WO2023246060A1 - Procédé et appareil d'authentification et d'autorisation d'utilisateur, et support et dispositif - Google Patents

Procédé et appareil d'authentification et d'autorisation d'utilisateur, et support et dispositif Download PDF

Info

Publication number
WO2023246060A1
WO2023246060A1 PCT/CN2022/142487 CN2022142487W WO2023246060A1 WO 2023246060 A1 WO2023246060 A1 WO 2023246060A1 CN 2022142487 W CN2022142487 W CN 2022142487W WO 2023246060 A1 WO2023246060 A1 WO 2023246060A1
Authority
WO
WIPO (PCT)
Prior art keywords
cloud
cloud service
authentication
service authentication
network interoperability
Prior art date
Application number
PCT/CN2022/142487
Other languages
English (en)
Chinese (zh)
Inventor
李阳春
刘艺
林宝洪
黄志兰
樊勇兵
Original Assignee
中国电信股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国电信股份有限公司 filed Critical 中国电信股份有限公司
Publication of WO2023246060A1 publication Critical patent/WO2023246060A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network

Definitions

  • the present disclosure relates to the field of communication technology and the field of cloud computing, and in particular to a user authentication and authorization method, a user authentication and authorization device, a computer-readable storage medium and an electronic device.
  • Authentication and authorization of user terminals is an indispensable and important link in the process of user terminals using access services or cloud services.
  • cloud service authentication and cloud resource authorization are independent of the authentication service process on the access side.
  • the authorization information returned by the authentication server is usually only related to the access service or data channel, such as IP (Internet Protocol) allocation, port, MTU (Maximum Transmission Unit, maximum transmission unit), PPP (Point to Point Protocol, Point-to-point protocols), etc., do not involve cloud resource application and activation, cloud service activation and other services.
  • IP Internet Protocol
  • MTU Maximum Transmission Unit, maximum transmission unit
  • PPP Point to Point Protocol, Point-to-point protocols
  • a user authentication and authorization processing method is provided, which is applied to network access and cloud service authentication and cloud resource authorization.
  • the method includes: in response to receiving an authentication request sent by an access gateway, performing Access authentication of the user terminal, wherein the authentication request is generated by the user terminal and sent to the access gateway; initiating a cloud service authentication request to the cloud service authentication module, so that the cloud service authentication module is based on the cloud service authentication module.
  • the service authentication request performs cloud service authentication of the user terminal; and initiates a cloud network interoperability detection request to the cloud network interoperability detection module, so that the cloud network interoperability detection module performs cloud network interoperability detection request of the user terminal based on the cloud network interoperability detection request.
  • Network interoperability detection is provided, which is applied to network access and cloud service authentication and cloud resource authorization.
  • initiating a cloud service authentication request to the cloud service authentication module so that the cloud service authentication module performs cloud service authentication of the user terminal based on the cloud service authentication request includes: Send a cloud service authentication request to the cloud service authentication module, so that the cloud service authentication module obtains cloud service authentication information based on the cloud service authentication request, and performs cloud service authentication of the user terminal based on the cloud service authentication information.
  • the cloud service authentication module after receiving the cloud service authentication request, the cloud service authentication module initializes the cloud service authentication information corresponding to the user terminal, and completes the cloud service authentication information based on the cloud service authentication information.
  • Cloud service authentication of the user terminal obtains cloud resource authorization parameters, and returns the cloud service authentication result and the cloud resource authorization parameters to the authentication server.
  • the cloud network interoperability detection request is initiated to the cloud network interoperability detection module, so that the cloud network interoperability detection module performs cloud network interoperability detection on the user terminal based on the cloud network interoperability detection request.
  • Interoperability detection includes: initiating a cloud-network interoperability detection request to the cloud-network interoperability detection module, so that the cloud-network interoperability detection module obtains cloud-network interoperability detection parameters based on the cloud-network interoperability detection request, and detects cloud-network interoperability based on the cloud-network interoperability detection module. Parameters are used to detect cloud-network interoperability of the user terminal.
  • the cloud network interoperability detection module after receiving the cloud network interoperability detection request, the cloud network interoperability detection module initializes the detection record of the user terminal, and determines the cloud network interoperability detection parameter according to the cloud network interoperability detection parameter. Interoperability detection strategy, and deliver the parameter information of the cloud resource pool access end and the cloud network interoperability detection strategy to the access gateway, so that the access gateway provides the cloud resource pool with an interoperability detection strategy based on the cloud network interoperability detection strategy.
  • the access terminal initiates cloud-network interoperability detection and returns the cloud-network interoperability detection result to the cloud-network interoperability detection module.
  • the method further includes: returning the access authentication result and access authorization parameter corresponding to the user terminal to the access Gateway, so that the access gateway configures according to the access authentication result and the access authorization parameter.
  • the method further includes: receiving the cloud service authentication result and cloud resources corresponding to the user terminal returned by the cloud service authentication module.
  • Authorization parameters Return the cloud service authentication result and the cloud resource authorization parameter corresponding to the user terminal to the access gateway, so that the access gateway Configure resource authorization parameters.
  • the method further includes: receiving the cloud network interoperability detection result corresponding to the user terminal returned by the cloud network interoperability detection module, and converting the cloud network interoperability detection result corresponding to the user terminal into The interoperability detection result is returned to the access gateway, so that the access gateway configures according to the cloud network interoperability detection result.
  • a user authentication and authorization processing device which is applied to network access and cloud service authentication and cloud resource authorization.
  • the device includes: an access authentication module, configured to respond to receiving the The authentication request sent by the gateway performs access authentication of the user terminal, where the authentication request is generated by the user terminal and sent to the access gateway; a cloud service authentication initiation module is used to initiate cloud services to the cloud service authentication module Authentication request, so that the cloud service authentication module performs cloud service authentication of the user terminal based on the cloud service authentication request; a cloud network interoperability detection initiation module, used to initiate a cloud network interoperability detection request to the cloud network interoperability detection module, So that the cloud network interoperability detection module performs cloud network interoperability detection of the user terminal based on the cloud network interoperability detection request.
  • a computer-readable storage medium on which a computer program is stored.
  • the computer program is executed by a processor, the above-mentioned user authentication and authorization processing method is implemented.
  • an electronic device including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the operation via executing the executable instructions. Execute the above user authentication and authorization processing method.
  • Figure 1 shows the system architecture executed by a user authentication and authorization processing method in this exemplary embodiment
  • Figure 2 shows a flow chart of a user authentication and authorization processing method in this exemplary embodiment
  • Figure 3 shows an access authentication flow chart executed by the authentication server in this exemplary embodiment
  • Figure 4 shows a cloud service authentication flow chart executed by the cloud service authentication module in this exemplary embodiment
  • Figure 5 shows a flow chart of feedback of cloud-network interoperability detection results executed by the cloud-network interoperability detection module in this exemplary embodiment
  • Figure 6 shows an interaction example diagram of user authentication and authorization in this exemplary embodiment
  • Figure 7 shows a structural block diagram of a user authentication and authorization processing device in this exemplary embodiment
  • FIG. 8 shows an electronic device used to implement the above user authentication and authorization processing method in this exemplary embodiment.
  • Example embodiments will now be described more fully with reference to the accompanying drawings.
  • Example embodiments may, however, be embodied in various forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concepts of the example embodiments.
  • the described features, structures or characteristics may be combined in any suitable manner in one or more embodiments.
  • numerous specific details are provided to provide a thorough understanding of embodiments of the disclosure.
  • those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details described, or other methods, components, devices, steps, etc. may be adopted.
  • well-known technical solutions have not been shown or described in detail to avoid obscuring aspects of the disclosure.
  • access authentication and authorization, cloud service authentication and authorization adopt independent processes, lacking coordination, and user terminals need to complete authentication twice.
  • This method may have the following problems: it is inconvenient for users; the authentication information is fragmented, which increases security risks; the authentication channel and access channel of the cloud business are not guaranteed to be consistent, and the cloud business authentication and authorization cannot guarantee that the cloud business is available; it is not conducive to implementation
  • the synergistic advantages of access service providers and cloud service providers may have the following problems: it is inconvenient for users; the authentication information is fragmented, which increases security risks; the authentication channel and access channel of the cloud business are not guaranteed to be consistent, and the cloud business authentication and authorization cannot guarantee that the cloud business is available; it is not conducive to implementation
  • the synergistic advantages of access service providers and cloud service providers are examples of access service providers and cloud service providers.
  • exemplary embodiments of the present disclosure provide a user authentication authorization processing method. This user authentication and authorization processing method can be applied to scenarios where user terminals use access services and cloud services at the same time.
  • the user authentication and authorization processing method can be deployed in the network architecture 100 shown in Figure 1 and executed by the authentication server 110 in the network architecture 100.
  • the network architecture 100 may include: an authentication server 110, a cloud service authentication module 120, a cloud network interoperability detection module 130, an access gateway 140, a user terminal 150, and a cloud resource pool access terminal 160.
  • the authentication server 110 includes but is not limited to AAA server or DN-AAA (Data Network-Authentication, Authorization, Accounting) server of the 5G network, etc., and can be connected with the cloud service authentication module 120, the cloud network interoperability detection module 130 and the access gateway. 140 communicates, can receive the authentication request sent by the access gateway 140, can obtain the cloud service authentication results and cloud resource authorization parameters and other data returned by the cloud service authentication module 120, and can obtain the access data returned by the cloud network interoperability detection module 130. Data such as interoperability detection results between the gateway and cloud resources can also be returned to the access gateway 140, such as authorization information.
  • the cloud service authentication module 120 may be responsible for cloud service authentication, generating and maintaining cloud resource authorization parameters.
  • the cloud network interoperability detection module 130 may be responsible for detecting and maintaining network connectivity between the access gateway 140 and the cloud resource pool access terminal 160, and returning the detection results to the authentication server.
  • the access gateway 140 can send the authentication request to the authentication server 110 when the user terminal 150 initiates the authentication request, and obtain access authorization parameters, cloud resource authorization parameters, cloud network interoperability detection results and other information from the authentication server 110 to complete the access.
  • the user terminal 150 can be mounted on smart devices capable of network communication, such as smartphones, computers, smart monitoring systems, and vehicle-mounted systems.
  • the cloud resource pool access terminal 160 can provide cloud resource access services.
  • FIG. 2 shows a schematic flow of a user authentication and authorization processing method in this exemplary embodiment. It is applied to network access and cloud service authentication and cloud resource authorization, and may include the following steps S210 to step S230:
  • Step S210 In response to receiving the authentication request sent by the access gateway, perform access authentication of the user terminal, where the authentication request is generated by the user terminal and sent to the access gateway;
  • Step S220 Initiate a cloud service authentication request to the cloud service authentication module, so that the cloud service authentication module performs cloud service authentication of the user terminal based on the cloud service authentication request;
  • Step S230 Initiate a cloud-network interoperability detection request to the cloud-network interoperability detection module, so that the cloud-network interoperability detection module performs cloud-network interoperability detection on the user terminal based on the cloud-network interoperability detection request.
  • Step S210 In response to receiving the authentication request sent by the access gateway, perform access authentication of the user terminal, where the authentication request is generated by the user terminal and sent to the access gateway.
  • the user terminal can initiate authentication to the access gateway, and the access gateway sends the authentication request of the user terminal to the authentication server. After receiving the authentication request sent by the access gateway, the authentication server can perform access authentication on the user terminal. .
  • the above-mentioned access authentication of the user terminal can be implemented through the following steps: parsing the authentication request to obtain the access authentication information; performing access authentication on the user terminal based on the access authentication information.
  • the access authentication information includes but is not limited to user name, user account and other information. The details can be determined by the access authentication mechanism configured by the authentication server, and are not specifically limited here.
  • the authentication server can return the access authentication result to the access gateway, so that the access gateway can feed back the access authentication result to the user terminal.
  • the following steps may also be performed: return the access authentication result and access authorization parameters corresponding to the user terminal to the access gateway, so that the access The gateway is configured based on the access authentication results and access authorization parameters.
  • the authentication server can feed back access authentication passing information and access authorization parameters to the access gateway, so that the access gateway can configure the access authorization parameters for the user terminal, so that the user terminal can Use access services normally.
  • the authentication server can directly return access authentication failure information to the access gateway, and the access gateway feeds back the access authentication failure information to the user terminal to end this authentication and authorization process. .
  • an access authentication flow chart executed by an authentication server is provided, which may include the following steps:
  • Step S301 Receive the authentication request sent by the access gateway
  • Step S302 parse the authentication information to obtain access authentication information
  • Step S303 Perform access authentication on the user terminal according to the access authentication information
  • Step S304 Determine whether the access authentication passes. If it passes, execute step S305. If it fails, execute step S306;
  • Step S305 Return access authentication passing information and access authorization parameters to the access gateway
  • Step S306 Return access authentication failure information to the access gateway.
  • the access authentication result and access authorization parameters can be returned to the access gateway in real time. You can also wait for the execution of steps S220 and S230 to complete. The information that needs to be returned to the access gateway is returned together to reduce the number of communications.
  • the authentication server can determine whether the user terminal has cloud services. If not, it can directly return the access authentication result to the access gateway; if so, it can continue to step S220 with reference to Figure 2.
  • Step S220 Initiate a cloud service authentication request to the cloud service authentication module, so that the cloud service authentication module performs cloud service authentication of the user terminal based on the cloud service authentication request.
  • the authentication server may initiate a cloud service authentication request to the cloud service authentication module after determining that the user terminal has the cloud service. After receiving the cloud service authentication request, the cloud service authentication module can perform cloud service authentication on the user terminal according to the received cloud service authentication request.
  • the above-mentioned initiating a cloud service authentication request to the cloud service authentication module so that the cloud service authentication module performs cloud service authentication of the user terminal based on the cloud service authentication request.
  • this can be achieved through the following steps:
  • the cloud service authentication module sends a cloud service authentication request, so that the cloud service authentication module obtains cloud service authentication information based on the cloud service authentication request, and performs cloud service authentication of the user terminal based on the cloud service authentication information.
  • Cloud service authentication information may include, but is not limited to, part or all of user name, password, cloud service identifier, cloud service domain name, cloud service IP address and other information.
  • the authentication server can directly use the user name and password of the user connected to the user terminal as the cloud service authentication information.
  • the details can be determined by the cloud service authentication mechanism configured in the cloud service authentication module, which is not specifically limited here.
  • the authentication server can generate cloud service authentication information based on the access information, append the cloud service authentication information to the cloud service authentication request, and send the cloud service authentication request with the cloud service authentication information appended to the cloud service authentication module.
  • the cloud service authentication module can obtain the cloud service authentication information by parsing the cloud service authentication request, and perform cloud service authentication on the user terminal based on the cloud service authentication information.
  • the access information may include the access user's user name, password, session ID, user identity, and information obtained by the authentication server after completing user access authentication.
  • the authentication server may append the access authentication information to the cloud service authentication request, and send the cloud service authentication request to the cloud service authentication module.
  • the cloud service authentication module obtains access authentication information by parsing the cloud service authentication request; generates cloud service authentication information based on the access authentication information; and performs cloud service authentication on the user terminal based on the cloud service authentication information.
  • the authentication server may send the cloud service authentication request to the cloud service authentication module.
  • the cloud service authentication module can respond to the received cloud service authentication request, query the local cache, obtain the historical authentication record of the user accessed by the user terminal, and obtain the cloud service authentication information based on the historical authentication record; verify the user based on the cloud service authentication information
  • the terminal performs cloud service authentication.
  • the authentication server may send the cloud service authentication request to the cloud service authentication module.
  • the cloud service authentication module can respond to the received cloud service authentication request, obtain cloud service authentication information from a third-party module or through external API (Application Programming Interface, application programming interface) configuration; perform authentication on the user terminal based on the cloud service authentication information Cloud business certification.
  • the third-party module represents a source of cloud service authentication information, such as an external system used to manage and maintain users' cloud service authentication information.
  • the authentication server realizes the cloud service authentication of the user terminal through interaction with the cloud service authentication module, connecting the access authentication service and the cloud service authentication service to simplify the user authentication and authorization process, thereby improving user authentication and authorization. s efficiency.
  • the cloud service authentication module can also initialize the cloud service authentication information corresponding to the user terminal; complete the cloud service authentication of the user terminal according to the cloud service authentication information, obtain the cloud resource authorization parameters; and return the cloud service to the authentication server. Authentication results and cloud resource authorization parameters, so that the subsequent authentication server can feed back the cloud service authentication results and cloud resource authorization parameters to the access gateway.
  • the following steps may also be performed: receiving the cloud service authentication result and cloud resource authorization parameters corresponding to the user terminal returned by the cloud service authentication module; The corresponding cloud service authentication result and cloud resource authorization parameters are returned to the access gateway, so that the access gateway performs configuration according to the cloud service authentication result and cloud resource authorization parameters.
  • the cloud service authentication module can return the cloud service authentication passing information and cloud resource authorization parameters to the authentication server, and feed back the cloud service authentication passing information and cloud resource authorization parameters to the access gateway through the authentication server. , so that the access gateway can configure the cloud resource authorization parameters for the user terminal, so that the user terminal can use cloud services normally.
  • the information returned by the cloud service authentication module to the authentication server may also include but is not limited to: some or all of the cloud service identifier, cloud service domain name and other information.
  • Cloud resource authorization parameters may include but are not limited to some or all of the following information:
  • Resource type such as virtual machine, container/pod, physical machine
  • vCPU Virtual Central Processing Unit, virtual processor
  • memory storage and other parameters.
  • a pod can be viewed as a collection of containers.
  • the cloud service authentication module can directly return the cloud service authentication failed information to the authentication server, and the authentication server returns the cloud service authentication failed information to the user terminal through the access gateway to end this section. Sub-authentication and authorization process.
  • a cloud service authentication flow chart executed by the cloud service authentication module is provided, which may include the following steps:
  • Step S401 In response to the received cloud service authentication request, perform cloud service authentication
  • Step S402 obtain cloud service authentication results and cloud resource authorization parameters
  • Step S403 Determine whether the cloud service authentication result passes. If it passes, execute step S404. If it fails, execute step S405;
  • Step S404 Return cloud service authentication passing information and cloud resource authorization parameters to the authentication server;
  • Step S405 Return cloud service authentication failure information to the authentication server.
  • the authentication server can return the cloud service authentication results and cloud resource authorization parameters to the access gateway in real time if the cloud service authentication passes. It can also wait for the completion of step S230 and return the required information. The information to the access gateway is returned together to reduce the number of communications.
  • step S230 to perform cloud network interoperability detection.
  • Step S230 Initiate a cloud-network interoperability detection request to the cloud-network interoperability detection module, so that the cloud-network interoperability detection module performs cloud-network interoperability detection on the user terminal based on the cloud-network interoperability detection request.
  • the authentication server can send a cloud-network interoperability detection request to the cloud-network interoperability detection module.
  • the cloud network interoperability detection module can perform cloud network interoperability detection on the user terminal according to the cloud network interoperability detection request.
  • the above-mentioned method of initiating a cloud-network interoperability detection request to the cloud-network interoperability detection module, so that the cloud-network interoperability detection module performs cloud-network interoperability detection of the user terminal based on the cloud-network interoperability detection request can be done in the following manner To achieve: Initiate a cloud-network interoperability detection request to the cloud-network interoperability detection module, so that the cloud-network interoperability detection module obtains the cloud-network interoperability detection parameters based on the cloud-network interoperability detection request, and performs cloud-network interoperability of the user terminal based on the cloud-network interoperability detection parameters. detection.
  • the parameters carried by the cloud network interoperability detection request may include but are not limited to: user identity, access gateway parameters (such as IP address, etc.), cloud service identifier, cloud service domain name, cloud service IP address, cloud resource authorization parameters and other information Part or all of it can be determined by the cloud-network interoperability detection mechanism configured in the cloud-network interoperability detection module, and there is no specific limit here.
  • a flow chart of feedback of cloud-network interoperability detection results executed by the cloud-network interoperability detection module is provided, which may include the following steps:
  • Step S501 After receiving the cloud-network interoperability detection request, the cloud-network interoperability detection parameters can be obtained by parsing the cloud-network interoperability detection request;
  • Step S502 determine whether the preset detection period is met, if not, continue to step S503, if so, jump to step S504;
  • Step S503 query the locally stored historical detection records of the previous detection cycle
  • Step S504 determine whether the historical detection record is queried, if not, continue to step S505, if so, jump to step S506;
  • Step S505 Initiate cloud-network interoperability detection, receive cloud-network interoperability detection results, and update detection records;
  • Step S506 Return the cloud network interoperability detection results.
  • Historical detection records include but are not limited to the following parameters: source parameters, destination parameters, detection methods, and detection results.
  • the source end and the destination end can respectively refer to the access gateway and the cloud resource pool access end.
  • the source end parameters can be, for example, the IP address of the access gateway, and the destination end parameters can be, for example, the domain name and IP address of the cloud resource pool access end;
  • the detection method can be Including but not limited to ping, HTTP (Hyper Text Transfer Protocol, Hypertext Transfer Protocol) access, etc.; detection results include but are not limited to the average of single or multiple detection results obtained during the detection process, such as delay, packet loss rate average etc.
  • ping can be used to determine whether the source end can successfully exchange (send and receive) data packets with the destination end, and then based on the returned information, infer whether the TCP/IP parameters are set correctly, whether the operation is normal, whether the network is smooth, etc.
  • HTTP is a request-response protocol that usually runs on top of the TCP protocol and can specify the messages that the source end may send to the destination end and the response received.
  • the cloud-network interoperability detection module does not need to perform cloud-network interoperability detection every time, which can shorten the time for returning cloud-network interoperability detection results to a certain extent and further improve User authentication and authorization efficiency.
  • the cloud-network interoperability detection can also be performed after receiving the cloud-network interoperability detection request to obtain the latest detection results.
  • the two methods of periodic detection and real-time detection can be set according to actual needs, and there are no specific limitations here.
  • the cloud-network interoperability detection module can obtain the cloud-network interoperability detection parameters through any of the following methods, which are not specifically limited here.
  • the authentication server can obtain the cloud-network interoperability detection parameters from the access authentication information, cloud service authentication information, and cloud resource authorization parameters, and append the cloud-network interoperability detection parameters to the cloud-network interoperability detection request and send it to the cloud-network interoperability detection module.
  • the cloud-network interoperability detection module can obtain the cloud-network interoperability detection parameters by parsing the cloud-network interoperability detection request.
  • the authentication server can append access authentication information, cloud service authentication information, and cloud resource authorization parameters to the cloud-network interoperability detection request and send it to the cloud-network interoperability detection module, and the cloud-network interoperability detection module obtains the access authentication information, Cloud network interoperability detection parameters are obtained from the cloud service authentication information and cloud resource authorization information.
  • the cloud-network interoperability detection module may respond to the received cloud-network interoperability detection request and generate cloud-network interoperability detection parameters based on the historical detection records of the previous detection cycle.
  • the cloud-network interoperability detection module may, in response to the received cloud-network interoperability detection request, obtain the cloud-network interoperability detection parameters from an external system that manages and maintains the user's cloud interoperability detection parameters or through external API configuration.
  • the authentication server or cloud-network interoperability detection module when the above-mentioned authentication server or cloud-network interoperability detection module obtains the cloud-network interoperability detection parameters from the access authentication information, cloud service authentication information, and cloud resource authorization parameters, the authentication server or cloud-network interoperability detection module can obtain the cloud-network interoperability detection parameters from the access authentication information.
  • the source parameters such as the IP address of the access gateway
  • obtain the destination detection parameters from the cloud resource authorization parameters such as the IP address of the cloud resource pool access end.
  • the authentication server realizes cloud network interoperability detection through interaction with the cloud network interoperability detection module, which can ensure the availability of cloud resources and thereby improve the user's cloud resource access experience.
  • the cloud-network interoperability detection module after receiving the cloud-network interoperability detection request, the cloud-network interoperability detection module initializes the detection record of the user terminal; determines the cloud-network interoperability detection strategy according to the cloud-network interoperability detection parameters; and downloads the download to the access gateway. Send the parameter information of the cloud resource pool access end and the cloud network interoperability detection strategy, so that the access gateway initiates the cloud network interoperability detection to the cloud resource pool access end based on the cloud network interoperability detection strategy, and returns the cloud network interoperability detection to the cloud network interoperability detection module result.
  • the cloud network interoperability detection module realizes interoperability detection between the access gateway and the cloud resource pool access end through interaction with the access gateway. By detecting and maintaining the interoperability between the access gateway and the cloud resource pool access end, Network connectivity between cloud resources ensures that authorized cloud resource services can be accessed by user terminals.
  • the cloud-network interoperability detection module can also determine the cloud-network interoperability detection strategy of the user terminal based on this cache; the cloud-network interoperability detection module can also configure the cloud-network interoperability detection strategy of the user terminal from an external device through the external API port.
  • the cloud network interoperability detection result corresponding to the user terminal returned by the cloud network interoperability detection module is received, and the cloud network interoperability detection result corresponding to the user terminal is returned to the access gateway, so that the access gateway
  • the ingress gateway is configured based on the cloud network interoperability detection results.
  • the authentication server can feedback the cloud-network interoperability detection results to the access gateway to prompt the access gateway that the user terminal that has been authenticated and authorized can access the cloud resource pool access terminal.
  • the authentication server can receive Input authentication results, access authorization parameters, cloud service authentication results and cloud resource authorization parameters, generate authorization information, and return the authorization information to the access gateway.
  • the authorization information can be defined according to the TLV (Tag, length, value, attribute type, length, value) format.
  • the attribute type can be used to describe the type of authorization information returned by the authentication server to the access gateway, which can include but is not limited to the following types: user identity identifier, access service identifier, access user's IP address, cloud service identifier, cloud resource Authorization parameters (such as vCPU, memory, disk size), cloud network interoperability detection parameters (encapsulation type, access gateway IP address, cloud resource pool access end address, etc.), cloud network interoperability detection results, etc.
  • Length can be used to describe the length of the attribute value corresponding to the corresponding attribute type. Values can be used to describe the attribute value corresponding to the corresponding attribute type.
  • the transmission protocol used may include but is not limited to the Radius (Remote Authentication Dial-In User Server, Remote Authentication Dial-In User Service) protocol.
  • an interaction example diagram of user authentication and authorization is also provided, as shown in Figure 6 .
  • the authentication server may perform step S601: in response to receiving the authentication request sent by the access gateway, perform access authentication of the user terminal; initiate a cloud service authentication request to the cloud service authentication module; initiate cloud network interoperability detection to the cloud network interoperability detection module ask;
  • the cloud service authentication module can perform step S602: obtain cloud service authentication parameters based on the cloud service authentication request, perform cloud service authentication of the user terminal according to the cloud service authentication parameters, and return the cloud service authentication results and cloud resource authorization parameters to the authentication server;
  • the cloud-network interoperability detection module can perform step S603: obtain cloud-network interoperability detection parameters based on the cloud-network interoperability detection request, perform cloud-network interoperability detection on the user terminal based on the cloud-network interoperability detection parameters, and return the cloud-network interoperability detection results to the authentication server;
  • the authentication server may perform step S604: determine the authorization information based on the access authentication results, access authorization parameters, cloud service authentication results, cloud resource authorization parameters and cloud network interoperability detection results, and return the authorization information to the access gateway to enable access The gateway completes local configuration.
  • the authentication server completes the access authentication, cloud service authentication, and cloud-network interoperability detection, and carries the access authorization parameters, cloud resource authorization parameters, and cloud-network interoperability detection results in the authorization information returned by the authentication server.
  • open up the authentication process of access business and cloud business and the access gateway completes the configuration according to the authorization information, which can simplify the user's business use process, enhance the convenience and security of users' use of cloud business, and thus catalyze the rapid and healthy development of cloud network business .
  • Exemplary embodiments of the present disclosure also provide a user authentication and authorization processing device, which is applied to network access and cloud service authentication and cloud resource authorization.
  • the user authentication and authorization processing device 700 may include:
  • the access authentication module 710 is configured to perform access authentication of the user terminal in response to receiving an authentication request sent by the access gateway, where the authentication request is generated by the user terminal and sent to the access gateway;
  • the cloud service authentication initiation module 720 is configured to initiate a cloud service authentication request to the cloud service authentication module, so that the cloud service authentication module performs cloud service authentication of the user terminal based on the cloud service authentication request;
  • the cloud-network interoperability detection initiating module 730 is configured to initiate a cloud-network interoperability detection request to the cloud-network interoperability detection module, so that the cloud-network interoperability detection module performs cloud-network interoperability detection on the user terminal based on the cloud-network interoperability detection request.
  • the cloud service authentication initiation module 720 may be configured to: send a cloud service authentication request to the cloud service authentication module, so that the cloud service authentication module obtains the cloud service authentication parameters based on the cloud service authentication request, And perform cloud service authentication of the user terminal according to the cloud service authentication parameters.
  • the cloud service authentication module can initialize the cloud service authentication information corresponding to the user terminal, and complete the cloud service authentication of the user terminal based on the cloud service authentication information to obtain the cloud service authentication request. Resource authorization parameters, and returns the cloud service authentication results and cloud resource authorization parameters to the authentication server.
  • the cloud-network interoperability detection initiating module 730 may be configured to: initiate a cloud-network interoperability detection request to the cloud-network interoperability detection module, so that the cloud-network interoperability detection module obtains data based on the cloud-network interoperability detection request.
  • Cloud network interoperability detection parameters, and cloud network interoperability detection of user terminals is performed based on the cloud network interoperability detection parameters.
  • the cloud-network interoperability detection module after receiving the cloud-network interoperability detection request, the cloud-network interoperability detection module initializes the detection record of the user terminal, determines the cloud-network interoperability detection strategy according to the cloud-network interoperability detection parameters, and reports to the access
  • the gateway delivers the parameter information of the cloud resource pool access end and the cloud network interoperability detection policy, so that the access gateway initiates cloud network interoperability detection to the cloud resource pool access end based on the cloud network interoperability detection policy, and returns the cloud network interoperability detection module to the cloud network interoperability detection module.
  • Exchange test results
  • the user authentication and authorization processing device 700 may also include: an access authentication feedback module, configured to obtain the access authentication result corresponding to the user terminal and The access authorization parameters are returned to the access gateway, so that the access gateway can configure based on the access authentication results and the access authorization parameters.
  • the user authentication and authorization processing device 700 may also include: a cloud service authentication feedback module, and the cloud service authentication feedback module may be configured to: receive cloud service authentication.
  • the service authentication module returns the cloud service authentication result and cloud resource authorization parameters corresponding to the user terminal; returns the cloud service authentication result and cloud resource authorization parameters corresponding to the user terminal to the access gateway, so that the access gateway can authenticate according to the cloud service Configure the results and cloud resource authorization parameters.
  • the user authentication and authorization processing device 700 may also include: an interoperability detection feedback module, configured to receive the cloud-network interoperability detection result corresponding to the user terminal returned by the cloud-network interoperability detection module, and The cloud network interoperability detection result corresponding to the user terminal is returned to the access gateway, so that the access gateway performs configuration according to the cloud network interoperability detection result.
  • an interoperability detection feedback module configured to receive the cloud-network interoperability detection result corresponding to the user terminal returned by the cloud-network interoperability detection module, and The cloud network interoperability detection result corresponding to the user terminal is returned to the access gateway, so that the access gateway performs configuration according to the cloud network interoperability detection result.
  • Exemplary embodiments of the present disclosure also provide a computer-readable storage medium on which a program product capable of implementing the user authentication and authorization processing method described above in this specification is stored.
  • various aspects of the present disclosure can also be implemented in the form of a program product, which includes program code.
  • the program product When the program product is run on an electronic device, the program code is used to cause the electronic device to execute the above-mentioned instructions in this specification.
  • the steps according to various exemplary embodiments of the present disclosure are described in the "Exemplary Methods" section.
  • the program product may take the form of a portable compact disk read-only memory (CD-ROM) and include the program code, and may be run on an electronic device, such as a personal computer.
  • CD-ROM portable compact disk read-only memory
  • the program product of the present disclosure is not limited thereto.
  • a readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.
  • the Program Product may take the form of one or more readable media in any combination.
  • the readable medium may be a readable signal medium or a readable storage medium.
  • the readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: electrical connection with one or more conductors, portable disk, hard disk, random access memory (RAM), read only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.
  • a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave carrying readable program code therein. Such propagated data signals may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above.
  • a readable signal medium may also be any readable medium other than a readable storage medium that can send, propagate, or transport the program for use by or in connection with an instruction execution system, apparatus, or device.
  • Program code embodied on a readable medium may be transmitted using any suitable medium, including but not limited to wireless, wireline, optical cable, RF, etc., or any suitable combination of the foregoing.
  • Program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages such as Java, C++, etc., as well as conventional procedural programming. Language—such as "C” or a similar programming language.
  • the program code may execute entirely on the user's computing device, partly on the target user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device, or entirely on the remote computing device or executed on the server.
  • the remote computing device may be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device, such as provided by an Internet service. (business comes via Internet connection).
  • LAN local area network
  • WAN wide area network
  • Exemplary embodiments of the present disclosure also provide an electronic device capable of implementing the above user authentication and authorization processing method.
  • An electronic device 800 according to such an exemplary embodiment of the present disclosure is described below with reference to FIG. 8 .
  • the electronic device 800 shown in FIG. 8 is only an example and should not bring any limitations to the functions and usage scope of the embodiments of the present disclosure.
  • electronic device 800 may take the form of a general-purpose computing device.
  • the components of the electronic device 800 may include, but are not limited to: at least one processing unit 810, at least one storage unit 820, a bus 830 connecting different system components (including the storage unit 820 and the processing unit 810), and a display unit 840.
  • the storage unit 820 stores program code, which can be executed by the processing unit 810, so that the processing unit 810 performs the steps according to various exemplary embodiments of the present disclosure described in the "Example Method" section of this specification to ensure cloud resources. availability and improve users’ convenience in using cloud services.
  • processing unit 810 can perform the following steps:
  • the above-mentioned initiating a cloud service authentication request to the cloud service authentication module may include the following steps: Authentication to the cloud service The module sends a cloud service authentication request, so that the cloud service authentication module obtains cloud service authentication parameters based on the cloud service authentication request, and performs cloud service authentication of the user terminal based on the cloud service authentication parameters.
  • the cloud service authentication module can initialize the cloud service authentication information corresponding to the user terminal, and complete the cloud service authentication of the user terminal based on the cloud service authentication information to obtain the cloud service authentication request. Resource authorization parameters, and returns the cloud service authentication results and cloud resource authorization parameters to the authentication server.
  • the above-mentioned initiating a cloud-network interoperability detection request to the cloud-network interoperability detection module, so that the cloud-network interoperability detection module performs cloud-network interoperability detection of the user terminal based on the cloud-network interoperability detection request may include the following steps : Initiate a cloud-network interoperability detection request to the cloud-network interoperability detection module, so that the cloud-network interoperability detection module obtains the cloud-network interoperability detection parameters based on the cloud-network interoperability detection request, and performs cloud-network interoperability detection on the user terminal based on the cloud-network interoperability detection parameters.
  • the cloud-network interoperability detection module can initialize the detection record of the user terminal, determine the cloud-network interoperability detection strategy according to the cloud-network interoperability detection parameters, and provide the The ingress gateway delivers the parameter information of the cloud resource pool access end and the cloud network interoperability detection policy, so that the access gateway initiates cloud network interoperability detection to the cloud resource pool access end based on the cloud network interoperability detection policy, and returns the cloud network interoperability detection strategy to the cloud network interoperability detection module. Network interoperability test results.
  • the following steps may also be performed: returning the access authentication result and access authorization parameters corresponding to the user terminal to the access gateway, so that the access The gateway is configured based on the access authentication results and access authorization parameters.
  • the following steps may also be performed: receiving the cloud service authentication result and cloud resource authorization parameters corresponding to the user terminal returned by the cloud service authentication module; The corresponding cloud service authentication result and cloud resource authorization parameters are returned to the access gateway, so that the access gateway performs configuration according to the cloud service authentication result and cloud resource authorization parameters.
  • the following steps may also be performed: receiving the cloud-network interoperability detection result corresponding to the user terminal returned by the cloud-network interoperability detection module, and returning the cloud-network interoperability detection result corresponding to the user terminal to the interface.
  • Ingress gateway so that the access gateway can be configured based on the cloud network interoperability detection results.
  • the storage unit 820 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 821 and/or a cache storage unit 822, and may further include a read-only storage unit (ROM) 823.
  • RAM random access storage unit
  • ROM read-only storage unit
  • Storage unit 820 may also include a program/utility 824 having a set of (at least one) program modules 825 including, but not limited to: an operating system, one or more application programs, other program modules, and program data, Each of these examples, or some combination, may include the implementation of a network environment.
  • program/utility 824 having a set of (at least one) program modules 825 including, but not limited to: an operating system, one or more application programs, other program modules, and program data, Each of these examples, or some combination, may include the implementation of a network environment.
  • Bus 830 may be a local area representing one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or using any of a variety of bus structures. bus.
  • Electronic device 800 may also communicate with one or more external devices 900 (e.g., keyboard, pointing device, Bluetooth device, etc.), may also communicate with one or more devices that enable a user to interact with electronic device 800, and/or with Any device that enables the electronic device 800 to communicate with one or more other computing devices (eg, router, modem, etc.). This communication may occur through input/output (I/O) interface 850.
  • the electronic device 800 may also communicate with one or more networks (eg, a local area network (LAN), a wide area network (WAN), and/or a public network, such as the Internet) through a network adapter 860. As shown, network adapter 860 communicates with other modules of electronic device 800 via bus 830.
  • network adapter 860 communicates with other modules of electronic device 800 via bus 830.
  • electronic device 800 may be used in conjunction with electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives And data backup storage system, etc.
  • the example embodiments described here can be implemented by software, or can be implemented by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, U disk, mobile hard disk, etc.) or on the network , including several instructions to cause a computing device (which may be a personal computer, a server, a terminal device, a network device, etc.) to execute a method according to an exemplary embodiment of the present disclosure.
  • a computing device which may be a personal computer, a server, a terminal device, a network device, etc.
  • modules or units of equipment for action execution are mentioned in the above detailed description, this division is not mandatory.
  • the features and functions of two or more modules or units described above may be embodied in one module or unit.
  • the features and functions of one module or unit described above may be further divided into being embodied by multiple modules or units.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Telephonic Communication Services (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

Un procédé et un appareil d'authentification et d'autorisation d'utilisateur, ainsi qu'un support et un dispositif électronique. Le procédé consiste à : en réponse à la réception d'une demande d'authentification, qui est envoyée par une passerelle d'accès, effectuer une authentification d'accès d'un terminal utilisateur, la demande d'authentification étant générée par le terminal utilisateur et envoyée à la passerelle d'accès ; initier une demande d'authentification de service en nuage à un module d'authentification de service en nuage, de telle sorte que le module d'authentification de service en nuage effectue une authentification de service en nuage du terminal utilisateur sur la base de la demande d'authentification de service en nuage ; et initier une demande de détection d'intercommunication de réseau en nuage à un module de détection d'intercommunication de réseau en nuage, de telle sorte que le module de détection d'intercommunication de réseau en nuage effectue une détection d'intercommunication de réseau en nuage du terminal utilisateur sur la base de la demande de détection d'intercommunication de réseau en nuage. La collaboration d'une fonction d'authentification d'accès, d'une fonction d'authentification de service en nuage et d'une fonction de détection d'intercommunication de réseau en nuage est réalisée, de telle sorte que la disponibilité de ressources en nuage peut être assurée, et la commodité d'un utilisateur utilisant le service en nuage peut être améliorée.
PCT/CN2022/142487 2022-06-24 2022-12-27 Procédé et appareil d'authentification et d'autorisation d'utilisateur, et support et dispositif WO2023246060A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210730355.0 2022-06-24
CN202210730355.0A CN115022074A (zh) 2022-06-24 2022-06-24 用户认证授权方法、装置、介质及设备

Publications (1)

Publication Number Publication Date
WO2023246060A1 true WO2023246060A1 (fr) 2023-12-28

Family

ID=83077367

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/142487 WO2023246060A1 (fr) 2022-06-24 2022-12-27 Procédé et appareil d'authentification et d'autorisation d'utilisateur, et support et dispositif

Country Status (2)

Country Link
CN (1) CN115022074A (fr)
WO (1) WO2023246060A1 (fr)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115022074A (zh) * 2022-06-24 2022-09-06 中国电信股份有限公司 用户认证授权方法、装置、介质及设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109194673A (zh) * 2018-09-20 2019-01-11 江苏满运软件科技有限公司 基于用户授权信息的认证方法、系统、设备及存储介质
CN114090975A (zh) * 2021-10-28 2022-02-25 青岛海尔科技有限公司 云数据库资源的处理方法及装置、电子设备、存储介质
US20220141662A1 (en) * 2019-02-06 2022-05-05 Apple Inc. Enabling interactive service for cloud renderting gaming in 5g systems
CN115022074A (zh) * 2022-06-24 2022-09-06 中国电信股份有限公司 用户认证授权方法、装置、介质及设备

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103873449B (zh) * 2012-12-18 2017-07-07 中国电信股份有限公司 网络接入方法与系统
EP2747350A1 (fr) * 2012-12-21 2014-06-25 Telefónica, S.A. Procédé et système pour accès à des services de réseau en nuage
FR3007551A1 (fr) * 2013-06-25 2014-12-26 France Telecom Procede et serveur de traitement d'une requete d'acces d'un terminal a une ressource informatique
CN108111473B (zh) * 2016-11-24 2020-11-13 腾讯科技（深圳）有限公司 混合云统一管理方法、装置和系统
CN112153055B (zh) * 2020-09-25 2023-04-18 北京百度网讯科技有限公司 鉴权方法及装置、计算设备和介质
CN114372254B (zh) * 2021-08-16 2023-03-24 中电长城网际系统应用有限公司 大数据环境下的多认证授权方法
CN114125023B (zh) * 2021-11-12 2024-03-22 青岛海尔科技有限公司 数据连接的确定方法及装置、存储介质及电子装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109194673A (zh) * 2018-09-20 2019-01-11 江苏满运软件科技有限公司 基于用户授权信息的认证方法、系统、设备及存储介质
US20220141662A1 (en) * 2019-02-06 2022-05-05 Apple Inc. Enabling interactive service for cloud renderting gaming in 5g systems
CN114090975A (zh) * 2021-10-28 2022-02-25 青岛海尔科技有限公司 云数据库资源的处理方法及装置、电子设备、存储介质
CN115022074A (zh) * 2022-06-24 2022-09-06 中国电信股份有限公司 用户认证授权方法、装置、介质及设备

Also Published As

Publication number Publication date
CN115022074A (zh) 2022-09-06

Similar Documents

Publication Publication Date Title
WO2020057163A1 (fr) Procédé et dispositif de déploiement d'une plate-forme mec
WO2019000871A1 (fr) Procédé et dispositif de fourniture de service vocal, et serveur
WO2022166359A1 (fr) Procédé et appareil d'envoi de paquets fragmentés
US11777865B2 (en) Discovery and adjustment of path maximum transmission unit
WO2017101265A1 (fr) Procédé de traitement de messages, serveur de traitement, terminal et support de stockage
US9720747B2 (en) Method for flow control and reliable communication in a collaborative environment
TWI735429B (zh) 用戶端登錄伺服器端的鑑別方法、裝置、系統及電子設備
US8769039B2 (en) Method and apparatus of performing remote computer file exchange
WO2018188082A1 (fr) Procédé, dispositif et système permettant de mettre en œuvre une commande de stratégie
US10645172B1 (en) Socket tunneling connections in a service provider environment
US9591081B2 (en) Virtual desktop access using wireless devices
US20180152519A1 (en) Integrating applications with endpoints using dynamic port negotiation
CN102904959A (zh) 网络加速方法和网关
US11216293B2 (en) Command line interface
WO2023246060A1 (fr) Procédé et appareil d'authentification et d'autorisation d'utilisateur, et support et dispositif
US11457337B2 (en) Short message service link for activity feed communications
US9760412B2 (en) Client server communication system
CN108989157B (zh) 用于智能设备控制的方法、装置
WO2020221033A1 (fr) Procédé de gestion de dispositif de stockage à distance au moyen d'un dispositif de gestion
CN114363427A (zh) 一种基于浏览器实时获取主机设备信息的方法
WO2024066939A1 (fr) Procédé de communication de multidiffusion pour groupe de réseau virtuel, système de communication et dispositif associé
WO2024022400A1 (fr) Procédé de configuration de ressource en nuage et dispositif associé
WO2024119917A1 (fr) Procédé et appareil de mesure de détection, et dispositif associé
CN112055083B (zh) 请求处理方法、装置、电子设备和介质
WO2024032599A1 (fr) Procédé et fonction de liaison de session, et support de stockage et dispositif électronique

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22947795

Country of ref document: EP

Kind code of ref document: A1