WO2013163944A1 - Iaas service cloud account sharing method, sharing platform and network device - Google Patents

Abstract

Provided is an IaaS (Infrastructure as a Service) service cloud account sharing method, comprising: saving at least one cloud account used to access an infrastructure cloud providing the IaaS service, the cloud account being the cloud account of a first user; creating for a second user an account for a second user client terminal to access a sharing platform; according to the associative relationship between the first user and the second user, specifying for the second user at least one first user cloud account as an access account for the second user to access the infrastructure cloud providing the IaaS service, such that the second user client terminal, according to the account accessing the sharing platform and the access account, accesses the infrastructure cloud providing the IaaS service and corresponding to the access account. Therefore, the second user can use the cloud account registered for the first user, thus achieving cloud account sharing between users.

Description

 The invention relates to a method for sharing an IaaS service cloud account, and a sharing platform and a network device. The application requires that the application number submitted on May 4, 2012 is 201210137495.3, and the invention name is "a method for sharing an IaaS service cloud account, and a sharing platform. The priority of the Chinese Patent Application, the entire disclosure of which is incorporated herein by reference. Technical field

 The embodiments of the present invention relate to the field of communications technologies, and in particular, to a method for sharing an IaaS service cloud account, a sharing platform, and a network device. Background technique

 Cloud computing allocates resources according to user needs. According to user charges, users do not need to purchase hardware and software. All software and hardware resource requirements can be met by remote access using the software provider's hardware and software. Through the shared use of resources, resource utilization can be improved, and the cost of use and maintenance costs can be reduced.

 Infrastructure as a Service (IAAS) is a typical application mode of cloud computing. In this application mode, the most typical resource representation is Virtual Machines (VM), which virtualizes hardware resources. A virtual machine that provides the required capabilities according to user requirements, so that one hardware can provide services for multiple users, improving the utilization of hardware resources. Storage capacity is another common form of resource representation.

In the process of implementing the present invention, the inventors found that the prior art has the following drawbacks: In actual use, each user applying for a cloud account is a very cumbersome process, and the user experience is not good. Secondly, for group users such as enterprises, if multiple people share account usage, it is difficult to control the rights. If each person in the enterprise applies for an account, charging and VM control are more difficult. Summary of the invention

 Embodiments of the present invention provide a method for sharing an IaaS service cloud account, a sharing platform, and a network device, so as to share a cloud account between multiple users. An embodiment of the present invention provides a method for sharing an infrastructure as a service cloud account for an IaaS service, including:

 And storing at least one cloud account for accessing an infrastructure cloud providing the IaaS service, where the cloud account is a cloud account of the first user;

 Creating a second user client accessing the account of the sharing platform for the second user;

 Assigning at least one cloud account of the first user to the second user as the second user accessing the infrastructure cloud providing the IaaS service according to the association relationship between the first user and the second user Entering an account, so that the client of the second user accesses the infrastructure cloud that provides the IaaS service corresponding to the access account according to the account of the access sharing platform and the access account.

 An embodiment of the present invention provides a shared platform, which is a shared platform for serving an IaaS service cloud account, and includes:

 The first storage unit 52 is configured to save at least one cloud account for accessing the infrastructure cloud that provides the IaaS service, as the cloud account of the first user, and also used to save the second user identifier and the access account. Correspondence relationship;

 The first processing unit 51 is configured to create an account for the second user to access the shared platform, and the account of the access sharing platform includes the identifier of the second user; according to the association between the first user and the second user a relationship, the at least one cloud account of the first user is designated as the access account of the second user accessing the infrastructure cloud of the IaaS service, so that the client of the second user is configured according to The account of the access sharing platform and the access account access the infrastructure cloud that provides the IaaS service corresponding to the access account.

According to the technical solution disclosed in the embodiment of the present invention, after the cloud account is registered for the first user, the cloud account registered by the first user may be designated as the first according to the association relationship between the first user and the second user. The second user accesses the access account of the infrastructure cloud that provides the IaaS service, thereby using the second The user can use the cloud account registered for the first user to realize the sharing of the cloud account between the users. DRAWINGS

 In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief description of the drawings used in the embodiments or the prior art description will be briefly described below. Obviously, the drawings in the following description It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work.

 1 is a flow chart of a method for sharing an infrastructure as a method for serving an IaaS service cloud account;

 2 is a flowchart of an embodiment of a method for creating a virtual machine according to an embodiment of the present invention;

 3 is a flowchart of an embodiment of implementing a cloud storage method according to an embodiment of the present invention;

 4 is a schematic structural diagram of a system for sharing an infrastructure as a service cloud account for an IaaS service according to the present invention;

 FIG. 5 is a schematic structural diagram of a shared infrastructure as a shared platform for serving IaaS service cloud accounts according to the present invention. detailed description

 The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is a partial embodiment of the invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

 FIG. 1 is a flowchart of a method for sharing an infrastructure as a method for serving an IaaS service cloud account. As shown in FIG. 1, the method may include:

101. Save at least one cloud account for accessing an infrastructure cloud that provides an IaaS service, where the cloud account is a cloud account of the first user; The cloud account described in the embodiment of the present invention is an account that is applied to the IaaS service provider to access and use the IaaS service, and may include a username, a password, and/or a related access authentication key (such as an Access Key, Secret Access Key) and so on.

 At least one cloud account here includes the following meanings: One or more cloud accounts that are saved are used to access an infrastructure cloud that provides IaaS services, including user names and authentication information, that is, cloud accounts and IaaS services. The relationship of infrastructure clouds is a many-to-one relationship.

 The cloud account that is used to access the infrastructure cloud of the IaaS service may be included in the following two implementation manners:

 1. The sharing platform receives the cloud account creation request sent by the first user client, and applies, according to the cloud account creation request, the first user to the infrastructure cloud that provides the IaaS service to apply for at least one infrastructure cloud for accessing the IaaS service. Cloud account, and save the cloud account;

 2. The sharing platform receives and saves at least one cloud account registered by the first user, and the cloud account is obtained by the first user from the infrastructure cloud that provides the IaaS service. The registration here means that the first user provides the cloud account information owned by the first user to the sharing platform according to the format of the shared platform.

 102. Create, for the second user, an account of the second user client accessing the sharing platform;

 103. Specify, according to the association relationship between the first user and the second user, the cloud account of the at least one first user for the second user as the infrastructure cloud of the second user accessing the IaaS service. Entering an account, so that the client of the second user accesses the infrastructure cloud that provides the IaaS service corresponding to the access account according to the account of the access sharing platform and the access account.

The association relationship between the first user and the second user in the embodiment of the present invention may be any relationship that the first user agrees to authorize the second user to use the cloud account, where the first user may be the operator or manager of the shared platform. , or a third-party company, or an individual, the second user can be an individual. The association relationship embodies an association between the first user and the second user, which may be a correspondence relationship table, that is, an association relationship table. The association table may be stored in a shared platform, or may be stored on a separate storage device. For example, after the second user logs in to the shared platform, the IaaS service object operation request is sent, or the shared platform creates an access for the second user. After sharing the account of the platform, by sharing The platform queries the association relationship table to specify the access account for the second user.

 Of course, the foregoing association relationship can be saved on the shared platform, and can be queried when needed. Of course, the association relationship can also be saved on the client of the first user, and the shared platform goes to the client of the first user when needed. Get it, etc.

 Assigning, by the second user, at least one of the cloud accounts registered for the first user as the access account of the second user to access the infrastructure cloud providing the IaaS service may include the following situations:

 1. Receiving, by the client of the second user, an operation request of the IaaS service object sent after the account is logged in based on the account of the access sharing platform, according to the association relationship, specifying at least one of the registrations for the second user. The cloud account serves as the second user accessing the access account of the infrastructure cloud that provides the IaaS service.

 Specifically, the client receiving the second user specifies an access account for the second user that sends the operation request of the IaaS service object after the operation request of the IaaS service object sent after the account is logged in according to the account of the access sharing platform. .

 Or,

 2. When the client of the second user is created to access the account of the shared platform for the second user, at least one of the registered cloud accounts is designated as the second user for the second user according to the association relationship. Enter the access account of the infrastructure cloud that provides IaaS services;

 Or,

 After the second user subscribes to the IaaS service to the sharing platform, according to the association relationship, at least one cloud account of the first user is specified as the second user accessing the second user.

The access account of the infrastructure cloud of the IaaS service.

 After the access account of the infrastructure cloud that provides the IaaS service is specified, the corresponding relationship between the second user identifier and the access account may be saved for subsequent use.

After the access account is specified for the second user, the sharing platform encapsulates the IaaS service object operation according to the message format of the infrastructure cloud that provides the IaaS service corresponding to the specified access account. And requesting, by the infrastructure cloud that provides the laaS service corresponding to the access account, the encapsulated LAAS service object operation request; the infrastructure cloud that provides the laaS service corresponding to the access account is configured according to the encapsulated laaS service The object operation request returns a response message to the shared platform; the sharing platform receives the response message sent by the infrastructure cloud that provides the laaS service corresponding to the access account, and encapsulates the response message, and sends the response message to the client of the second user. Encapsulated response message.

 In the present invention, the response message includes a laaS service object returned by the infrastructure cloud providing the laaS service, and the laaS service object is a target object provided by the infrastructure cloud of the laaS service for the user to perform the operation remotely. The laaS business object includes, but is not limited to, one or more of a virtual machine, a security group, a key pair, a storage object, and the like.

 This embodiment is a scheme written from the shared platform side. According to the technical solution disclosed by the embodiment of the present invention, after the cloud account is registered for the first user, the cloud account registered by the first user may be designated as the first according to the association relationship between the first user and the second user. The second user accesses the access account of the infrastructure cloud that provides the laaS service, so that the second user can use the cloud account registered for the first user to realize the sharing of the cloud account between the users.

 The method may further include setting an operation authority for the second user, that is, setting an operation authority for the second user corresponding to the identifier of the second user, and further saving the operation authority set for the user in the bdfgh. The method further includes: after receiving an operation request of the laaS service object sent by the client of the second user after the account is logged in based on the account of the access sharing platform, according to the operation set by the user corresponding to the second user identifier Determining, by the authority, whether the user corresponding to the second user identifier has the right to perform the operation request on the laaS service object, and determining that the user corresponding to the second user identifier has the authority corresponding to executing the operation request Performing a subsequent operation, the subsequent operation, for example, may encapsulate the LAAS service object operation request according to the message format of the infrastructure cloud providing the laaS service corresponding to the specified access account, and corresponding to the access account The infrastructure cloud providing the laaS service sends the encapsulated laaS business object operation request.

When the operation authority is not set for the second user, the client that receives the second user sends After the operation request of the IaaS service object is sent, the user corresponding to the operation request of the IaaS service object may not be determined, and the client receiving the second user is based on the access sharing platform. After the operation request of the IaaS business object sent after the account is logged in, the subsequent operation is directly performed.

 After transmitting the encapsulated IaaS service object operation request to the infrastructure cloud that provides the IaaS service corresponding to the access account, the method further includes receiving an infrastructure cloud providing the IaaS service corresponding to the access account. The encapsulated IaaS service object operates to send a response message to the request; and further encapsulates the response message, and sends the encapsulated response message to the second user's client. After receiving the response message sent by the infrastructure cloud providing the IaaS service corresponding to the access account according to the encapsulated IaaS service object operation request, the method further parses the response message to obtain a success or failure. The operation result information is saved, and the operation result information is saved in the sharing platform, so as to provide a reference for the second user to determine the infrastructure cloud that provides the IaaS service corresponding to the access account.

 The foregoing method is mainly for the case that one or more cloud accounts saved on the shared platform correspond to an infrastructure cloud that provides an IaaS service, and if the shared platform simultaneously registers a plurality of cloud accounts of the infrastructure cloud providing the IaaS service, the receiving After the operation request of the IaaS service object sent by the second user's client after the account is logged in, the method may further include: first determining, according to the operation request of the IaaS service object, the infrastructure cloud that provides the IaaS service. And then, the account corresponding to the determined infrastructure cloud is used as the designated access account of the operation request of the IaaS service object.

 Specifically, determining, according to the operation request of the IaaS service object, that the infrastructure cloud providing the IaaS service can be classified into the following two cases:

The operation request of the IaaS service object includes an identifier of an infrastructure cloud that is to be accessed by the second user client to provide an IaaS service, and the infrastructure cloud corresponding to the identifier of the infrastructure cloud is determined to be an infrastructure cloud that provides IaaS services; Or, according to the previously stored correspondence between the second user identifier and the access account, finding that the corresponding relationship has obtained multiple access corresponding to the second user identifier The account, and then the infrastructure cloud that provides the IaaS service is found according to the access account; or the operation request of the IaaS service object does not include the identifier of the infrastructure cloud to be accessed by the second user client, and the second user is pre- The selection rules for the provided infrastructure cloud determine the infrastructure cloud that provides IaaS services. Preferably, the selection rule may be: the second user pre-provides its acceptable service quality of service (QoS), such as request delay duration, request failure rate, IaaS service object abnormal ratio, etc., and these parameters are Specifying the weight, filtering all the infrastructure clouds that can provide the IaaS service according to the QoS and its weight, and determining the infrastructure cloud for providing the IaaS service to the second user from the filtered infrastructure cloud that can provide the IaaS service, determining The method may be: sorting according to the quality of the QoS, and selecting the infrastructure cloud with the highest QoS quality to provide the IaaS service.

 The IaaS service object in the response message received by the shared platform includes the IaaS service object identifier, and the shared platform may also establish the second user identifier after receiving the IaaS service object identifier for the first time. Corresponding relationship with the identifier of the IaaS service object, for the subsequent shared platform to verify whether the user has the right to initiate an operation for the IaaS service object, or to perform statistics, charging, and the like according to the user. The shared platform may receive the IaaS service object identifier for the first time from the following two ways: The second user passes the IaaS service object identifier provided by the IaaS service object operation request, or the infrastructure cloud that provides the IaaS service processes the IaaS service submitted by the second user. When the request is operated, the IaaS service object identifier is allocated to the generated IaaS service object, and the IaaS service object identifier is returned to the sharing platform by the response message of the IaaS service object operation request.

 In the foregoing method, in order to prevent conflicts (such as duplicate names) of IaaS service object identifiers of multiple users sharing the same cloud account, there are two processing methods:

1. The sharing platform allocates a unique prefix or suffix to the second user identifier, and saves the correspondence between the second user identifier and the prefix or suffix, and the message between the client and the shared platform of the second user Use the IaaS business object identifier without adding a prefix or suffix, and the identifier of the IaaS business object with the prefix or suffix added between the shared platform and the infrastructure cloud providing the IaaS service to prevent object conflicts between different users, then encapsulation The IaaS business object operation request, or When the response message is encapsulated, the prefix or suffix corresponding to the second user identifier is obtained according to the correspondence between the second user identifier and the prefix or suffix, and the laaS included in the operation request of the laaS service object is obtained. The service object identifier is added with a prefix or suffix, or the prefix or suffix of the laaS service object identifier included in the response message is used as the identifier of the encapsulated laaS service object.

 2. The sharing platform assigns an alias to the laaS service object, and the alias may be uniquely associated with the laaS service object, and save the correspondence between the laaS service object of the second user identifier and the specified alias, The message between the user client and the shared platform uses the laaS service object identifier provided by the user, and the alias of the laaS service object is used between the shared platform and the infrastructure cloud providing the laaS service to prevent object conflicts between different users. Encapsulating the laaS service object operation request, or encapsulating the response message, replacing the laaS service object identifier included in the laaS service object operation request with a corresponding alias, or the laaS service object identifier included in the response message The alias is replaced with the corresponding laaS service object identifier as the identifier of the encapsulated laaS service object.

 After the access account is specified for the second user, the specified access account may be used to create a virtual machine or implement cloud storage. The following sections describe two specific application examples of the present invention: virtual machine creation and cloud storage implementation.

 If the laaS service is a virtual machine service of the infrastructure cloud, the foregoing laaS service object may be one or more of a key pair, a virtual machine, a security group, and the like.

When the laaS service object is a key pair, and the operation request of the laaS service object sent by the second user is an operation request for creating a key pair, the response message returned by the infrastructure cloud providing the laaS service includes providing a laaS service. The result of the infrastructure cloud processing the laaS service object operation request, including a key pair name, a private key in the generated key pair, wherein the key pair name is one of identifiers of the laaS service object. After receiving the response message, the method further includes: sending a private key of the generated key pair to a client of the second user, where the sharing platform does not save the private key. When the second user creates a virtual machine, the second user carries the key pair name in the laaS service object operation request, and after the virtual machine is created, when the virtual machine is accessed, the key pair is used. The private key is used for virtual machine login authentication.

 Of course, when the key pair is used as the IaaS service object, there is another implementation: when the IaaS service object is a key pair, and the IaaS service object operation request sent by the second user is an operation request for creating a key pair. The response message includes a result of the infrastructure cloud processing the IaaS service object operation request, and also includes a private key in the generated key pair. After receiving the response message, the method further includes: the sharing platform saving the private key of the key pair and the correspondence between the key pair and the infrastructure cloud. When the second user client creates a virtual machine, that is, the sent IaaS service object operation request is an operation request for creating a virtual machine, the second user client carries the key pair name in the IaaS service object operation request, after the virtual machine is created, The access virtual machine SSH (Secure Shell) client can access the virtual machine through the sharing platform. The shared platform uses the key of the virtual machine saved by the shared platform to perform virtual machine login authentication. After the authentication is passed, the user interface is provided to the second user client, and the virtual machine login authentication is transparent to the second user, that is, the specific process of the virtual machine login authentication is invisible to the user.

 When the IaaS service object operation request creates a request for a virtual machine, and generates a virtual machine using a key pair, where the virtual machine creation request includes the second user identifier, a specification and a key pair of a virtual machine to be created After receiving the virtual machine creation request, the sharing platform determines the access account of the infrastructure cloud that provides the IaaS service corresponding to the second user identifier, and the specific determining method may be as follows: Step 103; The second user identifier, the specification of the virtual machine to be created, and the key pair name are encapsulated in the operation request of the IaaS service object, and the encapsulated IaaS service is sent to the infrastructure cloud that provides the IaaS service corresponding to the access account. The operation request returned by the infrastructure cloud that provides the IaaS service includes an identifier of the IaaS service object generated according to the IaaS service object operation request, and the IaaS service object is the created virtual machine.

When the IaaS service object operation request is an operation request for creating a virtual machine, and the virtual machine is generated by using a username and a password, the user name and password are login user names and passwords of the virtual machine created by logging in, where the virtual machine is created. The operation request includes the second user identifier and a specification of the virtual machine to be created, optionally including a login user name or password provided by the second user; After the virtual machine creates the request, the sharing platform determines the access account of the infrastructure cloud that provides the IaaS service corresponding to the second user identifier. For details, refer to step 103. The operation request for creating the virtual machine is carried. The information is encapsulated in an operation request of the IaaS service object, and sends an operation request of the encapsulated IaaS service object to the infrastructure cloud that provides the IaaS service corresponding to the access account; and the response returned by the infrastructure cloud that provides the IaaS service The message includes an identifier of the IaaS service object generated according to the IaaS service object operation request, and the IaaS service object is the created virtual machine.

 Of course, after the virtual machine is created, you can perform other operations on the virtual machine that has already been created, such as stopping, changing, restarting, or deleting. When performing other operations on the created virtual machine, the method includes: for an created virtual machine, the IaaS business object operation request is a virtual machine stop operation request, a virtual machine change operation request, a virtual machine Restart operation request or virtual machine delete operation request, the IaaS business object operation request includes the second user identifier, the identifier of the virtual machine that needs to be stopped, changed, restarted or deleted; according to the saved second user Corresponding relationship between the identifier and the access account determines an access account of the infrastructure cloud that provides the IaaS service corresponding to the second user identifier; and the second user identifier, the virtual machine that needs to be stopped, changed, restarted, or deleted The identifier is encapsulated in an operation request of the IaaS service object, and sends an operation request of the encapsulated IaaS service object to the infrastructure cloud that provides the IaaS service corresponding to the access account; and the response returned by the infrastructure cloud that provides the IaaS service The message includes the processing result of the infrastructure cloud processing IaaS business object operation request

 If the IaaS service is a storage service of the infrastructure cloud, the foregoing IaaS service object may be a storage object or a storage block bucket.

When the IaaS service object operation request is an operation request for creating a storage block or save an operation request of a storage object or a copy, delete, or the like of the storage object, the operation request for creating the storage block includes a name or storage of the storage block. The identifier of the object; after receiving the IaaS service object operation request, the sharing platform determines, according to the correspondence between the second user identifier and the access account that is saved by the shared platform, the infrastructure cloud that provides the IaaS service corresponding to the second user identifier. Access account; and The operation request for creating a storage block or the operation request for saving a storage object or the other operation request of the storage object is encapsulated in an operation request of an IaaS service object, and provides a basis for providing an IaaS service corresponding to the access account. The facility cloud sends an operation request of the encapsulated IaaS service object; the infrastructure cloud response message providing the IaaS service includes a processing result of processing the IaaS service object operation request.

 When the IaaS service object is a storage object, and the IaaS service object operation request sent by the second user is to change the access right of the storage object, receiving the IaaS service object operation request sent by the second user client After the method, the method may further include: determining, by the IaaS service object operation request, whether the target user that changes the access right of the storage object that is included in the IaaS service object operation request is the second user of the shared platform, and if yes, the sharing platform saves the object The new access right does not send an access permission operation request to change the storage object to the infrastructure cloud providing the storage service, otherwise, send the re-encapsulated change access permission operation of the storage object to the infrastructure cloud providing the storage service request.

 FIG. 2 is a flowchart of an embodiment of a method for creating a virtual machine (VM). As shown in FIG. 2, the method may include:

 Step 201: Register at least one cloud account for accessing the infrastructure cloud providing the IaaS service on the shared platform, as the cloud account of the client of the first user; the specific registration process may refer to the related description of the foregoing embodiment of the present invention.

 The sharing platform can simultaneously register multiple cloud accounts of the infrastructure cloud that provides IaaS services. For each infrastructure cloud that provides IaaS services, one or more of the infrastructure cloud's Yunma can be registered with the shared platform.

 Step 202: The second user client of the shared platform accessing the shared platform creates an account of the second user client to access the shared platform.

Specifically, the sharing platform generates an account for accessing the shared platform for each second user that uses the cloud service through the shared platform, where the account of the access sharing platform includes at least a user identifier of the second user, and optionally has an access sharing. Certification information for the platform, such as passwords, certificates, etc. Second user client The account of the access sharing platform is used to access the sharing platform, and the cloud service provided by the infrastructure cloud is used through the sharing platform. When the second user accesses the shared platform, the authentication information corresponding to the account of the access sharing platform is provided, such as providing a password or a certificate, and the sharing platform uses the authentication information to authenticate the identity of the second user, and after the authentication is passed, Open cloud business access capabilities for users.

 Step 203: The sharing platform, according to the association relationship between the first user and the second user, specifies, for the second user, at least one cloud account of the first user as the second user access

The access account of the infrastructure cloud of the IaaS service, so that the client of the second user accesses the basis of providing the IaaS service corresponding to the access account according to the account of the access sharing platform and the access account. Facility cloud.

 The sharing platform specifies an access account for the second user in step 202. For a specific infrastructure cloud providing a certain IaaS service, a second user can be assigned to an access account of the infrastructure cloud, one of the foundations. The access account of the facility cloud can be assigned to multiple second users.

 The process of associating the first user with the second user and the process of assigning an access account to the second user may refer to related descriptions of other embodiments of the present invention. The sharing platform specifies, as the second user, the cloud account registered by the first user as the second user to access the access account of the infrastructure cloud of the IaaS according to the association relationship between the first user and the second user.

 The preferred implementation of the foregoing sharing platform for the cloud account registered by the first user as the first user according to the association relationship between the first user and the second user as the second user accessing the infrastructure cloud providing the IaaS is: When multiple access accounts of a certain infrastructure cloud are registered on the shared platform, the shared platform is uniformly allocated according to the load condition of each access account of the infrastructure cloud, so that each access account of the infrastructure cloud is made. The number of associated users is basically equal, where the load refers to the number of second users associated with it, regardless of whether the second user is currently used or not; or, the sharing platform groups the users according to the different rights granted to the user, and Assign to an IaaS access account based on the packet.

The manner in which the sharing platform specifies the access account for the second user may be fixed or dynamically specified. When the shared platform specifies the access account for the second user in a fixed manner, that is, a user is fixedly bound to an access account corresponding to an infrastructure cloud, and the user identifier and the infrastructure cloud are saved on the shared platform. The correspondence between access accounts. Such a user can view and manage the status information of cloud instances stored in the infrastructure cloud providing IaaS services at any time. A cloud instance refers to an IaaS service object created by the infrastructure cloud according to the request of the second user. For example, the created virtual machine is a cloud instance, and one storage space allocated for the user, that is, the stored block is a cloud instance.

 When the sharing platform specifies the access account for the second user in a dynamic manner, that is, when a user is using the cloud service (such as an operation request for sending an IaaS service), the sharing platform temporarily specifies the IaaS for the user. The cloud account of the infrastructure cloud of the service is used as an access account, and the cloud account is released after the user requests the processing, that is, the cloud account is no longer bound. In this manner, the sharing platform can dynamically assign an access account of the infrastructure cloud to the user according to the load of the infrastructure cloud that provides the IaaS service corresponding to each access account, such as assigning a lower current load to the user. The access account of the facility cloud processes the operational request of the user's IaaS service, where the load refers to the number of second users associated with which the infrastructure cloud is currently being used.

 Optionally, the sharing platform may assign operation rights to the user according to the identity of the second user, for example, the ordinary user can only use the VM, but cannot create the intermediate user, and the intermediate user can only create a maximum of 5 VMs. The advanced user can apply for the specification comparison. High VM and so on, and save the user rights.

 Step 204: The sharing platform sends an operation request for creating a key pair of the second user, and receives a key pair returned by the corresponding infrastructure cloud that provides the IaaS service.

 The key pair keypa ir is a key-value pair, including a public key and a private key, for the second user client to access the virtual machine VM.

 The key pair application request may be that after the sharing platform receives the operation request of the IaaS service object sent by the second user after logging in based on the account of the access sharing platform, the sharing platform sends the information to the corresponding infrastructure cloud.

After receiving the operation request of the IaaS service object, the sharing platform determines an access account for the operation request, and applies and receives the key to the infrastructure cloud that provides the Ia.S service corresponding to the access account. Correct. For a specific process of determining an access account for the operation request in this embodiment, refer to related descriptions of other embodiments of the present invention, and details are not described herein again.

 Determining, by the sharing platform, that the user corresponding to the second user identifier has the right to perform the operation request on the IaaS service object according to the operation authority set by the user corresponding to the second user identifier, and determining the location When the user corresponding to the second user identifier has the right to execute the operation request, the operation request of the IaaS service object is encapsulated according to the message format of the infrastructure cloud that provides the IaaS service corresponding to the access account, and The infrastructure cloud that provides the IaaS service corresponding to the access account sends the encapsulated IaaS service object operation request.

 The sharing platform applies at least one key pair keypa ir (including the public key and the private key) in the infrastructure cloud providing the IaaS service corresponding to the specified access account according to the operation request of the business object, and the specific keypa ir is generated by the The infrastructure cloud that provides the IaaS service is completed. The infrastructure that provides the IaaS service generates the key pair and then stores the public key. The private key corresponding to the keypa ir is sent to the shared platform through the response message.

 After the shared platform receives the private key sent by the infrastructure cloud, there are two cases: The shared platform saves the private key and the shared platform does not save the private key.

 It should be noted that, if the user name and password are assigned to the second user when the virtual machine is created, the second user can access the virtual machine by using the username and password, and the step 204 of creating the key pair may be omitted.

 In order to explain that the shared platform saves the private key, the shared platform does not save the private key, and the infrastructure cloud creates the virtual machine without using the key pair, and uses the username and password, the following embodiments are introduced in three cases. If the private key of the key pair is not saved on the shared platform, see Step 2051-2071. For the process of saving the private key of the key pair on the shared platform, see Step 2052-2072. When the infrastructure cloud creates a VM, For the process of creating a virtual machine using a key pair and using a username and password, see Step 2053 2063. In these three cases, one of them can be selected according to the user's preference and the capabilities of the infrastructure cloud.

Step 2051: Send the private key of the assigned key pair to the client of the second user. The sharing platform provides the key of the infrastructure cloud assigned by the IaaS service to the final second user, and the second user saves the private key to facilitate its use of other ssh (Secure Shell, Secure Shell Protocol) tools. Access to the cloud. The sharing platform saves the correspondence between the user identifier and the key pair of the second user. If the sharing platform registers a plurality of infrastructure clouds, the correspondence between the key pair and the infrastructure cloud that generates the key pair needs to be saved.

 To prevent key pairs of different users bound to the same access account from being duplicated, you can do the following two methods:

 1) The sharing platform may assign an alias to each key pair keypair, save the corresponding relationship between the alias and the key pair name, and provide the alias to the second user. As shown in Table 1:

Table 1

 Wherein mykeypair is used in messages between user2 and the shared platform; alias keypair—for—user 1 is used in messages between the shared platform and the cloud.

 The sharing platform saves the correspondence between the key pair alias and the key pair name.

 2) The sharing platform may assign a prefix or suffix to each second user, and each second user has a different prefix or suffix, and the sharing platform communicates with the infrastructure cloud that generates the key pair, in the key Add a prefix or suffix to the name.

 Step 2011: The sharing platform applies, according to an operation request for creating a virtual machine sent by the second user, to the corresponding infrastructure cloud to create a virtual machine, and receives the created virtual machine returned by the infrastructure cloud.

The second user initiates an operation request for creating a virtual machine to the shared platform for creating a virtual machine. The operation request for creating a virtual machine includes the second user identifier, a specification of a virtual machine to be created, and a key pair identifier. The specifications of the virtual machine VM to be created are as follows: The image image used to create the VM, the size of the VM, etc., after verifying that the second user authority passes, the shared platform queries the keypair alias table mentioned in Table 1 of step 2051. Or add a prefix or suffix to get The key pair name sent to the infrastructure cloud, and then reading the access account assigned to the second user in step 203, and then using the access account and the obtained key pair name to provide the IaaS service corresponding to the access account The infrastructure cloud submits an operation request to create a virtual machine. If the creation is successful, the infrastructure cloud returns a response message to the shared platform, where the response message carries the identifier of the virtual machine that has been created, otherwise an error is returned. After the creation is successful, the mapping between the virtual machine identifier and the second user may be saved on the shared platform, and other information of the virtual machine, such as an IP address, a specification, and the like, may also be saved. The sharing platform provides the virtual machine to the second user.

 In order to enable the sharing platform to obtain the status information of the VM created by the second user in real time, such as whether there is a shutdown or the like that does not pass the management command, so as to more accurately record the information of the second user using the infrastructure cloud, the sharing platform may Install an agent for the created vm, the agent can monitor the running status of the vm, and automatically report to the shared platform periodically, and the shared platform analyzes the received information to obtain the status of the VM. Alternatively, the sharing platform can record the point in time when the VM is created, and according to the charging rules of the infrastructure cloud (such as the deduction time interval), determine and configure a time interval for acquiring the VM state, and pass the infrastructure cloud at each time interval. The provided interface obtains the status of the VM. For example, the hourly charge, that is, the charge per hour, the VM state is acquired once the VM starts 59 minutes.

 Step 2071: The second user manages the created virtual machine or accesses the created virtual machine through the shared platform.

The second user initiates an operation request for the IaaS service of the specific cloud instance to the shared platform to manage the virtual machine that has been created, such as stopping, changing, restarting, viewing, or deleting the virtual machine. The operation request of the IaaS service specifies the identifier of the virtual machine, and the sharing platform determines whether the virtual machine corresponds to the second user identifier according to the correspondence between the saved virtual machine identifier and the second user identifier, so as to verify whether the user is The virtual machine can be managed, and if the corresponding relationship is verified, the access account bound by the second user identifier is used to initiate an operation for the virtual machine to the corresponding infrastructure cloud. The infrastructure cloud corresponding to the access account performs a corresponding operation on the operation request of the IaaS service object, and returns a response message to the shared platform, where the response message includes the result of the corresponding operation, and is shared by the sharing The station returns the result to the second user client.

 Step 2052: Save the private key of the created one or more key pairs on the shared platform.

 The shared platform saves the private key of the key pair and also stores the correspondence between the key pair and the infrastructure cloud that created the key pair.

 Step 2062: The sharing platform applies for creating a virtual machine to the corresponding infrastructure cloud according to the operation request for creating a virtual machine sent by the second user, where the virtual machine creation request includes the second user identifier and the virtual machine to be created. The specification, optionally including a key pair identifier, and receiving the identifier of the created virtual machine and the address information of the virtual machine (such as IP, Internet Protocol) returned by the infrastructure cloud. If the key pair identifier is not included in the operation request, the sharing platform selects a keypair from the keypair corresponding to the cloud account specified by the operation request as a keypair for creating the virtual machine, which may be randomly selected or selected according to the security group.

 For the VM creation and monitoring description of this step, refer to the related description of step 2061, which will not be described here.

 Step 2072: The second user manages the created virtual machine or accesses the created virtual machine through the shared platform.

 For a description of this step, refer to the related description of step 2071, and details are not described herein again.

 Step 2053: The sharing platform applies for creating a virtual machine to the corresponding infrastructure cloud according to the operation request for creating a virtual machine sent by the second user, where the virtual machine creation request includes the second user identifier, and the virtual machine to be created. Specifications, optional: root password, or username and password other than root. If the operation request does not include any username and password, the infrastructure cloud can generate a password for the root user and request it through the operation. The response message returns the generated password to the second user.

 The sharing platform receives the identifier of the created virtual machine and the address information of the virtual machine (such as IP, Internet Protocol) returned by the infrastructure cloud, and optionally, the password of the root user generated by the infrastructure cloud.

For other virtual machine creation and monitoring descriptions of this step, refer to the related description of step 2061. I won't go into details here.

 Step 2063: The second user manages the created virtual machine or accesses the created virtual machine through the shared platform.

 For a description of this step, refer to the related description of step 2071, and details are not described herein again.

 FIG. 3 is a flowchart of an embodiment of implementing a cloud storage method according to an embodiment of the present invention. As shown in FIG. 3, the method may include:

 Step 301: Register at least one cloud account for accessing the infrastructure cloud providing the IaaS service on the shared platform, as the cloud account of the client of the first user; the specific registration process may refer to the related description of the foregoing embodiment of the present invention.

 Step 302: The sharing platform creates an account for the second user to access the shared platform for the second user to access the shared platform.

 Step 303: The sharing platform, according to the association relationship between the first user and the second user, specifies, for the second user, at least one cloud account of the first user as the second user access

The access account of the infrastructure cloud of the IaaS service, so that the client of the second user accesses the basis of providing the IaaS service corresponding to the access account according to the account of the access sharing platform and the access account. Facility cloud.

 For a detailed description of the steps 301-303 in this embodiment, reference may be made to the related descriptions of the steps 201-203, and the designation of the access account, and the related descriptions of other embodiments of the present invention, and details are not described herein again.

 Step 304: Send an operation request of the second user to create a storage block, and receive an identifier of the created block returned by the corresponding infrastructure cloud.

 The creating action of the directory or the block is that the sharing platform automatically initiates a creation command to the cloud when the second user connects the second user to the specified access account, or receives the second user after the login based on the account of the access sharing platform. When the operation request of the IaaS business object is requested, the sharing platform initiates creation to the corresponding infrastructure cloud.

The sharing platform sends an IaaS that creates at least one root directory or block bucket to the specified access account. The service corresponding to the operation request, and receiving a response message returned by the corresponding infrastructure cloud, where the response message includes an identifier of a block or a directory created for implementing the cloud storage, and the sharing platform assigns the second user to the block or directory, and The corresponding relationship between the second user identifier and the block or directory identifier is saved on the shared platform.

 The sharing platform may allocate a unique storage object prefix or suffix to the second user identifier, and after the second user client sends the IaaS service object operation request, add the identifier and the location of the block to the storage object identifier. The storage object prefix or suffix is described, and the identifier of the added block and the storage object identifier or the storage object identifier after the suffix are encapsulated in the encapsulated IaaS service object operation request sent to the infrastructure cloud. Preferably, the prefix may use a unique identifier corresponding to the user name or username of the user.

 The sharing platform saves the correspondence between the identifier of the block and the storage object identifier or the suffix after the storage object identifier and the real identifier of the storage object, after the second user client sends the IaaS service object operation request, The method further includes: determining, according to the added identifier of the block, the correspondence between the storage object identifier or the storage object identifier after the storage object prefix or the suffix, and the storage object identifier, the storage object identifier in the IaaS service object operation request message. Replacing the original storage object identifier with the real identifier of the storage object; and encapsulating the real identifier of the storage object in the encapsulated IaaS business object operation request sent to the infrastructure cloud.

 Step 305: The second user manages the storage object by using the shared platform.

 After receiving the storage object management operation initiated by the second user, the sharing platform determines, according to the saved right information, whether the user has the right to perform the operation corresponding to the operation request. If the second user has permission to perform the operation, further operations are performed.

 The rights here may include: a permission limit of a user saved by the sharing platform, such as a maximum storage space limit, or/and an access control information of the operated object saved by the sharing platform. Here, it should be noted that the access control information is shared platform management. , and the access control of the infrastructure cloud is not the same.

If the IaaS service object operation request is to change the access right of the storage object, after receiving the IaaS service object operation request sent by the second user client, the method may further The method includes: determining, by the IaaS service object operation request, a target user that changes an access right of a storage object that is included in the IaaS service object operation request, whether the second user of the shared platform is saved, and if yes, saving the new access right of the object, and does not provide the The infrastructure cloud of the storage service sends an access permission operation request to change the storage object, otherwise, a re-encapsulated access permission operation request to change the storage object is sent to the infrastructure cloud providing the storage service.

 A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to program instructions, and the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The foregoing storage medium includes: ROM, RAM, magnetic disk or optical disk, and the like, which can store program code. FIG. 4 is a shared infrastructure of the present invention as a system for serving an IaaS service cloud account. A schematic diagram of the structure includes a sharing platform 41 and an infrastructure cloud providing device 42 that provides IaaS services, and the infrastructure cloud may have multiple. Of course, the system of the present invention may further include a first user client 43 and a second user client 44.

 The sharing platform 41 is configured to save at least one cloud account for accessing the infrastructure cloud that provides the IaaS service, as the cloud account of the first user, and create an account for the second user to access the shared platform for the second user. And assigning, by the second user, at least one cloud account of the first user as the second user accessing an infrastructure cloud providing IaaS service according to an association relationship between the first user and the second user; An account, such that the client of the second user accesses the infrastructure cloud that provides the IaaS service corresponding to the access account according to the account of the access sharing platform and the access account;

 The infrastructure cloud providing device 42 is configured to register a cloud account for the first user by using the sharing platform, and access the infrastructure cloud by using the specified access account by the second user. After the device, the second user is provided with an IaaS service.

The sharing platform 41 is further configured to save a correspondence between the second user identifier and an access account. The sharing platform saves at least one cloud account for accessing an infrastructure cloud of the IaaS service, The cloud account is the cloud account of the first user, and the sharing platform 41 receives the cloud account creation request sent by the first user client 43 according to the cloud account creation request to the infrastructure cloud that provides the laaS service. The providing device 42 applies for at least one cloud account as the cloud account of the first user, and saves the cloud account; or the sharing platform 41 receives and saves at least one cloud account registered by the first user, The at least one cloud account registered by the first user is requested by the first user to the providing device 42 of the infrastructure cloud providing the laaS service.

 The receiving, by the second user, the at least one cloud account of the first user as the second user accessing the access account of the infrastructure cloud that provides the laaS service includes: the sharing platform 41 receiving the second user The client 44 specifies, according to the association relationship, at least one cloud account of the first user as the second user according to the association relationship when the operation request of the laaS service object is sent after the account is accessed by the account of the access sharing platform. The second user accesses the access account of the infrastructure cloud that provides the laaS service; or the sharing platform 41 creates the account of the second user client accessing the shared platform for the second user accessing the sharing platform 41, Assigning, according to the association relationship, at least one cloud account of the first user to the second user as an access account of an infrastructure cloud that provides a laaS service for the second user; or, in the second After the user's client 44 subscribes the laaS service to the sharing platform 41, the sharing platform 41 specifies the second user according to the association relationship. Providing means cloud infrastructure least one of said first user account as cloud users access the second business providing access account laaS 42.

The sharing platform 41 specifies, after the second user specifies the access account of the infrastructure cloud that provides the laaS service for the second user, the sharing platform 41 provides the laaS service according to the specified access account. The message format of the infrastructure cloud encapsulates the laaS service object operation request, and sends the encapsulated laaS service object operation request to an infrastructure cloud that provides a laaS service corresponding to the access account; the sharing platform 41 receives the a response message sent by the providing device 42 of the infrastructure cloud providing the laaS service corresponding to the specified access account according to the encapsulated laaS service object operation request; the sharing platform 41 encapsulating the response message, and reporting to the The client 44 of the second user sends the encapsulated response message. Create a second user client access sharing platform, the second user specifies that the second user specifies that the sharing platform 41 can also set the operation authority for the second user corresponding to the second user identifier and save; and then receive the second user. The client 44 determines, after the operation request of the IaaS service object that is sent after the login of the account of the access sharing platform, the sharing platform 41 determines the operation authority according to the operation authority set by the user corresponding to the second user identifier. Whether the user corresponding to the second user identifier has the right to perform the operation request on the IaaS service object, and when determining that the user corresponding to the second user identifier has the authority corresponding to executing the operation request, according to the The message format of the infrastructure cloud that provides the IaaS service corresponding to the specified access account encapsulates the IaaS service object operation request, and sends the encapsulated to the infrastructure cloud providing device 44 that provides the IaaS service corresponding to the access account. IaaS business object operation request.

 The sharing platform 41 is further configured to receive a response message that is sent by the infrastructure cloud that provides the IaaS service corresponding to the access account according to the encapsulated IaaS service object operation request, encapsulate the response message, and send the response message to the second The client's client sends 44 the encapsulated response message.

 After the sharing platform 41 receives the operation request of the IaaS service object sent by the client 44 of the second user after logging in based on the account of the access sharing platform, the sharing platform 41 requests the operation according to the IaaS service object. Determining an infrastructure cloud that provides an IaaS service, and using the account corresponding to the determined infrastructure cloud as the designated access account of the operation request of the IaaS service object.

 The sharing platform 41 determines, according to the operation request of the IaaS service object, the infrastructure cloud that provides the IaaS service, specifically: the operation request of the IaaS service object includes an identifier of an infrastructure cloud to be accessed by the second user, The shared platform determines that the infrastructure cloud corresponding to the identifier of the infrastructure cloud is an infrastructure cloud that provides an IaaS service; or the operation request of the IaaS service object does not include an identifier of an infrastructure cloud to be accessed by the second user, The sharing platform determines an infrastructure cloud providing IaaS services according to a selection rule of an infrastructure cloud provided by a second user in advance.

FIG. 5 is a schematic structural diagram of a shared infrastructure as a shared platform for serving an IaaS service cloud account according to the present invention. The shared platform includes a first processing unit 51, a first storage unit 52, and a first Transmitting unit 54.

 The first memory 52 is configured to save at least one cloud account for accessing the infrastructure cloud providing the laaS service as the cloud account of the first user; and the first processing unit 51 is configured to create a second user client for the second user. Accessing the account of the shared platform, the account of the access sharing platform includes the identifier of the second user; and assigning at least one of the first users to the second user according to the association relationship between the first user and the second user The user's cloud account is used as the second user to access the access account of the infrastructure cloud that provides the laaS service, so that the client of the second user is connected according to the account of the access sharing platform and the access account. And the first sending unit 54 sends the specified access account to the client of the second user.

 The first storage unit 52 is further configured to save a correspondence between the second user identifier and the access account.

 The sharing platform further includes a first receiver 53, and the first receiving unit 53 is configured to receive a cloud account creation request sent by the first user client, and send the request to the first processing unit 51, where The first processing unit 51 applies, according to the cloud account creation request, the at least one cloud account to the infrastructure cloud that provides the laaS service as the cloud account of the first user; or the first receiving unit 53 receives the first At least one cloud account registered by the user, and the at least one cloud account registered by the first user is saved by the first storage unit 52, wherein at least one cloud account registered by the first user is used by the first user The infrastructure cloud application that provides the laaS service is available.

The first processing unit 51, for the second user, to specify at least one cloud account of the first user as the second user accessing an access account of the infrastructure cloud that provides the laaS service, includes: the first receiving The unit 53 receives an operation request of the laaS service object sent by the client of the second user after logging in based on the account of the access sharing platform, and sends an operation request of the laaS service object to the first processing unit 51, The first processing unit 51 specifies, according to the association relationship, the at least one cloud account of the first user as the second user to access the access account of the infrastructure cloud that provides the laaS service; or The first processing unit 51, when creating a second user client accessing the account of the sharing platform for the second user accessing the sharing platform, according to the The first processing unit 51 specifies, for the second user, at least one cloud account of the first user as an access account of the second user to access an infrastructure cloud that provides IaaS services; or After the second user sends the subscription to the IaaS service to the first receiving unit 53, the first processing unit 51 specifies, according to the association relationship, at least one cloud of the first user for the second user. The account is used as the access account of the second user to access the infrastructure cloud that provides the IaaS service.

 After the first processing unit 51 assigns at least one cloud account of the first user to the second user as the access account of the infrastructure cloud that provides the IaaS service to the second user, the first The processing unit 51 encapsulates the IaaS service object operation request according to the message format of the infrastructure cloud that provides the IaaS service corresponding to the specified access account, and the first sending unit 54 provides the corresponding corresponding to the access account. The infrastructure cloud providing device of the IaaS service sends the encapsulated IaaS service object operation request; the first receiving unit 53 receives the infrastructure cloud that provides the IaaS service corresponding to the specified access account, according to the encapsulated IaaS The response message sent by the service object operation request is encapsulated, and the response message is encapsulated, and the encapsulated response message is sent by the first sending unit 54 to the client of the second user.

 Creating a second user client access sharing platform, the second user specifying that the second user specifies that the first processing unit 51 sets an operation authority for the second user corresponding to the second user identifier and saves the first In the storage unit 52, after the first receiving unit 53 receives the operation request of the IaaS service object sent by the client of the second user after logging in based on the account of the access sharing platform, the first processing unit 51 Determining, according to the operation authority set by the user corresponding to the second user identifier, whether the user corresponding to the second user identifier has the right to perform the operation request on the IaaS service object, and determining the second user When the user corresponding to the identifier has the right to execute the operation request, the first processing unit 51 encapsulates the IaaS service object operation according to the message format of the infrastructure cloud that provides the IaaS service corresponding to the specified access account. Providing, and providing, by the first sending unit 54 to the access cloud, the infrastructure cloud providing the IaaS service The business object IaaS send operation request package.

Receiving, on the first receiving unit 53, the basis for providing the IaaS service corresponding to the access account After the response cloud is sent by the facility cloud according to the encapsulated laaS service object operation request, the first processing unit 51 parses the response message, and obtains operation result information indicating success or failure, and is used by the first storage unit. 52 saves the operation result information.

 After the first receiving unit 53 receives an operation request of the laaS service object sent by the client of the second user after logging in based on the account of the access sharing platform, the first processing unit 51 is configured according to the laaS service object. The operation request determines an infrastructure cloud that provides a laaS service, and uses the account corresponding to the determined infrastructure cloud as the designated access account of the operation request of the laaS service object.

 Determining, by the first processing unit 51, the infrastructure cloud that provides the laaS service according to the operation request of the laaS service object, specifically: the operation request of the laaS service object includes an identifier of an infrastructure cloud to be accessed by the second user, The first processing unit 51 determines that the infrastructure cloud corresponding to the identifier of the infrastructure cloud is an infrastructure cloud that provides a laaS service; or the operation request of the laaS service object does not include an infrastructure that the second user needs to access The identifier of the cloud, the first processing unit 51 determines an infrastructure cloud providing the laaS service according to the selection rule of the infrastructure cloud provided by the second user in advance.

 The first processing unit 51 may further allocate a unique prefix or suffix to the second user identifier, and save, by the first storage unit 52, a correspondence between the second user identifier and the prefix or suffix; If the sharing platform encapsulates the laaS service object operation request, or encapsulates the response message, the method may include: acquiring, according to the correspondence between the second user identifier and the prefix or suffix, the second user identifier a prefix or a suffix; when the laaS service object operation request includes a service object identifier, adding a prefix or a suffix to the laaS service object identifier included in the laaS service object operation request, or when the response message includes a service object identifier, And reducing a prefix or a suffix for the laaS service object identifier included in the response message, as an identifier of the encapsulated laaS service object.

Alternatively, the first processing unit 51 may further allocate an alias for the laaS service object, and save, by the first storage unit 52, a correspondence between the laaS service object and the alias. And the encapsulating the IaaS service object operation request, or encapsulating the response message, specifically includes: when the IaaS service object operation request includes a service object identifier, the IaaS service included in the IaaS service object operation request The object identifier is replaced with the corresponding alias, or when the response message includes the service object identifier, the IaaS service object identifier alias included in the response message is replaced with the corresponding IaaS service object identifier, as the encapsulated IaaS service. The identity of the object.

 For a specific implementation of the second user designating the second user to specify the related processing of the system and the various device embodiments of the present invention, reference may be made to the related description of the method embodiment of the present invention, which is not described herein again.

 Of course, the sharing platform in the embodiment of the present invention may include a storage unit, and each unit included in the sharing platform may be located in the storage unit. For a specific implementation process of the method for performing the method of the present invention, reference may be made to the related description of the method embodiment of the present invention, and details are not described herein again.

 The specific working process of the above system of the embodiment of the present invention can be referred to other embodiments of the present invention, and is not described here.

 A person skilled in the art can understand that the drawings are only a schematic diagram of a preferred embodiment, and the modules or processes in the drawings are not necessarily required to implement the invention.

 Those skilled in the art can understand that the modules in the apparatus in the embodiments may be distributed in the apparatus of the embodiment according to the description of the embodiments, or may be correspondingly changed in one or more apparatuses different from the embodiment. The modules of the above embodiments may be combined into one module, or may be further split into a plurality of sub-modules.

 It should be noted that the above embodiments are only for explaining the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those skilled in the art that: The technical solutions described in the foregoing embodiments are modified, or some of the technical features are equivalently replaced. The modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

Claim

 A method for sharing an infrastructure as a service cloud account for an IaaS service, characterized in that:

 And storing at least one cloud account for accessing an infrastructure cloud providing the IaaS service, where the cloud account is a cloud account of the first user;

 Creating a second user client accessing the account of the sharing platform for the second user;

 Assigning, by the second user of the second user, at least one cloud account of the first user as a basis for the second user to access the provided IaaS service according to an association relationship between the first user and the second user The access account of the facility cloud, so that the client of the second user accesses the infrastructure cloud that provides the IaaS service corresponding to the access account according to the account of the access sharing platform and the access account.

 2. The method of claim 1 wherein

 The cloud account of the infrastructure cloud for accessing the IaaS service is saved, and the cloud account whose cloud account is the first user includes:

 Receiving a cloud account creation request sent by the first user client, requesting, by the cloud account creation request, at least one cloud account for accessing an infrastructure cloud of the IaaS service to the infrastructure cloud that provides the IaaS service, as the a cloud account of the first user, and saving the cloud account;

 Or receiving and saving at least one cloud account registered by the first user, where the cloud account is obtained by the first user from the infrastructure cloud that provides the IaaS service.

 3. A method according to claim 1 or 2, characterized in that

 Assigning, by the second user, the at least one cloud account of the first user as the access account of the second user accessing the infrastructure cloud providing the IaaS service includes:

Receiving, by the client of the second user, an operation request of the IaaS service object sent after the login of the account of the access sharing platform, according to the association relationship, designating, by the second user, at least one of the first user The cloud account is used as the access account of the second user to access the infrastructure cloud that provides the IaaS service; or When the second user is configured to access the account of the second user to access the shared platform, the second user is designated as the second user by using at least one cloud account of the first user according to the association relationship. Access the access account of the infrastructure cloud that provides the laaS service; or,

 After the second user subscribes to the IaaS service to the sharing platform, according to the association relationship, at least one cloud account of the first user is designated as the second user access by the second user. The access account of the infrastructure cloud of the IaaS service.

 The method according to claim 3, wherein the receiving the second user's client is based on the operation request of the IaaS service object sent after the account is logged in based on the account of the access sharing platform The method further includes: after the at least one cloud account of the first user is specified as the second user accessing the access account of the infrastructure cloud that provides the IaaS service, the method further includes:

 And the IaaS service object operation request is encapsulated according to the message format of the infrastructure cloud that provides the IaaS service corresponding to the specified access account, and the encapsulated device is sent to the infrastructure cloud that provides the IaaS service corresponding to the access account. IaaS business object operation request;

 Receiving, by the infrastructure cloud that provides the IaaS service corresponding to the specified access account, a response message sent according to the encapsulated IaaS service object operation request; encapsulating the response message, and sending the response message to the second user's client Encapsulated response message.

 The method according to claim 3, wherein, when the second user client is configured to access the account of the shared platform for the second user, according to the association relationship, the second user is Specifying at least one cloud account of the first user as the access account of the second user accessing the infrastructure cloud providing the IaaS service, or the subscribing the IaaS service to the shared platform by the second user After the at least one cloud account of the first user is specified as the second user accessing the access account of the infrastructure cloud that provides the IaaS service, the method further includes:

 Receiving, after the client of the second user logs in based on the account of the access sharing platform

Operation request of the IaaS business object; And the IaaS service object operation request is encapsulated according to the message format of the infrastructure cloud that provides the IaaS service corresponding to the specified access account, and the encapsulated device is sent to the infrastructure cloud that provides the IaaS service corresponding to the access account. IaaS business object operation request;

 Receiving, by the infrastructure cloud that provides the IaaS service corresponding to the specified access account, a response message sent according to the encapsulated IaaS service object operation request; encapsulating the response message, and sending the response message to the second user's client Encapsulated response message.

 The method according to claim 3 or 4 or 5, further comprising: setting an operation authority for the second user corresponding to the second user identifier and saving;

 After the operation request of the IaaS service object sent by the client of the second user after the login of the account of the access sharing platform is performed, before the operation request of the IaaS service object is encapsulated, the method further includes:

 Determining, according to the operation authority set by the user corresponding to the second user identifier, whether the user corresponding to the second user identifier has the right to perform the operation request on the IaaS service object, and determining the second user When the user corresponding to the identifier has the authority corresponding to the execution of the operation request, the IaaS service object operation request is encapsulated.

 The method according to claim 3 or 4 or 5, wherein after the operation request of the IaaS service object sent by the client receiving the second user after logging in based on the account of the access sharing platform , Also includes:

 And determining, according to the operation request of the IaaS service object, an infrastructure cloud that provides an IaaS service, and using the determined account of the infrastructure cloud as the designated access account of the operation request of the IaaS service object.

 The method according to claim 7, wherein the determining, according to the operation request of the IaaS service object, the infrastructure cloud that provides the IaaS service, specifically includes:

The operation request of the IaaS service object includes an identifier of an infrastructure cloud to be accessed by the second user, and the infrastructure cloud corresponding to the identifier of the infrastructure cloud is determined to be an infrastructure cloud that provides an IaaS service, or The operation request of the laaS service object does not include the identifier of the infrastructure cloud to be accessed by the second user, and the infrastructure cloud providing the laaS service is determined according to the selection rule of the infrastructure cloud provided by the second user in advance.

 9. The method according to claim 4 or 5 or 6, characterized in that it comprises:

 Allocating a unique prefix or suffix to the second user identifier, and saving a correspondence between the second user identifier and the prefix or suffix;

 The encapsulating the laaS service object operation request, or encapsulating the response message, specifically includes: acquiring a prefix or a suffix corresponding to the second user identifier according to the correspondence between the second user identifier and the prefix or the suffix;

 Adding a prefix or a suffix to the laaS service object identifier included in the laaS service object operation request when the laaS service object operation request includes the service object identifier, or when the response message includes the service object identifier, The LAAS service object identifier included in the message reduces the prefix or suffix as the identifier of the encapsulated laaS service object.

 10. A method according to claim 4 or 5 or 6, characterized in that

 Assigning an alias to the laaS business object and saving the correspondence between the laaS business object and the alias.

 The encapsulating the laaS service object operation request, or encapsulating the response message, specifically includes: when the laaS service object operation request includes the service object identifier, replacing the laaS service object identifier included in the LAAS service object operation request with The corresponding alias, or when the response message includes the service object identifier, replace the laaS service object identifier with the corresponding laaS service object identifier as the identifier of the encapsulated laaS service object.

 The method according to any one of claims 5 to 10, further comprising: establishing a correspondence between the second user identifier and the laaS service object identifier.

 The method according to any one of claims 9-11, wherein the laaS service object is one or more of a key pair, a virtual machine, a security group, a storage object, and a storage block.

13. The method according to any one of claims 4 and 5, characterized in that the laaS industry The service object operation request is an application key pair, and the response message includes a laaS service object allocated to the laaS service object operation request, and the allocated laaS service object is a key pair.

 The method according to claim 13, wherein after receiving the response message sent by the infrastructure cloud providing the laaS service, the method further includes:

 Saving the private key generated by the infrastructure cloud providing the laaS service after processing the laaS business object operation request, or

 After receiving the response message, the private key of the assigned key pair is sent to the client of the second user.

 15. The method of claim 14 wherein:

 The laaS service object operation request is an operation request for creating a virtual machine, and the operation request for creating a virtual machine includes the second user identifier, a specification of a virtual machine to be created, and a key pair name; An access account corresponding to the infrastructure cloud of the laaS service corresponding to the user identifier; encapsulating the specification and the key pair name of the virtual machine to be created in an operation request of the laaS service object, and accessing the access The infrastructure cloud that provides the laaS service corresponding to the account sends an operation request of the encapsulated laaS business object;

 The response message includes an identifier of a laaS service object generated according to the laaS service object operation request, where the laaS service object is a created virtual machine.

 The method according to claim 13, wherein the method includes: the laaS service object operation request is an operation request for creating a virtual machine, and the operation request for creating a virtual machine includes the second user identifier And the specifications of the virtual machine that you need to create;

 Finding an access account of the infrastructure cloud that provides the laaS service corresponding to the second user identifier; encapsulating the specification of the virtual machine to be created in an operation request of the laaS service object, and reporting the The infrastructure cloud that provides the laaS service corresponding to the access account sends an operation request of the encapsulated laaS service object;

The response message includes an identifier of a laaS service object generated according to the operation request of the laaS service object, where the laaS service object is a created virtual machine, and the generated LAAS service object is marked. Know the identity of the virtual machine created.

 The method according to claim 12 or 13, wherein the IaaS service object operation request is an operation request for creating a storage block or an operation request for saving a storage object, and the operation request for creating a storage block includes a storage block. Name or identifier of the storage object;

 Searching for an access account of the infrastructure cloud that provides the IaaS service corresponding to the second user identifier; encapsulating the operation request for creating the storage block or an operation request for saving the storage object in the

An operation request of the IaaS service object, and sending an operation request of the encapsulated IaaS service object to the infrastructure cloud that provides the IaaS service corresponding to the access account;

 The response message includes a result of processing the operation request to create the memory block or saving an operation request of the storage object.

 The method according to claim 17, wherein the IaaS service object operation request is to change an access right of the storage object, and after receiving the IaaS service object operation request sent by the second user client The method further includes:

 Determining, by the IaaS service object operation request, a target user that changes an access right of a storage object that is included in the IaaS service object operation request, whether the second user of the shared platform is saved, and if so, saving the new access right of the object, otherwise, providing the The infrastructure cloud of the IaaS service sends the re-encapsulated IaaS business object operation request.

 19. A shared infrastructure as a shared platform for service IaaS service cloud accounts, characterized by:

 The first storage unit 52 is configured to save at least one cloud account for accessing the infrastructure cloud that provides the IaaS service, as the cloud account of the first user, and also used to save the second user identifier and the access account. Correspondence relationship;

The first processing unit 51 is configured to create an account for the second user to access the shared platform for the second user; and specify at least one of the first user for the second user according to the association relationship between the first user and the second user. The user's cloud account is used as the second user to access an access account of the infrastructure cloud that provides the IaaS service, so that the client of the second user is based on the account of the access sharing platform and the The access account accesses the infrastructure cloud that provides the IaaS service corresponding to the access account.

 The sharing platform according to claim 19, wherein the sharing platform further includes a first receiving unit 53;

 The first receiving unit 53 is configured to receive a cloud account creation request sent by the first user client, and send the request to the first processing unit 51, where the first processing unit 51 creates a request according to the cloud account. Applying at least one cloud account to the infrastructure cloud providing the IaaS service as the cloud account of the first user;

 Or the first receiving unit 53 receives at least one cloud account registered by the first user, and saves, by the first storage unit 52, at least one cloud account registered by the first user, where the first user The registered at least one cloud account is obtained by the first user from the infrastructure cloud providing the IaaS service.

 21. A sharing platform according to claim 19 or 20, characterized in that

 The first processing unit 51, for the second user, to specify at least one cloud account of the first user as the access account of the second user accessing the infrastructure cloud providing the IaaS service, includes: the first receiving The unit 53 receives an operation request of the IaaS service object sent by the client of the second user after logging in based on the account of the access sharing platform, and sends an operation request of the IaaS service object to the first processing unit 51, The first processing unit 51 specifies, according to the association relationship, at least one cloud account of the first user for the second user as an access account of the infrastructure cloud that provides the IaaS service to the second user;

 Alternatively, the first processing unit 51, when creating a second user client accessing the account of the shared platform for the second user accessing the sharing platform, according to the association relationship, the first processing unit 51 is the first The second user specifies at least one cloud account of the first user as an access account of the second user accessing the infrastructure cloud providing the IaaS service;

Or, after the second user sends the subscription to the IaaS service to the first receiving unit 53, the first processing unit 51 specifies at least one of the first users for the second user according to the association relationship. The user's cloud account is used as the second user to access the infrastructure cloud that provides the IaaS service. Access account.

 22. The sharing platform of claim 21, wherein

 The first receiving unit 53 receives an operation request of the IaaS service object sent by the client of the second user after logging in based on the account of the access sharing platform, and sends an operation request of the IaaS service object to the first process. The unit 51, the first processing unit 51 assigns, according to the association relationship, at least one cloud account of the first user to the second user as the infrastructure cloud of the second user accessing the IaaS service. After entering the account, the method further includes:

 The first processing unit 51 encapsulates the IaaS service object operation request according to the message format of the infrastructure cloud that provides the IaaS service corresponding to the specified access account, and the first sending unit 54 accesses the access The providing device of the infrastructure cloud that provides the IaaS service corresponding to the account sends the encapsulated IaaS service object operation request;

 The first receiving unit 53 receives a response message sent by the infrastructure cloud that provides the IaaS service corresponding to the specified access account according to the encapsulated IaaS service object operation request, and encapsulates the response message, and the A sending unit 54 sends the encapsulated response message to the client of the second user.

 The sharing platform according to claim 21, wherein the first processing unit 51, when creating a second user client accessing the account of the sharing platform for the second user accessing the sharing platform, according to the Correlation relationship, the first processing unit 51 specifies, for the second user, at least one cloud account of the first user as the access account of the infrastructure cloud that provides the IaaS service to the second user, or After the second user sends the subscription to the IaaS service to the first receiving unit 53, the first processing unit 51 specifies at least one of the first user for the second user according to the association relationship. After the cloud account is accessed as an access account of the infrastructure cloud that provides the IaaS service to the second user,

 The first receiving unit 53 receives an operation request of the IaaS service object sent by the client of the second user after logging in based on the account of the access sharing platform;

Providing the basis of the IaaS service corresponding to the designated access account specified by the first processing unit 51 The message format of the facility cloud encapsulates the IaaS service object operation request, and the first sending unit 54 sends the encapsulated IaaS service object operation request to the infrastructure cloud that provides the IaaS service corresponding to the access account.

 The first receiving unit 53 receives a response message sent by the providing device of the infrastructure cloud that provides the IaaS service corresponding to the specified access account according to the encapsulated IaaS service object operation request; the first processing unit 51 encapsulates The response message, and the encapsulated response message is sent by the first sending unit 54 to the client of the second user.

 The sharing platform according to claim 22 or 23, wherein the first receiving unit 53 receives an IaaS service object sent by a client of the second user after logging in based on the account of the access sharing platform. After the operation request,

 The first processing unit 51 determines, according to the operation request of the IaaS service object, an infrastructure cloud that provides an IaaS service, and uses the determined account of the infrastructure cloud as the designated access account of the operation request of the IaaS service object. .