WO2018153353A1 - 实现认证/授权的方法、装置、云计算系统及计算机系统 - Google Patents

实现认证/授权的方法、装置、云计算系统及计算机系统 Download PDF

Info

Publication number
WO2018153353A1
WO2018153353A1 PCT/CN2018/077065 CN2018077065W WO2018153353A1 WO 2018153353 A1 WO2018153353 A1 WO 2018153353A1 CN 2018077065 W CN2018077065 W CN 2018077065W WO 2018153353 A1 WO2018153353 A1 WO 2018153353A1
Authority
WO
WIPO (PCT)
Prior art keywords
service
token
tenant
information
request
Prior art date
Application number
PCT/CN2018/077065
Other languages
English (en)
French (fr)
Inventor
张煜
张琦
俞岳
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2018153353A1 publication Critical patent/WO2018153353A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • the embodiments of the present invention relate to the field of cloud computing, and in particular, to an authentication/authorization method between services based on a PaaS platform.
  • Cloud Computing is a computing model that provides dynamically scalable virtualized resources in a serviced manner over a network.
  • PaaS Platinum as a Service
  • PaaS platform is one of the main modes of cloud computing, and is mainly used to provide software development platforms as services to tenants. Different tenants are registered on the PaaS platform. These tenants use the software development platform provided by the PaaS platform to develop and provide a variety of software services (including microservices), hereinafter referred to as services.
  • the service invocation service occurs between different tenants. For example, service A of tenant 1 subscribes to service B of tenant 2, which means that service A will call service B periodically or eventally when it is used.
  • the authentication/authorization mechanism commonly used on PaaS is a token-based authentication/authorization mechanism, such as SWT (Simple Web Token), JWT (Json Web Token), CMS (Cryptographic Message Syntax), and SAML (Security Assertion Markup Language). , X.509 Certificate, OAuth2 authorization token, RSA token, etc. If there is a call between services with different authentication/authorization mechanisms, there will be problems with authentication/authorization difficulties, resulting in a seamless and secure integration.
  • the prior art mainly proposes two solutions: one is to use a unified authentication and authorization center to handle all service invocation requests, but this way leads to performance bottleneck, which may bring a single point of failure (single point) The problem of failure); the other is that the service requester implements the generated code of the token in different formats on its client, so that the service requester can generate different tokens when calling different services, but this way will give Service developers add an extra development burden.
  • Embodiments of the present invention provide a method, an apparatus, a cloud computing system, and a computer system for implementing authentication/authorization, which are applied to a cloud computing system of a multi-tenant domain, and implement authentication/authorization for calls between different services, and can improve service calls. s efficiency.
  • an embodiment of the present invention provides a method for implementing authentication/authorization, which may be applied to a cloud computing system or other type of computer system.
  • the method includes receiving a service invocation request sent by a first service running on a first tenant domain, wherein the service invoking request includes information of a second service; and the first token set is based on information of the second service Acquiring the token of the second service, where the first token set includes a correspondence between the information of the second service and the token of the second service; using the obtained The token of the second service updates the service invocation request; and sends the updated service invocation request to the second service according to the information of the second service.
  • the first tenant domain is a tenant domain belonging to the first tenant in the cloud computing system.
  • Services provided by cloud computing systems such as development environments/development platforms, can be provided to multiple users at the same time. Each user uses the service like “lease”, so users of cloud computing systems are generally referred to as “tenants”.
  • the information of the second service may be information for identifying the service, such as an access endpoint of the service.
  • the token set includes one or more tokens and a correspondence between the token and the service.
  • the token A corresponding to the service A indicates that the token A can be used when other services invoke the service A.
  • the token collection is also referred to as a token stack in some embodiments of the invention.
  • the specific form of the token set is not limited by the embodiment of the present invention. Note that the token set may include only one token and the corresponding relationship of the token to the service.
  • the second service in the method provided by the embodiment of the present invention usually runs in a second tenant domain different from the first tenant domain, but if there is a problem that the authentication/authorization mechanism is inconsistent between the services of the different tenant domains,
  • the services provided by the embodiments of the present invention may also be used in the same tenant domain.
  • the execution body of the above method is one or more units deployed in the first tenant domain.
  • the one or more units are named as the first request reconstruction unit.
  • a request reconfiguration unit similar in function to the first request reconfiguration unit may also be deployed in other tenant domains.
  • embodiments of the present invention do not mandate that similar units be deployed in each tenant domain of the cloud computing system.
  • more method steps in other implementation manners of the first aspect described below are implemented by the cloud computing system, but are not necessarily implemented by the first tenant domain.
  • the decentralized authentication/authorization mode is implemented, thereby avoiding the single point failure problem and improving The efficiency of certification/authorization.
  • the token of the second service ie, the called service
  • the existence of the first set of tokens causes the developer of the calling service (ie the first service) not to provide additional token generation code to satisfy the authentication mode required by the different called services, but directly from the first token set Get the token, which simplifies the service development process.
  • the execution body of the above method may also be centrally deployed in the cloud computing system or centrally deployed in other systems outside the cloud computing system that have a communication relationship with the cloud computing system, so that although the single point failure problem cannot be avoided, it may also be improved. Tokens gain efficiency and simplify the service development process.
  • each tenant domain in the cloud computing system includes a token set, wherein the token set of the first tenant domain is the first token set.
  • the first token set includes at least one service and token corresponding to the tenant subscription of the first tenant domain Relationship, the at least one service comprising the second service.
  • the first token set corresponding to the first tenant domain does not include a correspondence between all services and tokens in the cloud computing system, and the tenant of the first tenant domain is included (referred to as the first The relationship between the services subscribed to by a tenant and the tokens of these services. Only those services are the ones most likely to be invoked by the services of the first tenant domain. Only the tokens that hold these services can improve the efficiency of service invocation. While saving storage space.
  • the services subscribed by the first tenant can be known in advance by the cloud computing system, and then the cloud computing system regenerates the first token set containing the tokens of the services.
  • the service subscribed by the first tenant may include a service subscribed by any one of the services in the first tenant domain.
  • the services included in the first token set may be This is another category.
  • the token of the second service is based on a token template corresponding to the second service and the first tenant The information generated by the domain. More specifically, the token of the second service is generated by updating the token template corresponding to the second service by using information of the first tenant domain.
  • the information of the first tenant domain may include tenant information of the first tenant domain and/or information of a service of the second service within the first tenant domain.
  • a token template corresponding to the second service is established, and the token template includes the content of the information/name of the information required for the authentication/authorization of the second service, and further according to the information of the tenant of the first tenant domain.
  • the information of the service in the tenant domain that invokes the second service determines the specific token, which makes the construction of the token more convenient and efficient.
  • the token of the second service is built based on the token template, and the token template is related to the second service by intercepting The service invokes the request and extracts one or more token attributes corresponding to the second service from the service call request.
  • service call request intercepted here is not necessarily used to invoke the second service, and may be used to call other services of the same type as the second service.
  • the token of the second service is constructed based on the token template, and the token template is based on intercepting the real service call request and The token is generated by extracting the token attribute in the service call request.
  • the token template also supports customization. Specifically, the so-called customization includes the extracted token attribute that can be modified by the user or the user can add/delete the token attribute according to the requirement.
  • a customized or semi-automated approach makes the generation of token templates more flexible and, to a certain extent, improves the accuracy of token templates.
  • a token set in the cloud computing system may be generated by: the cloud computing system according to the tenant domain tenant information Obtaining a token template, wherein the obtained service corresponding to the token template is a service subscribed by a tenant of the tenant domain; updating the token template by using the tenant information to generate a token of the service; The token set, wherein the token set includes a correspondence between a service subscribed by the tenant and a token of the service.
  • the generating of the token set is performed periodically or after receiving a token request sent by the tenant domain Executed under the trigger, wherein the token request includes tenant information of the tenant domain.
  • the generation of the token set is implemented by one or more units of the cloud computing system, for convenience of description, for the one or more units Named the token collection generation unit.
  • the token set generating unit is deployed in the tenant management plane of the cloud computing system, so that the token set corresponding to each tenant domain is uniformly generated in the tenant management plane, and then the token set is delivered to each tenant domain.
  • the tenant management plane can also store multiple token collections in the tenant management plane or other storage locations. Each tenant domain uses the token to obtain the desired token from the tenant management plane or other storage location.
  • the token set of each tenant domain is generated based on tenant information of the tenant domain and a token template of the service subscribed by the tenant domain.
  • the cloud computing system verifies the identity of the tenant according to the tenant information; acquires the service subscribed by the tenant according to the identity of the tenant; and obtains the service from the stored correspondence according to the service subscribed by the tenant Corresponding to the token template, wherein the correspondence relationship includes a correspondence between the service and the token template corresponding to the service.
  • verifying the identity of the tenant can improve the security of the cloud computing system.
  • an embodiment of the present invention provides an apparatus for implementing authentication/authorization for a service call, where the apparatus is located in a cloud computing system, where the apparatus includes a first request reconstruction unit, where the first request reconstruction unit may be located in the cloud. Within the first tenant domain of the computing system. Other request reconstruction units having the same or similar functions as the first request reconstruction unit may also be deployed in other tenant domains of the cloud computing system.
  • the first request reconstruction unit is configured to receive a service call request sent by the first service running in the first tenant domain, where the service call request includes information of the second service; and according to the information of the second service Acquiring the token of the second service in the first token set, where the first token set includes a correspondence between the information of the second service and the token of the second service; Reaching the token of the second service to update the service invocation request; and transmitting the updated service invocation request to the second service according to the information of the second service.
  • the apparatus further includes a token set generation unit.
  • the token set generating unit is configured to generate a token of the second service based on a token template corresponding to the second service and tenant information of the first tenant domain; and generate the first token set,
  • the first token set includes a correspondence between the information of the second service and the generated token.
  • the token set generating unit is specifically configured to update the token template corresponding to the second service by using the tenant information. To generate a token for the second service.
  • the apparatus further includes a template generating unit, configured to intercept a service call request related to the second service, and invoke the service from the service The request extracts one or more token attributes corresponding to the second service to generate a token template of the second service.
  • a template generating unit configured to intercept a service call request related to the second service, and invoke the service from the service The request extracts one or more token attributes corresponding to the second service to generate a token template of the second service.
  • a request reconfiguration unit is deployed in each tenant domain of the cloud computing system, where the first tenant domain
  • the deployed request reconstruction unit is the first request reconstruction unit.
  • the template generating unit and the token set generating unit are deployed in a tenant management plane of the cloud computing system.
  • the token set generating unit is deployed in a trust center of the tenant management plane.
  • the token set generating unit is further configured to send the first token set to the first tenant domain, so as to facilitate The first request reconstruction unit is capable of accessing the first token set from the first tenant domain.
  • the first tenant domain can access the first token set locally, and the tenant management plane requests the token when the service is invoked, and the token is acquired more quickly, thereby improving the service authentication/authorization speed.
  • an embodiment of the present invention provides a cloud computing system, such as a PaaS system, where the cloud computing system includes any of the foregoing devices.
  • an embodiment of the present invention provides a method for generating a token template, where a token of the service may be generated based on a token template corresponding to the service.
  • the method includes intercepting a service invocation request for invoking a service, analyzing the service invocation request to obtain a token summary of the service, and generating a token template corresponding to the service according to the token summary. After the token template is generated, the correspondence between the token template and the service may be stored.
  • the Toolkit is inserted into one or more running instances of the service, thereby intercepting a service invocation request for the service, and extracting token attribute information from the service invocation request,
  • the token template is finally generated.
  • the extracted token attribute information may be customized before the token template is generated, such as modifying token attribute information or adding new token attribute information.
  • an embodiment of the present invention provides a method for creating a token set, where the method includes receiving a request for acquiring a token set sent by a tenant domain, where the request includes identity information of a tenant of the tenant domain and Service information, the service information is used to indicate a service subscribed by the tenant, for example, the service information is, for example, an access endpoint of the service; verifying the identity of the tenant according to the identity information of the tenant; When the information is verified as the trusted tenant, the token template corresponding to the service information is obtained from the pre-stored correspondence relationship; and the token set is created for the tenant according to the obtained token template, the token The set includes a token and a corresponding relationship of the service information, where the token is generated according to the token template, and the service information corresponding to the token is a token template corresponding to the token.
  • Service information that is, information about the services subscribed by the tenant.
  • an embodiment of the present invention provides an apparatus for implementing authentication/authorization for implementing the method described in any one of the foregoing aspects or an implementation manner, where the apparatus includes one or more units to implement the steps of the method.
  • the device can be deployed in a PaaS system for secure and seamless integration between different services.
  • an embodiment of the present invention provides a computer storage medium, which may be non-volatile, and the computer storage medium stores a computer program for implementing the method described in any one of the foregoing aspects or an implementation manner. .
  • an embodiment of the present invention provides a computer system including a processor and a memory, wherein the memory is configured to store a computer program, the processor is configured to read a computer program from the memory and implement any one of the foregoing Aspect or method of one implementation.
  • the embodiment of the present invention provides a cloud computing system, where the cloud computing system includes a tenant management plane and a tenant plane, where the tenant plane includes a first tenant domain and a second tenant domain, and the first tenant domain
  • a first request reconfiguration unit is deployed, and the tenant management plane is configured with a token set generation unit and a template generation unit, where the first request reconstruction unit is configured to: receive the first operation in the first tenant domain a service invocation request sent by the service, wherein the service invocation request includes information of the second service, the second service is running in the second tenant domain; and is obtained from the first token set according to the information of the second service a token of the second service, where the first token set includes a correspondence between information of the second service and a token of the second service; using the acquired second service
  • the token updates the service invocation request; and sends the updated service invocation request to the second service based on the information of the second service.
  • the template generating unit is configured to: intercept a service invocation request related to the second service, and extract one or more token attributes corresponding to the second service from the service invocation request to generate the second a token template generating unit, configured to: generate a token of the second service based on a token template corresponding to the second service and information of the first tenant domain; generate the token a first token set; the token set generating unit is further configured to send the first token set to the first tenant domain, so that the first request reconfiguration unit can be from the first tenant domain Accessing the first set of tokens.
  • FIG. 1 is a schematic diagram of a logical structure of an authentication/authorization apparatus according to an embodiment of the present invention
  • FIG. 2 is a schematic diagram of a logical structure of a cloud computing system according to an embodiment of the present invention
  • FIG. 3 is a schematic diagram of a logical structure of a PaaS platform according to an embodiment of the present disclosure
  • FIG. 4 is a schematic diagram of interaction of an authentication/authorization method according to an embodiment of the present invention.
  • FIG. 5 is a schematic flowchart of a method for generating a token template according to an embodiment of the present disclosure
  • FIG. 6 is an example of a token according to an embodiment of the present invention.
  • FIG. 7 is a schematic flowchart of a method for generating a token stack according to an embodiment of the present invention.
  • FIG. 8 is an example of a token stack according to an embodiment of the present invention.
  • FIG. 9 is a schematic diagram of a logical structure of a computer system according to an embodiment of the present invention.
  • first and second in this application are used for descriptive purposes only, and are not to be construed as indicating or implying a relative importance or implicitly indicating the number of technical features indicated. Thus, features defining “first” and “second” may include one or more of the features either explicitly or implicitly.
  • a plurality means two or more unless otherwise stated.
  • the term “and/or” or the character “/” in the present application is merely an association relationship describing an associated object, indicating that there may be three relationships, for example, A and/or, or A/B, which may represent: separate There are three cases in which A and B exist at the same time, and B exists separately.
  • FIG. 1 is a schematic diagram of a logical structure of an authentication/authorization device according to an embodiment of the present invention.
  • the authentication/authorization device 100 can be a stand-alone system or a device embedded or deployed in other systems.
  • the authentication/authorization device 100 may be a software implemented device or a hardware implemented device.
  • the authentication/authorization device 100 includes a request reconstruction unit 101, a token set generation unit 102, and a template generation unit 103.
  • the template generation unit 103 generates a token template corresponding to the service to facilitate subsequent generation of a token of the service based on the template.
  • the token set generation unit 102 generates a token for the caller based on the token template of the service and the information of the caller of the service, in order to use the token to implement authentication/authorization when the caller invokes the service.
  • the caller of a service can be considered a tenant or a service in the tenant.
  • the request reconstruction unit 101 receives the caller's service call request, and updates the service call request according to the token generated by the token set generation unit 102, and transmits the updated service call request to the called service. Since the updated service call request contains the token supported by the called service, the called service can implement the caller's authentication/authorization according to the token.
  • the template generating unit 103 intercepts a service invocation request for the service, parses the service invocation request to obtain one or more token attributes of the service, and generates a corresponding to the service according to the one or more token attributes.
  • Token template That is, the template generation unit 103 obtains a token from an existing service call request, and extracts one or more token attributes from the token to form a token template.
  • the template generating unit 103 supports customization of the token template. For example, the token template can be provided to the user, modified by the user according to requirements, and then formed into a final token template.
  • the template generating unit 103 After the template generating unit 103 generates the token template of the service, the information of the service (for example, the identifier of the service), the token template of the service, and the correspondence between the two items may be stored for use by themselves or other units.
  • the token set generating unit 102 receives the request information sent by the caller, where the request information includes the identity information of the caller; determines the service subscribed by the caller according to the identity information of the caller, and obtains the service subscribed by the caller.
  • Corresponding token template; generating a token of the service subscribed by the caller according to the obtained token template and the caller identity information, and if the caller subscribes to multiple services, the multiple tokens may be in the token stack
  • the form is stored (see Figure 8).
  • the token stack includes a plurality of tokens and identification information of services corresponding to the plurality of tokens, and a correspondence between the two items.
  • the caller's subscription information can be pre-stored, and the subscription information contains the service subscribed by the caller, so the service subscribed by the caller can be obtained according to the subscription information.
  • the caller may also send information of the service (eg, identification information of the service) to the token set generation unit 102 to indicate that the caller intends to invoke the service, and wants to acquire the token of the service, then the token set generation unit 102
  • the token template of the service is found according to the information of the service, and the token of the service is generated according to the identity information of the caller and the token template, which is used when the caller invokes the service.
  • Each caller can have a corresponding token or token stack (multiple tokens) that can be generated at the caller's request and sent to the caller immediately after generation. Stored locally; it can also periodically generate tokens or token stacks for known callers, store these tokens or token stacks, send them to the caller when the caller requests them, or send them to the call spontaneously.
  • token or token stack multiple tokens
  • the request reconstruction unit 101 receives a service call request sent by the caller, where the service call request includes information of the called service; and one or more tokens corresponding to the caller according to the information of the invoked service Obtaining the token of the called service, and then updating the foregoing service invocation request with the obtained token, so that the token is included in the service invocation request; finally, the updated service invocation request is sent to the called service.
  • the embodiments of the present invention describe how the various units in the authentication/authorization device 100 and the respective units cooperate to implement the device.
  • the following describes the authentication/authorization device provided by the present invention in the cloud computing system and the specific embodiments through a more detailed embodiment. How to deploy and apply on the PaaS (Platform as a Service) platform.
  • PaaS Platinum as a Service
  • FIG. 2 is a schematic diagram of a logical structure of a cloud computing system according to an embodiment of the present invention.
  • the cloud computing system 200 includes an Infrastructure is a Service (IaaS) 210, a PaaS platform 220, and a Software is a Service (SaaS) 230.
  • IaaS, PaaS, and SaaS are considered three service models for cloud computing, referred to as SPI. These three service modes can be considered as a cloud computing system even if they exist alone.
  • the IaaS 210 specifically includes a hardware resource layer 213, a virtualization layer 212, and a virtual resource layer 211.
  • the storage resources, the processing resources, and the network resources of the hardware resource layer 213 are subjected to virtualization processing by the virtualization layer 212, and then present various virtual resources, including virtual storage resources, virtual processing resources, and virtual network resources, such as multiple virtual resources, to the upper layer PaaS platform. machine.
  • the PaaS platform runs on top of the IaaS layer and provides applications (also called services) development/deployment/running environments to users (eg, service providers or service developers) using various virtual resources provided by the IaaS layer. Services such as operation and maintenance management are applied, so that users do not need to pay attention to the resources of the IaaS layer.
  • the various applications running on the PaaS platform are delivered to end users in the form of services through the SaaS model.
  • a service that only provides music playback can call another service that provides vocal functions, so that users can use the vocal function provided by another service at any time when using the music playback service.
  • the authentication/authorization device 100 provided by the embodiment of the present invention is deployed in the PaaS platform, and is used to implement authentication/authorization when different services are called each other.
  • FIG. 3 is a schematic diagram of a logical structure of a PaaS platform according to an embodiment of the present invention.
  • the PaaS platform 300 includes an operation surface 310, a tenant management surface 320, and a data surface 330 (also referred to as a tenant surface).
  • the operation and maintenance surface 310 includes a management portal 311, a platform management 312, and the like.
  • the platform management 312 specifically includes the platform deployment management 3121 and the operation management 3122.
  • the tenant management plane 320 includes a trust center 322 and a deployment service 324, and may also include a portal 321 and the like.
  • the configuration center 3222, the secret service 3223, the PaaS Identity and Access Management (PaaS Identity and Access Management, abbreviated as PaaS-IAM) 3224, and the token set generation unit 3221 are deployed in the trust center 322.
  • the token set generating unit 3221 may be the token set generating unit 102 in the foregoing embodiment, or may introduce similar functional units in other embodiments or implement similar methods introduced in other embodiments.
  • the tenant management plane 320 further includes a template generating unit 323, which may be the template generating unit 103 in the foregoing embodiment, or may introduce similar functional units in other embodiments or implement similarities introduced in other embodiments. method.
  • the data plane 330 includes a plurality of tenant domains, wherein the tenant domain 331 includes a plurality of services 3311 providing different functions and a request reconfiguration unit 3312.
  • the tenant domain 332 includes a plurality of services 3321 providing different functions and a request reconfiguration unit 3322.
  • the tenant domain 333 includes a plurality of services 3331 providing different functions and a request reconfiguration unit 3332.
  • the cloud computing system includes a plurality of nodes capable of providing computer functions. Since the cloud computing system is based on virtualization technology, these nodes are usually virtual computing nodes such as virtual machines or containers.
  • a tenant of the cloud computing system can use one or more nodes of the cloud computing system, and the one or more nodes form the tenant domain of the tenant. Multiple tenant domains can be identified and isolated using technologies such as Virtual Local Area Network (VLAN) to ensure data security in multiple tenant domains.
  • VLAN Virtual Local Area Network
  • FIG. 4 is a schematic diagram of interaction of an authentication/authorization method according to an embodiment of the present invention.
  • a tenant domain can contain one or more nodes.
  • the "node” here generally refers to a virtual computing environment such as a virtual machine or a virtual container in the context of cloud computing.
  • service 1 of tenant domain 331 subscribes to service 6 of tenant domain 333, which is stored in configuration center 3222.
  • the specific template generation process will be described in detail later.
  • the token template and the correspondence between the token template and the service are stored in the configuration center 3222, wherein the service can be identified by a service endpoint.
  • the configuration center 3222 stores the correspondence between the plurality of service endpoints and the token templates of the services.
  • the token set generating unit 3221 receives a message for requesting a token or a token stack sent by the tenant domain, where the message includes the identity information of the tenant of the tenant domain, and the token set generating unit 3221 requests the PaaS-IAM 3224 to verify the tenant's If the authentication succeeds, the endpoints of the service subscribed by the tenant are obtained from the configuration center 3222 according to the identity of the tenant, and the corresponding end points of the services and the correspondence between the token template and the service endpoint stored in the configuration center 3222 are searched. Obtain a token template for the subscribed service and then generate a token based on the token template. The specific process will be described in detail later.
  • the token or the token stack is sent to the corresponding tenant domain, and the tenant domain stores the token or the token stack in the tenant domain.
  • Storage resources For example, the tenant domain 331 sends a message requesting a token stack, the token set generation unit 3221 verifies the identity of the tenant domain 331, generates a token stack, and transmits the token stack to the tenant domain 331.
  • the token set generation unit 3221 may also self-generate into the token stack of all tenant domains and distribute the token stack to the respective tenant domains.
  • the tokens of the respective subscribed services are already stored in each tenant domain or in the tenant domain in need.
  • the following describes the service invocation process by using the service in the tenant domain 331 to invoke the service in the tenant domain 333 as an example.
  • the service 1 in the tenant domain 331 sends a service invocation request to the service forwarding agent located in the same tenant domain.
  • the service forwarding agent is a module for receiving and forwarding service invocation requests on an existing PaaS platform, and is deployed in each tenant domain.
  • the request reconfiguration unit 3312 provided by the embodiment of the present invention may be deployed in a service forwarding agent of each tenant domain.
  • the request re-establishing unit 3312 in a tenant domain intercepts the service invocation request sent by the service in the same tenant domain to the service forwarding agent, updates the service invoking request, and then sends the updated service invoking request to the called service.
  • the request re-establishing unit 3312 located in the tenant domain 331 intercepts the service invocation request sent by the service 1, in which the service invoking request is used to invoke the service 6 in the tenant domain 333, so the service invoking The request includes the endpoint of the service 6, and the request reestablishing unit 3312 finds the token corresponding to the service 6 according to the endpoint of the service 6 and the token stack stored in the tenant domain, and then uses the token to update the service invocation request, for example, using the service 6
  • the token replaces the original token in the service call request, or adds the token for the service 6 in the service call request.
  • Which of the update methods, such as "replace” or "add” depends on the form of the intercepted service call request, and the purpose of the embodiment of the present invention is to make the service call request contain the correct token, and the specific "update" mode Not limited.
  • the request re-establishment unit 3312 transmits the updated service call request to the service 6 in the tenant domain 333.
  • the token of the second service (ie, the called service) is obtained through the correspondence stored in the first token set, so that the acquisition of the token of the called service is more direct and efficient.
  • the presence of the first set of tokens causes the developer of the calling service (eg, the first service) not to provide additional token generation code to satisfy the authentication mode required by the different invoked services, but directly from the first set of tokens Obtaining tokens, in other words, the process of token generation is transparent to the service developer and is not perceptible, thereby reducing the complexity of service development and simplifying the service development process.
  • FIG. 5 is a schematic flowchart of a method for generating a token template according to an embodiment of the present invention, that is, a specific method performed by the template generating unit 323 .
  • the service running example herein may be considered as a running instance of the service 6 in FIG. 4 or a running instance of another service having the same token format as the service 6.
  • the Toolkit intercepts and obtains a service request message for the running instance of the service, wherein the service request message is a specific form of the service call request
  • c) Analyze the intercepted service request message. Specifically, the head/body of the intercepted service request message is parsed to obtain the token in the service request message.
  • the shared token attributes are extracted therefrom.
  • Figure 5 shows an example of a token profile that includes token attributes including: token format, token location, attributes (unlike the token attribute concept described above), signature body, and signature algorithm.
  • the values of the token format include JWT, SWT, CMS, AK/SK, X.509, and SAML.
  • the value of the token location includes X-Auth-Token, X-Subject-Token, X-Access-Token, and Bear.
  • the value of the token location indicates the field of the service request message where the token is located, followed by the token. You can see it in the concrete example.
  • Attributes include user name, issuer, issue date, recipient, expiration time, role, and scope of access, etc., values of one or more of these attributes that need to be included in the service request message, such as who the user's name is, What is the expiration time and the scope of the visit. Which attributes are needed in a service's token and what layout between the attributes may also be related to the format of the service token, which is not explained here.
  • the signature body includes the tenant private key and the root certificate private key. There are many signature algorithms, such as RSA256 and SHA.
  • the automatically generated token profile may directly be used as a token template, or may receive the user's input according to the steps shown in e) of FIG. 5, and generate a token template based on the token profile under manual customization by the user.
  • the value of the automatically generated token summary token format, the value of the signature body, and the value of the signature algorithm are not determined, and the user can fill in manually.
  • the known or default value of each token attribute in the token profile can also be modified
  • token summary shown in FIG. 5 is only an example, and the information contained therein may be increased or decreased, and the presentation form thereof is not limited to the form shown in FIG. 5.
  • Figure 6 shows a specific token.
  • the location of the token is the field X-Access-Token in the service request message.
  • the value of the token is 64-bit code as shown.
  • the token is obtained by obtaining the service request message and parsing the field X-Access-Token, and then decoding the content of the token, including the user id, the role name, and the project. Id, authorization date (issue_at), expiration date (expires_at), and signature (signature).
  • the token template can then be generated based on the content.
  • the value of some token attributes in the token template is consistent regardless of the service caller.
  • the value of this type can be directly obtained from the token and used as the token.
  • the default value of the property is used.
  • the method provided by the embodiment of the present invention can create a token template for a tenant's service by using an automatic/semi-automatic method, thereby implementing secure and seamless integration of different services based on the token template.
  • FIG. 7 is a schematic flowchart of a method for generating a token stack according to an embodiment of the present invention, that is, a specific method performed by the token set generating unit 3221 .
  • the token set generating unit 3221 is deployed in the trust center 322, and deployed in the trust center 322 has advantages in security and access control. In other embodiments, the deployment location of the token set generation unit 3221 is not limited.
  • a tenant domain wants to obtain the token stack of the service subscribed to by the tenant domain, a request for acquiring the token stack is sent to the token set generating unit 3221, and the request is signed using AK/SK, and the signature is An implementation of the identity information of the tenant of the tenant domain.
  • the tenant domain in which the request is sent may be considered as the tenant domain 331 shown in FIG.
  • AK Access Key ID
  • Access key ID A unique identifier associated with the private access key; the access key ID is used with the private access key to cryptographically sign the request.
  • SK Secret Access Key
  • the request may also be sent to the trust center 322 and then intercepted by the token set generation unit 3221, ie, the token set generation unit 3221 is transparent to the tenant domain.
  • the token set generation unit 3221 sends a request to the PaaS-IAM 3224 to verify the identity of the tenant of the tenant domain. Based on the AK/SK verification principle, the PaaS-IAM3224 verifies the identity of the tenant based on the tenant information, the tenant's public key private key pair, and the X.509 root key/certificate.
  • the token set generation unit 3221 acquires the tenant's tenant information and the secret key value for encryption and the like from the PaaS-IAM 3224.
  • d) Obtain information such as a token template, a role, and the like of the service subscribed by the tenant from the configuration center 3222 according to the acquired tenant information, such as the name of the tenant.
  • the configuration center 3222 shown in FIG. 7 stores the two relationships together in one table.
  • the tenant sending the token stack request is Tenant1
  • Tenant1 can be found to subscribe to Service Endpoint1 and Service Endpoint2, and the roles are developer and reader respectively.
  • the token templates of the service Endpoint1 and the service Endpoint2 are Token Template 1 and Token Template 2, respectively.
  • Figure 8 shows an example of a token stack.
  • the example shows a token stack consisting of two tokens, the first token exemplarily showing: "endpoint" is /analytics/service, ie a subscribed service End point.
  • the specific content of the token is 64-bit encoded and placed in the field "token”, and at the same time indicates the location where the token needs to be placed in the service request message, that is, the field "position”, and the x-access-token indicates the order.
  • the card needs to be placed in the field x-access-toke in the service request message (refer to the content of the service request message shown in 6). As can be seen from FIG.
  • the token stack includes not only a plurality of tokens, but also corresponding information of service endpoints, tokens, and service endpoints of the service corresponding to each token, and location information that should be placed when the token is used. .
  • Figure 8 is only to show the format of the token stack, so the second token is not shown, you can refer to the first token.
  • FIG. 8 is merely an example.
  • the token stack may also be a table or a piece of program code or the like. Multiple tokens can be sent together to the tenant domain of the request token; they can also be sent one by one, and the tenant domain decides how to store it.
  • the method provided by the foregoing embodiments may be implemented on one or more physical computers, and the devices proposed in the foregoing embodiments may be deployed on one or more physical computers, and the unit module division inside the device is only as an exemplary It can be seen that each unit module can be deployed on the same physical computer or on different physical computers.
  • FIG. 9 is a schematic diagram of a logical structure of a computer system according to an embodiment of the present invention.
  • the computer system 900 includes
  • System bus 910 can be any of several types of bus structures, which can include a memory bus or memory controller, a peripheral bus, and a local bus using a bus structure.
  • the bus structure may include an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Extended ISA (Extended-ISA) bus, and a Video Electronics Standards Association (VESA) Bureau. Domain bus, and Peripheral Component Interconnect (PCI) bus.
  • ISA Industry Standard Architecture
  • MCA Micro Channel Architecture
  • VESA Video Electronics Standards Association
  • PCI Peripheral Component Interconnect
  • System memory 930 includes both volatile and non-volatile memory, such as read only memory (ROM) 931 and random access memory (RAM) 932.
  • the basic input/output system 933 (BIOS) is typically stored in the ROM 931 and contains basic routines that facilitate the transfer of information between the various elements in the management node 910.
  • RAM 932 typically contains data and/or program modules that are immediately accessible and/or immediately operational by processing unit 920, such as operating system 934, applications 935, other program modules 936, and program data 937.
  • Computer system 900 may also include other removable/non-removable, volatile/non-volatile storage media.
  • hard disk storage 941 which can be a non-removable and non-volatile, readable and writable magnetic medium.
  • the external memory 951 can be a variety of external memories, such as an optical disk, a magnetic disk, a flash memory or a mobile hard disk, which are detachable and non-volatile; the hard disk storage 941 is generally connected through a non-removable storage interface (for example, the interface 940).
  • System bus 810 is coupled, and external memory is typically coupled to system bus 910 via a removable storage interface (e.g., interface 960).
  • the hard disk storage 941 can be used to store an operating system 942, an application 943, other program modules 944, and program data 945. It should be noted that these components may be the same as or different from the operating system 934, the application 935, the other program modules 936, and the program data 937.
  • the user can enter commands or information through various types of input devices 961 to manage computer system 900.
  • the various input devices are typically coupled to the processing unit 920 via a user input interface 960.
  • the user input interface 960 is coupled to the system bus 910, but may be coupled to the system bus 910 via other interfaces, such as a parallel interface, or a general purpose string.
  • Display device 991 can also be coupled to system bus 910 via an interface (e.g., video interface 990).
  • the computer system 900 can also include various types of peripheral output devices 982 that can be connected through an output interface 980 or the like.
  • the functions of the method in any of the preceding embodiments or the logic module of the previous embodiment may be read by the processing unit 920 by code or readable instructions stored in one or more storage media of the computing system 900.
  • the code or readable instructions are implemented.
  • Processing unit 920 can be a single core processor or a multi-core processor. When the processing unit 920 is a multi-core processor, the method implemented by the foregoing embodiments may be run on one core, or different functional units may be distributed on different cores. Processing unit 920 may also include a microprocessor/coprocessor or the like.
  • the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, ie may be located A place, or it can be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • the connection relationship between the modules indicates that there is a communication connection between them, and specifically, one or more communication buses or signal lines can be realized.
  • the drawing device can be implemented by means of software plus necessary general hardware, and of course, the dedicated hardware can also include an ASIC. , dedicated CPU, dedicated memory, dedicated components, etc. to achieve.
  • functions performed by computer programs can be easily implemented with the corresponding hardware, and the specific hardware structure used to implement the same function can be various, such as analog circuits, digital circuits, or dedicated circuits. Circuits, etc.

Abstract

本申请提供一种实现认证/授权的方法、装置、云计算系统及计算机系统，应用于多租户域的云计算系统中，为不同服务之间的调用实现认证/授权，能够提高服务调用的效率。其中，该方法包括接收服务调用请求；根据该服务调用请求中包含的第二服务的信息从第一令牌集合中获取所述第二服务的令牌，所述第一令牌集合包括所述第二服务的信息和所述第二服务的令牌之间的对应关系；使用获取到的所述第二服务的令牌更新所述服务调用请求；根据所述第二服务的信息向所述第二服务发送所述更新后的服务调用请求。

Description

实现认证/授权的方法、装置、云计算系统及计算机系统 技术领域
本发明实施例涉及云计算领域，尤其涉及一种基于PaaS平台的服务之间的认证/授权方法。
背景技术
云计算(Cloud Computing)是一种通过网络以服务的方式提供动态可伸缩的虚拟化资源的计算模式。PaaS(Platform as a Service)是云计算的主要模式之一，主要用于将软件研发平台作为服务提供给租户。PaaS平台上注册不同的租户，这些租户会使用PaaS平台提供的软件研发平台开发和提供各种各样的软件服务(包括微服务)，下文简称为服务。不同的租户之间会发生服务调用服务的情况，例如，租户1的服务A订阅租户2的服务B，这意味着服务A在被使用的时候会周期性或事件触发性地调用服务B。
同一个PaaS平台上，由于不同的租户可采用不同的程序模型开发服务，导致不同的服务的认证/授权机制可能不同。PaaS上常用的认证/授权机制为基于令牌(token)的认证/授权机制，例如SWT(Simple Web Token),JWT(Json Web Token),CMS(Cryptographic Message Syntax),SAML(Security Assertion Markup Language),X.509 Certificate,OAuth2授权token,RSA token等。拥有不同的认证/授权机制的服务之间如果发生调用，就会存在认证/授权困难的问题，从而无法达到安全的无缝集成。
为解决这一问题，现有技术主要提出两种方案：一种是采用统一的认证授权中心来处理所有的服务调用请求，但这种方式会导致性能瓶颈，可能带来单点失败(single point failure)的问题；另一种是服务请求者在其客户端实现不同格式的token的生成代码，从而在该服务请求者调用不同的服务时能相应生成不同格式的token，但这种方式会给服务开发者增加额外的开发负担。
发明内容
本发明实施例提供一种实现认证/授权的方法、装置、云计算系统及计算机系统，应用于多租户域的云计算系统中，为不同服务之间的调用实现认证/授权，能够提高服务调用的效率。
第一方面，本发明实施例提供一种实现认证/授权的方法，该方法可以应用于包括云计算系统或其他类型计算机系统中。该方法包括：接收运行在第一租户域上的第一服务发送的服务调用请求，其中，所述服务调用请求包括第二服务的信息；根据所述第二服务的信息从第一令牌集合中获取所述第二服务的令牌，其中，所述第一令牌集合包括所述第二服务的信息和所述第二服务的令牌之间的对应关系；使用获取到的所述第二服务的令牌更新所述 服务调用请求；根据所述第二服务的信息向所述第二服务发送所述更新后的服务调用请求。
当以上方法应用于云计算系统时，第一租户域为该云计算系统中属于第一租户的租户域。云计算系统提供的服务，例如开发环境/开发平台，可以同时提供给多个用户，每个用户都像“租赁”一样使用该服务，所以云计算系统的用户一般称之为“租户”。
第二服务的信息可以为用于标识服务的信息，例如服务的访问端点(endpoint)。
令牌集合中包括一个或多个令牌以及令牌与服务的对应关系，例如，令牌A与服务A对应则表明该令牌A可以在其他服务调用服务A的时候使用。当令牌集合包含多个令牌时，令牌集合在本发明的一些实施例中也被称为令牌栈。关于令牌集合的具体形式，本发明实施例不做限定。注意，令牌集合可以仅包括一个令牌及该令牌与服务的对应关系。
通常不同租户域的服务之间才可能存在认证/授权机制不一致的问题，所以本发明实施例提供的方法中的第二服务通常运行在与第一租户域不同的第二租户域中，但是如果同一租户域中存在认证/授权机制不同的服务，这些服务彼此调用时也可以使用本发明实施例提供的方法。
以上方法的执行主体为部署在第一租户域的一个或多个单元，为方便描述，为这一个或多个单元命名为第一请求重构单元。其他租户域中也可以部署有与该第一请求重构单元功能类似的请求重构单元。但本发明实施例并不强制要求云计算系统的每个租户域中都部署类似单元。另外，需要说明的是，下述第一方面的其他实现方式中更多的方法步骤是云计算系统实现的，但未必均由第一租户域实现。
可见，通过在第一租户域中实现第二服务的令牌的获取，以及针对第二服务的服务调用请求的更新，实现了非集中式的认证/授权模式，避免了单点失败问题，提高认证/授权的效率。通过第一令牌集合的中存储的对应关系获取第二服务(即被调用服务)的令牌，使得被调用服务的令牌的获取更加直接和高效。第一令牌集合的存在使得调用服务(即第一服务)的开发者不需要提供额外的令牌生成代码来满足不同被调用服务所需的验证模式，而是直接从第一令牌集合中获取令牌，从而简化了服务开发过程。
以上方法的执行主体也可以集中部署在云计算系统中或集中部署在云计算系统之外的与该云计算系统具有通信关系的其他系统中，这样虽然不能避免单点失败问题，但是也可以提高令牌获取效率，并简化服务开发过程。
结合第一方面，在一些实现方式下，该云计算系统中的每一个租户域均包含一个令牌集合，其中所述第一租户域的令牌集合即为所述第一令牌集合。
这样，每一个租户域内的服务在调用其他租户域的服务时，均可以通过本地保存的令牌集合来获取被调用服务的令牌，提高了令牌的获取效率，进 而提高了整个云计算系统的服务调用效率。
结合第一方面或前述任意一种第一方面的实现方式，在一些实现方式下，该第一令牌集合中包含的是所述第一租户域的租户订阅的至少一个服务及令牌的对应关系，所述至少一个服务包括所述第二服务。
在这种实现方式下，与第一租户域对应的第一令牌集合并不包含一个云计算系统中所有服务及令牌的对应关系，它包含的是第一租户域的租户(简称为第一租户)所订阅的服务及这些服务的令牌的对应关系，只有这些服务才是最有可能被第一租户域的服务所调用的服务，仅保存这些服务的令牌能够在提高服务调用效率的同时节省存储空间。
由于云计算系统中会存储租户之间的服务订阅关系，所以第一租户订阅的服务能够提前被云计算系统获知，然后云计算系统再生成包含这些服务的令牌的第一令牌集合。该第一租户订阅的服务可以包括第一租户域内的任意一个服务所订阅的服务。
在其他实现方式中，如果存在其他类型的服务调用关系或云计算系统可以通过其他方式获知第一租户域中的服务最可能调用的服务有哪些，第一令牌集合中包含的服务可以为据此为其他类别。
结合第一方面或前述任意一种第一方面的实现方式，在一些实现方式下，所述第二服务的令牌是基于与所述第二服务对应的令牌模板以及和所述第一租户域的信息生成的。更具体地，所述第二服务的令牌是通过用所述第一租户域的信息更新所述与所述第二服务对应的令牌模板生成的。
所述第一租户域的信息可以包括第一租户域的租户信息和/或第一租户域内调用第二服务的服务的信息。
先建立第二服务对应的令牌模板，该令牌模板中已经包含一些第二服务的认证/授权所需的信息的名称/信息的内容，进一步再依据第一租户域的租户的信息/第一租户域内调用第二服务的服务的信息确定具体的令牌，这样使得令牌的构建更加便捷和高效。
结合第一方面或前述任意一种第一方面的实现方式，在一些实现方式下，第二服务的令牌是基于令牌模板构建的，而令牌模板是通过拦截与所述第二服务相关的服务调用请求并从所述服务调用请求中提取一个或多个与所述第二服务对应的令牌属性生成的。
需要说明的是，这里拦截的服务调用请求不一定是用于调用该第二服务的，可以是用于调用与第二服务的令牌类型相同的其他服务的。
采用这种自动化方式，能够提高生成令牌模板的速度。
结合第一方面或前述任意一种第一方面的实现方式，在一些实现方式下，第二服务的令牌是基于令牌模板构建的，而令牌模板是基于拦截真实的服务调用请求并从该服务调用请求中提取令牌属性生成的，其中令牌模板也支持定制化，具体的，所谓定制化包括提取的令牌属性可以被用户修改或用户可以根据需求增加/删除令牌属性。定制化或半自动化方式使得令牌模板的 生成更灵活，一定程度上也提高了令牌模板的准确性。
结合第一方面或前述任意一种第一方面的实现方式，在一些实现方式下，所述云计算系统中的一个令牌集合可以通过如下方式生成：所述云计算系统根据租户域的租户信息获取令牌模板，其中，获取的所述令牌模板对应的服务是所述租户域的租户订阅的服务；使用所述租户信息更新所述令牌模板以生成所述服务的令牌；构建所述令牌集合，其中所述令牌集合中包括所述租户订阅的服务与该服务的令牌之间的对应关系。
结合第一方面或前述任意一种第一方面的实现方式，在一些实现方式下，所述令牌集合的生成是周期性执行的，或者是在接收到所述租户域发送的令牌请求的触发下执行的，其中所述令牌请求包括所述租户域的租户信息。
结合第一方面或前述任意一种第一方面的实现方式，在一些实现方式下，令牌集合的生成由云计算系统的一个或多个单元实现，为方便描述，为这一个或多个单元命名为令牌集合生成单元。该令牌集合生成单元被部署在所述云计算系统的租户管理面中，从而在租户管理面中统一生成各个租户域对应的令牌集合，然后将令牌集合下发到各个租户域。租户管理面也可以将多个令牌集合统一存储在租户管理面或其他存储位置，各个租户域在使用令牌时才到租户管理面或其他存储位置获取想要的令牌。
结合第一方面或前述任意一种第一方面的实现方式，在一些实现方式下，每个租户域的令牌集合基于该租户域的租户信息和该租户域订阅的服务的令牌模板生成。具体的，云计算系统根据所述租户信息验证所述租户的身份；根据所述租户的身份获取所述租户订阅的服务；根据所述租户订阅的服务从存储的对应关系中获取与所述服务对应的所述令牌模板，其中所述对应关系包括所述服务与所述服务对应的所述令牌模板之间的对应关系。
在获取租户订阅的服务的令牌模板之前，先验证租户的身份，能够提高云计算系统的安全性。
第二方面，本发明实施例提供一种为服务调用实现认证/授权的装置，该装置位于云计算系统中，该装置包括第一请求重构单元，该第一请求重构单元可以位于该云计算系统的第一租户域内。该云计算系统的其他租户域内也可以相应部署与该第一请求重构单元功能相同或相似的其他请求重构单元。
该第一请求重构单元用于接收运行在所述第一租户域的第一服务发送的服务调用请求，其中所述服务调用请求包括第二服务的信息；根据所述第二服务的信息从第一令牌集合中获取所述第二服务的令牌，其中，所述第一令牌集合包括所述第二服务的信息和所述第二服务的令牌之间的对应关系；使用获取到的所述第二服务的令牌更新所述服务调用请求；以及根据所述第二服务的信息向所述第二服务发送所述更新后的服务调用请求。
结合第二方面，在一些实现方式下，该装置还包括令牌集合生成单元。该令牌集合生成单元用于基于与所述第二服务对应的令牌模板和所述第一 租户域的租户信息生成所述第二服务的令牌；以及生成所述第一令牌集合，所述第一令牌集合中包括所述第二服务的信息与生成的所述令牌之间的对应关系。
结合第二方面或前述任意一种第二方面的实现方式，在一些实现方式下，该令牌集合生成单元具体用于使用所述租户信息更新所述与所述第二服务对应的令牌模板以生成所述第二服务的令牌。
结合第二方面或前述任意一种第二方面的实现方式，在一些实现方式下，该装置还包括模板生成单元，用于拦截与所述第二服务相关的服务调用请求并从所述服务调用请求中提取一个或多个与第二服务对应的令牌属性以生成所述第二服务的令牌模板。
结合第二方面或前述任意一种第二方面的实现方式，在一些实现方式下，所述云计算系统的每个租户域中均部署有一个请求重构单元，其中所述第一租户域中部署的请求重构单元即为所述第一请求重构单元。
结合第二方面或前述任意一种第二方面的实现方式，在一些实现方式下，所述模板生成单元和所述令牌集合生成单元被部署在所述云计算系统的租户管理面中。
结合第二方面或前述任意一种第二方面的实现方式，在一些实现方式下，所述令牌集合生成单元被部署在所述租户管理面的信任中心中。
结合第二方面或前述任意一种第二方面的实现方式，在一些实现方式下，所述令牌集合生成单元还用于向所述第一租户域发送所述第一令牌集合，以便于所述第一请求重构单元能够从所述第一租户域中访问所述第一令牌集合。
这样，第一租户域可以从本地访问第一令牌集合，相较于服务调用时再去租户管理面请求令牌，获取令牌更快速，进而提高了服务认证/授权速度。
第三方面，本发明实施例提供一种云计算系统，例如PaaS系统，该云计算系统包括前述任意一种装置。
第四方面，本发明实施例提供一种令牌模板的生成方法，服务的令牌可以基于该服务对应的令牌模板生成。该方法包括：拦截用于调用服务的服务调用请求；分析所述服务调用请求以获得所述服务的令牌概要；根据所述令牌概要生成所述服务对应的令牌模板。令牌模板生成之后可以存储该令牌模板与该服务的对应关系。
基于第四方面，在一些实现方式下，插入Toolkit到所述服务的一个或多个运行实例中，从而拦截针对所述服务的服务调用请求，从所述服务调用请求中提取令牌属性信息，最终生成令牌模板。可选的，在生成令牌模板之前，提取的令牌属性信息可以被定制化，例如修改令牌属性信息或添加新的令牌属性信息等
第五方面，本发明实施例提供一种创建令牌集合的方法，该方法包括接收租户域发送的用于获取令牌集合的请求，所述请求中包括所述租户域的租户的 身份信息以及服务信息，该服务信息用于指示该租户订阅的服务，例如，所述服务信息例如为服务的访问端点(endpoint)；根据所述租户的身份信息验证所述租户的身份；当根据所述身份信息验证所述租户为可信租户时，从预先存储的对应关系中获取所述服务信息对应的令牌模板；根据获取的所述令牌模板为所述租户创建令牌集合，所述令牌集合中包括令牌以及所述服务信息的对应关系，其中，所述令牌是根据所述令牌模板生成的，且所述令牌对应的服务信息是生成该令牌的令牌模板对应的服务信息，亦即所述租户订阅的服务的信息。
第六方面，本发明实施例提供一个实现认证/授权的装置，用以实现前述任意一方面或一种实现方式所述的方法，该装置中包括一个或多个单元以实现方法的步骤。该装置可以部署在PaaS系统中，用于实现不同服务之间安全的无缝集成。
第七方面，本发明实施例提供一种计算机存储介质，该计算机存储介质可以是非易失性的，该计算机存储介质存储用于实现前述任意一方面或一种实现方式所述的方法的计算机程序。
第八方面，本发明实施例提供一种计算机系统，该计算机系统包括处理器和存储器，其中，该存储器用于存储计算机程序，该处理器用于从该存储器中读取计算机程序并实现前述任意一方面或一种实现方式所述的方法。
第九方面，本发明实施例提供一种云计算系统，该云计算系统包括租户管理面和租户面，所述租户面中包括第一租户域和第二租户域，所述第一租户域中部署有第一请求重构单元，所述租户管理面中部署有令牌集合生成单元和模板生成单元，其中，所述第一请求重构单元用于：接收运行在第一租户域的第一服务发送的服务调用请求，其中所述服务调用请求包括第二服务的信息，所述第二服务运行在所述第二租户域；根据所述第二服务的信息从第一令牌集合中获取所述第二服务的令牌，其中，所述第一令牌集合包括所述第二服务的信息和所述第二服务的令牌之间的对应关系；使用获取到的所述第二服务的令牌更新所述服务调用请求；以及根据所述第二服务的信息向所述第二服务发送所述更新后的服务调用请求。所述模板生成单元用于：拦截与所述第二服务相关的服务调用请求并从所述服务调用请求中提取一个或多个与所述第二服务对应的令牌属性以生成所述第二服务的令牌模板；所述令牌集合生成单元用于：基于与所述第二服务对应的令牌模板和所述第一租户域的信息生成所述第二服务的令牌；生成所述第一令牌集合；所述令牌集合生成单元还用于向所述第一租户域发送所述第一令牌集合，以便于所述第一请求重构单元能够从所述第一租户域中访问所述第一令牌集合。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面 描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的认证/授权装置的逻辑结构示意图；
图2为本发明实施例提供的云计算系统的逻辑结构示意图；
图3为本发明实施例提供的PaaS平台的逻辑结构示意图；
图4为本发明实施例提供的认证/授权方法的交互示意图；
图5为本发明实施例提供的令牌模板生成方法的流程示意图；
图6为本发明实施例提供的一种令牌的示例；
图7为本发明实施例提供的令牌栈生成方法的流程示意图；
图8为本发明实施例提供的一种令牌栈的示例；
图9为本发明实施例提供的一种计算机系统的逻辑结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚地描述。
本申请中的术语“第一”、“第二”仅用于描述目的，而不能理解为指示或暗示相对重要性或者隐含指明所指示的技术特征的数量。由此，限定有“第一”、“第二”的特征可以明示或者隐含地包括一个或者更多个该特征。在本发明的描述中，除非另有说明，“多个”的含义是两个或两个以上。本申请中的术语“和/或”或字符“/”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或，或A/B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。
请参考图1，为本发明实施例提供的认证/授权装置的逻辑结构示意图。该认证/授权装置100可以为一个独立的系统，也可以是嵌入或部署在其他系统中的一个装置。该认证/授权装置100可以是软件实现的装置，也可以是硬件实现的装置。
该认证/授权装置100包括请求重构单元101、令牌集合生成单元102以及模板生成单元103。
模板生成单元103生成与服务对应的令牌模板，以便于后续基于该模板生成该服务的令牌。
令牌集合生成单元102根据服务的令牌模板和该服务的调用者的信息生成针对该调用者的令牌，以便于在该调用者调用该服务时使用该令牌实现认证/授权。在云计算系统中，服务的调用者可以认为是一个租户或该租户中的一个服务。
请求重构单元101接收调用者的服务调用请求，并根据令牌集合生成单元102生成的令牌更新该服务调用请求，将更新后的服务调用请求发送给被调用的服务。由于更新后的服务调用请求中包含了被调用服务支持的令牌，因此被调用服务可以根据该令牌实现调用者的认证/授权。
具体的，模板生成单元103拦截对该服务的服务调用请求，解析该服务调用请求以获取所述服务的一个或多个令牌属性；根据该一个或多个令牌属性生成与所述服务对应的令牌模板。也就是说，模板生成单元103从已有的服务调用请求中获得令牌，并从该令牌中提取一个或多个令牌属性，形成令牌模板。进一步的，该模板生成单元103支持令牌模板的定制化，例如，令牌模板可以提供给用户，由用户根据需求进行修改，然后形成最终的令牌模板。
模板生成单元103生成服务的令牌模板之后，可以将服务的信息(例如服务的标识)、服务的令牌模板以及这两项的对应关系存储起来，供自己或其他单元使用。
具体的，令牌集合生成单元102接收调用者发送的请求信息，该请求信息中包含调用者的身份信息；根据调用者的身份信息确定调用者所订阅的服务，并获取调用者所订阅的服务对应的令牌模板；根据获取的令牌模板和该调用者身份信息生成调用者所订阅的服务的令牌，若调用者订阅的服务为多个，那么这多个令牌可以以令牌栈的形式存储起来(参考图8)。该令牌栈中包括多个令牌和这多个令牌对应的服务的标识信息，以及这两项的对应关系。
调用者的订阅信息可以预先存储，订阅信息中包含调用者所订阅的服务，因此可以根据此订阅信息获取调用者所订阅的服务。调用者也可以发送服务的信息(例如该服务的标识信息)到令牌集合生成单元102，以表明该调用者意图调用该服务，想要获取该服务的令牌，那么令牌集合生成单元102根据该服务的信息找到该服务的令牌模板，根据调用者的身份信息和该令牌模板生成该服务的令牌，以用于调用者调用该服务时使用。
每个调用者都可以有对应的令牌或令牌栈(多个令牌)，这些令牌或令牌栈可以在调用者的请求下生成，并在生成之后立即发送给调用者，由调用者存储在本地；也可以周期性地为已知的调用者生成令牌或令牌栈，并将这些令牌或令牌栈存储起来，在调用者请求时发送给调用者或者自发发送给调用者。
具体的，请求重构单元101接收调用者发送的服务调用请求，该服务调用请求中包括被调用的服务的信息；根据该被调用的服务的信息从该调用者对应的一个或多个令牌中获取该被调用的服务的令牌，然后使用获取的令牌更新前述服务调用请求，使得该服务调用请求中包含这个令牌；最后将更新后的服务调用请求发送给被调用的服务。
需要说明的是，多个令牌的存储形式仅以该令牌栈为例，在本发明其他实现方式中，也可以采用其它存储形式。
本发明实施例叙述了认证/授权装置100中的各个单元以及各个单元之间如何配合实现装置目的，下面通过更为详尽的实施例介绍本发明提供的认证/授权装置在云计算系统中以及具体的PaaS(Platform as a Service)平台上如何部署和应用。
请参考图2，为本发明实施例提供的云计算系统的逻辑结构示意图。该云计算系统200包括基础设施即服务(Infrastructure is a Service,IaaS)210、PaaS平台220以及软件即服务(Software is a Service,SaaS)230。IaaS、PaaS和SaaS被视为云计算的三种服务模式，简称为SPI。这三种服务模式即便单独存在也可以认为是一个云计算系统。
IaaS210中具体包括包含硬件资源层213、虚拟化层212以及虚拟资源层211。硬件资源层213的存储资源、处理资源以及网络资源经过虚拟化层212的虚拟化处理后向上层PaaS平台呈现各种虚拟资源，包括虚拟存储资源、虚拟处理资源以及虚拟网络资源，例如多个虚拟机。PaaS平台运行在IaaS层之上，利用IaaS层提供的各种虚拟资源向用户(例如/服务提供者或服务开发者)提供应用(也可称之为服务)开发/部署/运行环境，并提供应用运维管理等服务，使得用户不需要关注IaaS层的资源。PaaS平台上运行的各种应用通过SaaS的模式以服务的形式提供给最终用户。
PaaS平台上的各种服务会发生调用，例如一个仅提供音乐播放功能的服务可以调用另一个提供伴唱功能的服务，这样用户使用该音乐播放服务时还能随时使用另一个服务提供的伴唱功能。本发明实施例提供的认证/授权装置100部署在PaaS平台中，用于实现不同服务之间互相调用时的认证/授权。
请参考图3，为本发明实施例提供的PaaS平台的逻辑结构示意图。PaaS平台300包括运维面310、租户管理面320以及数据面330(也可称之为租户面)。运维面310包括管理门户311和平台管理312等。其中平台管理312中具体包含平台部署管理3121和操作管理3122。租户管理面320包括信任中心322以及部署服务324，还可以包括门户(portal)321等。其中，信任中心322中部署有配置中心3222、秘密服务3223、PaaS身份识别与访问管理(PaaS Identity and Access Management,简称为PaaS-IAM)3224、以及令牌集合生成单元3221。该令牌集合生成单元3221可以为前述实施例中的令牌集合生成单元102，也可以为其他实施例中介绍类似功能单元或或实现其他实施例中介绍的类似方法。租户管理面320中还包括模板生成单元323，该模板生成单元323可以为前述实施例中的模板生成单元103，也可以为其他实施例中介绍类似功能单元或或实现其他实施例中介绍的类似方法。数据面330中包含多个租户域，其中租户域331中包括多个提供不同功能的服务3311以及请求重构单元3312，租户域332中包括多个提供不同功能的服务3321以及请求重构单元3322，租户域333中包括多个提供不同功能的服务3331以及请求重构单元3332。
云计算系统中包括多个能够提供计算机功能的节点，由于云计算系统基于虚拟化技术，所以这些节点通常是虚拟机或容器等虚拟计算节点。云计算系统的一个租户可以使用云计算系统的一个或多个节点，这一个或多个节点就形成了这个租户的租户域。多个租户域之间可以使用虚拟局域网(Virtual Local Area Network,VLAN)等技术实现标识和隔离，以保证多个租户域的 数据安全。
由于在本发明实施例中不涉及与运维面310强相关的改进，所以不对它做详细介绍。下面结合各个模块在PaaS平台的部署介绍详细认证/授权装置实现的方法流程。
请参考图4，为本发明实施例提供的认证/授权方法的交互示意图。
(1)各个租户域的租户发布服务到PaaS平台上，这些服务将会运行在数据面330上，在数据面上不同的租户拥有各自的租户域。一个租户域中可以包含一个或多个节点。这里的“节点”在云计算背景下通常指的是虚拟机或虚拟容器等虚拟计算环境。
(2)不同的租户之间发生服务的订阅。例如，如图所示，租户域331的服务1订阅租户域333的服务6，这种订阅关系会被存储在配置中心3222中。
需要说明的是，以上(1)和(2)由于没有限定特定租户域或特定服务，所以并无特定的顺序关系，但是如图一个服务想要订阅另一个服务，则这两个服务通常得先被发布到PaaS平台上。
经过(1)和(2)之后，PaaS平台的数据面330上已运行有多个服务，不同的服务之间可能存在的订阅关系也已经存储在配置中心3222中。之后部署在租户管理面320的模板生成单元323通过获取服务调用请求生成令牌模板。具体的模板生成过程后面再做详细描述。
(3)模板生成单元323生成令牌模板之后，将令牌模板以及令牌模板和服务的对应关系存储到配置中心中3222中，其中服务可以用服务端点(endpoint)来标识。
经过以上步骤之后，配置中心3222中存储多个服务端点和这些服务的令牌模板之间的对应关系。令牌集合生成单元3221接收租户域发送的用于请求令牌或令牌栈的消息，该消息中包含该租户域的租户的身份信息，令牌集合生成单元3221请求PaaS-IAM3224验证该租户的身份信息，若验证成功，则根据该租户的身份从配置中心3222中获取该租户所订阅的服务的端点，并根据这些服务的端点以及配置中心3222存储的令牌模板和服务端点的对应关系查找获得所订阅服务的令牌模板，然后基于该令牌模板生成令牌。具体过程在后面详述。
(4)令牌集合生成单元3221生成令牌或令牌栈后，会将该令牌或令牌栈发送到相应的租户域，租户域将该令牌或令牌栈存储到该租户域内的存储资源上。例如，租户域331发送请求令牌栈的消息，令牌集合生成单元3221验证租户域331的身份之后生成令牌栈，并将该令牌栈发送给租户域331。在其他实现方式中，令牌集合生成单元3221也可能自发生成所有租户域的令牌栈，并将令牌栈分发到各个租户域。
经过以上步骤之后，各个租户域中或有需求的租户域中已经均保存有各自所订阅服务的令牌。下面以租户域331中的服务调用租户域333中服务为例，介绍服务调用过程。
(5)租户域331中的服务1向位于同一租户域的服务转发代理发送服务调用请求。服务转发代理为现有PaaS平台上用于接收并转发服务调用请求的模块，部署在各个租户域中。
本发明实施例提供的请求重构单元3312可以部署在各个租户域的服务转发代理中。一个租户域内的请求重构单元3312拦截位于同一租户域的服务发送给服务转发代理的服务调用请求，更新服务调用请求，再将更新后的服务调用请求向被调用服务发送。
如图4所示，位于租户域331内的请求重构单元3312拦截服务1发送的服务调用请求，该示例中该服务调用请求是用来调用租户域333中的服务6的，因此该服务调用请求中包括服务6的端点，请求重构单元3312根据服务6的端点和本租户域内存储的令牌栈查找到服务6对应的令牌，然后使用该令牌更新服务调用请求，例如使用服务6的令牌替换服务调用请求中原有的令牌，或在服务调用请求中添加该服务6的令牌。采用“替换”或“添加”等哪一种更新方式取决于拦截到的服务调用请求的形式，本发明实施例的目的是使得服务调用请求中包含正确的令牌，对具体的“更新”方式不做限定。
(6)请求重构单元3312将更新后的服务调用请求发送给租户域333中的服务6。
可见，通过在第一租户域中实现第二服务的令牌的获取，以及针对第二服务的服务调用请求的更新，实现了非集中式的认证/授权模式，避免了单点失败问题，提高认证/授权的效率。
通过第一令牌集合的中存储的对应关系获取第二服务(即被调用服务)的令牌，使得被调用服务的令牌的获取更加直接和高效。
第一令牌集合的存在使得调用服务(例如第一服务)的开发者不需要提供额外的令牌生成代码来满足不同被调用服务所需的验证模式，而是直接从第一令牌集合中获取令牌，换句话说，令牌自动生成的过程对服务开发者是透明的，不感知的，从而降低服务开发的复杂度,简化了服务开发过程。
下面详细介绍令牌模板的生成方法。
请参考图5，为本发明实施例提供的令牌模板生成方法的流程示意图，亦即模板生成单元323所执行的具体方法。
a)在想要生成令牌模板的服务中设置拦截机制。具体的，在该服务的运行实例中插入Toolkit。为了承接前述实施例便于理解，这里的服务运行实例可以认为是图4中服务6的运行实例，或者是与服务6具有相同令牌格式的其他服务的运行实例。
b)Toolkit拦截并获取针对该服务运行实例的服务请求报文，其中，服务请求报文为服务调用请求的一种具体形式
c)分析拦截到的服务请求报文。具体的，解析拦截到的服务请求报文的head/body以获取所述服务请求报文中的令牌。
d)从获取的令牌中提取多个令牌属性，自动生成一个令牌概要。
在提取令牌属性之前，为确保正确性，可以拦截多个服务请求报文并获取其中的多个令牌之后，在从中提取共有的令牌属性。
图5示出了一个令牌概要的示例，该令牌概要包括的令牌属性包括：令牌格式、令牌位置、属性(与前述令牌属性概念不同)、签名体和签名算法。令牌格式的值包括JWT、SWT、CMS、AK/SK、X.509和SAML等。令牌位置的值包括X-Auth-Token、X-Subject-Token、X-Access-Token和Bear等，令牌位置的值指示的是令牌所在的服务请求报文的字段，后面令牌的具体示例中可以看到。属性包括用户姓名、颁发者、颁发日期、接受者、过期时间、角色、以及访问范围等，在服务请求报文中需要包括的这些属性中的一个或多个的值，比如用户姓名是谁、过期时间是什么以及访问范围有多大。一个服务的令牌中需要哪些属性以及属性之间什么布局可能还与该服务令牌的格式有关，在此不一一说明。签名体包括租户私钥和Root证书私钥等。签名算法有很多，以RSA256和SHA为例。
e)自动生成的令牌概要可以直接作为令牌模板，也可以按照图5中e)所示出的步骤，接收用户的输入，在用户的手工定制下基于令牌概要生成令牌模板。如图所示，该自动生成的令牌概要令牌格式的值、签名体的值、签名算法的值均未确定，用户可手工填写。该令牌概要中各个令牌属性的已知值或默认值也可以被修改
需要说明的是，图5所示的令牌概要仅是一个示例，其中包含的信息可以增加也可以减少，其展现形式也不局限于图5所示出的形式。
f)令牌模板确定后，建立服务端点与令牌模板的对应关系，以用于后续对令牌模板的查找。
为便于理解，图6示出了具体的一种令牌。该令牌的位置是服务请求报文中的字段X-Access-Token.该令牌的值如图所示，为64位编码。通过获取该服务请求报文以及解析其中的字段X-Access-Token获取该令牌，然后解码获得令牌的内容，包括用户(user)id，角色(roles)名称(name)、项目(project)id、授权日期(issue_at)、过期日期(expires_at)以及签名(signature)。然后可以依据这些内容生成令牌模板，令牌模板中有些令牌属性的值是无论服务调用者是谁都是一致的，此类型的值可以直接从该令牌中获取，并作为该令牌属性的默认值。
可见，本发明实施例提供的方法能够采用自动/半自动的方法为租户的服务创建令牌模板，从而基于令牌模板实现不同服务的安全无缝集成。
下面详细介绍令牌栈的生成过程。
请参考图7，为本发明实施例提供的令牌栈生成方法的流程示意图，亦即令牌集合生成单元3221所执行的具体方法。
本发明实施例中，令牌集合生成单元3221部署在信任中心322中，部署 在信任中心322中对于安全性和访问权限控制方面有优势。在其他实施例中，对令牌集合生成单元3221的部署位置不做限定。
a)某个租户域若想获得该租户域所订阅的服务的令牌栈，则向令牌集合生成单元3221发送用于获取令牌栈的请求，该请求使用AK/SK进行签名，签名为该租户域的租户的身份信息的一种实现方式。为了承接前述实施例便于理解，这里发送请求的租户域可以认为是图4中所示的租户域331。
AK(Access Key ID)：访问密钥ID。与私有访问密钥关联的唯一标识符；访问密钥ID和私有访问密钥一起使用，对请求进行加密签名。
SK(Secret Access Key)：与访问密钥ID结合使用的密钥，对请求进行加密签名，可标识发送方，并防止请求被修改。
在其他实施例中，该请求也可以是向信任中心322发送，然后被令牌集合生成单元3221拦截，即令牌集合生成单元3221对租户域是透明的。
b)令牌集合生成单元3221向PaaS-IAM3224发送请求以验证该租户域的租户的身份。依据AK/SK的验证原理，PaaS-IAM3224根据租户信息、租户的公钥私钥对以及X.509根秘钥(root key)/证书等验证租户的身份。
c)当租户的签名被验证成功后，令牌集合生成单元3221从PaaS-IAM3224获取该租户的租户信息和用于加密的秘钥值等。
d)根据获取的租户信息，例如租户的名称，从配置中心3222中获取该租户订阅的服务的令牌模板、角色等信息。
前述已经介绍了配置中心3222中存储服务以及服务的令牌模板的对应关系，并介绍了现有技术的配置中心3222中会存储服务与服务之间的订阅关系。这两种关系可以和在一起存储，也可以分开存储，也可以一定程度上重复性存储。
示例性的，图7所示的配置中心3222中将两种关系合在一起存储在一张表中。例如发送令牌栈请求的租户为租户1(Tenant1)，那么从该表中可以查找到Tenant1订阅了服务Endpoint1和服务Endpoint2,角色分别是developer和reader。服务Endpoint1和服务Endpoint2的令牌模板分别是Token模板1和Token模板2。
e)获取到该租户订阅的服务的令牌模板之后，根据该租户的信息将令牌模板中缺失的值补充完整，例如订阅者的信息等，形成完整的令牌，并将所有被订阅服务的令牌组合成令牌栈，然后向该租户域发送该令牌栈。
图8为一个令牌栈的示例。该示例中展示了一个令牌栈的组成，该令牌栈包括两个令牌，其中第一个令牌示例性地示出了：“endpoint”为/analytics/service,即一个被订阅的服务的端点。令牌的具体内容被64位编码后放在字段“token”处，并同时指出了该令牌需要放置在服务请求报文中的位置，即字段“position”，x-access-token表明该令牌需要被放置在服务请求报文中的字段x-access-toke处(参考6示出的服务请求报文的内容)。由图8可以看出，该令牌栈中不仅包含多个令牌，还包含各个令牌对应的服务的 服务端点、令牌和服务端点的对应信息以及令牌被使用时应放置的位置信息。图8仅是为了展现令牌栈的格式，因此第二个令牌没示出，可参考第一个令牌。
图8仅为示例，在其它实施例中，令牌栈也可以是一个表格或一段程序代码等。多个令牌可以一同被发送给请求令牌的租户域；也可以逐一发送，由租户域自行决定如何存储。
前述实施例提供的方法可以实现在一台或多台物理计算机上，前述实施例中提出的装置可以部署在一台或多台物理计算机上，装置内部的单元模块划分仅作为一种示例性的示出，各个单元模块可以部署在同一台物理计算机上，也可以部署在不同的物理计算机上。
请参考图9，为本发明实施例提供的一种计算机系统的逻辑结构示意图。该计算机系统900包括
处理单元920，系统存储器930，和系统总线910。系统总线将包括系统存储器的各种系统元件与处理单元920相耦合。系统总线910可以是几种类型总线结构中的任意一种总线，这些总线可以包括存储器总线或存储器控制器，外围总线，和使用一种总线结构的局部总线。总线结构可以包括工业标准结构(Industry Standard Architecture,ISA)总线，微通道结构(Micro Channel Architecture,MCA)总线，扩展ISA(Extended-ISA)总线，视频电子标准协会(Video Electronics Standards Association,VESA)局域总线，以及外围器件互联(Peripheral Component Interconnect,PCI)总线。
系统存储器930包括易失性和非易失性存储器，例如，只读存储器(ROM)931和随即存取存储器(RAM)932。基本输入/输出系统933(BIOS)一般存储于ROM931中，包含着基本的例行程序，它有助于在管理节点910中各元件之间的信息传输。RAM 932一般包含着数据和/或程序模块，它可以被处理单元920即时访问和/或立即操作，例如操作系统934，应用程序935，其他程序模块936和程序数据937。
计算机系统900也可以包括其他可拆卸/非拆卸，易失性/非易失性的存储媒介。例如硬盘存储器941，它可以是非拆卸和非易失性的可读写磁媒介。再例如外部存储器951，它可以是可拆卸和非易失性的各类外部存储器，例如光盘、磁盘、闪存或者移动硬盘等；硬盘存储器941一般是通过非拆卸存储接口(例如，接口940)与系统总线810相连接，外部存储器一般通过可拆卸存储接口(例如，接口960)与系统总线910相连接。硬盘存储器941可以用于存储操作系统942，应用程序943，其它程序模块944以及程序数据945。需要说明的是，这些元件可以与操作系统934，应用程序935，其他程序模块936，以及程序数据937是相同的，也可以是不同的。
用户可以通过各类输入设备961输入命令或信息以管理计算机系统900。各种输入设备通常是通过用户输入接口960与处理单元920相连接，用户输 入接口960与系统总线910相耦合，但也可以通过其他接口和系统总线910相连接，例如，并行接口，或通用串行接口(USB)。显示设备991也可以通过接口(例如，视频接口990)与系统总线910相连接。此外，该计算机系统900也可以包括各类外围输出设备982，外围输出设备982可以通过输出接口980等来连接。
前述任一实施例中的方法或者上一实施例中逻辑模块的功能可以通过存储在该算计系统900的一种或多种存储媒介中的代码或者可读指令，并由处理单元920读取所述代码或者可读指令从而得以实现。
处理单元920可以为单核处理器或多核处理器。当处理单元920为多核处理器时，前述实施例实现的方法可以运行在一个核上，也可以不同功能单元分布在不同的核上。处理单元920还可以包括微处理器/协处理器等。
以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。另外，本发明提供的装置实施例附图中，模块之间的连接关系表示它们之间具有通信连接，具体可以实现为一条或多条通信总线或信号线。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本发明实施例所述的绘图装置可借助软件加必需的通用硬件的方式来实现，当然也可以通过专用硬件包括专用集成电路、专用CPU、专用存储器、专用元器件等来实现。一般情况下，凡由计算机程序完成的功能都可以很容易地用相应的硬件来实现，而且，用来实现同一功能的具体硬件结构也可以是多种多样的，例如模拟电路、数字电路或专用电路等。
以上所述，仅为本发明的一些具体实施方式，但本发明的保护范围并不局限于此。

Claims (23)

  1. 一种实现认证/授权的方法，其特征在于,包括：
    接收运行在第一租户域上的第一服务发送的服务调用请求，所述服务调用请求包括第二服务的信息；
    根据所述第二服务的信息从第一令牌集合中获取所述第二服务的令牌，所述第一令牌集合包括所述第二服务的信息和所述第二服务的令牌之间的对应关系；
    使用获取到的所述第二服务的令牌更新所述服务调用请求；
    根据所述第二服务的信息向所述第二服务发送所述更新后的服务调用请求。
  2. 根据权利要求1所述的方法，其特征在于，所述方法应用于所述第一租户域。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一令牌集合包括所述第一租户域的租户订阅的至少一个服务与所述至少一个服务的令牌的对应关系，所述至少一个服务包括所述第二服务。
  4. 根据权利要求1-3任意一项所述的方法，其特征在于，所述第二服务的令牌是基于与所述第二服务对应的令牌模板以及所述第一租户域的信息生成的。
  5. 根据权利要求4所述的方法，其特征在于，与所述第二服务对应的令牌模板是通过拦截与所述第二服务相关的服务调用请求并从所述服务调用请求中提取一个或多个与所述第二服务对应的令牌属性生成的。
  6. 根据权利要求4或5所述的方法，其特征在于，所述第二服务的令牌是使用所述第一租户域的信息更新所述与所述第二服务对应的令牌模板而生成的。
  7. 一种实现认证/授权的装置，其特征在于，包括第一请求重构单元，所述第一请求重构单元用于：
    接收运行在第一租户域的第一服务发送的服务调用请求，其中所述服务调用请求包括第二服务的信息；
    根据所述第二服务的信息从第一令牌集合中获取所述第二服务的令牌，其中，所述第一令牌集合包括所述第二服务的信息和所述第二服务的令牌之间的对应关系；
    使用获取到的所述第二服务的令牌更新所述服务调用请求；以及
    根据所述第二服务的信息向所述第二服务发送所述更新后的服务调用 请求。
  8. 根据权利要求7所述的装置，其特征在于，所述第一令牌集合包括所述第一租户域的租户订阅的至少一个服务与所述至少一个服务的令牌的对应关系，所述至少一个服务包括所述第二服务。
  9. 根据权利要求7或8所述的装置，其特征在于，还包括令牌集合生成单元，用于：
    基于与所述第二服务对应的令牌模板和所述第一租户域的信息生成所述第二服务的令牌；以及
    生成所述第一令牌集合，所述第一令牌集合中包括所述第二服务的信息与生成的所述令牌之间的对应关系。
  10. 根据权利要求9所述的装置，其特征在于，所述令牌集合生成单元具体用于使用所述第一租户域的信息更新所述与所述第二服务对应的令牌模板以生成所述第二服务的令牌。
  11. 根据权利要求9或10所述的装置，其特征在于，还包括模板生成单元，用于拦截与所述第二服务相关的服务调用请求并从所述服务调用请求中提取一个或多个与所述第二服务对应的令牌属性以生成所述第二服务的令牌模板。
  12. 根据前述任意一项权利要求所述的装置，其特征在于，所述装置位于云计算系统内，所述第一请求重构单元部署在所述云计算系统的第一租户域内。
  13. 根据前述任意一项权利要求所述的装置，其特征在于，所述装置位于云计算系统内,所述模板生成单元和所述令牌集合生成单元被部署在所述云计算系统的租户管理面中。
  14. 根据权利要求13所述的装置，其特征在于，所述令牌集合生成单元被部署在所述租户管理面的信任中心中。
  15. 根据前述任意一项权利要求所述的装置，其特征在于，所述令牌集合生成单元还用于向所述第一租户域发送所述第一令牌集合，以便于所述第一请求重构单元能够从所述第一租户域中访问所述第一令牌集合。
  16. 一种云计算系统，其特征在于，所述云计算系统包括如权利要求7-15任意一项所述的装置。
  17. 根据权利要求16所述的云计算系统，其特征在于，所述云计算系统为平台即服务(PaaS)系统。
  18. 一种计算机系统，其特征在于，所述计算机系统包括处理器和存储器，所述存储器用于存储计算机可读程序，所述处理器用于读取所述存储器中存储的计算机可读程序并执行：
    接收运行在第一租户域的第一服务发送的服务调用请求，其中所述服务 调用请求包括第二服务的信息；
    根据所述第二服务的信息从第一令牌集合中获取所述第二服务的令牌，其中，所述第一令牌集合包括所述第二服务的信息和所述第二服务的令牌之间的对应关系；
    使用获取到的所述第二服务的令牌更新所述服务调用请求；以及
    根据所述第二服务的信息向所述第二服务发送所述更新后的服务调用请求。
  19. 根据权利要求18所述的计算机系统，其特征在于，所述第一令牌集合包括所述第一租户域的租户订阅的至少一个服务与所述至少一个服务的令牌的对应关系，所述至少一个服务包括所述第二服务。
  20. 根据权利要求18或19所述的计算机系统，其特征在于，所述第二服务的令牌是基于与所述第二服务对应的令牌模板以及和所述第一租户域的信息生成的。
  21. 根据权利要求20所述的计算机系统，其特征在于，与所述第二服务对应的令牌模板是通过拦截与所述第二服务相关的服务调用请求并从所述服务调用请求中提取一个或多个与所述第二服务对应的令牌属性生成的。
  22. 一种云计算系统，其特征在于，所述云计算系统包括一个或多个如权利要求18-21任意一项所述的计算机系统。
  23. 一种云计算系统，其特征在于，所述云计算系统包括租户管理面和租户面，所述租户面中包括第一租户域和第二租户域，所述第一租户域中部署有第一请求重构单元，所述租户管理面中部署有令牌集合生成单元和模板生成单元，其中，
    所述第一请求重构单元用于：接收运行在第一租户域的第一服务发送的服务调用请求，其中所述服务调用请求包括第二服务的信息，所述第二服务运行在所述第二租户域；根据所述第二服务的信息从第一令牌集合中获取所述第二服务的令牌，其中，所述第一令牌集合包括所述第二服务的信息和所述第二服务的令牌之间的对应关系；使用获取到的所述第二服务的令牌更新所述服务调用请求；以及根据所述第二服务的信息向所述第二服务发送所述更新后的服务调用请求。
    所述模板生成单元用于：拦截与所述第二服务相关的服务调用请求并从所述服务调用请求中提取一个或多个与所述第二服务对应的令牌属性以生成所述第二服务的令牌模板；
    所述令牌集合生成单元用于：基于与所述第二服务对应的令牌模板和所述第一租户域的信息生成所述第二服务的令牌；生成所述第一令牌集合；
    所述令牌集合生成单元还用于向所述第一租户域发送所述第一令牌集合，以便于所述第一请求重构单元能够从所述第一租户域中访问所述第一令牌集合。
PCT/CN2018/077065 2017-02-23 2018-02-23 实现认证/授权的方法、装置、云计算系统及计算机系统 WO2018153353A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710100457.3 2017-02-23
CN201710100457.3A CN108471395B (zh) 2017-02-23 2017-02-23 实现认证/授权的方法、装置、云计算系统及计算机系统

Publications (1)

Publication Number Publication Date
WO2018153353A1 true WO2018153353A1 (zh) 2018-08-30

Family

ID=63254141

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/077065 WO2018153353A1 (zh) 2017-02-23 2018-02-23 实现认证/授权的方法、装置、云计算系统及计算机系统

Country Status (2)

Country Link
CN (1) CN108471395B (zh)
WO (1) WO2018153353A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2020223020A1 (en) * 2019-04-29 2020-11-05 Google Llc Systems and methods for distributed verification of online identity

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109150528A (zh) * 2018-11-07 2019-01-04 杭州海兴电力科技股份有限公司 一种电表数据访问方法、装置、设备及可读存储介质
CN109814942B (zh) * 2018-12-19 2020-09-08 北京城市网邻信息技术有限公司 一种参数处理方法及装置
CN110691089B (zh) * 2019-09-29 2020-08-11 星环信息科技（上海）有限公司 一种应用于云服务的认证方法、计算机设备及存储介质
CN110881039B (zh) * 2019-11-27 2022-06-21 杭州安恒信息技术股份有限公司 一种云安全管理系统
CN111314491B (zh) * 2020-03-27 2022-07-08 北京尚医智信健康管理有限公司 跨租户数据交互方法、装置、服务器集群及介质
CN114513344A (zh) * 2022-01-26 2022-05-17 鼎捷软件股份有限公司 云应用间的集成系统及其方法
CN116127418B (zh) * 2023-04-14 2023-06-27 深圳竹云科技股份有限公司 容器应用授权方法、装置及计算机设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101729514A (zh) * 2008-10-23 2010-06-09 华为技术有限公司 一种业务调用的实现方法及装置和系统
US8336089B1 (en) * 2007-12-21 2012-12-18 Emc Corporation Method and apparatus for providing authentication and encryption services by a software as a service platform
CN105229987A (zh) * 2013-03-15 2016-01-06 微软技术许可有限责任公司 主动联合的移动认证
US20170048225A1 (en) * 2015-08-14 2017-02-16 Alibaba Group Holding Limited Method, Apparatus, and System for Secure Authentication

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8336089B1 (en) * 2007-12-21 2012-12-18 Emc Corporation Method and apparatus for providing authentication and encryption services by a software as a service platform
CN101729514A (zh) * 2008-10-23 2010-06-09 华为技术有限公司 一种业务调用的实现方法及装置和系统
CN105229987A (zh) * 2013-03-15 2016-01-06 微软技术许可有限责任公司 主动联合的移动认证
US20170048225A1 (en) * 2015-08-14 2017-02-16 Alibaba Group Holding Limited Method, Apparatus, and System for Secure Authentication

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2020223020A1 (en) * 2019-04-29 2020-11-05 Google Llc Systems and methods for distributed verification of online identity
EP3866390A1 (en) * 2019-04-29 2021-08-18 Google LLC Systems and methods for distributed verification of online identity
US11102004B2 (en) 2019-04-29 2021-08-24 Google Llc Systems and methods for distributed verification of online identity
EP4240039A3 (en) * 2019-04-29 2023-11-15 Google LLC Systems and methods for distributed verification of online identity

Also Published As

Publication number Publication date
CN108471395B (zh) 2019-12-17
CN108471395A (zh) 2018-08-31

Similar Documents

Publication Publication Date Title
WO2018153353A1 (zh) 实现认证/授权的方法、装置、云计算系统及计算机系统
JP7000442B2 (ja) ブロックチェーンクラウドサービスのためのインターフェイスを提供するためのシステムおよび方法
US10142326B2 (en) Attribute-based access control
US11075952B2 (en) Access control policy management in a computing environment
US9503447B2 (en) Secure communication between processes in cloud
US8924723B2 (en) Managing security for computer services
US20190294636A1 (en) Providing microservice information
EP3610623B1 (en) Protocol-level identity mapping
US10673835B2 (en) Implementing single sign-on in a transaction processing system
US10162952B2 (en) Security model for network information service
US20180006883A1 (en) Technologies for managing application configurations and associated credentials
US20230370265A1 (en) Method, Apparatus and Device for Constructing Token for Cloud Platform Resource Access Control
US9639691B2 (en) Dynamic database and API-accessible credentials data store
US10908971B1 (en) Method and system for generating a customizable connector
US10992680B2 (en) Authorization client management in a distributed computing environment
US20210132975A1 (en) Automated host attestation for secure run-time environments
CN112199079B (zh) 系统对接方法、计算设备和存储介质
US9948632B2 (en) Sharing data between sandboxed applications with certificates
US11606205B2 (en) Causal total order broadcast protocols using trusted execution environments
WO2021232860A1 (zh) 通信方法、装置及系统
CN106559454B (zh) 资源访问方法、装置及系统
US20240095338A1 (en) Isolated runtime environments for securing secrets used to access remote resources from compute instances
WO2024021785A1 (zh) 一种数字实体的处理方法、装置、设备、介质及程序产品
US20240007463A1 (en) Authenticating commands issued through a cloud platform to execute changes to inventory of virtual objects deployed in a software-defined data center
US20230269298A1 (en) Protecting api keys for accessing services

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18756957

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18756957

Country of ref document: EP

Kind code of ref document: A1