WO2023016414A1

WO2023016414A1 - Credential rotation method, computing device, and storage medium

Info

Publication number: WO2023016414A1
Application number: PCT/CN2022/110879
Authority: WO
Inventors: 李海滨; 陈俊朴; 王强; 范煜
Original assignee: 阿里云计算有限公司
Priority date: 2021-08-12
Filing date: 2022-08-08
Publication date: 2023-02-16
Also published as: CN113382024B; CN113382024A

Abstract

Embodiments of the present application provide a credential rotation method, a computing device, and a storage medium. In the embodiments of the present application, the method comprises: acquiring a target credential to be rotated, and creating a replacement credential corresponding to the target credential to be rotated, wherein the target credential to be rotated is stored in an acquisition region; replacing the target credential to be rotated in the acquisition region with the replacement credential, so as to be acquired; and deleting the target credential to be rotated, and using replacement data in the acquisition region as next target credential to be rotated. The replacement credential corresponding to the target credential to be rotated is created, and the target credential to be rotated is stored in the acquisition region; and the target credential to be rotated in the acquisition region is replaced with the replacement credential, so as to be acquired, so that the rotation of the target credential can be achieved, thereby updating the target credential, improving the security performance of the target credential, reducing the risk of being attacked, and reducing the possibility of leakage.

Description

Credential rotation method, computing device and storage medium

This application claims the priority of the Chinese patent application with the application number 202110923482.8 and the title of the invention "Credential rotation method, computing equipment and storage medium" submitted on August 12, 2021, the entire content of which is incorporated in this application by reference.

technical field

The present application relates to the field of computer technology, and in particular to a credential rotation method, computing equipment and storage media.

Background technique

With the advent of the information age and cloud services, more and more data needs to be protected. In particular, data such as access credentials is a top priority. Among them, the attack caused by leakage of RAM (Resource Access Management) credentials (AccessKey) is one of the main problems faced by cloud security. How to reduce the security risk of RAM credential leakage is very critical.

Contents of the invention

Various aspects of the present application provide a credential rotation method, a computing device, and a storage medium, so as to reduce the risk of credential leakage and improve its security performance.

An embodiment of the present application provides a credential rotation method, including: acquiring a target credential to be rotated, creating a replacement credential corresponding to the target credential to be rotated, and storing the target credential to be rotated in an acquisition area; The target credential to be rotated is replaced with the replacement credential to be acquired; the target credential to be rotated is deleted, and the replacement data in the acquisition area is used as the target credential to be rotated next time.

The embodiment of the present application also provides a computing device, including: a memory and a processor; the memory is used to store a computer program; the processor is used to execute the computer program to: acquire the target credential to be rotated, A replacement credential corresponding to the target credential to be rotated, the target credential to be rotated is stored in an acquisition area; replacing the target credential to be rotated in the acquisition area with the replacement credential for acquisition; deleting the target credential to be rotated The target credential, and use the replacement data in the acquisition area as the target credential to be rotated next time.

The embodiment of the present application also provides a computer-readable storage medium storing a computer program. When the computer program is executed by one or more processors, the one or more processors are caused to implement the steps in the above method.

In the embodiment of this application, the target credentials to be rotated are obtained, and the replacement credentials corresponding to the target credentials to be rotated are created, and the target credentials to be rotated are stored in the acquisition area; the target credentials to be rotated in the acquisition area are replaced with replacement credentials for the ;Delete the target credential to be rotated, and use the replacement data in the acquisition area as the target credential to be rotated next time.

Among them, create a replacement credential corresponding to the target credential to be rotated, and store the target credential to be rotated in the acquisition area; replace the target credential to be rotated in the acquisition area with a replacement credential, so as to be acquired, the rotation of the target credential can be realized, so that the target Credentials are updated to improve its security performance, reduce the risk of being attacked, and reduce the possibility of leakage. At the same time, since there is a target credential in the acquisition area, the situation that requires the target credential can be supported, so that the corresponding service can be continuously accessed.

Description of drawings

The drawings described here are used to provide a further understanding of the application and constitute a part of the application. The schematic embodiments and descriptions of the application are used to explain the application and do not constitute an improper limitation to the application. In the attached picture:

FIG. 1 is a schematic flowchart of a credential rotation method according to an exemplary embodiment of the present application;

Fig. 2 is a schematic diagram of credential escrow according to an exemplary embodiment of the present application;

FIG. 3 is a schematic diagram of a rotation cycle in an exemplary embodiment of the present application;

Fig. 4 is a schematic diagram of credential reading and writing in an exemplary embodiment of the present application;

Fig. 5 is a schematic structural diagram of a credential rotation system according to an exemplary embodiment of the present application;

Fig. 6 is a schematic structural diagram of a voucher rotation device provided by an exemplary embodiment of the present application;

Fig. 7 is a schematic structural diagram of a computing device provided by an exemplary embodiment of the present application.

Detailed ways

In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with specific embodiments of the present application and corresponding drawings. Apparently, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of this application.

According to the above, the attack caused by leakage of RAM (Resource Access Management) credentials (AccessKey) is one of the main problems facing cloud security. It is because the RAM credential remains unchanged, that is, once the corresponding RAM credential is generated, the RAM credential will not change again, thus greatly increasing the risk of being attacked.

Based on this, the embodiment of the present application provides a credential rotation method, a computing device, and a storage medium, which can reduce the risk of credential leakage and improve its security performance.

The following describes in detail the rotation process of the credential in conjunction with the method embodiment.

Fig. 1 is a schematic flowchart of a credential rotation method according to an exemplary embodiment of the present application. The method 100 provided by the embodiment of the present application is executed by a computing device, such as a cloud server. The method 100 includes the following steps:

101: Obtain the target credential to be rotated, and create a replacement credential corresponding to the target credential to be rotated.

Among them, the target credentials to be rotated are stored in the acquisition area.

102: Replace the target credential to be rotated in the acquisition area with the replacement credential to be acquired.

103: Delete the target credential to be rotated, and use the replacement data in the acquisition area as the target credential to be rotated next time.

It should be noted that the execution subject of this embodiment of the application may be more specifically a service on the cloud server, such as a program or service for rotating credentials, which can also implement functions such as credential hosting, that is, the program or service It can also be a management program or service, such as providing full-lifecycle management services such as creation, retrieval, update, and deletion of credentials, so as to realize unified management of credentials, which is not limited here. The program or service can run on one or more containers on the cloud server.

The following is a detailed description of the above steps:

Wherein, the target credential to be rotated may refer to a credential waiting to be updated, such as a RAM credential. The obtaining area may refer to the location or area used by the user or other equipment to obtain the credential, for example, in the current version of the program or service corresponding to the credential, it may be the location or area used to store the current credential in the current version.

The replacement credential can be a newly created credential.

For example, as shown in FIG. 2 , user 206 can log in to a control interface of the cloud server through a computer, and this interface can be used for hosting RAM credentials. The program 207 for rotating credentials sends an authorization request or information, that is, executes step 201: authorize management of RAM credentials. After authorization, the user 206 can log in to another control interface of the cloud server through a computer, and create RAM data to be managed on this interface. The created content may include: creating a credential type, such as a RAM credential, selecting a RAM user, and each user has at least one RAM credential. Determine the specific data of the RAM credentials under this user. In addition, description information of the RAM credential may also be input, such as describing what service the RAM credential is used to access. Then the created RAM data to be managed is sent to the credential rotation program 207, that is, step 202 is executed: creating a credential with managed RAM. Each RAM credential has a corresponding identification, such as a name. In addition, the user 206 can also set the rotation cycle, or use the default cycle.

After the program 207 for rotating credentials on the cloud server receives the authorization request and the RAM credentials to be managed, it can perform rotation of the RAM credentials to be managed through the resource access control service 208 according to the authorization, that is, perform step 203: rotate RAM data . In the process of rotating data, the program for rotating credentials 207 determines which credentials to be hosted currently have reached the rotation period according to the specific time of the rotation cycle, such as 7 days, and the start time of hosting, and then obtains these managed RAM credentials as waiting to be rotated The target credentials are rotated, and new RAM credentials corresponding to these RAM credentials are created by calling the Open API interface corresponding to the resource access control service 208.

It should be noted that the RAM credential refers to the access key (AccessKey, hereinafter referred to as AK) of the RAM user, including the AccessKey ID (account) and AccessKey Secret (password), which are used by the RAM user to complete the identity when calling the cloud service API. verify.

Specifically, obtaining the target credential to be rotated includes: querying the credential to be rotated, and obtaining a corresponding type of target credential to be rotated according to the credential type.

For example, according to the foregoing, as shown in Figure 2, in the process of rotating data, the program 207 for rotating credentials on the cloud server determines which current To-be-escrowed credentials arrive at the rotation cycle, then obtain these escrow credentials, and then determine the RAM credential as the target credential to be rotated according to the type of escrow credentials, and then hand it over to the escrow credential execution unit for RAM credential rotation, and the escrow credential execution unit finds the corresponding The executor will hand over the RAM credential to the executor for managed RAM credential rotation. The executor can create new RAM credentials corresponding to these RAM credentials by calling the Open API interface corresponding to the resource access control service 208.

In order to better determine when to perform the corresponding operation in credential rotation, such as creating a replacement credential. Time can be used to determine when to perform the corresponding operation action.

Specifically, after obtaining the target credential to be rotated, determine the operation action corresponding to the target credential to be rotated according to the current time; wherein, the operation action includes the operation action of creating a replacement credential, replacing the target credential to be rotated with a replacement credential, and Action to delete the target credentials to be rotated.

Wherein, since each target credential to be rotated has a corresponding rotation period, the rotation period may be the same, such as 7 days. It can also be different. As shown in FIG. 3 , the rotation period 303 of the RAM credential "AK1" 301 is 7 days. The rotation period may include multiple time windows, and each time window may trigger a corresponding operation action. When the time corresponding to this time window arrives, the corresponding operation action is executed.

For example, according to the above, after the program for rotating credentials on the cloud server obtains the RAM credentials to be rotated, as shown in Figure 3, the RAM credentials "AK1" 301 starts to rotate, when it is used to trigger the creation of new After the time window for the RAM credential arrives, create a new RAM credential according to the method described above. The newly created RMA credential can be "AK2" 302, which also has a corresponding rotation period, which can be 7 days.

It should be noted that, when other time windows arrive, other corresponding operation actions are performed, and the specific operation actions can be referred to below in detail.

Wherein, according to the above, the acquisition area may refer to the location or area used by the user or other equipment to obtain the credential, such as the current (Current) version used in the credential rotation program or service corresponding credential.

For example, as mentioned above, after the credential rotation program on the cloud server creates new RAM data "AK2", it can replace "AK1" stored in the current version with "AK2", so that "AK2" is waiting to be acquired .

Since the user or other device obtains the RAM credential from the current version, the user or other device can always obtain the available RAM credential from the current version to access the cloud service, preventing direct modification by man As a result, the available RAM credentials cannot be obtained in time, thereby hindering the access or invocation of cloud services.

At the same time, it can also reduce the technical development cost and time cost of users' own operation and maintenance of credentials, so that users can improve the security of credentials and the security of access to cloud services without awareness.

In addition, for the convenience of replacement, the replacement credential may also be stored in the corresponding version, and in order to distinguish the two credentials, the replacement credential may be stored in the previous version.

Specifically, the method 100 further includes: storing the created replacement credential in the previous (Previous) version of the credential corresponding to the credential rotation program, storing the target credential to be rotated in the current version of the credential corresponding to the credential rotation program, Use the current version of the credential for the credential rotation program as the acquisition area.

For example, according to the foregoing, the credential rotation program on the cloud server stores the created "AK2" in the previous (Previous) version, and stores "AK1" in the current (Previous) version.

Specifically, replacing the target credential to be rotated in the acquisition area with the replacement credential includes: replacing the credential to be rotated in the current version of the corresponding credential stored in the credential rotation program with replacement data, and storing the credential to be rotated in the In the previous version of the credential corresponding to the credential rotation program.

For example, according to the above, if the time window for triggering the replacement of credentials arrives, the program for rotating credentials on the cloud server will replace "AK1" in the current version with "AK2" in the previous version, that is, replace "AK2" in the current version and "AK1" in the previous version.

For example, according to the above, the program for rotating credentials on the cloud server is replacing "AK1" with "AK2".

Specifically, deleting the target credential to be rotated includes: deleting the target credential to be rotated stored in the previous version of the credential corresponding to the credential rotation program.

For example, according to the foregoing, if the time window for triggering the target credential rotation arrives, the program for credential rotation on the cloud server deletes the RAM of the previous version of the corresponding credential by calling the Open API interface corresponding to the resource access control service Credentials "AK1". At this time, the "AK2" in the current version is used as the target certificate to be rotated next time. After waiting for the arrival of its rotation period, the rotation will be carried out in a similar manner as described above, so I will not repeat it here.

It should be noted that when rotating each target credential to be rotated, a corresponding task can be created for each target credential to be rotated, and the task execution status will be marked as successful after the rotation is completed. The embodiment of this application adopts the method of Open API interface to process the user's RAM credentials based on the user's authorization and creation of the hosting credentials, which can avoid the security problem caused by the improper operation of the RAM credentials through the user's direct use of the Open API interface. RAM credentials used.

It should also be noted that, as shown in FIG. 2 , the application program 209 may access the program for rotating credentials 207 periodically or in real time, that is, execute step 204: access the program for rotating credentials. It can be accessed in the form of SDK (Software Development Kit, software development kit) or client, and obtains the corresponding target credential from the acquisition area, such as RAM credential, and the name of the credential. Then, when the application program 209 accesses the cloud service 210, it replaces the RAM credential according to the name, replaces the current RAM credential after the rotation with the RAM credential before the rotation, and then accesses the cloud service 210, that is, executes step 205 : Use the rotated RAM credentials to access cloud services. In addition, the credential rotation program 207 can also be used to encrypt and manage the escrow credentials, further ensuring the security of the credentials.

As shown in FIG. 2 , since the application program 209 can be connected to the program for rotating credentials 207 through the SDK or the client, the rotated credentials can be obtained. Then the user can also access the corresponding cloud service 210 through the rotated RAM credential when waiting to access the corresponding cloud service 210 again through the SDK or client, so as to implement the SDK or client to update the corresponding credential. Correspondingly, this embodiment of the application can ensure that the SDK or the client has at least one RAM credential available during the credential rotation process, avoiding that the SDK or the client cannot obtain the RAM credential in time during the credential rotation process, resulting in the inability to call cloud product services, and at the same time reducing the user cost.

In addition, once the credentials are leaked due to an attack, or the credentials are leaked due to other reasons, the embodiment of this application needs to redeploy the cloud services corresponding to the credentials, reset all corresponding access credentials of these cloud services, and prohibit old access credentials from being dropped. Credentials, which can no longer access services, so as to quickly respond to emergencies, so that cloud services can be accessed through reset access credentials. However, if the access credentials are manually reset, the corresponding application may be missed due to human effort, resulting in that the access credentials under the application are not reset, and these access credentials that have not been reset will be banned. Therefore, when the service is accessed again, the service cannot be accessed because the access credentials that have not been reset are still used for access, resulting in a system failure on the user side.

The embodiment of the present application also satisfies the means of centralized management of credentials required by various cloud resources, and realizes large-scale management.

The database db information stored in the program or service for rotating credentials, such as credential information, key information and other important information is only loaded once when the program or service is started, the access frequency is low, there are special periods such as concurrent access, expansion and upgrade, etc. The volume of requests has skyrocketed. Moreover, credential rotation will also trigger the same batch of credential rotation at the same time period, resulting in an instantaneous update peak. In view of these problems, the following implementation methods can be adopted to overcome them, and the specific implementation methods are as follows:

Specifically, the method 100 further includes: receiving a write request for the target credential to be rotated, creating a shared lock for the target credential to be rotated in the cache according to the write request; The data is written, so that the target credentials to be rotated are updated; after the data is written in the corresponding database, the shared lock in the cache is released to wait for the updated target credentials to be rotated to be loaded.

For example, according to the above, as shown in Figure 4, the user can call the API interface to send a write request through the computer. The write request is used to write the request for the target credential to be rotated. Implement updates. Here, other devices may also send write requests through the API interface. When the global cache 401 (Global Cache) of the rotation credential program or service receives the write request, it determines the corresponding RAM credential from the request, creates a corresponding shared lock for the RAM credential in the cache, and executes step 406: receive After a write request, a shared lock is created. After the shared lock is created, the value corresponding to the corresponding RAM credential can be deleted, that is, step 407 is performed: clearing the corresponding value corresponding to the RAM credential to be rotated in the global cache. Then write the value corresponding to the RAM credential in the write request into the database 402, that is, perform step 408: write the corresponding value data, and then perform step 409: release the shared lock.

It should be noted that, on the premise of having a shared lock, when another write request comes, you can first determine whether the corresponding RAM credential has a shared lock. If so, you can use the corresponding RAM credential in the cache according to The reentrancy of the shared lock is to create a shared lock this time, and then write it according to the method described above until it is unlocked. Thus, the data consistency in the global cache 401 and the database 402 is satisfied.

Therefore, by virtue of the above-mentioned shared locks and their reentrant locks, data consistency can be achieved and the impact of locks on throughput can be minimized.

For a read request, specifically, the method 100 further includes: receiving a read request for the target credential, and determining according to the read request that there is a shared lock for the target credential in the cache; if there is a shared lock, obtaining the corresponding lock from the corresponding database. target credentials.

For example, according to the above, as shown in Figure 4, the user can call the API interface to send a read request through the computer. The read request is a read request for the target credential. Can be a credential to be rotated. Here, other devices may also send read requests through the API interface. After the global cache 401 (Global Cache) of the credential rotation program or service receives the read request, it is determined whether the corresponding RAM credential in the cache has a shared lock. That is, step 403 is executed: after receiving the read request, determine whether there is a shared lock. If there is a shared lock, according to the RAM credential indicated in the request, the value corresponding to the corresponding RAM credential is read from the database 402 . That is, step 404 is executed: if there is shared storage, obtain the RAM credential from the database.

If there is no shared lock, you can read data in the following ways. Specifically, the method 100 further includes: if there is no shared lock, acquiring the target credential from the cache.

For example, according to the foregoing, as shown in FIG. 4 , if there is no shared lock, then according to the RAM credential indicated in the request, the value corresponding to the RAM credential can be directly read from the global cache 401 . That is, step 405 is executed: if there is no shared lock, obtain the RAM credential from the global cache.

If there is no corresponding credential in the cache, the data can be read in the following ways.

Specifically, the method 100 further includes: if there is no target credential in the cache, loading the target credential from the corresponding database, and acquiring the target credential from the cache.

For example, according to the foregoing, if there is no shared lock, and if the cache does not have the corresponding value of the target RAM credential, the value of the target RAM credential can be loaded from the database into the cache, and then the cache Read this value from .

It should be noted that the embodiment of the present application can make the operation of the global cache and the server consistent, and the cache is not actively refreshed after the database update data is completed, and the cache is loaded only when it takes time, so as to ensure consistency. Compared with the database, a global cache can support multiple machines and multiple concurrent requests, especially write requests, so it greatly improves its carrying capacity and responsiveness in scenarios such as batch expansion and sudden traffic increase. Based on this, in other disaster recovery scenarios, such as a power outage, the data in the cache and database can also be finally consistent.

Fig. 5 is a schematic structural diagram of a credential rotation system provided by an exemplary embodiment of the present application. As shown in FIG. 5 , the system 500 may include: a first device 501 and a second device 502 .

Wherein, the first device 501 may be a device with a certain computing capability, and may realize the function of sending data to the second device 502 , and may also receive data sent by the second device 502 . The basic structure of the first device 501 may include: at least one processor. The number of processors may depend on the configuration and type of device having a certain computing power. Devices with certain computing capabilities may also include memory, which may be volatile, such as RAM, or non-volatile, such as read-only memory (Read-Only Memory, ROM), flash memory, etc., or may also be Both types are included. An operating system (Operating System, OS), one or more application programs, and program data may also be stored in the memory. In addition to processing units and memories, devices with certain computing capabilities also include some basic configurations, such as network card chips, IO buses, display components, and some peripheral devices. Optionally, some peripheral devices may include, for example, a keyboard, a stylus, and the like. Other peripheral devices are well known in the art and will not be described here. Optionally, the first device 501 may be a smart terminal, for example, a mobile phone, a desktop computer, a notebook, a tablet computer, and the like.

The second device 502 refers to a device that can provide computing and processing services in a network virtual environment, and may refer to a device that uses a network to perform credential rotation. In terms of physical implementation, the second device 502 may be any device capable of providing computing services and performing credential rotation, for example, it may be a cloud server, a cloud host, a virtual center, a regular server, and the like. The composition of the second device 502 mainly includes a processor, a hard disk, a memory, a system bus, etc., and is similar to a general computer architecture.

Specifically, the second device 502 acquires the target credential to be rotated, creates a replacement credential corresponding to the target credential to be rotated, and stores the target credential to be rotated in the acquisition area; replaces the target credential to be rotated in the acquisition area with the replacement credential for Obtain; delete the target credential to be rotated, and use the replacement data in the fetch area as the target credential to be rotated next time.

The first device 501 can authorize the second device 502 to manage the RAM credential and create the RAM credential to be managed. After the second device 502 receives the authorization and the RAM credentials to be escrowed, the credentials can be rotated.

In addition, the second device 502, after obtaining the target credential to be rotated, determines the operation action corresponding to the target credential to be rotated according to the current time; the operation action includes the operation action of creating a replacement credential, replacing the target credential to be rotated with a replacement credential action and the operation action of deleting the target credential to be rotated.

In addition, the second device 502 stores the created replacement credential in the previous version of the credential corresponding to the credential rotation program, and stores the target credential to be rotated in the current version of the credential corresponding to the credential rotation program, which will be used for the credential rotation The program corresponds to the current version of the credential as the acquisition area.

Specifically, the second device 502 replaces the target credential to be rotated stored in the current version of the credential corresponding to the credential rotation program with replacement data, and stores the target credential to be rotated in the previous version of the credential corresponding to the credential rotation program.

In addition, the second device 502 receives the write request of the target credential to be rotated, creates a shared lock for the target credential to be rotated in the cache according to the write request; clears the target credential to be rotated in the cache, and writes data to the target credential to be rotated in the corresponding database input, so that the target credentials to be rotated are updated; after data is written in the corresponding database, the shared lock in the cache is released to wait for the updated target credentials to be rotated to be loaded.

In addition, the second device 502 receives the read request of the target credential, and determines whether there is a shared lock for the target credential in the cache according to the read request; if there is a shared lock, obtains the corresponding target credential from the corresponding database.

In addition, the second device 502, if there is no shared lock, obtains the target credential from the cache.

In addition, the second device 502, if there is no target credential in the cache, loads the target credential from the corresponding database, and acquires the target credential from the cache.

It should be noted that, for the content that cannot be fully described in the system 500, please refer to the content in the foregoing method 100, and for the specific implementation manner, please refer to the specific implementation manner of the foregoing method 100, and details will not be repeated here.

In the scenario of RAM credential rotation in the embodiment of the present application, as shown in FIG. 5 , the user can log in to a control interface of the cloud second device 502 (such as a server) through the first device 501 (such as a computer), and the interface can For RAM credential hosting, users operate on this interface, perform credential hosting authorization, and send authorization requests or information to the credential rotation program 207 on the cloud server, that is, execute step 201: authorize management of RAM credential. After authorization, the user can log in to another control interface of the cloud server through a computer, and create RAM data to be hosted on this interface, that is, perform step 202: create a RAM credential to be hosted.

After the program 207 for rotating credentials on the cloud server receives the authorization request and the RAM credentials to be managed, it can perform rotation of the RAM credentials to be managed through the resource access control service 208 according to the authorization, that is, perform step 203: rotate RAM data . In the process of rotating data, the program for rotating credentials 207 determines which current credentials to be escrowed have reached the rotation cycle according to the specific time of the rotation cycle, such as 7 days, and the start time of the escrow, and when it is used to trigger the creation of a new RAM After the credential time window arrives, obtain these managed RAM credentials as the target credentials to be rotated, and create a new RAM credential "AK2" corresponding to the RAM credential "AK1" by calling the Open API interface corresponding to the resource access control service 208. If the time window for triggering the replacement of credentials arrives, the credential rotation program 207 on the cloud server replaces "AK1" in the current version with "AK2" in the previous version, that is, "AK2" in the current version after the replacement is " AK2", and "AK1" in the previous version. If the time window for triggering the target credential to be rotated arrives, the credential rotation program 207 on the cloud server deletes the RAM credential "AK1" of the previous version of the corresponding credential by calling the Open API interface corresponding to the resource access control service 208. At this point, the "AK2" in the current version will be used as the target credential to be rotated next time.

The user can obtain the rotated RAM credential through the SDK or client installed on the computer, that is, perform step 503: obtain the rotated RAM credential. Thus, when the user is waiting to access the corresponding cloud service again, he can access the corresponding cloud service through the rotated RAM credentials.

In addition, the user can call the API interface through the computer to send a write request to the cloud server. The write request is used for writing the target credential to be rotated, and the RAM credential stored in the cloud server can be modified to realize the update. Here, other devices may also send write requests through the API interface. When the credential rotation program on the cloud server or the global cache (Global Cache) of the service receives the write request, it determines the corresponding RAM credential from the request, and creates a corresponding shared lock for the RAM credential in the cache. After the shared lock is created, the value corresponding to the corresponding RAM credential can be deleted. Then write the value corresponding to the RAM credential in the write request to the database, and release the shared lock. The user can call the API interface through the computer to send a read request to the cloud server. The read request is a read request for the target credential. The target credential can be a credential that has been rotated or a credential to be rotated. Here, other devices may also send read requests through the API interface. When the credential rotation program on the cloud server or the global cache (Global Cache) of the service receives the read request, it is determined whether the corresponding RAM credential in the cache has a shared lock. If there is a shared lock, read the value corresponding to the corresponding RAM credential from the database according to the RAM credential indicated in the request. If there is no shared lock, then according to the RAM credentials indicated in the request, the value corresponding to the RAM credentials can be directly read from the global cache. If there is no shared lock, and if there is no corresponding value of the target RAM credential in the cache, the value of the target RAM credential may be loaded from the database into the cache, and then the value may be read from the cache.

It should be noted that, for the content that cannot be described in detail here, please refer to the above-mentioned implementation manners, and details will not be repeated here.

In the present embodiment above, the first device 501 and the second device 502 are connected to a network. If the first device 501 and the second device 502 are connected by communication, the network standard of the mobile network can be 2G (GSM), 2.5G (GPRS), 3G (WCDMA, TD-SCDMA, CDMA2000, UTMS), 4G (LTE) , 4G+(LTE+), WiMax, 5G, etc.

Fig. 6 is a schematic structural frame diagram of a credential rotation device provided by an exemplary embodiment of the present application. The device 600 can be applied to a cloud server. The device 600 includes: a creation module 601, a replacement module 602, and a deletion module 603; the functions of each module are described in detail below:

The creating module 601 is configured to acquire a target credential to be rotated, and create a replacement credential corresponding to the target credential to be rotated.

A replacement module 602, configured to replace the target credential to be rotated in the acquisition area with a replacement credential to be acquired.

The deletion module 603 is configured to delete the target credential to be rotated, and use the replacement data in the acquisition area as the target credential to be rotated next time.

In addition, the device 600 also includes: a determination module, configured to determine the operation action corresponding to the target credential to be rotated according to the current time after the target credential to be rotated is obtained; Replace with the action of replacing the credential and the action of deleting the target credential to be rotated.

Specifically, the creating module 601 is specifically configured to: query the credentials to be rotated, and obtain the corresponding type of target credentials to be rotated according to the type of credentials.

In addition, the device 600 also includes: a storing module, configured to store the created replacement credential in the previous version of the credential corresponding to the credential rotation program, and store the target credential to be rotated in the current version of the credential corresponding to the credential rotation program , use the current version of the credential used in the credential rotation program as the acquisition area.

In addition, the replacement module 602 is configured to: replace the target credential to be rotated stored in the current version of the credential corresponding to the credential rotation program with replacement data, and store the target credential to be rotated in the previous version of the credential corresponding to the credential rotation program .

Specifically, the deletion module 603 is configured to delete the target credential to be rotated stored in the previous version of the credential corresponding to the credential rotation program.

In addition, the creation module 601 is also configured to: receive a write request for a target credential to be rotated, and create a shared lock for the target credential to be rotated in the cache according to the write request; the device 600 also includes: a write module, used to clear the cache to be rotated The target credential writes data in the corresponding database for the target credential to be rotated, so that the target credential to be rotated is updated; the release module is used to release the shared lock in the cache after writing data in the corresponding database to be rotated Loading of the updated target credentials to be rotated.

In addition, the determining module is also configured to: receive a read request of the target credential, and determine whether there is a shared lock for the target credential in the cache according to the read request; the apparatus 600 also includes an acquiring module, configured to obtain the corresponding Get the corresponding target credentials from the database.

In addition, the acquisition module is also used to obtain the target credentials from the cache if there is no shared lock.

In addition, the apparatus 600 further includes: a loading module, configured to load the target credential from the corresponding database if the cache does not have the target credential, and acquire the target credential from the cache.

For the specific implementation manners above, please refer to the specific implementation manners described above, and details will not be repeated here.

The internal functions and structure of the apparatus 600 shown in FIG. 6 are described above. In a possible design, the structure of the apparatus 600 shown in FIG. 6 can be implemented as a computing device, such as a cloud server. As shown in FIG. 7, the device 700 may include: a memory 701 and a processor 702;

The memory 701 is used for storing computer programs.

The processor 702 is configured to execute a computer program for: acquiring a target credential to be rotated, creating a replacement credential corresponding to the target credential to be rotated, storing the target credential to be rotated in the acquisition area; replacing the target credential to be rotated in the acquisition area It is a replacement credential to be obtained; delete the target credential to be rotated, and use the replacement data in the acquisition area as the target credential to be rotated next time.

In addition, the processor 702 is also configured to: after obtaining the target credential to be rotated, determine the operation action corresponding to the target credential to be rotated according to the current time; the operation action includes creating a replacement credential, replacing the target credential to be rotated with a replacement The operation action of the credential and the operation action of deleting the target credential to be rotated.

Specifically, the processor 702 is specifically configured to: query the credentials to be rotated, and acquire the corresponding type of target credentials to be rotated according to the type of credentials.

In addition, the processor 702 is also configured to: store the created replacement credential in the previous version of the credential corresponding to the credential rotation program, store the credential to be rotated in the current version of the credential corresponding to the credential rotation program, and use The current version of the credential corresponding to the credential rotation program is used as the acquisition area.

In addition, the processor 702 is also configured to: replace the target credential to be rotated stored in the current version of the credential corresponding to the credential rotation program with replacement data, and store the target credential to be rotated in the previous version of the credential corresponding to the credential rotation program middle.

Specifically, the processor 702 is specifically configured to: delete the target credential to be rotated stored in the previous version of the credential corresponding to the credential rotation program.

In addition, the processor 702 is also configured to: receive a write request for the target credential to be rotated, and create a shared lock for the target credential to be rotated in the cache according to the write request; Write data so that the target credentials to be rotated are updated; after writing the data in the corresponding database, release the shared lock in the cache to load the updated target credentials to be rotated.

In addition, the processor 702 is also configured to: receive a read request of the target credential, determine whether there is a shared lock for the target credential in the cache according to the read request; if there is a shared lock, obtain the corresponding target credential from the corresponding database.

In addition, the processor 702 is further configured to: if there is no shared lock, acquire the target credential from the cache.

In addition, the processor 702 is further configured to: if there is no target credential in the cache, load the target credential from the corresponding database, and acquire the target credential from the cache.

In addition, an embodiment of the present invention provides a computer storage medium. When the computer program is executed by one or more processors, one or more processors are caused to implement a credential rotation method in the method embodiments shown in FIGS. 1-4 . step.

In addition, in some of the processes described in the above embodiments and accompanying drawings, multiple operations appearing in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear herein or executed in parallel , the serial numbers of the operations, such as 101, 102, 103, etc., are only used to distinguish different operations, and the serial numbers themselves do not represent any execution order. Additionally, these processes can include more or fewer operations, and these operations can be performed sequentially or in parallel. It should be noted that the descriptions of "first" and "second" in this article are used to distinguish different messages, devices, modules, etc. are different types.

The device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed to multiple network elements. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without any creative effort.

Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be realized by means of a general hardware platform plus necessary, and of course, can also be realized by a combination of hardware and software. Based on such an understanding, the above-mentioned technical solution can be embodied in the form of computer products in essence or in other words, the part that contributes to the prior art, and the present invention can adopt computer-usable media (including but not limited to disk storage, CD-ROM, optical storage, etc.) embodied in the form of a computer program product.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable multimedia data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable multimedia data processing equipment Produce means for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable multimedia data processing device to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the The instruction means implements the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded on a computer or other programmable multimedia data processing device, so that a series of operation steps are performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device The instructions provide steps for implementing the functions specified in the procedure or procedures of the flowchart and/or the block or blocks of the block diagram.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

Memory may include non-permanent storage in computer-readable media, in the form of random access memory (RAM) and/or nonvolatile memory such as read-only memory (ROM) or flash RAM. Memory is an example of computer readable media.

Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can be implemented by any method or technology for storage of information. Information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Flash memory or other memory technology, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, Magnetic tape cartridge, tape magnetic disk storage or other magnetic storage device or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media excludes transitory computer-readable media, such as modulated data signals and carrier waves.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

A credential rotation method, characterized by comprising:

Acquiring the target credential to be rotated, creating a replacement credential corresponding to the target credential to be rotated, and storing the target credential to be rotated in the acquisition area;

replacing the to-be-rotated target credential in the acquisition area with the replacement credential for acquisition;

The target credential to be rotated is deleted, and the replacement data in the acquisition area is used as the target credential to be rotated next time.
The method according to claim 1, further comprising:

After acquiring the target credential to be rotated, determine the operation action corresponding to the target credential to be rotated according to the current time;

The operation action includes an operation action of creating a replacement credential, an operation action of replacing the target credential to be rotated with the replacement credential, and an operation action of deleting the target credential to be rotated.
The method according to claim 1, wherein said obtaining the target credentials to be rotated comprises:

Query the credentials to be rotated, and obtain the corresponding target credentials to be rotated according to the credential type.
The method according to claim 1, further comprising:

Store the created replacement credential in the previous version of the credential corresponding to the credential rotation program, and store the target credential to be rotated in the current version of the credential corresponding to the credential rotation program, which will be used in the current version of the credential corresponding to the credential rotation program version as the fetch area.
The method according to claim 1, wherein the replacing the target credential to be rotated in the acquisition area with the replacement credential comprises:

The replacement data is used to replace the target credential to be rotated stored in the current version of the credential corresponding to the credential rotation program, and the target credential to be rotated is stored in the previous version of the credential corresponding to the credential rotation program.
The method according to claim 5, wherein the deleting the target credential to be rotated comprises:

Delete the target credential to be rotated stored in the previous version of the credential used in the credential rotation program.
The method according to claim 1, further comprising:

receiving a write request for the target credential to be rotated, and creating a shared lock for the target credential to be rotated in the cache according to the write request;

clearing the target credential to be rotated in the cache, and writing data to the target credential to be rotated in the corresponding database, so that the target credential to be rotated is updated;

After the data is written in the corresponding database, the shared lock in the cache is released to wait for the loading of the updated target credentials to be rotated.
The method according to claim 7, wherein the method further comprises:

receiving a read request for the target credential, and determining whether there is a shared lock for the target credential in the cache according to the read request;

If there is a shared lock, the corresponding target credential is obtained from the corresponding database.
The method according to claim 8, characterized in that the method further comprises:

If no shared lock exists, the target credential is acquired from the cache.
The method according to claim 9, characterized in that the method further comprises:

If the target credential does not exist in the cache, load the target credential from the corresponding database, and acquire the target credential from the cache.
A computing device, comprising: a memory, a processor;

The memory is used to store computer programs;

The processor executes the computer program for:

Acquiring the target credential to be rotated, creating a replacement credential corresponding to the target credential to be rotated, and storing the target credential to be rotated in the acquisition area;

replacing the to-be-rotated target credential in the acquisition area with the replacement credential for acquisition;

The target credential to be rotated is deleted, and the replacement data in the acquisition area is used as the target credential to be rotated next time.
A computer-readable storage medium storing a computer program, characterized in that, when the computer program is executed by one or more processors, the one or more processors are caused to implement the method described in any one of claims 1-10 in the steps.