Resource access control method and device, electronic equipment, storage medium and program product

Abstract

The invention provides a resource access control method and device, electronic equipment, a computer readable storage medium and a computer program product. The method comprises the steps that under the condition that a resource access request initiated by a target object is received, a target expression matched with the target object is acquired from a permission language library; obtaining metadata information associated with the target object, and generating a query statement based on the metadata information and the target expression; and accessing a resource library based on the query statement to obtain target resource information used for responding to the resource access request. According to the method and the device, the calculation amount for matching and filtering the data can be greatly saved, so that the resource access efficiency can be effectively improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a resource access control method, device, electronic device, computer-readable storage medium, and computer program product. Background Art

[0002] Compared with traditional cloud platforms, financial clouds not only need to meet the requirements of resource reuse and isolation, but also have higher requirements for data security, system performance, etc.; cloud vendors' access management (Access Manager Service, AM) services are all resource-based access control management solutions, which are a specific implementation of attribute-based access control (Attribute-Based Access Control, ABAC). It provides a permission policy language that provides better support for authentication needs in multiple regions, multiple availability zones, multiple tenants and other dimensions. Summary of the invention

[0003] The embodiments of the present application provide a resource access control method, device, electronic device, computer-readable storage medium, and computer program product, which can effectively improve the efficiency of resource access.

[0004] The technical solution of the embodiment of the present application is implemented as follows:

[0005] The present application provides a resource access control method, including:

[0006] Upon receiving a resource access request initiated by a target object, obtaining a target expression matching the target object from a permission language library;

[0007] Acquire metadata information associated with the target object, and generate a query statement based on the metadata information and the target expression;

[0008] The resource library is accessed based on the query statement to obtain target resource information for responding to the resource access request.

[0009] The present application provides a resource access control device, including:

[0010] An acquisition module, configured to acquire a target expression matching the target object from a permission language library upon receiving a resource access request initiated by the target object;

[0011] A generation module, used to obtain metadata information associated with the target object, and generate a query statement based on the metadata information and the target expression;

[0012] The access module is used to access the resource library based on the query statement to obtain target resource information for responding to the resource access request.

[0013] An embodiment of the present application provides an electronic device, including:

[0014] A memory for storing executable instructions;

[0015] The processor is used to implement a resource access control method provided in an embodiment of the present application when executing executable instructions stored in the memory.

[0016] An embodiment of the present application provides a computer-readable storage medium storing computer-executable instructions for implementing a resource access control method provided by an embodiment of the present application when executed by a processor.

[0017] An embodiment of the present application provides a computer program product, including a computer program or computer executable instructions, which are used to implement a resource access control method provided by an embodiment of the present application when executed by a processor.

[0018] The embodiments of the present application have the following beneficial effects:

[0019] On the one hand, by obtaining the target expression that matches the target object from the permission language library, the efficiency of obtaining the expression is improved. On the other hand, when a resource access request initiated by the target object is received, it is only necessary to obtain the metadata information associated with the target object and generate a query statement based on the metadata information and the target expression. In this way, the resource library can be directly accessed based on the query statement to obtain accurate target resource information from the resource library, avoiding the matching and filtering operations that need to be performed by related technologies when accessing resources, greatly reducing the amount of calculation, and thus effectively improving the efficiency of resource access. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 is a schematic diagram of the architecture of a resource access control system 100 provided in an embodiment of the present application;

[0021] Figure 2 is a schematic diagram of the structure of an electronic device 500 provided in an embodiment of the present application;

[0022] Figure 3 It is a flowchart of a resource access control method provided in an embodiment of the present application;

[0023] Figure 4 It is a flowchart of a resource access control method provided in an embodiment of the present application;

[0024] Figure 5 It is a flowchart of a resource access control method provided in an embodiment of the present application;

[0025] Fig. 6A It is a flowchart of a resource access control method provided in an embodiment of the present application;

[0026] Figure 6B It is a flowchart of a resource access control method provided in an embodiment of the present application;

[0027] Figure 6C It is a flowchart of a resource access control method provided in an embodiment of the present application;

[0028] Fig.6D It is a flowchart of a resource access control method provided in an embodiment of the present application;

[0029] Fig. 6E It is a flowchart of a resource access control method provided in an embodiment of the present application;

[0030] Fig. 6F It is a flowchart of a resource access control method provided in an embodiment of the present application;

[0031] Figure 7 is a schematic diagram of a specific example of an abstract syntax tree provided in an embodiment of the present application;

[0032] Figure 8 This is a specific architecture diagram of the resource access control method provided by the embodiment of the present application applied in a financial cloud service scenario;

[0033] Fig. 9 is a timing diagram of the resource access control method provided in an embodiment of the present application;

[0034] Fig.10 It is a structural diagram of a specific instance of an abstract syntax tree provided in an embodiment of the present application. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0036] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it can be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0037] It is understandable that in the embodiments of the present application, when user information and other related data (such as user feature information) are involved, when the embodiments of the present application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0038] In the following description, the terms "first\second\..." involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\..." can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0039] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0040] Before further describing the embodiments of the present application in detail, the nouns and terms involved in the embodiments of the present application are explained. The nouns and terms involved in the embodiments of the present application are subject to the following interpretations.

[0041] 1) In response to: used to indicate the conditions or states on which the executed operations depend. When the dependent conditions or states are met, one or more operations executed may be in real time or have a set delay. Unless otherwise specified, there is no restriction on the order in which the multiple operations executed may be executed.

[0042] 2) Access Manager Service (AM) service: AM service is a user identity management and resource access control service provided by cloud vendors. It is mainly implemented based on ABAC, expressed in a domain-specific language (DSL), and integrates the characteristics of multiple access controls. Cloud vendors mainly use Resource Access Management (RAM) service and Configuration Account Management (CAM) service, which are all based on JavaScript Object Notation (JSON).

[0043] 3) Role-Based Access Control (RBAC): RBAC is an access control model widely used in the field of information security. The RBAC model implements a flexible and structured access control mechanism by granting permissions to roles and then granting roles to users.

[0044] 4) Attribute-Based Access Control (ABAC): ABAC is a trusted relational access control model for distributed applications in the industry. It uses the attributes of related entities (such as subjects, objects, and environments) as the basis for authorization to perform access control. ABAC uses attributes as a building block in a structured language to define and implement access control, and provides context-related fine-grained dynamic access control services. Compared with RBAC, ABAC has higher flexibility and finer granularity in access control, and is more suitable for complex scenarios in large-scale distributed cloud environments.

[0045] 5) Domain-Specific Language (DSL): DSL is a computer language that focuses on a certain application domain, such as Structured Query Language (SQL), HyperText Markup Language (HTML), JavaScript Object Notation (JSON), etc.

[0046] 6) Lexical analysis: Lexical analysis is the first stage of the compilation process and is the basis of compilation. The task of this stage is to read the source program character by character from left to right, that is, to scan the character stream that constitutes the source program and then identify words (also called word symbols or symbols) according to the word formation rules.

[0047] 7) Syntax analysis: Syntax analysis is a logical stage of the compilation process. The task of syntax analysis is to combine word sequences into various grammatical phrases based on lexical analysis.

[0048] 8) Semantic analysis: Semantic analysis is a logical stage of the compilation process. The task of semantic analysis is to review the context-related properties of the structurally correct source program and perform type review.

[0049] 9) Permission language library: Permission language library refers to the language library used to describe and manage system permissions, and is usually used to build a permission management system. It contains various permission-related terms, concepts, rules, and operation methods, and is used to define and manage the relationship between users, roles, permissions, etc., as well as operations such as granting, revoking, and reviewing permissions. Permission language libraries are usually written in a specific programming language or markup language for easy management and maintenance. Expressions that match the target object can be obtained from the permission language library.

[0050] 10) Resource context: Resource context refers to the language library used to describe and manage various attributes and states in a specific resource environment when performing system resource management. It is usually used to describe and manage various resources in the system, such as files, databases, network services, etc., as well as the associations and interactions between them. The resource context in this application mainly stores the mapping relationship between different elements.

[0051] 11) Metadata information: referred to as metadata for short, where metadata is data about data, used to describe and manage the attributes, characteristics, structure and relationships of data. The metadata information in this application mainly includes environmental information, resource information and user characteristic information.

[0052] 12) Abstract Data Type (ADT): Abstract data structure is a concept in computer science. It is an abstract description of data, not just the data itself. Abstract data types are widely used in database systems, compiler design, software engineering, and programming languages. Common abstract data structures include stacks, queues, abstract syntax trees, etc.

[0053] 13) Abstract Syntax Tree (AST): It is an abstract representation of the syntax structure of the source code. It represents the syntax structure of the programming language in a tree form. Each node on the tree represents a structure in the source code.

[0054] Compared with traditional cloud platforms, financial clouds not only need to meet the requirements of resource reuse and isolation, but also have higher requirements for data security and system performance. The AM services of existing cloud vendors are all based on resource access control management solutions, which are a specific implementation of ABAC. It provides a permission policy language that provides good support for authentication needs in multiple regions, multiple availability zones, and multiple tenants. However, in the face of financial cloud scenarios, with the increasing amount and complexity of data, its authentication performance and general capabilities face more challenges.

[0055] In the related technology, after the user sends a resource access request, the resource service will preliminarily filter the existing user conditions and obtain key value information (such as the primary key information of a tenant-related table). In order to ensure the effectiveness of resource filtering, the relevant key information will be extracted, where the resource service refers to all data, business services, basic components, various middleware, etc. that require access control management, and the user includes all tenants and services that have access requirements to controlled resources; then, request authentication from the AM service, and the AM service will perform preliminary parsing and verification of the resource model and the existing permission expression, including some legality verification and matching, to generate a set to be authenticated; then, traverse the set to be authenticated (this set is the encapsulated resource model key information set), match the permission expression in turn, and filter out the set information that meets the expression; then, the AM service sends the filtered resource model to the resource service, obtains the target resource according to the resource model screening, and returns the resource to the user.

[0056] However, the applicant found that the solution provided by the related technology has the following defects:

[0057] (1) In the process of encapsulating resource models, if a larger scope of permission control is involved, more data may be filtered out. As the amount of data increases, the access time and space occupied also increase, which can easily lead to poor cloud service performance or even service unavailability under conditions of massive data.

[0058] (2) The expressions used in the relevant technologies have relatively simple expressive capabilities and are difficult to cover for some complex scenarios, such as more fine-grained data field-level permissions, and such expressions are not suitable as general expressions for further back-end interpretation.

[0059] (3) The authentication process in the related technology is to match and filter the data to be authenticated, which may involve a large amount of calculation and easily further reduce the performance of the cloud service.

[0060] In view of this, the embodiments of the present application provide a resource access control method, device, electronic device, computer-readable storage medium and computer program product, which can effectively improve the efficiency of resource access. The electronic device provided by the embodiments of the present application is described below. The electronic device provided by the embodiments of the present application can be implemented as a server, or implemented by a server and a terminal in collaboration. The resource access control method provided by the embodiments of the present application is described below by taking the server and the terminal cooperating to implement the resource access control method provided by the embodiments of the present application as an example.

[0061] For example, see Figure 1 , Figure 1 1 is a schematic diagram of the architecture of a resource access control system 100 provided in an embodiment of the present application, in order to realize supporting a resource access control application, such as Figure 1As shown, the resource access control system 100 includes: a server 200, a network 300, a user terminal 400-1, an administrator terminal 400-2 and a database 600. The user terminal 400-1 and the administrator terminal 400-2 are respectively connected to the server 200 through the network 300, and the server 200 is connected to the database 600, wherein the network 300 can be a local area network or a wide area network, or a combination of the two; the user terminal 400-1 is a terminal associated with the user (i.e., the target object), and the administrator terminal 400-2 is a terminal associated with the administrator; the database 600 is used to store structured data (such as text information, mapping relationships and other types of data).

[0062] In some embodiments, the target object (e.g., user 1) initiates a resource access request through user terminal 400-1, and transmits the resource access request to server 200 through network 300. Upon receiving the resource access request initiated by user 1, server 200 obtains a target expression matching user 1 from the permission language library; then, server 200 obtains metadata information associated with user 1, and based on the metadata information and the target expression, generates a query statement that can directly access database 600; finally, server 200 sends the query statement to database 600, accesses database 600, obtains target resource information, and returns the resource information to user terminal 400-1 through network 300 for display on user terminal 400-1.

[0063] In some embodiments, before user 1 initiates a resource access request through user terminal 400-1, the administrator may also configure a permission language library through administrator terminal 400-2, and administrator terminal 400-2 determines the usage rules of the permission language library; then, administrator terminal 400-2 receives the expression configured by the administrator based on the usage rules, and stores the expression in the permission language library, wherein the expressions in the permission language library include common expressions and permission expressions that need to be escaped; finally, the configured permission language library is obtained, and the configured permission language library is transmitted to server 200 through network 300, and server 200 transmits the permission language library to database 600 for storage.

[0064] In other embodiments, the embodiments of the present application can also be implemented with the aid of cloud technology. Cloud technology refers to a hosting technology that unifies a series of resources such as hardware, software, and networks within a wide area network or a local area network to achieve data calculation, storage, processing, and sharing.

[0065] Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, and application technology based on the cloud computing business model. It can form a resource pool that can be used on demand and is flexible and convenient. Cloud computing technology will become an important support. The background services of the technical network system require a large amount of computing and storage resources.

[0066] For example, Figure 1 The server 200 in the example can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms. The user terminal 400-1 and the administrator terminal 400-2 can be smart phones, tablet computers, laptops, desktop computers, smart speakers, smart watches, car terminals, etc., but are not limited to these. The user terminal 400-1, the administrator terminal 400-2 and the server 200 can be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiments of the present application.

[0067] It should be noted that the resource access control method provided in the embodiment of the present application can be applied to different resource access control scenarios such as enterprise internal system access control, cloud service access management, application authorization management, data access control, etc., and can effectively improve resource access efficiency.

[0068] In some embodiments, the terminal or server can also implement the resource access control method provided by the embodiment of the present application by running various computer executable instructions or computer programs. For example, computer executable instructions can be commands, machine instructions or software instructions at the microprogram level. The computer program can be a native program or software module in the operating system; it can be a local (Native) application (APPlication, APP), that is, a program that needs to be installed in the operating system to run; it can also be a small program that can be embedded in any APP, that is, a program that can be run only by downloading it to a browser environment. In short, the above-mentioned computer executable instructions can be instructions in any form, and the above-mentioned computer program can be an application, module or plug-in in any form.

[0069] The structure of the electronic device provided in the embodiment of the present application is further described below. Taking the electronic device as a server as an example, see Figure 2 , Figure 2 is a schematic diagram of the structure of an electronic device 500 provided in an embodiment of the present application, Figure 2The electronic device 500 shown includes: at least one processor 510, a memory 540, and at least one network interface 520. The various components in the electronic device 500 are coupled together via a bus system 530. It is understood that the bus system 530 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 530 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, the bus system 530 is not described in detail. Figure 2 Various buses are labeled as bus system 530 .

[0070] The processor 510 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., where the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0071] The memory 540 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard drives, optical drives, etc. The memory 540 may optionally include one or more storage devices that are physically remote from the processor 510.

[0072] The memory 540 includes a volatile memory or a non-volatile memory, and may also include both volatile and non-volatile memories. The non-volatile memory may be a read-only memory (ROM), and the volatile memory may be a random access memory (RAM). The memory 540 described in the embodiments of the present application is intended to include any suitable type of memory.

[0073] In some embodiments, memory 540 is capable of storing data to support various operations, examples of which include programs, modules, and data structures, or a subset or superset thereof, as exemplarily described below.

[0074] Operating system 541, including system programs for processing various basic system services and performing hardware-related tasks, such as a framework layer, a core library layer, a driver layer, etc., for implementing various basic services and processing hardware-based tasks;

[0075] A network communication module 542, for reaching other computing devices via one or more (wired or wireless) network interfaces 520, exemplary network interfaces 520 include: Bluetooth, Wireless Authentication (WiFi), and Universal Serial Bus (USB);

[0076] In some embodiments, the device provided in the embodiments of the present application can be implemented in software. Figure 2 The resource access control device 543 stored in the memory 540 is shown, which can be software in the form of a program or plug-in, including the following software modules: an acquisition module 5431, a generation module 5432, an access module 5433, and a configuration module 5434. These modules are logical, and therefore can be arbitrarily combined or further split according to the functions implemented. It should be noted that in Figure 2 For the sake of convenience, all the above modules are shown at once, but it should not be considered that the resource access control device 543 excludes the implementation that can only include the acquisition module 5431, the generation module 5432 and the access module 5433. The functions of each module will be explained below.

[0077] In other embodiments, the device provided in the embodiments of the present application can be implemented in hardware. As an example, the device provided in the embodiments of the present application can be a processor in the form of a hardware decoding processor, which is programmed to execute the resource access control method provided in the embodiments of the present application. For example, the processor in the form of a hardware decoding processor can adopt one or more application specific integrated circuits (Application Specific Integrated Circuit, ASIC), digital signal processors (Digital Signal Processor, DSP), programmable logic devices (Programmable Logic Device, PLD), complex programmable logic devices (Complex Programmable Logic Device, CPLD), field programmable gate arrays (Field-Programmable Gate Array, FPGA) or other electronic components.

[0078] The resource access control method provided in the embodiment of the present application will be specifically described below in combination with the exemplary application and implementation of the server provided in the embodiment of the present application.

[0079] See also Figure 3 , Figure 3 is a flowchart of a resource access control method provided in an embodiment of the present application, which will be combined with Figure 3 The steps shown are explained.

[0080] In step 101, when a resource access request initiated by a target object is received, a target expression matching the target object is obtained from a permission language library.

[0081] It should be noted that the permission language library contains permission rules or policy expressions for different target objects and resources. These expressions can be based on attributes such as user identity, role, and permission level, and are used to describe the resource information that the target object can access and the way to access the resources. When the server receives a resource access request, it can search the permission language library for the corresponding expression based on the target object information carried in the request to determine whether the access requirement is met. By using the permission language library, the server can implement a more flexible and configurable access control strategy. When the server receives a resource access request, it can dynamically query the permission language library to evaluate and process the access request based on specific conditions and requirements, thereby improving the security, compliance, and flexibility of resource management, ensuring that only authorized objects can access the corresponding resources, and limiting the access rights of objects.

[0082] For example, suppose in an RBAC system, the permission language library contains rules and specifies that "administrators of the finance department" can access the "financial report" resource. When a resource access request comes from a user identified as "administrator of the finance department", the system will extract the user's role and permissions and verify whether the user has the right to access the resource.

[0083] In some embodiments, see Figure 4 , Figure 4 is a flow chart of a resource access control method provided in an embodiment of the present application, such as Figure 4 As shown, in the execution Figure 3 Before step 101 shown, you can also perform Figure 4 Steps 104 and 105 shown will be combined Figure 4 The steps shown are explained.

[0084] In step 104, the usage rules of the permission language library are determined.

[0085] In some embodiments, to determine the usage rules of the permission language library, first clarify the access control requirements of the server or application, including clarifying the resources that need to be protected, the users or roles that need to access these resources, and the specific requirements for access rights; then, based on the clear access control requirements, define the corresponding permission model, where the model includes the relationship between users, roles, permissions and resources, and the structure and content of the permission rules; then, based on the defined permission model, write corresponding permission rules to express the access rights of different users or roles to resources in different situations; then, determine the format and grammatical rules of the permission expression, including how to represent user identity, role, resources, operation permissions, etc., to ensure that the server can correctly parse and match these expressions; finally, verify and test the written permission rules to ensure that the permission rules conform to the expected access control logic and do not introduce ambiguity or security vulnerabilities.

[0086] For example, the usage rule of the permission language library may be that a target object (eg, a user) with "read" permission can access a "resource:report" resource, while a target object (eg, an administrator) with "write" permission can modify the "resource:report" resource.

[0087] In step 105, an expression configured based on a usage rule is received and stored in a rights language library.

[0088] Here, the expressions in the permission language library include common expressions and permission expressions that need to be escaped.

[0089] In some embodiments, an administrator inputs a permission expression through a user interface or a command line tool, wherein the permission expression may be written based on a certain permission description language (e.g., role-based access control (RBAC)). Then, the server requires a parser to parse the permission expression input by the administrator. Here, the parser checks whether the syntax of the permission expression is correct and converts the permission expression into a representation stored inside the permission language library (e.g., a data structure or an object model). Then, it verifies whether the parsed permission expression complies with the access control policy of the resource access control system (e.g., checking whether the roles, permissions, and resources in the permission expression are valid, and whether the logical relationship between them is correct). Finally, the verified permission expression is stored in the permission language library. This requires corresponding operations on the database to save the representation stored inside the permission expression to the corresponding tables and fields.

[0090] It should be noted that the expressions in the permission language library can provide flexible permission management solutions according to different scenarios and needs, thereby improving the applicability and scalability of the system.

[0091] Continuing with the above example, the target object with "read" permission can be represented by {permission="read", subject="role:user", object="resource:report"} based on the expression of the usage rule; the target object with "write" permission can be represented by {permission="write", subject="role:admin", object="resource:report"} based on the expression of the usage rule.

[0092] In some embodiments, see Figure 5 , Figure 5 is a flow chart of a resource access control method provided in an embodiment of the present application, such as Figure 5 As shown, Figure 3 Step 101 shown may be performed by Figure 5 Steps 1011 to 1012 shown in the figure are implemented by combining Figure 5 The steps shown are explained.

[0093] In step 1011, the resource access request is parsed to obtain permission information of the target object.

[0094] In some embodiments, first, the server parses the resource access request to obtain information including the request type (e.g., read, write, execute, etc.), target resource (e.g., file, database record, etc.), requester (user, application, device, etc.); then, the target object targeted by the resource access request is determined, and the scope of the target object's authority is determined based on the information carried in the request (e.g., resource identifier, user identifier, etc.); finally, the authority management system or authority repository is queried to find the authority information of the target object (including the current authority configuration of the target object, the role it belongs to, the authority it has, etc.). Then, the authority information of the target object is matched with the authority required in the request, and the authority information of the target object is compared with the authority required for the request (e.g., read, write, execute authority) to determine whether the target object has sufficient authority to execute the request; then, a corresponding authority decision is made based on the result of the authority matching. If the target object has sufficient authority to execute the request, the resource access request can be authorized. Otherwise, the resource access request will be rejected, and a response (e.g., prompt information, etc.) of denying access will be issued to the target object.

[0095] For example, suppose that in a RBAC system, the subject and resource in the resource access request are first identified, and the permission rules matching the subject and resource are queried in the permission language library; when the matching permission rules are found, the operation type authorized by the subject is extracted, and based on the extracted permission information, it is decided whether to allow the subject to access the resource; if allowed, the resource access request is allowed to continue to perform subsequent operations; if not allowed, it is returned that the resource access request is denied (for example, 403 Forbidden is returned).

[0096] In step 1012, based on the permission information of the target object, a target expression matching the permission information of the target object is obtained from a permission language library.

[0097] Continuing with the above example, after extracting the permission information of the target object from the permission repository or permission management system, the server can map the extracted permission information of the target object to an expression in the permission language library, and search the permission language library for an expression that matches the extracted permission language library.

[0098] In some embodiments, when a resource access request is received from a target object (such as a user, program, or device), for resource access control, the sent resource access request is usually matched with pre-defined permission rules to determine whether the resource access request is allowed to access the resource, wherein an expression that matches the target object can be obtained by querying the permission language library.

[0099] In step 102, metadata information associated with the target object is obtained, and a query statement is generated based on the metadata information and the target expression.

[0100] In some embodiments, see Fig. 6A , Fig. 6A is a flow chart of a resource access control method provided in an embodiment of the present application, such as Fig. 6A As shown, Figure 3 Step 102 shown may be performed by Fig. 6A Steps 1021 to 1023 shown in the figure are implemented by combining Fig. 6A The steps shown are explained.

[0101] In step 1021, a resource context is constructed based on the metadata information.

[0102] It should be noted that metadata information mainly includes user feature information, environment feature information and resource feature information, and metadata information is uploaded by reporting during the process of creating resources on the server. When implementing the resource access control method, it is only necessary to extract metadata information related to the target user and build a resource context based on the extracted metadata information. The resource context can be the most basic key-value pair information table, including metadata information of users, environments, and resources, or it can be expressed in JSON type to provide a format conversion environment for expressions.

[0103] In some embodiments, see Figure 6B , Figure 6B is a flow chart of a resource access control method provided in an embodiment of the present application, such as Figure 6B As shown, Fig. 6A Step 1021 shown may be performed by Figure 6B Steps 10211 to 10212 shown in the figure are implemented by combining Figure 6B The steps shown are explained.

[0104] In step 10211, a data structure matching the metadata information is created.

[0105] In some embodiments, according to the characteristics of the metadata information, an appropriate data storage technology (such as a relational database, a non-relational database, a data warehouse, etc.) is selected, and a data model is designed according to the metadata information, including information such as entities, attributes, relationships, and constraints; according to the designed data model, corresponding data tables are created in the selected data storage technology, where each table should correspond to an entity and contain fields that match the metadata information; then, fields are defined for each data table to ensure that the data type, length, constraints, etc. of the fields are consistent with the metadata information to maintain the integrity and correctness of the data.

[0106] For example, suppose a data structure for matching metadata information is created for a file management system. First, a data table is defined to store file attributes (such as file name, size, type, creation time, last modification time, etc.); then, a query interface is created to search and match metadata information based on the above attributes.

[0107] In step 10212, the metadata information is stored in a data structure to obtain a resource context.

[0108] Continuing with the above example, the metadata information is stored in a designed data structure to ensure that each metadata information is correctly mapped and stored for subsequent query and retrieval; then, based on the data structure of the stored metadata information, a resource context is constructed. The resource context includes all data entities, attributes, and the relationships between them to provide the overall context and meaning of the data. In this way, by constructing a resource context, the server does not need to traverse all the data, but only needs to access some key metadata information related to the permission expression according to the mapping relationship stored in the resource context. In this way, the amount of data access is reduced, thereby improving the resource access management efficiency of the server.

[0109] In step 1022, the target expression is converted based on the resource context to obtain an abstract data structure.

[0110] It should be noted that the abstract data structure can be a common abstract data structure type such as a stack, a queue, a linked list, a number, a graph, etc., and no specific limitation is made here.

[0111] In some embodiments, the target expression includes a permission expression that needs to be escaped, see Figure 6C , Figure 6C is a flow chart of a resource access control method provided in an embodiment of the present application, such as Figure 4 As shown, in the execution Fig. 6A Before step 1022, you can also perform Figure 6C Step 1024 is shown, combining Figure 6C The steps shown are explained.

[0112] In step 1024, the target expression is converted into a common expression based on the resource context.

[0113] For example, assume that the format of the permission expression that needs to be escaped is as follows:

[0114]

[0115]

[0116] The general expression obtained by escaping is as follows: when Condition(Principal)then Action(Effect,Resource), where Condition(Principal) represents the conditional function based on Principal, and Action(Effect,Resource) represents the action function based on Effect and Resource.

[0117] In some embodiments, the basic grammatical expression of the general expression in the embodiments of the present application can be expressed as whenCondition then Action, and the general expression in the embodiments of the present application can be a variety of combinations, and both conditions and actions can be expressed in a functional manner; wherein Condition represents a true value situation, such as age>18and name in(a,b,c); Action can be a series of verb-object phrase combinations, such as allow create ecs, deny readuser.password; and the type of the parameter in the expression can be an integer (int), a Boolean type (bool), and a string type (string); the general expression of the present application can be compatible with the original expression, so that the permission coverage is wider and can adapt to more fine-grained data resource-level permissions.

[0118] In some embodiments, see Fig.6D , Fig.6D is a flow chart of a resource access control method provided in an embodiment of the present application, such as Fig.6D As shown, Figure 6C Step 1024 shown may be performed by Fig.6D Steps 10241 to 10243 shown are implemented by combining Fig.6D The steps shown are explained.

[0119] In step 10241, the target expression is decomposed into multiple first elements.

[0120] In some embodiments, the permission expression that needs to be escaped can be first decomposed into multiple first elements according to the escape rule, wherein the type of the first element can be a keyword, an operator, an identifier, etc.

[0121] Following the above permission expression example that needs to be escaped, the expression can be decomposed into multiple first elements such as "Effect", "Action", "Resource", "Condition" and "Principal".

[0122] In step 10242, the second element corresponding to each first element is determined based on the resource context.

[0123] In some embodiments, the above-mentioned determination of the second element corresponding to each first element based on the resource context can be implemented in the following way: query the resource context based on the first element to obtain the second element corresponding to the first element, wherein the resource context includes a first mapping relationship between the first element and the second element.

[0124] Continuing with the above example, according to the first mapping relationship in the resource context, the representation form of the first element in the general expression, that is, the second element, is determined. For example, the second element corresponding to the first elements "Condition" and "Principal" is "When Condition(Principal)", and the second element corresponding to "Effect", "Action" and "Resource" is "then Action(Effect,Resource)".

[0125] In step 10243, multiple second elements are combined based on the grammatical rules of the general expression to obtain a general expression.

[0126] Continuing with the above example, according to the grammatical rules of general expressions, the second element "When Condition (Principal)" and "then Action (Effect, Resource)" are combined to obtain a general expression, namely "When Condition (Principal) then Action (Effect, Resource)".

[0127] In some embodiments, see Fig. 6E , Fig. 6E is a flow chart of a resource access control method provided in an embodiment of the present application, such as Fig. 6E As shown, Fig. 6A Step 1022 may be performed by Fig. 6E Steps 10221 to 10223 shown are implemented by combining Fig. 6E The steps shown are explained.

[0128] In step 10221, the target expression is decomposed into multiple third elements.

[0129] It should be noted that the expression can be decomposed into multiple third elements through lexical analysis, or according to specified decomposition rules, without specific limitation here; wherein the third element includes at least one of multiple elements such as keywords, identifiers, operators, separators, etc., and the third element can be the same type as the above-mentioned second element or different.

[0130] In step 10222, the sub-abstract data structure corresponding to each third element is determined based on the resource context.

[0131] It should be noted that the sub-abstract data structure can be dynamically adjusted and created according to the resource context, thereby achieving flexible and fine-grained access control.

[0132] In some embodiments, the above-mentioned determination of the sub-abstract data structure corresponding to each third element based on the resource context can be implemented in the following way: query the resource context based on the third element to obtain the sub-abstract data structure corresponding to the third element, wherein the resource context includes a second mapping relationship between the third element and the sub-abstract data structure.

[0133] For example, a grammatical analysis is performed based on the corresponding relationship of the third element in the resource context to determine the abstract data structure corresponding to the third element. For example, element A and element B correspond to the user abstract data structure, and element C and element D correspond to the permission abstract data structure. That is, multiple different sub-abstract data structures can be determined based on the resource context.

[0134] In step 10223, an abstract data structure is constructed based on the association relationship between multiple sub-abstract data structures.

[0135] For example, semantic analysis is performed based on the association relationship between multiple sub-abstract data structures, and different sub-abstract data structures are combined according to the association relationship to construct an abstract data type. Taking the abstract syntax tree as an example, the abstract syntax tree is constructed based on the association relationship between the sub-abstract syntax trees. See Figure 7 , Figure 7 It is a schematic diagram of a specific example of an abstract syntax tree provided in an embodiment of the present application.

[0136] In step 1023, the abstract data structure is converted based on the resource context to obtain a query statement.

[0137] In some embodiments, see Fig. 6F , Fig. 6F is a flow chart of a resource access control method provided in an embodiment of the present application, such as Fig. 6F As shown, Fig. 6A Step 1023 shown may be performed by Fig. 6F Steps 10231 to 10233 shown in the figure are implemented by combining Fig. 6F The steps shown are explained.

[0138] In step 10231, the abstract data structure is extracted based on the resource context to obtain key information.

[0139] It should be noted that the abstract data structure contains at least one of the multiple elements such as keywords, identifiers, operators, separators, etc. Based on the content stored in the resource context, the key information matching the resource context is extracted, and unimportant characters and symbols are removed, that is, only the key information is retained.

[0140] For example, assume that there is a file system, and each file information corresponds to an abstract data structure. The creator, creation time, file type, and size information in the abstract data structure are extracted according to the resource context information to obtain the corresponding key information, so as to facilitate the evaluation of the access control policy based on the extracted key information.

[0141] In step 10232, the query language type is determined based on the key information, and a query statement template corresponding to the query language type is generated.

[0142] In some embodiments, the type of data storage is first determined, including a relational database (such as MySQL, PostgreSQL, etc.), a graph database (such as Neo4j, etc.) or other types of database storage types; then, based on the access control policy and key information, the query requirements are analyzed (such as queries for specific resources, queries for users or roles, logical combination queries for specific conditions, etc.); then, based on the data storage type and query requirements, a suitable query language is selected (for example, if the data storage is a relational database, the query language may be SQL; if the data storage is a graph database, the query language may be Cypher); then, a query statement template is designed based on the selected query language to facilitate the subsequent generation of specific query statements based on the key information.

[0143] For example, assuming that the extracted key information includes user key information and corresponding ID, resource key information and corresponding ID, and permission key information and corresponding ID, and assuming that the language type supported by the key information is SQL, a corresponding query statement template is generated according to the key information, such as select*from*where*.

[0144] In step 10233, key information is filled into the query statement template to obtain a query statement.

[0145] Continuing with the above example, the extracted user key information and corresponding ID, resource key information and corresponding ID, and permission key information and corresponding ID are filled into the corresponding positions of the query statement template to obtain a query statement that can directly access the resource library.

[0146] In step 103, the resource library is accessed based on the query statement to obtain target resource information for responding to the resource access request.

[0147] In some embodiments, the query statement is first parsed to determine the structure of the query statement and the condition information contained therein (for example, the condition parameters to be queried are followed by WHERE in the SQL statement); then, according to the requirements of the query statement, the required query parameters are prepared, wherein these query parameters are used to replace the placeholders in the template when executing the query, so as to ensure that the query statement can be correctly executed according to different query conditions; then, the query statement and query parameters are used to access the resources and perform the query operation, where a database driver, ORM framework or other data access layer components can be used; then, the query results are obtained and transmitted to the client to feed back the queried resource information to the user.

[0148] In some embodiments, the above-mentioned access to the resource library based on the query statement to obtain the target resource information for responding to the resource access request can be achieved in the following way: access the resource library based on the query statement, and use the resource information in the resource library that matches the query statement as the target resource information for responding to the resource access request.

[0149] For example, suppose there is a resource library that stores detailed information of all resources. The resource library is accessed based on a query statement, and resource information matching the query statement is retrieved from the resource library. Based on the retrieved resource information, the query user's permissions are confirmed to ensure that the user has sufficient permissions to access. If the user has permission to access the corresponding resource information, the matching resource information is returned to the user as the target resource information. Otherwise, a prompt message is sent to the user to prompt the user that the user does not have permission to access the target resource information.

[0150] Next, an exemplary application of the embodiment of the present application in an actual application scenario will be described. The exemplary application describes the specific implementation process of the resource access control method in a financial cloud service scenario.

[0151] In some embodiments, see Figure 8 , Figure 8 This is a specific architecture diagram of the resource access control method provided by the embodiment of the present application in the financial cloud service scenario. Figure 8 Describe the specific implementation process.

[0152] Phase 1: The administrator configures the permission language library by constructing expressions.

[0153] It should be noted that the expression here can be compatible with the original statement expression, or it can be directly obtained from the general expression in the embodiment of the present application.

[0154] In some embodiments, the administrator first understands the access control model adopted (such as RBAC, ABAC, etc.), and the configuration methods and requirements of different models may be different; then, based on the access control model, determine the key entities that need to be configured (such as users, roles, resources, operations, etc.); then, based on the configured key entities, construct permission expressions, where the permission expressions define the permissions of specific entities (such as users, roles, etc.) to perform specific operations (such as reading, modifying, etc.) on specific resources (such as files, directories, etc.). Here, different access control frameworks can support different syntax and structures, and permission expressions can be constructed according to the syntax supported by the permission language library.

[0155] Phase 2: The user issues a resource access request and provides basic information about himself / herself.

[0156] It should be noted that the basic factor information refers to the user characteristic information.

[0157] Phase 3: Resource-related services will report their own resource metadata.

[0158] It should be noted that resource-related services will report key resource data information based on resource access requests issued by users.

[0159] Phase 4: Extract environmental feature information and user feature information, and synchronize the information to the access control service to complete the configuration of metadata information.

[0160] It should be noted that the environmental characteristic information includes relevant information such as time and hardware information, and the user characteristic information includes information such as user ID and permissions.

[0161] Here, environmental characteristic information related to access control can be collected from the system environment, such as system status, resource attributes, timestamp, geographic location, etc.; user characteristic information related to access control (such as user roles, user groups, user permissions, user behavior patterns, etc.) can be collected from sources such as user sessions, user attributes, and user behaviors.

[0162] Phase 5: The access control service obtains the corresponding expression from the permission language library based on the configured metadata information. If the expression is a statement expression, it will be escaped into a common expression. If the expression is a common expression, no escape operation is required.

[0163] Phase 6: Perform lexical analysis, syntax analysis, and semantic analysis on the common expression, and build the common expression into an AST-based intermediate authority representation to facilitate further back-end interpretation operations.

[0164] In some embodiments, a lexical analysis is first performed on the general expression to decompose the general expression into basic elements (such as keywords, operators, identifiers, constants, etc.) to obtain a lexical token (Token) sequence; then, a syntactic analysis is performed to convert the Token sequence obtained from the lexical analysis into an abstract syntax tree; then, a semantic analysis is performed to verify whether the elements in the abstract syntax tree are meaningful and ensure that the elements semantically meet the requirements of access control; finally, the abstract syntax tree that has undergone semantic analysis is converted into an intermediate permission representation to facilitate further back-end interpretation operations.

[0165] Phase 7: Interpret the AST-based intermediate authority representation into query statements, such as the database language of the relational database (such as SQL), the command of the cache middleware (such as Redis command), the syntax of the search middleware (such as ElasticSearch query language), and the monitoring middleware language (such as Prometheus's PromQL, etc.).

[0166] Phase 8: Access the resource library based on the generated query statement, such as a relational database, etc. Of course, other corresponding intermediate media such as caching, search, monitoring, etc. can also be used as a language to access the resource library.

[0167] Phase 9: Based on the access operation of the resource library access language, the resource information requested by the user is returned.

[0168] In some embodiments, see Fig. 9 , Fig. 9 This is a timing diagram of the resource access control method provided in the embodiment of the present application. Fig. 9 The steps shown are described in detail.

[0169] In step 201, the controlled resource receives a resource access request issued by a user.

[0170] It should be noted that the resource access request sent by the user to the controlled resource through the application or tool may be an HTTP request, file system access, database query or other types of resource access requests, which are not specifically limited here.

[0171] In some embodiments, first, the controlled resources can detect or receive access requests from users, which can be initiated through the network, API calls, file system operations, etc.; then, the controlled resources parse the resource access requests issued by the users and extract the information carried in the resource access requests.

[0172] In step 202, the controlled resource builds a resource context.

[0173] In some embodiments, metadata information such as user characteristics, environment characteristics, and resource characteristics are obtained, and a resource context is constructed based on the metadata information, wherein the resource context information can be expressed using the JSON type or using the most basic key-value pair information table to provide an environment for expression evaluation operations.

[0174] In step 203, the controlled resource requests authentication from the resource access management service.

[0175] In some embodiments, the controlled resource initiates an authentication request to the resource access management service, and the resource access management service performs matching verification based on the identification information in the request (such as user name / mobile phone number / IP, etc.) to ensure the legitimacy of the source of the request; after the verification is passed, the resource access management service further checks the authority of the requester to determine whether it has the authority to access the target resource.

[0176] In step 204, the resource access management service performs front-end translation.

[0177] In some embodiments, the resource access management service searches for an expression that matches the user's permission information from a permission language library based on the user's permission information. When the expression is a permission expression that needs to be escaped, the resource access management service needs to perform front-end translation to escape the permission expression that needs to be escaped into a common expression.

[0178] For example, the permission expression that needs to be escaped is as follows.

[0179]

[0180]

[0181] The above expression indicates that ordinary users can see the information of fields a, b, and c executed in ECS instances created after 2024 under their tenants.

[0182] The above expression generates the common expression when(tenant is user and createTime>2024-01-01)then(access list instances.fields) through escaping.

[0183] In step 205, the resource access management service generates an intermediate rights expression.

[0184] In some embodiments, the resource access management service generates an intermediate permission representation based on AST by performing lexical analysis, syntactic analysis, and semantic analysis on the common expression.

[0185] Following the above example, see Fig.10 , Fig.10 : is a schematic diagram of the structure of a specific instance of the abstract syntax tree provided in the embodiment of the present application. The resource access management service performs lexical analysis, grammatical analysis, and semantic analysis on the general expression in sequence, and generates an AST such as Fig.10 shown.

[0186] In step 206, the resource access management service performs backend interpretation.

[0187] In some embodiments, the resource access management service performs backend interpretation on the AST to obtain a query statement that can directly access the resource repository.

[0188] Continuing with the above example, the resource access management service interprets the AST in the backend and generates a SQL query statement corresponding to the above AST that can directly access the resource library: select a,b,c from cloud_instances where tenant=123and createTime>2024-01-01.

[0189] In step 207, the resource access management service performs resource access to the controlled resource after authentication.

[0190] In some embodiments, when the resource access management service verifies the requester through authentication and authorization, and determines whether the requester has sufficient authority to access the controlled resources, when the confirmation is successful, the resource access management service requests resource access to the controlled resources based on the generated query statement.

[0191] In step 208, the controlled resource acquires the resource.

[0192] In some embodiments, the controlled resource searches for resources according to the query statement sent by the resource access management service to obtain resource information matching the query statement.

[0193] In step 209, the controlled resource returns the resource to the user.

[0194] In some embodiments, the controlled resource returns the queried resource information to the user.

[0195] The following is a description of an exemplary structure of the resource access control device 543 provided in the embodiment of the present application implemented as a software module. In some embodiments, for example, Figure 2As shown, the software modules stored in the resource access control device 543 of the memory 540 may include: an acquisition module 5431, which is used to obtain a target expression matching the target object from the permission language library when a resource access request initiated by the target object is received; a generation module 5432, which is used to obtain metadata information associated with the target object, and generate a query statement based on the metadata information and the target expression; an access module 5433, which is used to access the resource library based on the query statement to obtain target resource information for responding to the resource access request.

[0196] In some embodiments, the generation module 5432 is further used to construct a resource context based on metadata information; transform the target expression based on the resource context to obtain an abstract data structure; and transform the abstract data structure based on the resource context to obtain a query statement.

[0197] In some embodiments, the resource access control device 543 also includes a configuration module 5434, which is used to determine the usage rules of the permission language library; receive expressions configured based on the usage rules, and store the expressions in the permission language library, wherein the expressions in the permission language library include common expressions and permission expressions that need to be escaped.

[0198] In some embodiments, when the target expression is a permission expression including escape, the generation module 5432 is further used to convert the target expression into a common expression based on the resource context.

[0199] In some embodiments, the generation module 5432 is further used to decompose the target expression into multiple first elements; determine the second element corresponding to each first element based on the resource context; and combine the multiple second elements based on the grammatical rules of the general expression to obtain a general expression.

[0200] In some embodiments, the generation module 5432 is further used to create a data structure matching the metadata information; store the metadata information in the data structure to obtain a resource context.

[0201] In some embodiments, the generation module 5432 is further used to decompose the target expression into multiple third elements; determine the sub-abstract data structure corresponding to each third element based on the resource context; and construct an abstract data structure based on the association relationship between the multiple sub-abstract data structures.

[0202] In some embodiments, the generation module 5432 is also used to extract the abstract data structure based on the resource context to obtain key information; determine the query language type based on the key information, and generate a query statement template corresponding to the query language type; fill the key information into the query statement template to obtain a query statement.

[0203] In some embodiments, the acquisition module 5431 is further used to parse the resource access request to obtain the permission information of the target object; based on the permission information of the target object, obtain a target expression matching the permission information of the target object from the permission language library.

[0204] It should be noted that the description of the device in the embodiment of the present application is similar to the description of the method embodiment above, and has similar beneficial effects as the method embodiment, so it will not be repeated. Figure 3 , Figure 4 , Figure 5 , Fig. 6A , Figure 6B , Figure 6C , Fig.6D , Fig. 6E ,or Fig. 6F The present invention should be understood by referring to the description of any one of the accompanying drawings.

[0205] The embodiment of the present application provides a computer program product, which includes a computer program or a computer executable instruction, and the computer program or the computer executable instruction is stored in a computer-readable storage medium. The processor of the computer device reads the computer executable instruction from the computer-readable storage medium, and the processor executes the computer executable instruction, so that the computer device executes the resource access control method described in the embodiment of the present application.

[0206] The embodiment of the present application provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, the processor will execute the resource access control method provided by the embodiment of the present application, for example, Figure 3 , Figure 4 , Figure 5 , Fig. 6A , Figure 6B , Figure 6C , Fig.6D , Fig. 6E ,or Fig. 6F The resource access control method shown.

[0207] In some embodiments, the computer-readable storage medium may be a ferroelectric random access memory (FRAM), ROM, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory, magnetic surface memory, optical disk, or compact disc read-only memory (CD-ROM) and other memories; it may also be various devices including one or any combination of the above memories.

[0208] In some embodiments, executable instructions may be in the form of a program, software, software module, script or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a stand-alone program or as a module, component, subroutine or other unit suitable for use in a computing environment.

[0209] As an example, the executable instructions may be deployed to be executed on one electronic device, or on multiple electronic devices located at one site, or on multiple electronic devices distributed at multiple sites and interconnected by a communication network.

[0210] In summary, the embodiments of the present application have the following beneficial effects:

[0211] (1) Obtain the expression that matches the target object from the permission language library and obtain metadata information, and build a resource context based on the metadata information. There is no need to traverse all the data, only some key authorization metadata information is needed, which reduces the access to data rows and improves performance.

[0212] (2) The expressions are uniformly converted into common expressions, and the method represented by abstract data structures can be easily converted into query statements that can directly access the resource library, thereby improving the portability of the method.

[0213] (3) The resource access request method provided in the embodiment of the present application does not directly participate in the filtering of permissions, thereby avoiding a large amount of filtering calculations and effectively improving the efficiency of resource access.

[0214] The above is only an embodiment of the present application and is not intended to limit the protection scope of the present application. Any modifications, equivalent substitutions and improvements made within the spirit and scope of the present application are included in the protection scope of the present application.

Claims

1. A resource access control method, characterized in that: The method comprises: Upon receiving a resource access request initiated by a target object, obtaining a target expression matching the target object from a permission language library; Acquire metadata information associated with the target object, and generate a query statement based on the metadata information and the target expression; The resource library is accessed based on the query statement to obtain target resource information for responding to the resource access request.

2. The method according to claim 1, characterized in that The generating a query statement based on the metadata information and the target expression includes: Building a resource context based on the metadata information; Convert the target expression based on the resource context to obtain an abstract data structure; The abstract data structure is converted based on the resource context to obtain the query statement.

3. The method according to claim 1, characterized in that Before the responding to the resource access request initiated by the target object, the method further includes: Determining usage rules of the permission language library; An expression configured based on the usage rule is received, and the expression is stored in a permission language library, wherein the expressions in the permission language library include common expressions and permission expressions that need to be escaped.

4. The method according to claim 2 or 3, characterized in that: The target expression includes a permission expression that needs to be escaped; Before converting the target expression based on the resource context, the method further includes: The target expression is converted into a common expression based on the resource context.

5. The method according to claim 4, characterized in that The converting the target expression into a common expression based on the resource context includes: Decomposing the target expression into a plurality of first elements; Determine, based on the resource context, a second element corresponding to each of the first elements; The plurality of second elements are combined based on the grammatical rule of the general expression to obtain the general expression.

6. The method according to claim 2, characterized in that The constructing a resource context based on the metadata information includes: Creating a data structure matching the metadata information; The metadata information is stored in the data structure to obtain the resource context.

7. The method according to claim 2, characterized in that The target expression is converted based on the resource context to obtain an abstract data structure, including: Decomposing the target expression into a plurality of third elements; Determine, based on the resource context, a sub-abstract data structure corresponding to each of the third elements; The abstract data structure is constructed based on the association relationship between multiple sub-abstract data structures.

8. The method according to claim 2, characterized in that: The converting the abstract data structure based on the resource context to obtain the query statement includes: Extracting the abstract data structure based on the resource context to obtain key information; Determine a query language type based on the key information, and generate a query statement template corresponding to the query language type; Fill the key information into the query statement template to obtain the query statement.

9. The method according to claim 1, characterized in that: The acquiring a target expression matching the target object from the permission language library includes: Parsing the resource access request to obtain permission information of the target object; Based on the permission information of the target object, a target expression matching the permission information of the target object is acquired from the permission language library.

10. A resource access control device, characterized in that: The device comprises: An acquisition module, configured to acquire a target expression matching the target object from a permission language library upon receiving a resource access request initiated by the target object; A generation module, used to obtain metadata information associated with the target object, and generate a query statement based on the metadata information and the target expression; The access module is used to access the resource library based on the query statement to obtain target resource information for responding to the resource access request.

11. An electronic device, characterized in that: include: A memory for storing executable instructions; A processor is used to implement the resource access control method described in any one of claims 1 to 9 when executing the executable instructions stored in the memory.

12. A computer-readable storage medium storing computer-executable instructions, characterized in that: When the computer executable instructions are executed by a processor, the resource access control method described in any one of claims 1 to 9 is implemented.

13. A computer program product comprising a computer program or computer executable instructions, characterized in that: When the computer program or computer executable instruction is executed by a processor, the resource access control method described in any one of claims 1 to 9 is implemented.

Images