# US 12,603,881 B2 · Cloud service access permission setting method for enclave instance and cloud management platform > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,881 B2 - Document ID: US12603881B2 - Status: Granted - Kind: B2 - Application number: 18/814,811 - Filed: 2024-08-26 - Published: 2024-12-19 - Granted: 2026-04-14 - Earliest claimed: 2022-02-25 - Assignees: Huawei Cloud Computing Technologies Co., Ltd. - Applicants: Huawei Cloud Computing Technologies Co., Ltd. - Inventors: Jun Li; Zhixi Sun; Qi Zhang - Web page: https://patentgrep.com/patent/US12603881B2 ## CPC - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - G06F 21/604: {Tools and structures for managing or administering access control systems} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/102: {Entity profiles} - H04L 63/105: {Multiple levels of security} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A cloud management platform provides an identity and access management (IAM) service and a security token service (STS). The IAM service is used to confirm an enclave instance type input or selected by a first tenant and a conversion rule input or selected by the first tenant. The conversion rule is used to convert, into a tenant-customized attribute, an enclave instance attestation document provided by an enclave instance corresponding to the enclave instance type. The STS is used to receive a token obtaining request sent by an application program in the enclave instance. ## Claims ### Claim 1 A method comprising: providing, by a cloud management platform, an identity and access management (IAM) service, wherein the IAM service is configured to confirm an enclave instance type and a conversion rule input or selected by a first tenant, and wherein the conversion rule is configured to convert, into a tenant-customized attribute, an enclave instance attestation document provided by an enclave instance corresponding to the enclave instance type; and providing, by the cloud management platform, a security token service (STS), wherein the STS is configured to: receive a token obtaining request from an application program in the enclave instance, wherein the token obtaining request carries the enclave instance attestation document obtained from a trusted computing base (TCB); convert the enclave instance attestation document into the tenant-customized attribute according to the conversion rule; and return, to the application program, a token carrying the tenant-customized attribute, wherein the token indicates that the application program in the enclave instance has permission to access a target cloud service. ### Claim 2 (depends on 1) The method according to claim 1, wherein the IAM service is further configured to confirm an authorization policy input or selected by the first tenant or a second tenant, wherein the STS is further configured to further convert the enclave instance attestation document into the tenant-customized attribute according to the conversion rule when the authorization policy is met. ### Claim 3 (depends on 2) The method according to claim 2, wherein the first tenant is a security administrator, and wherein the second tenant is a permission administrator. ### Claim 4 (depends on 2) The method according to claim 2, wherein the authorization policy comprises allowing the application program to access the target cloud service in the enclave instance corresponding to the enclave instance type. ### Claim 5 (depends on 1) The method according to claim 1, further comprising: sending, by the application program in the enclave instance, a service invocation request to the target cloud service, wherein the service invocation request carries the token; receiving, by the target cloud service, the service invocation request; confirming, by the target cloud service, validity of the token with the STS; and allowing, by the target cloud service, the application program to access the target cloud service on a premise that the STS confirms that the token is valid. ### Claim 6 (depends on 1) The method according to claim 1, wherein the enclave instance attestation document comprises at least one platform configuration register (PCR) measurement value. ### Claim 7 A cloud service system, comprising: a target cloud service; and a cloud management platform configured to: provide an identity and access management (IAM) service, wherein the IAM service is configured to confirm an enclave instance type and a conversion rule input or selected by a first tenant, wherein the conversion rule is configured to convert, into a tenant-customized attribute, an enclave instance attestation document provided by an enclave instance corresponding to the enclave instance type, and wherein the enclave instance comprises an application program; and provide a security token service (STS), wherein the STS is configured to receive a token obtaining request from the application program, wherein the token obtaining request carries the enclave instance attestation document obtained from a trusted computing base (TCB), and wherein the STS is further configured to: convert the enclave instance attestation document into the tenant-customized attribute according to the conversion rule; and return, to the application program, a token carrying the tenant-customized attribute, wherein the token indicates that the application program in the enclave instance has permission to access the target cloud service. ### Claim 8 (depends on 7) The cloud service system according to claim 7, wherein the IAM service is further configured to confirm an authorization policy input or selected by the first tenant or a second tenant, wherein the STS is further configured to further convert the enclave instance attestation document into the tenant-customized attribute according to the conversion rule when the authorization policy is met, and wherein the STS returns, to the application program, the token carrying the tenant-customized attribute. ### Claim 9 (depends on 8) The cloud service system according to claim 8, wherein a role of the first tenant is a security administrator, and wherein the second tenant is a permission administrator. ### Claim 10 (depends on 8) The cloud service system according to claim 8, wherein the authorization policy comprises allowing the application program to access the target cloud service in the enclave instance corresponding to the enclave instance type. ### Claim 11 (depends on 7) The cloud service system according to claim 7, wherein the application program is configured to send a service invocation request to the target cloud service, wherein the service invocation request carries the token, and wherein the target cloud service is configured to: receive the service invocation request; confirm validity of the token with the STS; and allow the application program to access the target cloud service on a premise that the STS confirms that the token is valid. ### Claim 12 (depends on 7) The cloud service system according to claim 7, wherein the enclave instance attestation document comprises at least one platform configuration register (PCR) measurement value. ### Claim 13 A cloud management platform, comprising: a memory configured to store instructions; and at least one processor coupled to the memory and configured to execute the instructions to cause the cloud management platform to: provide an identity and access management (IAM) service, wherein the IAM service is configured to confirm an enclave instance type and a conversion rule input or selected by a first tenant, and wherein the conversion rule is configured to convert, into a tenant-customized attribute, an enclave instance attestation document provided by an enclave instance corresponding to the enclave instance type, wherein the enclave instance comprises an application program; and provide a security token service (STS), wherein the STS is configured to receive a token obtaining request from the application program, wherein the token obtaining request carries the enclave instance attestation document obtained from a trusted computing base (TCB), and wherein the STS is further configured to: convert the enclave instance attestation document into the tenant-customized attribute according to the conversion rule; and return, to the application program, a token carrying the tenant-customized attribute, wherein the token indicates that the application program has permission to access a target cloud service. ### Claim 14 (depends on 13) The cloud management platform according to claim 13, wherein the IAM service is further configured to confirm an authorization policy input or selected by the first tenant or a second tenant, wherein the STS is further configured to further convert the enclave instance attestation document into the tenant-customized attribute according to the conversion rule when the authorization policy is met, and wherein the STS returns, to the application program, the token carrying the tenant-customized attribute. ### Claim 15 (depends on 14) The cloud management platform according to claim 14, wherein the first tenant is a security administrator, and wherein the second tenant is a permission administrator. ### Claim 16 (depends on 14) The cloud management platform according to claim 14, wherein the authorization policy comprises allowing the application program to access the target cloud service in the enclave instance corresponding to the enclave instance type. ### Claim 17 (depends on 13) The cloud management platform according to claim 13, wherein the at least one processor is further configured to execute the instructions to cause the cloud management platform to: send, by the application program, a service invocation request to the target cloud service, wherein the service invocation request carries the token; and receive, by the target cloud service, the service invocation request, wherein the service invocation request confirms validity of the token with the STS and allows the application program to access the target cloud service on a premise that the STS confirms that the token is valid.