KR102936977B1 - Method for verifying service and user in a cloud environment and system therefor - Google Patents

Abstract

A method for authenticating services and users in a cloud environment and a system thereof are provided. A service providing method according to one embodiment of the present disclosure is a method performed by a computing system, comprising: receiving an access request for a second cloud service from a terminal of a user using a first cloud service; determining, in response to receiving the access request, whether the first cloud service is authenticated in the second cloud service; transmitting a user verification request to the first cloud service if the first cloud service is authenticated in the second cloud service as a result of the determination; transmitting, in response to the verification request, a user verification result regarding whether the user has access to the second cloud service; and using the user verification result, setting access rights to the second cloud service for the user, wherein the first cloud service and the second cloud service may be services provided on the same cloud platform.

Description

METHOD FOR VERIFYING SERVICE AND USER IN A CLOUD ENVIRONMENT AND SYSTEM THEREFOR

The present disclosure relates to a method and system for service and user authentication in a cloud environment. More specifically, it relates to a method and system for providing a new cloud service within an existing cloud service.

In a cloud environment, service delivery refers to the on-demand provision of computing resources and software via the Internet. These are typically categorized as Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). Users can run servers, storage, networks, applications, and more in the cloud as needed.

Service providers leverage virtualization technology and distributed computing to ensure automatic scalability, high availability, and security, and provide interoperability with various services through REST APIs and authentication protocols (OAuth, SAML, etc.).

This allows businesses and individuals to build and operate efficient and scalable IT services on a cloud basis without having to directly operate physical infrastructure.

This study was supported by the National IT Industry Promotion Agency (NIPA) through funding from the Ministry of Science and ICT (Ministry of Science and ICT) in 2022 (No. 2022-0-01019, Development of eSIM security platform technology for edge devices to foster an eSIM ecosystem).

This work was supported by Institute of Information & communications Technology Planning & Evaluation (IITP) grant funded by the Korea government (MSIT)(No.2022-0-01019, Development of eSIM security platform technology for edge devices to expand the eSIM ecosystem).

Patent Publication No. 10-2025-0016591 (February 4, 2025)

A technical problem to be solved in some embodiments of the present disclosure is to provide a method and system for providing services in a cloud environment, in which a user can use various services provided on a cloud platform without a separate log-in.

Another technical problem to be solved in some embodiments of the present disclosure is to provide a method and system for requesting authentication for a service requiring authentication when building a service in a cloud environment.

The technical problems of the present disclosure are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art of the present disclosure from the description below.

According to some embodiments of the present disclosure for solving the above technical problem, a method for providing a service in a cloud environment is provided, the method comprising: receiving an access request for a second cloud service from a terminal of a user using a first cloud service; determining, in response to receiving the access request, whether the first cloud service is authenticated in the second cloud service; transmitting a user verification request to the first cloud service if the first cloud service is authenticated in the second cloud service as a result of the determination; transmitting, in response to the verification request, a user verification result regarding whether the user has access to the second cloud service; and using the user verification result, setting access rights for the user to the second cloud service, wherein the first cloud service and the second cloud service may be services provided on the same cloud platform.

In some embodiments, the determining step comprises: receiving an authentication request for the first cloud service from the second cloud service when the first cloud service is not authenticated by the second cloud service; generating authentication request data for the first cloud service using a certificate and public IP information of the second cloud service in response to the authentication request; encrypting the authentication request data with a public key included in the certificate of the first cloud service; transmitting the encrypted authentication request data to the public IP of the first cloud service; decrypting the encrypted authentication request data using a private key of the first cloud service; verifying whether a Certificate Authority of the second cloud service certificate included in the authentication request data matches a Certificate Authority of a certificate of the second cloud service stored in the cloud platform; And as a result of the verification, if the certification authority of the certificate of the second cloud service included in the authentication request data matches the certification authority of the certificate of the second cloud service stored in the cloud platform, the step of adding the second cloud service to the authentication target of the first cloud service so that the first cloud service can be provided in the second cloud service may be included.

In some embodiments, the step of adding the second cloud service to the authentication target of the first cloud service may include the step of storing a certificate and public IP information of the second cloud service in a storage space of the first cloud service.

In some embodiments, the determining step comprises: receiving, from the second cloud service, a request for renewal of authentication information for the first cloud service, if the certificate or public IP information of the second cloud service has changed; generating, in response to the authentication information renewal request, authentication renewal request data for the first cloud service using the changed certificate or public IP information of the second cloud service; signing the authentication renewal request data using a private key of a certificate of the second cloud service before the change, and generating signature authentication renewal request data; encrypting the signature authentication renewal request data using a public key included in a certificate of the first cloud service; transmitting the encrypted signature authentication renewal request data to the public IP of the first cloud service; decrypting the signature authentication renewal request data using the private key of the first cloud service; verifying the signature authentication renewal request data using the public key of the certificate of the second cloud service before the change; verifying whether a certificate authority of a certificate of the second cloud service included in the signature authentication renewal request data matches a certificate authority of a second cloud service certificate stored in the cloud platform; And, if the certification authority of the certificate of the second cloud service included in the signature authentication renewal request data matches the certification authority of the certificate of the second cloud service stored in the cloud platform, the step of adding the second cloud service to the authentication target of the first cloud service so that the first cloud service can be provided in the second cloud service may be included.

In some embodiments, the step of adding the second cloud service to the authentication target of the first cloud service may include the step of storing the changed certificate and public IP information of the second cloud service in the storage space of the first cloud service.

In some embodiments, the user's verification request may include user verification request data regarding the user's first user authentication token for the first cloud service and unique identification information of the first cloud service, encrypted with a public key included in a certificate of the first cloud service.

In some embodiments, the step of transmitting the user verification result may include: decrypting the user verification request data using a private key included in a certificate of the first cloud service; obtaining information about the user using the first user authentication token; obtaining access authority information about the user for the second cloud service using the information about the user; and encrypting the access authority information using a public key included in a certificate of the second cloud service.

In some embodiments, the step of setting the access rights may include: if the user has access rights to the second cloud service, transmitting a request for generating a second user authentication token of the user to the second cloud service; and in response to receiving the generation request, using the access rights information, generating a second user authentication token including information regarding the user's access rights to the second cloud service and a token expiration time.

According to some embodiments of the present disclosure for solving the above technical problem, a system for providing a service in a cloud environment includes: a communication interface; a memory in which a computer program is loaded; and one or more processors in which the computer program is executed, wherein the computer program includes instructions for performing the following operations: receiving an access request for a second cloud service from a terminal of a user using a first cloud service; determining, in response to receiving the access request, whether the first cloud service is authenticated in the second cloud service; transmitting a user verification request to the first cloud service if the first cloud service is authenticated in the second cloud service as a result of the determination; transmitting, in response to the verification request, a user verification result regarding whether the user has access to the second cloud service to the second cloud service; and using the user verification result, setting access rights for the user to the second cloud service, wherein the first cloud service and the second cloud service may be services provided on the same cloud platform.

According to some embodiments of the present disclosure for solving the above technical problem, a computer program stored on a computer-readable recording medium is coupled to a computing device and executes the steps of: receiving an access request for a second cloud service from a terminal of a user using a first cloud service; determining, in response to receiving the access request, whether the first cloud service is authenticated in the second cloud service; transmitting a user verification request to the first cloud service if the first cloud service is authenticated in the second cloud service as a result of the determination; transmitting, in response to the verification request, a user verification result regarding whether the user has access to the second cloud service; and setting access rights to the second cloud service for the user using the user verification result, wherein the first cloud service and the second cloud service may be services provided on the same cloud platform.

FIG. 1 is a system configuration diagram for explaining the configuration and operation of a service provision system in a cloud environment according to some embodiments of the present disclosure.
FIG. 2 is a signal flow diagram illustrating the operation of a service providing method in a cloud environment according to some embodiments of the present disclosure.
FIG. 3 is a detailed flowchart for explaining detailed operations of a service provision method in a cloud environment according to some embodiments of the present disclosure, described with reference to FIG. 2.
FIG. 4 is a detailed flowchart for explaining detailed operations of a service provision method in a cloud environment according to some embodiments of the present disclosure, described with reference to FIG. 2.
FIG. 5 is a detailed flowchart for explaining the detailed operation of a service provision method in a cloud environment according to some embodiments of the present disclosure, described with reference to FIG. 2.
FIG. 6 is a detailed flowchart for explaining the detailed operation of a service provision method in a cloud environment according to some embodiments of the present disclosure, described with reference to FIG. 2.
FIG. 7 is a hardware configuration diagram of a computing device described in some embodiments of the present disclosure.

Hereinafter, preferred embodiments of the present disclosure will be described in detail with reference to the attached drawings. The advantages and features of the present invention, and methods for achieving them, will become clearer with reference to the embodiments described in detail below together with the attached drawings. However, the technical spirit of the present invention is not limited to the following embodiments and may be implemented in various different forms. The following embodiments are provided only to complete the technical spirit of the present invention and to fully inform those skilled in the art of the present invention of the scope of the present invention, and the technical spirit of the present invention is defined only by the scope of the claims.

In describing the present disclosure, if it is determined that a detailed description of a related known configuration or function may obscure the gist of the present invention, the detailed description will be omitted.

Unless otherwise defined, the terms (including technical and scientific terms) used in the following examples may be used with meanings commonly understood by those of ordinary skill in the art to which this disclosure pertains; however, this may vary depending on the intentions of engineers working in the relevant field, precedents, the emergence of new technologies, etc. The terminology used in this disclosure is for the purpose of describing the embodiments and is not intended to limit the scope of this disclosure.

In the following examples, singular expressions include plural concepts unless the context clearly specifies that they are singular. Furthermore, plural expressions include singular concepts unless the context clearly specifies that they are plural.

In addition, terms such as first, second, A, B, (a), (b), etc. used in the following embodiments are only used to distinguish certain components from other components, and the nature, order, or sequence of the components are not limited by the terms.

Various embodiments of the present disclosure will be described below with reference to the attached drawings.

Hereinafter, the configuration and operation of a service provision system in a cloud environment according to some embodiments of the present disclosure will be described with reference to FIG. 1. FIG. 1 is a system configuration diagram for explaining the configuration and operation of a service provision system in a cloud environment according to some embodiments of the present disclosure.

Referring to FIG. 1, a service provision system may be configured to include a cloud platform (10) and a user terminal (20). The cloud platform (10) may include a service server (11), a first cloud service (12), and a second cloud service (13). However, the scope of the present disclosure is not limited thereto. In some cases, the service provision system may be configured to further include modules/devices/systems not illustrated in FIG. 1. Alternatively, the service provision system may be configured to exclude at least some of the components (10 to 13 and 20) illustrated in FIG. 1.

The user terminal (20) may be a user terminal using the first cloud service (12) provided on the cloud platform (10). The user may access the first cloud service (12) through the user terminal (20). In this case, the user may wish to use the second cloud service (13), which is a service provided on the same cloud platform (10) as the first cloud service (12).

The service server (11) can maintain and manage cloud services (12 and 13) provided on the cloud platform (10). In the following, it is assumed that transactions occurring between the first cloud service (12) and the second cloud service (13) are initially received by the service server (11), and the service server (11) transmits the transaction to the other (12, 13). However, for convenience of explanation, it may be described as a direct transaction between the first cloud service (12) and the second cloud service (13) without any mention of the service server (11).

In addition, the explanation will continue on the premise that the first cloud service (12) is a service that is already provided on the cloud platform (10), and the second cloud service (13) is a service that is newly added on the cloud platform (10) and requires service authentication and verification of user access rights.

The service server (11) can receive an access request to the second cloud service from a terminal (20) of a user using the first cloud service (12).

In response to receiving the access request, the service server (11) can determine whether the first cloud service (12) is authenticated by the second cloud service (13). In order for the user of the second cloud service (13) to be able to call the UI and REST API of the first cloud service (12), service authentication is required between the first cloud service (12) and the second cloud service (13). This will be described in detail with reference to FIGS. 3 and 4.

When the first cloud service (12) is authenticated in the second cloud service (13), the service server (11) can transmit a user verification request to the first cloud service (12). In order for the user of the first cloud service (12) to use the second cloud service (13) on the first cloud service (12), the service server (11) must search for the user's access information stored on the first cloud service (12), and, as a result of the search, must have the authority to access the second cloud service (13).

In response to the verification request, the first cloud service (12) can transmit a user verification result regarding whether the user has access rights to the second cloud service (13) to the second cloud service (13) via the service server (11). This will be described in detail with reference to FIG. 5.

The second cloud service (12) can use the user verification results to set access rights for the user to the second cloud service (12). This will be described in detail with reference to FIG. 6.

Meanwhile, in some embodiments, components (10 to 20) of the service provision system may communicate via a network. Here, the network may be implemented as any type of wired/wireless network, such as a Local Area Network (LAN), a Wide Area Network (WAN), a mobile radio communication network, or Wibro (Wireless Broadband Internet).

Each of the components of the cloud platform (10) described above may be implemented on at least one computing device. For example, all functions of the cloud platform (10) may be implemented on a single computing device, or a first function of the cloud platform (10) may be implemented on a first computing device and a second function may be implemented on a second computing device. Alternatively, specific functions of the cloud platform (10) may be implemented on multiple computing devices.

For ease of understanding, the following description assumes that all steps/operations of the methods described below are performed on the aforementioned service server (11). Therefore, if the subject of a specific step/operation is omitted, it can be understood that it is performed on the service server (11). However, in an actual environment, some steps/operations of the methods described below may be performed on other computing devices.

According to this embodiment, when a service provided on a cloud platform (10) is added, there is an advantage in that a user can easily execute a newly provided second cloud service (13) from an existing first cloud service (12) without separate registration or log-in. Therefore, according to this embodiment, there is an advantage in that the scalability and user convenience of various cloud services provided on the cloud platform (10) can be increased.

Hereinafter, with reference to FIG. 2, the operation of a service provision method in a cloud environment according to some embodiments of the present disclosure will be described. FIG. 2 is a signal flow diagram illustrating the operation of a service provision method in a cloud environment according to some embodiments of the present disclosure.

Referring to FIG. 2, a user terminal (20) of a user using a first cloud service (12) can transmit an access request for a second cloud service (13) to a service server (11) (S100). The user can transmit an access request for the second cloud service (13) through the UI of the first cloud service (12) displayed on the user terminal (20) or through a REST API. The REST API (Representational State Transfer API) is an application program interface designed based on the HTTP protocol to enable a user terminal (20) to exchange data between a service server (11) on the web. Since this is something that a person skilled in the art to which the present disclosure pertains is already familiar with, a detailed description thereof will be omitted.

Thereafter, in response to receiving the access request, the service server (11) can determine whether the first cloud service (12) is authenticated in the second cloud service (13) (S200). In order for the user of the second cloud service (13) to be able to call the UI and REST API of the first cloud service (12), service authentication is required between the first cloud service (12) and the second cloud service (13). Accordingly, the service server (11) determines whether the first cloud service (12) is authenticated in the second cloud service (13), and if the first cloud service (12) is not authenticated in the second cloud service (13), authentication can be performed through a predetermined procedure. This will be described in detail with reference to FIGS. 3 and 4.

Thereafter, the service server (11) can transmit the judgment result of step S200 to the second cloud service (13) (S201).

Accordingly, the second cloud service (13) may transmit a user verification request to the service server (11) (S300). The user verification request may include user verification request data regarding the unique identification information of the first cloud service (12) and the user's first user authentication token for the first cloud service (12), encrypted with a public key included in a certificate issued to the first cloud service (12). The unique identification information of the first cloud service (12) may be information necessary to identify the first cloud service (12). The first user authentication token may be information necessary to obtain information regarding the user's unique identification information (ID) and the user's access rights to the service on the first cloud service (12).

The service server (11) can transmit the user's verification request to the first cloud service (12) (S301).

In response to the user's verification request, the first cloud service (12) can transmit the user verification result regarding whether the user has access rights to the second cloud service (13) to the service server (11) (S400). This will be described in detail with reference to FIG. 5.

The service server (11) can transmit the user verification result to the second cloud service (13) (S401).

The second cloud service (13) can use the user verification results to set access rights for the user to the second cloud service (13) (S500). This will be described in detail with reference to FIG. 6.

Thereafter, the second cloud service (13) can transmit information regarding the access rights to the service server (11) (S501).

Thereafter, the service server (11) may determine whether to allow access to the second cloud service (13) based on the access right in response to the user terminal (20)'s request for access to the second cloud service (13) (S600). That is, if the first user has the right to access the second cloud service (13) from the first cloud service (12), the service server (11) may allow the user terminal of the first user to access the second cloud service (13). On the other hand, if the second user does not have the right to access the second cloud service (13) from the first cloud service (12), the service server (11) may deny the user terminal of the first user access to the second cloud service (13) and disallow access to the second cloud service (13).

According to this embodiment, when a service provided on a cloud platform (10) is added, there is an advantage in that a user can easily execute a newly provided second cloud service (13) from an existing first cloud service (12) without separate registration or log-in. Therefore, according to this embodiment, there is an advantage in that the scalability and user convenience of various cloud services provided on the cloud platform (10) can be increased.

In addition, according to this embodiment, the service authentication process for linking the first cloud service (12) and the second cloud service (13) can be performed in an M2M (Machine To Machine) manner without human intervention, and there is an advantage in that information required for service authentication can be set remotely.

Hereinafter, it is assumed that a transaction occurring between a first cloud service (12) and a second cloud service (13) is initially received by the service server (11), and the service server (11) transmits the transaction to each other (12, 13). However, for convenience of explanation, it may be explained that there is a direct transaction between the first cloud service (12) and the second cloud service (13) without any mention of the service server (11).

In addition, the explanation will continue on the premise that the first cloud service (12) is a service that is already provided on the cloud platform (10), and the second cloud service (13) is a service that is newly added on the cloud platform (10) and requires service authentication and verification of user access rights.

Hereinafter, with reference to FIG. 3, a method for mutually authenticating cloud services according to some embodiments of the present disclosure will be described. FIG. 3 is a detailed flowchart illustrating the detailed operations of a method for providing services in a cloud environment according to some embodiments of the present disclosure, as described with reference to FIG. 2.

Referring to FIG. 3, if the first cloud service (12) is not authenticated in the second cloud service (13), the service server (11) can receive an authentication request for the first cloud service (12) from the second cloud service (13) (S210).

The service server (11) may, in response to the authentication request, generate authentication request data for the first cloud service (12) using the certificate and public IP information issued to the second cloud service (13). The authentication request data is transmitted to the first cloud service (12) and may include the certificate and public IP information of the second cloud service (13). The certificate of the second cloud service (13) may be used to determine the authenticity of the certificate issued to the second cloud service (13). The public IP information of the second cloud service (13) may be used to identify IP information accessed by the second cloud service (13). The public IP information may be an IP that does not change once assigned to the second cloud service (13).

Thereafter, the service server (11) can encrypt the authentication request data with the public key included in the certificate of the first cloud service (12). Thereafter, the service server (11) can transmit the encrypted authentication request data to the public IP of the first cloud service (12) (S212). Since the authentication request data is encrypted with the public key included in the certificate of the first cloud service (12), the authentication request data can be transmitted to the first cloud service (12). If an entity other than the first cloud service (12) receives the authentication request data, the other entity cannot obtain the secret key of the first cloud service (12), and therefore, even if the authentication request is transmitted to another entity due to a cyber attack such as hacking, the other entity cannot confirm the authentication request data. Therefore, the security of the cloud platform (10) can be improved.

Thereafter, the first cloud service (12) can decrypt the encrypted authentication request data using the secret key of the first cloud service. Thereafter, the first cloud service (12) can verify whether the certificate authority of the certificate of the second cloud service (13) included in the authentication request data matches the certificate authority of the second cloud service certificate stored in the cloud platform (10) (S213). By verifying whether the certificate authorities match as in step S213, the authenticity of the certificate of the second cloud service (13) included in the authentication request data can be determined. That is, whether the certificate authorities match in step S213 can be an authentication factor for determining the authenticity of the certificate of the second cloud service (13) included in the authentication request data.

As a result of the verification in step S213, if the certification authority of the certificate of the second cloud service (13) included in the authentication request data matches the certification authority of the second cloud service certificate stored in the cloud platform (10), the first cloud service (12) can add the second cloud service (13) to the authentication target of the first cloud service (12) so that the first cloud service (12) can be provided on the second cloud service (13) (S214). That is, in this case, the first cloud service (12) can perform a service authentication operation between services (12, 13) for the second cloud service (13) so that the second cloud service (12) can be executed on the second cloud service (13).

In one embodiment, the service server (11) may store the certificate and public IP information of the second cloud service included in the authentication request data in the storage space (not shown) of the first cloud service.

According to this embodiment, the service authentication process for linking the first cloud service (12) and the second cloud service (13) can be performed in an M2M (Machine To Machine) manner without human intervention, and there is an advantage in that information required for service authentication can be set remotely.

Furthermore, according to this embodiment, a secure service authentication process based on a certificate signed by the same certification authority can be performed during the authentication process between services provided on the cloud platform (10). Therefore, according to this embodiment, the authenticity of a certificate can be easily determined, while also ensuring its authenticity.

After the first cloud service (12) is authenticated by the second cloud service (13), there may be cases where the authentication information, such as the certificate or public IP of the second cloud service (13), is changed. In this case, the authentication information of the second cloud service (13) must be updated in the first cloud service (12) so that the second cloud service (13) can be provided by the first cloud service (12), and vice versa.

Hereinafter, with reference to FIG. 4, a method for updating authentication information between cloud services when authentication information of a cloud service has changed according to some embodiments of the present disclosure will be described. FIG. 4 is a detailed flowchart illustrating the detailed operations of a service provision method in a cloud environment according to some embodiments of the present disclosure, as described with reference to FIG. 2.

Referring to FIG. 4, when the certificate or public IP information of the second cloud service (13) is changed, the service server (11) can receive a request for renewal of authentication information for the first cloud service (12) from the second cloud service (13) (S220).

In response to the authentication information renewal request, the service server (11) may generate authentication renewal request data for the first cloud service (12) using the changed certificate or public IP information of the second cloud service (13) (S221). The authentication renewal request data is transmitted to the first cloud service (12) and may include the changed certificate and public IP information of the second cloud service (13). The changed certificate of the second cloud service (13) may be used to determine the authenticity of the certificate issued to the second cloud service (13). The changed public IP information of the second cloud service (13) may be used to identify the IP information accessed by the second cloud service (13). The public IP information is an IP that does not change once assigned to the second cloud service (13), but if it changes due to external circumstances, authentication of the changed public IP information is required.

Thereafter, the second cloud service (13) may use the private key of the certificate of the second cloud service before the change to sign the authentication renewal request data and generate signature authentication renewal request data (S222). The second cloud service (13) may transmit the signature authentication renewal request data to the service server (11).

Thereafter, the service server (11) can encrypt the signature authentication renewal request data with a public key included in the certificate of the first cloud service (12). The service server (11) can transmit the encrypted signature authentication renewal request data to the public IP of the first cloud service (12) (S223).

The first cloud service (12) can decrypt the signature authentication renewal request data using the secret key of the first cloud service (12). The first cloud service (12) can verify the signature authentication renewal request data using the public key of the certificate before the change of the second cloud service (13). That is, the first cloud service (12) can verify the signature authentication renewal request data using the public key of the certificate before the change of the second cloud service (13) to confirm whether the signature authentication renewal request data is signed by the second cloud service (13) using the secret key of the certificate before the change of the second cloud service (13).

Thereafter, the first cloud service (12) can verify whether the certification authority of the certificate of the second cloud service (13) included in the signature authentication renewal request data matches the certification authority of the certificate of the second cloud service (13) stored in the cloud platform (10) (S224). By verifying whether the certification authorities match as in step S224, the authenticity of the certificate of the second cloud service (13) included in the authentication renewal request data can be determined. That is, whether the certification authorities match in step S224 can be an authentication factor for determining the authenticity of the certificate of the second cloud service (13) included in the authentication renewal request data.

As a result of the verification in step S224, if the certification authority of the certificate of the second cloud service (13) included in the authentication renewal request data matches the certification authority of the second cloud service certificate stored in the cloud platform (10), the first cloud service (12) can add the second cloud service (13) to the authentication target of the first cloud service (12) so that the first cloud service (12) can be provided on the second cloud service (13) (S214). That is, in this case, the first cloud service (12) can perform a service authentication operation between services (12, 13) for the second cloud service (13) so that the second cloud service (12) can be executed on the second cloud service (13).

In one embodiment, the service server (11) may store the changed certificate and public IP information of the second cloud service included in the authentication renewal request data in the storage space (not shown) of the first cloud service.

According to this embodiment, the service authentication process for linking the first cloud service (12) and the second cloud service (13) can be performed in an M2M (Machine To Machine) manner without human intervention, and there is an advantage in that information required for service authentication can be set remotely.

Furthermore, according to this embodiment, a secure service authentication process based on a certificate signed by the same certification authority can be performed during the authentication process between services provided on the cloud platform (10). Therefore, according to this embodiment, the authenticity of a certificate can be easily determined, while also ensuring its authenticity.

Additionally, according to this embodiment, if the certificate or public IP information of one cloud service within the cloud platform (10) is changed, the authentication information of that cloud service can be automatically updated in other cloud services within the cloud platform (10) without human intervention, which is advantageous. Therefore, according to this embodiment, the scalability of services within the cloud platform (10) can be improved.

Meanwhile, as described with reference to FIG. 2, the second cloud service (13) may transmit a user verification request to the service server (11) (S300). The user verification request may include user verification request data regarding the user's first user authentication token for the first cloud service (12) and unique identification information of the first cloud service (12) encrypted with a public key included in the certificate of the first cloud service (12). The unique identification information of the first cloud service (12) may be information necessary to identify the first cloud service (12). The first user authentication token may be information necessary to obtain information regarding the user's unique identification information (ID) on the first cloud service (12) and the user's access rights to the service.

Hereinafter, with reference to FIG. 5, a method for generating a user verification result regarding whether a user has access to a second cloud service according to some embodiments of the present disclosure is described. FIG. 5 is a detailed flowchart illustrating the detailed operations of a service provision method in a cloud environment according to some embodiments of the present disclosure, as described with reference to FIG. 2.

Referring to FIG. 5, the first cloud service (12) can decrypt the user verification request data using the secret key included in the certificate of the first cloud service (12) (S410).

Thereafter, the first cloud service (12) can obtain the user's information by using the first user authentication token included in the user verification request data (S411).

The first cloud service (12) can obtain the user's access rights information for the second cloud service (13) using the user's information (S412). The first user authentication token may include information necessary to obtain information regarding the user's unique identification information (ID) and the user's access rights to the service on the first cloud service (12). Accordingly, the first cloud service (12) can obtain the user's unique identification information (ID) on the first cloud service (12) and information regarding the user's access rights to the first cloud service (12) and the second cloud service (13).

Thereafter, the first cloud service (12) can transmit the access right information to the service server (10). The service server (11) can encrypt the received access right information with the public key included in the certificate of the second cloud service (13) (S413). As a result of performing step S413, the access right information can be decrypted only by the private key of the second cloud service (13), so there is an advantage in that the security of the service provided on the cloud platform (10) can be strengthened.

Thereafter, the service server (11) can transmit access right information encrypted with the public key included in the certificate of the second cloud service (13) to the second cloud service (13). When the encrypted access right information is transmitted to the second cloud service (13), the second cloud service (13) can decrypt the encrypted access right information using the private key of the second cloud service (13).

Hereinafter, with reference to FIG. 6, a method for setting access rights according to some embodiments of the present disclosure will be described. FIG. 6 is a detailed flowchart illustrating detailed operations of a service provision method in a cloud environment according to some embodiments of the present disclosure, as described with reference to FIG. 2.

Referring to FIG. 6, the second cloud service (13) can determine whether the user has access rights to the second cloud service (13) on the first cloud service (12) (S501). The second cloud service (13) can determine whether the user has access rights to the second cloud service (13) on the first cloud service (12) based on the user's access rights information for the second cloud service (13) acquired by the first cloud service (12).

If the user does not have access to the second cloud service (13) on the first cloud service (12), the second cloud service (13) may deny access to the second cloud service (13) so that the user cannot use the second cloud service (13) on the first cloud service (12) (S502).

On the other hand, if the user has access to the second cloud service (13) on the first cloud service (12), the second cloud service (13) can send a request to the service server (11) to create a second user authentication token for the user for the second cloud service (13) (S503).

In response to receiving a request for generating the second user authentication token, the service server (11) may generate a second user authentication token including information about the user's access rights to the second cloud service (13) and the token expiration time, using the user's access rights information for the second cloud service (13). That is, when verification of the first user, who is a user of the first cloud service (12), is completed, the second cloud service (13) may issue a second user authentication token for the second cloud service (13) to the first user. In this case, the second cloud service (13) may issue and store the second user authentication token by applying rights and token expiration time policies defined in advance for the first user.

According to the present embodiment, a user of the first cloud service (12) provided on the cloud platform (10) does not need to separately sign up for or log in to the second cloud service (13) in order to use the second cloud service (13) newly added to the cloud platform (10). Instead, when the user initially accesses the second cloud service (13), once a user authentication token for the second cloud service (13) is issued, the user can then use the first cloud service (12) and the second cloud service (13) within a predefined range, which is advantageous. Therefore, according to the present embodiment, the scalability of services within the cloud platform (10) can be improved.

FIG. 7 is a hardware configuration diagram of a computing device according to some embodiments of the present disclosure. The computing device (1000) of FIG. 7 may include one or more processors (1100), a system bus (1600), a communication interface (1200), a memory (1400) for loading a computer program (1500) executed by the processor (1100), and a storage (1300) for storing the computer program (1500).

The computing system (1000) of FIG. 7 may present a hardware structure of one or more computing systems constituting the cloud platform (10) described with reference to FIG. 1, for example.

The processor (1100) controls the overall operation of each component of the computing system (1000). The processor (1100) can perform operations for at least one application or program for executing methods/operations according to various embodiments of the present disclosure. The memory (1400) stores various data, commands, and/or information. The memory (1400) can load one or more computer programs (1500) from the storage (1300) to execute methods/operations according to various embodiments of the present disclosure. The storage (1300) can non-temporarily store one or more computer programs (1500).

The computer program (1500) may include one or more instructions implementing methods/operations according to various embodiments of the present disclosure. When the computer program (1500) is loaded into the memory (1400), the processor (1100) may execute the one or more instructions to perform the methods/operations according to various embodiments of the present disclosure.

In one embodiment, the computer program (1500) includes instructions for executing the following operations: receiving an access request for a second cloud service from a terminal of a user using a first cloud service; determining, in response to receiving the access request, whether the first cloud service is authenticated in the second cloud service; transmitting a user verification request to the first cloud service if the first cloud service is authenticated in the second cloud service as a result of the determination; transmitting, in response to the verification request, a user verification result regarding whether the user has access to the second cloud service to the second cloud service; and using the user verification result, setting access rights for the user to the second cloud service, wherein the first cloud service and the second cloud service may be services provided on the same cloud platform.

Various embodiments of the present disclosure and the effects thereof have been described with reference to FIGS. 1 through 7 so far. The effects of the technical concept of the present disclosure are not limited to the effects described above, and other effects not mentioned will be readily apparent to those skilled in the art from the description below.

Furthermore, even though the above embodiments have described multiple components as being combined or operating in combination, the technical concept of the present disclosure is not necessarily limited to these embodiments. That is, within the scope of the technical concept of the present disclosure, all of the components may be selectively combined and operated one or more times.

The technical concepts of the present disclosure described so far can be implemented as computer-readable code on a computer-readable medium. A computer program recorded on a computer-readable recording medium can be transmitted to another computing device via a network such as the Internet, installed on said other computing device, and thus used on said other computing device.

Claims (10)

In a method performed by a computing system,
A step of receiving an access request for a second cloud service from a terminal of a user using a first cloud service;
In response to receiving the access request, determining whether the first cloud service is authenticated in the second cloud service;
As a result of the above determination, if the first cloud service is authenticated in the second cloud service, a step of transmitting the user's verification request to the first cloud service;
In response to the verification request, transmitting to the second cloud service a user verification result regarding whether the user has access to the second cloud service; and
A step of setting access rights to the second cloud service for the user using the user verification result is included.
The above first cloud service and the above second cloud service are services provided on the same cloud platform,
The above judging step is,
A step of receiving an authentication request for the first cloud service from the second cloud service when the first cloud service is not authenticated in the second cloud service;
In response to the authentication request, a step of generating authentication request data for the first cloud service using the certificate and public IP information of the second cloud service;
A step of encrypting the above authentication request data with a public key included in the certificate of the first cloud service;
A step of transmitting the encrypted authentication request data to the public IP of the first cloud service;
A step of decrypting the encrypted authentication request data using the secret key of the first cloud service;
A step of verifying whether the certificate authority of the second cloud service certificate included in the above authentication request data matches the certificate authority of the second cloud service certificate stored in the cloud platform; and
As a result of the above verification, if the certification authority of the certificate of the second cloud service included in the authentication request data matches the certification authority of the certificate of the second cloud service stored in the cloud platform, a step of adding the second cloud service to the authentication target of the first cloud service so that the first cloud service can be provided in the second cloud service is included.
How to provide services in a cloud environment. delete In the first paragraph,
The step of adding the second cloud service to the authentication target of the first cloud service is as follows:
Comprising a step of storing the certificate and public IP information of the second cloud service in the storage space of the first cloud service,
How to provide services in a cloud environment. In a method performed by a computing system,
A step of receiving an access request for a second cloud service from a terminal of a user using a first cloud service;
In response to receiving the access request, determining whether the first cloud service is authenticated in the second cloud service;
As a result of the above determination, if the first cloud service is authenticated in the second cloud service, a step of transmitting the user's verification request to the first cloud service;
In response to the verification request, transmitting to the second cloud service a user verification result regarding whether the user has access to the second cloud service; and
A step of setting access rights to the second cloud service for the user using the user verification result is included.
The above first cloud service and the above second cloud service are services provided on the same cloud platform,
The above judging step is,
A step of receiving a request for renewing authentication information for the first cloud service from the second cloud service when the certificate or public IP information of the second cloud service has changed;
In response to the authentication information renewal request, a step of generating authentication renewal request data for the first cloud service using the changed certificate or public IP information of the second cloud service;
A step of signing the authentication renewal request data using the secret key of the certificate before the change of the second cloud service and generating signed authentication renewal request data;
A step of encrypting the above signature authentication renewal request data with a public key included in the certificate of the first cloud service;
A step of transmitting the encrypted signature authentication renewal request data to the public IP of the first cloud service;
A step of decrypting the signature authentication renewal request data using the secret key of the first cloud service;
A step of verifying the signature authentication renewal request data using the public key of the certificate before the change of the second cloud service;
A step of verifying whether the certificate authority of the second cloud service certificate included in the signature authentication renewal request data matches the certificate authority of the second cloud service certificate stored in the cloud platform; and
If the certification authority of the certificate of the second cloud service included in the signature authentication renewal request data matches the certification authority of the certificate of the second cloud service stored in the cloud platform, a step of adding the second cloud service to the authentication target of the first cloud service so that the first cloud service can be provided in the second cloud service is included.
How to provide services in a cloud environment. In paragraph 4,
The step of adding the second cloud service to the authentication target of the first cloud service is as follows:
Comprising a step of storing the changed certificate and public IP information of the second cloud service in the storage space of the first cloud service,
How to provide services in a cloud environment. In the first paragraph,
The above user's verification request is:
Including user verification request data regarding the user's first user authentication token for the first cloud service and unique identification information of the first cloud service encrypted with a public key included in the certificate of the first cloud service,
How to provide services in a cloud environment. In paragraph 6,
The step of transmitting the above user verification result is:
A step of decrypting the user verification request data using a secret key included in the certificate of the first cloud service;
A step of obtaining information about the user using the first user authentication token;
A step of obtaining the user's access authority information for the second cloud service by using the user's information; and
A step of encrypting the above access authority information with a public key included in the certificate of the second cloud service,
How to provide services in a cloud environment. In paragraph 7,
The steps to set the above access rights are:
If the user has access to the second cloud service, a step of sending a request for generating a second user authentication token of the user to the second cloud service; and
In response to receiving the above generation request, a step of generating a second user authentication token including information about the user's access rights to the second cloud service and a token expiration time using the access rights information,
How to provide services in a cloud environment. communication interface;
Memory into which computer programs are loaded; and
Including one or more processors on which the above computer program is executed,
The above computer program,
An action of receiving an access request for a second cloud service from a terminal of a user using a first cloud service;
In response to receiving the access request, an action of determining whether the first cloud service is authenticated in the second cloud service;
As a result of the above determination, if the first cloud service is authenticated in the second cloud service, an operation of transmitting the user's verification request to the first cloud service;
In response to the verification request, an operation of transmitting a user verification result regarding whether the user has access to the second cloud service to the second cloud service; and
Using the above user verification result, instructions are included to execute an operation for setting access rights to the second cloud service for the user.
The above first cloud service and the above second cloud service are services provided on the same cloud platform,
The above judgment action is,
An operation of receiving an authentication request for the first cloud service from the second cloud service when the first cloud service is not authenticated in the second cloud service;
In response to the authentication request, an action of generating authentication request data for the first cloud service using the certificate and public IP information of the second cloud service;
An action of encrypting the above authentication request data with a public key included in the certificate of the first cloud service;
An action of transmitting the encrypted authentication request data to the public IP of the first cloud service;
An operation of decrypting the encrypted authentication request data using the secret key of the first cloud service;
An operation of verifying whether the certificate authority of the second cloud service certificate included in the above authentication request data matches the certificate authority of the second cloud service certificate stored in the cloud platform; and
As a result of the above verification, if the certification authority of the certificate of the second cloud service included in the authentication request data matches the certification authority of the certificate of the second cloud service stored in the cloud platform, an operation of adding the second cloud service to the authentication target of the first cloud service so that the first cloud service can be provided in the second cloud service is included.
Service provision system in a cloud environment. delete