TWI825525B - Identity and access management system and method for multi-cloud integrated application service and computer readable medium therefor - Google Patents

Abstract

The invention discloses an identity and access management system and method for multi-cloud integrated application service and computer readable medium therefor, which provides management services of multiple public clouds, provides an integrated service portal for managing life cycle management of multiple public cloud services or resources, and provides a user graphical management interface to analyze information of multiple public clouds. Further, a user identity and access management microservice performs life cycle management of accounts of a first user end and second user ends, a multi-cloud application authentication management microservice integrates a core authentication mechanism of the first user end, the second user ends, a multi-cloud service management application unit, a public cloud resource management application unit and a multi-cloud monitoring application unit based on an open authorization framework, and a multi-cloud monitoring application interface proxy microservice provides a consistent proxy interface, so that the user identification and access management microservice interfaces with a proxy of the multi-cloud monitoring application unit.

Description

Identity identification and access control system, method and computer-readable medium for multi-cloud integrated application services

The present invention relates to an identity recognition and access control technology, and in particular, to an identity recognition and access control system and method for multi-cloud integrated application services and a computer-readable medium thereof.

Multi-cloud customer security management technology is the core function of cloud systems. In particular, multi-cloud identity identification and access control systems that integrate multiple application services are more important. However, most of the existing technologies are concentrated in the cloud service field of a single public cloud or private cloud.

In addition, the cooperation model of cloud services, public cloud integration and agency is a market that the global information and communication technology industry attaches great importance to. As the global public cloud market is occupied by the three major public clouds, such as Amazon Web Service (AWS), Microsoft Azure, and Google Public clouds such as Cloud Platform (GCP) and public cloud customers using two or more public cloud services at the same time are also growing rapidly, making the development of multi-cloud management technology more urgent and necessary.

The existing technology proposes a multi-tenant oriented identity hosting authentication cloud resource access The control system and control method divide the cloud service business of the cloud service provider into the identity authentication and permission part and the cloud resource access control part. The business of the identity authentication and permission part is entrusted to a trusted third party of the cloud service, and is managed by the third party. The manufacturer is responsible for managing the user information and group information hosted by the tenant.

However, the identity recognition function of this existing technology can only support multi-tenants of a single cloud service provider, so it cannot meet the management functions of multiple public clouds, and it also lacks effective hierarchical users (such as root users and sub-users). management mechanism. In addition, after identity permission, the user operation service module of this prior art groups multiple tenants. Users in the same user group have the same resource operation permissions, but cannot effectively ensure the use of the user's role access permission control. situation, it cannot satisfy the usage function of a user with multiple role access rights.

Therefore, how to provide an innovative identity recognition and access control technology to solve any of the above problems or provide related functions (technology/services) has become a major research topic for those skilled in the field.

The present invention provides an innovative multi-cloud integrated application service identity recognition and access management and control system, method and computer-readable medium. It provides a set of integrated identity recognition technology, access authority management and control technology and multiple types of multi-cloud management services in the field of multi-cloud management services. The mechanism of heterogeneous application units (such as multi-cloud service management application units, public cloud resource management application units, multi-cloud monitoring application units), or the use of identity recognition technology based on an open authorization framework to design account synchronization and authentication procedures for multiple heterogeneous application units Integration mechanism, or the root user (root user) creates and manages the information of multiple groups of sub-users through user management technology, or assigns information to sub-users (sub-users) through access control technology Appropriate operating permissions.

The identity identification and access management and control system of multi-cloud integrated application services of the present invention includes: a multi-cloud service management application unit, a public cloud resource management application unit and a multi-cloud monitoring application unit. The multi-cloud service management application unit provides a plurality of public As a cloud management service, the public cloud resource management application unit provides an integrated service portal for life cycle management of multiple public cloud services or resources in multiple public clouds, and the multi-cloud monitoring application unit provides a user graphical management interface to For analyzing resource usage, resource performance or abnormal status on multiple public clouds; and a multi-cloud identity identification and access management subsystem, which has a user identity and access management microservice and a multi-cloud application authentication management Microservices and a multi-cloud monitoring application interface agent microservice. Among them, the user identity identification and access management microservice performs life cycle management of accounts on the first user side and the second user side, and the multi-cloud application authentication management microservice The service is based on the open authorization framework and integrates the core authentication mechanism of the first user end, the second user end, the multi-cloud service management application unit, the public cloud resource management application unit and the multi-cloud monitoring application unit, and the multi-cloud monitoring application interface agent microservice system Provide a consistent proxy interface for user identification and access management microservices and proxy interfaces with multi-cloud monitoring application units.

The identity identification and access control method of multi-cloud integrated application services of the present invention includes: providing a multi-cloud service management application unit, a public cloud resource management application unit, a multi-cloud monitoring application unit and a multi-cloud identity identification and access control subsystem, and the multi-cloud identity identification and access management subsystem has a user identity identification and access management microservice, a multi-cloud application authentication management microservice and a multi-cloud monitoring application interface agent microservice; the multi-cloud service management application The unit provides management services for multiple public clouds. The public cloud resource management application unit provides an integrated service portal for life cycle management of multiple public cloud services or resources of multiple public clouds. The multi-cloud monitoring application unit provides users with Graphical management interface for analyzing resource usage, resource performance or abnormal status on multiple public clouds; and user identification and access management microservices to execute the account life of the first user and the second user. Cycle management, consisting of multiple The cloud application authentication management microservice integrates the core authentication mechanisms of the first user end, the second user end, the multi-cloud service management application unit, the public cloud resource management application unit and the multi-cloud monitoring application unit based on the open authorization framework, and is controlled by the multi-cloud monitoring application The interface proxy microservice provides a consistent proxy interface for user identification and access management microservices and proxy interfaces with multi-cloud monitoring application units.

The computer-readable medium of the present invention is used in a computing device or computer and stores instructions to execute the identity identification and access control method of the multi-cloud integrated application service.

In order to make the above-mentioned features and advantages of the present invention more obvious and easy to understand, embodiments are given below and explained in detail with reference to the accompanying drawings. Additional features and advantages of the invention will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the invention. It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not intended to limit the scope of the invention.

1: Identity identification and access control system for multi-cloud integrated application services

10: Multi-cloud identity recognition and access control subsystem

11:User identity identification and access management microservices

12: Multi-cloud application authentication management microservices

13: Multi-cloud monitoring application interface proxy microservice

20:Multi-cloud service management application unit

30: Public cloud resource management application unit

40: Multi-cloud monitoring application unit

50: Public cloud interface proxy microservices

60: Management interface of external public cloud

A:Root client

B: Sub-user

B1: First sub-user

B2: Second sub-user

D: Relationship diagram of role operation permission data table structure

D1: Public cloud contract data sheet

D2: Root user data table

D3: Sub-user data table

D4: Sub-user role corresponding data table

D5: Sub-user role data table

D6: Sub-user access scope data table

D7: Data table corresponding to sub-user roles and access scopes

D8: Sub-user operation permission data table

D9: Data table corresponding to sub-user roles and operation permissions

S11 to S18: Steps

S21 to S28: Steps

S31 to S35: Steps

S41 to S55: Steps

Figure 1 is a schematic structural diagram of the identity recognition and access management and control system of multi-cloud integrated application services of the present invention.

FIG. 2 is a schematic flowchart of sub-user management in the identity identification and access control method of multi-cloud integrated application services of the present invention.

Figure 3 is a schematic diagram of the operation flow of multi-cloud authentication and authorization microservices in the identity identification and access management and control system and method of multi-cloud integrated application services of the present invention.

FIG. 4 is a diagram illustrating the structure of the role operation authority data table in the identity recognition and access management and control system and method of the multi-cloud integrated application service of the present invention.

Figure 5 is an embodiment flow chart of a multi-cloud service management application unit (or public cloud resource management application unit) related to multi-cloud authentication and authorization microservices in the identity identification and access management and control system and method of multi-cloud integrated application services of the present invention. .

6A to 6B are flow charts of an embodiment of a multi-cloud monitoring application unit related to multi-cloud authentication and authorization microservices in the identity identification and access management and control system and method of multi-cloud integrated application services of the present invention.

The following describes the embodiments of the present invention through specific specific embodiments. Those skilled in the art can understand other advantages and effects of the present invention from the content disclosed in this specification, and can also implement it through other different specific equivalent embodiments or Use.

Figure 1 is a schematic structural diagram of the identity recognition and access management and control system 1 for multi-cloud integrated application services of the present invention. As shown in the figure, in one embodiment, the identity recognition and access control system 1 of the multi-cloud integrated application service can be a multi-cloud management system, and mainly includes a multi-cloud identity recognition and access control subsystem 10 that is interconnected or communicates with each other. , at least one (such as plural) multi-cloud service management application unit 20, at least one (such as plural) public cloud resource management application unit 30, at least one (such as plural) multi-cloud monitoring application unit 40, and at least one (such as plural) public cloud interface The proxy microservice 50 can also further connect or communicate with the root user A (root user or first user), sub-user B (sub-user or second user) or the management interface 60 of an external public cloud. , and the multi-cloud identity identification and access management control subsystem 10 may have at least one (eg, plural) user identity identification and access management microservices 11, at least one (eg, plural) multi-cloud application authentication management microservices 12, and at least one ( As in the plural) multi-cloud monitoring application interface proxy microservices 13. It should be noted that the "plural" generation used in the present invention If there are more than two tables (such as two, three, four, ten or more than one hundred), "transduction" represents redirection, for example, the "transduction URL" represents a redirect URL.

In one embodiment, the user identity identification and access management microservice 11 may be a user identity identification and access management microservice software, a user identity identification and access management microservice program, etc., a multi-cloud application authentication management microservice 12 can be the multi-cloud application authentication management microservice software, multi-cloud application authentication management microservice program, etc. The multi-cloud monitoring application interface agent microservice 13 can be the multi-cloud monitoring application interface agent microservice software, multi-cloud monitoring application interface agent microservice program, etc. The multi-cloud service management application unit 20 may be multi-cloud service management application software, multi-cloud service management application, etc., the public cloud resource management application unit 30 may be public cloud resource management application software, public cloud resource management application, etc., and the multi-cloud monitoring application unit 40 It can be a multi-cloud monitoring application software, a multi-cloud monitoring application program, etc. The public cloud interface proxy microservice 50 can be a public cloud interface proxy microservice software, a public cloud interface proxy microservice program, etc. The root client (first user) A and the sub-user (second user) B can be the user or its user device, and the user device can be a computer (such as a personal computer/laptop/ Tablet computer), smart phone, smart watch, smart bracelet, etc., and the sub-user terminal (second user terminal) B can be the first sub-user terminal B1 in Figure 5 or Figure 6A to Figure 6B The second sub-user terminal B2. The electronic device can be a server (such as a cloud server), a computer (such as a cloud computer), a host (such as a cloud host), etc. However, the present invention is not limited thereto.

In one embodiment, the identity recognition and access control system 1 of multi-cloud integrated application services is constructed in at least one electronic device (not shown) with a processor or memory, so that the electronic device performs user identity recognition and storage. Management microservice 11, multi-cloud application authentication management microservice 12, multi-cloud monitoring application interface agent microservice 13, multi-cloud service management application unit 20, public cloud Resource management application unit 30, multi-cloud monitoring application unit 40, public cloud interface agent microservice 50, etc.

For example, the identity recognition and access management system 1 of the multi-cloud integrated application service can be deployed in at least one electronic device through clustered container technology, and can also integrate identity recognition technology (such as multi-cloud identity technology), storage technology in the scope of multi-cloud management services. Taking permission management and control technology and multiple heterogeneous application units (such as multi-cloud service management application unit 20, public cloud resource management application unit 30, multi-cloud monitoring application unit 40), the root user A (root user/first Integration mechanism of account synchronization and authentication procedures of user), sub-user B (sub-user/second user), multi-cloud service management application unit 20, public cloud resource management application unit 30, multi-cloud monitoring application unit 40, etc. . The three microservices of the multi-cloud identity identification and access management subsystem 10 (i.e., the user identity identification and access management microservice 11, the multi-cloud application authentication management microservice 12, and the multi-cloud monitoring application interface agent microservice 13) can communicate with each other or Work collaboratively to complete the integration mechanism of account synchronization and authentication procedures, and can also be responsible for access rights management and control technology.

The user identification and access management microservice 11 can be responsible for executing the account balance between the root user A (root user/first user) and the sub-user B (sub-user/second user). Life cycle management, users can also edit or change the account attributes of root user A (root user/first user) or sub-user B (sub-user/second user), and the user identity The identification and access management microservice 11 allows the root user A (root user/first user) to edit or change the access rights of the sub-user B (sub-user/second user). In addition, the user identity recognition and access management microservice 11 can provide secure login and logout functions for multi-cloud management service portals in the identity recognition process and authentication process, and can also play the role of a window for user interaction, and the user Identity and access management microservices 11 can be integrated with multi-cloud application authentication management microservices 12 and the multi-cloud monitoring application interface agent microservice 13 cooperate with each other to execute or complete the authentication process. The user identity identification and access management microservice 11 can be responsible for providing an interface for querying the access rights role and scope of sub-user B (sub-user/second user) in the access rights control program. For the multi-cloud service management application unit 20, the public cloud resource management application unit 30 and/or the multi-cloud monitoring application unit 40 to query the access rights role and scope of the sub-user B (sub-user/second user), and then based on The query results filter the access rights of sub-user B (sub-user/second user).

The multi-cloud application authentication management microservice 12 can integrate or extend the integration of root user A (root user/first user) and sub-user B (sub-user/first user) based on an open authorization framework (such as OAuth open authorization framework). Two users), the core authentication mechanism of the multi-cloud service management application unit 20, the public cloud resource management application unit 30 and the multi-cloud monitoring application unit 40. The multi-cloud monitoring application interface agent microservice 13 may be responsible for providing a consistent agent interface so that the user identity identification and access management microservice 11 can interface with the agent of the multi-cloud monitoring application unit 40 .

The multi-cloud service management application unit 20 can provide management services for a plurality of public clouds, such as optimization, knowledge management, security, asset management and other fields, applications or functions of a plurality of public clouds. The public cloud resource management application unit 30 can provide an integrated service portal for users to manage multiple public cloud services of multiple public clouds or life cycle management of resources (such as application, query, deletion and other functions of public cloud resources). The multi-cloud monitoring application unit 40 can provide a user graphical management interface to analyze resource usage, resource performance and/or abnormal status on multiple public clouds through the user graphical management interface. The public cloud interface proxy microservice 50 can provide a consistent proxy interface for the multi-cloud service management application unit 20, the public cloud resource management application unit 30 and/or the multi-cloud monitoring application unit 40 to communicate with external parties through the public cloud interface proxy microservice 50. The management interface 60 of the public cloud performs integration and interface.

The above-mentioned multi-cloud management service is an integrated management service that supports multiple public clouds, and public clouds can include but are not limited to Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). Therefore, the present invention can design or provide a set of integrated identity recognition technology (such as multi-cloud identity recognition technology), access permission management and control technology (role access control technology) and multiple heterogeneous application units (such as multi-cloud management service) in the field of multi-cloud management services. The mechanisms of the service management application unit 20, the public cloud resource management application unit 30, and the multi-cloud monitoring application unit 40) are provided to facilitate the provision of multi-cloud management services with the identity identification and access rights for managing and controlling users (such as multiple groups of users). In addition, the root user A (root user/first user) of the multi-cloud management service can pre-create and manage multiple groups of sub-users B (sub-users/second users) through user management technology. Information, and grant appropriate operation permissions to multiple groups of sub-users B (sub-users/second users) to satisfy service usage scenarios with multiple users.

The identity recognition technology of the present invention (such as multi-cloud identity recognition technology) can be extended to integrate multiple heterogeneous application units (such as multi-cloud service management application unit 20, public cloud resource management application unit 30, etc.) based on an open authorization framework (such as OAuth open authorization framework). The account synchronization and authentication process of the multi-cloud monitoring application unit 40) provides the sub-user B (sub-user/second user) with seamless switching between multiple heterogeneous application units, thereby improving user experience and usability. .

In addition, the access rights management and control technology of the present invention can grant access to multiple roles based on the root user A (root user/first user) to the sub-user B (sub-user/second user). Permissions (such as operating permissions for multi-cloud management services, access permissions for public cloud accounts, and role access permissions for public cloud resource management) are filtered and controlled to satisfy the root user A (root user/first user) ) and the operation of the complex group sub-user B (sub-user/second user) Security can also improve users’ business application flexibility.

FIG. 2 is a schematic flow diagram of sub-user management in the identity identification and access control method of multi-cloud integrated application services of the present invention, and refer to FIG. 1 for explanation. It should be noted that the user identity identification and access management microservice 11 of the multi-cloud identity identification and access management subsystem 10 can be responsible for the root user A (root user/th) in steps S11 to S18 of Figure 2 Life cycle management and access permission settings of user B (sub-user/second user) for user B (sub-user/second user).

As shown in FIG. 2 , in step S11 , the root user A (root user/first user) performs operations on the sub-user B (sub-user/first user) through the user identity identification and access management microservice 11 . The management of the second user) is to perform the management behavior of the sub-user B (sub-user/second user).

In step S12, when the management behavior of the sub-user B (sub-user/second user) is "delete", then proceed to step S13, and the root user A (root user/first user) ) deletes the information of sub-user B (sub-user/second user) through the user identity identification and access management microservice 11 (see step S13), for example, sub-user B (sub-user/second user) user) account, password or all information, and directly enter step S18 to complete it. When the management behavior of sub-user B (sub-user/second user) is "add or change", then proceed to step S14, root user A (root user/first user) Add, change or set the access rights of sub-user B (sub-user/second user) through the user identity identification and access management microservice 11 (see steps S14 to S17).

In step S14, when the root user A (root user/first user) sets the operation authority role of the sub-user B (sub-user/second user), the root user A (root user/first user) can set multiple sets of operation permission roles allowed by this sub-user B (sub-user/second user) through the user identity identification and access management microservice 11. Any one of the plurality of sets of operation authority roles includes operation authority for a plurality of functional items in the multi-cloud service management application unit 20 of the multi-cloud management service, the public cloud resource management application unit 30 and/or the multi-cloud monitoring application unit 40, and the operation authority roles The name can be, for example, Billing Manager (such as AWS Billing Manager), Monitoring Viewer (such as Azure Monitoring Viewer), or Support Center Viewer (such as GCP Support Center Viewer), etc. If the operation authority role of sub-user B (sub-user/second user) is not set in step 14, the root user A (root user/first user) can identify and save through user identity. Get the management microservice 11 and set the operation permission role of sub-user B (sub-user/second user) as a general viewer.

In step S15, the root user A (root user/first user) sets the sub-user B (sub-user/second user) through the user identity identification and access management microservice 11. Multiple public cloud accounts are allowed to be accessed, and multiple public cloud accounts are selected from the set of valid public cloud accounts of the public cloud service contract to which root user A (root user/first user) belongs.

In step S16, the root user A (root user/first user) can configure the sub-user B (sub-user/second user) through the user identity identification and access management microservice 11 The type of public cloud resource management that allows operation and management, that is, in the public cloud management application, the root user A (root user/first user) selects the type of public cloud resource that allows operation and management from the supported public cloud resource set. Public cloud resource type.

In step S17, after the root user A (root user/first user) completes setting the access rights of the sub-user B (sub-user/second user), the user identity is identified. The access management microservice 11 will create, add or change sub-user B (sub-user/second user) based on the management behavior (such as adding or changing) of sub-user B (sub-user/second user). second user) information.

Figure 3 is a schematic diagram of the operation flow of multi-cloud authentication and authorization microservices in the identity identification and access management and control system 1 and method of multi-cloud integrated application services of the present invention. It should be noted that since the operation processes of the multi-cloud service management application unit 20 and the public cloud resource management application unit 30 are the same or similar, only the multi-cloud service management application unit 20 is shown in FIG. 3 , but similarly, FIG. 3 can be The multi-cloud service management application unit 20 is replaced by the public cloud resource management application unit 30.

As shown in Figure 3, when sub-user B (sub-user/second user) initiates a request for the authentication process, the user identity identification and access management microservice 11, the multi-cloud application authentication management microservice 12 and the multi-cloud The monitoring application interface agent microservice 13 integrates the integration mechanism of the account synchronization and authentication procedures of the multi-cloud service management application unit 20, the public cloud resource management application unit 30 and the multi-cloud monitoring application unit 40, as well as the access rights control of the three. The timing of character acquisition.

In step S21, the sub-user B (sub-user/second user) initiates a request to log in to the user portal, and the login information of the sub-user B (sub-user/second user) is sent to the user The user identification and access management microservice 11 prepares the necessary parameters for the production of authentication tokens (such as JWT authentication tokens or JSON Web Tokens), and Send the necessary parameters of the authentication token (such as JWT authentication token) to the multi-cloud application authentication management microservice 12 to produce the authentication token (such as JWT authentication token), and then the multi-cloud application authentication management microservice 12 will authenticate The token (such as JWT authentication token) is verified and sent back to the sub-user B (sub-user/second user) for the sub-user B (sub-user/ The second user) uses the authentication token (such as JWT authentication token) to log in to the user portal.

In steps S22 to S23, when the sub-user B (sub-user/second user) completes logging in to the user portal, the multi-cloud service management application unit 20 or the public cloud resource management application unit 30 may identify the user's identity. Obtain the role access rights of this sub-user B (sub-user/second user) with the access management microservice 11, and sub-user B (sub-user/second user) can have the correct Access rights to successfully use the multi-cloud service management application unit 20 or the public cloud resource management application unit 30.

In step S24, when the sub-user B (sub-user/second user) wants to use the multi-cloud monitoring application unit 40, the user identity identification and access management microservice 11 can prepare the sub-user B ( Sub-user/second user) account to establish the required or related parameters, and then initiate the account synchronization mechanism of the multi-cloud application to the multi-cloud monitoring application unit 40. After the account synchronization mechanism is executed to complete the account synchronization, the sub-user will Terminal B (sub-user/second user) temporarily stores the authentication token (such as JWT authentication token) obtained in the above step S21.

In step S25, the multi-cloud monitoring application unit 40 initiates authentication (such as OAuth authentication) to the multi-cloud application authentication management microservice 12, so that the multi-cloud application authentication management microservice 12 confirms the legality of the multi-cloud monitoring application unit 40, and after the confirmation is completed After the validity of the multi-cloud monitoring application unit 40 is verified, the multi-cloud monitoring application unit 40 sends a redirection URL (ie, a redirect URL) to the sub-user B (sub-user/second user).

In step S26, the sub-user B (sub-user/second user) can use the temporarily stored authentication token (such as JWT authentication token) as identity recognition, and based on the obtained redirection URL (i.e. Redirect URL) and the temporarily stored authentication token (such as JWT authentication token) obtain the multi-cloud monitoring from the user identification and access management microservice 11 and the multi-cloud application authentication management microservice 12 The authorization code to which the control application unit 40 belongs.

In step S27, the user identity identification and access management microservice 11 can synchronize the account information and role access rights of the sub-user B (sub-user/second user) to the multi-cloud monitoring application unit 40 based on the authorization code. .

In step S28, after sub-user B (sub-user/second user) obtains correct account information and role access rights, the multi-cloud monitoring application unit 40 can be successfully used.

Figure 4 is a relationship diagram D showing the structure of the role operation authority data table in the identity recognition and access management and control system 1 of multi-cloud integrated application services and its method according to the present invention, and refer to Figure 1 for explanation. It should be noted that the relationship diagram D of this role operation authority data table structure can completely store the information required by the access control mechanism of the present invention, and can also explain the root user A (root user/first user), The association of sub-user B (sub-user/second user) with the data structure of sub-user roles and access rights.

The root user data table D2 records (stores) the information (if necessary information) of all root user A (root user/first user), and the public cloud contract data table D1 records (stores) the use of this root in the valid contract. The public cloud account associated with client A (root user/first user), and a root user record in the root user data table D2 can be related to multiple public cloud contract records in the public cloud contract data table D1 (i.e. 1 versus n; n represents a plural number). The root user A (root user/first user) can create multiple groups of information of the sub-user B (sub-user/second user) to record (store) the multi-cloud through the sub-user data table D3 Integrate the information (if necessary) of all or multiple groups of sub-users B (sub-users/second users) in the identity recognition and access control system 1 of the application service (such as a multi-cloud management system), and use the root A root user record in user data table D2 can be related to multiple sub-user records in sub-user data table D3 (i.e. 1 versus n).

As illustrated in Figure 2, when root user A (root user/first user) creates information about sub-user B (sub-user/second user), root user A (root user) user/first user) can set the role access rights of sub-user B (sub-user/second user) to correspond to the sub-user record in sub-user data table D3 through the sub-user role Data table D4 is related to multiple sub-user role records of sub-user role data table D5 (i.e. 1 versus n). The sub-user role data table D5 records (stores) the types of all sub-user roles in the identity identification and access management and control system 1 of the multi-cloud integrated application service (such as the multi-cloud management system), and the sub-user role data table D5 can also be based on Set the access permission type and then associate it.

If root user A (root user/first user) sets the access rights of sub-user B (sub-user/second user) to associate a public cloud account or set the available public cloud resource management type , then the sub-user access scope is recorded (stored) in the sub-user access scope data table D6, and the sub-user role and sub-user are recorded (stored) in the sub-user role and access scope corresponding data table D7 Access scope association. If root user A (root user/first user) sets the operation permission role of sub-user B (sub-user/second user), then sub-user B (sub-user/second user) will The operation authority role of the second user) is recorded (stored) in the sub-user operation authority data table D8, and the sub-user role and sub-user operation authority are recorded (stored) in the sub-user role and operation authority corresponding data table D9. association.

Figure 5 is a flow chart of an embodiment of the multi-cloud service management application unit 20 or the public cloud resource management application unit 30 related to multi-cloud authentication and authorization microservices in the identity identification and access management and control system 1 of multi-cloud integrated application services and its method according to the present invention. . It should be noted that since the operation processes of the multi-cloud service management application unit 20 and the public cloud resource management application unit 30 are the same or similar, only the multi-cloud service management application unit 20 is shown in FIG. 5 , but similarly, FIG. 5 cloudy The service management application unit 20 is replaced by the public cloud resource management application unit 30.

As shown in Figure 5, in step S31, the first sub-user B1 (first sub-user) uses its account (such as login account b1) and password (such as login password pd1) to log in to the multi-cloud integrated application service. Identification and access management system 1 (such as multi-cloud management system) user portal.

In step S32, when the first sub-user B1 (first sub-user) successfully logs into the user portal, the user identity identification and access management microservice 11 can obtain the multi-cloud application authentication management microservice 12. The authentication token (such as JWT authentication token or called the first authentication token) of the first sub-user B1 (the first sub-user) is used to issue or reply to the authentication token (such as JWT authentication token) to the third sub-user. One sub-user B1 (the first sub-user).

In step S33, the first sub-user B1 (first sub-user) wants to use the multi-cloud service management application unit 20 or the public cloud resource management application unit 30. For example, the first sub-user B1 (first sub-user) wants to use or view the asset management query function of the multi-cloud service management application unit 20 .

In step S34, the multi-cloud service management application unit 20 or the public cloud resource management application unit 30 queries the user identity identification and access management microservice 11 to obtain the role storage of the first sub-user B1 (first sub-user). Obtain permissions and confirm the role access permissions owned by the first sub-user B1 (first sub-user). Taking the asset management query function as an example, if the first sub-user B1 (first sub-user) does not have access rights to this role (such as the role of asset management viewer of the asset management query function), then the multi-cloud service management application The unit 20 or the public cloud resource management application unit 30 needs to block the first sub-user B1 (first sub-user) from querying the access rights (such as the asset management query function) of this role; also, if the first sub-user Terminal B1 (the first sub-user) does not have the access permission of the public cloud account, then the multi-cloud service management application unit 20 or the public cloud The resource management application unit 30 needs to filter the query or returned results according to the access range of the first sub-user B1 (first sub-user).

In step S35, if the first sub-user B1 (first sub-user) has access rights to this role (such as the role of asset management viewer of the asset management query function), then the multi-cloud service management application unit 20 or the public The cloud resource management application unit 30 successfully returns the filtered query results, that is, returns the results of the public cloud account with query authority to the first sub-user B1 (first sub-user).

6A to 6B are flow charts of embodiments of the multi-cloud monitoring application unit related to multi-cloud authentication and authorization microservices in the identity identification and access management and control system 1 of multi-cloud integrated application services and the method of the present invention, to illustrate the second sub-section. The process of identity recognition and role access rights control of the multi-cloud monitoring application unit 40 that the user B2 (the second sub-user) wants to use is explained with reference to Figure 1 .

As shown in Figure 6A, in step 41, the second sub-user B2 (second sub-user) uses its account (such as login account b2) and password (such as login password pd2) to log in to the identity recognition of the multi-cloud integrated application service User portal with access control system 1 (such as multi-cloud management system).

In step S42, when the first sub-user B1 (first sub-user) successfully logs into the user portal, the user identity identification and access management microservice 11 can obtain the multi-cloud application authentication management microservice 12. The authentication token (such as JWT authentication token or called the second authentication token) of the second sub-user B2 (second sub-user) is used to issue or reply to the authentication token (such as JWT authentication token) to the second sub-user B2. Second sub-user B2 (second sub-user).

In step S43 , the second sub-user B2 (second sub-user) sends the inspection request of the multi-cloud monitoring application unit 40 to the user identity identification and access management microservice 11 .

In step S44, the multi-cloud application authentication management microservice 12 queries the multi-cloud monitoring application unit 40 for the account of the second sub-user B2 (second sub-user) through the multi-cloud monitoring application interface proxy microservice 13. If the multi-cloud monitoring application unit 40 has not created an account of the second sub-user B2 (second sub-user), the account is created.

In step S45, the user identity recognition and access management microservice 11 temporarily stores the authentication token (such as JWT authentication token) obtained in the above step S42 to the second sub-user B2 (second sub-user B2) based on this account. user) local storage.

In step S46, use the account of the second sub-user B2 (second sub-user) to connect to the login URL of the multi-cloud monitoring application unit 40, for example, the login URL is https://aaa.bbb.ccc.com.tw/ login/generic_oauth.

In step S47, the multi-cloud monitoring application unit 40 initiates authentication (such as OAuth authentication) to the multi-cloud application authentication management microservice 12, so that the multi-cloud application authentication management microservice 12 confirms the legitimacy of the multi-cloud monitoring application unit 40 and completes the authentication (such as OAuth authentication). certification).

As shown in FIG. 6B , in step S48 , the multi-cloud monitoring application unit 40 uses a redirection URL technology (such as the HTTP 301 redirection URL technology) to entrain a redirection URL (such as a dedicated redirection URL) to reply to the redirection URL. The second sub-user B2 (second sub-user).

In step S49, the temporarily stored authentication token (such as JWT authentication token) is retrieved from the local storage of the second sub-user B2 (second sub-user), and then the temporarily stored authentication token is cleared from the local storage. (Such as JWT authentication token).

In step S50, the second sub-user B2 (second sub-user) authenticates the multi-cloud application management microservice 12 according to the redirection URL (such as a dedicated redirection URL) carried by the multi-cloud monitoring application unit 40 in step S48. Obtain the authorization code of the multi-cloud monitoring application unit 40.

In step S51, use the account of the second sub-user B2 (second sub-user) to connect to the login URL of the multi-cloud monitoring application unit 40 again, and entrain the second sub-user B2 (second sub-user). The account number and authorization code are sent to the multi-cloud monitoring application unit 40.

In step S52, the multi-cloud monitoring application unit 40 verifies the authorization code of the second sub-user B2 (second sub-user).

In step S53, after successfully verifying the authorization code of the second sub-user B2 (second sub-user), the multi-cloud monitoring application unit 40 obtains and confirms the second sub-user from the user identity identification and access management microservice 11. User B2 (the second sub-user) has role access rights.

In step S54, the multi-cloud monitoring application unit 40 confirms that the second sub-user B2 (second sub-user) has the role of multi-cloud monitoring viewer.

In step S55, after successfully verifying or confirming that the second sub-user B2 (second sub-user) has the role of multi-cloud monitoring viewer, the information of the multi-cloud monitoring application unit 40 will be successfully returned to the second sub-user. Terminal B2 (second sub-user).

In addition, the present invention also provides a computer-readable medium for identity recognition and access control methods of multi-cloud integrated application services, which is applied to a computing device or computer with a processor and/or memory, and the computer-readable medium Instructions are stored and can be executed by a computing device or computer through a processor and/or memory to execute the above content when the computer-readable medium is executed.

In one embodiment, the processor may be a microprocessor, a central processing unit (CPU), a graphics processing unit (GPU), etc., and the memory may be a random access memory (RAM), a memory card, a hard disk (such as a cloud /network hard drive), database, etc., but not limited to this.

In summary, the identity recognition and access management and control system of the multi-cloud integrated application service of the present invention The system, method and computer-readable medium thereof shall have at least the following features, advantages or technical effects.

1. The present invention can design or provide a set of integrated identity recognition technology (such as multi-cloud identity recognition technology), access rights management and control technology (role access management and control technology) and multiple heterogeneous application units (such as multi-cloud) in the field of multi-cloud management services. Service management application unit, public cloud resource management application unit, multi-cloud monitoring application unit) mechanism to facilitate the provision of multi-cloud management services with the ability to manage and control the identity and access rights of users (such as multiple groups of users).

2. The root user (root user/first user) of the multi-cloud management service of the present invention can pre-create and manage multiple groups of sub-users (sub-users/second users) through user management technology. information, and grant appropriate operation permissions to sub-users (sub-users/second users) to meet service usage scenarios with multiple users.

3. The present invention can provide the root user (root user/first user) with sub-user management technology in the multi-cloud management service, so as to facilitate the root user (root user/first user) to the user. Create, change or delete the information of the sub-user (sub-user/second user) in the user management function of the portal.

4. The root user (root user/first user) of the present invention can set the sub-user (sub-user/second user) to have multiple sets of public cloud account access roles, and can also set up the root user. A plurality of sets of public cloud accounts that are allowed to be accessed are selected from the set of valid public cloud accounts recorded in the public cloud service contract to which the user (root user/first user) belongs, in order to make the plurality of sets of public cloud accounts that are allowed to be accessed public The cloud account is set to the public cloud account access role.

5. The root client (root user/first user) of the present invention can set the sub-user (sub-user/second user) to have the public cloud resource management role, and can also set up the public cloud resource management role from the supported public cloud. Select the public cloud resource type that allows operation and management in the resource collection to configure it to the public cloud in resource management roles.

6. When creating the information of the sub-user (sub-user/second user) in this invention, you can select the role permissions that need to be given to the sub-user (sub-user/second user), and the attributes of the role include The operation permissions of the multi-cloud management service, the access permissions of the public cloud account and/or the management of public cloud resources. When changing the information of the sub-user (sub-user/second user), the sub-user (sub-user/second user) can also be changed. The role permissions currently possessed by the sub-user/secondary user).

7. The present invention can adopt a hierarchical user (such as root user and sub-user) management mechanism, and the root user (root user/first user) can set sub-users (sub-user/ The second user) has a plurality of groups of operation authority roles. Any one of the plurality of groups of operation authority roles includes a plurality of functional items among the multi-cloud service management application unit, the multi-cloud monitoring application unit and the public cloud resource management application unit of the multi-cloud management service. Operation permission.

8. When the sub-user (sub-user/second user) logs into the user portal, the present invention can use the access authority control technology to obtain the information possessed by the sub-user (sub-user/second user). For an operation authority role, only the functional items that this operation authority role has are displayed in the user portal. Operations and access to function items that do not have this operation authority role can be filtered and blocked.

9. When the sub-user (sub-user/second user) logs in to the user portal, the present invention can use the access authority control technology to obtain the permissions of the sub-user (sub-user/second user). Get the scope of the public cloud account or the type of public cloud resource to filter and block resource access and operations that do not have the access permission scope or resource type of the public cloud account.

10. The present invention can use identity recognition technology (such as multi-cloud identity recognition technology) based on an open authorization framework (such as OAuth open authorization framework) to design the same account number for multiple heterogeneous application units. An integration mechanism with the authentication process so that the root user (root user/first user) or sub-user (sub-user/second user) can quickly or conveniently log in at the user portal. Seamless switching between multiple heterogeneous application units such as multi-cloud service management application unit, multi-cloud monitoring application unit and public cloud resource management application unit.

The above embodiments are only illustrative of the principles, characteristics and effects of the present invention, and are not intended to limit the scope of the present invention. Anyone skilled in the art can make the above-mentioned modifications without violating the spirit and scope of the present invention. Modify and change the implementation form. Any equivalent changes and modifications made using the contents disclosed in the present invention shall still be covered by the patent application. Therefore, the protection scope of the present invention should be as listed in the patent application scope.

1: Identity identification and access control system for multi-cloud integrated application services

10: Multi-cloud identity recognition and access control subsystem

11:User identity identification and access management microservices

12: Multi-cloud application authentication management microservices

13: Multi-cloud monitoring application interface proxy microservice

20:Multi-cloud service management application unit

30: Public cloud resource management application unit

40: Multi-cloud monitoring application unit

50: Public cloud interface proxy microservices

60: Management interface of external public cloud

A:Root client

B: Sub-user

Claims (15)

An identity recognition and access management and control system for multi-cloud integrated application services, including: one of a plurality of heterogeneous application units, a multi-cloud service management application unit, which provides management services of a plurality of public clouds; one of the plurality of heterogeneous application units The public cloud resource management application unit provides an integrated service portal for life cycle management of a plurality of public cloud services or resources of the plurality of public clouds; a multi-cloud monitoring application unit, one of the plurality of heterogeneous application units, provides A user graphical management interface for analyzing resource usage, resource performance or abnormal status on the plurality of public clouds; and a multi-cloud identity identification and access management subsystem with a user identity and access management micro-system. service, a multi-cloud application authentication management microservice and a multi-cloud monitoring application interface proxy microservice, wherein the user identity identification and access management microservice of the multi-cloud identity identification and access management control subsystem performs the first use The life cycle management of the accounts of the client and the second user. The multi-cloud application authentication management microservice of the multi-cloud identity identification and access control subsystem is based on the open authorization framework to jointly integrate the first user and the second user. The core authentication mechanism of the user, the multi-cloud service management application unit, the public cloud resource management application unit and the multi-cloud monitoring application unit with the user graphical management interface, and the multi-cloud identity identification and access control sub-unit The multi-cloud monitoring application interface agent microservice of the system provides a consistent first agent interface for the user identification and access management microservices and the plurality of heterogeneous application units with the user graphical management interface. The proxy interface of the multi-cloud monitoring application unit, Among them, the user identity identification and access management microservice of the multi-cloud identity identification and access control subsystem, the multi-cloud application authentication management microservice and the multi-cloud monitoring application interface agent microservice jointly integrate the plurality of heterogeneous application units The account synchronization and authentication process mechanism of the multi-cloud service management application unit, the public cloud resource management application unit and the multi-cloud monitoring application unit with the user graphical management interface is provided for the first user or The second user terminal is seamless between the multi-cloud service management application unit of the plurality of heterogeneous application units, the public cloud resource management application unit and the multi-cloud monitoring application unit with the user graphical management interface Switching is used, wherein the user identity identification and access management microservice of the multi-cloud identity identification and access control subsystem, the multi-cloud application authentication management microservice and the multi-cloud monitoring application interface agent microservice can be integrated for the third One user or the second user can seamlessly switch between the multi-cloud service management application unit, the public cloud resource management application unit and the multi-cloud with the user graphical management interface among the plurality of heterogeneous application units. Monitor the access rights control role acquisition opportunities of the three application units. The identity recognition and access control system as described in claim 1 further includes a public cloud interface proxy microservice that provides a consistent second proxy interface for the multi-cloud service management application unit and the public cloud resource management application. The unit or the multi-cloud monitoring application unit proxies microservices through the public cloud interface to integrate and interface with the management interface of the external public cloud. The identity recognition and access management and control system as described in claim 1, wherein the user identity recognition and access management microservice provides secure login and logout of multi-cloud management service portals in the identity recognition process and authentication process. function, and the user identity identification and access management microservice cooperates with the multi-cloud application authentication management microservice and the multi-cloud monitoring application interface proxy microservice to execute the authentication process. The identity recognition and access control system as described in claim 1, wherein the user identity recognition and access management microservice provides an interface in the access rights control program for the multi-cloud service management application unit, The public cloud resource management application unit or the multi-cloud monitoring application unit queries the access rights role and scope of the second user, and then filters the access rights of the second user. The identity recognition and access management control system as described in claim 1, wherein the first user terminal executes the management behavior of the second user terminal through the user identity recognition and access management microservice, so that the The first user deletes, adds, changes or sets the information or access rights of the second user through the user identification and access management microservice. The identity recognition and access control system as described in claim 1, wherein when the first user sets the operation authority role of the second user, the first user uses the user identity recognition and The access management microservice sets a plurality of sets of operation permission roles allowed by the second user. The identity recognition and access control system as described in claim 1, wherein the first user sets a plurality of public objects that the second user can access through the user identity and access management microservice. cloud account, and select the plurality of public cloud accounts from the set of valid public cloud accounts of the public cloud service contract to which the first user belongs. An identity identification and access control method for multi-cloud integrated application services, including: providing a plurality of heterogeneous application units and a multi-cloud identity identification and access control subsystem, wherein the plurality of heterogeneous application units include a multi-cloud service Management application unit, a public cloud resource management application unit and a multi-cloud monitoring application unit, and the multi-cloud identity identification and access management control subsystem has a user identity identification and access management microservice, a multi-cloud application authentication management microservice Services and a multi-cloud monitoring application interface proxy microservice; The multi-cloud service management application unit of the heterogeneous application units provides management services of a plurality of public clouds, and the public cloud resource management application unit of the heterogeneous application units provides an integrated service portal to perform the plurality of heterogeneous application units. Life cycle management of multiple public cloud services or resources in the public cloud, and the multi-cloud monitoring application unit of the multiple heterogeneous application units provides a user graphical management interface for analyzing resource utilization on the multiple public clouds, Resource performance or abnormal status; and the user identity and access management microservice of the multi-cloud identity and access management subsystem performs life cycle management of the accounts of the first user and the second user, by The multi-cloud application authentication management microservice of the multi-cloud identity recognition and access control subsystem jointly integrates the first user end, the second user end, the multi-cloud service management application unit, and the public cloud resource management based on an open authorization framework The core authentication mechanism between the application unit and the multi-cloud monitoring application unit with the user graphical management interface, and the consistency is provided by the multi-cloud monitoring application interface proxy microservice of the multi-cloud identity and access control subsystem An agent interface is provided for the user identification and access management microservice to interface with the agent of the multi-cloud monitoring application unit having the user graphical management interface of the plurality of heterogeneous application units, wherein the multi-cloud identification The multi-cloud service management application of the plurality of heterogeneous application units is integrated with the user identification and access management microservice of the access control subsystem, the multi-cloud application authentication management microservice and the multi-cloud monitoring application interface agent microservice. The account synchronization and authentication process mechanism of the three units, the public cloud resource management application unit and the multi-cloud monitoring application unit with the user graphical management interface, for the first user or the second user Seamlessly switch between the multi-cloud service management application unit of the plurality of heterogeneous application units, the public cloud resource management application unit and the multi-cloud monitoring application unit with the user graphical management interface, Among them, the user identity identification and access management microservice of the multi-cloud identity identification and access control subsystem, the multi-cloud application authentication management microservice and the multi-cloud monitoring application interface agent microservice are jointly integrated to provide the first user The multi-cloud service management application unit, the public cloud resource management application unit and the multi-cloud monitoring application unit with the user graphical management interface are seamlessly switched between the plurality of heterogeneous application units used by the terminal or the second user terminal. The timing of obtaining the role of the three access rights control. The identity identification and access control method described in claim 8 further includes that when one of the second users successfully logs into the user portal, the user identity and access management microservice obtains the multi-cloud application authentication management The authentication token of the second user generated by the microservice is used to issue or reply the authentication token to the second user, and when the second user When a user wants to use the multi-cloud service management application unit or the public cloud resource management application unit, the multi-cloud service management application unit or the public cloud resource management application unit queries the user identity identification and access management microservice to confirm the second The role access rights possessed by the user on the user side. The identity identification and access control method described in claim 9 further includes: if the person on the second user terminal does not have access rights to the role, the multi-cloud service management application unit or the public cloud resource management application unit Block the user of the second user from querying the access permission of the role, and if the user of the second user does not have the access scope permission of the public cloud account, the multi-cloud service management application unit or the The public cloud resource management application unit filters the query results according to the access scope of the second user. The identity identification and access control method described in claim 8 further includes that when one of the second users successfully logs into the user portal, the user identity identification and access management microservice obtains the multi-cloud application authentication management microservice. The authentication token of the other party of the second user side generated by the service, so as to issue or reply the authentication token to the other side of the second user side, and then The multi-cloud application authentication management microservice establishes the account of the other party of the second user to the multi-cloud monitoring application unit through the multi-cloud monitoring application interface proxy microservice, so that the user identity identification and access management microservice The service temporarily saves the authentication token to the other's local storage of the second user according to the account. The identity identification and access control method as described in claim 8 further includes recording the information of the first user through a first user data table, and recording the first user in the valid contract through a public cloud contract data table. The public cloud account associated with the user then associates a first user record in the first user data table to a plurality of public cloud contract records in the public cloud contract data table. The identity identification and access control method as described in claim 8 further includes creating a plurality of sets of second user information by the first user, so as to record the plurality of second sets of information in the second user data table. Information on the user side, and associates a first user record in the first user data table to a plurality of second user records in the second user data table. The identity identification and access control method as described in claim 8 further includes when the first user creates the information of the second user, the first user sets the role of the second user. Access rights are provided to associate a second user record in the second user data table to a plurality of second user role records in the second user role data table through the second user role corresponding data table. A computer-readable medium, used in a computing device or computer, stores instructions to execute the identity identification and access control method of multi-cloud integrated application services as described in any one of claims 8 to 14.

Images