A cloud computing platform data security access method and system

Abstract

The present invention relates to the field of secure communication technology, and in particular to a method and system for secure access to data on a cloud computing platform, comprising: obtaining a role group to be split and a candidate split role group, and obtaining a split group and a candidate group based on a split factor, the split efficiency of the role group to be split, and the split versatility of the candidate split role group. The roles associated with the newly added user group are obtained based on the split group. When a new user group appears again in the future, the split factor is updated based on the consistency between the candidate split role group and the candidate group; the roles associated with the newly added user group are obtained again based on the updated split factor; when the difference between the split efficiency and the split versatility is less than a first preset threshold, the roles in the candidate group are split and recombined. The present invention reasonably refines the roles and updates the association between user groups and roles, which helps to efficiently manage the roles during secure data access.

Description

Technical Field

[0001] The present invention relates to the field of secure communication technology, and in particular to a method and system for securely accessing data on a cloud computing platform. Background Art

[0002] Cloud computing platforms, such as AWS, Azure, and Google Cloud, provide a rich set of data computing resources. Role-based access control (RBAC) is a permission management method that is widely used in these platforms to manage user access rights to various resources such as virtual machines, storage, databases, network configurations, etc., to ensure security during data access. The core principle of role-based access control (RBAC) is to associate permissions with roles rather than directly with users. In the RBAC model, a role is a collection of permissions, and users obtain corresponding permissions by being assigned to one or more roles. However, in many cases, as the cloud computing platform runs or the system functions are continuously updated, after different users join the cloud computing platform, the defined roles may be too broad or too detailed, and it is impossible to efficiently and accurately assign or associate appropriate roles to users, or it is impossible to effectively divide permissions into appropriate roles, which may lead to too many roles on the cloud computing platform, resulting in management difficulties. Summary of the invention

[0003] In order to solve the above problems, the present invention provides a method and system for secure access to data on a cloud computing platform.

[0004] A cloud computing platform data security access method and system of the present invention adopts the following technical solutions:

[0005] An embodiment of the present invention provides a method for securely accessing data on a cloud computing platform, the method comprising the following steps:

[0006] All permissions required by the newly added user group are recorded as permissions to be added. Each existing user group is associated with multiple roles, and each role is a collection of several permissions. The role group to be split is obtained, and all roles in the role group to be split include the permissions to be added, and each role in the role group to be split has an intersection with the permissions to be added. The permissions in the role group to be split excluding the permissions to be added are recorded as a set S, and all roles including S are recorded as candidate split role groups corresponding to the role group to be split. The splitting efficiency is obtained according to the number of user groups associated with all roles in the role group to be split, and the splitting versatility is obtained according to the number of user groups associated with all roles in the candidate split role group.

[0007] Obtaining the roles associated with the newly added user group according to the initialized splitting factor, including: using the splitting factor to weight the sum of splitting efficiency and splitting versatility to obtain the splitting priority of the role group to be split, taking the role group to be split with the largest splitting priority as the splitting group, recording the candidate splitting role group corresponding to the splitting group as the candidate group, splitting and recombining all roles in the splitting group to obtain the roles associated with the newly added user group;

[0008] H1: When a new user group appears again, the role group to be split and the candidate split role group are obtained again, and the split efficiency corresponding to the role group to be split and the split versatility corresponding to the candidate split role group are obtained again; according to the consistency between the candidate split role group obtained again and the candidate group, the split factor is updated; according to the updated split factor, the role associated with the new user group is obtained; the updated split factor is positively correlated with the consistency;

[0009] Repeat H1. When the difference between the splitting efficiency and the splitting versatility is less than a first preset threshold, stop repeating H1 and split and recombine the roles in the candidate group.

[0010] Preferably, the step of obtaining the splitting efficiency according to the number of user groups associated with all roles in the role group to be split includes the following specific steps:

[0011] For each user in the user group associated with all roles in the role group to be split, obtain the frequency of each user accessing the data, obtain the number N2 of all users whose frequency is greater than the preset frequency threshold, and record exp(-N2 / N0) as the splitting efficiency; where N0 represents the number of existing users, and exp() represents an exponential function with a natural constant as the base.

[0012] Preferably, the step of obtaining the split versatility according to the number of user groups associated with all roles in the candidate split role group includes the following specific steps:

[0013] For all user groups associated with all roles in the candidate split role group, obtain the number of users N3 included in all user groups, and record exp(-N3 / N0) as the split versatility, where N0 represents the number of existing users, and exp() represents an exponential function with a natural constant as the base.

[0014] Preferably, the method of using the splitting factor to perform a weighted summation of the splitting efficiency and the splitting versatility to obtain the splitting priority of the role group to be split includes the following specific steps:

[0015] Let (1-w)×H1+w×H2 be the splitting priority of the role group to be split, where H1 represents the splitting efficiency, H2 represents the splitting versatility, and w represents the splitting factor.

[0016] Preferably, the step of splitting and recombining all roles in the split group to obtain the role associated with the newly added user group includes the following specific steps:

[0017] Record each role in the split group as the first old role, obtain the intersection of the permissions contained in the first old role and the permissions to be added, and use all permissions in the intersection as a new role, recorded as A1. All permissions in the first old role except the permissions to be added are also used as a new role, recorded as A2;

[0018] For all user groups associated with each first old role, delete the first old role associated with the user group, and then associate A1 and A2 with the user group; associate the new role A1 corresponding to all the first old roles in the split group with the newly added user group.

[0019] Preferably, the specific steps for obtaining the consistency are as follows:

[0020] When a new user group appears again, obtain the candidate groups corresponding to all the previous new user groups, obtain the intersection and union ratios of all roles in the newly obtained candidate split role group and all roles in each candidate group, and the average of the intersection and union ratios of all roles in the newly obtained candidate split role group and all roles in all candidate groups is recorded as consistency.

[0021] Preferably, the updating of the splitting factor comprises the following specific steps:

[0022] The split factor is denoted as F1, and the updated split factor is denoted as F2, F2=F1×(1-t0)+F1×q, where q represents consistency and t0 is a preset parameter.

[0023] Preferably, the splitting and recombining of roles in the candidate group includes the following specific steps:

[0024] Each role in the candidate group is recorded as the second oldest role; for the set S corresponding to the candidate group, the intersection of the permissions contained in the second oldest role and S is recorded as the new role B1, and the permissions contained in the second oldest role, excluding S, are recorded as the new role B2;

[0025] For each user group associated with the second oldest role, the second oldest role associated with the user group is deleted, and B1 and B2 are associated with the user group.

[0026] Preferably, when the set S is an empty set, all existing roles whose permissions are equal to the permissions to be added are used as roles associated with the newly added user group.

[0027] In another embodiment of the present invention, a cloud computing platform data security access system is provided, the system includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the above-mentioned cloud computing platform data security access method when executing the computer program.

[0028] The beneficial effects of the technical solution of the present invention are:

[0029] The present invention uses the splitting factor to weight the splitting efficiency and the splitting versatility to obtain the splitting priority of the role group to be split, takes the role group to be split with the largest splitting priority as the splitting group, records the candidate splitting role group corresponding to the splitting group as the candidate group, and re-splits and re-combines all the roles in the splitting group to obtain the roles associated with the newly added user group. When a new user group appears, it can be associated with a suitable role while ensuring the efficiency of users' access to data points.

[0030] Furthermore, when a new user group appears again, the role group to be split and the candidate split role group are obtained again, and the split efficiency corresponding to the role group to be split and the split versatility corresponding to the candidate split role group are obtained again; the split factor is updated according to the consistency between the candidate split role group obtained again and the candidate group; the role associated with the new user group is obtained according to the updated split factor. This process associates the new user group with the appropriate role without significantly affecting the data access efficiency by splitting and recombining the roles in the split group. At the same time, when obtaining the role associated with the current new user group, the following situation is also combined: whether the permissions that were split out when the new user group was added in the past but were not associated with the new user group can be reasonably reused by the currently obtained candidate group.

[0031] Furthermore, the above process is repeated. When the difference between the splitting efficiency and the splitting versatility is less than the first preset threshold, the repeated execution of H1 is stopped, and the roles in the candidate group are split and recombined. In this process, when the difference between the splitting efficiency and the splitting versatility is less than the first preset threshold, on the one hand, it indicates that the roles in the candidate group obtained previously can be reused after splitting and combining. On the other hand, it also indicates that when the roles in the split group are split and recombined to obtain the roles associated with the newly added user group, the impact on the user's access to data process can no longer be significantly reduced (that is, the user's efficient access to data cannot be maintained). At this time, the roles in the candidate group are split and recombined so that the roles are reasonably subdivided, which is conducive to the reuse of roles and avoids the difficulty of managing redundant roles.

[0032] In summary, the present invention realizes the splitting and recombining of roles in the split group and the candidate group, and reasonably refines the roles. It can also be said that it is an overall update of the existing roles and the association between user groups and roles, which is conducive to the efficient management of roles. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0034] Figure 1 A flowchart of a method for securely accessing data on a cloud computing platform provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0035] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of a cloud computing platform data security access method and system proposed by the present invention, its specific implementation method, structure, features and effects, in combination with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0036] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0037] The specific scheme of a cloud computing platform data security access method and system provided by the present invention is described in detail below with reference to the accompanying drawings.

[0038] See also Figure 1 , which shows a flowchart of a method for securely accessing data on a cloud computing platform provided by an embodiment of the present invention, the method comprising the following steps:

[0039] Step S001, all permissions required by the newly added user group are recorded as permissions to be added, each existing user group is associated with multiple roles, each role is a collection of several permissions; obtain the role group to be split, all roles in the role group to be split include the permissions to be added, and each role in the role group to be split has an intersection with the permissions to be added.

[0040] During the operation of the cloud computing platform, for a newly added user group, which contains one or more users, all permissions required by the newly added user group are recorded as permissions to be added. For user groups that already exist in the cloud computing platform (i.e., existing user groups), each of which is associated with multiple roles, and each role is associated with multiple permissions (i.e., each role is a collection of several permissions). All users in the user group can securely access the data of the cloud computing platform, such as data stored in a database, or data output by a computer program running in a virtual machine, based on these associated permissions.

[0041] In order to allow the newly added user group to access the data of the cloud computing platform, it is necessary to associate the permissions to be added with one or more roles. One method is to associate all permissions to be added with one role. This method is simple and fast, but it may cause the role to be unable to be reused for other user groups in the future, and eventually lead to more and more roles in the cloud computing platform, which is difficult to manage. This method is not advisable. Another method is to associate the permissions to be added with multiple existing roles, but the existing roles may not include all the permissions to be added, resulting in missing permissions to be added or over-authorization, so this method is also not advisable.

[0042] The method provided in this embodiment is: obtain some existing roles, which meet the following two aspects: on the one hand, the permissions associated with or included in each of these roles have an intersection with the permissions to be added; on the other hand, for the set of all permissions included in these roles, the set completely includes the permissions to be added. Some roles that meet the above two aspects are recorded as role groups to be split. Since some roles that meet the above two conditions have multiple combination methods, multiple role groups to be split can be obtained.

[0043] The roles in each role group to be split can be subsequently split and recombined to obtain the roles associated with the newly added user group.

[0044] Step S002: The permissions in the role group to be split excluding the permissions to be added are recorded as a set S, and all roles including S are recorded as candidate split role groups corresponding to the role group to be split.

[0045] The above-mentioned role group to be split contains the permissions to be added, so the roles in the role group to be split can be subsequently split and recombined to obtain the roles associated with the newly added user group; however, if a new user group appears again in the future, it may still be impossible to use the existing roles to associate the corresponding roles, because the existing role division method is unreasonable, the role division is not detailed enough, and each role cannot be associated or reused in multiple user groups. The roles in the candidate split role group obtained in this step include S, so that after the roles in the role group to be split are split and recombined, the remaining part of the permissions (that is, S) can be reused or associated with other roles, so that the existing roles can be reasonably refined, ensuring that when a new user group appears again in the future, it has the opportunity to be timely, efficiently and reasonably associated with the appropriate role.

[0046] In summary, this embodiment can subsequently split and regroup the roles in the role group to be split and the candidate split role group, so as to re-divide the existing roles and redetermine the association relationship between user groups and roles, thereby improving the role association efficiency when adding new user groups.

[0047] Step S003: obtaining splitting efficiency according to the number of user groups associated with all roles in the role group to be split, and obtaining splitting versatility according to the number of user groups associated with all roles in the candidate splitting role group.

[0048] The roles in the role group to be split obtained above need to be split and reassembled later. For all users in the existing user group, this will cause the roles associated with some of the users to be updated or replaced. This process will reduce the efficiency of these users' access to data (for example, some users cannot access some data on the cloud platform for a short period of time). Split efficiency describes the impact on user access to data when the roles in the role group to be split are subsequently split and reassembled. The greater the impact, the lower the efficiency of data access.

[0049] As an optional example, the method for obtaining the splitting efficiency is:

[0050] For all roles in the role group to be split, obtain the user groups associated with these roles, obtain the number of users N1 included in these user groups, record the existing number of users as N0, and record exp(-N1 / N0) as the splitting efficiency; exp() represents an exponential function with a natural constant as the base.

[0051] The larger the N1 / N0 is, the more users are associated with the role group to be split. When the roles in the role group to be split are split and recombined, the greater the impact is, and the lower the splitting efficiency is; the smaller the N1 / N0 is, the fewer users are associated with the role group to be split. When the roles in the role group to be split are split and recombined, the smaller the impact is, and the higher the splitting efficiency is.

[0052] As a preferred example, the method for obtaining the splitting efficiency is:

[0053] For each user in the user group associated with all roles in the role group to be split; in the recent period of time (for example, in the last day), obtain the frequency of each user's access to data (that is, the number of data accesses per user per unit time), obtain all users whose frequency is greater than the preset frequency threshold T0, and record these users as N2, and record exp(-N2 / N0) as the splitting efficiency. In this example, the more users access data with a higher frequency, the greater the impact when splitting and recombining the roles in the role group to be split, the lower the splitting efficiency, and the lower the efficiency of user access to data.

[0054] This embodiment is described by taking T0=200 as an example. In other embodiments, T0 may be set to other values, which are not specifically limited in this embodiment.

[0055] It should be further explained that the purpose of subsequently splitting and recombining the roles in the role group to be split is to further obtain the roles of the new user group by splitting and recombining the roles in the role group to be split when the roles of the new user group cannot be obtained by associating the existing roles. However, there will be a part of permissions (i.e., the set S in step S002), which are split out but not associated with the new user group. And further considering that when a new user group appears again in the future, the new user group can be associated with the roles associated with the permissions in the set S, which can further improve the utilization rate of the roles by the new user group, so that the roles can be reasonably divided and used; the roles in the candidate split role group obtained by the set S can be reasonably updated after being split and recombined, so as to ensure that when a new user group appears again in the future, it can be timely, efficiently and reasonably associated with the appropriate role, thereby improving the utilization rate of the roles by the new user group and the existing user group. Split versatility describes: after the roles in the candidate split role group are split and recombined, the existing user group reuses the recombined roles.

[0056] As an example, the method of obtaining split versatility includes:

[0057] For all roles in the candidate split role group, obtain the user groups associated with these roles, obtain the number of users N3 included in these user groups, and record exp(-N3 / N0) as the split versatility.

[0058] The greater the split versatility, it means that after the roles in the split role group are split and recombined, for the permissions that are split out but not associated with the newly added user groups, the roles composed of this part of permissions can be associated and reused by more user groups (for example, associated or reused by existing user groups, and for example, associated or reused by subsequently added user groups).

[0059] At this point, each role group to be split corresponds to a splitting efficiency, and each role group to be split corresponds to a candidate splitting role group, and the candidate splitting role group corresponds to a splitting versatility.

[0060] Step S004: Use the splitting factor to weight the splitting efficiency and the splitting versatility to obtain the splitting priority of the role group to be split, take the role group to be split with the largest splitting priority as the splitting group, record the candidate splitting role group corresponding to the splitting group as the candidate group, split and recombine all the roles in the splitting group to obtain the roles associated with the newly added user group.

[0061] H = (1-w) × H1 + w × H2 is recorded as the splitting priority of the role group to be split, where H1 represents the splitting efficiency of the role group to be split, and H2 represents the splitting versatility of the candidate splitting role group corresponding to the role group to be split;

[0062] The above formula uses the split factor to weight the split efficiency and split versatility to obtain the split priority of the role group to be split. The larger the H1, the less impact it has on the process of user access to data when the roles in the role group to be split are split and recombined, avoiding affecting the efficiency of user access to data. When H2 is larger, it means that after the roles in the role group to be split are split and recombined, the permissions (that is, set S) not associated with the newly added user group can be reused when new users appear again in the future (or reused by the existing user group in the future). At this time, the larger H is, the more worthy the role group to be split is to be split and recombined.

[0063] Wherein, w is recorded as a splitting factor. In this embodiment, the initial value of w is 0.1. In other embodiments, the initial value of w can be set to other values. In order to avoid setting the initial value too large, other embodiments preferably take a value in the interval of (0, 0.4); the reason why the initial value of w is set to be smaller is that for the current newly added user group, when the roles in the role group to be split are split and recombined, the user access data process is avoided from being significantly affected, and the role reuse problem when new users appear again in the future is not concerned. The reason is that the current newly added user group is the first newly added user group, and the role association or allocation method of other subsequent newly added user groups has not yet been known. For the roles obtained after splitting and recombining the roles in the candidate split role group, it is impossible to ensure whether these roles can be reasonably associated and reused by the subsequent newly added user group and the existing user group.

[0064] For the multiple role groups to be split obtained in step S001, the role group to be split with the highest splitting priority is obtained as the splitting group, and the candidate splitting role group corresponding to the splitting group is recorded as the candidate group.

[0065] All roles in the split group are split and recombined to obtain the roles associated with the newly added user group.

[0066] As an example, all roles in the split group are split and reassembled to obtain roles associated with the newly added user group, including the following steps:

[0067] Each role in the split group is recorded as the first old role. Each first old role contains or is associated with multiple permissions. The intersection of the permissions contained in the first old role and the permissions to be added is obtained. All permissions in the intersection are taken as a new role, recorded as A1. All permissions in the first old role except the permissions to be added are also taken as a new role, recorded as A2. This process realizes the splitting of all roles in the split group.

[0068] Each first old role in the above split group is split into two parts, A1 and A2. Further, all user groups associated with each first old role are obtained, the first old roles associated with these user groups are deleted, and then A1 and A2 are associated with the user group. This process splits all the roles in the split group and then recombines them, so that the association relationship between these user groups and the roles is updated.

[0069] Furthermore, all new roles A1 corresponding to the first old roles in the split group are associated with the newly added user group.

[0070] Step S005: when a new user group appears again, the split factor is updated according to the consistency between the candidate split role group obtained again and the candidate group; and the role associated with the new user group is obtained according to the updated split factor.

[0071] With the operation of the cloud computing platform or the update of the functional system, when a new user group appears again, all the permissions required by the new user group are obtained, and they are still recorded as permissions to be added. According to the methods of steps S001 and S002, each role group to be split and the candidate split role group corresponding to each role group to be split are obtained again, and according to the method in step S003, the splitting efficiency of each role group to be split and the splitting versatility of the candidate split role group are obtained.

[0072] Get all candidate groups obtained when adding a new user group, and get the consistency between the currently obtained candidate split role group and all candidate groups.

[0073] The roles in all candidate groups contain some permissions. When adding user groups multiple times in succession, these permissions are split out in order to assign roles to the newly added user groups, but are not associated with the newly added user groups. The greater the consistency, the more similar the roles associated with these permissions are to the roles in the currently obtained candidate split role group. At this time, after the currently obtained candidate split role group is split and recombined, the permissions that were split out when adding user groups in the past but were not associated with the newly added user groups can be reasonably reused. The smaller the consistency, the less likely it is that the permissions that were split out when adding user groups in the past but were not associated with the newly added user groups can be reasonably reused.

[0074] As an example, the method for obtaining the consistency includes:

[0075] For all previous newly added user groups, each newly added user group corresponds to a candidate group, and each candidate group includes multiple roles. For the candidate split role group obtained when the newly added user group appears again, the candidate split role group also includes multiple roles. The intersection-union ratio of all roles in the candidate split role group and all roles in each candidate group is obtained (that is, the ratio of the number of elements in the intersection to the number of elements in the union), and the average of the intersection ratios of the roles in the candidate split role group and the roles in all candidate groups is recorded as consistency.

[0076] Furthermore, the split factor is updated using consistency. The role group to be split is split according to the updated split factor to obtain the role of the newly added user group. The specific process is: the split efficiency and split versatility obtained in this step are weighted and summed using the updated split factor to obtain the split priority of the role group to be split again, the role group to be split with the largest split priority is taken as the split group, and the candidate split role group corresponding to the split group is recorded as the candidate group, and all roles in the split group are split and recombined to obtain the role corresponding to the current newly added user group (the specific process is the same as step S004).

[0077] In this process, the split factor is updated through consistency and the split priority is obtained again. When the roles are assigned to the newly added user group before, for the permissions that are split but not associated with the newly added user group, if the roles associated with these permissions are the same or similar to the candidate split role group obtained when the current user is added (that is, the consistency is large), the updated split factor becomes larger at this time, then the currently obtained split priority and split group pay more attention to the role reuse than the previously obtained split priority and split group, so that when the corresponding role is associated with the current newly added user group, more attention is paid to the reuse of the roles of the candidate split role group for these permissions split when the user group was previously added; if the roles associated with these permissions are completely different or dissimilar to the candidate split role group obtained when the current user is added (that is, the consistency is small), the updated split factor becomes smaller at this time, then the currently obtained split priority and split group no longer pay too much attention to the role reuse compared to the previously obtained split priority and split group, but ensure user access efficiency while associating the current newly added user group with the appropriate role.

[0078] In summary, this embodiment associates the newly added user group with the appropriate role without significantly affecting the data access efficiency by splitting and recombining the roles within the split group. At the same time, when obtaining the role associated with the current newly added user group, the following situations are also taken into account: whether the permissions that were split out when the new user group was previously added but were not associated with the new user group can be reasonably reused by the currently obtained candidate group. The larger the updated split factor becomes, the larger H2 is, which means that the currently obtained candidate group can reuse these permissions more. At this time, by splitting and recombining the roles in the candidate group, a reasonable subdivision of the roles can be achieved, and then when a new user group appears again in the future, it can be directly associated and reused with the appropriate role, and the existing user group can be reused with the appropriate role, thereby updating the association relationship between the role and the user group. The smaller the updated split factor becomes, the smaller H2 is, indicating that the currently obtained candidate group is less likely to reuse these permissions. At this time, by splitting and recombining the roles in the candidate group, it is not possible to achieve a reasonable subdivision of the roles, but rather to generate more useless roles (that is, roles that cannot be reused by subsequent new users and existing users), making the roles redundant and difficult to manage. The method of splitting and recombining the roles in the candidate group will be described later.

[0079] As an example, the method to update the split factor using consistency includes:

[0080] The split factor is recorded as F1, and the updated split factor is recorded as F2, F2=F1×(1-t0)+F1×q, where q represents consistency and t0 is a preset parameter. When q is less than t0, F2 becomes smaller than F1; when q is greater than t0, F2 becomes larger than F1. This embodiment is described by taking t0=0.2 as an example. Other embodiments may be set to other values, which are not described in detail in this embodiment. In addition, when F2 is less than 0.1, F2 is set equal to 0.1, the purpose of which is to avoid the value of F2 being too small.

[0081] It should be noted that when a new user group appears again, if all the permissions required by the new user group (that is, the permissions to be added) can be reused by existing roles (that is, the set S obtained by step S002 is an empty set, indicating that there are existing roles, and all the permissions included in these roles are equal to the permissions to be added), then these existing roles with all permissions equal to the permissions to be added are used as roles associated with the new user group, and the method in steps S001 to S005 is no longer executed, that is, the split group and candidate group are no longer obtained. It should be further noted that there may be multiple methods for obtaining existing roles with all permissions equal to the permissions to be added, and this embodiment only randomly selects one.

[0082] Step S006: When the difference between the splitting efficiency and the splitting versatility is less than a first preset threshold, the roles in the candidate group are split and recombined.

[0083] In the above steps S001 to S004, for a newly added user group, the splitting efficiency of the role group to be split and the set S are first obtained, and the candidate splitting role group corresponding to the role group to be split and its splitting versatility are obtained based on the set S. Based on this and through the initialized splitting factor, the splitting group with the highest splitting priority and the candidate group corresponding to the splitting group are obtained from the role group to be split, and the roles associated with the newly added user group are obtained by splitting and combining the roles in the splitting group.

[0084] In the above step S005, for the newly added user group that appears again, the splitting efficiency of the role group to be split and the set S are still obtained. Based on the set S, the candidate split role group corresponding to the role group to be split and its split versatility are obtained. Further, the splitting factor is updated by utilizing the consistency between the candidate group when new users were added in the past and the candidate split role group obtained in step S005. Through the updated splitting factor, the split group with the highest splitting priority and the candidate group corresponding to the split group are obtained from the role group to be split. The roles associated with the newly added user group that appears again are obtained by splitting and combining the roles in the split group.

[0085] When a new user group appears again in this step, the method in step S005 is repeated: the splitting efficiency of the role group to be split and the set S are obtained, and based on the set S, the candidate split role group corresponding to the role group to be split and its split versatility are obtained. Furthermore, the splitting factor is updated using the consistency between the candidate group when new users were added in the past and the candidate split role group obtained in step S005. Through the updated splitting factor, the split group with the highest splitting priority and the candidate group corresponding to the split group are obtained from the role group to be split. The roles associated with the new user group added in this step are obtained by splitting and combining the roles in the split group.

[0086] By continuously executing the method in step S005, the split factor is continuously updated. When the consistency obtained in the process is small, it means that when the roles associated with the newly added user group are obtained by splitting and recombining the roles in the split group, the permissions that are split out but not associated with the newly added user group cannot be effectively reused (for example, reused by the subsequent newly added user group and the existing user group). At this time, by updating the split factor to be smaller, the user access to data will not be seriously affected when the roles associated with the newly added user group are obtained, thereby ensuring data access efficiency; when the consistency obtained is large, it means that when the roles associated with the newly added user group are obtained by splitting and recombining the roles in the split group, the permissions that are split out but not associated with the newly added user group can be reused. By updating the split factor to be larger, after the roles in the candidate group are subsequently split and recombined, all roles can be reasonably subdivided and used, thereby avoiding the situation where role redundancy is difficult to manage.

[0087] After each execution of S005, the obtained splitting efficiency and splitting versatility are obtained. When the difference between the splitting efficiency and the splitting versatility is less than the first preset threshold value th1, the repeated execution of S005 is stopped. The larger the difference between the splitting efficiency and the splitting versatility, the smaller the impact on the process of user access to data (that is, the data access efficiency is high) when the roles in the splitting group are split and recombined to obtain the roles associated with the new user group as new users appear one after another, and if the roles in the candidate group are also split and recombined, the obtained roles cannot be widely reused; when the smaller the difference between the splitting efficiency and the splitting versatility, the smaller the impact on the process of user access to data (that is, the data access efficiency is low) when the roles in the splitting group are split and recombined to obtain the roles associated with the new user group as new users appear, and if the roles in the candidate group are also split and recombined, the obtained roles can be widely reused.

[0088] When the difference between the split efficiency and the split versatility is less than the first preset threshold, it means that when the roles in the split group are split and re-divided to obtain the roles associated with the newly added user group, the data access efficiency is significantly reduced, and the permissions that were previously split but not associated with the newly added user group can also be reused. At this time, if the roles in the candidate group are not split and re-divided, the existing roles will be unreasonable and difficult to manage, resulting in the inability to directly associate with the appropriate roles when new users are added later. Even if the roles in the split group are split and re-divided to obtain the roles associated with the subsequent newly added user group, the data access efficiency cannot be guaranteed (that is, it will significantly affect the data access process). Therefore, when the difference between the split efficiency and the split versatility is less than the first preset threshold th1, the roles in the candidate group need to be split and re-divided.

[0089] The method for obtaining th1 in this embodiment is:

[0090] When the role associated with the first newly added user is obtained, the difference between the splitting efficiency and the splitting versatility at this time is obtained, recorded as d1, and 0.5×d1 is taken as th1.

[0091] In other embodiments, th1 may be set to other values, which are not specifically limited in this embodiment.

[0092] As an example, the roles in the candidate group are split and combined, including the following methods:

[0093] When the difference between the splitting efficiency and the splitting versatility is less than a first preset threshold, the existing roles at that time and the obtained candidate groups are obtained, and the set S corresponding to the candidate groups is obtained.

[0094] Each role in the candidate group is recorded as the second oldest role, the intersection of the permissions included in the second oldest role and S is recorded as the new role B1, and the permissions included in the second oldest role, excluding S, are recorded as the new role B2.

[0095] Each user group associated with the second oldest role is obtained, the second oldest role associated with the user group is deleted, and B1 and B2 split from the second oldest role are associated with the user group.

[0096] As another example, the roles in the candidate group are split and combined, including the following methods:

[0097] For each role in the candidate group, obtain the intersection and union ratio of the permissions contained in each role and S. If the intersection and union ratio is greater than th2, then the role is recorded as the second oldest role, and then each second oldest role in the candidate group is split using the method of the above example, and then recombined and associated to all user groups. This embodiment is described by taking th2=0.2 as an example. In other embodiments, th2 can be set to other values, which are not specifically limited in this embodiment.

[0098] The purpose of this example is to avoid over-splitting the roles in the candidate group.

[0099] So far, it can be known from step S001 to step S006 that when a user is added for the first time or several times before (that is, when the split factor is relatively small), the roles associated with the newly added user are obtained by splitting and recombining the roles in the split group. This process focuses on the impact of splitting and recombining on the user access data process. When new users are added subsequently, if the split factor gradually increases (that is, the consistency remains at a large value, indicating that the roles in the candidate group obtained previously can be reused after splitting and combining), then focus on the roles in the candidate group, which can improve the versatility of the roles after splitting and recombining (that is, the subsequent newly added user group and the existing user group can be reused). If the split factor gradually decreases or always remains near a small value (that is, the roles in the candidate group obtained previously cannot be reused after splitting and combining), then continue to focus on the impact of splitting and recombining on the user access data process.

[0100] Until the difference between the splitting efficiency and the splitting versatility is less than the first preset threshold, on the one hand, it means that the roles in the candidate group obtained before can be reused after splitting and combining, and on the other hand, it also means that when the roles in the split group are split and recombined to obtain the roles associated with the newly added user group, the impact on the user's access to data process can no longer be significantly reduced (that is, the user's efficient access to data cannot be maintained). At this time, in step S006, the roles in the candidate group are split and recombined, so that the roles are reasonably subdivided, which is conducive to the reuse of roles and avoids the difficulty of managing redundant roles. The reuse means that the roles can be associated with multiple existing user groups at the same time, and on the other hand, when a new user appears again in the future, there are roles that can be directly reused or associated with the user.

[0101] In summary, step S001 to step S006 realizes the splitting and regrouping of roles in the split group and the candidate group, and reasonably refines the roles. It can also be said that an overall update is made to the existing roles, as well as the association between user groups and roles.

[0102] After step S006 is executed, the method from step S001 to step S006 is repeatedly executed to perform the next round of overall update of the existing roles, and so on. By updating the existing roles and the association between user groups and roles one after another, the division of roles is reasonable and easy to manage.

[0103] It should be noted that each time the method from step S001 to step S006 is re-executed, the splitting factor needs to be reset to the initial value when it is used for the first time to calculate the splitting priority. At the same time, the newly added user group refers to: the newly added user group involved each time the method from step S001 to step S006 is re-executed, and does not include the newly added user group involved when the method from step S001 to step S006 was re-executed last time.

[0104] In particular, if the candidate split role group is an empty set, then the corresponding split versatility is set to 0. If the obtained candidate group is an empty set, then the candidate group is screened out and no longer participates in the calculation, and no longer determines whether the difference between the split efficiency and the split versatility is less than the first preset threshold, but directly continues to execute the method in step S005.

[0105] In another embodiment of the present invention, a cloud computing platform data security access system is provided, the system comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the above steps S001 to S006 when executing the computer program.

[0106] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for secure access to data on a cloud computing platform, characterized in that: The method comprises the following steps: All permissions required by the newly added user group are recorded as permissions to be added. Each existing user group is associated with multiple roles, and each role is a collection of several permissions. The role group to be split is obtained, and all roles in the role group to be split include the permissions to be added, and each role in the role group to be split has an intersection with the permissions to be added. The permissions in the role group to be split excluding the permissions to be added are recorded as a set S, and all roles including S are recorded as candidate split role groups corresponding to the role group to be split. The splitting efficiency is obtained according to the number of user groups associated with all roles in the role group to be split, and the splitting versatility is obtained according to the number of user groups associated with all roles in the candidate split role group. Obtaining the roles associated with the newly added user group according to the initialized splitting factor, including: using the splitting factor to weight the sum of splitting efficiency and splitting versatility to obtain the splitting priority of the role group to be split, taking the role group to be split with the largest splitting priority as the splitting group, recording the candidate splitting role group corresponding to the splitting group as the candidate group, splitting and recombining all roles in the splitting group to obtain the roles associated with the newly added user group; H1: When a new user group appears again, the role group to be split and the candidate split role group are obtained again, and the split efficiency corresponding to the role group to be split and the split versatility corresponding to the candidate split role group are obtained again; according to the consistency between the candidate split role group obtained again and the candidate group, the split factor is updated; according to the updated split factor, the role associated with the new user group is obtained; the updated split factor is positively correlated with the consistency; Repeat H1. When the difference between the splitting efficiency and the splitting versatility is less than a first preset threshold, stop repeating H1 and split and reassemble the roles in the candidate group. The specific steps of obtaining the splitting efficiency according to the number of user groups associated with all roles in the role group to be split are as follows: For each user in the user group associated with all roles in the role group to be split, obtain the frequency of each user accessing the data, obtain the number N2 of all users whose frequency is greater than the preset frequency threshold, and record exp(-N2 / N0) as the splitting efficiency; where N0 represents the number of existing users, and exp() represents an exponential function with a natural constant as the base; The specific steps of obtaining the split versatility according to the number of user groups associated with all roles in the candidate split role group are as follows: For all user groups associated with all roles in the candidate split role group, obtain the number of users N3 included in all user groups, and record exp(-N3 / N0) as the split versatility, where N0 represents the number of existing users, and exp() represents an exponential function with a natural constant as the base.

2. A cloud computing platform data security access method according to claim 1, characterized in that: The method of using the splitting factor to weight the splitting efficiency and the splitting versatility to obtain the splitting priority of the role group to be split includes the following specific steps: Let (1-w)×H1+w×H2 be the splitting priority of the role group to be split, where H1 represents the splitting efficiency, H2 represents the splitting versatility, and w represents the splitting factor.

3. A cloud computing platform data security access method according to claim 1, characterized in that: The specific steps of splitting and recombining all roles in the split group to obtain the role associated with the newly added user group include the following: Record each role in the split group as the first old role, obtain the intersection of the permissions contained in the first old role and the permissions to be added, and use all permissions in the intersection as a new role, recorded as A1. All permissions in the first old role except the permissions to be added are also used as a new role, recorded as A2; For all user groups associated with each first old role, delete the first old role associated with the user group, and then associate A1 and A2 with the user group; associate the new role A1 corresponding to all the first old roles in the split group with the newly added user group.

4. A cloud computing platform data security access method according to claim 1, characterized in that: The specific steps for obtaining the consistency are as follows: When a new user group appears again, obtain the candidate groups corresponding to all the previous new user groups, obtain the intersection and union ratios of all roles in the newly obtained candidate split role group and all roles in each candidate group, and the average of the intersection and union ratios of all roles in the newly obtained candidate split role group and all roles in all candidate groups is recorded as consistency.

5. A cloud computing platform data security access method according to claim 1, characterized in that: The updating split factor includes the following specific steps: The split factor is denoted as F1, and the updated split factor is denoted as F2, F2=F1×(1-t0)+F1×q, where q represents consistency and t0 is a preset parameter.

6. A cloud computing platform data security access method according to claim 1, characterized in that: The specific steps of splitting and recombining the roles in the candidate group are as follows: Each role in the candidate group is recorded as the second oldest role; for the set S corresponding to the candidate group, the intersection of the permissions contained in the second oldest role and S is recorded as the new role B1, and the permissions contained in the second oldest role, excluding S, are recorded as the new role B2; For each user group associated with the second oldest role, the second oldest role associated with the user group is deleted, and B1 and B2 are associated with the user group.

7. A cloud computing platform data security access method according to claim 1, characterized in that: When the set S is an empty set, all existing roles whose permissions are equal to the permissions to be added are used as the roles associated with the newly added user group.

8. A cloud computing platform data security access system, the system comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method for securely accessing data on a cloud computing platform as claimed in any one of claims 1 to 7 are implemented.

Images