WO2022095958A1 - 资源管理方法、装置、计算机系统、可读存储介质 - Google Patents

资源管理方法、装置、计算机系统、可读存储介质 Download PDF

Info

Publication number
WO2022095958A1
WO2022095958A1 PCT/CN2021/128968 CN2021128968W WO2022095958A1 WO 2022095958 A1 WO2022095958 A1 WO 2022095958A1 CN 2021128968 W CN2021128968 W CN 2021128968W WO 2022095958 A1 WO2022095958 A1 WO 2022095958A1
Authority
WO
WIPO (PCT)
Prior art keywords
cloud platform
account
resource pool
user
access
Prior art date
Application number
PCT/CN2021/128968
Other languages
English (en)
French (fr)
Inventor
左凯
Original Assignee
北京京东尚科信息技术有限公司
北京京东世纪贸易有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京京东尚科信息技术有限公司, 北京京东世纪贸易有限公司 filed Critical 北京京东尚科信息技术有限公司
Priority to US18/250,490 priority Critical patent/US20240015113A1/en
Priority to EP21888650.5A priority patent/EP4243382A4/en
Priority to KR1020237015062A priority patent/KR20230082652A/ko
Priority to JP2023524643A priority patent/JP7546164B2/ja
Publication of WO2022095958A1 publication Critical patent/WO2022095958A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/70—Admission control; Resource allocation
    • H04L47/80—Actions related to the user profile or the type of traffic
    • H04L47/808—User-type aware
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/70—Admission control; Resource allocation
    • H04L47/78—Architectures of resource allocation
    • H04L47/783—Distributed allocation of resources, e.g. bandwidth brokers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/105—Multiple levels of security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/2866—Architectures; Arrangements
    • H04L67/30—Profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services

Definitions

  • the present disclosure relates to the field of Internet technologies, and more particularly, to a resource management method, apparatus, computer system, and readable storage medium.
  • the present disclosure provides a resource management method, device, computer system, and readable storage medium that reduce the cost of independently constructing a computer room and a basic platform under a private cloud solution.
  • One aspect of the present disclosure provides a resource management method, comprising:
  • resources in the resource pool corresponding to the shadow account are accessed based on a preset access policy.
  • the private cloud platform is provided on a public cloud platform, and the private cloud platform shares the front-end components of the public cloud platform.
  • the method when the user accesses the proprietary cloud platform, before accessing the resources in the resource pool corresponding to the shadow account based on a preset access policy, the method includes:
  • the login state is not the proprietary cloud platform login state
  • a corresponding access policy is set for the login account, and the login state is switched to the proprietary cloud platform login state.
  • the login state is the login state of the proprietary cloud platform, access the proprietary cloud platform.
  • the determining the resource pool corresponding to the shadow account includes:
  • the setting of the corresponding access policy for the login account includes:
  • the user has at least one administrator account, and/or, at least one non-administrator account;
  • the administrator account has the authority to access all resources in the resource pool corresponding to the shadow account;
  • the administrator account has the authority to grant roles to the non-administrator account.
  • accessing the resources in the resource pool corresponding to the shadow account based on a preset access policy includes:
  • the non-administrator account is controlled to access the resources in the resource pool corresponding to the shadow account.
  • Another aspect of the present disclosure provides a resource management apparatus, including:
  • an establishment module for establishing a shadow account for the user on the proprietary cloud platform in response to the user's operation of entering the proprietary cloud platform
  • a determining module configured to determine the resource pool corresponding to the shadow account
  • An access module configured to access resources in the resource pool corresponding to the shadow account based on a preset access policy when the user accesses the proprietary cloud platform.
  • Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, which when executed, are used to implement the method as described above.
  • Another aspect of the present disclosure provides a computer program comprising computer-executable instructions, which when executed, are used to implement the method as described above.
  • the technical means of shadow account is adopted on the proprietary cloud platform, the usage of resources under the shadow account by the login account can be controlled on the proprietary cloud platform, thereby reducing the number of resources under the private cloud solution.
  • FIG. 1 schematically shows an exemplary system architecture 100 for a resource management method according to an embodiment of the present disclosure
  • FIG. 2 schematically shows a flowchart of a resource management method according to an embodiment of the present disclosure
  • FIG. 3 schematically shows a flow chart of a login state switching method according to an embodiment of the present disclosure
  • Fig. 4a schematically shows a flowchart of determining a resource pool according to an embodiment of the present disclosure
  • Fig. 4b schematically shows a schematic diagram of account access according to an embodiment of the present disclosure
  • FIG. 5 schematically shows a flow chart of accessing resources according to an embodiment of the present disclosure
  • FIG. 6 schematically shows a block diagram of a resource management apparatus 600 according to an embodiment of the present disclosure.
  • FIG. 7 schematically shows a block diagram of a computer system 700 suitable for implementing the resource management method according to an embodiment of the present disclosure.
  • At least one of the “systems” shall include, but not be limited to, systems with A alone, B alone, C alone, A and B, A and C, B and C, and/or A, B, C, etc. ).
  • Embodiments of the present disclosure provide a resource management method.
  • the method includes that after the user settles on the proprietary cloud platform, the proprietary cloud platform creates shadow accounts and roles for the users, determines a resource pool corresponding to the shadow accounts, and grants corresponding permissions to the roles.
  • the Proprietary Cloud platform controls the user's access to the resources in the resource pool corresponding to the shadow account based on the user's current role and the permissions corresponding to the role.
  • FIG. 1 schematically illustrates an exemplary system architecture 100 for a resource management method according to an embodiment of the present disclosure.
  • FIG. 1 is only an example of a system architecture to which the embodiments of the present disclosure can be applied, so as to help those skilled in the art to understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used for other A device, system, environment or scene.
  • the system architecture 100 may include terminal devices 101 , 102 , and 103 , a network 104 and a server 105 .
  • the network 104 is a medium used to provide a communication link between the terminal devices 101 , 102 , 103 and the server 105 .
  • the network 104 may include various connection types, such as wired and/or wireless communication links, and the like.
  • the user can use the terminal devices 101, 102, 103 to interact with the server 105 through the network 104 to obtain information services of different degrees and types.
  • the terminal devices 101, 102, 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.
  • the server 105 is a server of a public cloud platform, and the public cloud platform can be a storage-type cloud platform that mainly focuses on data storage, a computing-type cloud platform that focuses on data processing, or a comprehensive cloud computing that takes both computing and data storage and processing into consideration. platform.
  • the resource management method provided by the embodiment of the present disclosure may generally be executed by the server 105 .
  • the resource management apparatus provided by the embodiments of the present disclosure may generally be provided in the server 105 .
  • the resource management method provided by the embodiment of the present disclosure may also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101 , 102 , 103 and/or the server 105 .
  • the resource management apparatus provided by the embodiments of the present disclosure may also be provided in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101 , 102 , 103 and/or the server 105 .
  • terminal devices, networks and cloud platforms in FIG. 1 are only illustrative. According to implementation needs, there can be any number of terminal devices, networks and cloud platforms.
  • FIG. 2 schematically shows a flowchart of a resource management method according to an embodiment of the present disclosure.
  • the method includes operations S201-S203.
  • a resource pool corresponding to the shadow account is determined.
  • a shadow account refers to an account with the same authority as an administrator account.
  • the proprietary cloud platform exists on the public cloud platform and shares the front-end components of the public cloud platform to provide users with cloud computing products and data services. Users refer to merchants, software developers, and so on. Understandably, there may also be other proprietary cloud platforms on the public cloud platform to provide exclusive services for different users according to user needs.
  • the ApsaraDB for userA will create a shadow account with administrator privileges on the ApsaraDB for userA, allocate a resource pool to the shadow account, and obtain the user userA
  • the corresponding access policy on the proprietary cloud platform enables user userA to access resources in the resource pool corresponding to the shadow account based on the access policy.
  • a shadow account is established for the user, and a resource pool corresponding to the shadow account is determined.
  • the resource in the resource pool corresponding to the shadow account is accessed based on the preset access policy.
  • Resource isolation and resource authority control can be achieved by setting shadow accounts, thereby reducing the cost of independently building computer rooms and basic platforms under the private cloud solution.
  • the private cloud platform is set on a public cloud platform, and the private cloud platform shares the front-end components of the public cloud platform.
  • the private cloud platform can be upgraded with the public cloud platform.
  • FIG. 3 schematically shows a flow chart of a login state switching method according to an embodiment of the present disclosure.
  • operation S303 is performed, a corresponding access policy is set for the login account, and the login state is switched to the proprietary cloud platform login state.
  • operation S304 is performed to access the proprietary cloud platform.
  • the login state means that after a user logs in with an account number and password, an encrypted token is generally generated and stored on the client side. Each interaction between the client side and the server side will bring the token, so that the server side can obtain user-related information. , without the need to bring the user's account and password every time, the token is the user's login state.
  • a user can log in to the proprietary cloud platform and the public cloud platform with a set of account passwords, but the login status of the user when logging in to the proprietary cloud platform and the public cloud platform is different.
  • the login state of the user logging in to the proprietary cloud platform is the login state of the proprietary cloud platform.
  • the access policy is an access policy that the user needs to adopt when accessing the proprietary cloud platform.
  • the proprietary cloud platform will redirect the login page, and deliver the login status of the proprietary cloud platform to the current login account.
  • the single sign-on system SSO, SingleSignOn
  • the proprietary cloud platform login state can be used to issue the proprietary cloud platform login state to the current login account, so that the user can not need to re-enter the account and Password to log in to the proprietary cloud platform.
  • setting a corresponding access policy for the login account in operation S303 includes: creating a role for the user on the proprietary cloud platform according to the service domain where the user resides; granting each The access rights of the role to the resources in the resource pool corresponding to the shadow account.
  • the user when the user chooses to settle in the proprietary cloud platform, the user will provide his/her own relevant information to the proprietary cloud platform to obtain the required services.
  • the relevant information is, for example, the business scale, the business domain where the user is located, and so on.
  • Business domains such as logistics, retail, etc.
  • the roles of logistics business include courier, sorter, merchandiser, and so on.
  • the roles under the retail business include pre-sales customer service, after-sales customer service, artist, operation and so on. It can be understood that the above is only an exemplary illustration, and should not be construed as a specific limitation to the present disclosure.
  • Fig. 4a schematically shows a flowchart of determining a resource pool according to an embodiment of the present disclosure.
  • operation S202 includes operations S401-S403.
  • Operation S401 obtaining the service domain where the user resides
  • Operation S402 obtaining the resource pool corresponding to the business domain
  • the resource pool corresponding to the business domain is set as the resource pool corresponding to the shadow account.
  • the proprietary cloud platform After the user chooses to settle in the proprietary cloud platform, it will obtain the business domain information provided by the user, and the proprietary cloud platform will select the resource pool corresponding to the business domain. For example, for the logistics business, it will select the resources under the logistics business domain. For retail business, the resource pool under the retail business domain will be selected. Then, the resource pool is used as the resource pool corresponding to the shadow account.
  • FIG. 4b schematically shows a schematic diagram of account access according to an embodiment of the present disclosure.
  • a schematic example is given by taking the user having one administrator account and one non-administrator account as an example.
  • the user has at least one administrator account, and/or at least one non-administrator account;
  • the administrator account has the authority to access all resources in the resource pool corresponding to the shadow account;
  • the administrator account has the authority to grant roles to the non-administrator account.
  • a non-admin account can have one or more roles, and an administrator account can have all roles.
  • a user has one administrator account and three non-administrator accounts.
  • the user's business domain is logistics, and the corresponding roles under the logistics business are courier, sorter, and merchandiser.
  • the first non-admin account is granted the courier role
  • the second non-admin account is granted points.
  • Picker role grants the Merchandiser role to the third non-admin account.
  • grant the role of courier and sorter to the first non-admin account grant the role of sorter to the second non-admin account, and grant the role of sorter and merchandiser to the third non-admin account character of.
  • FIG. 5 schematically shows a flow chart of accessing resources according to an embodiment of the present disclosure.
  • operation S203 includes operations S501 to S503.
  • the non-administrator account is controlled to access the resources in the resource pool corresponding to the shadow account.
  • the non-administrator account corresponds to role 1, and the resources in the resource pool corresponding to the shadow account include resource 1, resource 2, and resource 3.
  • Role 1 can access resource 1 and resource 2, but cannot access resource 3.
  • Role 2 can access resource 1, resource 2 and resource 3, and role 3 can only access resource 3. Then, according to the access permission, control non-administrator accounts to only access resource 1 and resource 2.
  • controlling the non-administrator account to access the resources in the resource pool corresponding to the shadow account according to the access authority may be implemented through identity identification and access management (IAM, Identity and Access Management).
  • IAM identity identification and access management
  • FIG. 6 schematically shows a block diagram of a resource management apparatus according to an embodiment of the present disclosure.
  • the resource management apparatus 600 includes a creation module 601 , a determination module 602 , and an access module 603 .
  • the establishment module 601 is used for establishing a shadow account on the proprietary cloud platform for the user in response to the user's operation of entering the proprietary cloud platform;
  • a determination module 602 configured to determine a resource pool corresponding to the shadow account
  • the access module 603 is configured to, when the user accesses the proprietary cloud platform, access resources in the resource pool corresponding to the shadow account based on a preset access policy.
  • the device further includes:
  • the acquisition module is used to obtain the login status of the current login account
  • a judgment module for judging whether the login state is the login state of the proprietary cloud platform
  • a setting module is used to set a corresponding access policy for the login account if the login state is not the login state of the proprietary cloud platform; a switching module is used to switch the login state to the proprietary cloud platform login state.
  • an access module configured to access the proprietary cloud platform if the login state is the login state of the proprietary cloud platform.
  • the determining module includes:
  • a first acquisition sub-module used to acquire the business domain where the user resides
  • the second acquisition sub-module is used to acquire the resource pool corresponding to the business domain
  • a setting submodule is used to set the resource pool corresponding to the business domain as the resource pool corresponding to the shadow account.
  • the setting module includes:
  • a creation sub-module configured to create a role for the user on the proprietary cloud platform according to the business domain in which the user resides;
  • the grant sub-module is used to grant each role access rights to the resources in the resource pool corresponding to the shadow account.
  • the user has at least one administrator account, and/or at least one non-administrator account;
  • the administrator account has the authority to access all resources in the resource pool corresponding to the shadow account;
  • the administrator account has the authority to grant roles to the non-administrator account.
  • the access module includes:
  • a third acquiring submodule configured to acquire the role corresponding to the non-administrator account when the user accesses the proprietary cloud platform using a non-administrator account;
  • the fourth acquisition submodule is used to acquire the access authority of the role to the resources in the resource pool corresponding to the shadow account;
  • the access sub-module is configured to control the non-administrator account to access resources in the resource pool corresponding to the shadow account according to the access authority.
  • the private cloud platform is set on a public cloud platform, and the private cloud platform shares the front-end components of the public cloud platform.
  • modules, sub-modules, units, sub-units, or at least part of the functions of any of them according to embodiments of the present disclosure may be implemented in one module. Any one or more of the modules, sub-modules, units, and sub-units according to the embodiments of the present disclosure may be divided into multiple modules for implementation.
  • any one or more of the modules, sub-modules, units, sub-units according to embodiments of the present disclosure may be implemented at least partially as hardware circuits, such as field programmable gate arrays (FPGA), programmable logic arrays (PLA), A system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or any other reasonable means of hardware or firmware that integrates or packages circuits, or can be implemented in software, hardware, and firmware Any one of these implementations or an appropriate combination of any of them is implemented.
  • FPGA field programmable gate arrays
  • PLA programmable logic arrays
  • ASIC application specific integrated circuit
  • any one of these implementations or an appropriate combination of any of them is implemented.
  • one or more of the modules, sub-modules, units, and sub-units according to embodiments of the present disclosure may be implemented at least in part as computer program modules that, when executed, may perform corresponding functions.
  • any one of the resource management apparatuses 600 may be implemented in one module/unit/subunit, or any one of the modules/units/subunits may be split into multiple modules/units/subunits.
  • at least part of the functionality of one or more of these modules/units/subunits may be combined with at least part of the functionality of other modules/units/subunits and combined in one module/unit/subunit realized in.
  • At least one of the resource management apparatuses 600 may be implemented at least in part as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate , a system on a package, an application specific integrated circuit (ASIC), or any other reasonable way of integrating or encapsulating a circuit, such as hardware or firmware, or any one of software, hardware, and firmware. Or any suitable combination of any of them can be implemented.
  • FPGA field programmable gate array
  • PLA programmable logic array
  • ASIC application specific integrated circuit
  • at least one of the resource management apparatuses 600 may be implemented at least partially as a computer program module, which, when executed, may perform corresponding functions.
  • resource management device part in the embodiment of the present disclosure corresponds to the resource management method part in the embodiment of the present disclosure, and the description of the resource management device part refers to the resource management method part, which is not repeated here.
  • Figure 7 schematically shows a block diagram of a computer system suitable for implementing the methods described above, according to an embodiment of the present disclosure.
  • the computer system shown in FIG. 7 is only an example, and should not impose any limitation on the function and scope of use of the embodiments of the present disclosure.
  • a computer system 700 includes a processor 701 that can be loaded into a random access memory (RAM) 703 according to a program stored in a read only memory (ROM) 702 or from a storage portion 708 program to perform various appropriate actions and processes.
  • the processor 701 may include, for example, a general-purpose microprocessor (eg, a CPU), an instruction set processor and/or a related chipset, and/or a special-purpose microprocessor (eg, an application specific integrated circuit (ASIC)), among others.
  • the processor 701 may also include on-board memory for caching purposes.
  • the processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to the embodiments of the present disclosure.
  • the processor 701, the ROM 702, and the RAM 703 are connected to each other through a bus 704.
  • the processor 701 performs various operations of the method flow according to an embodiment of the present disclosure by executing programs in the ROM 702 and/or the RAM 703.
  • the program may also be stored in one or more memories other than ROM 702 and RAM 703.
  • the processor 701 may also perform various operations of the method flow according to the embodiments of the present disclosure by executing programs stored in the one or more memories.
  • the system 700 may also include an input/output (I/O) interface 705 that is also connected to the bus 704 .
  • System 700 may also include one or more of the following components connected to I/O interface 705: input portion 706 including keyboard, mouse, etc.; including components such as cathode ray tubes (CRT), liquid crystal displays (LCD), etc., and speakers
  • I/O interface 705 input portion 706 including keyboard, mouse, etc.; including components such as cathode ray tubes (CRT), liquid crystal displays (LCD), etc., and speakers
  • a communication section 709 including a network interface card such as a LAN card, a modem, and the like.
  • the communication section 709 performs communication processing via a network such as the Internet.
  • a drive 710 is also connected to the I/O interface 705 as needed.
  • a removable medium 711 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is mounted on the drive 710 as needed so that a computer program read therefrom is installed into the storage section 708 as needed.
  • the method flow according to an embodiment of the present disclosure may be implemented as a computer software program.
  • embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer-readable storage medium, the computer program containing program code for performing the method illustrated in the flowchart.
  • the computer program may be downloaded and installed from the network via the communication portion 709 and/or installed from the removable medium 711 .
  • the above-described functions defined in the system of the embodiment of the present disclosure are performed.
  • the above-described systems, apparatuses, apparatuses, modules, units, etc. can be implemented by computer program modules.
  • the present disclosure also provides a computer-readable storage medium.
  • the computer-readable storage medium may be included in the device/apparatus/system described in the above embodiments; it may also exist alone without being assembled into the device/system. device/system.
  • the above-mentioned computer-readable storage medium carries one or more programs, and when the above-mentioned one or more programs are executed, implement the method according to the embodiment of the present disclosure.
  • the computer-readable storage medium may be a non-volatile computer-readable storage medium. Examples may include, but are not limited to, portable computer disks, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), portable compact disk read only memory (CD- ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.
  • a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.
  • a computer-readable storage medium may include one or more memories other than ROM 702 and/or RAM 703 and/or ROM 702 and RAM 703 described above.
  • each block in the flowchart or block diagrams may represent a module, segment, or portion of code that contains one or more functions for implementing the specified logical function(s) executable instructions.
  • the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)
  • Information Transfer Between Computers (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本公开提供了一种资源管理方法，包括响应于用户入驻专有云平台的操作，为所述用户在所述专有云平台上建立影子账号；确定所述影子账号对应的资源池；当所述用户访问所述专有云平台时，基于预置的访问策略访问所述影子账号对应的资源池内的资源。本公开还提供了一种资源管理装置、计算机系统以及计算机可读存储介质。

Description

资源管理方法、装置、计算机系统、可读存储介质
本申请要求于2020年11月09日递交的中国专利申请No.202011242896.6的优先权，其内容一并在此作为参考。
技术领域
本公开涉及互联网技术领域，更具体地，涉及一种资源管理方法、装置、计算机系统、可读存储介质。
背景技术
一般对于某些行业或专有云的场景，在继承公有云平台在规模化增长、可扩展性、稳定性及运维等方面的能力上，为了满足业务在资源隔离、安全方面的独立的管控需求，一般会采用专有云平台方案。然而，私有化部署的专有云方案面临基础平台建设投入大，在业务的成长期，前期的重资产投入进行独立的机房与云平台建设成本过重。
发明内容
有鉴于此，本公开提供了一种减少私有云方案下独立建设机房与基础平台的成本投入的资源管理方法、装置、计算机系统、可读存储介质。
本公开的一个方面提供了一种资源管理方法，包括：
响应于用户入驻专有云平台的操作，为所述用户在所述专有云平台上建立影子账号；
确定所述影子账号对应的资源池；
当所述用户访问所述专有云平台时，基于预置的访问策略访问所述影子账号对应的资源池内的资源。
根据本公开的实施例，所述专有云平台设置于公有云平台上，且所述专有云平台共用所述公有云平台的前端组件。
根据本公开的实施例，所述当所述用户访问所述专有云平台时，基于预置的访问策略访问所述影子账号对应的资源池内的资源之前，包括：
获取当前登录账号的登录态；
判断所述登录态是否为专有云平台登录态；
若所述登录态不为所述专有云平台登录态，则为所述登录账号设置相应的访问策略，并切换所述登录态为所述专有云平台登录态。
若所述登录态为所述专有云平台登录态，则访问所述专有云平台。
根据本公开的实施例，所述确定所述影子账号对应的资源池包括：
获取所述用户入驻的业务域；
获取所述业务域对应的资源池；
将所述业务域对应的资源池设置为所述影子账号对应的资源池。
根据本公开的实施例，所述为所述登录账号设置相应的访问策略包括：
根据所述用户入驻的业务域，为所述用户在所述专有云平台上创建角色；
授予各角色对于所述影子账号对应的资源池内资源的访问权限。
根据本公开的实施例，所述用户拥有至少一个管理员账号，和/或，至少一个非管理员账号；
所述管理员账号拥有访问所述影子账号对应的资源池内所有资源的权限；
所述管理员账号拥有为所述非管理员账号授予角色的权限。
根据本公开的实施例，所述当所述用户访问所述专有云平台时，基于预置的访问策略访问所述影子账号对应的资源池内的资源包括：
当所述用户采用非管理员账号访问所述专有云平台时，获取所述非管理员账号对应的角色；
获取所述角色对于所述影子账号对应的资源池内资源的访问权限；
根据所述访问权限，控制所述非管理员账号访问所述影子账号对应的资源池内的资源。
本公开的另一个方面提供了一种资源管理装置，包括：
建立模块，用于响应于用户入驻专有云平台的操作，为所述用户在所述专有云平台上建立影子账号；
确定模块，用于确定所述影子账号对应的资源池；
访问模块，用于当所述用户访问所述专有云平台时，基于预置的访问策略访问所述影子账号对应的资源池内的资源。
本公开的另一方面提供了一种计算机可读存储介质，存储有计算机可 执行指令，所述指令在被执行时用于实现如上所述的方法。
本公开的另一方面提供了一种计算机程序，所述计算机程序包括计算机可执行指令，所述指令在被执行时用于实现如上所述的方法。
根据本公开的实施例，因为在专有云平台上采用了影子账号的技术手段，使得在专有云平台上可以控制登录账号对影子账号下的资源的使用情况，从而实现减少私有云方案下独立建设机房与基础平台的成本投入的技术效果。
附图说明
通过以下参照附图对本公开实施例的描述，本公开的上述以及其他目的、特征和优点将更为清楚，在附图中：
图1示意性示出了根据本公开实施例的用于资源管理方法示例性系统架构100；
图2示意性示出了根据本公开实施例的资源管理方法的流程图；
图3示意性示出了根据本公开实施例的登录态切换方法的流程图；
图4a示意性示出了根据本公开实施例的确定资源池的流程图；
图4b示意性示出了根据本公开实施例的账号访问的示意图；
图5示意性示出了根据本公开实施例的访问资源的流程图；
图6示意性示出了根据本公开的实施例的资源管理装置600的框图；以及
图7示意性示出了根据本公开实施例的适于实现资源管理方法的计算机系统700的框图。
具体实施方式
以下，将参照附图来描述本公开的实施例。但是应该理解，这些描述只是示例性的，而并非要限制本公开的范围。在下面的详细描述中，为便于解释，阐述了许多具体的细节以提供对本公开实施例的全面理解。然而，明显地，一个或多个实施例在没有这些具体细节的情况下也可以被实施。此外，在以下说明中，省略了对公知结构和技术的描述，以避免不必要地混淆本公开的概念。
在此使用的术语仅仅是为了描述具体实施例，而并非意在限制本公开。在此使用的术语“包括”、“包含”等表明了所述特征、步骤、操作和/或部 件的存在，但是并不排除存在或添加一个或多个其他特征、步骤、操作或部件。
在此使用的所有术语(包括技术和科学术语)具有本领域技术人员通常所理解的含义，除非另外定义。应注意，这里使用的术语应解释为具有与本说明书的上下文相一致的含义，而不应以理想化或过于刻板的方式来解释。
在使用类似于“A、B和C等中至少一个”这样的表述的情况下，一般来说应该按照本领域技术人员通常理解该表述的含义来予以解释(例如，“具有A、B和C中至少一个的系统”应包括但不限于单独具有A、单独具有B、单独具有C、具有A和B、具有A和C、具有B和C、和/或具有A、B、C的系统等)。在使用类似于“A、B或C等中至少一个”这样的表述的情况下，一般来说应该按照本领域技术人员通常理解该表述的含义来予以解释(例如，“具有A、B或C中至少一个的系统”应包括但不限于单独具有A、单独具有B、单独具有C、具有A和B、具有A和C、具有B和C、和/或具有A、B、C的系统等)。
本公开的实施例提供了一种资源管理方法。该方法包括在用户入驻专有云平台后，专有云平台为用户创建影子账号和角色，并确定影子账号对应的资源池，给角色授予对应的权限。当用户登录专有云平台后，专有云平台基于用户当前的角色和角色对应的权限，控制用户对影子账号对应的资源池内的资源的访问。
图1示意性示出了根据本公开实施例的用于资源管理方法示例性系统架构100。需要注意的是，图1所示仅为可以应用本公开实施例的系统架构的示例，以帮助本领域技术人员理解本公开的技术内容，但并不意味着本公开实施例不可以用于其他设备、系统、环境或场景。
如图1所示，根据该实施例的系统架构100可以包括终端设备101、102、103，网络104和服务器105。网络104用以在终端设备101、102、103和服务器105之间提供通信链路的介质。网络104可以包括各种连接类型，例如有线和/或无线通信链路等等。
用户可以使用终端设备101、102、103通过网络104与服务器105交互，以得到不同程度、不同类型的信息服务。
终端设备101、102、103可以是具有显示屏并且支持网页浏览的各种电子设备，包括但不限于智能手机、平板电脑、膝上型便携计算机和台式计算机等等。
服务器105为公有云平台的服务器，该公有云平台可以是以数据存储为主的存储型云平台、或以数据处理为主的计算型云平台，或以计算和数据存储处理兼顾的综合云计算平台。
需要说明的是，本公开实施例所提供的资源管理方法一般可以由服务器105执行。相应地，本公开实施例所提供的资源管理装置一般可以设置于服务器105中。本公开实施例所提供的资源管理方法也可以由不同于服务器105且能够与终端设备101、102、103和/或服务器105通信的服务器或服务器集群执行。相应地，本公开实施例所提供的资源管理装置也可以设置于不同于服务器105且能够与终端设备101、102、103和/或服务器105通信的服务器或服务器集群中。
应该理解，图1中的终端设备、网络和云平台的数目仅仅是示意性的。根据实现需要，可以具有任意数目的终端设备、网络和云平台。
图2示意性示出了根据本公开实施例的资源管理方法的流程图。
如图2所示，该方法包括操作S201～S203。
在操作S201，响应于用户入驻专有云平台的操作，为所述用户在所述专有云平台上建立影子账号。
在操作S202，确定所述影子账号对应的资源池。
在操作S203，当所述用户访问所述专有云平台时，基于预置的访问策略访问所述影子账号对应的资源池内的资源。
在本公开中，影子账号是指有着和管理员账号相同权限的账号。专有云平台存在于公有云平台上，共用公有云平台的前端组件，可以为用户提供云计算产品及数据服务。用户是指商家，软件开发商等等。可理解的，公有云平台上还可以有其它专有云平台，针对用户需求，为不同的用户提供专属服务。
在本公开中，访问策略可以是针对用户所在业务域内具有的角色对资源的访问权限，不同的角色对于影子账号对应资源池内各资源的访问权限不同。
具体的，例如，用户userA选择入驻专有云平台后，专有云平台会为用户userA在专有云平台上建立具有管理员权限的影子账号，再为影子账号分配资源池，并且获取用户userA在专有云平台上对应的访问策略，使得用户userA基于该访问策略访问影子账号对应的资源池内的资源。
根据本公开实施例，对于入驻专有云平台的用户，为用户建立影子账号，并确定影子账号对应拥有的资源池。在用户访问专有云平台时，基于预置的访问策略访问影子账号对应的资源池内的资源。通过设置影子账号实现资源隔离和资源的权限控制，从而减少私有云方案下独立建设机房与基础平台的成本投入。
在本公开其中一个实施例中，所述专有云平台设置于公有云平台上，且所述专有云平台共用所述公有云平台的前端组件。可在公有云进行升级时，专有云平台跟随公有云平台进行升级。
图3示意性示出了根据本公开实施例的登录态切换方法的流程图。
如图3所示，操作S203之前还包括操作S301～S304。
操作S301，获取当前登录账号的登录态；
操作S302，判断所述登录态是否为专有云平台登录态；
若所述登录态不为所述专有云平台登录态，则执行操作S303，为所述登录账号设置相应的访问策略，并切换所述登录态为所述专有云平台登录态。
若所述登录态为所述专有云平台登录态，则执行操作S304，访问所述专有云平台。
在本公开中，登录态是指用户使用账号和密码登录后一般会生成一个加密的token保存在用户端，每次用户端和服务端的交互会带上token，从而服务端可以获取用户相关的信息，而不需要每次都带上用户的账号和密码，该token即为用户登录态。用户可以使用一套账号密码登录专有云平台和公有云平台，但用户登录专有云平台和公有云平台时的登录态不同。在本公开中，用户登录专有云平台的登录态为专有云平台登录态。其中，该访问策略是用户访问专有云平台时所需采用的访问策略。
具体的，在操作S303中，专有云平台会重定向登录页，给当前登录账号下发专有云平台登录态。当用户从公有云平台登录态切换为专有云平 台登录态时，可利用单点登录系统(SSO，SingleSignOn)给当前登录账号下发专有云平台登录态，使得用户可以无需重新输入账号和密码登录专有云平台。
在本公开其中一个实施例中，操作S303中为所述登录账号设置相应的访问策略包括：根据所述用户入驻的业务域，为所述用户在所述专有云平台上创建角色；授予各角色对于所述影子账号对应的资源池内资源的访问权限。
具体的，在用户选择入驻专有云平台时，用户会向专有云平台提供自身的相关信息以获取所需的服务。相关信息例如，业务规模、用户所在业务域等等。业务域例如，物流、零售等等。
不同业务域下具有不同的角色，例如，物流业务下的角色有快递员、分拣员、跟单员等等。零售业务下的角色有售前客服、售后客服、美工、运营等等。可理解的，以上仅为一种示例性说明，不可理解为对本公开的具体限制。
图4a示意性示出了根据本公开实施例的确定资源池的流程图。
如图4a所示，操作S202包括操作S401～S403。
操作S401，获取所述用户入驻的业务域；
操作S402，获取所述业务域对应的资源池；
操作S403，将所述业务域对应的资源池设置为所述影子账号对应的资源池。
在用户选择入驻专有云平台后，会获取用户提供的业务域信息，专有云平台选择于该业务域对应的资源池，例如，对于物流业务，会选择与物流业务域下的资源，对于零售业务，会选择与零售业务域下的资源池。然后，将该资源池作为影子账号对应的资源池。
图4b示意性示出了根据本公开实施例的账号访问的示意图。图4b中以用户具有一个管理员账号和一个非管理员账号为例进行示意性举例。
在本公开其中一个实施例中，所述用户拥有至少一个管理员账号，和/或，至少一个非管理员账号；
所述管理员账号拥有访问所述影子账号对应的资源池内所有资源的权限；
所述管理员账号拥有为所述非管理员账号授予角色的权限。
具体的，一个非管理员账号可以具有一个或多个角色，管理员账号可以具有所有角色。
示例性的，用户拥有一个管理员账号和三个非管理员账号。用户所在业务域为物流，物流业务下对应的角色为快递员、分拣员、跟单员，则为第一个非管理员账号授予快递员的角色，为第二个非管理员账号授予分拣员的角色，为第三个非管理员账号授予跟单员的角色。或者为第一个非管理员账号授予快递员、分拣员的角色，为第二个非管理员账号授予分拣员的角色，为第三个非管理员账号授予分拣员、跟单员的角色。
图5示意性示出了根据本公开实施例的访问资源的流程图。
如图5所示，操作S203包括操作S501～S503。
操作S501，当所述用户采用非管理员账号访问所述专有云平台时，获取所述非管理员账号对应的角色。
操作S502，获取所述角色对于所述影子账号对应的资源池内资源的访问权限。
操作S503，根据所述访问权限，控制所述非管理员账号访问所述影子账号对应的资源池内的资源。
示例性的，非管理员账号对应角色1，影子账号下对应的资源池内的资源包括资源1、资源2和资源3。角色1可以访问资源1和资源2，不可以访问资源3，角色2可以访问资源1、资源2和资源3、角色3只可以访问资源3。则根据该访问权限，控制非管理员账号只能访问资源1和资源2。
具体的，操作S503中，根据访问权限控制非管理员账号访问影子账号对应的资源池内的资源可以是通过身份识别与访问管理(IAM，Identity and Access Management)来实现。
图6示意性示出了根据本公开的实施例的资源管理装置的框图。
如图6所示，资源管理装置600包括建立模块601、确定模块602、访问模块603。
建立模块601，用于响应于用户入驻专有云平台的操作，为所述用户在所述专有云平台上建立影子账号；
确定模块602，用于确定所述影子账号对应的资源池；
访问模块603，用于当所述用户访问所述专有云平台时，基于预置的访问策略访问所述影子账号对应的资源池内的资源。
在本公开其中一个实施例中，所述装置还包括：
获取模块，用于获取当前登录账号的登录态；
判断模块，用于判断所述登录态是否为专有云平台登录态；
设置模块，用于若所述登录态不为所述专有云平台登录态，则为所述登录账号设置相应的访问策略；切换模块，用于切换所述登录态为所述专有云平台登录态。
访问模块，用于若所述登录态为所述专有云平台登录态，则访问所述专有云平台。
在本公开其中一个实施例中，所述确定模块包括：
第一获取子模块，用于获取所述用户入驻的业务域；
第二获取子模块，用于获取所述业务域对应的资源池；
设置子模块，用于将所述业务域对应的资源池设置为所述影子账号对应的资源池。
在本公开其中一个实施例中，所述设置模块包括：
创建子模块，用于根据所述用户入驻的业务域，为所述用户在所述专有云平台上创建角色；
授予子模块，用于授予各角色对于所述影子账号对应的资源池内资源的访问权限。
在本公开其中一个实施例中，所述用户拥有至少一个管理员账号，和/或，至少一个非管理员账号；
所述管理员账号拥有访问所述影子账号对应的资源池内所有资源的权限；
所述管理员账号拥有为所述非管理员账号授予角色的权限。
在本公开其中一个实施例中，所述访问模块包括：
第三获取子模块，用于当所述用户采用非管理员账号访问所述专有云平台时，获取所述非管理员账号对应的角色；
第四获取子模块，用于获取所述角色对于所述影子账号对应的资源池 内资源的访问权限；
访问子模块，用于根据所述访问权限，控制所述非管理员账号访问所述影子账号对应的资源池内的资源。
在本公开其中一个实施例中，所述专有云平台设置于公有云平台上，且所述专有云平台共用所述公有云平台的前端组件。
根据本公开的实施例的模块、子模块、单元、子单元中的任意多个、或其中任意多个的至少部分功能可以在一个模块中实现。根据本公开实施例的模块、子模块、单元、子单元中的任意一个或多个可以被拆分成多个模块来实现。根据本公开实施例的模块、子模块、单元、子单元中的任意一个或多个可以至少被部分地实现为硬件电路，例如现场可编程门阵列(FPGA)、可编程逻辑阵列(PLA)、片上系统、基板上的系统、封装上的系统、专用集成电路(ASIC)，或可以通过对电路进行集成或封装的任何其他的合理方式的硬件或固件来实现，或以软件、硬件以及固件三种实现方式中任意一种或以其中任意几种的适当组合来实现。或者，根据本公开实施例的模块、子模块、单元、子单元中的一个或多个可以至少被部分地实现为计算机程序模块，当该计算机程序模块被运行时，可以执行相应的功能。
例如，资源管理装置600中的任意多个可以合并在一个模块/单元/子单元中实现，或者其中的任意一个模块/单元/子单元可以被拆分成多个模块/单元/子单元。或者，这些模块/单元/子单元中的一个或多个模块/单元/子单元的至少部分功能可以与其他模块/单元/子单元的至少部分功能相结合，并在一个模块/单元/子单元中实现。根据本公开的实施例，资源管理装置600中的至少一个可以至少被部分地实现为硬件电路，例如现场可编程门阵列(FPGA)、可编程逻辑阵列(PLA)、片上系统、基板上的系统、封装上的系统、专用集成电路(ASIC)，或可以通过对电路进行集成或封装的任何其他的合理方式等硬件或固件来实现，或以软件、硬件以及固件三种实现方式中任意一种或以其中任意几种的适当组合来实现。或者，资源管理装置600中的至少一个可以至少被部分地实现为计算机程序模块，当该计算机程序模块被运行时，可以执行相应的功能。
需要说明的是，本公开的实施例中资源管理装置部分与本公开的实施 例中资源管理方法部分是相对应的，资源管理装置部分的描述具体参考资源管理方法部分，在此不再赘述。
图7示意性示出了根据本公开实施例的适于实现上文描述的方法的计算机系统的框图。图7示出的计算机系统仅仅是一个示例，不应对本公开实施例的功能和使用范围带来任何限制。
如图7所示，根据本公开实施例的计算机系统700包括处理器701，其可以根据存储在只读存储器(ROM)702中的程序或者从存储部分708加载到随机访问存储器(RAM)703中的程序而执行各种适当的动作和处理。处理器701例如可以包括通用微处理器(例如CPU)、指令集处理器和/或相关芯片组和/或专用微处理器(例如，专用集成电路(ASIC))，等等。处理器701还可以包括用于缓存用途的板载存储器。处理器701可以包括用于执行根据本公开实施例的方法流程的不同动作的单一处理单元或者是多个处理单元。
在RAM 703中，存储有系统700操作所需的各种程序和数据。处理器701、ROM 702以及RAM 703通过总线704彼此相连。处理器701通过执行ROM 702和/或RAM 703中的程序来执行根据本公开实施例的方法流程的各种操作。需要注意，所述程序也可以存储在除ROM 702和RAM 703以外的一个或多个存储器中。处理器701也可以通过执行存储在所述一个或多个存储器中的程序来执行根据本公开实施例的方法流程的各种操作。
根据本公开的实施例，系统700还可以包括输入/输出(I/O)接口705，输入/输出(I/O)接口705也连接至总线704。系统700还可以包括连接至I/O接口705的以下部件中的一项或多项：包括键盘、鼠标等的输入部分706；包括诸如阴极射线管(CRT)、液晶显示器(LCD)等以及扬声器等的输出部分707；包括硬盘等的存储部分708；以及包括诸如LAN卡、调制解调器等的网络接口卡的通信部分709。通信部分709经由诸如因特网的网络执行通信处理。驱动器710也根据需要连接至I/O接口705。可拆卸介质711，诸如磁盘、光盘、磁光盘、半导体存储器等等，根据需要安装在驱动器710上，以便于从其上读出的计算机程序根据需要被安装入存储部分708。
根据本公开的实施例，根据本公开实施例的方法流程可以被实现为计算机软件程序。例如，本公开的实施例包括一种计算机程序产品，其包括承载在计算机可读存储介质上的计算机程序，该计算机程序包含用于执行流程图所示的方法的程序代码。在这样的实施例中，该计算机程序可以通过通信部分709从网络上被下载和安装，和/或从可拆卸介质711被安装。在该计算机程序被处理器701执行时，执行本公开实施例的系统中限定的上述功能。根据本公开的实施例，上文描述的系统、设备、装置、模块、单元等可以通过计算机程序模块来实现。
本公开还提供了一种计算机可读存储介质，该计算机可读存储介质可以是上述实施例中描述的设备/装置/系统中所包含的；也可以是单独存在，而未装配入该设备/装置/系统中。上述计算机可读存储介质承载有一个或者多个程序，当上述一个或者多个程序被执行时，实现根据本公开实施例的方法。
根据本公开的实施例，计算机可读存储介质可以是非易失性的计算机可读存储介质。例如可以包括但不限于：便携式计算机磁盘、硬盘、随机访问存储器(RAM)、只读存储器(ROM)、可擦式可编程只读存储器(EPROM或闪存)、便携式紧凑磁盘只读存储器(CD-ROM)、光存储器件、磁存储器件、或者上述的任意合适的组合。在本公开中，计算机可读存储介质可以是任何包含或存储程序的有形介质，该程序可以被指令执行系统、装置或者器件使用或者与其结合使用。
例如，根据本公开的实施例，计算机可读存储介质可以包括上文描述的ROM 702和/或RAM 703和/或ROM 702和RAM 703以外的一个或多个存储器。
附图中的流程图和框图，图示了按照本公开各种实施例的系统、方法和计算机程序产品的可能实现的体系架构、功能和操作。在这点上，流程图或框图中的每个方框可以代表一个模块、程序段、或代码的一部分，上述模块、程序段、或代码的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。也应当注意，在有些作为替换的实现中，方框中所标注的功能也可以以不同于附图中所标注的顺序发生。例如，两个接连地表示的方框实际上可以基本并行地执行，它们有时也可以按相反的顺序执行， 这依所涉及的功能而定。也要注意的是，框图或流程图中的每个方框、以及框图或流程图中的方框的组合，可以用执行规定的功能或操作的专用的基于硬件的系统来实现，或者可以用专用硬件与计算机指令的组合来实现。
本领域技术人员可以理解，本公开的各个实施例和/或权利要求中记载的特征可以进行多种组合和/或结合，即使这样的组合或结合没有明确记载于本公开中。特别地，在不脱离本公开精神和教导的情况下，本公开的各个实施例和/或权利要求中记载的特征可以进行多种组合和/或结合。所有这些组合和/或结合均落入本公开的范围。
以上对本公开的实施例进行了描述。但是，这些实施例仅仅是为了说明的目的，而并非为了限制本公开的范围。尽管在以上分别描述了各实施例，但是这并不意味着各个实施例中的措施不能有利地结合使用。本公开的范围由所附权利要求及其等同物限定。不脱离本公开的范围，本领域技术人员可以做出多种替代和修改，这些替代和修改都应落在本公开的范围之内。

Claims (10)

  1. 一种资源管理方法，包括：
    响应于用户入驻专有云平台的操作，为所述用户在所述专有云平台上建立影子账号；
    确定所述影子账号对应的资源池；
    当所述用户访问所述专有云平台时，基于预置的访问策略访问所述影子账号对应的资源池内的资源。
  2. 根据权利要求1所述的方法，其中，所述专有云平台设置于公有云平台上，且所述专有云平台共用所述公有云平台的前端组件。
  3. 根据权利要求1所述的方法，其中，所述当所述用户访问所述专有云平台时，基于预置的访问策略访问所述影子账号对应的资源池内的资源之前，包括：
    获取当前登录账号的登录态；
    判断所述登录态是否为专有云平台登录态；
    若所述登录态不为所述专有云平台登录态，则为所述登录账号设置相应的访问策略，并切换所述登录态为所述专有云平台登录态。
    若所述登录态为所述专有云平台登录态，则访问所述专有云平台。
  4. 根据权利要求1所述的方法，其中，所述确定所述影子账号对应的资源池包括：
    获取所述用户入驻的业务域；
    获取所述业务域对应的资源池；
    将所述业务域对应的资源池设置为所述影子账号对应的资源池。
  5. 根据权利要求3所述的方法，其中，所述为所述登录账号设置相应的访问策略包括：
    根据所述用户入驻的业务域，为所述用户在所述专有云平台上创建角色；
    授予各角色对于所述影子账号对应的资源池内资源的访问权限。
  6. 根据权利要求1所述的方法，其中，所述用户拥有至少一个 管理员账号，和/或，至少一个非管理员账号；
    所述管理员账号拥有访问所述影子账号对应的资源池内所有资源的权限；
    所述管理员账号拥有为所述非管理员账号授予角色的权限。
  7. 根据权利要求6所述的方法，其中，所述当所述用户访问所述专有云平台时，基于预置的访问策略访问所述影子账号对应的资源池内的资源包括：
    当所述用户采用非管理员账号访问所述专有云平台时，获取所述非管理员账号对应的角色；
    获取所述角色对于所述影子账号对应的资源池内资源的访问权限；
    根据所述访问权限，控制所述非管理员账号访问所述影子账号对应的资源池内的资源。
  8. 一种资源管理装置，包括：
    建立模块，用于响应于用户入驻专有云平台的操作，为所述用户在所述专有云平台上建立影子账号；
    确定模块，用于确定所述影子账号对应的资源池；
    访问模块，用于当所述用户访问所述专有云平台时，基于预置的访问策略访问所述影子账号对应的资源池内的资源。
  9. 一种计算机系统，包括：
    一个或多个处理器；
    存储器，用于存储一个或多个程序，
    其中，当所述一个或多个程序被所述一个或多个处理器执行时，使得所述一个或多个处理器实现权利要求1至7中任一项所述的方法。
  10. 一种计算机可读存储介质，其上存储有可执行指令，该指令被处理器执行时使处理器实现权利要求1至7中任一项所述的方法。
PCT/CN2021/128968 2020-11-09 2021-11-05 资源管理方法、装置、计算机系统、可读存储介质 WO2022095958A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
US18/250,490 US20240015113A1 (en) 2020-11-09 2021-11-05 Method and apparatus of managing resource, computer system, and readable storage medium
EP21888650.5A EP4243382A4 (en) 2020-11-09 2021-11-05 RESOURCE MANAGEMENT METHOD AND DEVICE, COMPUTER SYSTEM AND READABLE STORAGE MEDIUM
KR1020237015062A KR20230082652A (ko) 2020-11-09 2021-11-05 자원 관리 방법, 장치, 컴퓨터 시스템, 판독 가능 매체
JP2023524643A JP7546164B2 (ja) 2020-11-09 2021-11-05 資源管理方法、装置、コンピュータシステム、可読記憶媒体

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011242896.6 2020-11-09
CN202011242896.6A CN112437123B (zh) 2020-11-09 2020-11-09 资源管理方法、装置、计算机系统、可读存储介质

Publications (1)

Publication Number Publication Date
WO2022095958A1 true WO2022095958A1 (zh) 2022-05-12

Family

ID=74701227

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/128968 WO2022095958A1 (zh) 2020-11-09 2021-11-05 资源管理方法、装置、计算机系统、可读存储介质

Country Status (6)

Country Link
US (1) US20240015113A1 (zh)
EP (1) EP4243382A4 (zh)
JP (1) JP7546164B2 (zh)
KR (1) KR20230082652A (zh)
CN (1) CN112437123B (zh)
WO (1) WO2022095958A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112437123B (zh) * 2020-11-09 2024-04-09 北京京东尚科信息技术有限公司 资源管理方法、装置、计算机系统、可读存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102420846A (zh) * 2010-10-15 2012-04-18 微软公司 企业用户对主存的虚拟机的远程访问
US20180123912A1 (en) * 2016-11-02 2018-05-03 International Business Machines Corporation Intelligently suggesting computing resources to computer network users
CN110784433A (zh) * 2018-07-31 2020-02-11 阿里巴巴集团控股有限公司 一种用户访问处理方法、装置及设备
CN110968413A (zh) * 2018-09-28 2020-04-07 华为技术有限公司 一种数据管理方法、装置和服务器
CN112437123A (zh) * 2020-11-09 2021-03-02 北京京东尚科信息技术有限公司 资源管理方法、装置、计算机系统、可读存储介质

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2011128994A (ja) 2009-12-18 2011-06-30 Canon It Solutions Inc 情報処理装置、情報処理方法、及びコンピュータプログラム
CN102317905A (zh) 2010-03-25 2012-01-11 恩梯梯数据积水系统集成有限公司 网络应用程序构建系统、网络应用程序构建方法、网络应用程序构建程序以及记录了网络应用程序构建程序的记录介质
JP5930847B2 (ja) 2011-06-29 2016-06-08 キヤノン株式会社 サーバーシステムおよび制御方法およびプログラム
CN102903029A (zh) * 2012-09-27 2013-01-30 广东亿迅科技有限公司 云计算资源分域授权方法
US10878079B2 (en) * 2016-05-11 2020-12-29 Oracle International Corporation Identity cloud service authorization model with dynamic roles and scopes
CN106067119A (zh) 2016-06-03 2016-11-02 成都镜杰科技有限责任公司 基于私有云的客户关系管理方法
WO2019040658A1 (en) * 2017-08-22 2019-02-28 Terawe Corporation SINGLE HYBRID SIGNATURE FOR APPLICATIONS AND SOFTWARE SERVICES USING CLASSIC AND MODERN IDENTITY PROVIDERS
CN109587254B (zh) * 2018-12-11 2021-09-17 深圳市口袋网络科技有限公司 云服务器访问方法、装置、云服务器及存储介质
CN109525605B (zh) * 2019-01-03 2021-07-27 杭州数梦工场科技有限公司 一种账号管理方法、装置、系统及计算机可读存储介质
CN110247927B (zh) * 2019-06-28 2021-12-03 北京金山云网络技术有限公司 一种云计算资源的权限管理方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102420846A (zh) * 2010-10-15 2012-04-18 微软公司 企业用户对主存的虚拟机的远程访问
US20180123912A1 (en) * 2016-11-02 2018-05-03 International Business Machines Corporation Intelligently suggesting computing resources to computer network users
CN110784433A (zh) * 2018-07-31 2020-02-11 阿里巴巴集团控股有限公司 一种用户访问处理方法、装置及设备
CN110968413A (zh) * 2018-09-28 2020-04-07 华为技术有限公司 一种数据管理方法、装置和服务器
CN112437123A (zh) * 2020-11-09 2021-03-02 北京京东尚科信息技术有限公司 资源管理方法、装置、计算机系统、可读存储介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4243382A4

Also Published As

Publication number Publication date
JP2023546484A (ja) 2023-11-02
US20240015113A1 (en) 2024-01-11
JP7546164B2 (ja) 2024-09-05
KR20230082652A (ko) 2023-06-08
CN112437123A (zh) 2021-03-02
EP4243382A4 (en) 2024-09-18
CN112437123B (zh) 2024-04-09
EP4243382A1 (en) 2023-09-13

Similar Documents

Publication Publication Date Title
US8943606B2 (en) Systems and methods for associating a virtual machine with an access control right
US9954844B2 (en) Offline authentication
US11526620B2 (en) Impersonation for a federated user
CN113316783A (zh) 使用活动目录和一次性口令令牌组合的双因素身份认证
US11411881B2 (en) Organization level identity management
US10110587B2 (en) Entity to authorize delegation of permissions
US9172724B1 (en) Licensing and authentication with virtual desktop manager
US10511584B1 (en) Multi-tenant secure bastion
US8108907B2 (en) Authentication of user database access
US9225744B1 (en) Constrained credentialed impersonation
US20220232010A1 (en) Protected resource authorization using autogenerated aliases
US10992713B2 (en) Method of and system for authorizing user to execute action in electronic service
US11233776B1 (en) Providing content including sensitive data
US8984612B1 (en) Method of identifying an electronic device by browser versions and cookie scheduling
US20210182440A1 (en) System for preventing access to sensitive information and related techniques
US11544415B2 (en) Context-aware obfuscation and unobfuscation of sensitive content
US10542005B2 (en) Connection control for virtualized environments
JP7403010B2 (ja) 共有化されたリソース識別
US10084784B1 (en) Restricting access to computing resources
US10257263B1 (en) Secure remote execution of infrastructure management
WO2022095958A1 (zh) 资源管理方法、装置、计算机系统、可读存储介质
US20150281281A1 (en) Identification of unauthorized application data in a corporate network
US11140145B1 (en) Systems and methods for providing single sign-on capability
CN113132303A (zh) 由防火墙执行的信息处理方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21888650

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2023524643

Country of ref document: JP

WWE Wipo information: entry into national phase

Ref document number: 18250490

Country of ref document: US

ENP Entry into the national phase

Ref document number: 20237015062

Country of ref document: KR

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 2021888650

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2021888650

Country of ref document: EP

Effective date: 20230609