Access object authentication method and apparatus, and system
An access object authentication method includes a trusted component that is in a computing device and that completes an access object authentication process. When a client requests to access a target object, the trusted component receives an object identifier (ID) and an authentication ID of the target object from the client to perform, based on the authentication ID, tenant authentication on a tenant to which the client belongs. When the authentication on the tenant to which the client belongs succeeds, the trusted component accesses a storage device based on the object ID of the target object.
1 . A method implemented by a trusted component in a computing device, wherein the method comprises:
receiving, from a client in the computing device, an object identifier (ID) of a target object and an authentication ID of the target object, wherein the client cannot change the authentication ID, and wherein the trusted component is a virtual machine monitor that runs in at least one central processing unit (CPU) or a trusted execution environment (TEE) that runs in the at least one CPU;
performing, based on the authentication ID, tenant authentication on a tenant corresponding to the client; and
sending, to a storage device, an access instruction for accessing the target object when the tenant authentication has succeeded, wherein the access instruction comprises the object ID.
2 . The method of claim 1 , wherein the object ID is an encrypted object ID, wherein the access instruction comprises a decrypted object ID, and wherein the method further comprises decrypting the encrypted object ID to obtain the decrypted object ID to generate the access instruction.
3 . The method of claim 2 , wherein decrypting the encrypted object ID comprises: querying for a key corresponding to the authentication ID; and decrypting, using the key, the encrypted object ID.
4 . The method of claim 1 , further comprising: receiving, from the client, a first tenant ID; querying for a second tenant ID corresponding to the authentication ID; and identifying that the tenant authentication has succeeded when the second tenant ID matches the first tenant ID.
5 . The method of claim 1 , further comprising: receiving, from the client, a first message authentication code (MAC); querying for a key corresponding to the authentication ID; generating a second MAC related to the key and the object ID; and identifying that the tenant authentication has succeeded when the first MAC matches the second MAC.
6 . The method of claim 1 , wherein the object ID is an unencrypted object ID.
7 . The method according to claim 1 , wherein the object ID is an encrypted object ID.
8 . A computing device comprising:
a memory configured to store instructions; and
a trusted component coupled to the memory and configured to:
receive, from a client in the computing device, an object identifier (ID) of a target object and an authentication ID of the target object, wherein the client cannot change the authentication ID, and wherein the trusted component is a virtual machine monitor that runs in at least one central processing unit (CPU) or a trusted execution environment (TEE) that runs in the at least one CPU:
perform, based on the authentication ID, a tenant authentication on a tenant corresponding to the client; and
send, to a storage device, an access instruction for accessing the target object when the tenant authentication has succeeded,
wherein the access instruction comprises the object ID.
9 . The computing device of claim 8 , wherein the object ID is an encrypted object ID, wherein the access instruction comprises a decrypted object ID, and wherein the trusted component is further configured to decrypt the encrypted object ID to obtain the decrypted object ID to generate the access instruction.
10 . The computing device of claim 9 , wherein the trusted component is further configured to: query for a key corresponding to the authentication ID; and decrypt, using the key, the encrypted object ID.
11 . The computing device of claim 8 , wherein the trusted component is further configured to: receive, from the client, a first tenant ID; query for a second tenant ID corresponding to the authentication ID; and identify that the tenant authentication has succeeded when the second tenant ID matches the first tenant ID.
12 . The computing device of claim 8 , wherein the trusted component is further configured to: receive, from the client, a first message authentication code (MAC): query for a key corresponding to the authentication ID: generate a second MAC related to the key and the object ID; and identify that the tenant authentication has succeeded when the first MAC matches the second MAC.
13 . The computing device of claim 8 , wherein the computing device is configured to run a virtual machine (VM), and wherein the VM is configured to run the client.
14 . The computing device of claim 8 , wherein the computing device is configured to run a container, and wherein the container is configured to run the client.
15 . The computing device of claim 8 , wherein the trusted component is a data processing unit (DPU) configured to provide a virtual function (VF), and wherein the authentication ID is a VF ID of the VF.
16 . The computing device of claim 8 , wherein the computing device is configured to run a virtual machine (VM), wherein the VM is configured to run the client and add a VM ID of the VM, and wherein the authentication ID is the VM ID.
17 . The computing device of claim 8 , wherein the computing device is configured to run a container, wherein the container is configured to run the client and add a container ID of the container, and wherein the authentication ID is the container ID.
18 . A computer program product comprising computer executable instructions that are stored on a non-transitory computer-readable medium and that, when executed by at least one processor, cause a trusted component in a computing device to:
receive, from a client in the computing device, an object identifier (ID) of a target object and an authentication ID of the target object, wherein the client cannot change the authentication ID, and wherein the trusted component is a virtual machine monitor that runs in at least one central processing unit (CPU) or a trusted execution environment (TEE) that runs in the at least one CPU:
perform, based on the authentication ID, tenant authentication on a tenant corresponding to the client; and
send, to a storage device, an access instruction for accessing the target object when the tenant authentication has succeeded,
wherein the access instruction comprises the object ID.
19 . The computer program product of claim 18 , wherein the object ID is an encrypted object ID wherein the object ID is a decrypted object ID; and the computer executable instructions, when executed by the processor, cause the trusted component to decrypt the encrypted object ID to obtain the decrypted object ID to generate the access instruction.