WO2016188153A1 - 访问角色获取方法、装置及系统 - Google Patents

访问角色获取方法、装置及系统 Download PDF

Info

Publication number
WO2016188153A1
WO2016188153A1 PCT/CN2016/073949 CN2016073949W WO2016188153A1 WO 2016188153 A1 WO2016188153 A1 WO 2016188153A1 CN 2016073949 W CN2016073949 W CN 2016073949W WO 2016188153 A1 WO2016188153 A1 WO 2016188153A1
Authority
WO
WIPO (PCT)
Prior art keywords
data center
client
role
access
temporary user
Prior art date
Application number
PCT/CN2016/073949
Other languages
English (en)
French (fr)
Inventor
童遥
彭亦辉
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016188153A1 publication Critical patent/WO2016188153A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • the present invention relates to the field of access control, and in particular to a method, device, and system for acquiring an access role.
  • Access control refers to restricting access to critical resources by unauthorized users and preventing the intrusion of illegal users or the inadvertent operation of legitimate users. Access control techniques are based on the subject-object access control idea. As long as the subject has specific access to an object, the object can be accessed.
  • Access control technology generally includes three elements: the main body: the active party that issues the access operation, usually refers to a process of the user or the user. Includes users, user groups, terminals, hosts, or an application. The subject can access the object.
  • Object The object being accessed. It can be a byte, a field, a record, a program, a file. Or a processor, memory, network contacts, and so on.
  • Secure Access Policy A set of rules used to determine whether a principal has access to an object.
  • role-based access control its basic idea is to grant access rights to users, usually determined by the role of the user in an organization, according to the user's role in the organization to make access authorization and control , but users cannot autonomously pass access to others.
  • the biggest feature of role-based access control is to associate access rights with roles. Different roles have different permissions. The user's power cannot exceed the permissions he needs to perform work. When the user's responsibilities change, the authorization is changed. Their role also changes the user's permissions, which reduces the complexity of management, but also describes more complex security policies.
  • an embodiment of the present invention provides a method, an apparatus, and a system for acquiring an access role.
  • a method for obtaining an access role including: a second data center acquiring a role obtaining request, wherein the role obtaining request carries an access right of a client; and the second data center Generating a temporary user certificate according to the access authority and the certificate issued by the first data center, where the temporary user certificate carries the access role of the client to the first data center; the second data center Send the temporary use User certificate to the client.
  • the method further includes: receiving, by the first data center, the temporary user certificate and service request sent by the client
  • the first data center determines an access role of the client to the first data center according to the temporary user certificate; and the first data center processes the service request according to the access role.
  • the acquiring, by the second data center, the role obtaining request includes: the third data center receiving a dispatching role request sent by the client; and the third data center determining the access right of the client; The third data center sends the role acquisition request to the second data center.
  • the determining, by the third data center, the access rights of the client includes: the third data center querying the access authority of the client in a role-based access control database by using an access control service.
  • the generating, by the second data center, the temporary user certificate according to the access authority and the certificate issued by the first data center comprises: the second data center according to the access right and the first The certificate issued by a data center to determine the access role of the client to the first data center; the second data center records the access role to an unsigned temporary user certificate; The data center signs the unsigned temporary user certificate using the private key of the second data center to generate the temporary user certificate.
  • the sending, by the second data center, the temporary user certificate to the client comprises: sending, by the second data center, the signed temporary user certificate and the public key of the second data center to the Client.
  • the method further includes: receiving, by the first data center The signed temporary user certificate, the public key of the second data center, and the service request sent by the client; the first data center decrypts the temporary user certificate by using the public key, and verifies the Whether the signature information of the temporary user certificate is the signature of the second data center; if the verification result is yes, the first data center determines, according to the decrypted temporary user certificate, the client to the first An access role of a data center; the first data center processes the service request according to the access role.
  • an access role obtaining apparatus which is applied to a second data center, and includes: an obtaining module, configured to acquire a role obtaining request, wherein the role obtaining request carries a client access a generating module, configured to generate a temporary user certificate according to the access right and a certificate issued by the first data center, where the temporary user certificate carries the access role of the client to the first data center a sending module configured to send the temporary user certificate to the client.
  • the generating module includes: a determining unit, configured to determine, according to the access right and the certificate, the access role of the client to the first data center; and a recording unit configured to: The access role records to the unsigned temporary user certificate; the signing unit is configured to sign the unsigned temporary user certificate using the private key of the second data center to generate the temporary user certificate.
  • the sending module is configured to: send the signed temporary user certificate and the second data center The public key to the client.
  • an access role acquisition system including: a first data center, a second data center, a third data center, and a client, wherein the second data center includes: The access role acquisition device described.
  • the first data center includes: a first receiving module, configured to receive the temporary user certificate and a service request sent by the client; and a first determining module, configured to determine, according to the temporary user certificate, Determining an access role of the client to the first data center; and the processing module is configured to process the service request according to the access role.
  • a first receiving module configured to receive the temporary user certificate and a service request sent by the client
  • a first determining module configured to determine, according to the temporary user certificate, Determining an access role of the client to the first data center
  • the processing module is configured to process the service request according to the access role.
  • the first receiving module is configured to receive the signed temporary user certificate, the public key of the second data center, and a service request sent by the client;
  • the first determining module is configured to decrypt the temporary user certificate by using the public key, and verify whether the signature information of the temporary user certificate is a signature of the second data center; and if the verification result is yes And determining, by the first data center, the access role of the client to the first data center according to the decrypted temporary user certificate.
  • the third data center includes: a second receiving module, configured to receive a dispatching role request sent by the client; a second determining module, configured to determine the access authority of the client; a delivery module, setting A request is sent to the second data center for sending the role.
  • the second determining module is configured to query the access authority of the client in a role-based access control database by using an access control service.
  • the second data center is used to obtain a role acquisition request, where the role acquisition request carries the access authority of the client; the second data center generates the temporary user certificate according to the access authority and the certificate issued by the first data center.
  • the temporary user certificate carries the access role of the client to the first data center; the second data center sends the temporary user certificate to the client, which solves the problem that the related technology does not provide the cloud computing multi-level data center system.
  • the role-based access control method realizes role-based access control in a cloud computing multi-level data center system.
  • FIG. 1 is a schematic flowchart of an access role acquisition method according to an embodiment of the present invention.
  • FIG. 2 is a schematic structural diagram of an access role obtaining apparatus according to an embodiment of the present invention.
  • FIG. 3 is a first schematic structural diagram 1 of an access role obtaining apparatus according to an embodiment of the present invention.
  • FIG. 4 is a second schematic structural diagram of an access role obtaining apparatus according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of an access role acquisition system according to an embodiment of the present invention.
  • FIG. 6 is a flow chart of an event processing method in accordance with a preferred embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a system according to a preferred embodiment 1 of the preferred embodiment of the present invention.
  • FIG. 8 is a schematic diagram of access control according to a preferred embodiment 1 of the preferred embodiment of the present invention.
  • Embodiment 9 is a schematic structural diagram of a system to which Embodiment 2 of the present invention is applied;
  • FIG. 10 is a schematic structural diagram of a system to which Embodiment 3 of the present invention is applied.
  • FIG. 1 is a flowchart of a method for acquiring an access role according to an embodiment of the present invention. As shown in FIG. 1 , the process includes the following steps:
  • Step S102 the second data center acquires a role acquisition request, where the role acquisition request carries the access authority of the client;
  • Step S104 The second data center generates a temporary user certificate according to the access authority and the certificate issued by the first data center, where the temporary user certificate carries the access role of the client to the first data center.
  • Step S106 the second data center sends a temporary user certificate to the client.
  • the second data center transmits the access role information of the client to the first data center to the client according to the access authority of the client and the certificate issued by the first data center, thereby realizing the client access role.
  • the problem that the role-based access control method is applied in the cloud computing multi-level data center system is not solved in the related art, and the role-based access control in the cloud computing multi-level data center system is realized.
  • the client may send the received temporary user certificate and the service request to the first data center.
  • the first data center receives the temporary user certificate and the service request sent by the client; determines the access role of the client to the first data center according to the temporary user certificate; and processes the service request according to the access role.
  • the client performs role-based access control on the first data center.
  • the second data center can directly interact with the client, for example, after obtaining the client's assigned role request, according to the query client's access right, the client role is obtained.
  • the request is obtained, wherein the role obtaining request carries related information of the access right of the client.
  • the role obtaining request may be generated by the third data center according to the access authority of the client, for example, the third data center receives the assigned role sent by the client.
  • the third data center determines the access rights of the client; the third data center sends the role acquisition request to the second data center.
  • the access right is queried by the third data center in the role-based access control database through the access control service.
  • the third data center queries the access authority of the client in the role-based access control database through the access control service.
  • the second data center determines the access role of the client to the first data center according to the access authority and the certificate; records the access role to the unsigned temporary user certificate; and uses the private key of the second data center. Sign the unsigned temporary user certificate to generate a temporary user certificate.
  • asymmetric encryption is used to improve security.
  • the second data center transmits the signed temporary user certificate and the public key of the second data center to the client.
  • the encryption mode of the certificate is not limited to an asymmetric encryption algorithm.
  • a symmetric encryption algorithm may also be adopted.
  • the method further includes: receiving, by the first data center, the signed temporary user certificate sent by the client, The public key and service request of the second data center; the first data center decrypts the temporary user certificate by using the public key, and verifies whether the signature information of the temporary user certificate is the signature of the second data center; if the verification result is yes, A data center determines an access role of the client to the first data center according to the decrypted temporary user certificate; the first data center processes the service request according to the access role.
  • the certificate-based access control is integrated, which not only improves the security, but also improves the flexibility of access control in the cloud computing multi-level data center system.
  • the second data center may verify the identity validity of the third data center; wherein generating the temporary user certificate comprises: at the third data center A temporary user certificate is generated if the identity is valid.
  • an access role obtaining device is also provided, which is applied to the second data center, and is used to implement the foregoing embodiments and preferred embodiments.
  • the module is explained.
  • the term "module” may implement a combination of software and/or hardware of a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 2 is a schematic structural diagram of an access role obtaining apparatus according to an embodiment of the present invention.
  • the apparatus pack The obtaining module 22, the generating module 24, and the sending module 26, wherein the obtaining module 22 is configured to acquire a role obtaining request, wherein the role obtaining request carries the access authority of the client;
  • the generating module 24 is coupled to the obtaining module 22, Setting a temporary user certificate according to the access authority and the certificate issued by the first data center, where the temporary user certificate carries the access role of the client to the first data center;
  • the sending module 26 is coupled to the generating module 24, and is set to Send a temporary user certificate to the client.
  • the second data center transmits the access role information of the client to the first data center to the client according to the access authority of the client and the certificate issued by the first data center, thereby realizing the client. Access to the acquisition of the role.
  • the problem that the role-based access control method is applied in the cloud computing multi-level data center system is not solved in the related art, and the role-based access control in the cloud computing multi-level data center system is realized.
  • FIG. 3 is a first schematic diagram of a preferred structure of an access role obtaining apparatus according to an embodiment of the present invention.
  • the generating module 24 includes: a determining unit 242, configured to determine a client pair according to an access right and a certificate. An access role of a data center; a recording unit 244 coupled to the determining unit 242, configured to record the access role to the unsigned temporary user certificate; a signature unit 246 coupled to the recording unit 244, configured to use the private key of the second data center Sign the unsigned temporary user certificate to generate a temporary user certificate.
  • the sending module 26 is configured to send the signed temporary user certificate and the public key of the second data center to the client.
  • FIG. 4 is a schematic diagram of a preferred structure of an access role obtaining apparatus according to an embodiment of the present invention.
  • the apparatus further includes: a verification module 42 coupled to the obtaining module 22 and the generating module 24 respectively for setting verification.
  • FIG. 5 is a schematic structural diagram of an access role acquisition system according to an embodiment of the present invention. As shown in FIG. 5, the system includes: a first data center 52 and second data. The center 54, the third data center 56, and the client 58, wherein the second data center 54 includes the access role obtaining means 542 as above.
  • the first data center coupling 52 is coupled to the second data center 54
  • the second data center 54 is coupled to the third data center 56
  • the third data center 56 is coupled to the client 58
  • the client 58 is coupled to the first data center 52.
  • the first data center 52 includes: a first receiving module, configured to receive a temporary user certificate and a service request sent by the client; the first determining module is coupled to the first receiving module, and is configured to determine the client according to the temporary user certificate.
  • the first receiving module is configured to receive the signed temporary user certificate sent by the client, the public key of the second data center, and the service request; the first determining module is configured to adopt the public The key decrypts the temporary user certificate, and verifies whether the signature information of the temporary user certificate is the signature of the second data center; and if the verification result is yes, the first data center determines that the client is the first according to the decrypted temporary user certificate.
  • the access role of the data center is configured to receive the signed temporary user certificate sent by the client, the public key of the second data center, and the service request; the first determining module is configured to adopt the public The key decrypts the temporary user certificate, and verifies whether the signature information of the temporary user certificate is the signature of the second data center; and if the verification result is yes, the first data center determines that the client is the first according to the decrypted temporary user certificate.
  • the access role of the data center is configured to receive the signed temporary user certificate sent by the client, the public key of the second data center, and the service request;
  • the third data center 56 includes: a second receiving module, configured to receive the assigned role sent by the client, And a second determining module, coupled to the second receiving module, configured to determine an access right of the client; the sending module, coupled to the second determining module, configured to send the role obtaining request to the second data center.
  • the second determining module is configured to query the access rights of the client in the role-based access control database through the access control service.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • a preferred embodiment of the present invention provides an access control method for a cloud computing data center.
  • a secure data center access control mechanism can be provided to help the enterprise to implement a secure data center construction and improve operation and maintenance efficiency.
  • the preferred embodiment of the present invention combines the access control technology with the access principle of the data center, and proposes a certificate-based regional authorization access control method, thereby effectively solving the data.
  • Central access security issues For the topology characteristics of the cloud computing data center, the preferred embodiment of the present invention combines the access control technology with the access principle of the data center, and proposes a certificate-based regional authorization access control method, thereby effectively solving the data. Central access security issues.
  • a method for access control of a cloud computing data center provided by a preferred embodiment of the present invention, considering that in a network environment of a cross-regional data center, different role-based access control rights exist within each data center, the present invention proposes a A zone-authorized access control mechanism that combines identity authentication and access control permissions through certificates.
  • the authorization domain is based on the management of a central server. Data centers in different regions are listed in different domains according to their affiliation. At the same time, the central server grants different access rights to different domains according to actual conditions.
  • the primary data center is an independent entity. It is the authority of all authorized domains. All authorized domains will be divided and established. The information about each authorized domain will be stored in the primary data center database.
  • the trust relationship between each authorized domain and the primary data center is mainly composed of three actions: registration, update and revocation.
  • the authorized domain when a new authorized domain appears on the network, it must register with the primary data center server, and the authorized domain that receives the certificate authenticated by the certificate authority is a valid authorized domain.
  • the authorized domain may change its own state, condition, etc. registration content for some reason, so the registration information can be updated or revoked during the running of the system.
  • the authorized domain sends its update status to the primary data center in the form of a update primitive, so that the registration information of the data center is consistent with the registration information in the authorized domain.
  • the authorized domain is removed from the jurisdiction of the primary data center and access to the primary data center is no longer possible.
  • Step 1 The client first requests a role to be assigned to the third-level data center (equivalent to the third data center). After receiving the request, the third-level data center may send the access control service through the intermediate service agent, and the service searches for the role-based service.
  • the access control (Role-Based Access Control, RBAC for short) database is used to verify whether the client has the corresponding permission to access the data of the primary data center (equivalent to the first data center), and then sends the result to the intermediate service. proxy.
  • RBAC Role-Based Access Control
  • the process of processing related processes by the intermediate service agent is not a necessary process for implementing the preferred embodiment of the present invention.
  • the method of using the intermediate service agent can improve security on the one hand and facilitate correlation on the other hand.
  • the modular encapsulation of functional entities facilitates compatibility with various protocols.
  • Step 2 If the client has the corresponding authority, the intermediate service agent sends the access right of the client to the role dispatching service together, the role dispatching service processes, encapsulates into a get role request service, and sends the service
  • the secondary data center (corresponding to the second data center mentioned above); after receiving the service request, the secondary data center may also process through the intermediate service agent, and send the processing result to the authorized access control service for verification.
  • Step 3 After the authorized access control service receives the request, the server first verifies the validity of the identity of the sender (three-level data center) according to the data in the database; after passing, the certificate server will issue the authorization according to the primary data center.
  • the certificate content of the domain obtain the corresponding access role of the client to the primary data center, and record the information to a new temporary user certificate; after obtaining the assigned role, the certificate server will sign it with its own private key. At the same time, attach your own public key to form a complete temporary user certificate and send it to the client.
  • Step 4 After the client obtains the temporary user certificate, the temporary user certificate must be attached when submitting the service request to the primary data center.
  • the primary data center receives the service request, it first decrypts the certificate using the public key. If the signature of the central server is found, the certificate is considered to be legal, the client identity authentication is passed, and the client has obtained the The role of the first-level data center through the role of the role to complete the service request submitted by the client, after completion, the results are returned to the client.
  • the overall architecture of the data center adopting the preferred embodiment of the present invention is as shown in FIG. 7, and includes: a user portal module, a management portal module, an operation management module, an IT service management module, a resource management module, an IT operation and maintenance management module, and an infrastructure management module. .
  • the user portal module comprises: a self-service portal and a service catalog.
  • the management portal module includes: alarm management, report presentation, rights management, and access control.
  • the operation management module comprises: service catalog management, product management, billing/report management, order management, user management, and resource scheduling.
  • the information technology (IT) service management module comprises: a service desk, a service level agreement (SLA) management, a problem Management, event management, configuration management, change management.
  • SLA service level agreement
  • the resource management module includes: application deployment, resource/template management, resource scheduling, and resource monitoring.
  • the IT operation and maintenance management module includes: service impact analysis, alarm, topology, performance, report, server monitoring, network monitoring, storage monitoring, middleware monitoring, application monitoring, and database monitoring.
  • the infrastructure management module includes: alarm management, three-dimensional (3D) room visualization, energy management, capacity management, environmental monitoring, and power monitoring.
  • 3D three-dimensional
  • the workflow of the preferred embodiment of the present invention is as shown in FIG. 8 and includes the following steps:
  • Step S802 The client first sends an access request to the nearest three-level data center, and performs preliminary verification through the access control service of the three-level data center whether the data has the corresponding authority to access the data of the primary data center, and then notify the third-level data center permission Management module.
  • Step S804 the three-level data center rights management module re-encapsulates the client request and sends it to the secondary data center.
  • Step S806 the authorized access control service of the secondary data center first verifies the message, and verifies the validity of the identity of the requesting sender (ie, the three-level data center). After passing, the temporary management certificate generated by the certificate management module is sent to the client.
  • Step S808 after the client obtains the temporary user certificate, the temporary user certificate must be attached when submitting the service request to the primary data center.
  • the primary data center receives the service request, it first decrypts the certificate using the public key. If the signature of the central server is found, the certificate is considered to be legal, the client identity authentication is passed, and the client has obtained the The role of the first-level data center through the role of the role to complete the service request submitted by the client, after completion, the results are returned to the client.
  • the traditional distributed, layered, and heterogeneous data center architecture can be upgraded to a distributed cloud data center of physical distributed and logically centralized unified resource management.
  • Data centers of different geographies, different phases, and different scales can be mixed into one logical resource pool across data centers, and global capacity management. It can manage and schedule resources across multiple data centers across regions, and strategic access control management. It can be seen that by applying the access control function provided by the system, the security and confidentiality of the entire system are strengthened.
  • the data center system used is as shown in FIG. 9.
  • the system also adopts a three-level architecture, and a data center is constructed at the group headquarters as a primary data center, and the country is divided into two regions, the south.
  • the base and the northern base respectively construct the Southern Base Data Center and the Northern Base Data Center as secondary data centers (the Southern Base Data Center and the Northern Base Data Center each govern the data centers of multiple provinces), and the provincial capital cities respectively construct data centers as three. Level data center.
  • Step S902 the client first sends an access request to the data center of the XX city in the province where the territory is located, and passes the data in the XX city.
  • the heart's access control service performs preliminary verification whether it has the corresponding authority to access the data of the primary data center, and then informs the Northern Base Data Center Rights Management Module.
  • Step S904 the XX city data center authority management module re-encapsulates the client request and sends it to the northern base data center.
  • Step S906 the authorized access control service of the northern base data center first verifies the message, and verifies the validity of the identity of the requesting sender (ie, the XX city data center). After passing, the temporary management certificate generated by the certificate management module is sent to the client.
  • Step S908 after the client obtains the temporary user certificate, the temporary user certificate must be attached when submitting the service request to the headquarters data center.
  • the headquarters data center receives the service request, it first uses the public key to decrypt the certificate. If the signature of the central server is found, the certificate is considered to be legal, the client identity authentication is passed, and the client has obtained the Role; the headquarters data center completes the service request submitted by the client through the permissions of the role, and returns the result to the client after completion.
  • the system effectively reduces the construction and management cost of the data center, and realizes data isolation between the data center and the data center.
  • each data center is composed of a service service platform, a cloud management platform, and a data center management platform. .
  • the business service platform is responsible for managing various services, including: monitoring, data analysis, office services, and so on.
  • the cloud management platform manages load virtualization management and resource operation management, including: virtualized environment management software, resource operation management software, access control management software, and certificate management software.
  • the data center management platform is responsible for monitoring the data center infrastructure, including: video surveillance, environmental monitoring, power distribution monitoring, energy consumption monitoring, refrigeration monitoring, security monitoring and capacity monitoring.
  • step S1002 the operation and maintenance engineer sends an access request to the third-level data center through the dedicated client, and performs preliminary verification through the access control management software of the third-level data center whether the corresponding permission has access to the primary data center, and the secondary data is notified after passing.
  • Central access control management software
  • step S1004 the access control management software of the three-level data center re-encapsulates the client request and sends it to the secondary data center.
  • step S1006 the access control management software of the secondary data center first verifies the message and verifies the validity of the identity of the requesting sender (ie, the three-level data center). After passing, the temporary management certificate generated by the certificate management software is sent to the client.
  • step S1008 after the client obtains the temporary user certificate, the temporary user certificate must be attached when submitting the service request to the primary data center.
  • the primary data center receives the service request, it first decrypts the certificate using the public key, such as If the signature of the central server is found, the certificate is considered to be legal, the client identity authentication is passed, and the role of the client is obtained therefrom; the primary data center completes the service submitted by the client through the authority of the role. After the request is completed, the result is returned to the client.
  • the public key such as If the signature of the central server is found, the certificate is considered to be legal, the client identity authentication is passed, and the role of the client is obtained therefrom; the primary data center completes the service submitted by the client through the authority of the role. After the request is completed, the result is returned to the client.
  • the system realizes the access control between the data centers and the access control of the operation and maintenance personnel accessing the data center through the access control management software, effectively realizing the data isolation inside the data center.
  • the embodiment of the present invention proposes a certificate-based area authorization access control mechanism, which combines the advantages of the existing access control technology to achieve secure and reliable access between various systems. It is used in the construction of various distributed data centers to ensure the confidentiality, integrity and availability of data center data.
  • a storage medium is further provided, wherein the software includes the above-mentioned software, including but not limited to: an optical disk, a floppy disk, a hard disk, an erasable memory, and the like.
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.
  • the second data center is used to obtain a role acquisition request, where the role acquisition request carries the access authority of the client; the second data center generates the temporary user certificate according to the access authority and the certificate issued by the first data center.
  • the temporary user certificate carries the access role of the client to the first data center; the second data center sends the temporary user certificate to the client, which solves the problem that the multi-level data center system is not provided in the cloud computing system.
  • the role-based access control method is applied to implement role-based access control in a cloud computing multi-level data center system.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本发明提供了访问角色获取方法、装置及系统，其中，该方法包括：采用第二数据中心获取角色获取请求，其中，角色获取请求中携带有客户端的访问权限；第二数据中心根据访问权限和第一数据中心颁发的证书，生成临时用户证书，其中，临时用户证书中携带有客户端对第一数据中心的访问角色；第二数据中心发送临时用户证书至客户端。通过本发明，解决了在相关技术中没有提供在云计算多级数据中心系统中应用基于角色的访问控制方法的问题，实现了云计算多级数据中心系统中基于角色的访问控制。

Description

访问角色获取方法、装置及系统 技术领域
本发明涉及访问控制领域，具体而言，涉及一种访问角色获取方法、装置及系统。
背景技术
访问控制是指限制不合法用户对关键资源的访问，防止非法用户的侵入或合法用户的不慎操作所造成的破坏。访问控制技术都是建立在对主体-客体访问控制思想上的。只要主体拥有对某客体的特定访问权限，就可以对客体进行访问。
访问控制技术中一般包括三个要素：主体：发出访问操作的主动方，通常指用户或用户的某个进程。包括用户、用户组、终端、主机或一个应用。主体可以访问客体。客体：被访问的对象。它可以是一个字节、字段、记录、程序、文件。或者是一个处理器、存储器、网络接点等。安全访问政策：一套规则，用以确定一个主体是否对客体拥有访问能力。
目前使用最多的是基于角色的访问控制，它的基本思想是授权给用户的访问权限，通常由用户在一个组织中担当的角色来确定，根据用户在组织内所处的角色作出访问授权与控制，但用户不能自主地将访问权限传给他人。基于角色的访问控制最大的特点就是将访问权限与角色相关联，不同的角色有不同权限，用户所拥有的权力不能超过他执行工作时所需的权限，当用户的职责变化时，改变授权给他们的角色，也就改变了用户的权限，这样就降低了管理的复杂度，同时也可以描述更复杂的安全策略。
目前，云计算数据中心的部署，是以区域为单位进行部署，同一级别的区域建立同一级别的数据中心，同级数据中心之前不需要互相通信，它们仅与上级数据中心以及它所下属的下级数据中心进行通信，同时可以对下一级数据中心进行一定的管理。然而，由于相关技术中的基于角色的访问控制并不能够自主地将访问权限传给他人，因此，如何在云计算多级数据中心系统中实现基于角色的访问控制方法，目前并没有提出有效的解决方案。
针对相关技术中没有提供在云计算多级数据中心系统中应用基于角色的访问控制方法的问题，目前尚未提出有效的解决方案。
发明内容
为了解决上述技术问题，本发明实施例提供了一种访问角色获取方法、装置及系统。
根据本发明实施例的一个方面，提供了一种访问角色获取方法，包括：第二数据中心获取角色获取请求，其中，所述角色获取请求中携带有客户端的访问权限；所述第二数据中心根据所述访问权限和第一数据中心颁发的证书，生成临时用户证书，其中，所述临时用户证书中携带有所述客户端对所述第一数据中心的访问角色；所述第二数据中心发送所述临时用 户证书至所述客户端。
优选地，在所述第二数据中心发送所述临时用户证书至所述客户端之后，所述方法还包括：所述第一数据中心接收所述客户端发送的所述临时用户证书和服务请求；所述第一数据中心根据所述临时用户证书，确定所述客户端对所述第一数据中心的访问角色；所述第一数据中心根据所述访问角色，处理所述服务请求。
优选地，所述第二数据中心获取所述角色获取请求包括：所述第三数据中心接收所述客户端发送的分派角色请求；所述第三数据中心确定所述客户端的所述访问权限；所述第三数据中心发送所述角色获取请求至所述第二数据中心。
优选地，所述第三数据中心确定所述客户端的所述访问权限包括：第三数据中心通过访问控制服务在基于角色的访问控制数据库中查询所述客户端的所述访问权限。
优选地，所述第二数据中心根据所述访问权限和所述第一数据中心颁发的所述证书，生成所述临时用户证书包括：所述第二数据中心根据所述访问权限和所述第一数据中心颁发的所述证书，确定所述客户端对所述第一数据中心的所述访问角色；所述第二数据中心将所述访问角色记录至未签名临时用户证书；所述第二数据中心使用所述第二数据中心的私钥对所述未签名临时用户证书进行签名，生成所述临时用户证书。
优选地，所述第二数据中心发送所述临时用户证书至所述客户端包括：所述第二数据中心发送已签名的所述临时用户证书和所述第二数据中心的公钥至所述客户端。
优选地，在所述第二数据中心发送已签名的所述临时用户证书和所述第二数据中心的公钥至所述客户端的情况下，所述方法还包括：所述第一数据中心接收所述客户端发送的已签名的所述临时用户证书、所述第二数据中心的公钥和服务请求；所述第一数据中心采用所述公钥解密所述临时用户证书，并验证所述临时用户证书的签名信息是否为所述第二数据中心的签名；在验证结果为是的情况下，所述第一数据中心根据解密的所述临时用户证书，确定所述客户端对所述第一数据中心的访问角色；所述第一数据中心根据所述访问角色，处理所述服务请求。
根据本发明的另一个方面，还提供了一种访问角色获取装置，应用于第二数据中心，包括：获取模块，设置为获取角色获取请求，其中，所述角色获取请求中携带有客户端的访问权限；生成模块，设置为根据所述访问权限和第一数据中心颁发的证书，生成临时用户证书，其中，所述临时用户证书中携带有所述客户端对所述第一数据中心的访问角色；发送模块，设置为发送所述临时用户证书至所述客户端。
优选地，所述生成模块包括：确定单元，设置为根据所述访问权限和所述证书，确定所述客户端对所述第一数据中心的所述访问角色；记录单元，设置为将所述访问角色记录至未签名临时用户证书；签名单元，设置为使用所述第二数据中心的私钥对所述未签名临时用户证书进行签名，生成所述临时用户证书。
优选地，所述发送模块设置为：发送已签名的所述临时用户证书和所述第二数据中心的 公钥至所述客户端。
根据本发明的另一个方面，还提供了一种访问角色获取系统，包括：第一数据中心、第二数据中心、第三数据中心和客户端，其中，所述第二数据中心包括：如上所述的访问角色获取装置。
优选地，所述第一数据中心包括：第一接收模块，设置为接收所述客户端发送的所述临时用户证书和服务请求；第一确定模块，设置为根据所述临时用户证书，确定所述客户端对所述第一数据中心的访问角色；处理模块，设置为根据所述访问角色，处理所述服务请求。
优选地，在所述第一数据中心中：所述第一接收模块，设置为接收所述客户端发送的已签名的所述临时用户证书、所述第二数据中心的公钥和服务请求；所述第一确定模块，设置为采用所述公钥解密所述临时用户证书，并验证所述临时用户证书的签名信息是否为所述第二数据中心的签名；并在验证结果为是的情况下，所述第一数据中心根据解密的所述临时用户证书，确定所述客户端对所述第一数据中心的访问角色。
优选地，所述第三数据中心包括：第二接收模块，设置为接收所述客户端发送的分派角色请求；第二确定模块，设置为确定所述客户端的所述访问权限；输送模块，设置为发送所述角色获取请求至所述第二数据中心。
优选地，所述第二确定模块设置为：通过访问控制服务在基于角色的访问控制数据库中查询所述客户端的所述访问权限。
通过本发明实施例，采用第二数据中心获取角色获取请求，其中，角色获取请求中携带有客户端的访问权限；第二数据中心根据访问权限和第一数据中心颁发的证书，生成临时用户证书，其中，临时用户证书中携带有客户端对第一数据中心的访问角色；第二数据中心发送临时用户证书至客户端的方式，解决了在相关技术中没有提供在云计算多级数据中心系统中应用基于角色的访问控制方法的问题，实现了云计算多级数据中心系统中基于角色的访问控制。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是根据本发明实施例的访问角色获取方法的流程示意图；
图2是根据本发明实施例的访问角色获取装置的结构示意图；
图3是根据本发明实施例的访问角色获取装置的优选结构示意图一；
图4是根据本发明实施例的访问角色获取装置的优选结构示意图二；
图5是根据本发明实施例的访问角色获取系统的结构示意图；
图6是根据本发明优选实施例的事件处理方法的流程图；
图7是根据本发明优选实施例的优选实施方式一的系统结构示意图；
图8是根据本发明优选实施例的优选实施方式一的访问控制示意图；
图9是应用本发明的实施方式二的系统结构示意图；
图10是应用本发明的实施方式三的系统结构示意图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
本发明的其它特征和优点将在随后的说明书中阐述，并且，部分地从说明书中变得显而易见，或者通过实施本发明而了解。本发明的目的和其他优点可通过在所写的说明书、权利要求书、以及附图中所特别指出的结构来实现和获得。
为了使本技术领域的人员更好地理解本发明方案，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分的实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本发明保护的范围。
本发明实施例提供了一种访问角色获取方法，图1是根据本发明实施例的访问角色获取方法的流程图，如图1所示，该流程包括如下步骤：
步骤S102，第二数据中心获取角色获取请求，其中，角色获取请求中携带有客户端的访问权限；
步骤S104，第二数据中心根据访问权限和第一数据中心颁发的证书，生成临时用户证书，其中，临时用户证书中携带有客户端对第一数据中心的访问角色；
步骤S106，第二数据中心发送临时用户证书至客户端。
通过上述步骤，通过第二数据中心根据客户端的访问权限和第一数据中心颁发的证书，将携带有客户端对第一数据中心的访问角色信息发送给客户端，从而实现了客户端访问角色的获取。解决了相关技术中没有提供在云计算多级数据中心系统中应用基于角色的访问控制方法的问题，实现了云计算多级数据中心系统中基于角色的访问控制。
相应地，为了实现访问控制，在客户端将要访问第一数据中心的情况下，客户端可以将收到的临时用户证书以及服务请求发送给第一数据中心。第一数据中心接收客户端发送的临时用户证书和服务请求；根据临时用户证书，确定客户端对第一数据中心的访问角色；以及根据访问角色，处理服务请求。通过上述方式，实现了客户端对第一数据中心基于角色的访问控制。
优选地，在两级数据中心设置的云计算中心中，第二数据中心可以直接与客户端进行交互，例如，在获取客户端的分配角色请求后，根据查询客户端的访问权限，从而得到客户端的角色获取请求，其中，角色获取请求中携带有客户端的访问权限的相关信息。而在采用两级以上的数据中心设置的云计算中心中，优选地，角色获取请求可以是由第三数据中心根据客户端的访问权限生成的，例如，第三数据中心接收客户端发送的分派角色请求；第三数据中心确定客户端的访问权限；第三数据中心发送角色获取请求至第二数据中心。通过上述方式，实现了客户端访问权限的确定。
优选地，访问权限是由第三数据中心通过访问控制服务在基于角色的访问控制数据库中查询的，例如，第三数据中心通过访问控制服务在基于角色的访问控制数据库中查询客户端的访问权限。
优选地，在步骤S104中，第二数据中心根据访问权限和证书，确定客户端对第一数据中心的访问角色；将访问角色记录至未签名临时用户证书；以及使用第二数据中心的私钥对未签名临时用户证书进行签名，生成临时用户证书。通过上述方式，采用不对称加密提升了安全性。
优选地，在采用不对称加密的情况下，在步骤S106中，第二数据中心发送已签名的临时用户证书和第二数据中心的公钥至客户端。
需要说明的是，在本发明实施例中并不限于证书的加密方式为不对称加密算法，例如，对称加密算法也是可以被采用的。
优选地，在第二数据中心发送已签名的临时用户证书和第二数据中心的公钥至客户端的情况下，上述方法还包括：第一数据中心接收客户端发送的已签名的临时用户证书、第二数据中心的公钥和服务请求；第一数据中心采用公钥解密临时用户证书，并验证临时用户证书的签名信息是否为第二数据中心的签名；在验证结果为是的情况下，第一数据中心根据解密的临时用户证书，确定客户端对第一数据中心的访问角色；第一数据中心根据访问角色，处理服务请求。通过上述方式，在基于角色的访问控制中，融合了基于证书的访问控制，不仅提升了安全性，也提升了在云计算多级数据中心系统中访问控制的灵活性。
优选地，为了进一步的提升安全性，在第二数据中心获取角色获取请求之后，第二数据中心可以验证第三数据中心的身份有效性；其中，生成临时用户证书包括：在第三数据中心的身份为有效的情况下，生成临时用户证书。
在本实施例中还提供了一种访问角色获取装置，应用于第二数据中心，用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述，下面对该装置中涉及到的模块进行说明。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图2是根据本发明实施例的访问角色获取装置的结构示意图，如图2所示，该装置包 括：获取模块22、生成模块24和发送模块26，其中，获取模块22，设置为获取角色获取请求，其中，角色获取请求中携带有客户端的访问权限；生成模块24，耦合至获取模块22，设置为根据访问权限和第一数据中心颁发的证书，生成临时用户证书，其中，临时用户证书中携带有客户端对第一数据中心的访问角色；发送模块26，耦合至生成模块24，设置为发送临时用户证书至客户端。
通过上述模块的综合作用，通过第二数据中心根据客户端的访问权限和第一数据中心颁发的证书，将携带有客户端对第一数据中心的访问角色信息发送给客户端，从而实现了客户端访问角色的获取。解决了相关技术中没有提供在云计算多级数据中心系统中应用基于角色的访问控制方法的问题，实现了云计算多级数据中心系统中基于角色的访问控制。
图3是根据本发明实施例的访问角色获取装置的优选结构示意图一，如图3所示，优选地，生成模块24包括：确定单元242，设置为根据访问权限和证书，确定客户端对第一数据中心的访问角色；记录单元244，耦合至确定单元242，设置为将访问角色记录至未签名临时用户证书；签名单元246，耦合至记录单元244，设置为使用第二数据中心的私钥对未签名临时用户证书进行签名，生成临时用户证书。
优选地，发送模块26设置为：发送已签名的临时用户证书和第二数据中心的公钥至客户端。
图4是根据本发明实施例的访问角色获取装置的优选结构示意图二，如图4所示，优选地，装置还包括：验证模块42，分别耦合至获取模块22和生成模块24设置为验证第三数据中心的身份有效性；其中，生成模块24设置为：在第三数据中心的身份为有效的情况下，生成临时用户证书。
本发明实施例还提供了一种访问角色获取系统，图5是根据本发明实施例的访问角色获取系统的结构示意图，如图5所示，该系统包括：第一数据中心52、第二数据中心54、第三数据中心56和客户端58，其中，第二数据中心54包括：如上的访问角色获取装置542。
其中，第一数据中心耦52合至第二数据中心54，第二数据中心54耦合至第三数据中心56，第三数据中心56耦合至客户端58，客户端58耦合至第一数据中心52。
优选地，第一数据中心52包括：第一接收模块，设置为接收客户端发送的临时用户证书和服务请求；第一确定模块，耦合至第一接收模块，设置为根据临时用户证书，确定客户端对第一数据中心的访问角色；处理模块，耦合至第一确定模块，设置为根据访问角色，处理服务请求。
优选地，在第一数据中心52中：第一接收模块，设置为接收客户端发送的已签名的临时用户证书、第二数据中心的公钥和服务请求；第一确定模块，设置为采用公钥解密临时用户证书，并验证临时用户证书的签名信息是否为第二数据中心的签名；并在验证结果为是的情况下，第一数据中心根据解密的临时用户证书，确定客户端对第一数据中心的访问角色。
优选地，第三数据中心56包括：第二接收模块，设置为接收客户端发送的分派角色请 求；第二确定模块，耦合至第二接收模块，设置为确定客户端的访问权限；输送模块，耦合至第二确定模块，设置为发送角色获取请求至第二数据中心。
优选地，第二确定模块设置为：通过访问控制服务在基于角色的访问控制数据库中查询客户端的访问权限。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
为了使本发明实施例的描述更加清楚，下面结合优选实施例进行描述和说明。
本发明优选实施例提供了一种云计算数据中心的访问控制方法。在本发明优选实施例中，基于云计算技术和虚拟化技术，可以提供安全的数据中心访问控制机制，帮助企业进行安全的数据中心建设，提升运维效率。
针对云计算的数据中心的拓扑结构特点，本发明优选实施例将访问控制技术和对数据中心的访问原则相结合，提出了一种基于证书的区域授权访问控制方法，从而可以有效地解决了数据中心访问安全性的问题。
本发明优选实施例提供的一种云计算数据中心的访问控制方法，考虑到在跨地域数据中心的网络环境中，各级数据中心内部又存在不同的基于角色的访问控制权限，本发明提出一种将身份认证和访问控制权限通过证书结合在一起的区域授权访问控制机制。
(1)授权域
授权域是在一个中心服务器的管理下，将不同地域的数据中心，按照其隶属关系，列入到不同的域中，同时，中心服务器根据实际情况，对不同的域授予不同的访问操作权限。一级数据中心是一个独立个体，它是所有授权域的授权权威，所有的授权域都将通过它进行划分建立，每个授权域的相关信息都将保存在一级数据中心数据库中。
(2)一级数据中心与授权域之间的身份认证和权限控制
每个授权域与一级数据中心建立信任关系主要由3个动作组成：注册、更新和撤销。
首先，当一个新的授权域在网络中出现时，它必须向一级数据中心服务器进行注册，接收到经过认证中心认证的证书的授权域才是有效的授权域。其次，在动态的环境中，授权域可能会因为某些原因变更自身的状态、条件等注册内容，因此在系统运行的过程中，注册信息能够被更新或撤销。授权域将自己的更新状态以更新原语的方式发送给一级数据中心，使得数据中心的注册信息与授权域中的注册信息保持一致。最后，执行撤销原语后，授权域脱离一级数据中心的管辖，无法再对一级数据中心进行访问。
(3)授权域内的角色认证及用户证书的颁发
当授权中的任一客户端欲访问一级数据中心数据时，客户端需经过下面几个步骤才能完 成，如图6所示，具体过程描述如下：
步骤一，客户端首先向三级数据中心(相当于上述第三数据中心)请求分派角色，三级数据中心接收到请求后，可以经过中间服务代理发送给访问控制服务，该服务通过查找基于角色的访问控制(Role-Based Access Control，简称为RBAC)数据库来进行验证客户端是否具有相应的权限访问一级数据中心(相当于上述第一数据中心)的数据，完毕后将结果发给中间服务代理。
需要说明的是，通过中间服务代理处理相关过程并不是本发明优选实施例实施的必需过程，但在实施过程中，采用中间服务代理的方式，一方面可以提升安全性，另一方面有利于相关功能实体的模块化封装，有利于对各种协议的兼容性。
步骤二，如果客户端具有相应的权限，则中间服务代理将该客户端具有的访问权限一起发给角色分派服务，由角色分派服务进行处理，封装成一个获取角色请求服务，并将该服务发给二级数据中心(相当于上述第二数据中心)；二级数据中心接收到服务请求后，也可以经过中间服务代理处理，将处理结果发给授权访问控制服务进行验证。
步骤三，授权访问控制服务接收到请求后，首先由服务器根据数据库中数据验证服务请求发送方(三级数据中心)身份的有效性；通过后，证书服务器将根据一级数据中心颁给该授权域的证书内容，获取客户端对一级数据中心的相应访问角色，并将该信息记录到一张新的临时用户证书上；获取了分派角色后，证书服务器将用自己的私钥为其签名，同时附上自己的公钥，组成一份完整的临时用户证书发送给客户端。
步骤四，客户端获取到临时用户证书后，在向一级数据中心提交服务请求时，必须附带上该临时用户证书。当一级数据中心收到服务请求后，它首先使用公钥为证书解密，如果发现中心服务器的签名，则认为这份证书是合法的，客户端身份认证通过，并从中获取客户端所具有的的角色；一级数据中心通过角色所具有的权限来完成客户端提交的服务请求，完成后，将结果返回给客户端。
下面通过在不同场景应用的优选实施方式来对本发明优选实施例进行说明。
优选实施方式一
采用本发明优选实施例的数据中心总体架构如图7所示，包括：用户门户模块、管理门户模块、运营管理模块、IT服务管理模块、资源管理模块、IT运维管理模块和基础设施管理模块。
优选地，用户门户模块包括：自服务门户和服务目录。
优选地，管理门户模块包括：告警管理、报表呈现、权限管理和访问控制。
优选地，运营管理模块包括：服务目录管理、产品管理、计费/报表管理、订单管理、用户管理、资源调度。
优选地，信息技术(IT)服务管理模块包括：服务台、服务等级协议(SLA)管理、问题 管理、事件管理、配置管理、变更管理。
优选地，资源管理模块包括：应用部署、资源/模板管理、资源调度、资源监控。
优选地，IT运维管理模块包括：业务影响分析、告警、拓扑、性能、报表、服务器监控、网络监控、存储监控、中间件监控、应用监控、数据库监控。
优选地，基础设施管理模块包括：告警管理、三维(3D)机房可视化、能耗管理、容量管理、环境监控、动力监控。
本发明优选实施例的工作流程如图8所示，包括如下步骤：
步骤S802，客户端先向最近的三级数据中心发送访问请求，通过三级数据中心的访问控制服务进行初步验证是否具有相应的权限访问一级数据中心的数据，通过后通知三级数据中心权限管理模块。
步骤S804，三级数据中心权限管理模块将客户端请求进行再次封装，发给二级数据中心。
步骤S806，二级数据中心的授权访问控制服务先对消息进行验证，验证请求发送方(即三级数据中心)身份的有效性。通过后，由证书管理模块生成临时用户证书发送给客户端。
步骤S808，客户端获取到临时用户证书后，在向一级数据中心提交服务请求时，必须附带上该临时用户证书。当一级数据中心收到服务请求后，它首先使用公钥为证书解密，如果发现中心服务器的签名，则认为这份证书是合法的，客户端身份认证通过，并从中获取客户端所具有的的角色；一级数据中心通过角色所具有的权限来完成客户端提交的服务请求，完成后，将结果返回给客户端。
通过上述优选实施方式，可以将传统的分散、分层、异构的数据中心架构，升级为物理分散、逻辑集中的统一资源管理的分布式云数据中心。可以将不同地域、不同阶段、不同规模的数据中心，混合为一个跨数据中心的逻辑资源池，全局容量管理。可以跨地域多数据中心的资源统一管理及调度，策略化的访问控制管理。可见，通过应用本系统提供的访问控制功能，整个系统的安全性和保密性加强了。
优选实施方式二
在本发明优选实施例中，采用的数据中心系统如图9所示，该系统也采用三级架构，在集团总部建设一套数据中心作为一级数据中心，将全国分为两个区域，南方基地和北方基地，分别建设南方基地数据中心和北方基地数据中心作为二级数据中心(南方基地数据中心和北方基地数据中心各自管辖多个省的数据中心)，各个省会城市分别建设数据中心作为三级数据中心。
基于上述数据中心系统的访问控制方法流程描述如下：
步骤S902，客户端先向属地所在省的XX市数据中心发送访问请求，通过XX市数据中 心的访问控制服务进行初步验证是否具有相应的权限访问一级数据中心的数据，通过后通知北方基地数据中心权限管理模块。
步骤S904，XX市数据中心权限管理模块将客户端请求进行再次封装，发给北方基地数据中心。
步骤S906，北方基地数据中心的授权访问控制服务先对消息进行验证，验证请求发送方(即XX市数据中心)身份的有效性。通过后，由证书管理模块生成临时用户证书发送给客户端。
步骤S908，客户端获取到临时用户证书后，在向总部数据中心提交服务请求时，必须附带上该临时用户证书。当总部数据中心收到服务请求后，它首先使用公钥为证书解密，如果发现中心服务器的签名，则认为这份证书是合法的，客户端身份认证通过，并从中获取客户端所具有的的角色；总部数据中心通过角色所具有的权限来完成客户端提交的服务请求，完成后，将结果返回给客户端。
本系统通过采用本发明的授权域和访问控制机制，有效降低了数据中心的建设和管理成本，并实现了数据中心内部以及数据中心之间的数据隔离。
优选实施方式三
本发明优选实施例采用的数据中心及其运维系统如图10所示，该系统也采用三级架构，每一级数据中心由业务服务平台、云管理平台、数据中心管理平台三大部分组成。
其中，业务服务平台负责管理各种业务，包括：监控、数据分析、办公业务等。
其中，云管理平台管理负载虚拟化管理、资源运营管理，包括：虚拟化环境管理软件、资源运营管理软件、访问控制管理软件、证书管理软件。
其中，数据中心管理平台负责对数据中心基础设施进行监控，包括：视频监控、环境监控、配电监控、能耗监控、制冷监控、安防监控和容量监控。
下面以运维人员接入数据中心进行故障定位的场景为例，流程描述如下：
步骤S1002，运维工程师通过专用客户端向三级数据中心发送访问请求，通过三级数据中心的访问控制管理软件进行初步验证是否具有相应的权限接入一级数据中心，通过后通知二级数据中心访问控制管理软件。
步骤S1004，三级数据中心的访问控制管理软件将客户端请求进行再次封装，发给二级数据中心。
步骤S1006，二级数据中心的访问控制管理软件先对消息进行验证，验证请求发送方(即三级数据中心)身份的有效性。通过后，由证书管理软件生成临时用户证书发送给客户端。
步骤S1008，客户端获取到临时用户证书后，在向一级数据中心提交服务请求时，必须附带上该临时用户证书。当一级数据中心收到服务请求后，它首先使用公钥为证书解密，如 果发现中心服务器的签名，则认为这份证书是合法的，客户端身份认证通过，并从中获取客户端所具有的的角色；一级数据中心通过角色所具有的权限来完成客户端提交的服务请求，完成后，将结果返回给客户端。
本系统通过访问控制管理软件实现对数据中心间的访问控制，以及运维人员接入数据中心的访问控制，有效实现了数据中心内部的数据隔离。
综上所述，本发明实施例提出了一种基于证书的区域授权访问控制机制，这种访问控制机制结合了现有访问控制技术的优势，实现各个系统之间安全、可靠地访问，它们可应用于各种分布式数据中心建设中，确保了数据中心数据的保密性、完整性和可用性。
在另外一个实施例中，还提供了一种软件，该软件用于执行上述实施例及优选实施方式中描述的技术方案。
在另外一个实施例中，还提供了一种存储介质，该存储介质中存储有上述软件，该存储介质包括但不限于：光盘、软盘、硬盘、可擦写存储器等。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的对象在适当情况下可以互换，以便这里描述的本发明的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
通过本发明实施例，采用第二数据中心获取角色获取请求，其中，角色获取请求中携带有客户端的访问权限；第二数据中心根据访问权限和第一数据中心颁发的证书，生成临时用户证书，其中，临时用户证书中携带有客户端对第一数据中心的访问角色；第二数据中心发送临时用户证书至客户端的方式，解决了在相关技术中没有提供在云计算多级数据中心系统 中应用基于角色的访问控制方法的问题，实现了云计算多级数据中心系统中基于角色的访问控制。

Claims (15)

  1. 一种访问角色获取方法，包括：
    第二数据中心获取角色获取请求，其中，所述角色获取请求中携带有客户端的访问权限；
    所述第二数据中心根据所述访问权限和第一数据中心颁发的证书，生成临时用户证书，其中，所述临时用户证书中携带有所述客户端对所述第一数据中心的访问角色；
    所述第二数据中心发送所述临时用户证书至所述客户端。
  2. 根据权利要求1所述的方法，其中，在所述第二数据中心发送所述临时用户证书至所述客户端之后，所述方法还包括：
    所述第一数据中心接收所述客户端发送的所述临时用户证书和服务请求；
    所述第一数据中心根据所述临时用户证书，确定所述客户端对所述第一数据中心的访问角色；
    所述第一数据中心根据所述访问角色，处理所述服务请求。
  3. 根据权利要求1所述的方法，其中，所述第二数据中心获取所述角色获取请求包括：
    第三数据中心接收所述客户端发送的分派角色请求；
    所述第三数据中心确定所述客户端的所述访问权限；
    所述第三数据中心发送所述角色获取请求至所述第二数据中心。
  4. 根据权利要求3所述的方法，其中，所述第三数据中心确定所述客户端的所述访问权限包括：
    所述第三数据中心通过访问控制服务在基于角色的访问控制数据库中查询所述客户端的所述访问权限。
  5. 根据权利要求1所述的方法，其中，所述第二数据中心根据所述访问权限和所述第一数据中心颁发的所述证书，生成所述临时用户证书包括：
    所述第二数据中心根据所述访问权限和所述第一数据中心颁发的所述证书，确定所述客户端对所述第一数据中心的所述访问角色；
    所述第二数据中心将所述访问角色记录至未签名临时用户证书；
    所述第二数据中心使用所述第二数据中心的私钥对所述未签名临时用户证书进行签名，生成所述临时用户证书。
  6. 根据权利要求5所述的方法，其中，所述第二数据中心发送所述临时用户证书至所述客户端包括：
    所述第二数据中心发送已签名的所述临时用户证书和所述第二数据中心的公钥至所述客户端。
  7. 根据权利要求6所述的方法，其中，在所述第二数据中心发送已签名的所述临时用户证书和所述第二数据中心的公钥至所述客户端的情况下，所述方法还包括：
    所述第一数据中心接收所述客户端发送的已签名的所述临时用户证书、所述第二数据中心的公钥和服务请求；
    所述第一数据中心采用所述公钥解密所述临时用户证书，并验证所述临时用户证书的签名信息是否为所述第二数据中心的签名；
    在验证结果为是的情况下，所述第一数据中心根据解密的所述临时用户证书，确定所述客户端对所述第一数据中心的访问角色；
    所述第一数据中心根据所述访问角色，处理所述服务请求。
  8. 一种访问角色获取装置，应用于第二数据中心，包括：
    获取模块，设置为获取角色获取请求，其中，所述角色获取请求中携带有客户端的访问权限；
    生成模块，设置为根据所述访问权限和第一数据中心颁发的证书，生成临时用户证书，其中，所述临时用户证书中携带有所述客户端对所述第一数据中心的访问角色；
    发送模块，设置为发送所述临时用户证书至所述客户端。
  9. 根据权利要求8所述的装置，其中，所述生成模块包括：
    确定单元，设置为根据所述访问权限和所述证书，确定所述客户端对所述第一数据中心的所述访问角色；
    记录单元，设置为将所述访问角色记录至未签名临时用户证书；
    签名单元，设置为使用所述第二数据中心的私钥对所述未签名临时用户证书进行签名，生成所述临时用户证书。
  10. 根据权利要求9所述的装置，其中，
    所述发送模块设置为：发送已签名的所述临时用户证书和所述第二数据中心的公钥至所述客户端。
  11. 一种访问角色获取系统，包括：第一数据中心、第二数据中心、第三数据中心和客户端，其中，
    所述第二数据中心包括：如权利要求8至10中任一项所述的访问角色获取装置。
  12. 根据权利要求11所述的系统，其中，所述第一数据中心包括：
    第一接收模块，设置为接收所述客户端发送的所述临时用户证书和服务请求；
    第一确定模块，设置为根据所述临时用户证书，确定所述客户端对所述第一数据中心的访问角色；
    处理模块，设置为根据所述访问角色，处理所述服务请求。
  13. 根据权利要求12所述的系统，其中，在所述第一数据中心中：
    所述第一接收模块，设置为接收所述客户端发送的已签名的所述临时用户证书、所述第二数据中心的公钥和服务请求；
    所述第一确定模块，设置为采用所述公钥解密所述临时用户证书，并验证所述临时用户证书的签名信息是否为所述第二数据中心的签名；并在验证结果为是的情况下，所述第一数据中心根据解密的所述临时用户证书，确定所述客户端对所述第一数据中心的访问角色。
  14. 根据权利要求11所述的系统，其中，所述第三数据中心包括：
    第二接收模块，设置为接收所述客户端发送的分派角色请求；
    第二确定模块，设置为确定所述客户端的所述访问权限；
    输送模块，设置为发送所述角色获取请求至所述第二数据中心。
  15. 根据权利要求14所述的系统，其中，
    所述第二确定模块设置为：通过访问控制服务在基于角色的访问控制数据库中查询所述客户端的所述访问权限。
PCT/CN2016/073949 2015-05-22 2016-02-17 访问角色获取方法、装置及系统 WO2016188153A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510267814.6A CN106302334B (zh) 2015-05-22 2015-05-22 访问角色获取方法、装置及系统
CN201510267814.6 2015-05-22

Publications (1)

Publication Number Publication Date
WO2016188153A1 true WO2016188153A1 (zh) 2016-12-01

Family

ID=57392427

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/073949 WO2016188153A1 (zh) 2015-05-22 2016-02-17 访问角色获取方法、装置及系统

Country Status (2)

Country Link
CN (1) CN106302334B (zh)
WO (1) WO2016188153A1 (zh)

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110830569A (zh) * 2019-11-01 2020-02-21 国云科技股份有限公司 一种基于多云管理平台的页面权限访问层级控制方法
US11258775B2 (en) 2018-04-04 2022-02-22 Oracle International Corporation Local write for a multi-tenant identity cloud service
US11321343B2 (en) 2019-02-19 2022-05-03 Oracle International Corporation Tenant replication bootstrap for a multi-tenant identity cloud service
CN114443435A (zh) * 2022-01-27 2022-05-06 中远海运科技股份有限公司 一种面向容器微服务的性能监控告警方法及告警系统
US11411944B2 (en) 2018-06-28 2022-08-09 Oracle International Corporation Session synchronization across multiple devices in an identity cloud service
US11528262B2 (en) 2018-03-27 2022-12-13 Oracle International Corporation Cross-region trust for a multi-tenant identity cloud service
US11652685B2 (en) 2018-04-02 2023-05-16 Oracle International Corporation Data replication conflict detection and resolution for a multi-tenant identity cloud service
US11669321B2 (en) 2019-02-20 2023-06-06 Oracle International Corporation Automated database upgrade for a multi-tenant identity cloud service

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109587101B (zh) * 2017-09-29 2021-04-13 腾讯科技（深圳）有限公司 一种数字证书管理方法、装置及存储介质
CN110839005B (zh) * 2018-08-17 2023-08-01 恩智浦美国有限公司 装置利用云平台的安全登记
CN110708298A (zh) * 2019-09-23 2020-01-17 广州海颐信息安全技术有限公司 集中管理动态实例身份和访问的方法及装置
CN112118224B (zh) * 2020-08-12 2021-07-23 北京大学 一种大数据区块链的可信机制权限管理方法和系统
CN112134848B (zh) * 2020-08-27 2023-03-24 中央广播电视总台 融合媒体云自适应访问控制方法、装置、终端及介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2011175402A (ja) * 2010-02-24 2011-09-08 Mitsubishi Electric Corp アクセス制御連携システム及びアクセス制御連携方法
CN102195956A (zh) * 2010-03-19 2011-09-21 富士通株式会社 云服务系统及其中管理用户权限的方法
CN103685463A (zh) * 2013-11-08 2014-03-26 浪潮(北京)电子信息产业有限公司 云计算系统中访问控制的方法和系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040128559A1 (en) * 2002-12-31 2004-07-01 Zurko Mary Ellen Trusting security attribute authorities that are both cooperative and competitive
CN101997876B (zh) * 2010-11-05 2014-08-27 重庆大学 基于属性的访问控制模型及其跨域访问方法
CN102790761B (zh) * 2012-06-13 2015-05-06 浙江浙大中控信息技术有限公司 一种区域医疗信息系统及访问权限控制方法
CN102761551B (zh) * 2012-07-09 2014-12-17 郑州信大捷安信息技术股份有限公司 多级跨域访问控制系统及控制方法
CN103338194B (zh) * 2013-03-06 2016-04-20 国家电网公司 一种基于信誉度评估的跨安全域访问控制系统和方法
CN103312721B (zh) * 2013-07-04 2016-12-28 北京迈普华兴信息技术有限公司 一种云平台访问控制架构及其实现方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2011175402A (ja) * 2010-02-24 2011-09-08 Mitsubishi Electric Corp アクセス制御連携システム及びアクセス制御連携方法
CN102195956A (zh) * 2010-03-19 2011-09-21 富士通株式会社 云服务系统及其中管理用户权限的方法
CN103685463A (zh) * 2013-11-08 2014-03-26 浪潮(北京)电子信息产业有限公司 云计算系统中访问控制的方法和系统

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11528262B2 (en) 2018-03-27 2022-12-13 Oracle International Corporation Cross-region trust for a multi-tenant identity cloud service
US11652685B2 (en) 2018-04-02 2023-05-16 Oracle International Corporation Data replication conflict detection and resolution for a multi-tenant identity cloud service
US11258775B2 (en) 2018-04-04 2022-02-22 Oracle International Corporation Local write for a multi-tenant identity cloud service
US11411944B2 (en) 2018-06-28 2022-08-09 Oracle International Corporation Session synchronization across multiple devices in an identity cloud service
US11321343B2 (en) 2019-02-19 2022-05-03 Oracle International Corporation Tenant replication bootstrap for a multi-tenant identity cloud service
US11669321B2 (en) 2019-02-20 2023-06-06 Oracle International Corporation Automated database upgrade for a multi-tenant identity cloud service
CN110830569A (zh) * 2019-11-01 2020-02-21 国云科技股份有限公司 一种基于多云管理平台的页面权限访问层级控制方法
CN114443435A (zh) * 2022-01-27 2022-05-06 中远海运科技股份有限公司 一种面向容器微服务的性能监控告警方法及告警系统
CN114443435B (zh) * 2022-01-27 2023-09-08 中远海运科技股份有限公司 一种面向容器微服务的性能监控告警方法及告警系统

Also Published As

Publication number Publication date
CN106302334A (zh) 2017-01-04
CN106302334B (zh) 2020-06-12

Similar Documents

Publication Publication Date Title
WO2016188153A1 (zh) 访问角色获取方法、装置及系统
Shi et al. A blockchain-empowered AAA scheme in the large-scale HetNet
Saini et al. A smart-contract-based access control framework for cloud smart healthcare system
EP3962019B1 (en) Trusted data transmission methods, apparatuses, and devices
WO2019214311A1 (zh) 一种基于区块链的信息监管方法及装置
CN113132103B (zh) 一种数据跨域安全共享系统及方法
CN106992988B (zh) 一种跨域匿名资源共享平台及其实现方法
WO2018112946A1 (zh) 注册及授权方法、装置及系统
CN103327084B (zh) 一种公私混合分布式的云存储系统及云存储方法
Shi et al. BacS: a blockchain-based access control scheme in distributed internet of things
US8578452B2 (en) Method for securely creating a new user identity within an existing cloud account in a cloud computing system
CN103152179A (zh) 一种适用于多应用系统的统一身份认证方法
US11838406B2 (en) Systems and methods for control-data plane partitioning in virtual distributed ledger networks
CN109995791A (zh) 一种数据授权方法及系统
CN107302524A (zh) 一种云计算环境下的密文数据共享系统
Almutairi et al. Survey of centralized and decentralized access control models in cloud computing
Chai et al. BHE-AC: A blockchain-based high-efficiency access control framework for Internet of Things
Ezawa et al. Blockchain-based cross-domain authorization system for user-centric resource sharing
Feng et al. Blockchain enabled zero trust based authentication scheme for railway communication networks
Vignesh et al. Secured Data Access and Control Abilities Management over Cloud Environment using Novel Cryptographic Principles
CN114398612A (zh) 一种基于微服务的ict虚拟运营安全接入管控方法
Frimpong et al. Footsteps in the fog: Certificateless fog-based access control
Yeluri et al. Identity management and control for clouds
Bhattacharjee et al. Original Research Article An efficient framework for secure data transmission using blockchain in IoT environment
Rech et al. A decentralized service-platform towards cross-domain entitlement handling

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16799042

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16799042

Country of ref document: EP

Kind code of ref document: A1