WO2018120913A1 - 一种获取证书、鉴权的方法及网络设备 - Google Patents

一种获取证书、鉴权的方法及网络设备 Download PDF

Info

Publication number
WO2018120913A1
WO2018120913A1 PCT/CN2017/101307 CN2017101307W WO2018120913A1 WO 2018120913 A1 WO2018120913 A1 WO 2018120913A1 CN 2017101307 W CN2017101307 W CN 2017101307W WO 2018120913 A1 WO2018120913 A1 WO 2018120913A1
Authority
WO
WIPO (PCT)
Prior art keywords
app
certificate
apis
api
equal
Prior art date
Application number
PCT/CN2017/101307
Other languages
English (en)
French (fr)
Inventor
张大成
付天福
周冲
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP17886998.8A priority Critical patent/EP3550786B1/en
Priority to JP2019534954A priority patent/JP6940240B2/ja
Publication of WO2018120913A1 publication Critical patent/WO2018120913A1/zh
Priority to US16/456,706 priority patent/US11451531B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Definitions

  • the present application relates to the field of network communication technologies, and relates to a method for acquiring a certificate, authenticating, and a network device.
  • SDX software definition everything
  • SDDC software-defined data center
  • SDS software-defined storage
  • the controller centrally controls all hardware capabilities. Moreover, the controller provides an application programming interface (API) to the user, and the user's various application programs (APPs) can access the API to perform network devices, security devices, virtual machines, and the like controlled by the controller. Configure management or get network information.
  • API application programming interface
  • APPs application programs
  • the APP comes from outside the controller and may be developed by a third party and used by the user, it is necessary to control the permissions of these APPs to prevent misuse and abuse of the controller's API.
  • the application provides a method for obtaining a certificate, an authentication, and a network device, so as to improve the operation authority control of the APP to the API.
  • a first aspect of the present application provides a method of obtaining a certificate.
  • the network device sends certificate application information including the APP to the certificate generation device, and the certificate generation device generates a certificate according to the APP and sends the generated certificate to the network device.
  • This certificate is used for the authority authentication when the APP accesses the API of the controller.
  • the certificate includes one or more of (a) to (c): (a) the operating authority information of the APP to the N application programming interface APIs of the controller, and (b) the N APIs have the right to operate the APP.
  • N is a natural number greater than or equal to 1
  • L is a natural number greater than or equal to 1
  • L is less than or equal to N
  • R is a natural number greater than or equal to 1
  • R is less than or equal to N.
  • the second aspect of the present application provides an authentication method, according to which the authentication device receives an access request message of an APP, and determines, according to the operation authority information carried in the certificate in the access request message, the N of the APP to the controller.
  • the operating permissions of the API The certificate of the access request message includes one or more of the above (a) to (c).
  • a third aspect of the present application provides a certificate generating device.
  • the device includes a communication interface and a certificate generation module.
  • the communication interface is configured to receive the certificate application information and send the certificate application information to the certificate generation module, where the certificate application information includes an application APP, and the certificate generation module is configured to receive the
  • the certificate application information generates a certificate according to the APP in the certificate application information, and the certificate includes one or more of the (a) to (c).
  • a fourth aspect of the present application provides a network device, where the network device includes a communication interface and an authentication module, where
  • the communication interface is configured to receive an access request message of an application APP, where the access request message includes a digital certificate, and the digital certificate includes one or more of the (a) to (c).
  • the authentication module is configured to determine, according to the operation authority information, an operation authority of the APP to the N APIs.
  • the operation authority of the APP to the API of the controller is carried in the certificate, and the APP provides the certificate for the authentication device to authenticate, and the authentication is performed.
  • the device determines, according to the API operation authority carried in the certificate, whether the APP has the right to operate the API that the APP requests to access. This helps control the operation rights of the APP access API, and the method is simple, which simplifies the authentication process.
  • the certificate includes (a) operation authority information of the N APIs of the APP to the controller, where the operation authority information includes an identifier of the N APIs, and the APP is in the N APIs.
  • the operational permissions of each API In this way, the authentication device can obtain the operation authority information of the APP for all APIs, so that it can determine whether the APP has the right to operate the API for the current application.
  • the operation authority information includes an identifier of the M API identifier sets, and the identifier of each API identifier set in the M API identifier set is used to identify operation rights of the K APIs in the API identifier set, where M is A natural number greater than or equal to 1, K is an integer greater than or equal to 0 and K is less than or equal to N.
  • M is A natural number greater than or equal to 1
  • K is an integer greater than or equal to 0
  • K is less than or equal to N.
  • the authentication device can determine which APIs the APP has the right to operate or have access to the resources identified by the set of API identifiers according to the set of API identifiers carried in the certificate.
  • the certificate includes (a) operation authority information of the APP to the N APIs of the controller, where the operation authority is represented by a bitmap.
  • the storage resources of the authentication device can be effectively reduced, and the authentication efficiency is improved.
  • one or more of the (a) to (c) are carried in the extended information of the certificate.
  • the APP can determine the access rights of the APP to the N APIs of the controller, thereby quickly determining whether the APP has access rights to the API for which the application is currently requested.
  • the network device is part of the controller or the controller.
  • the network device may be an authentication server.
  • the network device is a software defined network SDN controller.
  • Yet another aspect of the present application is directed to a network device including a processor and a memory in communication with the processor, the certificate generation method described above being executable when the processor executes an instruction or a computer program stored in the memory Or authentication method.
  • Yet another aspect of the present application is directed to a computer readable storage medium having instructions stored therein that, when executed on a computer, cause the computer to perform the certificate generation method or authentication method described above.
  • Yet another aspect of the present application provides a computer program product comprising instructions when run on a computer When the computer is caused to execute the above-described certificate generation method or authentication method.
  • FIG. 1 is a schematic diagram of networking of an SDN according to an embodiment of the present application
  • FIG. 2 is a schematic flowchart of a method for obtaining a certificate according to an embodiment of the present application
  • FIG. 3 is a schematic diagram of a composition of an operation authority information of an APP to an API included in a certificate according to an embodiment of the present application;
  • FIG. 4 is a schematic diagram of composition of operation authority information of another APP to an API included in a certificate according to an embodiment of the present application;
  • FIG. 5 is a schematic diagram of another composition of an operation authority information of an APP to an API included in a certificate according to an embodiment of the present application;
  • FIG. 6 is a schematic structural diagram of a certificate according to an embodiment of the present application.
  • FIG. 7 is a schematic flowchart diagram of an authentication method according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a policy data entry according to an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of another policy data entry according to an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of still another policy data entry according to an embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of a certificate generating device according to an embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of a network device according to an embodiment of the present application.
  • the SDX may be an SDN, SDDC, SDS, or software-defined infrastructure (SDI).
  • SDN SDN
  • SDS software-defined infrastructure
  • SDI software-defined infrastructure
  • an SDN includes a controller and X network elements controlled by the controller: a network element 1, a network element 2, and a network element X.
  • X is a natural number greater than or equal to 1.
  • the controller includes a data-control interface and an application-control interface.
  • Each of the network element 1 to the network element X communicates with the controller through the data-control interface to receive a forwarding table sent by the controller, and forwards the packet according to the forwarding table.
  • X is a natural number greater than or equal to 1.
  • the forwarding tables sent by the controller to different network elements may be the same or different.
  • the applications APP 1 to APP Z communicate with the controller through an application-control interface. Z is a natural number greater than or equal to 1.
  • the controller also provides N APIs, such as API 1 ⁇ API N, N is a natural number greater than or equal to 1.
  • Each API provides one or more resources to invoke application calls, such that the application can enable control of the corresponding resources by calling the API. For example, when an application APP 1 calls API 1, the application APP 1 can forward traffic using a bandwidth of 1 megabit per second (Mbps).
  • the APP 1 to the APP Z may invoke one or more of the API 1 to the API N provided by the controller through the ACI of the controller, so as to operate the network element 1 to the network controlled by the controller through the controller. Yuan Y.
  • the DCI is deployed with an OpenFlow protocol.
  • the DCI can further deploy a Path Computation Element Communication Protocol (PCEP), a Border Gateway Protocol (BGP), a Network Configuration (NETCONF) protocol, and an intermediate system to the middle.
  • PCEP Path Computation Element Communication Protocol
  • Border Gateway Protocol BGP
  • NETCONF Network Configuration
  • ISIS Intermediate System to Intermediate System
  • OSPF Open Shortest Path First
  • the API may be an OpenStack API or an OpenFlow API or a Representational State Transfer (RESTful) API.
  • a certificate refers to a public key certificate (English: public key certificate).
  • a certificate is also called a digital certificate (English: digital certificate), an identity certificate (English: identity certificate) or a security certificate.
  • a certificate is an electronic file used to prove the identity of the public key owner.
  • the certificate issued by the certificate issuing authority usually includes the certificate validity period, the public key, the principal (the certificate owner), and the algorithm used by the signature.
  • the certificate validity period indicates the validity time of the certificate
  • the public key is the public key password for encrypting the message
  • the subject (certificate owner) identifies the organization that uses the certificate
  • the algorithm used for the signature is used to verify the integrity of the certificate.
  • the algorithm used by the signature can ensure that the certificate has not been tampered with.
  • the principle is that when issuing the certificate, the issuing authority of the certificate calculates the hash value of the entire certificate according to the fingerprint algorithm and sends the hash value together with the certificate to the user of the certificate, the certificate.
  • the hash value of the certificate is calculated according to the fingerprint algorithm, and the hash value calculated by the user is compared with the hash value issued by the issuing authority of the certificate. If the two are the same, the certificate has not been tampered with.
  • the process and standards for this certification are specified in X.509.
  • a certificate obtaining method of the present application when an APP, such as APP 1, wishes to acquire a certificate to perform certain operations by accessing one or more APIs of the controller, the APP 1
  • the network device on the owner side submits the APP 1 to the certificate issuing authority, and the security device of the certificate issuing authority performs security detection on the APP 1.
  • N is a natural number greater than or equal to 1.
  • L is a natural number greater than or equal to 1, and L is less than or equal to N.
  • R is a natural number greater than or equal to 1, and R is less than or equal to N.
  • the certificate issuing device of the certificate issuing authority generates a certificate for the APP 1, and the certificate includes an access right of the APP 1 to the N APIs or a list of L APIs that the APP 1 has the right to operate in the N APIs, and the certificate is issued.
  • the certificate issuing device of the institution sends the certificate to the owner of APP 1.
  • the certificate issuing authority is the organization or individual that created the certificate, and the certificate issuing authority only creates the certificate instead of the user of the certificate.
  • the content (a) included in the certificate may include the operation authority of the APP for each API among the N APIs of the controller, and in FIG. 3, the N APIs of an APP to the controller are included.
  • API 1 and API 3 have operation rights, no operation rights to API 2 and API N, and operation rights for other APIs in N APIs are also included in content (a).
  • the identifiers of the L APIs that the APP has the right to operate in the N APIs included in the certificate it is assumed that an APP has only operation rights to API 1 and API 3 in the N APIs of the controller, and has no operation authority to other APIs in the N APIs of the controller, and the certificate may include only the APP has a list of identifiers for APIs with operational privileges: API 1 and API 3.
  • the identifiers of the R APIs that the APP does not have the right to operate in the N APIs included in the certificate are assumed that an APP has no operation authority only for API 1 and API 3 in the N APIs of the controller, and has operation authority for other APIs in the N APIs of the controller, and the certificate may include only the List of IDs for APIs without APP permissions: API 1 and API 3.
  • the security device performing security detection on the APP 1 may include performing a sandbox test on the APP 1.
  • the certificate may follow the X.509 standard, including:
  • Subject The identifiable name of the certificate owner.
  • the naming rules are generally in X.500 format.
  • Subject public key information the public key of the subject and the algorithm identifier.
  • Issuer Includes the identity information and signature of the certificate issuer.
  • Validity of the certificate the effective start and end time of the certificate.
  • Management information certificate version, encryption algorithm identification, serial number and other information.
  • Certificate extension information (Extensions): including basic constraints, related identifiers, etc.
  • the extended information of the certificate can include three fields: type, default, and value.
  • the type field defines the data type in the extended value field. This type can be a simple string, a numeric value, a date, a picture, or a complex data type. For easy interaction, all data types are registered with internationally renowned organizations. Whether the default field is a one-bit flag. When an extension identifier is not configurable by default, the corresponding extension value is important, and the application cannot ignore this information. If an application that uses a special certificate cannot process the contents of this field, it should reject the certificate.
  • the value field contains the actual data for this extension.
  • One or more of the (a) to (c) may be carried in the extension information of the certificate generated by the certificate generation device.
  • an APP such as APP 1
  • the authentication device verifies whether the certificate provided by the APP 1 is valid, and if it is determined that the certificate provided by APP 1 is valid. And the authentication device further determines which API or APIs the APP 1 has access to according to the (a) to (c) included in the certificate.
  • the authentication device can be located on the controller, or independent of the controller, or the controller itself can also perform authentication of the APP as an authentication device.
  • the authentication device determines, according to the content (a), an API having the operation authority of the APP, and determines whether the API 1 is the APP.
  • An API having an operation authority that is, determining whether the API 1 is one of the N APIs of the controller, and if the API 1 is one of the N APIs of the controller, further determining the APP 1 to API If the permission of 1 is "having operation permission”, if APP 1 has the operation permission of API 1 as "having operation permission”, the APP 1 is allowed to operate API 1; if APP 1 operates the permission of API 1 as "no operation permission” ", does not allow APP 1 to operate API 1.
  • the response information may be returned to the APP 1, the response information including the indication APP 1 to the API 1 Information with operational permissions.
  • the authentication device determines, according to the content (b), whether the API that the APP attempts to access is in the content. (b), that is, whether the API 1 is in the content (b), if the API 1 is in the content (b), it is determined that the APP 1 has the operation authority to the API 1, and the APP 1 is allowed to operate the API 1; if the APP 1 If it is not in the content (b), it is determined that the APP 1 has no operation right for the API 1, and the APP 1 is not allowed to operate the API 1.
  • the response information may be returned to the APP 1, the response information including information indicating that the APP 1 has the operation authority for the API 1.
  • the authentication device determines, according to the content (c), whether the API that the APP attempts to access is in the content. (c) In the case of determining whether the API 1 that the APP 1 is trying to access is in the content (c), if the API 1 is in the content (c), determining that the APP 1 has no operation right for the API 1, the APP 1 is not allowed to operate the API 1; If APP 1 is not in content (c), it is determined that APP 1 has an operation right to API 1, and APP 1 is allowed to operate API 1.
  • the method for generating a certificate, the method for authenticating the controller, and the controller of the present application carry the operation authority of the APP to the API of the controller in the certificate, and the APP provides the certificate for the authentication device when accessing the API of the controller, and the authentication device
  • the API operation authority carried in the certificate it is determined whether the APP has the right to operate the API that the APP requests to access. This helps control the operation rights of the APP access API, and the method is simple, which simplifies the authentication process.
  • the response information may be returned to the APP 1, the response information including information indicating that the APP 1 has the operation authority for the API 1.
  • the address of the foregoing API may be a Uniform Resource Locator (URL).
  • the API list can include one or more API identities.
  • the API identifier can be a number or other identifier that can be used to uniquely identify an API or class of APIs.
  • the “operation authority” includes “call authority”, and the “operation” includes “call”.
  • the “operation” includes “call”.
  • APP 1 has an operation right to API 1
  • APP 1 does not have permission to operate on API 1, which means that APP 1 is not allowed to call API 1.
  • “Operation Permissions” may also include other possible content, such as one or more of "Modify Permissions", “Replace Permissions”, and the like.
  • “Modify permission” means that the APP has the right to modify the API
  • "Replace permission” means that the APP can replace the API with other content.
  • the content of the APP includes content (a).
  • the API can be a URL.
  • the bitmap can be used to indicate the operation authority of the APP for each API. For example, each API in the API list in the certificate of the APP is numbered by one binary bit, and the value of the corresponding bit in the binary number is used to indicate the operation authority of the APP to the API corresponding to the binary bit. For example, suppose the controller has four APIs, identified as API 1, API 2, API 3, and API 4.
  • API 1, API 2, API 3 and API 4 can be sequentially mapped to one binary bit, then a binary sequence ABCD is obtained, where A corresponds to API 1 and A is the identifier of API 1, and the binary value of A can represent APP 1 to API.
  • 1 operation authority, BCD is similar.
  • the binary location corresponding to the API that the APP has access to may be 1, and the binary location corresponding to the API that the APP does not have access to is 0, and vice versa.
  • APP's access rights to API 1, API 2, API 3, and API 4 correspond to values of 4 binary bits, respectively.
  • the APP has an operation permission value of 1100 for all APIs of the controller, and the APP's certificate includes the operation of the APP for 4 APIs.
  • the permission value is 1100.
  • the controller determines that the operation permission value of all the APIs of the controller included in the certificate provided by the APP is 1100, the controller determines that the APP has access to the API 1 and API 2 of the controller, and does not have access to the controller. API 3 and API 4.
  • the certificate provided by the APP includes the content (b), and the certificate of the APP includes one or more API identifiers, where the one or more API identifiers are used to indicate that the APP has the right to operate the one or more API identifies the API identified.
  • the certificate provided by the APP includes the content (c), and the certificate of the APP includes one or more API identifiers, where the one or more API identifiers are used to indicate that the APP does not have the right to operate the one or more API identifies the API identified.
  • the plurality of APIs of the controller are divided into a plurality of API Sets, each of which may include one or more API identifiers, and each API Set may be used to identify a specific set of APIs. resource of.
  • the APP has the same operation authority for the API identified by the API identifier in the API identifier set.
  • the APP may have different operation rights to the API identified by the APIAPI identifier in the API identifier set, and multiple APIs of different operation rights constitute an access permission combination, if the APP has access to the The API identifies the collection, and the APP has the right to operate the access permission combination.
  • the certificate provided by the APP may include one or more API sets.
  • the controller has 4 APIs, and the IDs of the 4 APIs are API 1, API 2, API 3, and API 4.
  • API Set 1 includes API 1 and API 2
  • API Set 2 includes API 3
  • API Set 3 includes API 4.
  • the API identifier list included in the API Set is used to indicate that the APP has the right to operate the API in the API Set, in which case, if the APP 1 has the right to operate the API 1 and the API 2 without authorization
  • API 1 will only include API Set 1 and will not include API Set 2 and API Set 3.
  • the API identifier list included in the API Set is used to indicate that the APP does not have the right to operate the API in the API Set and has the right to operate other APIs in the N APIs except the API Set.
  • APP 1's certificate will only include API Set 2 and API Set 3 without including API Set 1.
  • the operation authority information of the APP to the API of the controller acquired by the authentication device may be saved in the manner of the policy data table item on the authentication device or the controller or other storage device that communicates with the authentication device.
  • the format and content of the policy data entry are as shown in FIGS. 8-10, including one or more of (a') to (c'): (a') APP identifier and N APIs of the APP to the controller.
  • mapping relationship of the operation authority a mapping relationship between the (b') APP identifier and the identifiers of the L APIs in which the APP is authorized to operate, and (c') the APP identifier and the N APIs
  • the policy data entry of the APP 1 includes the APP 1 of the APP, and the operation authority of the APP 1 to all APIs of the controller, and Y represents the corresponding pair of APP 1
  • the API has the operation permission
  • N means that APP 1 has no operation permission for the API.
  • the operation authority can also be represented by other symbols, such as using a certain number or character to indicate that APP 1 has the operation authority for the API, and other Different numbers or characters indicate that APP 1 has no operational rights to the API.
  • the policy data table entry of the APP 1 includes the APP 1 of the APP, and an identifier list API List 1 of the API in which all the APIs of the controller have the operation authority.
  • the API List 1 includes an identification API 1, an API 2, an API 5, and an API 7 of an API in which the APP 1 has an operation right.
  • the policy data entry of the APP 1 includes the APP 1 of the APP, and an identifier list API List 1 of the API of the APP that has no operation authority in all APIs of the controller.
  • the API List 1 includes the identification API 1, API 2, API 5, and API 7 of the API for which the APP 1 has no operation authority.
  • the authentication device may only maintain one of the above (a'), (b'), and (c'), or only maintain the mapping relationship between the APP and the API set identifier to which the APP is authorized to operate. Because these mapping relationships are relatively static, it is easy to maintain the authentication device.
  • the policy data entry included in the authentication device may be aged to reduce the size of the policy data.
  • the authentication device may be a separate network device, such as a server, or part of a controller.
  • the certificate generation device shown in FIG. 2 includes a communication interface 1102 and a certificate generation module 1104, and the communication interface 1102 is configured to receive certificate application information and send the certificate application information to the certificate generation module.
  • the certificate application information includes an application APP;
  • the certificate generation module 1104 is configured to receive the certificate application information sent by the communication interface, and generate a certificate according to the APP in the certificate application information, where the certificate includes the above ( One or more of a) to (c).
  • the communication interface can also be used to return a certificate containing operational authority information of the APP to the controller's API to the network device that issued the certificate request information.
  • the certificate generating device may further include a security detecting module 1106, configured to perform security detection on the APP received by the communication interface 1102 to determine a security feature of the APP, and determine that the APP has the right to operate after determining the security feature of the APP. Controller API.
  • the certificate generating device may not include the security detecting module 1106, but set an independent security detecting device outside the certificate generating device, and the security detecting device performs security detection on the APP received by the communication interface 1102 to determine the The security feature of the APP determines the controller API that the APP has the right to operate after determining the security features of the APP.
  • the certificate generation module 1104 can be implemented by using a general-purpose CPU or an Application Specific Integrated Circuit (ASIC) or a Field-Programmable Gate Array (FPGA).
  • the authentication device shown in FIG. 4 includes a communication interface 1202 and an authentication module 1204.
  • the communication interface 1202 is configured to receive an access request message of an application APP, where the access request message includes a digital certificate, where the digital certificate includes one or more of the foregoing (a) to (c);
  • the authentication module 1204 is configured to determine, according to the operation authority information, an operation authority of the APP to the N APIs.
  • the authentication module 1204 can be implemented by a CPU or an ASIC or an FPGA.
  • the authentication device may be any network device capable of implementing the foregoing authentication method.
  • the authentication device can be a network device that is independent of the controller or can be part of the controller. When the authentication device is part of a controller, the authentication device can be implemented by a physical device or a software module.
  • Yet another aspect of the present application is directed to a network device including a processor and a memory in communication with the processor, the certificate generation method described above being executable when the processor executes an instruction or a computer program stored in the memory Or authentication method.
  • Yet another aspect of the present application is directed to a computer readable storage medium having instructions stored therein that, when executed on a computer, cause the computer to perform the certificate generation method or authentication method described above.
  • Yet another aspect of the present application provides a computer program product comprising instructions which, when run on a computer, cause the computer to perform the certificate generation method or authentication method described above.
  • the above embodiments it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer program instructions When the computer program instructions are loaded and executed on a computer, the processes or functions described in accordance with embodiments of the present invention are generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in or transmitted by a computer readable storage medium.
  • the computer instructions can be from a website site, computer, server or data center to another website site by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.) Transfer from a computer, server, or data center.
  • the computer readable storage medium can be a computer capable Any available media that is accessible.
  • the computer instructions can be stored or transmitted using a magnetic medium, such as a floppy disk, a hard disk, a magnetic tape, an optical medium (eg, a DVD), or a semiconductor medium (eg, a Solid State Disk (SSD)).
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit or module is only a logical function division.
  • there may be another division manner for example, multiple units or components may be used. Combinations can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit/module in each embodiment of the present invention may be integrated into one processing unit/module, or each unit may exist physically separately, or two or more units/modules may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional units.
  • the authentication module, the certificate generation module, and the like can be implemented by a CPU or an ASIC or an FPGA.
  • the above-described integrated unit implemented in the form of a software functional unit can be stored in a computer readable storage medium.
  • the software functional units described above are stored in a storage medium and include instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform portions of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, and the program code can be stored. Medium.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Stored Programmes (AREA)
  • Storage Device Security (AREA)

Abstract

本申请提供一种获取证书、鉴权的方法及网络设备，以改善APP对API的操作权限控制。根据该方法，网络设备向证书生成设备发送包含APP的证书申请信息，该证书生成设备根据所述APP生成证书并将生成的证书发给网络设备。该证书用于所述APP访问控制器的API时的权限认证。该证书包括(a)～(c)中的一个或多个：(a)该APP对控制器的N个应用程序编程接口API的操作权限信息，(b)N个API中该APP有权操作的L个API的标识，(c)该N个API中该APP无权操作的R个API的标识，N为大于或等于1的自然数，L为大于或等于1的自然数，并且L小于或等于N，R为大于或等于1的自然数，并且R小于或等于N。

Description

一种获取证书、鉴权的方法及网络设备
本申请要求于2016年12月28日提交中国专利局、申请号为201611238763.5、申请名称为“一种获取证书、鉴权的方法及网络设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络通信技术领域，涉及一种获取证书、鉴权的方法及网络设备。
背景技术
软件定义一切(英文：software defined anything，SDX)是所有种类的软件定义计算技术的集合。SDX中软件在控制硬件中起主要作用。常见的SDX技术包括软件定义网络(英文：software-defined networking，SDN)、软件定义数据中心(英文：software-defined data center，SDDC)、软件定义存储(英文：software-defined storage，SDS)等。
SDX架构中，控制器集中控制所有的硬件能力。并且，控制器向用户提供应用编程接口(英文：application programming interface，API)，用户的各种应用程序(APP)可以访问该API以对控制器所控制的网络设备、安全设备、虚拟机等进行配置管理，或获取网络信息。
然而，由于APP来自控制器外部，可能由第三方开发、由用户使用，有必要控制这些APP的权限，以防止对控制器的API的误用和滥用。
发明内容
本申请提供了一种获取证书、鉴权的方法及网络设备，以改善APP对API的操作权限控制。
本申请的第一方面提供一种获取证书的方法。根据该方法，网络设备向证书生成设备发送包含APP的证书申请信息，该证书生成设备根据所述APP生成证书并将生成的证书发给网络设备。该证书用于所述APP访问控制器的API时的权限认证。该证书包括(a)～(c)中的一个或多个：(a)该APP对控制器的N个应用程序编程接口API的操作权限信息，(b)N个API中该APP有权操作的L个API的标识，(c)该N个API中该APP无权操作的R个API的标识，N为大于或等于1的自然数，L为大于或等于1的自然数，并且L小于或等于N，R为大于或等于1的自然数，并且R小于或等于N。
本申请的第二方面提供一种鉴权方法，根据该方法，鉴权设备接收APP的访问请求消息，根据该访问请求消息中的证书中携带的操作权限信息确定所述APP对控制器的N个API的的操作权限。该访问请求消息的证书包括所述(a)～(c)中的一个或多个。
本申请的第三方面提供一种证书生成设备。该设备包括通信接口和证书生成模块。所述通信接口用于接收证书申请信息并发送所述证书申请信息给所述证书生成模块，所述证书申请信息包括应用程序APP；所述证书生成模块用于接收所述通信接口发送的所述证书申请信息，根据所述证书申请信息中的所述APP生成证书，所述证书包括所述(a)～(c)中的一个或多个。
本申请的第四方面提供一种网络设备，该网络设备包括通信接口和鉴权模块，其中，
所述通信接口，用于接收应用程序APP的访问请求消息，所述访问请求消息包括数字证书，所述数字证书中包括所述(a)～(c)中的一个或多个。所述鉴权模块，用于根据所述操作权限信息确定所述APP对所述N个API的操作权限。
在本申请的生成证书的方法、鉴权的方法和设备中，将APP对控制器的API的操作权限携带在证书中，APP访问控制器的API时提供该证书供鉴权设备认证，鉴权设备根据证书中携带的API操作权限确定该APP是否有权操作该APP申请访问的API。这有助于对APP访问API的操作权限控制，且方法简单，简化了鉴权过程。
可选地，所述证书包括(a)所述APP对控制器的N个API的操作权限信息，所述操作权限信息包括所述N个API的标识以及所述APP对所述N个API中的每个API的操作权限。这样，鉴权设备可以获取到该APP对所有API的操作权限信息，从而可以确定该APP对当前申请访问的API是否有权操作。
可选地，所述操作权限信息包括M个API标识集合的标识，该M个API标识集合中的每个API标识集合的标识用于标识该API标识集合中K个API的操作权限，M为大于或等于1的自然数，K为大于或等于0的整数且K小于或等于N。这样，鉴权设备可以根据证书中携带的API标识集合确定该APP有权操作哪些API或者有权访问该API标识集合所标识的资源。
可选地，所述证书包括(a)所述APP对控制器的N个API的操作权限信息，所述操作权限用位图表示。这样，可以有效减少占用鉴权设备的存储资源，并提高鉴权效率。
可选地，所述(a)～(c)中的一个或多个携带在所述证书的扩展信息中。这样，鉴权设备在根据证书对该APP进行认证时，即可确定该APP对控制器的N个API的访问权限，从而快速确定该APP对其当前申请访问的API是否有访问权限。
可选地，所述网络设备为所述控制器或所述控制器的一部分。该网络设备可能是鉴权服务器。
可选地，所述网络设备是软件定义网络SDN控制器。
本申请的又一方面提了供一种网络设备，该网络设备包括处理器和与该处理器通信的存储器，当处理器运行存储器中存储的指令或计算机程序时，可以执行上述的证书生成方法或鉴权方法。
本申请的又一方面提了供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述的证书生成方法或鉴权方法。
本申请的又一方面提供了一种包含指令的计算机程序产品，当其在计算机上运行 时，使得计算机执行上述的证书生成方法或鉴权方法。
附图说明
图1为本申请实施例的一种SDN的组网示意图；
图2为本申请实施例的证书获取方法方法流程示意图；
图3为本申请实施例的证书包括的一种APP对API的操作权限信息的组成示意图；
图4为本申请实施例的证书包括的另一种APP对API的操作权限信息的组成示意图；
图5为本申请实施例的证书包括的又一种APP对API的操作权限信息的组成示意图；
图6为本申请实施例的证书的组成示意图；
图7为本申请实施例的鉴权方法的流程示意图；
图8为本申请实施例的一种策略数据表项的组成示意图；
图9为本申请实施例的另一种策略数据表项的组成示意图；
图10为本申请实施例的又一种策略数据表项的组成示意图；
图11为本申请实施例的一种证书生成设备的组成示意图；
图12为本申请实施例的一种网络设备的组成示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。
本申请中，SDX可以是SDN、SDDC、SDS或软件定义基础设施(英文：software-defined infrastructure，SDI)。以下以SDN为例描述本申请的各个实施方式，但是本申请的各个实施方式也适用于SDX中的SDDC、SDS或SDI等。
如图1所示，一种SDN包括控制器和该控制器控制的X个网元：网元1、网元2、…网元X。X为大于或等于1的自然数。该控制器包括数据-控制接口和应用-控制接口。网元1～网元X中的每个网元通过所述数据-控制接口与控制器通信，以接收控制器发送的转发表，并根据转发表转发报文。X为大于或等于1的自然数。控制器发送给不同网元的转发表可能相同或不同。应用程序APP 1～APP Z通过应用-控制接口与该控制器通信。Z为大于或等于1的自然数。该控制器还提供N个API，比如API 1～API N，N为大于或等于1的自然数。每个API提供一种或多种资源，以供应用程序调用，从而可以使得所述应用程序可以通过调用该API实现对对应资源的控制。比如当某个应用程序APP 1调用API 1时，该应用程序APP 1可以使用1兆比特每秒(Mbps)的带宽转发流量。具体地，APP 1～APP Z可以通过该控制器的ACI调用该控制器提供的API 1～API N中的一个或多个，以通过该控制器来操作该控制器控制的网元1～网元Y。
可选地，DCI部署有开流(OpenFlow)协议。可选地，DCI也可以进一步部署路径计算单元通信协议(英文：Path Computation Element Communication Protocol，PCEP)、边界网关协议(英文：Border Gateway Protocol，BGP)、网络配置(NETCONF)协议、中间***到中间***(英文：Intermediate System to Intermediate System，ISIS) 协议、开放最短路径优先(Open Shortest Path First，OSPF)协议中的一个或多个。
可选地，所述API可以是开栈(OpenStack)API或OpenFlow API或代表性状态转移(英文：Representational State Transfer，RESTful)API。
在密码学中，证书是指公开密钥证书(英文：public key certificate)。证书又称数字证书(英文：digital certificate)、身份证书(英文：identity certificate)或安全证书。证书是用来证明公开密钥所有者的身份的电子文件。证书发布机构发布的证书通常包括证书有效期、公钥、主体(证书所有者)和签名所使用的算法。其中，证书有效期表示证书的有效时间，公钥是对消息进行加密的公钥密码，主体(证书所有者)标识使用证书的组织，签名所使用的算法用于验证证书的完整性。签名所使用的算法可以确保证书没有被篡改，其原理是，在发布证书时，证书的发布机构根据指纹算法计算整个证书的hash值并将该hash值与证书一起发给证书的使用者，证书的使用者在打开证书时，根据指纹算法计算证书的hash值，并将自己计算得到的hash值与证书的发布机构发布的hash值比较，如果二者相同，则表明证书未被篡改过。在X.509中规范了这个认证的过程与标准。
如图2所示，本申请的一种证书获取方法中，当某个APP，比如APP 1希望获取证书，以通过访问控制器的一个或多个API来执行某些操作时，该APP 1的拥有者一侧的网络设备将该APP 1提交给证书发布机构，证书发布机构的安全设备对APP 1进行安全检测。根据安全设备的安全检测结果确定(a)～(c)中的一个或多个：(a)该APP对控制器的N个API中每个API的操作权限；(b)所述N个API中所述APP有权操作的L个API的标识；(c)所述N个API中所述APP无权操作的R个API的标识。N为大于或等于1的自然数。L为大于或等于1的自然数，并且L小于或等于N。R为大于或等于1的自然数，并且R小于或等于N。证书发布机构的证书生成设备为该APP 1生成证书，该证书中包括APP 1对所述N个API的访问权限或者所述N个API中APP 1有权操作的L个API列表，该证书发布机构的证书发布设备将所述证书发给APP 1的拥有者。证书发布机构是创建证书的组织或个人，证书发布机构只创建证书而不是证书的使用者。
如图3所示，证书中包括的内容(a)可以包括控制器的N个API中、所述APP对每个API的操作权限，图3中，某个APP对控制器的N个API中的API 1和API 3有操作权限，对API 2和API N没有操作权限，对于N个API中的其他API的操作权限，也包括在内容(a)中。
如图4所示，证书中包括的内容所述N个API中所述APP有权操作的L个API的标识。图4中，假定某个APP只对控制器的N个API中的API 1和API 3有操作权限，对控制器的N个API中的其他API没有操作权限，则证书中可以只包括所述APP有操作权限的API的标识的列表：API 1和API 3。
如图5所示，证书中包括的内容所述N个API中所述APP无权操作的R个API的标识。图5中，假定某个APP只对控制器的N个API中的API 1和API 3无操作权限，对控制器的N个API中的其他API有操作权限，则证书中可以只包括所述APP无操作权限的API的标识的列表：API 1和API 3。
可选地，所述安全设备对APP 1进行安全检测可以包括：对APP 1进行沙箱测试。
可选地，如图6所示，所述证书可以遵循X.509标准，包括：
1)主体(Subject)：证书拥有者的可识别名称，命名规则一般采用X.500格式。
2)主体公钥信息：主体的公钥及算法标识符。
3)证书发布者(Issuer)：包括证书发布者的身份信息及签名。
4)证书的有效期(Validity)：证书的有效的起始与结束时间。
5)管理信息：证书的版本、加密算法标识、序列号等信息。
6)证书扩展信息(Extensions)：包括基本约束，相关标识等。
证书的扩展信息可以包括三个域：类型、可否缺省、值。类型字段定义了扩展值字段中的数据类型。这个类型可以是简单的字符串、数值、日期、图片或一个复杂的数据类型。为便于交互，所有的数据类型都在国际知名组织进行注册。是否可缺省字段是一比特标识位。当一扩展标识为不可缺省时，说明相应的扩展值比较重要，应用程序不能忽略这个信息。如果使用一特殊证书的应用程序不能处理该字段的内容，就应该拒绝此证书。值字段包含了这个扩展实际的数据。
所述(a)～(c)中的一个或多个可以携带在证书生成设备生成的证书的扩展信息中。
如图7所示，当某个APP，比如APP 1，试图访问控制器上的特定API，比如API 1时，鉴权设备验证该APP 1提供的证书是否有效，如果确定APP 1提供的证书有效，则鉴权设备进一步根据该证书中包括的所述(a)～(c)，确定APP 1有权访问控制器的哪个或哪些API。鉴权设备可以位于控制器上，或者独立于控制器，或者控制器本身也可以作为鉴权设备完成对APP的鉴权。
具体地，如果证书包括所述内容(a)该APP对控制器的N个API的操作权限信息，则鉴权设备根据内容(a)确定该APP有操作权限的API，确定API 1是否该APP有操作权限的API，也就是说，确定API 1是否所述控制器的N个API之一，如果所述API 1是所述控制器的N个API中的一个，则进一步确定APP 1对API 1的权限是否是“有操作权限”，如果APP 1对API 1的操作权限为“有操作权限”，则允许该APP 1操作API 1；如果APP 1对API 1的操作权限为“无操作权限”，则不允许APP 1操作API 1。可选地，如果APP 1对API 1的操作权限为“有操作权限”，除了允许该APP 1操作API 1之外，还可以向APP 1返回响应信息，该响应信息包括指示APP 1对API 1有操作权限的信息。
具体地，如果证书包括所述内容(b)所述N个API中所述APP有权操作的L个API的标识，则鉴权设备根据内容(b)确定该APP试图访问的API是否在内容(b)中，即确定API 1是否在内容(b)中，如果API 1在内容(b)中，则确定APP 1对API 1有操作权限，则允许该APP 1操作API 1；如果APP 1不在内容(b)中，则确定APP 1对API 1无操作权限，则不允许APP 1操作API 1。可选地，如果APP 1对API 1有操作权限，除了允许该APP 1操作API 1之外，还可以向APP 1返回响应信息，该响应信息包括指示APP 1对API 1有操作权限的信息。
具体地，如果证书包括所述内容(c)所述N个API中所述APP无权操作的R个API的标识，则鉴权设备根据内容(c)确定该APP试图访问的API是否在内容(c) 中，即确定APP 1试图访问的API 1是否在内容(c)中，如果API 1在内容(c)中，则确定APP 1对API 1无操作权限，则不允许该APP 1操作API 1；如果APP 1不在内容(c)中，则确定APP 1对API 1有操作权限，则允许APP 1操作API 1。
本申请的生成证书的方法、鉴权的方法和控制器，将APP对控制器的API的操作权限携带在证书中，APP访问控制器的API时提供该证书供鉴权设备认证，鉴权设备根据证书中携带的API操作权限确定该APP是否有权操作该APP申请访问的API。这有助于对APP访问API的操作权限控制，且方法简单，简化了鉴权过程。
可选地，如果APP 1对API 1有操作权限，除了允许该APP 1操作API 1之外，还可以向APP 1返回响应信息，该响应信息包括指示APP 1对API 1有操作权限的信息。
可选地，上述API的地址可以是统一资源***(Uniform Resource Locator，URL)。API list可以包括一个或多个API标识。所述API标识可以是编号或其他可以用于唯一标识某个API或某类API的标识。
可选地，上述实施例方式中，所述“操作权限”包括“调用权限”，所述“操作”包括“调用”，比如APP 1对API 1有操作权限，则表示允许APP 1调用API 1；APP 1对API 1无操作权限，则表示不允许APP 1调用API 1。当然，“操作权限”还可以包括其他可能的内容，比如“修改权限”、“替换权限”等中的一个或多个。“修改权限”表示APP对该API有修改的权限，“替换权限”表示该APP可以将该API替换为其他内容。
在一种实施方式中，所述APP的证书中包括内容(a)。API可以是URL。为了节省证书所占用的空间，可以用位图表示该APP对每个API的操作权限。例如，将APP的证书中的API list中的每个API用一个二进制位编号，并用二进制数中对应的位的值来表示该APP对对应这个二进制位的API的操作权限。比如，假定控制器有4个API，分别标识为API 1、API 2、API 3和API 4。可以将API 1、API 2、API 3和API 4依次对应到一个二进制位，则得到一个二进制序列ABCD，其中A对应API 1并且A作为API 1的标识，A的二进制数值可以表示APP 1对API 1的操作权限，BCD类似。可选地，可以将APP有权访问的API对应的二进制位置为1，将APP无权访问的API对应的二进制位置为0，反之亦然。例如，APP对API 1、API 2、API 3和API 4的访问权限分别对应4个二进制位的值。如果APP有权操作API 1和API 2而无权操作API 3和API 4，则该APP对控制器的所有API的操作权限值为1100，该APP的证书中包括该APP对4个API的操作权限值1100。当控制器确定该APP提供的证书中包括的控制器的所有API的操作权限值为1100时，该控制器确定该APP有权访问该控制器的API 1和API 2，无权访问该控制器的API 3和API 4。
在一种实施方式中，APP提供的证书包括内容(b)，则该APP的证书包括一个或多个API标识，所述一个或多个API标识用于表示该APP有权操作该一个或多个API标识所标识的API。
在一种实施方式中，APP提供的证书包括内容(c)，则该APP的证书包括一个或多个API标识，所述一个或多个API标识用于表示该APP无权操作该一个或多个API标识所标识的API。
在一种实施方式中，控制器的多个API被分为多个API标识集合(API Set)，每个API Set可以包括一个或多个API标识，每个API Set可以用于标识一组特定的资源。在一种实施方式中，所述APP对所述API标识集合中的API标识所标识的API的操作权限相同。在另一种实施方式中，所述APP对所述API标识集合中的APIAPI标识所标识的API的操作权限可以不同，多个不同操作权限的API组成一个访问权限组合，如果APP有权访问该API标识集合，则该APP有权操作该访问权限组合。APP提供的证书中可以包括一个或多个API Set。例如，控制器有4个API，4个API的标识分别为API 1、API 2、API 3和API 4。API Set 1包括API 1和API 2，API Set 2包括API 3，API Set 3包括API 4。在一种实施方式中，API Set中包含的API标识列表用于表示该APP有权操作API Set中的API，在这种情况下，如果APP 1有权操作API 1和API 2而无权操作API 3和API 4，则APP 1的证书中会只包括API Set 1而不包括API Set 2和API Set 3。在另一种实施方式中，API Set中包含的API标识列表用于表示该APP无权操作API Set中的API而有权操作N个API中、除了该API Set的其他API，在这种情况下，如果APP 1有权操作API 1和API 2而无权操作API 3和API 4，则APP 1的证书中会只包括API Set 2和API Set 3而不包括API Set 1。
在一种实施方式中，鉴权设备获取的APP对控制器的API的操作权限信息，可以以策略数据表项的方式保存在鉴权设备或控制器或与鉴权设备通信的其他存储设备上，策略数据表项的格式和内容如图8～10所示，包括(a’)～(c’)中的一个或多个：(a’)APP标识和该APP对控制器的N个API的操作权限的映射关系，(b’)APP标识和所述N个API中所述APP有权操作的L个API的标识的映射关系，(c’)APP标识和所述N个API中所述APP无权操作的R个API的标识的映射关系。
根据图8，对于任意一个APP，比如APP 1，该APP 1的策略数据表项包括该APP的标识APP 1、以及该APP 1对控制器的所有API的操作权限，Y表示APP 1对对应的API有操作权限，N表示APP 1对该API没有操作权限，当然，操作权限也可以用其他符号来表示，比如用某个数字或字符来表示APP 1对该API有操作权限，而用其他的不同数字或字符来表示APP 1对该API没有操作权限。
根据图9，对于一个APP，比如APP 1，该APP 1的策略数据表项包括该APP的标识APP 1、以及控制器的所有API中该APP 1有操作权限的API的标识列表API List 1，API List 1包括该APP 1有操作权限的API的标识API 1、API 2、API 5和API 7。
根据图10，对于一个APP，比如APP 1，该APP 1的策略数据表项包括该APP的标识APP 1、以及控制器的所有API中该APP 1没有操作权限的API的标识列表API List 1，API List 1包括该APP 1无操作权限的API的标识API 1、API 2、API 5和API 7。
在一种实施方式中，鉴权设备可以只维护以上(a’)、(b’)和(c’)中的一种，或者只维护APP与该APP有权操作的API集合标识的映射关系，由于这些映射关系相对静态，便于维护鉴权设备。可选地，鉴权设备包含的策略数据表项可以被老化，以减少策略数据看的大小。
在一种实施方式中，鉴权设备可以是单独的网络设备，比如服务器，也可以是控制器的一部分。
如图11所示，图2所示的证书生成设备包括通信接口1102和证书生成模块1104，所述通信接口1102用于接收证书申请信息并发送所述证书申请信息给所述证书生成模块，所述证书申请信息包括应用程序APP；所述证书生成模块1104用于接收所述通信接口发送的所述证书申请信息，根据所述证书申请信息中的所述APP生成证书，所述证书包括上述(a)～(c)中的一个或多个。该通信接口还可以用于向发出证书申请信息的网络设备返回包含APP对控制器的API的操作权限信息的证书。另外，该证书生成设备还可以包括安全检测模块1106，用于对通信接口1102收到的APP进行安全检测，以确定该APP的安全特性，在确定该APP的安全特性后确定该APP有权操作的控制器API。可选地，该证书生成设备可以不包括安全检测模块1106，而是在证书生成设备之外设置独立的安全检测设备，该安全检测设备对通信接口1102收到的APP进行安全检测，以确定该APP的安全特性，在确定该APP的安全特性后确定该APP有权操作的控制器API。可选地，证书生成模块1104可以通过通用中央处理器CPU或专用集成电路(Application Specific Integrated Circuit，ASIC)或现场可编程门阵列(Field－Programmable Gate Array，FPGA)来实现
如图12所示，图4所示的鉴权设备包括通信接口1202和鉴权模块1204。所述通信接口1202用于接收应用程序APP的访问请求消息，所述该访问请求消息包括数字证书，所述该数字证书中包括上述(a)～(c)中的一个或多个；所述鉴权模块1204用于根据所述操作权限信息确定所述该APP对所述N个API的操作权限。可选地，鉴权模块1204可以通过CPU或ASIC或FPGA来实现。可选地，该鉴权设备可以是能够实现上述鉴权方法的任意网络设备。该鉴权设备可以是独立于控制器的网络设备，也可以是控制器的一部分。该鉴权设备为控制器的一部分时，该鉴权设备可以通过物理器件或者软件模块来实现。
本申请的又一方面提了供一种网络设备，该网络设备包括处理器和与该处理器通信的存储器，当处理器运行存储器中存储的指令或计算机程序时，可以执行上述的证书生成方法或鉴权方法。
本申请的又一方面提了供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述的证书生成方法或鉴权方法。
本申请的又一方面提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述的证书生成方法或鉴权方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者通过所述计算机可读存储介质进行传输。所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能 够存取的任何可用介质。例如，可以利用磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))来存储或传输所述计算机指令。
在本申请所提供的几个实施例中，应该理解到，所揭露的***，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元或模块的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个***，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元/模块可以集成在一个处理单元/模块中，也可以是各个单元单独物理存在，也可以两个或两个以上单元/模块集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。比如，鉴权模块、证书生成模块等都可以通过CPU或ASIC或FPGA来实现。
上述以软件功能单元的形式实现的集成的单元，可以存储在一个计算机可读取存储介质中。上述软件功能单元存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，简称ROM)、随机存取存储器(Random Access Memory，简称RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明较佳的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到的变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应该以权利要求的保护范围为准。

Claims (26)

  1. 一种获取证书的方法，其特征在于，包括：
    网络设备向证书发布设备发送证书申请信息，所述证书申请信息包括APP；
    所述网络设备接收所述证书发布设备返回的APP的证书，所述证书是由所述证书发布设备根据所述APP生成的；所述证书用于所述APP访问控制器的API时的权限认证；
    所述证书包括(a)～(c)中的一个或多个：(a)所述APP对所述控制器的N个应用程序编程接口API的操作权限，(b)所述N个API中所述APP有权操作的L个API的标识，(c)所述N个API中所述APP无权操作的R个API的标识，N为大于或等于1的自然数，L为大于或等于1的自然数，并且L小于或等于N，R为大于或等于1的自然数，并且R小于或等于N。
  2. 根据权利要求1所述的方法，其特征在于，所述证书包括(a)所述APP对控制器的N个应用程序接口API的操作权限信息，所述操作权限信息包括所述N个API的标识以及所述APP对所述N个API中的每个API的操作权限。
  3. 根据权利要求1或2所述的方法，其特征在于，所述操作权限信息包括M个API标识集合的标识，该M个API标识集合中的每个API标识集合的标识用于标识该API标识集合中K个API的操作权限，M为大于或等于1的自然数，K为大于或等于0的整数且K小于或等于N。
  4. 根据权利要求1至3中任一所述的方法，其特征在于，所述证书包括(a)所述APP对控制器的N个API的操作权限，所述操作权限用位图表示。
  5. 根据权利要求1至4中任一所述的方法，其特征在于，所述(a)～(c)中的一个或多个携带在所述证书的扩展信息中。
  6. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行如权利要求1-5中任意一项所述的方法。
  7. 一种网络设备，其特征在于，包括处理器和与所述处理器通信的存储器，所述存储器存储有指令，当其在计算机上运行时，使得计算机执行如权利要求1-5中任意一项所述的方法。
  8. 一种鉴权方法，其特征在于，包括：
    鉴权设备接收应用程序APP的访问请求消息，所述访问请求消息包括数字证书，所述数字证书中包括(a)～(c)中的一个或多个：(a)所述APP对控制器的N个应用程序编程接口API的操作权限，(b)所述N个API中所述APP有权操作的L个API的标识，(c)所述N个API中所述APP无权操作的R个API的标识，N为大于或等于1的自然数，L为大于或等于1的自然数，并且L小于或等于N，R为大于或等于1的自然数，并且R小于或等于N；
    所述鉴权设备根据所述操作权限信息确定所述APP对所述一个或多个API的操作权限。
  9. 根据权利要求8所述的方法，其特征在于，若所述数字证书中包括(a)所述APP对控制器的N个API的操作权限信息，所述操作权限信息包括所述N个API的标识以及所述APP对所述N个API中的每个API的操作权限。
  10. 根据权利要求8或9所述的方法，其特征在于，所述操作权限信息包括M个API标识集合的标识，该M个API标识集合中的每个API标识集合的标识用于标识所述API标识集合中K个API的操作权限，M为大于或等于1的自然数，K为大于或等于0的整数且K小于或等于N。
  11. 根据权利要求8至10中任一所述的方法，其特征在于，若所述数字证书中包括(a)所述APP对控制器的N个API的操作权限，该操作权限用位图表示。
  12. 根据权利要求8至11中任一所述的方法，其特征在于，所述(a)～(c)中的一个或多个携带在所述证书的扩展信息中。
  13. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行如权利要求8-12任意一项所述的方法。
  14. 一种网络设备，其特征在于，包括处理器和与所述处理器通信的存储器，所述存储器存储有指令，当其在计算机上运行时，使得计算机执行如权利要求8-12任意一项所述的方法。
  15. 一种证书生成设备，其特征在于，包括通信接口和证书生成模块，其中：
    所述通信接口用于接收证书申请信息并发送所述证书申请信息给所述证书生成模块，所述证书申请信息包括应用程序APP；
    所述证书生成模块用于接收所述通信接口发送的所述证书申请信息，根据所述证书申请信息中的所述APP生成证书，所述证书包括(a)～(c)中的一个或多个：(a)所述APP对控制器的N个应用程序编程接口API的操作权限，(b)所述N个API中所述APP有权操作的L个API的标识，(c)所述N个API中所述APP无权操作的R个API的标识，N为大于或等于1的自然数，L为大于或等于1的自然数，并且L小于或等于N，R为大于或等于1的自然数，并且R小于或等于N。
  16. 根据权利要求15所述的设备，其特征在于，若所述证书包括(a)所述APP对控制器的N个API的操作权限信息，所述操作权限信息包括所述N个API的标识以及所述APP对所述N个API中的每个API的操作权限信息。
  17. 根据权利要求15或16所述的设备，其特征在于，所述操作权限信息包括M个API标识集合的标识，所述M个API标识集合中的每个API标识集合的标识用于标识所述API标识集合中的K个API的操作权限，M为大于或等于1的自然数，K为大于或等于1的自然数且K小于或等于N。
  18. 根据权利要求15至17中任一所述的设备，其特征在于，若所述证书包括(a)所述APP对控制器的N个API的操作权限，所述操作权限用位图表示。
  19. 根据权利要求15至18中任一所述的设备，其特征在于，所述(a)～(c)中的一个或多个携带在所述证书的扩展信息中。
  20. 一种网络设备，其特征在于，包括通信接口和鉴权模块，其中，
    所述通信接口，用于接收应用程序APP的访问请求消息，所述访问请求消息包括数字证书，所述数字证书中包括(a)～(c)中的一个或多个：(a)所述APP对控制器的N个应用程序编程接口API的操作权限，(b)所述N个API中所述APP有权操作的L个API的标识，(c)所述N个API中所述APP无权操作的R个API的标识，N为大于或等于1的自然数，L为大于或等于1的自然数，并且L小于或等于N，R 为大于或等于1的自然数，并且R小于或等于N；
    所述鉴权模块，用于根据所述操作权限信息确定所述APP对所述N个API的操作权限。
  21. 根据权利要求20所述的网络设备，其特征在于，若所述数字证书中包括(a)所述APP对控制器的N个API的操作权限信息，所述操作权限信息包括所述N个API的标识以及所述APP对所述N个API中的每个API的操作权限。
  22. 根据权利要求20或21所述的网络设备，其特征在于，所述操作权限信息包括M个API标识集合的标识，所述M个API标识集合中的每个API标识集合的标识用于标识所述API标识集合中的K个API的操作权限，M为大于或等于1的自然数，K为大于或等于1的自然数且K小于或等于N。
  23. 根据权利要求20至22中任一所述的网络设备，其特征在于，若所述数字证书中包括(a)所述APP对控制器的N个API的操作权限，所述操作权限用位图表示。
  24. 根据权利要求22至23中任一所述的网络设备，其特征在于，所述(a)～(c)中的一个或多个携带在所述证书的扩展信息中。
  25. 根据权利要求22至24中任一所述的网络设备，其特征在于，所述网络设备为所述控制器或所述控制器的一部分。
  26. 根据权利要求22至25中任一所述的网络设备，其特征在于，所述网络设备是软件定义网络SDN控制器。
PCT/CN2017/101307 2016-12-28 2017-09-11 一种获取证书、鉴权的方法及网络设备 WO2018120913A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP17886998.8A EP3550786B1 (en) 2016-12-28 2017-09-11 Certificate acquisition method, authentication method and network device
JP2019534954A JP6940240B2 (ja) 2016-12-28 2017-09-11 証明書取得方法、認証方法及びネットワークデバイス
US16/456,706 US11451531B2 (en) 2016-12-28 2019-06-28 Certificate obtaining method, authentication method, and network device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201611238763.5A CN108259413B (zh) 2016-12-28 2016-12-28 一种获取证书、鉴权的方法及网络设备
CN201611238763.5 2016-12-28

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/456,706 Continuation US11451531B2 (en) 2016-12-28 2019-06-28 Certificate obtaining method, authentication method, and network device

Publications (1)

Publication Number Publication Date
WO2018120913A1 true WO2018120913A1 (zh) 2018-07-05

Family

ID=62710331

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/101307 WO2018120913A1 (zh) 2016-12-28 2017-09-11 一种获取证书、鉴权的方法及网络设备

Country Status (5)

Country Link
US (1) US11451531B2 (zh)
EP (1) EP3550786B1 (zh)
JP (1) JP6940240B2 (zh)
CN (1) CN108259413B (zh)
WO (1) WO2018120913A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114598481A (zh) * 2020-11-19 2022-06-07 卫宁健康科技集团股份有限公司 一种授权认证方法、装置、电子设备及存储介质

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10694250B2 (en) * 2018-08-30 2020-06-23 At&T Intellectual Property I, L.P. Audiovisual content screening for locked application programming interfaces
CN109408250A (zh) * 2018-09-27 2019-03-01 天津字节跳动科技有限公司 调用应用程序编程接口api方法、装置、电子设备
CN109829287A (zh) * 2018-11-20 2019-05-31 新疆福禄网络科技有限公司 Api接口权限访问方法、设备、存储介质及装置
US11516253B1 (en) * 2019-03-28 2022-11-29 Amazon Technologies, Inc. Identity-aware filtering proxy for virtual networks
US10944578B2 (en) * 2019-07-24 2021-03-09 Advanced New Technologies Co., Ltd. Identity verification
CN111147259B (zh) * 2019-12-26 2022-01-14 华为技术有限公司 鉴权方法和设备
CN112383557B (zh) * 2020-11-17 2023-06-20 北京明朝万达科技股份有限公司 一种安全接入网关及工业设备通信管理方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101714201A (zh) * 2000-09-21 2010-05-26 捷讯研究有限公司 代码签字***及方法
CN102710640A (zh) * 2012-05-31 2012-10-03 中国联合网络通信集团有限公司 请求授权的方法、装置和***
CN102819715A (zh) * 2012-08-15 2012-12-12 腾讯科技（深圳）有限公司 Api监控方法和装置
EP2787725A1 (en) * 2011-11-30 2014-10-08 Nippon Hoso Kyokai Reception device, program, and reception method
CN105704154A (zh) * 2016-04-01 2016-06-22 金蝶软件（中国）有限公司 一种基于RESTful的服务处理方法、装置及***

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2001033340A2 (en) * 1999-10-26 2001-05-10 At Home Corporation Method and system for restricting access to user resources
JP2002351563A (ja) * 2001-05-30 2002-12-06 Canon Inc 情報処理装置、情報処理方法およびプログラム
US7752655B2 (en) * 2004-04-15 2010-07-06 Panasonic Corporation Access control device and electronic device
JP4727278B2 (ja) * 2005-04-05 2011-07-20 株式会社エヌ・ティ・ティ・ドコモ アプリケーションプログラム検証システム、アプリケーションプログラム検証方法およびコンピュータプログラム
WO2007097439A1 (ja) * 2006-02-21 2007-08-30 Nec Corporation プログラムの実行制御システム、実行制御方法、実行制御用コンピュータプログラム
CN101854624A (zh) * 2009-04-02 2010-10-06 联芯科技有限公司 移动终端的动态加载软件验证方法、监控方法和装置
US9009856B2 (en) * 2011-12-16 2015-04-14 Dell Products L.P. Protected application programming interfaces
KR101934025B1 (ko) * 2013-02-22 2018-12-31 삼성전자주식회사 보안 정책을 적용하는 단말기, 서버 및 그 제어 방법
WO2014128256A1 (en) * 2013-02-22 2014-08-28 Adaptive Mobile Security Limited Network security system and method
WO2015118751A1 (ja) * 2014-02-06 2015-08-13 ソニー株式会社 情報処理装置、情報処理方法、プログラム、及びサーバ
JP6424499B2 (ja) * 2014-07-10 2018-11-21 株式会社リコー 画像形成装置、情報処理方法、及びプログラム
WO2016013200A1 (ja) * 2014-07-22 2016-01-28 日本電気株式会社 情報処理システム及びネットワークリソース管理方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101714201A (zh) * 2000-09-21 2010-05-26 捷讯研究有限公司 代码签字***及方法
EP2787725A1 (en) * 2011-11-30 2014-10-08 Nippon Hoso Kyokai Reception device, program, and reception method
CN102710640A (zh) * 2012-05-31 2012-10-03 中国联合网络通信集团有限公司 请求授权的方法、装置和***
CN102819715A (zh) * 2012-08-15 2012-12-12 腾讯科技（深圳）有限公司 Api监控方法和装置
CN105704154A (zh) * 2016-04-01 2016-06-22 金蝶软件（中国）有限公司 一种基于RESTful的服务处理方法、装置及***

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3550786A4

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114598481A (zh) * 2020-11-19 2022-06-07 卫宁健康科技集团股份有限公司 一种授权认证方法、装置、电子设备及存储介质
CN114598481B (zh) * 2020-11-19 2024-05-31 卫宁健康科技集团股份有限公司 一种授权认证方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
EP3550786A1 (en) 2019-10-09
US11451531B2 (en) 2022-09-20
CN108259413A (zh) 2018-07-06
US20190327224A1 (en) 2019-10-24
JP2020514863A (ja) 2020-05-21
EP3550786B1 (en) 2022-02-16
CN108259413B (zh) 2021-06-01
JP6940240B2 (ja) 2021-09-22
EP3550786A4 (en) 2019-12-04

Similar Documents

Publication Publication Date Title
WO2018120913A1 (zh) 一种获取证书、鉴权的方法及网络设备
US20220191016A1 (en) Methods, apparatuses, and computer program products for frictionless electronic signature management
US10666642B2 (en) System and method for service assisted mobile pairing of password-less computer login
US11895096B2 (en) Systems and methods for transparent SaaS data encryption and tokenization
US9531714B2 (en) Enterprise authentication via third party authentication support
WO2019184924A1 (zh) 身份管理方法、设备、通信网络及存储介质
US9584515B2 (en) Enterprise system authentication and authorization via gateway
JP2022541760A (ja) コアネットワークドメインにおける証明書ハンドリングのための技法
WO2022246997A1 (zh) 业务处理方法、装置、服务器及存储介质
CN105207974A (zh) 一种实现用户资源差异化开放的方法、平台、应用和***
JP2020078067A (ja) モバイルデバイスを有するユーザがスタンドアロンコンピューティングデバイスの能力にアクセスすることをセキュアに可能にするためのシステム及び方法
WO2018196705A1 (zh) 网络安全保护方法、设备及***
WO2023279782A1 (zh) 一种访问控制方法、访问控制***及相关设备
WO2022053069A1 (zh) 绑定帐号的方法、装置、终端及存储介质
CN111241492A (zh) 一种产品多租户安全授信方法、***及电子设备
US20230299973A1 (en) Service registration method and device
CN106537962B (zh) 无线网络配置、接入和访问方法、装置及设备
WO2017080381A1 (zh) 用于处理跨域数据的方法、第一服务器及第二服务器
US20230351028A1 (en) Secure element enforcing a security policy for device peripherals
WO2022193494A1 (zh) 权限控制方法及服务器、终端、存储介质和计算机程序
WO2018172776A1 (en) Secure transfer of data between internet of things devices
EP3942770A1 (en) Chained trusted platform modules (tpms) as a secure bus for pre-placement of device capabilities
EP4340297A1 (en) Service function authorization
US11977620B2 (en) Attestation of application identity for inter-app communications
JP2018067327A (ja) プライベートデータを保護するセキュアプロキシ

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17886998

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019534954

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017886998

Country of ref document: EP

Effective date: 20190704