[go: up one dir, main page]

WO2012055339A1 - 一种云计算服务的认证路由系统、方法和认证路由器 - Google Patents

一种云计算服务的认证路由系统、方法和认证路由器 Download PDF

Info

Publication number
WO2012055339A1
WO2012055339A1 PCT/CN2011/081136 CN2011081136W WO2012055339A1 WO 2012055339 A1 WO2012055339 A1 WO 2012055339A1 CN 2011081136 W CN2011081136 W CN 2011081136W WO 2012055339 A1 WO2012055339 A1 WO 2012055339A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
cloud computing
computing service
router
user terminal
Prior art date
Application number
PCT/CN2011/081136
Other languages
English (en)
French (fr)
Inventor
林兆骥
陈小华
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP11835612.0A priority Critical patent/EP2624501A4/en
Priority to US13/881,225 priority patent/US8898747B2/en
Publication of WO2012055339A1 publication Critical patent/WO2012055339A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1097—Protocols in which an application is distributed across nodes in the network for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources
    • H04L67/63—Routing a service request depending on the request content or context

Definitions

  • the present invention relates to the field of cloud computing technologies, and in particular, to an authentication routing system, method, and authentication router for a cloud computing service. Background technique
  • Narrow cloud computing refers to the delivery and use of Internet technology (IT) infrastructure, which means that the required resources are obtained through the network in an on-demand and scalable manner.
  • Broadly defined cloud computing refers to the delivery and use of services. Mode refers to obtaining the required services on the network in an on-demand, scalable manner.
  • This kind of service can be IT and software, Internet related, or any other service.
  • Cloud computing has the advantages of super large scale, virtualization, and reliable security. For network operators, cloud computing can greatly reduce operating costs and operation and maintenance costs, and achieve energy saving and emission reduction. In addition, it can expand the scope of operations, not just pipeline operations.
  • cloud computing In a cloud computing environment, everything is operational and can be delivered as a service, including applications, software, platforms, processing power, storage, networking, computing resources, and other infrastructure. For users, cloud computing makes it possible to consume services anytime and anywhere. Users can get the IT resources needed to run their business without investing a lot of money. They can rent according to their own needs. IT resources are like water, electricity and gas. , on-demand access and billing.
  • Cloud computing generally has three main service models, Infrastructure as a Service (IAAS), Platform as a Service (PaaS, Platform as a Service), and Software as a Service (SaaS, Software as a Service). .
  • IAAS Infrastructure as a Service
  • PaaS Platform as a Service
  • SaaS Software as a Service
  • Service providers can have a more powerful user authentication mechanism to ensure that only legitimate users can access authorized resources.
  • Each cloud computing service provider has its own set of user authentication systems, commonly referred to as local authentication servers, such as the Lightweight Directory Access Protocol (LDAP) directory server or authentication and authorization accounting. (AAA, Authentication Authorization Accounting), etc., used to authenticate users' access to cloud computing services.
  • LDAP Lightweight Directory Access Protocol
  • AAA Authentication Authorization Accounting
  • the disadvantages of this method are: The number of cloud computing users is often very large, and the cloud computing service provider authentication overhead will be greatly increased; users need to register with different cloud computing service providers, the user experience is poor, and the risk of privacy leakage increases; In addition, the authentication solutions of different cloud computing service providers are different, and the security strength is different. According to the wooden barrel principle, once the cloud computing service provider authentication system with the weakest security strength is compromised, it is likely to make User authentication for other cloud computing service providers is also threatened because the average user will use the same or similar authentication credentials for ease of memory. Summary of the invention
  • the main purpose of the present invention is to provide an authentication routing system, a method, and an authentication router for a cloud computing service, so as to ensure that when a user uses a cloud computing service, different types of user terminals and different network access modes are used. Both can provide a consistent user authentication experience and a high level of authentication security, and effectively protect the privacy of users.
  • the present invention provides an authentication routing system for a cloud computing service, the system comprising: a user terminal, an authentication router, and an authentication server, where
  • the authentication router is configured to perform registration of the cloud computing service, and save registration information of the cloud computing service that is successfully registered; and further configured to receive the cloud computing service to the user terminal And authenticating the request, and routing the authentication request to the user terminal to the corresponding authentication server according to the saved registration information corresponding to the cloud computing service;
  • the user terminal is configured to request and use a cloud computing service
  • the authentication server is configured to authenticate the user terminal according to its own authentication mechanism.
  • the registration information includes: an index number of the cloud computing service, an authentication mechanism selected by the cloud computing service, an authentication server address providing the authentication mechanism, and a routing policy of the authentication server.
  • the authentication router further includes: a registration module, configured to receive a registration request of the cloud computing service, provide an optional authentication mechanism list to the cloud computing service requesting registration, and receive the cloud computing service selected from the list
  • the authentication mechanism saves the registration information of the cloud computing service according to the authentication mechanism selected by the cloud computing service.
  • the cloud computing service carries at least the index number of the cloud computing service in the authentication request of the user terminal;
  • the authentication router further includes: an authentication routing module, configured to select an authentication mechanism for the cloud computing service according to a preset policy according to an index number of the cloud computing service carried in the authentication request; The authentication mechanism selects the corresponding authentication server address in the registration information, and routes the authentication request to the corresponding authentication server.
  • the authentication server is further configured to: when the user terminal is authenticated, if the user terminal does not support the authentication mechanism of the authentication server, notify the authentication router; correspondingly, the authentication route of the authentication router
  • the module is further configured to: when the authentication server notifies the user terminal that the selected authentication mechanism is not supported, select another authentication mechanism for the cloud computing service according to a preset policy, and search for a corresponding one of the registration information according to the selected authentication mechanism.
  • the authentication server address is routed to the corresponding authentication server for authentication.
  • the authentication server is further configured to: after the authentication of the user terminal is completed, return an authentication result to the authentication router; The authentication router returns the authentication result to the cloud computing service, and the cloud computing service determines whether to provide the cloud computing service to the user terminal according to the received authentication result.
  • the present invention also provides an authentication routing method for a cloud computing service, the method comprising: authenticating a router to perform registration of a cloud computing service, and saving registration information of a successfully registered cloud computing service;
  • the authentication router receives the authentication request sent by the requested cloud computing service to the user terminal;
  • the authentication router routes the authentication request of the user terminal to the corresponding authentication server for authentication according to the saved registration information corresponding to the cloud computing service.
  • the registration information includes: an index number of the cloud computing service, an authentication mechanism selected by the cloud computing service, an authentication server address providing the authentication mechanism, and a routing policy of the authentication server.
  • the authentication router performs registration on the cloud computing service, and saves the registration information, specifically: the authentication router receives the registration request of the cloud computing service;
  • the authentication router provides an optional authentication mechanism list to the cloud computing service requesting registration; the cloud computing service selects an appropriate authentication mechanism from the list of optional authentication mechanisms according to security requirements and policies, and returns to the authentication router;
  • the authentication router saves the registration information of the cloud computing service according to the authentication mechanism selected by the cloud computing service.
  • the cloud computing service carries at least the index number of the cloud computing service in the authentication request of the user terminal;
  • the authentication router selects an authentication mechanism for the cloud computing service according to a preset policy according to an index number of the cloud computing service carried in the authentication request, and searches for a corresponding authentication server address in the registration information according to the selected authentication mechanism. And routing the authentication request to the corresponding authentication server.
  • the method further includes: When the authentication server authenticates the user terminal, if the user terminal does not support the authentication mechanism of the authentication server, the authentication router is notified;
  • the authentication router selects another authentication mechanism for the cloud computing service according to a preset policy, and searches for the corresponding authentication server address in the registration information according to the selected authentication mechanism, and routes the authentication request to the corresponding authentication server for authentication.
  • the method further includes:
  • the authentication server After the authentication of the user terminal is completed, the authentication server returns an authentication result to the authentication router.
  • the authentication router returns the authentication result to the cloud computing service
  • the cloud computing service determines whether to provide a cloud computing service to the user terminal according to the received authentication result.
  • the invention also provides an authentication router, comprising:
  • a registration module configured to perform registration of the cloud computing service, and save registration information of the registered cloud computing service
  • the authentication routing module is configured to receive the authentication request of the cloud computing service to the user terminal, and route the authentication request of the user terminal to the corresponding authentication server for authentication according to the saved registration information corresponding to the cloud computing service. .
  • the registration information includes: an index number of the cloud computing service, an authentication mechanism selected by the cloud computing service, an authentication server address providing the authentication mechanism, and a routing policy of the authentication server.
  • the registration module is further configured to: receive a registration request of the cloud computing service, provide an optional authentication mechanism list to the cloud computing service requesting registration, and receive an authentication mechanism selected by the cloud computing service from the list, according to The authentication mechanism selected by the cloud computing service saves registration information of the cloud computing service.
  • the cloud computing service carries at least the index number of the cloud computing service in the authentication request of the user terminal;
  • the authentication routing module is further configured to: according to the index number of the cloud computing service carried in the authentication request, select an authentication mechanism for the cloud computing service according to a preset policy;
  • the corresponding authentication server address in the registration information is used to route the authentication request to the corresponding authentication server.
  • the authentication routing module is further configured to, when learning from the authentication server that the user terminal does not support the selected authentication mechanism, select another authentication mechanism for the cloud computing service according to a preset policy, and search according to the selected authentication mechanism.
  • the corresponding authentication server address in the registration information is used to route the authentication request to the corresponding authentication server for authentication.
  • the authentication routing module is further configured to forward the authentication result returned by the authentication server to the cloud computing service after the authentication of the user terminal by the authentication server is completed.
  • the invention provides an authentication routing system, method and authentication router for a cloud computing service, by deploying a cloud computing service authentication router in a cloud computing service provider, so that the cloud computing service provider can utilize other more professional authentication infrastructure Providing access authentication for users, thereby reducing the authentication overhead of cloud computing service providers; separating authentication and service authorization; protecting user privacy; reducing authentication single point failure caused by large-scale users accessing cloud computing service providers , making the provision of cloud computing services more reliable and credible.
  • FIG. 1 is a schematic structural diagram of an authentication routing system of a cloud computing service according to an embodiment of the present invention
  • FIG. 3 is a flowchart of a cloud computing service registering with an authentication router according to an embodiment of the present invention
  • FIG. 3 is a flowchart of a user requesting a cloud computing service according to an embodiment of the present invention
  • Certification flow chart ;
  • FIG. 4 is a flowchart of a method for authenticating a cloud computing service according to an embodiment of the present invention
  • FIG. 5 is a schematic structural diagram of a system for authenticating a cloud computing service according to an embodiment of the present invention. detailed description
  • a unified authentication framework for a cloud computing service provided by the present invention can be divided into three domains: an authentication service provider domain, a cloud computing service provider domain, and a user terminal domain.
  • the authentication service provider domain is responsible for providing user authentication for professional cloud computing service access.
  • the main function is performed by the authentication server.
  • the authentication service provider domain can be composed of the network provider's authentication infrastructure, such as: Third Generation Partner Program (3GPP, The 3rd Generation Partnership Project) Authentication related network elements in the network, or Home Subscriber Server (HSS) / Answer Center (Australia Center) or Home Location Register (HLR)
  • HSS Home Subscriber Server
  • HLR Home Location Register
  • the AuC and Bootstrapping Service Function (BSF) or the AAA server in the fixed network may also be a pure identity provider (Identity Provider); the authentication-related functional entity in the cloud computing service provider domain includes the local authentication server.
  • the authentication router where the local authentication server is responsible for the identity authentication of the local user, the authentication router is responsible for the authentication information management and maintenance of the cloud computing service, and the routing of the authentication server;
  • the user terminal domain mainly includes the user terminal, and is responsible for the authentication request and the service. consumption.
  • a user terminal accessing various cloud computing services may require an authentication mechanism with different security strengths.
  • the authentication mechanism required by the cloud computing service needs to be preset in the authentication router in advance; the authentication router is a user terminal accessing the cloud.
  • the authentication boundary entry function entity when computing the service, the cloud computing service registers with the authentication router through a series of specified registration processes and a standardized authentication registration interface.
  • the registration process is shown in Figure 2, which includes the following steps:
  • Step 201 The cloud computing service requests registration from the authentication router.
  • Step 202 The authentication router provides an optional authentication mechanism to the cloud computing service.
  • Authentication services that provide these authentication mechanisms are provided by authentication service providers that can be recognized by cloud computing providers and that have established trust relationships with cloud computing service providers in advance. More often The authentication mechanisms used are: authentication based on Subscriber Identity Module (SIM), authentication based on Universal Integrated Circuit Card (UICC), authentication based on username and password, certificate-based authentication, etc. Wait.
  • SIM Subscriber Identity Module
  • UICC Universal Integrated Circuit Card
  • Step 203 Select an appropriate authentication mechanism in the list of authentication mechanisms provided by the authentication router according to the security requirements and policies of the cloud computing service (the selected authentication mechanism may be multiple).
  • Step 204 According to the selection made by the cloud computing service, the authentication router saves the index number of the cloud computing service, the selected authentication mechanism, the address of the authentication server that provides the authentication mechanism (such as the uniform resource locator URL of the authentication server), and the authentication. Information such as the routing policy of the server.
  • Step 205 The authentication router returns a registration success message to the cloud computing service.
  • the authentication of the terminal user accessing the cloud computing service is routed to the corresponding authentication server according to the predetermined policy, and the authentication server completes the authentication of the user.
  • the local authentication server may complete the authentication of the user by default or the user may not be authenticated at all and the user may directly access the service.
  • These interfaces may be set in the policy of the authentication router. .
  • the complete authentication process for the user terminal to access the cloud computing service is shown in Figure 3, which includes the following steps:
  • Step 301 The user terminal requests a cloud computing service, and the services may be a SaaS service, a PaaS service, or an IaaS service.
  • Step 302 The cloud computing service requests the authentication router to authenticate the request of the user terminal, and the request message at least needs to carry the index number of the cloud computing service.
  • Step 303 The authentication router selects an authentication mechanism for the cloud computing service according to the index number of the computing service and according to a preset policy.
  • the predetermined policy may be: selecting the security strength according to the authentication mechanism from high to low, selecting the order of the authentication mechanism from low to high, and the like.
  • Step 304 The authentication request is sent according to the address of the authentication server corresponding to the selected authentication mechanism. Route to the appropriate authentication server.
  • Step 305 The authentication server authenticates the terminal user by using the selected authentication mechanism.
  • the authentication router can set the routing policy according to the requirements of the cloud computing service to meet the requirements of the entire authentication process in terms of delay or protocol overhead or authentication security strength.
  • Step 306 If the authentication server completes the authentication of the terminal user, the authentication result is returned to the authentication router.
  • Step 307 The authentication router returns the authentication result to the cloud computing service.
  • Step 308 The cloud computing service determines, according to the received authentication result, whether the service can be provided to the terminal user.
  • the authentication server in the foregoing process may be a cloud computing service provider local authentication server or a non-local authentication server, and the cloud computing service provider may provide an interface for the authentication service provider to establish a trust relationship with the authentication service provider, and add As in the authentication router of a cloud computing service provider.
  • FIG. 4 is a flowchart of a method for authenticating a cloud computing service according to an embodiment of the present invention, where the process mainly includes the following steps:
  • Step 401 The authentication router performs registration of the cloud computing service, and saves the registration information of the cloud computing service that is successfully registered.
  • the registration information includes at least: an index number of the cloud computing service, and an authentication server address that provides an authentication mechanism.
  • the method further includes: an authentication mechanism selected by the cloud computing service, and a routing policy of the authentication server.
  • the registration information of the present invention is not limited to the above, and may be extended according to actual needs.
  • the authentication router receives the registration request of the cloud computing service; the authentication router requests the request
  • the registered cloud computing service provides an optional list of authentication mechanisms; the cloud computing service saves the above-mentioned registration letter step 402 of the cloud computing service according to the security requirement and the authentication mechanism selected by the authentication router according to the cloud computing service, when the user terminal requests the cloud computing service,
  • the authentication router receives the authentication request sent to the user terminal by the requested cloud computing service.
  • the authentication request of the cloud computing service to the user terminal carries at least the index of the cloud computing service; the authentication router selects an authentication mechanism for the cloud computing service according to the preset index of the cloud computing service carried in the authentication request; The selected authentication mechanism searches for the corresponding authentication server address in the registration information, and routes the authentication request to the corresponding authentication server.
  • Step 403 The authentication router routes the authentication request of the user terminal to the corresponding authentication server for authentication according to the saved registration information of the corresponding cloud computing service.
  • the authentication router When the authentication server authenticates the user terminal, if the user terminal does not support the authentication mechanism of the authentication server, the authentication router is notified; the authentication router selects another authentication mechanism for the cloud computing service according to the preset policy, and searches according to the selected authentication mechanism.
  • the corresponding authentication server address in the registration information is used to route the authentication request to the corresponding authentication server for authentication.
  • the authentication server returns the authentication result to the authentication router, and the authentication router returns the authentication result to the cloud computing service, and the cloud computing service determines whether to provide the cloud computing service to the user terminal according to the received authentication result.
  • the authentication routing system of the cloud computing service of the present invention includes: a user terminal 10, an authentication router 20, and an authentication server 30.
  • the authentication router 20 is configured to perform registration on the cloud computing service, and save the following registration information of the cloud computing service that is successfully registered: an index number of the cloud computing service, an authentication mechanism selected by the cloud computing service, and an authentication function providing the authentication mechanism. Server address and routing policy of the authentication server.
  • the user terminal 10 is configured to request and use a cloud computing service; the authentication router 20 is further configured to receive the cloud The authentication request of the service terminal to the user terminal 10 is calculated, and the authentication request of the user terminal 10 is routed to the corresponding authentication server 30 according to the saved registration information of the corresponding cloud computing service.
  • the authentication server 30 is configured to authenticate the user terminal 10 according to its own authentication mechanism.
  • the authentication router 20 further includes: a registration module 21 and an authentication routing module 22.
  • the registration module 21 is configured to perform registration of the cloud computing service and save registration information of the cloud computing service that is successfully registered. Specifically: receiving a registration request of the cloud computing service, providing an optional authentication mechanism list to the cloud computing service requesting registration, and receiving the authentication mechanism selected by the cloud computing service from the list, and saving according to the authentication mechanism selected by the cloud computing service Registration information for cloud computing services.
  • the authentication routing module 22 is configured to receive an authentication request of the cloud computing service to the user terminal 10, and route the authentication request of the user terminal 10 to the corresponding authentication server for authentication according to the saved registration information of the corresponding cloud computing service.
  • the authentication request of the cloud computing service to the user terminal 10 carries at least the index number of the cloud computing service; and correspondingly, the authentication routing module 20 is further configured to: according to the index number of the cloud computing service carried in the authentication request, according to The pre-set policy selects an authentication mechanism for the cloud computing service; searches for the corresponding authentication server address in the registration information according to the selected authentication mechanism, and routes the authentication request to the corresponding authentication server 30.
  • the authentication routing module 20 is further configured to: when the authentication server 30 learns that the user terminal 10 does not support the selected authentication mechanism, select another authentication mechanism for the cloud computing service according to a preset policy, and search according to the selected authentication mechanism.
  • the authentication server address corresponding to the registration information is routed to the corresponding authentication server 30 for re-authentication.
  • the authentication routing module 20 is further configured to forward the authentication result returned by the authentication server to the cloud computing service after the authentication of the user terminal 10 by the authentication server 30 is completed.
  • the present invention deploys a cloud computing service authentication router in a cloud computing service provider, so that the cloud computing service provider can provide access authentication to the user by using other more professional authentication infrastructures, thereby reducing cloud computing services.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Description

一种云计算服务的认证路由系统、 方法和认证路由器 技术领域
本发明涉及云计算技术领域， 尤其涉及一种云计算服务的认证路由系 统、 方法和认证路由器。 背景技术
随着计算机技术的快速发展， 云计算正在越来越受关注， 无论是互联 网厂商和运营商， 还是通信厂商和基础网络运营商， 都对云计算表现出极 大的关注。
狭义的云计算是指互联网技术（IT, Internet Technology )基础设施的 交付和使用模式， 指通过网络以按需、 易扩展的方式获得所需的资源； 广 义的云计算是指服务的交付和使用模式， 指通过网络以按需、 易扩展的方 式获得所需的服务。 这种服务可以是 IT和软件、 互联网相关的， 也可以是 任意其他的服务， 云计算具有超大规模、 虚拟化、 可靠安全等优点。 对于 网络运营商而言， 云计算可以使运营成本和操作维护成本大大降低， 达到 节能减排的目的， 除此之外， 还可以扩大运营的范围， 而不仅仅受限于管 道运营。 在云计算环境下， 一切资源都是可以运营的， 都可以作为服务提 供， 包括应用程序、 软件、 平台、 处理能力、 存储、 网络、 计算资源以及 其他基础设施等。 对于用户而言， 云计算使得随时、 随地消费服务成为可 能， 用户可以不需要大量投资而获得运营业务所需的 IT资源， 完全可以根 据自己的需求来租用， IT资源像水、 电和煤气一样， 按需获取和计费。
云计算一般有三种主要的服务模式， 基础设施即服务 （ IaaS , Infrastructure as a Service, )、 平台 月良务 ( PaaS, Platform as a Service )和 软件即月良务 ( SaaS , Software as a Service )。 在云计算场景下， 大量的用户信息都集中在云计算提供商， 与传统的 互联网业务相比， 其信息更集中、 信息资产价值更高、 面临的攻击也会更 多， 这就要求云计算服务提供商能够具备更强大的用户认证机制来保障只 有合法的用户才能够访问被授权的资源。
传统的解决方案是： 每个云计算服务提供商都拥有自身的一套用户认 证系统， 一般称为本地认证服务器， 如轻量目录访问协议 （ LDAP , Lightweight Directory Access Protocol )目录服务器或者认证授权计费（ AAA, Authentication Authorization Accounting )月良务器等 , 用于认证用户对云计算 服务的访问。 这种方法的缺点是： 云计算用户数量往往非常庞大， 云计算 服务提供商认证开销将大大增加； 用户需要在不同的云计算服务提供商注 册， 用户体验差， 而且隐私泄露的风险加大； 除此之外， 不同云计算服务 提供商的认证解决方案各不相同， 安全强度也不同， 根据木桶原理， 安全 强度最弱的云计算服务提供商认证系统一旦被攻破， 就很有可能使得其他 云计算服务提供商的用户认证也受到威胁， 因为一般用户为了便于记忆会 使用相同或相似的认证凭证。 发明内容
有鉴于此， 本发明的主要目的在于提供一种云计算服务的认证路由系 统、 方法和认证路由器， 以保证用户在使用云计算服务时， 针对不同类型 的用户终端和不同的网络接入方式， 均能提供一致的用户认证体验和较高 的认证安全强度， 并有效保障用户的隐私安全。
为达到上述目的， 本发明的技术方案是这样实现的：
本发明提供了一种云计算服务的认证路由系统， 该系统包括： 用户终 端、 认证路由器和认证服务器， 其中，
所述认证路由器， 设置为执行对云计算服务的注册， 并保存注册成功 的云计算服务的注册信息； 还设置为， 接收所述云计算服务对用户终端的 认证请求， 并根据保存的对应所述云计算服务的注册信息， 将所述对用户 终端的认证请求路由到相应的认证服务器；
所述用户终端， 设置为请求和使用云计算服务；
所述认证服务器， 设置为按照自身的认证机制对所述用户终端进行认 证。
所述注册信息包括： 云计算服务的索引号、 云计算服务选定的认证机 制、 提供所述认证机制的认证服务器地址和所述认证服务器的路由策略。
所述认证路由器进一步包括： 注册模块， 设置为接收所述云计算服务 的注册请求， 向请求注册的云计算服务提供可选的认证机制列表， 并接收 所述云计算服务从列表中选定的认证机制， 根据所述云计算服务选定的认 证机制保存所述云计算服务的注册信息。
所述云计算服务对用户终端的认证请求中至少携带所述云计算服务的 索引号；
相应的， 所述认证路由器进一步包括： 认证路由模块， 设置为根据所 述认证请求中携带的云计算服务的索引号， 并根据预先设定的策略为所述 云计算服务选择认证机制； 根据所选认证机制查找注册信息中对应的认证 服务器地址， 将所述认证请求路由到相应的认证服务器。
所述认证服务器进一步设置为， 在对所述用户终端进行认证时， 如果 所述用户终端不支持所述认证服务器的认证机制， 则告知所述认证路由器； 相应的， 所述认证路由器的认证路由模块进一步设置为， 在所述认证 服务器告知用户终端不支持选择的认证机制时， 根据预先设定的策略为所 述云计算服务选择其他认证机制， 并根据所选认证机制查找注册信息中对 应的认证服务器地址， 将所述认证请求路由到相应的认证服务器进行认证。
所述认证服务器进一步设置为， 在对所述用户终端的认证完成后， 向 认证路由器返回认证结果； 所述认证路由器将认证结果返回给云计算服务， 所述云计算服务根据 收到的认证结果， 决定是否向所述用户终端提供云计算服务。
本发明还提供了一种云计算服务的认证路由方法， 该方法包括： 认证路由器执行对云计算服务的注册， 并保存注册成功的云计算服务 的注册信息；
用户终端请求云计算服务时， 所述认证路由器接收被请求的云计算服 务发送的对所述用户终端的认证请求；
所述认证路由器根据保存的对应所述云计算服务的注册信息， 将所述 用户终端的认证请求路由到相应的认证服务器进行认证。
所述注册信息包括： 云计算服务的索引号、 云计算服务选定的认证机 制、 提供所述认证机制的认证服务器地址和所述认证服务器的路由策略。
所述认证路由器执行对云计算服务的注册， 并保存注册信息， 具体为： 认证路由器接收所述云计算服务的注册请求；
认证路由器向请求注册的云计算服务提供可选的认证机制列表； 所述云计算服务根据安全需求和策略， 从可选的认证机制列表中选定 合适的认证机制并返回给认证路由器；
认证路由器根据所述云计算服务选定的认证机制保存所述云计算服务 的注册信息。
所述云计算服务对用户终端的认证请求中至少携带所述云计算服务的 索引号；
所述认证路由器根据所述认证请求中携带的云计算服务的索引号， 并 根据预先设定的策略为所述云计算服务选择认证机制； 根据所选认证机制 查找注册信息中对应的认证服务器地址， 将所述认证请求路由到相应的认 证服务器。
该方法进一步包括： 认证服务器在对用户终端进行认证时， 如果所述用户终端不支持认证 服务器的认证机制， 则告知所述认证路由器；
认证路由器根据预先设定的策略为所述云计算服务选择其他认证机 制， 并根据所选认证机制查找注册信息中对应的认证服务器地址， 将所述 认证请求路由到相应的认证服务器进行认证。
该方法进一步包括：
认证服务器在对所述用户终端的认证完成后， 向认证路由器返回认证 结果；
所述认证路由器将认证结果返回给云计算服务；
所述云计算服务根据收到的认证结果， 决定是否向所述用户终端提供 云计算服务。
本发明还提供了一种认证路由器， 包括：
注册模块， 设置为执行对云计算服务的注册， 并保存注册成功的云计 算服务的注册信息；
认证路由模块， 设置为接收所述云计算服务对用户终端的认证请求， 并根据保存的对应所述云计算服务的注册信息， 将所述对用户终端的认证 请求路由到相应的认证服务器进行认证。
所述注册信息包括： 云计算服务的索引号、 云计算服务选定的认证机 制、 提供所述认证机制的认证服务器地址和所述认证服务器的路由策略。
所述注册模块进一步设置为， 接收所述云计算服务的注册请求， 向请 求注册的云计算服务提供可选的认证机制列表， 并接收所述云计算服务从 列表中选定的认证机制， 根据所述云计算服务选定的认证机制保存所述云 计算服务的注册信息。
所述云计算服务对用户终端的认证请求中至少携带所述云计算服务的 索引号； 相应的， 所述认证路由模块进一步设置为， 根据所述认证请求中携带 的云计算服务的索引号， 并根据预先设定的策略为所述云计算服务选择认 证机制； 根据所选认证机制查找注册信息中对应的认证服务器地址， 将所 述认证请求路由到相应的认证服务器。
所述认证路由模块进一步设置为， 在从所述认证服务器获知用户终端 不支持选择的认证机制时， 根据预先设定的策略为所述云计算服务选择其 他认证机制， 并根据所选认证机制查找注册信息中对应的认证服务器地址， 将所述认证请求路由到相应的认证服务器进行认证。
所述认证路由模块进一步设置为， 在所述认证服务器对用户终端的认 证完成后， 将认证服务器返回的认证结果转发给所述云计算服务。
本发明所提供的一种云计算服务的认证路由系统、 方法和认证路由器， 通过在云计算服务提供商内部署云计算服务认证路由器， 使得云计算服务 提供商可以借助其他更专业的认证基础设施为用户提供访问认证， 由此实 现减少云计算服务提供商的认证开销； 使得认证和服务授权分离； 保护用 户的隐私； 降低因为大规模用户访问云计算服务提供商而造成的认证单点 失效问题， 使得云计算服务的提供更加可靠、 可信。 附图说明
图 1为本发明实施例中云计算服务的认证路由系统的结构示意图； 图 为本发明实施例中云计算服务向认证路由器注册的流程图； 图 3为本发明实施例中用户请求云计算服务的认证流程图；
图 4为本发明实施例中一种云计算服务的认证路由方法的流程图； 图 5 为本发明实施例中一种云计算服务的认证路由系统的组成结构示 意图。 具体实施方式
下面结合附图和具体实施例对本发明的技术方案进一步详细阐述。 本发明所提供的一种云计算服务的统一认证框架， 如图 1 所示， 该框 架可以划分为三个域： 认证服务提供商域、 云计算服务提供商域和用户终 端域。 认证服务提供商域负责提供专业的云计算服务接入的用户认证， 主 要功能由认证服务器来完成， 认证服务提供商域可以由网络提供商的认证 基础设施构成， 如： 第三代合作伙伴计划 （3GPP , The 3rd Generation Partnership Project ) 网络中的认证相关网元， 或者归属用户服务器（HSS, Home Subscriber Server ) /答权中心 ( AuC, Authentication Center )或归属位 置寄存器（HLR, Home Location Register ) /AuC及引导服务功能（BSF, Bootstrapping Service Function )或固定网络中的 AAA服务器， 也可以是纯 粹的身份提供商 （Identity Provider ); 云计算服务提供商域中与认证相关的 功能实体包括本地认证服务器和认证路由器， 其中本地认证服务器负责本 地用户的身份认证， 认证路由器负责云计算服务的认证信息管理和维护、 认证服务器的路由； 用户终端域主要包括用户终端， 负责认证请求与服务 消费。
在云计算服务提供商域中， 用户终端访问各种云计算服务可能需要不 同安全强度的认证机制， 云计算服务所需要的认证机制需要提前在认证路 由器中预置； 认证路由器是用户终端访问云计算服务时的认证边界入口功 能实体， 云计算服务通过一系列规定的注册流程和标准化的认证注册接口 向认证路由器进行注册。 注册流程如图 2所示， 具体包括以下步驟：
步驟 201 , 云计算服务向认证路由器请求注册。
步驟 202, 认证路由器向云计算服务提供可选的认证机制。
提供这些认证机制的认证服务都是可以由云计算提供商认可的并且已 经和云计算服务提供商提前建立信任关系的认证服务提供商提供。 比较常 用的认证机制有：基于用户身份识别模块（SIM, Subscriber Identity Module ) 卡的认证、 基于通用集成电路卡（UICC, Universal Integrated Circuit Card ) 的认证、 基于用户名口令的认证、 基于证书的认证等等。
步驟 203 ,根据云计算服务的安全需求和策略，在认证路由器提供的认 证机制列表中选择合适的认证机制 （选择的认证机制可以为多种）。
步驟 204,根据云计算服务作出的选择，认证路由器保存云计算服务的 索引号、 被选定的认证机制、 提供该认证机制的认证服务器的地址（如认 证服务器的统一资源定位符 URL )和认证服务器的路由策略等信息。
步驟 205 , 认证路由器向云计算服务返回注册成功消息。
一旦某个云计算服务在认证路由器中注册完成后， 那么终端用户访问 云计算服务的认证就会根据预定的策略被路由到相应的认证服务器， 由该 认证服务器完成对用户的认证。 在云计算服务没有向认证路由器注册的情 况下， 可以默认由本地认证服务器完成对用户的认证或者根本不需要对用 户进行认证而让用户直接访问服务， 这些接口可以在认证路由器的策略中 设定。 用户终端访问云计算服务的完整的认证流程如图 3 所示， 具体包括 以下步驟：
步驟 301 ,用户终端请求云计算服务，这些服务可以是 SaaS服务、 PaaS 服务或 IaaS服务。
步驟 302, 云计算服务请求认证路由器对用户终端的请求进行认证，请 求消息中至少需要携带云计算服务的索引号。
步驟 303 ,认证路由器根据计算服务的索引号， 并根据预先设定的策略 为云计算服务选择认证机制。 所述预先设定的策略可以是： 按照认证机制 的安全强度由高到低的顺序选择、 按照认证机制的复杂度由低到高的顺序 选择等等。
步驟 304,根据选择的认证机制对应的认证服务器的地址，将认证请求 路由至相应的认证服务器。
步驟 305 , 认证服务器使用选定的认证机制对终端用户进行认证。
需要说明的是，如果终端用户不支持该认证机制，那么跳转至步驟 303 , 重复上述流程， 直到路由到合适的认证服务器为止。 认证路由器可以根据 云计算服务的要求设置路由策略， 以满足整个认证过程在时延或者协议开 销或者认证安全强度等方面的需求。
步驟 306, 如果认证服务器对终端用户认证完成， 那么向认证路由器返 回认证结果。
步驟 307, 认证路由器将认证结果返回给云计算服务。
步驟 308, 云计算服务根据收到的认证结果， 决定是否可以向终端用户 提供服务。
需要指出的是， 上述流程中的认证服务器可以是云计算服务提供商本 地认证服务器， 也可以是非本地认证服务器， 云计算服务提供商可以提供 接口使得认证服务提供方与之建立信任关系， 并添加如云计算服务提供商 的认证路由器中。
结合以上技术方案的描述可以看出， 本发明云计算服务的认证路由技 术包含图 4所示的操作思路。 如图 4所示， 图 4为本发明实施例的云计算 服务的认证路由方法的流程图， 该流程主要包括以下步驟：
步驟 401 ,认证路由器执行对云计算服务的注册， 并保存注册成功的云 计算服务的注册信息。
该注册信息至少包括： 云计算服务的索引号、 提供认证机制的认证服 务器地址； 还可以进一步包括： 云计算服务选定的认证机制、 认证服务器 的路由策略。 本发明的注册信息并非仅限于上述所举， 还可以根据实际需 要进行扩展。
具体的： 认证路由器接收云计算服务的注册请求； 认证路由器向请求 注册的云计算服务提供可选的认证机制列表； 云计算服务根据安全需求和 认证路由器根据云计算服务选定的认证机制保存云计算服务的上述注册信 步驟 402, 用户终端请求云计算服务时，认证路由器接收被请求的云计 算服务发送的对该用户终端的认证请求。
云计算服务对用户终端的认证请求中至少携带云计算服务的索引号； 认证路由器根据认证请求中携带的云计算服务的索引号， 并根据预先设定 的策略为云计算服务选择认证机制； 根据所选认证机制查找注册信息中对 应的认证服务器地址， 将认证请求路由到相应的认证服务器。
步驟 403 ,认证路由器根据保存的对应云计算服务的注册信息，将用户 终端的认证请求路由到相应的认证服务器进行认证。
认证服务器在对用户终端进行认证时， 如果用户终端不支持认证服务 器的认证机制， 则告知认证路由器； 认证路由器根据预先设定的策略为云 计算服务选择其他认证机制， 并根据所选认证机制查找注册信息中对应的 认证服务器地址， 将认证请求路由到相应的认证服务器进行认证。
此外， 认证服务器在对用户终端的认证完成后， 向认证路由器返回认 证结果， 认证路由器将认证结果返回给云计算服务， 云计算服务根据收到 的认证结果决定是否向用户终端提供云计算服务。
对应上述云计算服务的认证路由方法， 本发明的云计算服务的认证路 由系统， 如图 5所示， 包括： 用户终端 10、 认证路由器 20和认证服务器 30。 其中， 认证路由器 20, 用于执行对云计算服务的注册， 并保存注册成 功的云计算服务的以下注册信息： 云计算服务的索引号、 云计算服务选定 的认证机制、 提供认证机制的认证服务器地址和认证服务器的路由策略。 用户终端 10, 用于请求和使用云计算服务； 认证路由器 20还用于， 接收云 计算服务对用户终端 10的认证请求， 并根据保存的对应云计算服务的注册 信息， 将用户终端 10的认证请求路由到相应的认证服务器 30。认证服务器 30, 用于按照自身的认证机制对用户终端 10进行认证。
其中， 认证路由器 20进一步包括： 注册模块 21和认证路由模块 22。 注册模块 21 , 用于执行对云计算服务的注册， 并保存注册成功的云计算服 务的注册信息。 具体的： 接收云计算服务的注册请求， 向请求注册的云计 算服务提供可选的认证机制列表， 并接收云计算服务从列表中选定的认证 机制， 根据云计算服务选定的认证机制保存云计算服务的注册信息。 认证 路由模块 22, 用于接收云计算服务对用户终端 10的认证请求， 并根据保存 的对应云计算服务的注册信息， 将对用户终端 10的认证请求路由到相应的 认证服务器进行认证。
进一步的， 云计算服务对用户终端 10的认证请求中至少携带云计算服 务的索引号； 那么相应的， 认证路由模块 20还用于， 根据认证请求中携带 的云计算服务的索引号， 并根据预先设定的策略为云计算服务选择认证机 制； 根据所选认证机制查找注册信息中对应的认证服务器地址， 将认证请 求路由到相应的认证服务器 30。
进一步的， 认证路由模块 20还可用于， 在从认证服务器 30获知用户 终端 10不支持选择的认证机制时， 根据预先设定的策略为云计算服务选择 其他认证机制， 并根据所选认证机制查找注册信息中对应的认证服务器地 址， 将认证请求路由到相应的认证服务器 30重新进行认证。
进一步的， 认证路由模块 20还可用于， 在认证服务器 30对用户终端 10的认证完成后， 将认证服务器返回的认证结果转发给云计算服务。
综上所述， 本发明通过在云计算服务提供商内部署云计算服务认证路 由器， 使得云计算服务提供商可以借助其他更专业的认证基础设施为用户 提供访问认证， 由此实现减少云计算服务提供商的认证开销； 使得认证和 服务授权分离； 保护用户的隐私； 降低因为大规模用户访问云计算服务提 供商而造成的认证单点失效问题， 使得云计算服务的提供更加可靠、 可信。
以上所述， 仅为本发明的较佳实施例， 并非用于限定本发明的保护范 围。

Claims

权利要求书
1、 一种云计算服务的认证路由系统， 该系统包括： 用户终端、 认证路 由器和认证服务器， 其中，
所述认证路由器， 设置为执行对云计算服务的注册， 并保存注册成功 的云计算服务的注册信息； 还设置为， 接收所述云计算服务对用户终端的 认证请求， 并根据保存的对应所述云计算服务的注册信息， 将所述对用户 终端的认证请求路由到相应的认证服务器；
所述用户终端， 设置为请求和使用云计算服务；
所述认证服务器， 设置为按照自身的认证机制对所述用户终端进行认 证。
2、 根据权利要求 1所述云计算服务的认证路由系统， 其中， 所述注册 信息包括： 云计算服务的索引号、 云计算服务选定的认证机制、 提供所述 认证机制的认证服务器地址和所述认证服务器的路由策略。
3、 根据权利要求 1或 2所述云计算服务的认证路由系统， 其中， 所述 认证路由器进一步包括： 注册模块， 设置为接收所述云计算服务的注册请 求， 向请求注册的云计算服务提供可选的认证机制列表， 并接收所述云计 算服务从列表中选定的认证机制， 根据所述云计算服务选定的认证机制保 存所述云计算服务的注册信息。
4、 根据权利要求 2所述云计算服务的认证路由系统， 其中， 所述云计 算服务对用户终端的认证请求中至少携带所述云计算服务的索引号；
相应的， 所述认证路由器进一步包括： 认证路由模块， 设置为根据所 述认证请求中携带的云计算服务的索引号， 并根据预先设定的策略为所述 云计算服务选择认证机制； 根据所选认证机制查找注册信息中对应的认证 服务器地址， 将所述认证请求路由到相应的认证服务器。
5、 根据权利要求 4所述云计算服务的认证路由系统， 其中， 所述认证 服务器进一步设置为， 在对所述用户终端进行认证时， 如果所述用户终端 不支持所述认证服务器的认证机制， 则告知所述认证路由器；
相应的， 所述认证路由器的认证路由模块进一步设置为， 在所述认证 服务器告知用户终端不支持选择的认证机制时， 根据预先设定的策略为所 述云计算服务选择其他认证机制， 并根据所选认证机制查找注册信息中对 应的认证服务器地址， 将所述认证请求路由到相应的认证服务器进行认证。
6、 根据权利要求 1或 2所述云计算服务的认证路由系统， 其中， 所述 认证服务器进一步设置为， 在对所述用户终端的认证完成后， 向认证路由 器返回认证结果；
所述认证路由器将认证结果返回给云计算服务， 所述云计算服务根据 收到的认证结果， 决定是否向所述用户终端提供云计算服务。
7、 一种云计算服务的认证路由方法， 该方法包括：
认证路由器执行对云计算服务的注册， 并保存注册成功的云计算服务 的注册信息；
用户终端请求云计算服务时， 所述认证路由器接收被请求的云计算服 务发送的对所述用户终端的认证请求；
所述认证路由器根据保存的对应所述云计算服务的注册信息， 将所述 用户终端的认证请求路由到相应的认证服务器进行认证。
8、 根据权利要求 7所述云计算服务的认证路由方法， 其中， 所述注册 信息包括： 云计算服务的索引号、 云计算服务选定的认证机制、 提供所述 认证机制的认证服务器地址和所述认证服务器的路由策略。
9、 根据权利要求 7或 8所述云计算服务的认证路由方法， 其中， 所述 认证路由器执行对云计算服务的注册， 并保存注册信息， 具体为：
认证路由器接收所述云计算服务的注册请求；
认证路由器向请求注册的云计算服务提供可选的认证机制列表； 所述云计算服务根据安全需求和策略， 从可选的认证机制列表中选定 合适的认证机制并返回给认证路由器；
认证路由器根据所述云计算服务选定的认证机制保存所述云计算服务 的注册信息。
10、 根据权利要求 8所述云计算服务的认证路由方法， 其中， 所述云 计算服务对用户终端的认证请求中至少携带所述云计算服务的索引号； 所述认证路由器根据所述认证请求中携带的云计算服务的索引号， 并 根据预先设定的策略为所述云计算服务选择认证机制； 根据所选认证机制 查找注册信息中对应的认证服务器地址， 将所述认证请求路由到相应的认 证服务器。
11、 根据权利要求 10所述云计算服务的认证路由方法， 其中， 该方法 进一步包括：
认证服务器在对用户终端进行认证时， 如果所述用户终端不支持认证 服务器的认证机制， 则告知所述认证路由器；
认证路由器根据预先设定的策略为所述云计算服务选择其他认证机 制， 并根据所选认证机制查找注册信息中对应的认证服务器地址， 将所述 认证请求路由到相应的认证服务器进行认证。
12、 根据权利要求 7或 8所述云计算服务的认证路由方法， 其中， 该 方法进一步包括：
认证服务器在对所述用户终端的认证完成后， 向认证路由器返回认证 结果；
所述认证路由器将认证结果返回给云计算服务；
所述云计算服务根据收到的认证结果， 决定是否向所述用户终端提供 云计算服务。
13、 一种认证路由器， 包括： 注册模块， 设置为执行对云计算服务的注册， 并保存注册成功的云计 算服务的注册信息；
认证路由模块， 设置为接收所述云计算服务对用户终端的认证请求， 并根据保存的对应所述云计算服务的注册信息， 将所述对用户终端的认证 请求路由到相应的认证服务器进行认证。
14、 根据权利要求 13所述认证路由器， 其中， 所述注册信息包括： 云 计算服务的索引号、 云计算服务选定的认证机制、 提供所述认证机制的认 证服务器地址和所述认证服务器的路由策略。
15、 根据权利要求 13或 14所述认证路由器， 其中， 所述注册模块进 一步设置为， 接收所述云计算服务的注册请求， 向请求注册的云计算服务 提供可选的认证机制列表， 并接收所述云计算服务从列表中选定的认证机 制， 根据所述云计算服务选定的认证机制保存所述云计算服务的注册信息。
16、 根据权利要求 14所述认证路由器， 其中， 所述云计算服务对用户 终端的认证请求中至少携带所述云计算服务的索引号；
相应的， 所述认证路由模块进一步设置为， 根据所述认证请求中携带 的云计算服务的索引号， 并根据预先设定的策略为所述云计算服务选择认 证机制； 根据所选认证机制查找注册信息中对应的认证服务器地址， 将所 述认证请求路由到相应的认证服务器。
17、 根据权利要求 16所述认证路由器， 其中， 所述认证路由模块进一 步设置为， 在从所述认证服务器获知用户终端不支持选择的认证机制时， 根据预先设定的策略为所述云计算服务选择其他认证机制， 并根据所选认 证机制查找注册信息中对应的认证服务器地址， 将所述认证请求路由到相 应的认证服务器进行认证。
18、 根据权利要求 13或 14所述认证路由器， 其中， 所述认证路由模 块进一步设置为， 在所述认证服务器对用户终端的认证完成后， 将认证服 务器返回的认证结果转发给所述云计算服务。
PCT/CN2011/081136 2010-10-26 2011-10-21 一种云计算服务的认证路由系统、方法和认证路由器 WO2012055339A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP11835612.0A EP2624501A4 (en) 2010-10-26 2011-10-21 AUTHENTICATION ROUTING SYSTEM, METHOD AND AUTHENTICATION ROUTER FOR A CLOUD COMPUTING SERVICE
US13/881,225 US8898747B2 (en) 2010-10-26 2011-10-21 Authentication routing system and method for cloud computing service and authentication router

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201010520650.0 2010-10-26
CN201010520650.0A CN102457493B (zh) 2010-10-26 2010-10-26 一种云计算服务的认证路由系统、方法和认证路由器

Publications (1)

Publication Number Publication Date
WO2012055339A1 true WO2012055339A1 (zh) 2012-05-03

Family

ID=45993164

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2011/081136 WO2012055339A1 (zh) 2010-10-26 2011-10-21 一种云计算服务的认证路由系统、方法和认证路由器

Country Status (4)

Country Link
US (1) US8898747B2 (zh)
EP (1) EP2624501A4 (zh)
CN (1) CN102457493B (zh)
WO (1) WO2012055339A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9137131B1 (en) * 2013-03-12 2015-09-15 Skyhigh Networks, Inc. Network traffic monitoring system and method to redirect network traffic through a network intermediary

Families Citing this family (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9148381B2 (en) 2011-10-21 2015-09-29 Qualcomm Incorporated Cloud computing enhanced gateway for communication networks
US9116893B2 (en) 2011-10-21 2015-08-25 Qualcomm Incorporated Network connected media gateway for communication networks
WO2013106454A1 (en) * 2012-01-09 2013-07-18 Qualcomm Incorporated Cloud computing controlled gateway for communication networks
US8959335B2 (en) * 2012-04-17 2015-02-17 Gemalto Sa Secure password-based authentication for cloud computing services
US8862883B2 (en) * 2012-05-16 2014-10-14 Cisco Technology, Inc. System and method for secure cloud service delivery with prioritized services in a network environment
CN103281173A (zh) * 2013-04-27 2013-09-04 网银国际股份有限公司 复数网络平台的密钥管理方法
JP6507486B2 (ja) * 2013-05-10 2019-05-08 株式会社リコー 情報処理装置、プログラム、情報管理方法及び情報処理システム
JP6488673B2 (ja) * 2013-12-06 2019-03-27 株式会社リコー 情報処理装置、プログラム、情報管理方法、情報処理システム
CN104753879B (zh) * 2013-12-30 2019-03-15 中国银联股份有限公司 终端认证云服务提供者的方法及系统、云服务提供者认证终端的方法及系统
US10389709B2 (en) * 2014-02-24 2019-08-20 Amazon Technologies, Inc. Securing client-specified credentials at cryptographically attested resources
US9832252B2 (en) * 2014-03-27 2017-11-28 Genband Us Llc Systems, methods, and computer program products for third party authentication in communication services
CN103997437A (zh) * 2014-05-29 2014-08-20 上海斐讯数据通信技术有限公司 一种测试云服务器注册功能的方法
US10757197B2 (en) 2014-07-18 2020-08-25 Microsoft Technology Licensing, Llc Self-extending cloud
JP6027069B2 (ja) * 2014-09-18 2016-11-16 富士フイルム株式会社 Ｖｐｎアクセス制御システム、その作動方法及びプログラム、並びにｖｐｎルータ及びサーバ
US10193864B2 (en) * 2014-09-19 2019-01-29 Comcast Cable Communications, Llc Cloud interface for use of cloud services
CN106211152B (zh) 2015-04-30 2019-09-06 新华三技术有限公司 一种无线接入认证方法及装置
CN105072197A (zh) * 2015-08-28 2015-11-18 深圳市云工匠信息技术有限公司 一种信息推荐方法及装置
CN105554004B (zh) * 2015-12-24 2018-12-11 北京轻元科技有限公司 一种混合云计算环境中容器服务的认证系统和方法
US10567387B1 (en) * 2016-09-13 2020-02-18 Symantec Corporation Systems and methods for managing computing device access to local area computer networks
CN107249209A (zh) * 2017-06-09 2017-10-13 苏州汉明科技有限公司 无线局域网网关管理方法及系统
US10749868B2 (en) 2018-06-29 2020-08-18 Microsoft Technology Licensing, Llc Registration of the same domain with different cloud services networks
CN111988267B (zh) * 2019-05-24 2023-10-20 阿里巴巴集团控股有限公司 针对计算设备的认证方法及装置
CN110933147B (zh) * 2019-11-15 2020-07-17 链睿信息服务(南通)有限公司 一种基于云计算的信息技术分析系统
CN111865964B (zh) * 2020-07-16 2022-05-20 北京望京科技孵化服务有限公司 一种基于企业私有云加密文件系统的身份认证系统
US11777944B2 (en) * 2021-06-29 2023-10-03 International Business Machines Corporation Scalable authentication management

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1874287A (zh) * 2005-05-30 2006-12-06 中兴通讯股份有限公司 移动通信网与无线城域网的互通系统及其方法
WO2007015254A2 (en) * 2005-08-03 2007-02-08 Aladdin Knowledge Systems Ltd. Security server in a cloud
CN201491033U (zh) * 2009-08-20 2010-05-26 福建富士通信息软件有限公司 一种业务系统的统一认证平台
CN101719829A (zh) * 2009-06-11 2010-06-02 中兴通讯股份有限公司 一种实现idm系统间互操作的处理方法和系统
CN101834846A (zh) * 2010-03-30 2010-09-15 王兴强 一种未成年人健康网站认证系统及其认证方法

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1874226A (zh) * 2006-06-26 2006-12-06 杭州华为三康技术有限公司 终端接入方法及系统
CN101309139B (zh) * 2007-05-15 2011-03-30 盛大计算机（上海）有限公司 通行证认证系统
CN101170566A (zh) * 2007-11-20 2008-04-30 中兴通讯股份有限公司 一种多域认证方法及系统
US9210173B2 (en) 2008-11-26 2015-12-08 Red Hat, Inc. Securing appliances for use in a cloud computing environment
JP5153591B2 (ja) * 2008-11-26 2013-02-27 株式会社日立製作所 認証仲介サーバ、プログラム、認証システム及び選択方法
WO2010110182A1 (ja) * 2009-03-24 2010-09-30 日本電気株式会社 仲介装置、仲介方法、プログラム及び仲介システム
CN101582762B (zh) * 2009-04-02 2011-07-13 北京飞天诚信科技有限公司 基于动态口令进行身份认证的方法和系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1874287A (zh) * 2005-05-30 2006-12-06 中兴通讯股份有限公司 移动通信网与无线城域网的互通系统及其方法
WO2007015254A2 (en) * 2005-08-03 2007-02-08 Aladdin Knowledge Systems Ltd. Security server in a cloud
CN101719829A (zh) * 2009-06-11 2010-06-02 中兴通讯股份有限公司 一种实现idm系统间互操作的处理方法和系统
CN201491033U (zh) * 2009-08-20 2010-05-26 福建富士通信息软件有限公司 一种业务系统的统一认证平台
CN101834846A (zh) * 2010-03-30 2010-09-15 王兴强 一种未成年人健康网站认证系统及其认证方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP2624501A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9137131B1 (en) * 2013-03-12 2015-09-15 Skyhigh Networks, Inc. Network traffic monitoring system and method to redirect network traffic through a network intermediary

Also Published As

Publication number Publication date
CN102457493A (zh) 2012-05-16
CN102457493B (zh) 2015-12-16
US8898747B2 (en) 2014-11-25
EP2624501A4 (en) 2015-12-09
EP2624501A1 (en) 2013-08-07
US20130219476A1 (en) 2013-08-22

Similar Documents

Publication Publication Date Title
WO2012055339A1 (zh) 一种云计算服务的认证路由系统、方法和认证路由器
US9356928B2 (en) Mechanisms to use network session identifiers for software-as-a-service authentication
CN102550001B (zh) 用于允许自举架构和共享身份服务相互作用的用户身份管理
CN113746633B (zh) 物联网设备绑定方法、装置、系统、云服务器和存储介质
US8978100B2 (en) Policy-based authentication
US8554934B1 (en) Application single sign on leveraging virtual local area network identifier
CN103329091B (zh) 交叉接入登录控制器
US9787478B2 (en) Service provider certificate management
US20130174239A1 (en) Reinforced authentication system and method using context information at the time of access to mobile cloud service
CN107404485A (zh) 一种自验证云连接方法及其系统
WO2012094602A1 (en) Client and server group sso with local openid
JP2005519501A (ja) シングルサインオンサービスのためのシステム、方法、および装置
WO2017016252A1 (zh) 令牌生成并认证的方法及认证服务器
CN101867589B (zh) 一种网络身份认证服务器及其认证方法与系统
WO2015196908A1 (zh) 业务处理方法、终端、服务器及系统
US20230028642A1 (en) Systems and methods for application security utilizing centralized security management
WO2013040957A1 (zh) 单点登录的方法、系统和信息处理方法、系统
WO2013056619A1 (zh) 一种身份联合的方法、IdP、SP及系统
CN105306485A (zh) 上网认证方法、认证服务器及其所在认证系统
CN101697550A (zh) 一种双栈网络访问权限控制方法和系统
Lin et al. Proxy-based federated authentication: a transparent third-party solution for cloud-edge federation
WO2011063658A1 (zh) 统一安全认证的方法和系统
WO2022067831A1 (zh) 一种建立安全通信方法及装置
WO2011017921A1 (zh) 一种访问拜访地服务提供商的系统及方法
CN207706214U (zh) 一种自验证云连接系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 11835612

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 13881225

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

REEP Request for entry into the european phase

Ref document number: 2011835612

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2011835612

Country of ref document: EP