Cloud service access permission setting method for enclave instance and cloud management platform

A cloud service system, comprising:

• a target cloud service;
• and
• a cloud management platform configured to:
• provide an identity and access management (IAM) service, wherein the IAM service is configured to confirm an enclave instance type and a conversion rule input or selected by a first tenant, wherein the conversion rule is configured to convert, into a tenant-customized attribute, an enclave instance attestation document provided by an enclave instance corresponding to the enclave instance type, and wherein the enclave instance comprises an application program;
• and
• provide a security token service (STS), wherein the STS is configured to receive a token obtaining request from the application program, wherein the token obtaining request carries the enclave instance attestation document obtained from a trusted computing base (TCB), and wherein the STS is further configured to:
• convert the enclave instance attestation document into the tenant-customized attribute according to the conversion rule;
• and
• return, to the application program, a token carrying the tenant-customized attribute, wherein the token indicates that the application program in the enclave instance has permission to access the target cloud service.

A cloud management platform, comprising:

• a memory configured to store instructions;
• and
• at least one processor coupled to the memory and configured to execute the instructions to cause the cloud management platform to:
• provide an identity and access management (IAM) service, wherein the IAM service is configured to confirm an enclave instance type and a conversion rule input or selected by a first tenant, and wherein the conversion rule is configured to convert, into a tenant-customized attribute, an enclave instance attestation document provided by an enclave instance corresponding to the enclave instance type, wherein the enclave instance comprises an application program;
• and
• provide a security token service (STS), wherein the STS is configured to receive a token obtaining request from the application program, wherein the token obtaining request carries the enclave instance attestation document obtained from a trusted computing base (TCB), and wherein the STS is further configured to:
• convert the enclave instance attestation document into the tenant-customized attribute according to the conversion rule;
• and
• return, to the application program, a token carrying the tenant-customized attribute, wherein the token indicates that the application program has permission to access a target cloud service.