CN116708037B - Cloud platform access right control method and system - Google Patents
Cloud platform access right control method and system Download PDFInfo
- Publication number
- CN116708037B CN116708037B CN202310981214.0A CN202310981214A CN116708037B CN 116708037 B CN116708037 B CN 116708037B CN 202310981214 A CN202310981214 A CN 202310981214A CN 116708037 B CN116708037 B CN 116708037B
- Authority
- CN
- China
- Prior art keywords
- target user
- tenant
- cloud platform
- user
- interface
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 41
- 238000012795 verification Methods 0.000 claims abstract description 24
- 230000007246 mechanism Effects 0.000 claims abstract description 9
- 230000006870 function Effects 0.000 claims description 12
- 230000003993 interaction Effects 0.000 claims description 8
- 238000004590 computer program Methods 0.000 claims description 5
- 238000013507 mapping Methods 0.000 claims description 5
- 230000006399 behavior Effects 0.000 description 9
- 230000008569 process Effects 0.000 description 9
- 238000011156 evaluation Methods 0.000 description 5
- 238000007726 management method Methods 0.000 description 4
- 230000008901 benefit Effects 0.000 description 3
- 238000004364 calculation method Methods 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 3
- 238000013468 resource allocation Methods 0.000 description 3
- 230000008859 change Effects 0.000 description 2
- 238000007405 data analysis Methods 0.000 description 2
- 238000013461 design Methods 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000012544 monitoring process Methods 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 230000004044 response Effects 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 1
- 238000012550 audit Methods 0.000 description 1
- 238000013475 authorization Methods 0.000 description 1
- 230000003542 behavioural effect Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004422 calculation algorithm Methods 0.000 description 1
- 230000001010 compromised effect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000007613 environmental effect Effects 0.000 description 1
- 230000000977 initiatory effect Effects 0.000 description 1
- 238000007620 mathematical function Methods 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
- H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/40—Network security protocols
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Storage Device Security (AREA)
Abstract
The invention provides a cloud platform access right control method and a cloud platform access right control system, which relate to the technical field of cloud computing and comprise the steps that when a target user logs in a cloud platform, a user name of the target user is sent to a server of the cloud platform, and the server verifies the identity of the target user based on a certificate issuing mechanism and a digital signature returned by the target user; after the identity verification of the target user is passed, an interface calling request is sent to the cloud platform, and the cloud platform inquires the security level of the tenant corresponding to the target user and the interface authority level of the interface calling request according to the identity information of the target user, judges whether the target user has calling authorities and distributes corresponding resource request quantity for the interface calling request; and if the target user has the calling authority and a corresponding resource request quantity is distributed for the interface calling request, accessing the tenant with the calling authority in the cloud platform according to the interface calling request. The method can accurately control the access right of the cloud platform.
Description
Technical Field
The present invention relates to cloud computing technologies, and in particular, to a method and a system for controlling access rights of a cloud platform.
Background
With the continuous development of public cloud services, a large number of applications are deployed in a cloud environment, and the processing and storage of mass data of users in the cloud environment are accompanied. After the application originally deployed in the private cloud or the enterprise internal network is migrated to the public cloud environment, access control is performed on data among enterprises besides access control is performed on the data inside the enterprises.
CN112580006A, an access right control method, an access right control device and an authentication server of a multi-cloud system, wherein the method, the device and the authentication server are used for receiving an object access request sent by a client, the object access request at least comprises a user identifier of a target user and an object identifier of a target object, and the target object is an accessed object in a target cloud system in the plurality of cloud systems; obtaining a target authority strategy matched with the user identifier and the object identifier in an authority strategy set, wherein the authority strategy set comprises a plurality of pieces of authority strategy information, and each piece of authority strategy information corresponds to a user and an accessed object; and obtaining an authentication result according to the target authority strategy, wherein the authentication result represents whether the target user has the authority for accessing the target object in the target cloud system.
CN113872991A, a cloud platform interface authority control method, device, equipment and medium, disclose obtaining an access request initiated by a user terminal aiming at a target interface in a cloud platform; analyzing the access request to extract a first user identification and an interface identification of a target interface in the access request; determining service use rights corresponding to the first user identification according to the user role corresponding to the first user identification, and inquiring target service corresponding to the service use rights from the cloud platform; detecting whether a target interface corresponding to the interface identifier exists in the target service, and if so, allowing access.
The existing cloud platform access right control method is only focused on whether the access right level meets the requirement or not, and risk judgment of various rights is carried out, so that identity verification when a user logs in is seldom focused; in addition, in the authority control process, the trust level of the tenant is directly related to the final authority judgment, but the technical content is not related in the prior art.
Disclosure of Invention
The embodiment of the invention provides a cloud platform access right control method and a cloud platform access right control system, which can at least solve part of problems in the prior art, namely the problems that the prior art is less concerned about identity verification when a user logs in and does not relate to the trust degree of tenants.
In a first aspect of an embodiment of the present invention,
the method for controlling the access authority of the cloud platform comprises the following steps:
when a target user logs in a cloud platform, a user name of the target user is sent to a server of the cloud platform, and the server verifies the identity of the target user based on a certificate issuing mechanism and a digital signature returned by the target user;
after the identity verification of the target user is passed, an interface calling request is sent to the cloud platform, and the cloud platform inquires the security level of the tenant corresponding to the target user and the interface authority level of the interface calling request according to the identity information of the target user, and judges whether the target user has calling authority and whether the corresponding resource request quantity is allocated for the interface calling request;
and if the target user has the calling authority and the corresponding resource request quantity is distributed for the interface calling request, accessing the tenant with the calling authority in the cloud platform according to the interface calling request.
In an alternative embodiment of the present invention,
the server verifying the identity of the target user based on the certificate authority and the digital signature returned by the target user comprises:
The target user generates a pair of asymmetric keys in advance, wherein the asymmetric keys comprise a private key and a public key, and registers the public key in a trusted certificate authority to generate a corresponding digital certificate;
when the target user logs in a cloud platform, the user name of the target user is sent to a server of the cloud platform, and the server requests a digital certificate of the target user from the certificate authority and sends the digital certificate to the target user;
generating a random challenge value by a random generator, digitally signing the random challenge value and the digital certificate using a private key, and transmitting the digital signature back to the server;
and the server verifies the validity of the digital signature according to the public key, if the digital signature is valid, the identity verification of the target user is passed, and if the digital signature is invalid, the identity verification of the target user is not passed.
In an alternative embodiment of the present invention,
the cloud platform queries the security level of the tenant corresponding to the target user and the interface authority level of the interface call request according to the identity information of the target user, and the judging whether the target user has the call authority and whether the corresponding resource request quantity is allocated for the interface call request comprises the following steps:
Acquiring a calling service name corresponding to the interface calling request of the target user, judging whether the calling service name belongs to all service type sets based on all service type sets constructed in advance, if not, rejecting the interface calling request of the target user, and returning error operation information;
if yes, inquiring the security level of the tenant corresponding to the target user and the interface authority level of the interface call request according to the identity information of the target user;
if the security level of the tenant corresponding to the target user is not smaller than the interface authority level, further determining the resource request quantity corresponding to the interface call request, and judging whether to allocate the corresponding resource request quantity for the interface call request according to the resource quota allocated by the interface call request by combining the residual resource stock of the cloud platform.
In an alternative embodiment of the present invention,
the tenant comprises a trusted tenant with interaction history with the target user, and the accessing of the tenant with the calling authority in the cloud platform according to the interface calling request comprises the following steps:
acquiring user attribute information of the target user, environment attribute information of an environment where the target user is located and first reputation information of the target user, determining a first trust value of the tenant on the target user, if the first trust value is greater than or equal to a first preset trust threshold,
Then an access role is allocated to the target user, whether the access authority attribute of the target user meets the preset requirement is judged according to the access role and the environment attribute information of the environment where the target user is located,
if yes, a second trust value of the data owner to the access role is further determined according to the access right attribute, the environment attribute information and the second reputation information corresponding to the access role, and if the second trust value is greater than or equal to a second preset trust threshold, the access right of the target user is granted.
In an alternative embodiment of the present invention,
the obtaining the user attribute information of the target user, the environment attribute information of the environment where the target user is located, and the first reputation information of the target user determining the first trust value of the tenant on the target user includes:
the first trust value is determined according to the following formula:
；
wherein,T1representing the first trust value in question,w1、w2、w3respectively representing the weight values corresponding to the user attribute information, the environment attribute information and the first reputation information,NA、NE、FRand respectively representing the user attribute information, the environment attribute information and the first reputation information.
In an alternative embodiment of the present invention,
the determining the second trust value of the data owner to the access role according to the access right attribute, the environment attribute information and the second reputation information corresponding to the access role comprises:
constructing respective corresponding fuzzy sets based on the access right attribute, the environment attribute information and the second reputation information corresponding to the access role;
based on the fuzzy set, combining a preset fuzzy rule, determining membership of each element in the fuzzy set through a membership function, and mapping the membership into an actual trust value as the second trust value.
In an alternative embodiment of the present invention,
the method further includes determining whether the tenant is trusted:
acquiring the number of access resources participated by the tenant in a tenant role, and the number of illegal events participated by the tenant in the tenant role, and determining an initial trust value of the tenant by combining Bayesian probability distribution;
acquiring a trust record of the target user for the tenant, respectively distributing a first weight value for the initial trust value and a second weight value for the trust record, and determining a comprehensive trust value according to the initial trust value, the first weight value, the trust record and the second weight value;
And if the comprehensive trust value is larger than or equal to a preset trust threshold, the tenant is determined to be trusted, and if the comprehensive trust value is smaller than the preset trust threshold, the tenant is determined to be not trusted.
In a second aspect of an embodiment of the present invention,
provided is a cloud platform access right control system, comprising:
the first unit is used for sending the user name of the target user to a server of the cloud platform when the target user logs in the cloud platform, and the server verifies the identity of the target user based on a certificate issuing mechanism and a digital signature returned by the target user;
the second unit is used for sending an interface calling request to the cloud platform after the identity verification of the target user is passed, and the cloud platform queries the security level of the tenant corresponding to the target user and the interface authority level of the interface calling request according to the identity information of the target user, so as to judge whether the target user has the calling authority and whether the corresponding resource request quantity is allocated for the interface calling request;
and the third unit is used for accessing the tenant with the calling authority in the cloud platform according to the interface calling request if the target user has the calling authority and the corresponding resource request quantity is allocated for the interface calling request.
In a third aspect of an embodiment of the present invention,
there is provided an electronic device including:
a processor;
a memory for storing processor-executable instructions;
wherein the processor is configured to invoke the instructions stored in the memory to perform the method described previously.
In a fourth aspect of an embodiment of the present invention,
there is provided a computer readable storage medium having stored thereon computer program instructions which, when executed by a processor, implement the method as described above.
The beneficial effects of the embodiments of the present invention may refer to the technical effects of the technical feature in the specific implementation manner, and are not described herein.
Drawings
FIG. 1 is a schematic flow chart of a cloud platform access right control method according to an embodiment of the invention;
fig. 2 is a schematic structural diagram of a cloud platform access right control system according to an embodiment of the present invention.
Detailed Description
For the purpose of making the objects, technical solutions and advantages of the embodiments of the present invention more apparent, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention, and it is apparent that the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
The technical scheme of the application is described in detail below by specific examples. The following embodiments may be combined with each other, and some embodiments may not be repeated for the same or similar concepts or processes.
Fig. 1 is a flow chart of a cloud platform access right control method according to an embodiment of the present application, as shown in fig. 1, where the method includes:
s101, when a target user logs in a cloud platform, a user name of the target user is sent to a server of the cloud platform, and the server verifies the identity of the target user based on a certificate issuing mechanism and a digital signature returned by the target user;
for example, most of the access rights control of the existing cloud platform only focuses on whether the access rights level meets the requirement, and risk judgment of various rights, so that identity verification during user login is rarely focused, and as more and more resources are input by an enterprise on the cloud platform, multiple user logins are sometimes involved, and at this time, the identity verification of the user login is particularly important.
Therefore, when a target user logs in the cloud platform, the identity verification is carried out, and particularly, the identity verification method based on a security algorithm can use Public Key Infrastructure (PKI) and digital signature, and the method utilizes an asymmetric encryption technology to ensure the identity verification and the data integrity.
In an alternative embodiment of the present invention,
the server verifying the identity of the target user based on the certificate authority and the digital signature returned by the target user comprises:
the target user generates a pair of asymmetric keys in advance, wherein the asymmetric keys comprise a private key and a public key, and registers the public key in a trusted certificate authority to generate a corresponding digital certificate;
when the target user logs in a cloud platform, the user name of the target user is sent to a server of the cloud platform, and the server requests a digital certificate of the target user from the certificate authority and sends the digital certificate to the target user;
generating a random challenge value by a random generator, digitally signing the random challenge value and the digital certificate using a private key, and transmitting the digital signature back to the server;
and the server verifies the validity of the digital signature according to the public key, if the digital signature is valid, the identity verification of the target user is passed, and if the digital signature is invalid, the identity verification of the target user is not passed.
Wherein the target user may generate a pair of asymmetric keys: a private key and a public key, the private key is kept secret absolutely, and the public key can be invented. The public key is registered in a trusted Certificate Authority (CA) to generate a digital certificate, the certificate contains the public key of the user and some identification information, and the certificate authority is responsible for verifying the identity of the user and signing the certificate to confirm the authenticity of the public key.
When a user logs in, the user name is sent to a server, and the server requests the digital certificate of the user from a certificate authority and then sends the certificate back to the user. The user digitally signs a particular random challenge value using a private key and then sends the signature back to the server, which verifies the validity of the digital signature using a previously verified public key. If the verification is passed, the user is indicated to have the private key, and is a legal user.
Wherein the random challenge value (Random Challenge Value) is a type of randomness introduced during the digital signature process for increasing the security and unpredictability of the signature. In digital signatures, a signer signs specific data using a private key, and a random challenge value is to ensure that the signature is different every time, thereby preventing threats such as replay attacks. During digital signing, the signer may receive multiple identical requests, and if the same data is used to sign each time, the attacker may multiplex the signature to replay the attack. By introducing a random challenge value, each signature uses a different challenge value, thereby preventing an attacker from replay attacks using the same signature.
Wherein the server verifying the validity of the digital signature according to the public key may include:
decrypting the signature data by using the public key to obtain a signed digest, recalculating the digest from the original data, comparing whether the decrypted digest and the recalculated digest match, and if the decrypted digest and the recalculated digest match, indicating that the signature is valid; otherwise, the signature is invalid.
Digital certificates often have validity limits, and users need to apply for and obtain updated certificates before they expire, and certificate authorities can revoke certificates against abuse if their private keys are compromised or other security issues. The authentication method based on PKI and digital signature provides higher security because the confidentiality of the private key and the characteristics of the digital signature can effectively prevent forgery and falsification.
S102, after the identity verification of the target user is passed, an interface calling request is sent to the cloud platform, and the cloud platform inquires the security level of the tenant corresponding to the target user and the interface authority level of the interface calling request according to the identity information of the target user, and judges whether the target user has calling authorities and whether the interface calling request is allocated with corresponding resource request quantity;
Illustratively, if authentication is successful, the server generates an Access Token (Access Token) and returns it to the target user, the Token containing information about the user's identity and rights, as well as some signature or encryption mechanism to ensure the authenticity and integrity of the Token.
After the target user obtains the access token, the access token is added to each interface call request, and after the cloud platform receives the interface call request, the validity and the authenticity of the token are verified firstly, which can involve the decryption and signature verification processes of the token so as to ensure that the token is not tampered; user information in the token is extracted, including affiliated tenants, authority levels and the like.
The cloud platform inquires the security level and the interface permission level of the tenant according to the identity information of the user, and compares the user permission level with the required permission level of the interface call request; if the user rights are sufficient, continuing; otherwise, the request is denied and an error message is returned. If the user has enough rights, it is determined whether the resources can be allocated according to the resource requirements of the interface call request, which may involve checking the resource quota to ensure that the allocated resources do not exceed the user's limits and the remaining resources of the system.
And if the authority and the resource allocation pass, the cloud platform executes an interface call request to process the data or the service. And the cloud platform returns the operation result to the target user and carries necessary information in the response. In the whole process, the cloud platform records the log of each request, including target users, request content, authority verification results, resource allocation conditions and the like, so as to facilitate subsequent audit and monitoring.
By inquiring the security level of the tenant to which the target user belongs and the authority level of the interface call request, the system can judge whether the user has the call authority, and the accurate authority control ensures that only the user with enough authority can execute the corresponding operation, thereby reducing the security risk. In addition, the system can dynamically allocate resource request amount according to user identity, authority level and real-time resource condition to ensure reasonable use of resources and optimize system performance, and can reserve, limit or dynamically adjust resources for different users and interfaces to meet service requirements and performance requirements. By configuring and managing the security level and the interface authority level of the tenant, the system can flexibly adapt to different service scenes and requirements, and the modularized design can support the continuously-changing service requirements and simultaneously maintain the expandability of the whole system.
In an alternative embodiment of the present invention,
the cloud platform queries the security level of the tenant corresponding to the target user and the interface authority level of the interface call request according to the identity information of the target user, and the judging whether the target user has the call authority and whether the corresponding resource request quantity is allocated for the interface call request comprises the following steps:
Acquiring a calling service name corresponding to the interface calling request of the target user, judging whether the calling service name belongs to all service type sets based on all service type sets constructed in advance, if not, rejecting the interface calling request of the target user, and returning error operation information;
if yes, inquiring the security level of the tenant corresponding to the target user and the interface authority level of the interface call request according to the identity information of the target user;
if the security level of the tenant corresponding to the target user is not smaller than the interface authority level, further determining the resource request quantity corresponding to the interface call request, and judging whether to allocate the corresponding resource request quantity for the interface call request according to the resource quota allocated by the interface call request by combining the residual resource stock of the cloud platform.
Access Control (Access Control) is a Control that authorizes a system user or computer to Access a network or to operate an object on the computer, and is a Control that can Control a subject in a specific manner to maintain Access to an object within a certain security range. The most important task of access control is to ensure that the use of the system is in legal scope, and is also an important technology for protecting system resources and maintaining system safety.
The conventional access control model mainly comprises an autonomous access control DAC model, a forced access control MAC model, wherein,
the DAC model, also called a subject-based access control model, is the most common access control model in which a subject controls all access rights of an already owned object by itself. The control is that the main body autonomously grants the access right or some part of the access right to other main bodies, namely, the user autonomously shares resources with other users according to own wish. The biggest benefit of the autonomous access control model is that it is flexible enough because the creator of the object is able to manipulate all rights of the object. The disadvantage is that the rights are difficult to control after being transferred out, which brings a number of potential risks to the system and may be a security hole for the information resource. And meanwhile, the permission transferred out is expanded, so that huge expenditure is brought to the system because the permission cannot be controlled.
The MAC model, also called security-level based access control model, is subject to no intervention allowed. The model manages the information confidentiality level and class in the system by identifying the security level of all subjects and objects in the system, and adopts an unavoidable access control mode to prevent all direct or indirect attacks. That is, both the user and the resource are marked with a fixed security attribute, and each time the user accesses, a security attribute is detected to determine whether the user is entitled to access the resource. Its advantages are centralized management and high safety. But the flexibility is poor in the actual use of the application system, and the requirement of the application system with a large number of hosts and clients on access control cannot be met.
The embodiment of the invention takes a role-based access control model (RBAC model) as the basis of rights management and improves the role-based access control model.
The RBAC model introduces roles between users and authorities, and the users are enabled to obtain all access authorities of the corresponding roles by distributing proper roles to the users, so as to control the access operation of the users to system resources. The model realizes hierarchical management, wherein the change of any layer of relation does not affect the relation among other layers. The RBAC model has three entities, namely, a user, a role and rights, the user refers to a subject that can access system data and resources, the role refers to a set of rights or rights that possess certain rights to accomplish specified functions, the rights representing a set of rules for accessing system resources.
However, the physical relationship of the RBAC model is only three layers, and thus, a more detailed and comprehensive description of system resources cannot be realized, which results in insufficient granularity of management. In the design of component databases, most of components are realized by the database tables corresponding to the three entities, and also by the association tables among the user-role table, the role-permission table and the like, so that the related tables are numerous and the relationship among the tables is complex, the authorization process is complicated, the developer is not easy to understand, and the permission allocation is not flexible enough.
In order to more clearly illustrate the solution of the embodiment of the present invention, the following explanation is made on the corresponding terms:
the user is a registered user of the platform, the tenant is a role entity with a certain authority for a certain service, the role entity is a basic object of resource allocation, the resource allowance is the highest upper limit of the quantity of resources used for the certain service in the platform, the API interface level is a security level corresponding to the API interface, and the tenant level is a security level corresponding to a certain tenant.
Each user corresponds to multiple services of the platform, and each service corresponds to multiple tenant identities. Each tenant type may belong to a plurality of users, who obtain rights to the corresponding service through the tenant identity. The rights corresponding to the tenant mainly comprise two types, namely a resource quota and an API call right. The resource quota is operated by a relation table corresponding to the tenant and the resource quota. The calling authority of the API is operated by the tenant-corresponding API interface level table and the tenant-corresponding tenant level table. When the security level of a tenant in a service is not lower than the security level of the invoked interface, the tenant may invoke the interface. When a user has a resource request, the comprehensive judgment of the limit of the resource and the amount of the used resource is needed to determine whether the user has the right to use a certain amount of the resource.
Wherein determining whether to allocate a corresponding resource request amount for the interface call request may include:
and if not, refusing to allocate the resources.
When the system determines whether a user has a right to call a certain interface, firstly, acquiring a tenant type corresponding to a corresponding service of the user from a user tenant table according to the service type, wherein the tenant type name and a registered site type corresponding to the user name under the service are recorded in the user tenant table; inquiring an API interface level table according to the obtained tenant type to obtain an API interface security level value corresponding to the tenant type, wherein the interface level table records the security level value corresponding to each API;
querying a tenant level table to obtain the security level of the tenant type; the tenant level table records the security level value corresponding to the tenant type, and judges according to the results, if the security level of the tenant corresponding to the service of the user is not lower than the security level of the corresponding API interface, the user has the authority to call the interface, otherwise, the user cannot call the interface.
Further, if the system wants to determine whether a user has a fixed amount of authority to use a certain resource, it first needs to determine whether the user has an interface authority to call and obtain the resource through the above process, if so, the user continues to obtain the resource usage allowance corresponding to the tenant type through the tenant resource authority table, the tenant resource authority table records the usage allowance of various resources of various tenants under the corresponding service, and the user's corresponding resource usage amount is combined with the accounting part, and the amount of the resource being applied by the user is added, so as to determine whether the total amount of the resource exceeds the resource usage allowance corresponding to the tenant type, and further determine whether the user has authority to use the requested resource.
Optionally, the user needs to perform authentication before sending the interface call request, and may use a standard authentication protocol, such as OAuth 2.0; and after the authentication is successful, acquiring the role and tenant information of the user according to the identity information of the user. The cloud platform maintains a pre-built set of service types, including all legitimate service types. After receiving the interface call request of the user, extracting the call service name in the request, and judging whether the service name belongs to a predefined service type set. If the data do not belong to the set, the request is refused, error information is returned, and otherwise, the next step is carried out.
And acquiring the security level and the interface authority level of the tenant to which the user belongs from the identity information of the user. And comparing the interface authority level in the interface call request with the security level of the tenant, and ensuring that the user has enough authority to call. Inquiring the resource quota of the user and the residual resource stock of the cloud platform according to the identity information of the user and the interface call request; and judging whether enough resources are supplied to meet the interface call request according to the resource quota of the user and the residual resources of the cloud platform.
If the user has enough authority and enough resources, determining the resource request quantity allocated for the interface call request according to the service requirement or strategy; and once the authority and the resource verification are passed, the cloud platform allows the interface of the user to call the request, and the request is delivered to the corresponding service instance for processing. In the calling process, real-time resource usage monitoring and metering can be performed, and the user is ensured not to exceed the allocated resource quota.
S103, if the target user has the calling authority and the corresponding resource request quantity is distributed for the interface calling request, accessing the tenant with the calling authority in the cloud platform according to the interface calling request.
Illustratively, the tenant in the present application may be used to indicate a trusted tenant having an interaction history with the target user. In practical application, if two tenants have interaction histories and illegal events do not occur, the tenants can be considered as trusted. If the user in tenant a needs to access the resources of tenant B across tenants, then tenant B needs to determine whether the user in tenant a is trusted, i.e., the trust problem between tenants is involved. Tenant B is the party initiating trust, referred to as the trusted party, and tenant a is the party being trusted, referred to as the trusted party.
It should be noted that, the tenant refers to an entity renting a cloud service, a cloud service provider may provide services for multiple tenants, and the tenants utilize a cloud platform to carry their services. The user refers to an entity accessing the service carried by the tenant on the cloud service, and the service of the tenant can be accessed by a plurality of users. Roles refer to the identity or job function of a user in one tenant, and each tenant can have multiple roles, but each role can only belong to one tenant. The data owner refers to a tenant having ownership of the accessed data.
In practical applications, data leakage caused by accessing the resource of the data owner, etc.: granting sub-access rights to a trustworthy user; access is denied to untrustworthy users.
In an alternative embodiment of the present application,
the tenant comprises a trusted tenant with interaction history with the target user, and the accessing of the tenant with the calling authority in the cloud platform according to the interface calling request comprises the following steps:
acquiring user attribute information of the target user, environment attribute information of an environment where the target user is located and first reputation information of the target user, determining a first trust value of the tenant on the target user, if the first trust value is greater than or equal to a first preset trust threshold,
then an access role is allocated to the target user, whether the access authority attribute of the target user meets the preset requirement is judged according to the access role and the environment attribute information of the environment where the target user is located,
if yes, a second trust value of the data owner to the access role is further determined according to the access right attribute, the environment attribute information and the second reputation information corresponding to the access role, and if the second trust value is greater than or equal to a second preset trust threshold, the access right of the target user is granted.
According to the embodiment of the application, according to the user attribute information, the environment attribute information and the first reputation information of the target user, the tenant can establish the first trust value aiming at the target user, which can help to determine the credibility degree of the target user in the system. If the first trust value meets a preset trust threshold, the target user will be assigned the appropriate access role, which ensures that users that are trusted only to a certain extent are granted access to the system. After the access roles are allocated, the tenant evaluates the access authority attribute according to the environment attribute information of the environment where the target user is located, which is helpful to ensure that the roles and authorities of the target user are matched with the current environment, and different environments may need different authorities so as to realize flexible access control under different conditions. The calculation of the second trust value combines the access authority attribute, the environment attribute and the second credit information of the access role to form multi-level trust evaluation, and the multi-level evaluation considers a plurality of factors, so that the analysis of the user behavior is enhanced, and the accuracy of the trust evaluation is improved.
The user attribute information in the embodiment of the application can comprise attribute information such as an identity card number, a mailbox, a contact way and the like; the environment attribute refers to a time (time) at which a request is made, an access time length (the length of access time), an address (generally IP), and the like; the authority attribute comprises an operation attribute and a resource attribute; operational attributes include Read, write, update, delete, etc.; the resource attributes include a category (Type), a security Level (Secret Level), and the like of the resource of the data owner: the first reputation information of the target user may comprise an initial reputation rating of the target user, which may be an initial score given internally by the system.
The first trust value is used for indicating the trust degree among the quantified target user, the tenant and the access role. The trust of the data owner on the access role is that the data owner calculates the trust value of the access role from three aspects of access authority attribute, environment attribute information and reputation information of the access role.
In an alternative embodiment of the present application,
the obtaining the user attribute information of the target user, the environment attribute information of the environment where the target user is located, and the first reputation information of the target user determining the first trust value of the first tenant on the target user includes:
The first trust value is determined according to the following formula:
；
wherein,T1representing the first trust value in question,w1、w2、w3respectively representing the weight values corresponding to the user attribute information, the environment attribute information and the first reputation information,NA、NE、FRand respectively representing the user attribute information, the environment attribute information and the first reputation information.
Defining weights for the user attribute, the environment attribute and the first reputation information to reflect the importance degree of the user attribute, the environment attribute and the first reputation information on the trust value, wherein the weights can be fixed values determined according to field expertise or experience or can be obtained through data analysis; normalizing the user attributes and the environment attributes, mapping them to a uniform range, such as between 0 and 1, ensures that the attributes have similar weights in the calculation. In the embodiment of the application, the first preset trust threshold and the second preset trust threshold can be the same or different in value, and can be specifically set according to actual requirements, which is not limited by the application.
And if the first trust value is greater than or equal to a first preset trust threshold, assigning an access role to the target user, wherein the assignment of the access role to the target user is part of access control, and involves assigning specific rights and rights ranges to users so that they can perform specific operations in the system. An access role is a collection of permissions that represents the role and responsibilities of a user in a system, thereby restricting the operations that they can perform.
Different access roles may be defined in the system, each role representing a set of operations with similar responsibilities and rights, e.g., an administrator, general user, data analyst, etc. may be different roles, target users may be assigned to appropriate access roles based on user attributes and requirements, and a user may be assigned to one or more roles depending on their responsibilities in the system. An access role represents a class of users in a system that have a particular set of permissions, each role having a set of operational permissions to allow the user to perform a corresponding task. Different roles may have different access rights, so that the system may flexibly manage access and operation of the user.
Wherein the access rights attribute is used for indicating the rights attribute associated with the access role allocated by the user, and describes the operation which the user can execute under the specific role. And the system searches the access authority attribute of the role according to the environment attribute of the user so as to determine the operation which can be executed by the user in the current environment.
In an alternative embodiment of the present invention,
the determining the second trust value of the data owner to the access role according to the access right attribute, the environment attribute information and the second reputation information corresponding to the access role comprises:
Constructing respective corresponding fuzzy sets based on the access right attribute, the environment attribute information and the second reputation information corresponding to the access role;
based on the fuzzy set, combining a preset fuzzy rule, determining membership of each element in the fuzzy set through a membership function, and mapping the membership into an actual trust value as the second trust value.
Illustratively, assume a fuzzy set of access rights attributes: low, medium, high; fuzzy sets of environmental attributes: poor, fair, good; accessing a fuzzy set of second reputation information for the persona: low, medium, high; the preset fuzzy rule may be as follows:
if the access rights attribute is High and the environment attribute is Good, the trust value is High; if the access rights attribute is Low and the environment attribute is Poor, the trust value is Low. The membership function of the embodiment of the application can map the actual input value to the membership in the fuzzy set, and is usually a mathematical function, and can be a triangle function, a trapezoid function and the like. The following is an example of a simple triangle membership function:
triangle membership function of Low Access rights Properties: peak point: 0.2, left slope: 0.2, right slope: 0.4;
Triangle membership function of Medium Access rights Properties: peak point: 0.5, left slope: 0.2, right slope: 0.2;
triangle membership function of High access rights attribute: peak point: 0.8, left slope: 0.4, right slope: 0.2.
and finally mapping the membership degree into an actual trust value as the second trust value.
In an alternative embodiment of the present invention,
the method further includes determining whether the tenant is trusted:
acquiring the number of access resources participated by the tenant in a tenant role, and the number of illegal events participated by the tenant in the tenant role, and determining an initial trust value of the tenant by combining Bayesian probability distribution;
acquiring a trust record of the target user for the tenant, respectively distributing a first weight value for the initial trust value and a second weight value for the trust record, and determining a comprehensive trust value according to the initial trust value, the first weight value, the trust record and the second weight value;
and if the comprehensive trust value is larger than or equal to a preset trust threshold, the tenant is determined to be trusted, and if the comprehensive trust value is smaller than the preset trust threshold, the tenant is determined to be not trusted.
According to the embodiment of the application, a credibility assessment mechanism of the tenant is introduced, and the system can judge whether the tenant is worth trusting or not by analyzing the historical behavior and trust record of the tenant; different weight values are introduced to influence the calculation of the integrated trust value. The initial trust value, the trust record and different weight values are combined, so that the influence of various factors is better integrated, and more comprehensive trust evaluation is provided; along with the change of the behaviors and trust records of the tenants, the comprehensive trust value also changes, so that the system can update and adjust the trust degree of the tenants in real time, and the evaluation accuracy is maintained.
An illegal event, among others, refers to an event that occurs in a system or platform that violates a rule, does not comply with a law, policy, regulation, or rule. These events may involve illicit actions, violations of security policies, violations of terms of use, or other misbehavior; illegal events may lead to security risks and problems such as information leakage, intrusion into the system, data corruption, service interruption, etc.
The number of illegal events participated by the tenant role is an index for measuring the compliance of the tenant behavior, and by recording and counting the number of illegal events, whether the behavior of the tenant in the system meets the regulations and whether the potential risk exists can be estimated.
Assuming that a developer tenant accesses resources in a cloud platform, a malicious attempt illegally accesses data of other tenants, namely an illegal event. Or, one tenant obtains the sensitive data in the system in an unauthorized manner, and can be regarded as an illegal event.
Collecting data about the number of access resources and the number of illegal events that the tenant participates in the role of the tenant, calculating the behavior frequency of the tenant, namely the ratio of the number of access resources to the number of illegal events, can be used for measuring the behavior scale and compliance of the tenant. The initial trust value is calculated using a bayesian probability distribution. The bayesian probability distribution can combine a priori knowledge (the frequency of the tenant's behavior) with new observed data (the number of access resources and the number of illegal events) to derive a new estimate. And applying the Bayesian probability distribution to the behavioral frequency and the observed data of the tenant, and calculating to obtain an initial trust value.
The obtaining a trust record of the target user for the tenant may include:
in the system, operation logs of users and tenants are recorded, including access resources, modification settings and the like, and the logs can be used for tracking user behaviors and interaction histories; recording interaction history between the user and the tenant, including requests, responses, exchanged data, etc., which can reflect the collaboration relationship and trust between the user and the tenant.
The first weight value and the second weight value are respectively allocated to the initial trust value and the trust record, and the first weight and the second weight of the application can be fixed values determined according to technical expertise or experience of the field or can be obtained through data analysis. The first weight value may be the same as the second weight value or different from the second weight value, which is not limited in the embodiment of the present application.
And determining a comprehensive trust value according to the initial trust value, the first weight value, the trust record and the second weight value, wherein the comprehensive trust value can be determined in a weighted average mode, if the comprehensive trust value is greater than or equal to a preset trust threshold, the tenant is determined to be trusted, and if the comprehensive trust value is less than the preset trust threshold, the tenant is determined to be not trusted.
Fig. 2 is a schematic structural diagram of a cloud platform access right control system according to an embodiment of the present application, a second aspect of the embodiment of the present application,
provided is a cloud platform access right control system, comprising:
the first unit is used for sending the user name of the target user to a server of the cloud platform when the target user logs in the cloud platform, and the server verifies the identity of the target user based on a certificate issuing mechanism and a digital signature returned by the target user;
The second unit is used for sending an interface calling request to the cloud platform after the identity verification of the target user is passed, and the cloud platform queries the security level of the tenant corresponding to the target user and the interface authority level of the interface calling request according to the identity information of the target user, so as to judge whether the target user has the calling authority and whether the corresponding resource request quantity is allocated for the interface calling request;
and the third unit is used for accessing the tenant with the calling authority in the cloud platform according to the interface calling request if the target user has the calling authority and the corresponding resource request quantity is allocated for the interface calling request.
In a third aspect of an embodiment of the present invention,
there is provided an electronic device including:
a processor;
a memory for storing processor-executable instructions;
wherein the processor is configured to invoke the instructions stored in the memory to perform the method described previously.
In a fourth aspect of an embodiment of the present invention,
there is provided a computer readable storage medium having stored thereon computer program instructions which, when executed by a processor, implement the method as described above.
The present invention may be a method, apparatus, system, and/or computer program product. The computer program product may include a computer readable storage medium having computer readable program instructions embodied thereon for performing various aspects of the present invention.
Finally, it should be noted that: the above embodiments are only for illustrating the technical solution of the present invention, and not for limiting the same; although the invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some or all of the technical features thereof can be replaced by equivalents; such modifications and substitutions do not depart from the spirit of the invention.
Claims (9)
1. The cloud platform access right control method is characterized by comprising the following steps of:
when a target user logs in a cloud platform, a user name of the target user is sent to a server of the cloud platform, and the server verifies the identity of the target user based on a certificate issuing mechanism and a digital signature returned by the target user;
after the identity verification of the target user is passed, an interface calling request is sent to the cloud platform, and the cloud platform inquires the security level of the tenant corresponding to the target user and the interface authority level of the interface calling request according to the identity information of the target user, and judges whether the target user has calling authority and whether the corresponding resource request quantity is allocated for the interface calling request;
If the target user has the calling authority and the corresponding resource request quantity is distributed for the interface calling request, accessing the tenant with the calling authority in the cloud platform according to the interface calling request;
the tenant comprises a trusted tenant with interaction history with the target user, and the accessing of the tenant with the calling authority in the cloud platform according to the interface calling request comprises the following steps:
acquiring user attribute information of the target user, environment attribute information of an environment where the target user is located and first reputation information of the target user, determining a first trust value of the tenant on the target user, if the first trust value is greater than or equal to a first preset trust threshold,
then an access role is allocated to the target user, whether the access authority attribute of the target user meets the preset requirement is judged according to the access role and the environment attribute information of the environment where the target user is located,
if yes, a second trust value of the data owner to the access role is further determined according to the access right attribute, the environment attribute information and the second reputation information corresponding to the access role, and if the second trust value is greater than or equal to a second preset trust threshold, the access right of the target user is granted.
2. The method of claim 1, wherein the server verifying the identity of the target user based on a certificate authority and a digital signature returned by the target user comprises:
the target user generates a pair of asymmetric keys in advance, wherein the asymmetric keys comprise a private key and a public key, and registers the public key in a trusted certificate authority to generate a corresponding digital certificate;
when the target user logs in a cloud platform, the user name of the target user is sent to a server of the cloud platform, and the server requests a digital certificate of the target user from the certificate authority and sends the digital certificate to the target user;
generating a random challenge value by a random generator, digitally signing the random challenge value and the digital certificate using a private key, and transmitting the digital signature back to the server;
and the server verifies the validity of the digital signature according to the public key, if the digital signature is valid, the identity verification of the target user is passed, and if the digital signature is invalid, the identity verification of the target user is not passed.
3. The method of claim 1, wherein the cloud platform querying, according to the identity information of the target user, the security level of the tenant corresponding to the target user, and the interface authority level of the interface call request, determining whether the target user has call authorities, and whether to allocate a corresponding resource request amount for the interface call request comprises:
Acquiring a calling service name corresponding to the interface calling request of the target user, judging whether the calling service name belongs to all service type sets based on all service type sets constructed in advance, if not, rejecting the interface calling request of the target user, and returning error operation information;
if yes, inquiring the security level of the tenant corresponding to the target user and the interface authority level of the interface call request according to the identity information of the target user;
if the security level of the tenant corresponding to the target user is not smaller than the interface authority level, further determining the resource request quantity corresponding to the interface call request, and judging whether to allocate the corresponding resource request quantity for the interface call request according to the resource quota allocated by the interface call request by combining the residual resource stock of the cloud platform.
4. The method of claim 1, wherein the obtaining the user attribute information of the target user, the environment attribute information of the environment in which the target user is located, and the first reputation information of the target user to determine the first trust value of the tenant for the target user comprises:
The first trust value is determined according to the following formula:
；
wherein,T1representing the first trust value in question,w1、w2、w3respectively representing the weight values corresponding to the user attribute information, the environment attribute information and the first reputation information,NA、NE、FRand respectively representing the user attribute information, the environment attribute information and the first reputation information.
5. The method of claim 1, wherein the determining a second trust value for a data owner for the access role based on the access rights attribute, the environment attribute information, and the second reputation information for the access role comprises:
constructing respective corresponding fuzzy sets based on the access right attribute, the environment attribute information and the second reputation information corresponding to the access role;
based on the fuzzy set, combining a preset fuzzy rule, determining membership of each element in the fuzzy set through a membership function, and mapping the membership into an actual trust value as the second trust value.
6. The method of claim 1, further comprising determining whether the tenant is authentic:
acquiring the number of access resources participated by the tenant in a tenant role, and the number of illegal events participated by the tenant in the tenant role, and determining an initial trust value of the tenant by combining Bayesian probability distribution;
Acquiring a trust record of the target user for the tenant, respectively distributing a first weight value for the initial trust value and a second weight value for the trust record, and determining a comprehensive trust value according to the initial trust value, the first weight value, the trust record and the second weight value;
and if the comprehensive trust value is larger than or equal to a preset trust threshold, the tenant is determined to be trusted, and if the comprehensive trust value is smaller than the preset trust threshold, the tenant is determined to be not trusted.
7. The cloud platform access right control system is characterized by comprising:
the first unit is used for sending the user name of the target user to a server of the cloud platform when the target user logs in the cloud platform, and the server verifies the identity of the target user based on a certificate issuing mechanism and a digital signature returned by the target user;
the second unit is used for sending an interface calling request to the cloud platform after the identity verification of the target user is passed, and the cloud platform queries the security level of the tenant corresponding to the target user and the interface authority level of the interface calling request according to the identity information of the target user, so as to judge whether the target user has the calling authority and whether the corresponding resource request quantity is allocated for the interface calling request;
A third unit, configured to access, if the target user has a call right and a corresponding resource request amount is allocated to the interface call request, a tenant in the cloud platform having the call right according to the interface call request;
the tenant comprises a trusted tenant with interaction history with the target user, and the accessing of the tenant with the calling authority in the cloud platform according to the interface calling request comprises the following steps:
acquiring user attribute information of the target user, environment attribute information of an environment where the target user is located and first reputation information of the target user, determining a first trust value of the tenant on the target user, if the first trust value is greater than or equal to a first preset trust threshold,
then an access role is allocated to the target user, whether the access authority attribute of the target user meets the preset requirement is judged according to the access role and the environment attribute information of the environment where the target user is located,
if yes, a second trust value of the data owner to the access role is further determined according to the access right attribute, the environment attribute information and the second reputation information corresponding to the access role, and if the second trust value is greater than or equal to a second preset trust threshold, the access right of the target user is granted.
8. An electronic device, comprising:
a processor;
a memory for storing processor-executable instructions;
wherein the processor is configured to invoke the instructions stored in the memory to perform the method of any of claims 1 to 6.
9. A computer readable storage medium having stored thereon computer program instructions, which when executed by a processor, implement the method of any of claims 1 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310981214.0A CN116708037B (en) | 2023-08-07 | 2023-08-07 | Cloud platform access right control method and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310981214.0A CN116708037B (en) | 2023-08-07 | 2023-08-07 | Cloud platform access right control method and system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN116708037A CN116708037A (en) | 2023-09-05 |
| CN116708037B true CN116708037B (en) | 2023-11-24 |
Family
ID=87841842
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310981214.0A Active CN116708037B (en) | 2023-08-07 | 2023-08-07 | Cloud platform access right control method and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116708037B (en) |
Families Citing this family (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116881956B (en) * | 2023-09-08 | 2024-01-09 | 国网信息通信产业集团有限公司 | Permission management method and device oriented to multi-cloud resource management |
| CN117494163B (en) * | 2023-11-06 | 2024-05-31 | 深圳市马博士网络科技有限公司 | Data service method and device based on security rules |
| CN117792802B (en) * | 2024-02-28 | 2024-04-23 | 江苏意源科技有限公司 | Identity verification and application access control method and system based on multi-system interaction |
| CN117931460B (en) * | 2024-03-25 | 2024-05-24 | 勤源(江苏)科技有限公司 | Intelligent Internet of things terminal edge calculation method and system based on machine learning |
| CN118300835B (en) * | 2024-03-29 | 2024-10-22 | 深圳市机密计算科技有限公司 | High availability management method, system, terminal and medium for trusted computing device cluster |
| CN118332537B (en) * | 2024-06-13 | 2024-08-23 | 杭州喜格科技有限公司 | Cloud data access method and system |
| CN118509265A (en) * | 2024-07-19 | 2024-08-16 | 江苏苏商银行股份有限公司 | Security check authorization method, system and device based on attribute control |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103810444A (en) * | 2012-11-15 | 2014-05-21 | 中兴通讯股份有限公司 | Method and system for multi-tenant application isolation in cloud computing platform |
| CN106027462A (en) * | 2016-01-21 | 2016-10-12 | 李明 | Operation request control method and device |
| CN107204978A (en) * | 2017-05-24 | 2017-09-26 | 北京邮电大学 | A kind of access control method and device based on multi-tenant cloud environment |
| CN109818757A (en) * | 2019-03-18 | 2019-05-28 | 广东工业大学 | Cloud storage data access control method, Attribute certificate awarding method and system |
| CN113688376A (en) * | 2021-07-15 | 2021-11-23 | 上海浦东发展银行股份有限公司 | Tenant authority control method for realizing container cloud platform based on CMDB system and RBAC model |
-
2023
- 2023-08-07 CN CN202310981214.0A patent/CN116708037B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103810444A (en) * | 2012-11-15 | 2014-05-21 | 中兴通讯股份有限公司 | Method and system for multi-tenant application isolation in cloud computing platform |
| CN106027462A (en) * | 2016-01-21 | 2016-10-12 | 李明 | Operation request control method and device |
| CN107204978A (en) * | 2017-05-24 | 2017-09-26 | 北京邮电大学 | A kind of access control method and device based on multi-tenant cloud environment |
| CN109818757A (en) * | 2019-03-18 | 2019-05-28 | 广东工业大学 | Cloud storage data access control method, Attribute certificate awarding method and system |
| CN113688376A (en) * | 2021-07-15 | 2021-11-23 | 上海浦东发展银行股份有限公司 | Tenant authority control method for realizing container cloud platform based on CMDB system and RBAC model |
Also Published As
| Publication number | Publication date |
|---|---|
| CN116708037A (en) | 2023-09-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN116708037B (en) | Cloud platform access right control method and system | |
| US12008561B2 (en) | System for verification of pseudonymous credentials for digital identities with managed access to personal data on trust networks | |
| US7085925B2 (en) | Trust ratings in group credentials | |
| US8990896B2 (en) | Extensible mechanism for securing objects using claims | |
| CN109688119B (en) | Anonymous traceability identity authentication method in cloud computing | |
| US20010020228A1 (en) | Umethod, system and program for managing relationships among entities to exchange encryption keys for use in providing access and authorization to resources | |
| KR20210072794A (en) | Consensus-based voting for network member identification employing a blockchain-based identity signature mechanism | |
| CN103220141B (en) | A kind of protecting sensitive data method and system based on group key strategy | |
| CN114417287B (en) | Data processing method, system, device and storage medium | |
| CN109995791B (en) | Data authorization method and system | |
| CN102223420A (en) | Digital content distribution method for multimedia social network | |
| US20080066170A1 (en) | Security Assertion Revocation | |
| WO2022148182A1 (en) | Key management method and related device | |
| EP2912816A1 (en) | Method and apparatus for managing access rights | |
| CN116418568A (en) | Data security access control method, system and storage medium based on dynamic trust evaluation | |
| CN112187800A (en) | Attribute-based access control method with anonymous access capability | |
| Riad et al. | Multi-factor synthesis decision-making for trust-based access control on cloud | |
| CN117527378A (en) | Data encryption transmission method and system based on user attribute and dynamic strategy | |
| Chaudhry et al. | Zero‐trust‐based security model against data breaches in the banking sector: A blockchain consensus algorithm | |
| Chai et al. | BHE-AC: A blockchain-based high-efficiency access control framework for Internet of Things | |
| CN111538973A (en) | Personal authorization access control system based on state cryptographic algorithm | |
| US11954672B1 (en) | Systems and methods for cryptocurrency pool management | |
| CN112000936A (en) | Cross-domain attribute heterogeneous identity service method, medium and equipment | |
| CN117633749A (en) | Data security access control method and system supporting privacy protection and dynamic authorization | |
| KR100582195B1 (en) | Workflow-based Authorization System in Grid and method thereof |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |