WO2020034700A1

WO2020034700A1 - Method and device for accounting, authenticating and accessing cloud

Info

Publication number: WO2020034700A1
Application number: PCT/CN2019/088169
Authority: WO
Inventors: 王楠楠; 黄国强; 罗斌
Original assignee: 华为技术有限公司
Priority date: 2018-08-15
Filing date: 2019-05-23
Publication date: 2020-02-20
Also published as: CN110839002A; CN110839002B

Abstract

Disclosed is an accounting, authenticating and accessing method, comprising: a first cloud obtains a first access request of a user, wherein the first access request comprises a target token, the target token is generated by performing endorsement on user information of the user by an endorsement body, the first cloud belongs to a cloud alliance, and the cloud alliance comprises a plurality of clouds; obtain an alliance token from an alliance blockchain, and match the target token with the alliance token to obtain the matching result, wherein the alliance blockchain can be accessed by any cloud in the cloud alliance; determine the user to be a valid user according to the matching result, and allow the user to access the first cloud. By means of the method, users of the cloud alliance can randomly access resources of any cloud in the cloud alliance.

Description

Cloud account opening, authentication and access method and equipment

Technical field

This application relates to cloud technology, and in particular, to a cloud account opening, authentication, and access method, device, and storage medium.

Background technique

With the rapid development of cloud technology, more and more clouds have appeared around the world. Different clouds may be operated by different enterprises. If users want to access the resources of these clouds, they must register an account on each cloud and log in to the corresponding cloud using the account in order to access the resources of the cloud corresponding to the account. In order to break the barrier between these clouds and realize the sharing of resources, people have proposed the idea of building a cloud alliance.

However, how to realize that users of the cloud alliance can freely access the resources of any cloud in the cloud alliance is an open problem.

Summary of the Invention

This application provides an access method, device, and storage medium, so that users of the cloud alliance can access resources of any cloud in the cloud alliance.

In a first aspect, a method for user access to the cloud is provided, including:

The first cloud obtains a user's first access request, wherein the first access request includes a target token generated by an endorsement subject endorsing the user information of the user, the first cloud Belongs to a cloud alliance, which includes multiple clouds;

Obtain an alliance token from an alliance blockchain, and match the target token with the alliance token to obtain a matching result, wherein the alliance blockchain can be used by any one of the cloud alliances Cloud access

The target user is determined as a legitimate user according to the matching result, and the target user is allowed to access the first cloud.

With reference to the first aspect, in a first possible implementation manner of the first aspect, the endorsement subject includes any cloud in a cloud alliance or a third-party notary agency.

With reference to any one of the foregoing aspects of the first aspect, in a second possible implementation manner of the first aspect, when the fourth cloud and the first cloud are the same cloud, the endorsement body includes the first One cloud; when the fourth cloud and the first cloud are not the same cloud, the endorsement body includes a fourth cloud and the first cloud.

With reference to any one of the foregoing aspects of the first aspect, in a third possible implementation manner of the first aspect, the method further includes: when the life cycle of the alliance token is greater than the expiration period, the first cloud Regenerate a new alliance token and upload the new alliance token to the alliance blockchain.

With reference to any one of the foregoing aspects of the first aspect, in a fourth possible implementation manner of the first aspect, the method further includes:

Receiving a second access request from a user, wherein the second access request includes a target token;

The first cloud sends a second access request of the user to the second cloud, wherein the second cloud belongs to the cloud alliance.

In a second aspect, a cloud user authentication method is provided, including:

The third cloud obtains a user authentication request, wherein the authentication request includes user information of the user, the third cloud belongs to a cloud alliance, and the cloud alliance includes multiple clouds;

Sending an endorsement request to the endorsement body according to the authentication request, and receiving an endorsement result returned by the endorsement body, wherein the endorsement request includes the user information, and the endorsement result is that the endorsement body performs the user information Endorsement of the results;

Generating a target token for the target user according to the endorsement result;

Upload the target token to the alliance blockchain as an alliance token, and the alliance blockchain can be accessed by any cloud in the cloud alliance.

With reference to the second aspect, in a second possible implementation manner of the second aspect, the endorsement subject includes any cloud in a cloud alliance or a third-party notary agency.

With reference to any one of the foregoing aspects of the second aspect, in a third possible implementation manner of the second aspect, the method further includes:

Determining an expiration period of the federation token, wherein the expiration period is used to invalidate the federation token when a life period of the federation token is greater than an expiration period.

With reference to any one of the foregoing aspects of the second aspect, in a fourth possible implementation manner of the second aspect, the user information includes one or more of an alliance account number, a password, and an alliance identifier.

In a third aspect, a method for opening an account for a cloud user is provided, including:

The fourth cloud receives a user's account opening request, wherein the account opening cloud belongs to a cloud alliance, and the cloud alliance includes multiple clouds;

Generating user information for the user according to the account opening request;

Sending an endorsement request to the endorsement subject and receiving the endorsement result returned by the endorsement subject, wherein the endorsement request includes the user information, and the endorsement result is a result obtained by the endorsement subject endorsing the user information;

The endorsement result is uploaded to the alliance blockchain according to the endorsement result, and the alliance blockchain can be accessed by any cloud in the cloud alliance.

With reference to the third aspect, in a first possible implementation manner of the third aspect, the endorsement subject includes any cloud in a cloud alliance or a third-party notary agency.

With reference to the foregoing one manner of the third aspect, in a second possible implementation manner of the third aspect, the user information includes one or more of an alliance account number, a password, and an alliance identifier.

In a fourth aspect, an access device is provided, including: an acquisition module, a matching module, and a determination module,

The obtaining module is configured to obtain a first access request of a user, wherein the first access request includes a target token, the target token is generated by an endorsement subject endorsing the user information of the user, the The first cloud belongs to a cloud alliance, and the cloud alliance includes multiple clouds;

The matching module is configured to obtain an alliance token from an alliance blockchain, and match the target token and the alliance token to obtain a matching result, wherein the alliance blockchain can be used by the cloud Access to any cloud in the alliance;

The determining module is configured to determine the target user as a legal user according to the matching result, and allow the target user to access the first cloud.

With reference to the fourth aspect, in a first possible implementation manner of the fourth aspect, the endorsement subject includes any cloud in a cloud alliance or a third-party notary agency.

With reference to any one of the foregoing aspects of the fourth aspect, in a second possible implementation manner of the fourth aspect, when the fourth cloud and the first cloud are the same cloud, the endorsement body includes the first One cloud; when the fourth cloud and the first cloud are not the same cloud, the endorsement body includes a fourth cloud and the first cloud.

With reference to any one of the foregoing aspects of the fourth aspect, in a third possible implementation manner of the fourth aspect, the method further includes: when the life cycle of the alliance token is greater than the expiration period, the first cloud Regenerate a new alliance token and upload the new alliance token to the alliance blockchain.

With reference to any one of the foregoing aspects of the fourth aspect, in a fourth possible implementation manner of the fourth aspect, the access device further includes a receiving module and a sending module,

The receiving module is further configured to receive a second access request from a user, wherein the second access request includes a target token;

The sending module is further configured to send a second access request of the user to the second cloud, where the second cloud belongs to the cloud alliance.

In a fifth aspect, an authentication device is provided, including: an acquisition module, a sending module, and a generating module

The obtaining module is configured to obtain an authentication request of a user, wherein the authentication request includes user information of the user, the third cloud belongs to a cloud alliance, and the cloud alliance includes multiple clouds;

The sending module is configured to send an endorsement request to the endorsement subject according to the authentication request, and receive an endorsement result returned by the endorsement subject, wherein the endorsement request includes the user information, and the endorsement result is the endorsement subject A result obtained by endorsing the user information;

The generating module is configured to generate a target token for the target user according to the endorsement result;

The sending module is further configured to upload the target token to an alliance blockchain as an alliance token, and the alliance blockchain can be accessed by any cloud in the cloud alliance.

With reference to the fifth aspect, in a second possible implementation manner of the fifth aspect, the endorsement subject includes any cloud in a cloud alliance or a third-party notary agency.

With reference to any one of the foregoing aspects of the fifth aspect, in a third possible implementation manner of the fifth aspect, the apparatus further includes a determining module,

The determining module is configured to determine an expiration period of the federation token, wherein the expiration period is used to invalidate the federation token when a life period of the federation token is greater than an expiration period.

With reference to any one of the foregoing aspects of the fifth aspect, in a fourth possible implementation manner of the fifth aspect, the user information includes one or more of an alliance account number, a password, and an alliance identifier.

According to a sixth aspect, an account opening device is provided, including: a receiving module, a generating module, and a sending module,

The receiving module is configured to receive a user account opening request, wherein the account opening cloud belongs to a cloud alliance, and the cloud alliance includes multiple clouds;

The generating module is configured to generate user information for the user according to the account opening request;

The sending module is configured to send an endorsement request to the endorsement subject and receive an endorsement result returned by the endorsement subject, wherein the endorsement request includes the user information, and the endorsement result is the endorsement subject's response to the user information Endorsement results;

The sending module is further configured to upload the endorsement result to the alliance blockchain according to the endorsement result, and the alliance blockchain can be accessed by any cloud in the cloud alliance.

With reference to the sixth aspect, in a first possible implementation manner of the sixth aspect, the endorsement subject includes any cloud in a cloud alliance or a third-party notary agency.

With reference to the foregoing one manner of the sixth aspect, in a second possible implementation manner of the sixth aspect, the user information includes one or more of an alliance account number, a password, and an alliance identifier.

According to a seventh aspect, a cloud system is provided, including: a plurality of computer devices, wherein the computer device includes a memory, a processor coupled to the memory, and a communication module, wherein the communication module is used for sending or receiving Externally sent data, the memory is used to store program code, and the processor is used to call the program code stored in the memory to perform the method as described in any one of the first aspects.

According to an eighth aspect, a cloud system is provided, including: a plurality of computer devices, wherein the computer device includes a memory, a processor coupled to the memory, and a communication module, wherein the communication module is used for sending or receiving Externally sent data, the memory is used to store program code, and the processor is used to call the program code stored in the memory to perform the method as described in any one of the second aspects.

In a ninth aspect, a cloud system is provided, including: a plurality of computer devices, wherein the computer device includes a memory, a processor coupled to the memory, and a communication module, wherein the communication module is configured to send or receive Externally sent data, the memory is used to store program code, and the processor is used to call the program code stored in the memory to perform the method as described in any one of the third aspects.

According to a tenth aspect, a computer non-transitory storage medium is provided, including instructions, which, when the instructions are run on a device, cause the device to perform the method according to any one of the first aspects.

According to an eleventh aspect, a computer non-transitory storage medium is provided, and includes instructions that, when the instructions run on a device, cause the device to perform the method according to any one of the second aspects.

According to a twelfth aspect, a computer non-transitory storage medium is provided, including instructions, which, when the instructions are run on a device, cause the device to perform the method according to any one of the third aspects.

In the above solution, when the user needs to access the first cloud, the first cloud receives the first access request sent by the user, where the first access request includes a target token. First Cloud obtains the alliance token from the alliance blockchain, matches the target token and the alliance token to obtain a matching result, determines the target user as a legitimate user according to the matching result, and allows the target The user accesses the first cloud. Since the target token is generated by endorsement of the user information of the user and has good credibility, as long as the access request sent by the client carries the target token, and the target token is verified If it is successfully passed, the identity of the user is determined to be valid, and the user is allowed to access. Therefore, as long as the target token is carried, users of the cloud alliance can freely access any cloud resource in the cloud alliance.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic structural diagram of a cloud alliance according to an embodiment of the present application; FIG.

2 is a schematic structural diagram of another cloud alliance according to an embodiment of the present application;

3 is a process interaction diagram of an account opening method provided by the present application;

FIG. 4 is a process interaction diagram of an authentication method provided by the present application; FIG.

FIG. 5 is a flow interaction diagram of an access method provided by the present application; FIG.

FIG. 6 is a flow interaction diagram of an access method provided by the present application; FIG.

7 is a schematic structural diagram of still another cloud alliance provided by the present application;

FIG. 8 is a schematic structural diagram of still another cloud alliance provided by the present application.

Specific embodiment

As shown in FIG. 1, the envisaged cloud alliance includes multiple clouds, and an alliance blockchain belonging to the cloud alliance is constructed on the cloud alliance, wherein the alliance blockchain can be used by any cloud in the cloud alliance. access. It can be understood that the scale of the cloud alliance can be set according to actual needs. For example, the cloud alliance can be an alliance formed between clouds of multiple enterprises, an alliance formed between clouds of multiple cities, or multiple countries. The alliance formed between the cloud, or even the global cloud, is not specifically limited here.

A cloud can include multiple cloud nodes (see the solid white dots in Figure 2). Specifically, the cloud includes at least one data center and network equipment connected to the data center. Each data center includes hardware layers, such as servers, storage arrays, network equipment, and so on; and software layers running on top of the hardware layer. Cloud service providers provide cloud-based software and hardware resources to provide users with rental or hosting services, including hardware services such as computing, storage, and networking, or software services such as artificial intelligence and databases.

The alliance blockchain includes at least one order service node (such as the solid black dots in Figure 2) and an accounting node (such as a dotted dot in Figure 2) that connects the order service nodes. . The ordering service node may be composed of nodes other than each cloud in the cloud alliance, and the accounting node may be formed by combining some cloud nodes in each cloud in the cloud alliance. The sorting service node is used to sort the information that needs to be stored in the alliance blockchain, package the sorted information into blocks, and then broadcast the packed block to all accounting nodes. The bookkeeping node is used to store the packed blocks. In addition, the sorting service node may designate some of the bookkeeping nodes as endorsement nodes (such as dots with diagonal lines in FIG. 2).

The cloud alliance can be established in the following way: Cloud 1 first creates a cloud alliance and formulates the smart contracts that the cloud alliance needs to follow. If other clouds (such as cloud 2) recognize the smart contract formulated by cloud 1, other clouds can join the cloud alliance. When Cloud 1 creates a cloud alliance, it can create an alliance blockchain on its own foundation. When other clouds join the blockchain, other clouds can create a sub-blockchain on their own foundation, and Connect with the original alliance blockchain to form a new alliance blockchain. The alliance blockchain is the private blockchain of the cloud alliance, that is, when any cloud uploads data to the blockchain, the uploaded data will be quickly synchronized to the entire alliance blockchain, and can be used by the cloud Other cloud downloads in the alliance. It should be understood that the foregoing construction method is only an example, and should not constitute a specific limitation.

Imagine that users of the Cloud Alliance can access any cloud resource in the Cloud Alliance at will. Specifically, users can open an alliance account on any cloud in the cloud alliance. After the alliance account is opened, the user can use the alliance account to log in and perform identity verification on any cloud in the cloud alliance. After the verification is completed, the user can access any cloud in the cloud alliance through the alliance account. The following describes two specific application scenarios by way of examples:

In the first scenario, the user opens an alliance account on A cloud in the cloud alliance. Then, the user can log in and authenticate with the alliance account on the B cloud in the cloud alliance. After the verification is completed, the user can access the resources of the B cloud in the cloud alliance through the alliance account. Users can also log in and authenticate with an alliance account on C Cloud in the Cloud Alliance. After the verification is completed, the user can access the resources of C Cloud in the cloud alliance through the alliance account. By analogy, users can access every cloud (including A cloud) in the cloud alliance in the same way.

In the second scenario, the user opens an alliance account on A cloud in the cloud alliance. Then, the user can log in and authenticate with the alliance account on the B cloud in the cloud alliance. After the verification is completed, the user can access the B cloud, and can access each cloud (including A cloud) in the cloud alliance through the B cloud.

Among them, the cloud that the user directly accesses can be called the first cloud, the cloud that the user accesses through the first cloud can be called the second cloud, the cloud that the user authenticates can be called the third cloud, and the cloud that the user opens an alliance account with It can be called the fourth cloud. It should be understood that the first cloud, the third cloud, and the fourth cloud may be the same cloud; the third cloud and the fourth cloud may be the same cloud, and the first cloud may not be the same cloud; the fourth cloud and The first cloud may be the same cloud, the third cloud may not be the same cloud; the first cloud and the fourth cloud may be the same cloud, and the third cloud may not be the same cloud; the first cloud, the third cloud The cloud and the fourth cloud may not be the same cloud, which is not specifically limited here.

In order to enable users to freely access the resources of any cloud in the cloud alliance, the user can carry the target token to access any cloud in the cloud alliance. When a user carries a target token to access any cloud in the cloud alliance, the accessed cloud (first cloud) verifies the target token. In the case where the first cloud passes the verification of the target token, the user can be determined to be a legitimate user and allowed to access.

The reason why a user can visit any cloud in the cloud alliance with a target token is that the target token is a token generated by the endorsement body of the cloud alliance to endorse the user's user information according to the endorsement policy. Because the target token can prove that the endorsement subject has endorsed the user information of the target user, that is, the target token can prove that the endorsement subject guarantees the credibility of the target user, so long as the target token is verified, It can be determined that the target user is a legitimate user. The user information includes one or more of an alliance account, a password, and an alliance identifier. The endorsement subject may include any cloud in the cloud alliance or a third-party notary. More specifically, in the case where the endorsement subject includes one of the clouds in the cloud alliance, the endorsement subject includes the endorsement node of the cloud. The third-party notarization agency may be a recognized agency of the cloud alliance, such as credit card verification agencies and other credit agencies. The endorsement policy can be set according to actual needs. For example, when the fourth cloud and the first cloud are the same cloud, the endorsement body includes the first cloud; in the fourth cloud and the first cloud, When the first cloud is not the same cloud, the endorsement body includes a fourth cloud and the first cloud, which is not specifically limited herein. It should be understood that the above examples of user information, endorsement body, and endorsement strategy are merely examples, and should not constitute specific limitations.

The process for the first cloud to verify the target token may be: the first cloud obtains a first access request from the target user, and obtains an index and a target token from the first access request. The first cloud sends the index to the alliance blockchain. Accordingly, the alliance blockchain receives the index sent by the first cloud. The alliance blockchain looks up the alliance token according to the index. The alliance blockchain sends the alliance token to First Cloud. Accordingly, First Cloud receives the alliance token sent by the alliance blockchain. The first cloud matches the target token and the alliance token to obtain a matching result. When the matching result is a successful match, the first cloud determines that the target user is a legitimate user, and allows the target user to access the first cloud.

The process of generating a target token may be: a third cloud acquires an authentication request from a user, wherein the authentication request includes user information of the user. Then, the third cloud sends an endorsement request to the endorsement subject according to the authentication request. The endorsement request includes the user information. Accordingly, the endorsement subject receives the endorsement request sent by the third cloud. The endorsement subject endorses the user information according to the endorsement policy to obtain the endorsement result. The endorsement body sends the endorsement result to the third cloud. Accordingly, the third cloud receives the endorsement result returned by the endorsement body. When the endorsement is successful, the third cloud generates a target token for the user. The third cloud uploads the target token to the alliance blockchain as an alliance token. Accordingly, the alliance blockchain receives the target token sent by the third cloud, and stores the target token as the alliance token. The alliance blockchain sends the index of the alliance token to the third cloud. Accordingly, the third cloud receives the index sent by the alliance blockchain. The third cloud sends the target token to the user's client. Accordingly, the user end of the user receives the target token sent by the third cloud. It is not difficult to understand that, because the alliance blockchain has the characteristics of distributed storage and decentralized storage, the alliance tokens stored in the alliance blockchain cannot be tampered with high reliability.

The process of generating user information may be: the account opening cloud receives an account opening request from a target user, where the account opening request may include necessary information for opening an account, for example, one or more of a passport number, an ID number, a name, and the like. Then, the account opening cloud generates user information for the target user according to the account opening request. Account opening cloud sends an endorsement request to the endorsement subject and receives the endorsement result returned by the endorsement subject, wherein the endorsement request includes the user information, and the endorsement result is obtained by the endorsement subject endorsing the user information result. When the endorsement result is that the endorsement is successful, the account opening cloud uploads the user information to the alliance blockchain. Similarly, since the alliance blockchain has the characteristics of distributed storage and decentralized storage, user information stored in the alliance blockchain has extremely high reliability.

For the two different application scenarios mentioned above, users can carry a target token to access any cloud in the cloud alliance. This can be achieved in the following ways:

For the first application scenario, the user opens an alliance account on A cloud in the cloud alliance. Then, the user can use the federation account to log in and authenticate on the B cloud in the cloud alliance to generate a target token. After the verification is completed, the user can carry the target token to access the resources of B cloud in the cloud alliance. Users can also use the federation account to log in and authenticate on the C cloud in the cloud alliance to generate target tokens. After the verification is completed, the user can access the resources of C Cloud in the Cloud Alliance by carrying the target token. By analogy, users can access every cloud (including A cloud) in the cloud alliance in the same way.

For the second application scenario, the user opens an alliance account on A cloud in the cloud alliance. Then, the user can use the federation account to log in and authenticate on the B cloud in the cloud alliance to generate a target token. After the verification is completed, the user can carry the target token to access the B cloud, and can carry the target token to access each cloud (including the A cloud) in the cloud alliance.

The present invention will be further described below with reference to FIGS. 3 to 6 and specific embodiments.

As shown in FIG. 3, FIG. 3 is a process interaction diagram of an account opening method provided by the present application. The account opening method in this embodiment includes:

S101: The fourth cloud receives a user's account opening request.

In a specific embodiment of the present application, the account opening request includes one or more of identity information, the account opening information, a passport number, an ID number, a name, and the like.

S102: The fourth household cloud verifies the identity information.

In a specific embodiment of the present application, the identity information may be submitted to a third-party verification agency for verification by the fourth cloud. The third-party verification agency may be an organization with good credibility, for example, the household administration bureau, public security agency, or banking institution, etc., which is not specifically limited here.

S103: In a case where the identity information verification is successful, the fourth cloud generates user information for the user.

In a specific embodiment of the present application, the user information includes one or more of an affiliate account, a password, and an affiliate ID. The affiliate account can be a user's common account in the cloud alliance, that is, the user can log in to the affiliate account on any cloud in the cloud alliance. The password is the verification information entered by the target user when logging in to the federated account. The federation identity is the identity of the cloud federation.

S104: The fourth cloud sends the endorsement request to the endorsement subject. Accordingly, the endorsement subject receives the endorsement request sent by the fourth cloud.

In a specific embodiment of the present application, the endorsement request may be sent in the form of an account opening proposal. Specifically, the account opening cloud uploads the account opening proposal to the alliance blockchain. After receiving the account opening proposal, the alliance blockchain synchronizes the account opening proposal within the entire alliance blockchain. After the endorsement node receives the account opening proposal, it endorses the account opening proposal.

S105: The endorsement subject endorses the user information according to the endorsement policy to obtain the endorsement result.

S106: The endorsement body sends the endorsement result to the fourth cloud. Accordingly, the fourth cloud receives the endorsement result sent by the endorsement body.

S107: When the endorsement result is successful, the fourth cloud uploads the endorsement result to the alliance blockchain.

S108: The fourth cloud sends user information to the user end of the user. Accordingly, the user end of the user receives the user information returned by the fourth cloud.

As shown in FIG. 4, FIG. 4 is a process interaction diagram of an authentication method provided by the present application. The authentication method in this embodiment includes:

S201: The third cloud obtains an authentication request from a user.

In a specific embodiment of the present application, the authentication request includes user information of the user, and the user information includes one or more of an alliance account, a password, and an alliance identifier.

S202: The third cloud verifies the identity of the user according to the alliance account and password. The identity information may be verified by a third cloud or a third-party verification agency.

S203: In the case of successful verification, the third cloud generates an endorsement request according to the authentication request, wherein the endorsement request includes user information.

S204: The third cloud submits an endorsement request to the endorsement subject. Accordingly, the endorsement subject receives the endorsement request submitted by the authentication cloud.

In a specific embodiment of the present application, the endorsement request may be sent in the form of an authentication proposal. Specifically, the fourth cloud uploads the authentication proposal to the alliance blockchain. After the alliance blockchain receives the authentication proposal, it synchronizes the authentication proposal within the entire alliance blockchain. After the endorsement node receives the authentication proposal, it endorses the authentication proposal.

S205: The endorsement subject endorses the user information according to the endorsement policy to obtain the endorsement result.

S206: The endorsement body sends the endorsement result to the third cloud. Accordingly, the third cloud receives the endorsement result sent by the endorsement body.

S207: When the endorsement result is that the endorsement is successful, the third cloud generates a target token, and uses the target token as an alliance token.

S208: The third cloud uploads the alliance token to the alliance blockchain. Accordingly, the alliance blockchain receives the alliance token sent by the third cloud.

S209: The third cloud sends the target token to the user end of the user. Accordingly, the user end of the user receives the target token sent by the third cloud.

As shown in FIG. 5, FIG. 5 is a flow interaction diagram of an access method provided by the present application. The access method in this embodiment includes:

S301: The first cloud receives a first access request from a target user, wherein the first access request includes an index and a target token, and the target token is an order generated by the endorsement subject to endorsement of the user information of the user brand.

S302: First Cloud sends an index to the alliance blockchain. Accordingly, the alliance blockchain receives the index sent by the first cloud.

S303: The alliance blockchain searches for the alliance token corresponding to the index according to the index.

In a specific embodiment of the present application, the alliance token in the alliance blockchain has an expiration period. Among them, the alliance token is valid when the life cycle of the alliance token is less than the expiration period; when the life cycle of the alliance token is greater than or equal to the expiration period, the alliance token will become invalid. The expiry period of the alliance token can ensure that the alliance token will not lose its effect because it exists for too long, which improves the reliability of the alliance token.

S304: The alliance blockchain sends an alliance token to the first cloud. Accordingly, the first cloud receives the alliance token sent by the alliance blockchain.

S305: The first cloud matches the target token and the alliance token to obtain a matching result.

S306: When the matching result is a successful match, the first cloud determines that the user is a legitimate user, and allows the user to access the first cloud.

S307: When the matching result is a matching failure and the failure reason is a token invalidation, First Cloud regenerates a new alliance token.

S308: First Cloud uploads the alliance token to the alliance blockchain. Accordingly, the alliance blockchain receives the alliance token sent by the first cloud.

As shown in FIG. 6, FIG. 6 is a flow interaction diagram of an access method provided by the present application. The access method in this embodiment includes:

S401: The first cloud sends a second access request of the user to the second cloud, where the first access request includes an index and a target token.

S402: The second access cloud sends an index to the alliance blockchain. Accordingly, the alliance blockchain receives the index sent by the second cloud.

S403: The alliance blockchain searches for the alliance token corresponding to the index according to the index.

S404: The alliance blockchain sends an alliance token to the second cloud. Accordingly, the second cloud receives the alliance token sent by the alliance blockchain.

S405: The second cloud matches the target token and the alliance token to obtain a matching result.

S406: When the matching result is a successful match, the second cloud determines that the user is a legitimate user, and allows the user to access the second cloud.

S407: When the matching result is that the matching fails and the failure reason is that the token is invalid, the second cloud regenerates a new alliance token.

408: The second cloud uploads the alliance token to the alliance blockchain. Accordingly, the alliance blockchain receives the alliance token sent by the second cloud.

Referring to FIG. 7, FIG. 7 is a schematic structural diagram of still another cloud alliance provided by the present application. The cloud alliance of the present application includes the first cloud, the third cloud, and the fourth cloud. Among them, the cloud alliance blockchain is built on the first cloud, the third cloud, and the fourth cloud. The first cloud, the third cloud, and the fourth cloud may be completely different clouds, some of the same clouds, or completely the same clouds, which are not specifically limited herein.

As shown in FIG. 7, the first cloud may include multiple cloud nodes, and each cloud node includes a receiving module 101, a generating module 102, and a sending module 130.

The receiving module 101 is configured to receive a user account opening request, wherein the account opening cloud belongs to a cloud alliance, and the cloud alliance includes multiple clouds;

The generating module 102 is configured to generate user information for the user according to the account opening request;

The sending module 103 is configured to send an endorsement request to the endorsement subject and receive an endorsement result returned by the endorsement subject, wherein the endorsement request includes the user information, and the endorsement result is the endorsement subject to the user Endorsement of information;

The sending module 103 is further configured to upload the endorsement result to the alliance blockchain according to the endorsement result, and the alliance blockchain can be accessed by any cloud in the cloud alliance.

As shown in FIG. 7, the third cloud may include multiple cloud nodes, and each cloud node includes an obtaining module 201, a sending module 202, and a generating module 203.

The obtaining module 201 is configured to obtain an authentication request of a user, wherein the authentication request includes user information of the user, the third cloud belongs to a cloud alliance, and the cloud alliance includes multiple clouds;

The sending module 202 is configured to send an endorsement request to the endorsement subject according to the authentication request, and receive an endorsement result returned by the endorsement subject, wherein the endorsement request includes the user information, and the endorsement result is the endorsement. A result obtained by the subject endorsing the user information;

The generating module 203 is configured to generate a target token for the target user according to the endorsement result;

The sending module 203 is further configured to upload the target token to an alliance blockchain as an alliance token, and the alliance blockchain can be accessed by any cloud in the cloud alliance.

As shown in FIG. 7, the fourth cloud may include multiple cloud nodes, and each cloud node includes an obtaining module 301, a matching module 302, and a determining module 303.

The obtaining module 301 is configured to obtain a first access request of a user, wherein the first access request includes a target token, and the target token is generated by an endorsement subject endorsing the user information of the user. Said first cloud belongs to a cloud alliance, and the cloud alliance includes multiple clouds;

The matching module 302 is configured to obtain an alliance token from an alliance blockchain, and match the target token and the alliance token to obtain a matching result, wherein the alliance blockchain can be used by the Access to any cloud in the cloud alliance;

The determining module 303 is configured to determine that the target user is a legal user according to the matching result, and allow the target user to access the first cloud.

In the above embodiments, the first cloud, the third cloud, and the fourth cloud are not described in detail. For details, refer to FIGS. 2 to 6 and related statements, and details are not described herein again.

Referring to FIG. 8, FIG. 8 is a schematic structural diagram of still another cloud alliance provided by the present application. The cloud alliance of the present application includes a first cloud system, a third cloud system, and a fourth cloud system. Among them, the first cloud system, the third cloud system, and the fourth cloud system build a cloud alliance blockchain. The first cloud system, the third cloud system, and the fourth cloud system may be different cloud systems, some of the same cloud systems, or completely the same cloud systems, which are not specifically limited herein. The first cloud system, the third cloud system, and the fourth cloud system may belong to different companies, or may belong to clouds operated by different countries operated by the same company.

As shown in FIG. 8, the first cloud system of the present application includes a plurality of computing devices, and each computing device includes one or more processors 401, a communication interface 402, and a memory 403. The processor 401, the communication interface 402, and the memory 403 may be connected through a bus 404.

The processor 401 includes one or more general-purpose processors. The general-purpose processor may be any type of device capable of processing electronic instructions, including a central processing unit (CPU), a microprocessor, a microcontroller, and a main processor. Processors, controllers, and application-specific integrated circuits (ASICs). The processor 401 executes various types of digital storage instructions, such as software or firmware programs stored in the memory 403, which enables a computing device to provide a wide variety of services. For example, the processor 401 can execute programs or process data to perform part or all of the methods described herein.

The communication interface 402 may be a wired interface (such as an Ethernet interface) or a wireless interface (such as a cellular network interface or using a wireless local area network interface) for communicating with other computing devices or users.

The memory 403 may include an internal memory and an external memory. The internal memory may include one or more of at least one of the following: volatile memory (such as dynamic random access memory (DRAM), static RAM (SRAM), synchronous dynamic RAM (SDRAM)), and non-volatile memory (Such as one-time programmable read-only memory (OTPROM), programmable ROM (PROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), mask ROM, NAND (NAND) Flash memory, or non-NOR flash memory, etc.). The internal memory may be in the form of a solid state drive (SSD). The external memory may also include a flash drive, such as high-density flash memory, secure digital, micro SD, mini SD, extreme data (xD), memory stick, and the like. The external storage may use centralized storage or distributed storage, which is not specifically limited here.

The processor 401 can perform the following steps by reading the program in the memory 403:

Receiving a user's account opening request through the communication interface 402, wherein the fourth cloud belongs to a cloud alliance, and the cloud alliance includes multiple clouds;

Generating user information for the user by the processor 401 according to the account opening request;

Send an endorsement request to the endorsement subject through the communication interface 402 and receive the endorsement result returned by the endorsement subject, wherein the endorsement request includes the user information, and the endorsement result is that the endorsement subject endorses the user information The results obtained;

The endorsement result is uploaded to the alliance blockchain through the communication interface 402 according to the endorsement result, and the alliance blockchain can be accessed by any cloud in the cloud alliance.

Optionally, the endorsement body includes any cloud or a third party notary in the cloud alliance.

Optionally, the user information includes one or more of an alliance account, a password, and an alliance identifier.

As shown in FIG. 8, the structure of the third cloud system of the present application is similar to that of the first cloud system, and includes multiple computing devices. Each computing device includes one or more processors 501, a communication interface 502, and a memory 503. The processor 501, the communication interface 502, and the memory 503 may be connected through a bus 504.

The processor 501 can perform the following steps by reading the program in the memory 503:

Obtaining a user's authentication request through the communication interface 502, wherein the authentication request includes user information of the user, the third cloud belongs to a cloud alliance, and the cloud alliance includes multiple clouds;

Send an endorsement request to the endorsement subject according to the authentication request through the communication interface 502, and receive the endorsement result returned by the endorsement subject, wherein the endorsement request includes the user information, and the endorsement result is The endorsement of the user information;

Generating a target token for the target user by the processor 501 according to the endorsement result;

The target token is uploaded to the alliance blockchain through the communication interface 502 as an alliance token, and the alliance blockchain can be accessed by any cloud in the cloud alliance.

Optionally, the expiration period of the federation token is determined by the processor 501, wherein the expiration period is used to invalidate the federation token when the life period of the federation token is greater than the expiration period.

As shown in FIG. 8, the structure of the third cloud system of the present application is similar to that of the first cloud system, and includes multiple computing devices. Each computing device includes one or more processors 601, a communication interface 602, and a memory 603. The processor 601, the communication interface 602, and the memory 603 may be connected through a bus 604.

The processor 601 can execute the following steps by reading the program in the memory 603:

A first access request of a user is obtained through the communication interface 602, wherein the first access request includes a target token generated by an endorsement subject endorsing the user information of the user, the first access request The cloud belongs to a cloud alliance, and the cloud alliance includes multiple clouds;

The alliance token is obtained from the alliance blockchain through the communication interface 602, and the target token and the alliance token are matched to obtain a matching result, wherein the alliance blockchain can be used in the cloud alliance Access to any cloud of

The processor 601 determines that the target user is a legal user according to the matching result, and allows the target user to access the first cloud.

Optionally, if the life cycle of the alliance token is greater than the expiration period, the processor 601 regenerates a new alliance token and uploads the new alliance token to the alliance blockchain.

Optionally, the second access request of the user is received through the communication interface 602, wherein the second access request includes a target token; and the second access request of the user is sent to the second cloud through the communication interface 602, where , The second cloud belongs to the cloud alliance.

In the several embodiments provided in this application, it should be understood that the disclosed system, terminal, and method may be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner. For example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may also be electrical, mechanical or other forms of connection.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, may be located in one place, or may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments of the present invention.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist separately physically, or two or more units may be integrated into one unit. The above integrated unit may be implemented in the form of hardware or in the form of software functional unit.

When the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially a part that contributes to the existing technology, or all or part of the technical solution may be embodied in the form of a software product, which is stored in a storage medium Included are several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in the embodiments of the present invention. The foregoing storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disks or optical disks and other media that can store program codes .

The above are only specific embodiments of the present invention, but the scope of protection of the present invention is not limited to this. Any person skilled in the art can easily think of various equivalents within the technical scope disclosed by the present invention. Modifications or replacements should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

A method for accessing the cloud, comprising:

The first cloud obtains a user's first access request, wherein the first access request includes a target token generated by an endorsement subject endorsing the user information of the user, the first cloud Belongs to a cloud alliance, which includes multiple clouds;

Obtain an alliance token from an alliance blockchain, and match the target token with the alliance token to obtain a matching result, wherein the alliance blockchain can be used by any one of the cloud alliances Cloud access

The target user is determined as a legitimate user according to the matching result, and the target user is allowed to access the first cloud.
The method according to claim 1, wherein the endorsement subject includes any cloud in a cloud alliance or a third-party notary.
The method according to claim 1 or 2, further comprising:

In the case where the life cycle of the alliance token is greater than the expiration period, the first cloud regenerates a new alliance token and uploads the new alliance token to the alliance blockchain.
The method according to any one of claims 1 to 3, wherein the method further comprises:

Receiving a second access request from a user, wherein the second access request includes a target token;

Sending a second access request of the user to the second cloud, wherein the second cloud belongs to the cloud alliance.
A cloud user authentication method includes:

The third cloud obtains a user authentication request, wherein the authentication request includes user information of the user, the third cloud belongs to a cloud alliance, and the cloud alliance includes multiple clouds;

Sending an endorsement request to the endorsement body according to the authentication request, and receiving an endorsement result returned by the endorsement body, wherein the endorsement request includes the user information, and the endorsement result is that the endorsement body performs the user information Endorsement of the results;

Generating a target token for the target user according to the endorsement result;

Upload the target token to the alliance blockchain as an alliance token, and the alliance blockchain can be accessed by any cloud in the cloud alliance.
The method according to claim 5, wherein the endorsement subject includes any cloud in a cloud alliance or a third-party notary agency.
The method according to claim 5 or 6, further comprising:

Determining an expiration period of the federation token, wherein the expiration period is used to invalidate the federation token when a life period of the federation token is greater than an expiration period.
The method according to any one of claims 5-7, wherein the user information includes one or more of an affiliate account number, a password, and an affiliate ID.
A method for opening a cloud user account, comprising:

A fourth cloud receives a user's account opening request, wherein the fourth cloud belongs to a cloud alliance, and the cloud alliance includes multiple clouds;

Generating user information for the user according to the account opening request;

Sending an endorsement request to the endorsement subject and receiving an endorsement result returned by the endorsement subject, wherein the endorsement request includes the user information, and the endorsement result is a result of the endorsement subject endorsing the user information;

The endorsement result is uploaded to the alliance blockchain according to the endorsement result, and the alliance blockchain can be accessed by any cloud in the cloud alliance.
The method according to claim 9, wherein the endorsement subject includes any cloud in a cloud alliance or a third party notary.
The method according to claim 9 or 10, wherein the user information comprises one or more of an affiliate account number, a password, and an affiliate ID.
A cloud system, comprising: a plurality of computer devices, wherein each of the plurality of computer devices includes a memory, and a processor and a communication module coupled to the memory, wherein: the communication A module is used to send or receive data sent externally, the memory is used to store program code, and the processor is used to call the program code stored in the memory to perform the method described in any one of claims 1-4.
A cloud system, comprising: a plurality of computer devices, wherein each of the plurality of computer devices includes a memory, and a processor and a communication module coupled to the memory, wherein: the communication A module is used to send or receive data sent externally, the memory is used to store program code, and the processor is used to call the program code stored in the memory to perform the method described in any one of claims 5-8.
A cloud system, comprising: a plurality of computer devices, wherein each of the plurality of computer devices includes a memory, and a processor and a communication module coupled to the memory, wherein: the communication A module is used to send or receive data sent externally, the memory is used to store program code, and the processor is used to call the program code stored in the memory to perform the method described in any one of claims 9-11.
A computer non-transitory storage medium, comprising instructions, which, when the instructions are run on a computer, cause the computer to execute the method according to any one of claims 1-4.
A computer non-transitory storage medium, comprising instructions, which, when the instructions are run on a computer, cause the computer to execute the method according to any one of claims 5-8.
A computer non-transitory storage medium, comprising instructions, which, when the instructions are run on a computer, cause the computer to execute the method according to any one of claims 9-11.