Data isolation method used in storage cloud

Abstract

The invention relates to a data isolation method used in storage cloud, and belongs to the distributed storage field. The data isolation method comprises the following steps: (1) according to security demands of an organization, establishing security policy configuration of a tenant in master nodes of a storage cloud system; (2) establishing a user subject belonging to the organization and stamping role tags in a role model of the organization for the subject; (3) organizing an administrator to stamp the tags in the Tag model of the organization for an accessed resource object established by certain user in the organization; (4) according to role privileges of accessed resources, setting a security access policy of a role subject for the accessed resource object and storing the security access policy in the master nodes of the storage cloud system; and (5) according to the security access policy, judging whether the role subject passes the access to the accessed resource object by the master nodes, executing the access if yes and refusing the access if no. The data isolation method has the beneficial effects that the appropriate data isolation is ensured in a cloud-stored enterprise, and the adopted policy follows a universality principle, thus being applicable to public cloud, private cloud and mixed cloud.

Description

technical field [0001] The present invention proposes a method for providing isolation services for data stored on the cloud, and realizes a security mechanism for data isolation in a cloud storage environment based on HDFS (Hadoop Distributed File System). The technical field of the invention relates to mandatory access control, distributed storage. Background technique [0002] As an emerging technology and business application model, cloud computing has gained widespread attention and great promotion in recent years, both in the industry and in academia. Cloud computing presents a bright future for enterprise users. On the one hand, enterprises can entrust the management and maintenance of their IT infrastructure to professional cloud service providers, so as to focus more on the company's own business; on the other hand, it is more important that the services provided by cloud computing are their own. Adaptive, with flexible scalability. Enterprises can lease cloud se...

AI Technical Summary

Problems solved by technology

Aiming at the special environment of cloud storage, this paper proposes a flexible access control strategy based on RBAC (Role based Access Control), combined with the logical combination of organizational labels and various security attributes. On the one hand, it can ensure that data between different enterprises in the cloud The strong isolation makes it impossible for enterprise users to exceed their authority to access the data of other enterprise users; on the other hand, this strategy can ensure the appropriate isolation of cloud storage enterprise internal data, and enterprise users can flexibly customize the access control within the enterprise according to the company's own security needs strategy to isolate data from different departments and regions; finally, the strategy realizes possible data sharing under the condition of strong data isolation between enterprises through the concept of virtual organization, and ensures that enterprises in the same conflict concentration cannot share data through the Chinese Wall strategy of

Images