth aspect, an access device is provided, including: an acquisition module, a matching module, and a determination module,

The obtaining module is configured to obtain a user's first access request, wherein the first access request includes a target token, and the target token is generated by an endorsement subject endorsing the user information of the user, and the The first cloud belongs to the cloud alliance, and the cloud alliance includes multiple clouds;

The matching module is used to obtain the alliance token from the alliance blockchain, and match the target token and the alliance token to obtain a matching result, wherein the alliance blockchain can be used by the cloud Access to any cloud in the alliance;

The determining module is configured to determine that the target user is a legitimate user according to the matching result, and allow the target user to access the first cloud.

With reference to the fourth aspect, in a first possible implementation manner of the fourth aspect, the endorsement subject includes any cloud in the cloud alliance or a third-party notary institution.

In combination with any of the foregoing manners of the fourth aspect, in a second possible implementation manner of the fourth aspect, in the case that the fourth cloud and the first cloud are the same cloud, the endorsement body includes the first cloud. A cloud; in the case that the fourth cloud and the first cloud are not the same cloud, the endorsement subject includes the fourth cloud and the first cloud.

In combination with any of the foregoing manners of the fourth aspect, in a third possible implementation manner of the fourth aspect, the method further includes: in the case that the lifetime of the alliance token is greater than the expiration period, the first cloud Regenerate a new federation token and upload the new federation token to the federation blockchain.

In combination with any of the above manners of the fourth aspect, in a fourth possible implementation manner of the fourth aspect, the access device further includes a receiving module and a sending module,

The receiving module is further configured to receive a second access request from the user, wherein the second access request includes a target token;

The sending module is further configured to send the second access request of the user to the second cloud, where the second cloud belongs to the cloud alliance.

In a fifth aspect, an authentication device is provided, including: an acquiring module, a sending module, and a generating module

The obtaining module is configured to obtain an authentication request of a user, wherein the authentication request includes user information of the user, the third cloud belongs to a cloud alliance, and the cloud alliance includes multiple clouds;

The sending module is configured to send an endorsement request to an endorsement subject according to the authentication request, and receive an endorsement result returned by the endorsement subject, wherein the endorsement request includes the user information, and the endorsement result is the endorsement subject The result obtained by endorsing the user information;

The generating module is configured to generate a target token for the target user according to the endorsement result;

The sending module is further configured to upload the target token to a consortium blockchain as a consortium token, and the consortium blockchain can be accessed by any cloud in the cloud consortium.

With reference to the fifth aspect, in a second possible implementation manner of the fifth aspect, the endorsement subject includes any cloud in the cloud alliance or a third-party notary institution.

In combination with any of the foregoing manners of the fifth aspect, in a third possible implementation manner of the fifth aspect, the apparatus further includes a determining module,

The determining module is configured to determine the expiration period of the alliance token, wherein the expiration period is used to invalidate the alliance token when the life cycle of the alliance token is greater than the expiration period.

In combination with any of the foregoing manners of the fifth aspect, in a fourth possible implementation manner of the fifth aspect, the user information includes one or more of an alliance account number, a password, and an alliance identification.

In a sixth aspect, an account opening device is provided, comprising: a receiving module, a generating module and a sending module,

The receiving module is configured to receive an account opening request from a user, wherein the account opening cloud belongs to a cloud alliance, and the cloud alliance includes multiple clouds;

The generating module is configured to generate user information for the user according to the account opening request;

The sending module is configured to send an endorsement request to an endorsement subject, and receive an endorsement result returned by the endorsement subject, wherein the endorsement request includes the user information, and the endorsement result is the endorsement subject's response to the user information. the result of the endorsement;

The sending module is further configured to upload the endorsement result to a consortium blockchain according to the endorsement result, and the consortium blockchain can be accessed by any cloud in the cloud consortium.

With reference to the sixth aspect, in a first possible implementation manner of the sixth aspect, the endorsement subject includes any cloud in the cloud alliance or a third-party notary institution.

In combination with the foregoing one manner of the sixth aspect, in a second possible implementation manner of the sixth aspect, the user information includes one or more of an alliance account number, a password, and an alliance identifier.

In a seventh aspect, a cloud system is provided, comprising: a plurality of computer devices, wherein the computer devices include a memory, a processor coupled with the memory, and a communication module, wherein: the communication module is used for sending or receiving For externally sent data, the memory is used to store program codes, and the processor is used to call the program codes stored in the memory to execute the method described in any one of the first aspects.

In an eighth aspect, a cloud system is provided, comprising: a plurality of computer devices, wherein the computer devices include a memory, a processor coupled with the memory, and a communication module, wherein: the communication module is used for sending or receiving Externally sent data, the memory is used to store program codes, and the processor is used to call the program codes stored in the memory to execute the method described in any one of the second aspects.

In a ninth aspect, a cloud system is provided, comprising: a plurality of computer devices, wherein the computer devices include a memory, a processor coupled with the memory, and a communication module, wherein: the communication module is used for sending or receiving Externally sent data, the memory is used to store program codes, and the processor is used to call the program codes stored in the memory to execute the method described in any one of the third aspects.

In a tenth aspect, a computer non-transitory storage medium is provided, comprising instructions that, when executed on a device, cause the device to perform the method according to any one of the first aspects.

In an eleventh aspect, a computer non-transitory storage medium is provided, comprising instructions that, when executed on a device, cause the device to perform the method of any one of the second aspects.

A twelfth aspect provides a computer non-transitory storage medium comprising instructions that, when executed on a device, cause the device to perform the method of any one of the third aspects.

In the above solution, when the user terminal needs to access the first cloud, the first cloud receives the first access request sent by the user, wherein the first access request includes the target token. The first cloud obtains the alliance token from the alliance blockchain, matches the target token and the alliance token to obtain a matching result, determines the target user as a legitimate user according to the matching result, and allows the target The user accesses the first cloud. Since the target token is generated by the endorsement subject's endorsement of the user's user information, it has good credibility. Therefore, as long as the access request sent by the client carries the target token, and the verification of the target token If it is also successfully passed, it can be determined that the user's identity is legitimate and the user is allowed to access. Therefore, as long as the target token is carried, the users of the cloud alliance can freely access the resources of any cloud in the cloud alliance.

Description of drawings

1 is a schematic structural diagram of a cloud alliance involved in an embodiment of the present application;

2 is a schematic structural diagram of another cloud alliance involved in an embodiment of the present application;

Fig. 3 is a process interaction diagram of an account opening method provided by the present application;

Fig. 4 is a flow diagram of an authentication method provided by the present application;

Fig. 5 is a process interaction diagram of an access method provided by the present application;

Fig. 6 is a process interaction diagram of an access method provided by the present application;

7 is a schematic structural diagram of another cloud alliance provided by the present application;

FIG. 8 is a schematic structural diagram of still another cloud alliance provided by the present application.

specific embodiment

As shown in Figure 1, the envisaged cloud alliance includes multiple clouds, and an alliance blockchain belonging to the cloud alliance is constructed on the cloud alliance. The alliance blockchain can be used by any cloud in the cloud alliance. access. It can be understood that the scale of a cloud alliance can be set according to actual needs. For example, a cloud alliance can be an alliance formed between clouds of multiple enterprises, an alliance formed between clouds of multiple cities, or a plurality of countries. The alliance formed between the clouds, or even the alliance formed between the global clouds, is not specifically limited here.

Clouds can include multiple cloud nodes (see the solid white dots in Figure 2). Specifically, the cloud includes at least one data center and network devices connecting the data centers. Each data center includes a hardware layer, such as servers, storage arrays, network devices, etc.; and a software layer running on the hardware layer. Manufacturers that provide cloud services, based on cloud-based software and hardware resources, provide users with rental or hosting services, including hardware services such as computing, storage, and networking, or software services such as artificial intelligence and databases.

The consortium blockchain includes at least one order node (the solid black dot in Figure 2) and a peer node connecting the order service node (the dot with dots in Figure 2) . The ordering service node may be composed of nodes other than each cloud in the cloud alliance, and the accounting node may be composed of some cloud nodes in each cloud in the cloud alliance. The ordering service node is used to order the information that needs to be stored in the alliance blockchain, package the sorted information into blocks, and then broadcast the packaged blocks to all accounting nodes. Accounting nodes are used to store packaged blocks. In addition, the ordering service node may designate some accounting nodes as endorsement nodes (as shown in the circle dots with diagonal stripes in Figure 2).

The cloud alliance can be built in the following ways: Cloud 1 first creates the cloud alliance and formulates the smart contracts that the cloud alliance needs to follow. If other clouds (such as cloud 2) approve the smart contract formulated by cloud 1, other clouds can join the cloud alliance. When cloud 1 creates a cloud alliance, it can create an alliance blockchain on its own basis. When other clouds join the blockchain, other clouds can create sub-blockchains on their own basis, and divide the sub-blockchains. Connect with the original consortium blockchain to form a new consortium blockchain. The alliance blockchain is the private blockchain of the cloud alliance, that is to say, when any cloud uploads data to the blockchain, the uploaded data will be quickly synchronized to the entire alliance blockchain and can be accessed by the cloud. Other cloud downloads in the league. It should be understood that the above construction method is only an example, and should not constitute a specific limitation.

It is envisaged that users of China Cloud Alliance can freely access the resources of any cloud in the cloud alliance. Specifically, users can open an alliance account on any cloud in the cloud alliance. After the alliance account is opened, the user can log in and authenticate with the alliance account on any cloud in the cloud alliance. After the verification is completed, the user can access any cloud in the cloud alliance through the alliance account. The following two specific application scenarios are illustrated in the form of examples:

In the first scenario, the user opens an alliance account on Cloud A in the cloud alliance. Then, the user can log in and authenticate with the alliance account on the B cloud in the cloud alliance. After the verification is completed, the user can access the resources of Cloud B in the cloud alliance through the alliance account. Users can also log in and authenticate with the federation account on the C cloud in the cloud federation. After the verification is completed, the user can access the resources of the C cloud in the cloud alliance through the alliance account. By analogy, users can access each cloud (including A cloud) in the cloud alliance in the same way.

In the second scenario, the user opens an alliance account on Cloud A in the cloud alliance. Then, the user can log in and authenticate with the alliance account on the B cloud in the cloud alliance. After the verification is completed, the user can access the B cloud, and can access each cloud (including the A cloud) in the cloud alliance through the B cloud.

Among them, the cloud directly accessed by the user can be called the first cloud, the cloud accessed by the user through the first cloud can be called the second cloud, the cloud through which the user verifies the identity can be called the third cloud, and the cloud where the user opens an alliance account It can be called the fourth cloud. It should be understood that the above-mentioned first cloud, third cloud and fourth cloud may be the same cloud; the third cloud and the fourth cloud may be the same cloud, and the first cloud may not be the same cloud; the fourth cloud and The first cloud may be the same cloud, and the third cloud may not be the same cloud; the first cloud and the fourth cloud may be the same cloud, and the third cloud may not be the same cloud; The cloud and the fourth cloud may not be the same cloud, which is not specifically limited here.

In order to realize that the user can freely access the resources of any cloud in the cloud alliance, the user can carry the target token to access any cloud in the cloud alliance. When the user carries the target token to access any cloud in the cloud alliance, the visited cloud (the first cloud) verifies the target token. In the case that the first cloud has passed the verification of the target token, it can be determined that the user is a legitimate user, and the user is allowed to access.

The reason why the user can access any cloud in the cloud alliance with the target token is that the target token is a token generated by the endorsement subject of the cloud alliance to endorse the user's user information according to the endorsement policy. Since the target token can prove that the endorser has endorsed the user information of the target user, that is to say, the target token can prove that the endorser has guaranteed the credibility of the target user. Therefore, as long as the target token is verified, It can be determined that the target user is a legitimate user. Wherein, the user information includes one or more of alliance account numbers, passwords, and alliance identifiers. The endorsement subject can include any cloud in the cloud alliance or a third-party notary institution. More specifically, in the case where the endorsement subject includes one of the clouds in the cloud consortium, the endorsement subject includes the endorsement node of the cloud. The third-party notary agency may be an agency recognized by the Cloud Alliance, for example, a credit card verification agency and other credit agencies, and so on. The endorsement policy can be set according to actual needs. For example, in the case that the fourth cloud and the first cloud are the same cloud, the endorsement subject includes the first cloud; When the first cloud is not the same cloud, the endorsement subject includes the fourth cloud and the first cloud, which is not specifically limited here. It should be understood that the above examples of user information, endorsement subjects and endorsement policies are only examples and should not constitute specific limitations.

The process of verifying the target token by the first cloud may be as follows: the first cloud obtains the first access request of the target user, and obtains the index and the target token from the first access request. The first cloud sends the index to the consortium blockchain. Accordingly, the consortium blockchain receives the index sent by the first cloud. The consortium blockchain looks up the consortium token based on the index. The consortium blockchain sends the consortium token to the first cloud. Accordingly, the first cloud receives the alliance token sent by the alliance blockchain. The first cloud matches the target token and the federation token to obtain a matching result. When the matching result is a successful match, the first cloud determines that the target user is a legitimate user, and allows the target user to access the first cloud.

The generation process of the target token may be: the third cloud obtains an authentication request of the user, wherein the authentication request includes user information of the user. Then, the third cloud sends an endorsement request to the endorsement subject according to the authentication request. Wherein, the endorsement request includes the user information. Accordingly, the endorsement subject receives the endorsement request sent by the third cloud. The endorsement subject endorses the user information according to the endorsement policy to obtain the endorsement result. The endorsement subject sends the endorsement result to the third cloud. Accordingly, the third cloud receives the endorsement result returned by the endorsement subject. When the endorsement result is that the endorsement is successful, the third cloud generates a target token for the user. The third cloud uploads the target token to the consortium blockchain as a consortium token. Accordingly, the alliance blockchain receives the target token sent by the third cloud, and stores the target token as the alliance token. The consortium blockchain sends the index of the consortium token to the third cloud. Accordingly, the third cloud receives the index sent by the consortium blockchain. The third cloud sends the target token to the client of the user. Correspondingly, the user terminal of the user receives the target token sent by the third cloud. It is not difficult to understand that because the alliance blockchain has the characteristics of distributed storage and decentralized storage, the alliance token stored in the alliance blockchain cannot be tampered with and has extremely high reliability.

The user information generation process may be: the account opening cloud receives an account opening request from the target user, where the account opening request may include necessary information for opening an account, such as one or more of passport numbers, ID numbers, and names. Then, the account opening cloud generates user information for the target user according to the account opening request. The account opening cloud sends an endorsement request to the endorsement subject, and receives the endorsement result returned by the endorsement subject, where the endorsement request includes the user information, and the endorsement result is obtained by the endorsement subject endorsing the user information. result. When the endorsement result is successful, the account opening cloud uploads the user information to the alliance blockchain. Similarly, since the consortium blockchain has the characteristics of distributed storage and decentralized storage, the user information stored in the consortium blockchain has extremely high reliability.

For the above two different application scenarios, users can carry the target token to access any cloud in the cloud alliance, which can be achieved in the following ways:

For the first application scenario, the user opens an alliance account on Cloud A in the cloud alliance. Then, the user can log in and authenticate with the federated account on the B cloud in the cloud federation to generate the target token. After the verification is completed, the user can carry the target token to access the resources of Cloud B in the cloud alliance. The user can also log in and authenticate with the federation account on the C cloud in the cloud federation to generate the target token. After the verification is completed, the user can access the resources of the C cloud in the cloud alliance by carrying the target token. By analogy, users can access each cloud (including A cloud) in the cloud alliance in the same way.

For the second application scenario, the user opens an alliance account on Cloud A in the cloud alliance. Then, the user can log in and authenticate with the federated account on the B cloud in the cloud federation to generate the target token. After the verification is completed, the user can carry the target token to access the B cloud, and can carry the target token to access each cloud (including the A cloud) in the cloud alliance.

The present invention will be further described below with reference to FIGS. 3 to 6 and specific embodiments.

As shown in FIG. 3 , FIG. 3 is a flow interaction diagram of an account opening method provided by the present application. The account opening method of this embodiment includes:

S101: The fourth cloud receives an account opening request from a user.

In a specific embodiment of the present application, the account opening request includes identity information, one or more of the account opening information passport number, ID number, and name.

S102: The fourth cloud verifies the identity information.

In a specific embodiment of the present application, the identity information may be submitted by the fourth cloud to a third-party verification agency for verification. The third-party verification institution may be an institution with good credibility, such as a household registration bureau, a public security organ, or a banking institution, etc., which is not specifically limited here.

S103: In the case that the authentication of the identity information is successful, the fourth cloud generates user information for the user.

In a specific embodiment of the present application, the user information includes one or more of an alliance account, a password and an alliance identifier. The alliance account can be the user's common account in the cloud alliance, that is, the user can log in to the alliance account on any cloud in the cloud alliance. The password is the verification information entered by the target user when logging in to the affiliate account. The Alliance Logo is the logo of the Cloud Alliance.

S104: The fourth cloud sends the endorsement request to the endorsement subject. Accordingly, the endorsement subject receives the endorsement request sent by the fourth cloud.

In a specific embodiment of the present application, the endorsement request may be sent in the form of an account opening proposal. Specifically, the account opening cloud uploads the account opening proposal to the consortium blockchain, and after the consortium blockchain receives the account opening proposal, it synchronizes the account opening proposal within the entire consortium blockchain. After the endorsement node receives the account opening proposal, it endorses the account opening proposal.

S105: The endorsement subject endorses the user information according to the endorsement policy to obtain an endorsement result.

S106: The endorsement subject sends the endorsement result to the fourth cloud. Accordingly, the fourth cloud receives the endorsement result sent by the endorsement subject.

S107: When the endorsement result is successful, the fourth cloud uploads the endorsement result to the alliance blockchain.

S108: The fourth cloud sends user information to the user terminal of the user. Correspondingly, the user terminal of the user receives the user information returned by the fourth cloud.

As shown in FIG. 4 , FIG. 4 is a flow interaction diagram of an authentication method provided by the present application. The authentication method of this embodiment includes:

S201: The third cloud obtains the authentication request of the user.

In a specific embodiment of the present application, the authentication request includes user information of the user, and the user information includes one or more of an alliance account, a password, and an alliance identifier.

S202: The third cloud verifies the user's identity according to the alliance account and password. The identity information may be verified by a third cloud or a third-party verification agency.

S203: If the verification is successful, the third cloud generates an endorsement request according to the authentication request, where the endorsement request includes user information.

S204: The third cloud submits an endorsement request to the endorsement subject. Accordingly, the endorsement subject receives the endorsement request submitted by the authentication cloud.

In specific embodiments of the present application, the endorsement request may be sent in the form of an authentication proposal. Specifically, the fourth cloud uploads the certification proposal to the consortium blockchain, and after receiving the certification proposal, the consortium blockchain synchronizes the certification proposal within the entire consortium blockchain. After the endorsement node receives the certification proposal, it endorses the certification proposal.

S205: The endorsement subject endorses the user information according to the endorsement policy to obtain an endorsement result.

S206: The endorsement subject sends the endorsement result to the third cloud. Accordingly, the third cloud receives the endorsement result sent by the endorsement subject.

S207: When the endorsement result is that the endorsement is successful, the third cloud generates a target token and uses the target token as an alliance token.

S208: The third cloud uploads the alliance token to the alliance blockchain. Accordingly, the consortium blockchain receives the consortium token sent by the third cloud.

S209: The third cloud sends the target token to the client of the user. Correspondingly, the user terminal of the user receives the target token sent by the third cloud.

As shown in FIG. 5 , FIG. 5 is a flow interaction diagram of an access method provided by the present application. The access method of this embodiment includes:

S301: The first cloud receives a first access request from a target user, wherein the first access request includes an index and a target token, and the target token is a token generated by an endorsement subject endorsing the user information of the user Card.

S302: First Cloud sends the index to the alliance blockchain. Accordingly, the consortium blockchain receives the index sent by the first cloud.

S303: The alliance blockchain searches for the alliance token corresponding to the index according to the index.

In the specific embodiment of this application, the consortium token in the consortium blockchain has an expiration period. Wherein, if the life cycle of the alliance token is less than the expiration period, the alliance token is valid; when the life cycle of the alliance token is greater than or equal to the expiration period, the alliance token will be invalid. The expiration period of the alliance token can ensure that the alliance token will not lose its function due to its existence for too long, and improve the reliability of the alliance token.

S304: The alliance blockchain sends the alliance token to the first cloud. Accordingly, the first cloud receives the consortium token sent by the consortium blockchain.

S305: The first cloud matches the target token and the alliance token to obtain a matching result.

S306: When the matching result is that the matching is successful, the first cloud determines that the user is a legitimate user, and allows the user to access the first cloud.

S307: When the matching result is that the matching fails and the failure reason is that the token is invalid, the first cloud regenerates a new alliance token.

S308: First Cloud uploads the alliance token to the alliance blockchain. Accordingly, the alliance blockchain receives the alliance token sent by the first cloud.

As shown in FIG. 6 , FIG. 6 is a flow interaction diagram of an access method provided by the present application. The access method of this embodiment includes:

S401: The first cloud sends a second access request of the user to the second cloud, where the first access request includes an index and a target token.

S402: The second access cloud sends the index to the alliance blockchain. Accordingly, the consortium blockchain receives the index sent by the second cloud.

S403: The alliance blockchain searches for the alliance token corresponding to the index according to the index.

In the specific embodiment of this application, the consortium token in the consortium blockchain has an expiration period. Wherein, if the life cycle of the alliance token is less than the expiration period, the alliance token is valid; when the life cycle of the alliance token is greater than or equal to the expiration period, the alliance token will be invalid. The expiration period of the alliance token can ensure that the alliance token will not lose its function due to its existence for too long, and improve the reliability of the alliance token.

S404: The alliance blockchain sends the alliance token to the second cloud. Accordingly, the second cloud receives the consortium token sent by the consortium blockchain.

S405: The second cloud matches the target token and the alliance token to obtain a matching result.

S406: When the matching result is that the matching is successful, the second cloud determines that the user is a legitimate user, and allows the user to access the second cloud.

S407: When the matching result is that the matching fails and the failure reason is that the token is invalid, the second cloud regenerates a new alliance token.

408: The second cloud uploads the alliance token to the alliance blockchain. Accordingly, the consortium blockchain receives the consortium token sent by the second cloud.

Referring to FIG. 7 , FIG. 7 is a schematic structural diagram of another cloud alliance provided by the present application. The cloud alliance of this application includes the first cloud, the third cloud and the fourth cloud, wherein the cloud alliance blockchain is constructed on the first cloud, the third cloud and the fourth cloud. Wherein, the first cloud, the third cloud and the fourth cloud may be completely different clouds, partially identical clouds or completely identical clouds, which are not specifically limited here.

As shown in FIG. 7 , the first cloud may include multiple cloud nodes, and each cloud node includes a receiving module 101 , a generating module 102 and a sending module 130 .

The receiving module 101 is configured to receive an account opening request from a user, wherein the account opening cloud belongs to a cloud alliance, and the cloud alliance includes multiple clouds;

The generating module 102 is configured to generate user information for the user according to the account opening request;

The sending module 103 is configured to send an endorsement request to the endorsement subject, and receive an endorsement result returned by the endorsement subject, wherein the endorsement request includes the user information, and the endorsement result is the endorsement subject to the user. the result of the endorsement of the information;

The sending module 103 is further configured to upload the endorsement result to a consortium blockchain according to the endorsement result, and the consortium blockchain can be accessed by any cloud in the cloud consortium.

As shown in FIG. 7 , the third cloud may include multiple cloud nodes, and each cloud node includes an obtaining module 201 , a sending module 202 and a generating module 203 .

The obtaining module 201 is configured to obtain an authentication request of a user, wherein the authentication request includes user information of the user, the third cloud belongs to a cloud alliance, and the cloud alliance includes multiple clouds;

The sending module 202 is configured to send an endorsement request to an endorsement subject according to the authentication request, and receive an endorsement result returned by the endorsement subject, wherein the endorsement request includes the user information, and the endorsement result is the endorsement The result obtained by the subject's endorsement of the user information;

The generating module 203 is configured to generate a target token for the target user according to the endorsement result;

The sending module 203 is further configured to upload the target token to a consortium blockchain as a consortium token, and the consortium blockchain can be accessed by any cloud in the cloud consortium.

As shown in FIG. 7 , the fourth cloud may include multiple cloud nodes, and each cloud node includes an acquisition module 301 , a matching module 302 and a determination module 303 .

The obtaining module 301 is configured to obtain the user's first access request, wherein the first access request includes a target token, and the target token is generated by the endorsement subject's endorsement of the user's user information. The first cloud belongs to a cloud alliance, and the cloud alliance includes multiple clouds;

The matching module 302 is configured to obtain the alliance token from the alliance blockchain, and match the target token and the alliance token to obtain a matching result, wherein the alliance blockchain can be used by the Access to any cloud in the cloud alliance;

The determining module 303 is configured to determine that the target user is a legitimate user according to the matching result, and allow the target user to access the first cloud.

The first cloud, the third cloud, and the fourth cloud are not described in the above-mentioned embodiment. For details, please refer to FIG. 2 to FIG. 6 and related statements, and details are not repeated here.

Referring to FIG. 8 , FIG. 8 is a schematic structural diagram of still another cloud alliance provided by the present application. The cloud alliance of the present application includes a first cloud system, a third cloud system and a fourth cloud system, wherein a cloud alliance blockchain is constructed on the first cloud system, the third cloud system and the fourth cloud system. Wherein, the first cloud system, the third cloud system and the fourth cloud system may be different cloud systems, some of the same cloud systems or completely identical cloud systems, which are not specifically limited here. The first cloud system, the third cloud system, and the fourth cloud system may belong to different companies, or may belong to clouds operated by the same company in different countries.

As shown in FIG. 8 , the first cloud system of the present application includes a plurality of computing devices, and each computing device includes one or more processors 401 , a communication interface 402 and a memory 403 . The processor 401 , the communication interface 402 and the memory 403 may be connected through a bus 404 .

Processor 401 includes one or more general-purpose processors, where a general-purpose processor may be any type of device capable of processing electronic instructions, including a central processing unit (CPU), microprocessor, microcontroller, main Processors, controllers, and application specific integrated circuits (ASICs), etc. Processor 401 executes various types of digitally stored instructions, such as software or firmware programs stored in memory 403, which enable the computing device to provide a wide variety of services. For example, the processor 401 can execute programs or process data to perform some or all of the methods described herein.

Communication interface 402 may be a wired interface (eg, an Ethernet interface) or a wireless interface (eg, a cellular network interface or using a wireless local area network interface) for communicating with other computing devices or users.

The memory 403 may include internal memory and external memory. Internal memory may include one or more of at least one of: volatile memory (eg, dynamic random access memory (DRAM), static RAM (SRAM), synchronous dynamic RAM (SDRAM)), and nonvolatile memory (e.g. One Time Programmable Read Only Memory (OTPROM), Programmable ROM (PROM), Erasable Programmable ROM (EPROM), Electrically Erasable Programmable ROM (EEPROM), Mask ROM, NAND (NAND) flash memory, or non-(NOR) flash memory, etc.). The internal memory may be in the form of a solid state drive (SSD). External storage may also include flash drives such as high density flash, secure digital, micro SD, mini SD, extreme data (xD), memory sticks, and the like. The external storage may adopt centralized storage or distributed storage, which is not specifically limited here.

The processor 401 can perform the following steps by reading the program in the memory 403:

Receive an account opening request from a user through the communication interface 402, wherein the fourth cloud belongs to a cloud alliance, and the cloud alliance includes multiple clouds;

generating user information for the user according to the account opening request by the processor 401;

Send an endorsement request to an endorsement subject through the communication interface 402, and receive an endorsement result returned by the endorsement subject, where the endorsement request includes the user information, and the endorsement result is that the endorsement subject endorses the user information The results obtained;

The endorsement result is uploaded to the consortium blockchain through the communication interface 402 according to the endorsement result, and the consortium blockchain can be accessed by any cloud in the cloud consortium.

Optionally, the endorsement subject includes any cloud in the cloud alliance or a third-party notary institution.

Optionally, the user information includes one or more of an alliance account number, a password, and an alliance identification.

As shown in FIG. 8 , the structure of the third cloud system of the present application is similar to that of the first cloud system, including multiple computing devices, each computing device including one or more processors 501 , communication interfaces 502 and memory 503 . The processor 501 , the communication interface 502 and the memory 503 may be connected through a bus 504 .

The processor 501 can perform the following steps by reading the program in the memory 503:

Obtain the authentication request of the user through the communication interface 502, wherein the authentication request includes the user information of the user, the third cloud belongs to the cloud alliance, and the cloud alliance includes multiple clouds;

Send an endorsement request to the endorsement subject through the communication interface 502 according to the authentication request, and receive an endorsement result returned by the endorsement subject, wherein the endorsement request includes the user information, and the endorsement result is the endorsement subject to all The result obtained from the endorsement of the user information;

Generate a target token for the target user according to the endorsement result by the processor 501;

The target token is uploaded to the consortium blockchain through the communication interface 502 as a consortium token, and the consortium blockchain can be accessed by any cloud in the cloud consortium.

Optionally, the endorsement subject includes any cloud in the cloud alliance or a third-party notary institution.

Optionally, an expiration period of the alliance token is determined by the processor 501, wherein the expiration period is used to invalidate the alliance token when the life cycle of the alliance token is greater than the expiration period.

Optionally, the user information includes one or more of an alliance account number, a password, and an alliance identification.

As shown in FIG. 8 , the structure of the third cloud system of the present application is similar to that of the first cloud system, including multiple computing devices, each computing device including one or more processors 601 , communication interfaces 602 and memory 603 . The processor 601 , the communication interface 602 and the memory 603 may be connected through a bus 604 .

The processor 601 can perform the following steps by reading the program in the memory 603:

The user's first access request is obtained through the communication interface 602, wherein the first access request includes a target token, and the target token is generated by an endorsement subject endorsing the user information of the user, and the first access request includes a target token. The cloud belongs to the cloud alliance, and the cloud alliance includes multiple clouds;

Obtain the alliance token from the alliance blockchain through the communication interface 602, and match the target token and the alliance token to obtain a matching result, wherein the alliance blockchain can be used in the cloud alliance Any cloud access of ;

The processor 601 determines that the target user is a legitimate user according to the matching result, and allows the target user to access the first cloud.

Optionally, the endorsement subject includes any cloud in the cloud alliance or a third-party notary institution.

Optionally, when the life cycle of the alliance token is greater than the expiration period, the processor 601 regenerates a new alliance token, and uploads the new alliance token to the alliance blockchain.

Optionally, the second access request of the user is received through the communication interface 602, wherein the second access request includes a target token; the second access request of the user is sent to the second cloud through the communication interface 602, wherein , the second cloud belongs to the cloud alliance.

In the above solution, when the user terminal needs to access the first cloud, the first cloud receives the first access request sent by the user, wherein the first access request includes the target token. The first cloud obtains the alliance token from the alliance blockchain, matches the target token and the alliance token to obtain a matching result, determines the target user as a legitimate user according to the matching result, and allows the target The user accesses the first cloud. Since the target token is generated by the endorsement subject's endorsement of the user's user information, it has good credibility. Therefore, as long as the access request sent by the client carries the target token, and the verification of the target token If it is also successfully passed, it can be determined that the user's identity is legitimate and the user is allowed to access. Therefore, as long as the target token is carried, the users of the cloud alliance can freely access the resources of any cloud in the cloud alliance.

In the several embodiments provided in this application, it should be understood that the disclosed system, terminal and method may be implemented in other manners. For example, the apparatus embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may also be electrical, mechanical or other forms of connection.

The units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solutions in the embodiments of the present invention.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.

The integrated unit, if implemented in the form of a software functional unit and sold or used as an independent product, may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or a part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: U disk, removable hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes.

The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited to this. Any person skilled in the art can easily think of various equivalents within the technical scope disclosed by the present invention. Modifications or substitutions should be included within the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims (17)

1. A method of accessing a cloud, comprising:

a first cloud acquires a first access request of a user, wherein the first access request comprises a target token, the target token is generated by endorsement of an endorsement agent on user information of the user, the first cloud belongs to a cloud alliance, and the cloud alliance comprises a plurality of clouds;

acquiring a alliance token from an alliance block chain, and matching the target token with the alliance token to obtain a matching result, wherein the alliance block chain can be accessed by any cloud in the cloud alliance;

and determining that the target user is a legal user according to the matching result, and allowing the target user to access the first cloud.

2. The method of claim 1, wherein the endorsement agent comprises any cloud in a cloud federation or a third-party notarization authority.

3. The method according to claim 1 or 2, characterized in that the method further comprises:

in the event that the lifetime of the federation token is greater than a failure period, the first cloud regenerates a new federation token and uploads the new federation token into the federation blockchain.

4. The method according to any one of claims 1 to 3, further comprising:

receiving a second access request of the user, wherein the second access request comprises a target token;

sending a second access request of the user to the second cloud, wherein the second cloud belongs to the cloud federation.

5. A cloud user authentication method is characterized by comprising the following steps:

the method comprises the steps that a third cloud acquires an authentication request of a user, wherein the authentication request comprises user information of the user, the third cloud belongs to a cloud alliance, and the cloud alliance comprises a plurality of clouds;

sending an endorsement request to an endorsement main body according to the authentication request, and receiving an endorsement result returned by the endorsement main body, wherein the endorsement request comprises the user information, and the endorsement result is a result obtained by the endorsement main body in endorsement of the user information;

generating a target token for the target user according to the endorsement result;

uploading the target token into a federation blockchain as a federation token, the federation blockchain being accessible to any cloud in the cloud federation.

6. The method of claim 5, wherein the endorsement agent comprises any cloud in a cloud federation or a third-party notarization authority.

7. The method of claim 5 or 6, further comprising:

determining a failure period of the federation token, wherein the failure period is used for failing the federation token when the lifetime of the federation token is greater than the failure period.

8. The method according to any one of claims 5-7, wherein the user information comprises one or more of a federation account number, a password, and a federation identification.

9. An account opening method for a cloud user is characterized by comprising the following steps:

receiving an account opening request of a user by a fourth cloud, wherein the fourth cloud belongs to a cloud alliance, and the cloud alliance comprises a plurality of clouds;

generating user information for the user according to the account opening request;

sending an endorsement request to an endorsement main body, and receiving an endorsement result returned by the endorsement main body, wherein the endorsement request comprises the user information, and the endorsement result is a result obtained by the endorsement main body in endorsement of the user information;

uploading the endorsement result to a federation blockchain according to the endorsement result, wherein the federation blockchain can be accessed by any cloud in the cloud federation.

10. The method of claim 9, wherein the endorsement agent comprises any cloud in a cloud federation or a third-party notarization authority.

11. The method according to claim 9 or 10, wherein the user information comprises one or more of a federation account number, a password, and a federation identification.

12. A cloud system, comprising: a plurality of computer devices, wherein each of the plurality of computer devices comprises a memory and a processor, a communication module coupled with the memory, wherein: the communication module is used for transmitting or receiving data transmitted from the outside, the memory is used for storing program codes, and the processor is used for calling the program codes stored in the memory to execute the method described in any one of claims 1-4.

13. A cloud system, comprising: a plurality of computer devices, wherein each of the plurality of computer devices comprises a memory and a processor, a communication module coupled with the memory, wherein: the communication module is used for transmitting or receiving data transmitted from outside, the memory is used for storing program codes, and the processor is used for calling the program codes stored in the memory to execute the method described in any one of claims 5-8.

14. A cloud system, comprising: a plurality of computer devices, wherein each of the plurality of computer devices comprises a memory and a processor, a communication module coupled with the memory, wherein: the communication module is used for transmitting or receiving data transmitted from outside, the memory is used for storing program codes, and the processor is used for calling the program codes stored in the memory to execute the method described in any one of claims 9-11.

15. A computer non-transitory storage medium including instructions that, when executed on a computer, cause the computer to perform the method of any one of claims 1-4.

16. A computer non-transitory storage medium including instructions that, when executed on a computer, cause the computer to perform the method of any one of claims 5-8.

17. A computer non-transitory storage medium including instructions that, when executed on a computer, cause the computer to perform the method of any one of claims 9-11.

Images