Semantic calculation method and device for authorization strategy, storage medium and program product

Abstract

The invention provides a semantic calculation method and device for an authorization policy, a storage medium and a program product, and the method comprises the steps: obtaining a first authorization policy and a second authorization policy; respectively converting the first authorization strategy and the second authorization strategy into a first intermediate presentation layer and a second intermediate presentation layer which conform to a preset grammar structure; the preset grammar structure and grammar structures to which the first authorization strategy and the second authorization strategy belong can be mutually converted; and performing semantic calculation on the first intermediate presentation layer and the second intermediate presentation layer to obtain semantic calculation results of the first authorization strategy and the second authorization strategy. According to the invention, semantic calculation can be performed on different authorization policies, so that conflict detection is performed on the authorization policies according to the semantic calculation result.

Description

Technical Field

[0001] The present application belongs to the field of information processing technology, and specifically relates to a semantic computing method, device, storage medium and program product of an authorization policy. Background Art

[0002] Resource Access Management (RAM) is a service used for user identity management and resource access control. This service allows you to create and manage user accounts (such as employees, systems, or applications), and control the operational permissions these user accounts have on system resources. Authorization policies are used to implement the authorization function of the access control service, which indicates whether a user or user group is allowed or prohibited from performing operations on a certain type of object in the system resource. For example, based on the access control service, multiple user accounts can be created and managed under one cloud account, and different authorization policies can be assigned to a single user or a group of users, so that different users have different cloud resource access permissions.

[0003] However, in actual applications, when authorizing users based on access control services, authorization may sometimes fail to take effect. For example, when authorizing a sub-account / role, if the sub-account / role already has a "deny" permission, and then granting it an "allow" permission, the "allow" permission will not take effect because the "deny" permission has a higher priority than the "allow" permission.

[0004] It should be noted that the above statements are only used to provide background technical information related to this application and do not necessarily constitute prior art. Summary of the Invention

[0005] The present application proposes a semantic calculation method, device, storage medium and program product for authorization policies, which can perform semantic calculations on different authorization policies, thereby detecting conflicts among the authorization policies based on the semantic calculation results.

[0006] The first embodiment of the present application proposes a semantic calculation method for authorization policy, including:

[0007] Obtain the first authorization policy and the second authorization policy;

[0008] Converting the first authorization policy and the second authorization policy into a first intermediate representation layer and a second intermediate representation layer respectively that conform to a preset grammatical structure; the preset grammatical structure and the grammatical structures to which the first authorization policy and the second authorization policy belong can be converted into each other;

[0009] Perform semantic calculation on the first intermediate representation layer and the second intermediate representation layer to obtain semantic calculation results of the first authorization policy and the second authorization policy.

[0010] In some embodiments of the present application, performing semantic calculation on the first intermediate representation layer and the second intermediate representation layer includes:

[0011] respectively determining each first element included in the first intermediate representation layer and position information of each first element, and each second element included in the second expression and position information of each second element;

[0012] performing semantic calculation on the first elements and the second elements at the same position in the first intermediate representation layer and the second intermediate representation layer according to the position information of each of the first elements and the position information of each of the second elements;

[0013] The semantic calculation results of the first authorization policy and the second authorization policy are obtained based on the calculation results of the semantic calculation of the first element and the second element at the same position.

[0014] In some embodiments of the present application, when the position information of the first element and the position information of the second element both indicate a data type, performing semantic calculation on the first element and the second element at the same position in the first intermediate representation layer and the second intermediate representation layer according to the position information of each first element and the position information of each second element includes:

[0015] Determine, according to the position information of each of the first elements and the position information of each of the second elements, a target first element and a target second element having the same data type;

[0016] Determine a first logical expression set including the target first element, and a second logical expression set including the target second element;

[0017] A set operation is performed on the first logical expression set and the second logical expression set to obtain a semantic calculation result of the data type dimension.

[0018] In some embodiments of the present application, when the data type includes a wildcard string type, performing a set operation on the first logical expression set and the second logical expression set includes:

[0019] Determine a state transition equation corresponding to the first logical expression set and the second logical expression set; the state transition equation is used to determine whether the first logical expression set and the second logical expression set have an intersection;

[0020] In a case where the state transition equation represents that the first logical expression set and the second logical expression set have an intersection, determining the intersection of the first logical expression set and the second logical expression set of a wildcard string type based on the state transition equation;

[0021] Based on the intersection of the first logical expression set and the second logical expression set, a union and a complement of the first logical expression set and the second logical expression set are determined.

[0022] In some embodiments of the present application, determining the intersection of the first set of logical expressions and the second set of logical expressions of wildcard string type based on the state transition equation includes:

[0023] Determining a dynamic programming matrix of the first set of logical expressions and the second set of logical expressions based on the state transition equation;

[0024] Based on the dynamic programming matrix, an intersection of the first logical expression set and the second logical expression set of the wildcard string type is determined.

[0025] In some embodiments of the present application, when the data type includes a Boolean variable type, performing a set operation on the first logical expression set and the second logical expression set includes:

[0026] The empty set and the full set are used to supplement the operation results of any two Boolean variable expressions to form a Boolean variable operation set; the Boolean variable operation set is used to record the operation rules of the Boolean variable expressions;

[0027] Based on the Boolean variable operation set, the intersection, union and complement of the first logical expression set and the corresponding second logical expression set are respectively determined.

[0028] In some embodiments of the present application, the semantic calculation results of the first authorization policy and the second authorization policy obtained by performing the semantic calculation based on the first element and the second element having the same position include:

[0029] Generate a semantic calculation result of the conditional dimension based on the semantic calculation results of the first element and the second element with the same conditional keyword;

[0030] Generate semantic calculation results of the first and second elements of the inclusion statement based on semantic calculation results of the first and second elements of the inclusion condition;

[0031] The semantic calculation results of the first authorization policy and the second authorization policy are generated based on the semantic calculation results of the first elements and the second elements of the inclusion statement.

[0032] In some embodiments of the present application, converting the first authorization policy into a first intermediate representation layer conforming to a preset grammatical structure includes:

[0033] Determining each first element of the first authorization policy and the expressions contained therein;

[0034] Based on the position information of each first element, logical connectives are added to the expressions corresponding to the first elements to obtain a first intermediate representation layer that conforms to a preset grammatical structure.

[0035] In some embodiments of the present application, before performing semantic calculations on the first intermediate representation layer and the second intermediate representation layer for each element dimension, the method further includes:

[0036] performing semantic calculations on different logical expressions containing the same element in the first intermediate representation layer, and determining duplicate information located by the intersection when the semantic calculation results have an intersection;

[0037] The repeated information in the first intermediate representation layer is deleted.

[0038] In some embodiments of the present application, after performing semantic calculation on the first elements and the second elements at the same position in the first intermediate representation layer and the second intermediate representation layer based on the position information of each first element and the position information of each second element, the method further includes:

[0039] If the semantic calculation result indicates that the first authorization policy and the second authorization policy have an intersection, determining target element information located by the intersection;

[0040] When the validity information of the target element information in the first authorization policy and the validity information in the second authorization policy are the same, determining that the target element information in the first authorization policy and the target element information in the second authorization policy are repeated;

[0041] When the validity information of the target element information in the first authorization policy is different from the validity information in the second authorization policy, it is determined that the target element information in the first authorization policy and the target element information in the second authorization policy are repeated as conflicting information.

[0042] The second embodiment of the present application provides a semantic computing device for authorization policy, the device comprising:

[0043] A policy acquisition module, configured to acquire a first authorization policy and a second authorization policy;

[0044] a language conversion module, configured to convert the first authorization policy and the second authorization policy into a first intermediate representation layer and a second intermediate representation layer, respectively, that conform to a preset grammatical structure; the preset grammatical structure being convertible between the grammatical structure to which the first authorization policy and the second authorization policy belong;

[0045] The semantic calculation module is used to perform semantic calculation on the first intermediate representation layer and the second intermediate representation layer to obtain semantic calculation results of the first authorization policy and the second authorization policy.

[0046] An embodiment of the third aspect of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in the first aspect.

[0047] An embodiment of the fourth aspect of the present application provides a computer-readable storage medium on which a computer program is stored, characterized in that the program is executed by a processor to implement the method described in the first aspect.

[0048] An embodiment of the fifth aspect of the present application provides a computer program product, including a computer program, which is executed by a processor to implement the method described in the first aspect.

[0049] The technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0050] In an embodiment of the present application, by converting the authorization policy into an intermediate representation layer that conforms to a preset grammatical structure, the calculation result after semantic calculation can be expressed in the grammatical format before the conversion of the authorization policy, which can achieve the closure of the authorization policy in semantic calculation, thereby realizing the semantic calculation between the two authorization policies. Then, when authorizing a user, the newly written authorization policy can be semantically calculated with the user's existing authorization policy, and based on the semantic calculation result, it can be determined whether the newly written authorization policy is the same as the user's existing authorization policy, or partially repeated, or conflicting with each other, etc., and then it can be determined whether the newly written authorization policy can take effect (when the newly written authorization policy conflicts with the existing authorization policy, the newly written authorization policy cannot take effect, or the existing authorization policy is invalid, etc.), and whether it is a redundant authorization, and the location of the conflicting information or repeated information can be specifically determined, and the customer can be prompted with the invalid information and the reason for the invalidity, to help the user perform authorization analysis.

[0051] Additional aspects and advantages of the present application will be given in part in the description below and in part will become apparent from the description below or learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present application. Throughout the accompanying drawings, the same reference numerals are used to denote the same components.

[0053] In the attached figure:

[0054] Figure 1 A schematic diagram illustrating a flow chart of a semantic calculation method for authorization policies provided in some embodiments of the present application is shown;

[0055] Figure 2 The specific flow diagram of step S3 in some embodiments of the present application is shown;

[0056] Figure 3 A schematic diagram showing a specific process of step S32 in some embodiments of the present application is shown;

[0057] Figure 4 A schematic diagram showing the structure of a semantic computing device for authorization policies provided in some embodiments of the present application is shown;

[0058] Figure 5 A schematic diagram showing the structure of the semantic computing module in some embodiments of the present application is shown;

[0059] Figure 6 A schematic diagram of an electronic device provided by an embodiment of the present application is shown;

[0060] Figure 7 A schematic diagram of a storage medium provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0061] The following describes exemplary embodiments of the present application in more detail with reference to the accompanying drawings. Although exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. Instead, these embodiments are provided to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0062] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should be the common meanings understood by technical personnel in the field to which this application belongs. The data involved in this application (including but not limited to data used for model training, stored data, displayed data, etc.) are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0063] First, some nouns or terms appearing in the embodiments of this application may be interpreted as follows:

[0064] Authorization Policy (hereinafter referred to as Policy) is a method for managing resource access permissions. It defines which operations are authorized for which resources and can be granted to specific users, user groups, or roles. An authorization policy describes the specific authorization content and can be attached to one or more principals (i.e., users, user groups, or roles) to enable them to perform specific operations.

[0065] An authorization policy can include one or more authorization statements. Each authorization statement contains basic elements such as effect, resource, action permissions granted to the resource, and condition. Authorization statements can also be considered elements of the authorization policy. Combining these elements according to a specific grammatical structure forms an authorization policy.

[0066] Among them, the authorization statement (Statement) can be understood as the statement that constitutes the authorization policy, which is used to indicate whether an operation that meets the authorization conditions is allowed (Allow). Among different Statements, if there is a Statement indicating that an operation that meets the authorization conditions is denied (Deny), then the entire policy indicates Deny. If no Statement indicates that an operation that meets the authorization conditions is Deny, but there are one or more Statements indicating that an operation that meets the authorization conditions is Allow, then the entire policy indicates Allow.

[0067] Effect can also be called authorization type, which includes two types, namely, Allow and Deny.

[0068] A resource is a specific object being authorized. For example, if an authorization statement is "Allow Zhang San to perform the Get operation on resource A," then A is the resource in the authorization policy. Resources can include networks, servers, storage, applications, and services, and can be cloud or physical resources. This embodiment does not specifically limit this.

[0069] Action permissions refer to operations on specific resources. For example, in the authorization statement above, "Allow Zhang San to perform the Get operation on resource A," the Get operation is the action permission of the authorization policy.

[0070] Conditions are the judgment conditions in the authorization policy. In a Statement, there can be multiple Conditions for the same variable; in the same Policy, different Conditions are in a logical AND relationship. Action, Resource, and Principal (identity information) in a Policy can all fall into the category of Conditions. For example, an authorization statement is "Allow Zhang San to perform the Get operation on resource A before X year XX month XXX day." Here, "Zhang San" is the subject (Principal), and it, "Resource A," and "Get operation" are all conditions of the authorization statement. "Before X year XX month XXX day" is a conditional restriction on the authorization statement and is also one of the conditions of the authorization statement.

[0071] In the authorization policy, the condition may include the condition operator (Operator), condition keyword (Key) and condition value (Value). Among them, the authorization policy operator (Operator is used to represent the logical judgment method in the Condition, and also defines the data type (also known as the variable type) in the Condition. For example, the condition operator is NumericLessThanEquals, which means that the logical judgment method is: less than or equal to the value in the expression is allowed or denied, and the variable type is defined as a number. The condition keyword (Key) can be understood as a character with a specific meaning specified in the access control service. The specific naming format of the condition keyword can be defined so that the condition keyword can be quickly identified. The condition value (Value) is used to represent the value of each element in the condition, which can include time, IP address, etc. The above data type is the data type of the condition value.

[0072] Expression: Indicates the values ​​to be matched within the Condition in the authorization policy. The authorization policy can be viewed as a multi-layered nested logical expression. Its essence is a set of logical expressions and corresponding authorization results.

[0073] Semantic Computing: A field of computer science that aims to enable computers to better understand and process human language, data, and knowledge through understanding and reasoning about semantics (i.e., meaning). It aims to translate the differences between human and computer languages ​​into a form that computers can understand and process. In this application, this refers to computing based on the semantics represented by different authorization expressions to determine the relationships between them, including, but not limited to, identical, partially identical, conflicting, and partially conflicting relationships.

[0074] In related technologies, solvers can be used to determine whether one of two authorization policies contains the other, meaning that one policy is a subset of the other. However, solvers primarily address the problem of determining whether two regular expressions contain each other. Regular expressions are not closed during intersection calculations (the calculation result cannot be expressed using the syntax of the authorization policy before calculation), so semantic calculations cannot be performed. Therefore, solvers can only determine whether a containment relationship exists between two authorization policies, but cannot perform semantic calculations on the two policies.

[0075] In order to solve the above problems, the embodiments of the present application propose a semantic calculation method, device, electronic device, storage medium and program product for authorization policies. The method first converts the first authorization policy and the second authorization policy into the first intermediate representation layer and the second intermediate representation layer respectively, which conform to the preset grammatical structure; then performs semantic calculation on the first intermediate representation layer and the second intermediate representation layer to obtain the semantic calculation results of the first authorization policy and the second authorization policy. After converting the authorization policy into the intermediate representation layer, the embodiment performs semantic calculation on the intermediate representation layer. The calculation result can still be expressed using the grammatical structure of the authorization policy, thereby not only realizing the semantic calculation between the two authorization policies, but also obtaining an exact calculation result, so as to determine the relationship between the two authorization policies based on the calculation result. The relationship includes but is not limited to the same, partially the same, conflicting, partially conflicting, etc.

[0076] The above-mentioned electronic device can be any device that can execute the semantic computing method of the above-mentioned authorization policy, specifically a physical computer device, or a cloud server, and this embodiment does not make specific restrictions on this. The above-mentioned device can be a module on the electronic device specifically used to execute the semantic computing method of the authorization policy, and this embodiment does not make specific restrictions on its specific structure. The above-mentioned computer-readable storage medium stores a computer program that can implement the semantic computing method of the authorization policy, and can be any computer-readable storage medium that can store a computer program, and this embodiment does not make specific restrictions on its specific structure. The above-mentioned computer program product can be any product that includes the above-mentioned computer program, and this embodiment does not make specific restrictions on its specific implementation form and structure.

[0077] The various technical solutions provided in the embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0078] See Figure 1 , which is a flow chart of the semantic computing method of the authorization policy provided in the embodiment of the present application, such as Figure 1 As shown, the semantic calculation method of the authorization policy may include the following steps:

[0079] Step S1, obtaining a first authorization policy and a second authorization policy;

[0080] Step S2, converting the first authorization policy and the second authorization policy into a first intermediate representation layer and a second intermediate representation layer that conform to a preset grammatical structure respectively;

[0081] Step S3: Perform semantic calculation on the first intermediate representation layer and the second intermediate representation layer to obtain semantic calculation results of the first authorization policy and the second authorization policy.

[0082] The first authorization policy and the second authorization policy can be authorization policies for the same resource, that is, the two authorization policies have the same authorization object, so that the first authorization policy and the second authorization policy can be analyzed for duplication or conflict. Alternatively, they can be authorization policies for the same user, that is, the two authorization policies have the same execution subject, so as to facilitate analysis of the user's permissions. However, it should be understood that this embodiment is not limited to authorization policies for the same resource or the same user; any two authorization policies can be applied to the semantic calculation method for authorization policies provided in this embodiment.

[0083] The grammatical structure of the authorization policy may include the combined structure of the above elements, as well as the grammatical description format of each element. The current syntax used for authorization policies mostly uses JSON (JavaScript Object Notation) as the definition language for authorization policies. JSON defines the characters allowed in authorization policies and their usage rules. For example, permission policies can contain JSON characters such as {}[]", ", and :, as well as special characters such as =<>()|. The character usage rules are as follows: When an element allows multiple values, it can be expressed using commas (,) and ellipsis (...), or a single value, with the same effect. An element with a question mark (?) indicates that the element is optional. Multiple values ​​are separated by a vertical bar (|) to indicate that only one of these values ​​can be selected. Elements using double quotes ("") indicate that the element is a text string, etc. The values ​​of these elements can be specific numbers or expressions. The data types of element values ​​can be strings, numbers, dates, Booleans, and IP addresses. String values ​​can use the wildcard characters * and ?.

[0084] An authorization policy is essentially a set of logical expressions and corresponding authorization results. For example, "oss:*" in the Action is an expression, and the IP address "acs:SourceIp" in the Condition is "192.13.0.1 / 16," which is also an expression. Each Policy contains one or more Statements. Each Statement describes a set of operations on resources through a series of Conditions and defines whether operations on this set are permitted. Therefore, semantic computation between two authorization policies is essentially the semantic computation of the operation set expressions in the authorization policies.

[0085] During the research, this embodiment found that the premise for implementing the semantic calculation of the authorization policy is that the calculation syntax must be closed, that is, after a series of calculations of a semantic expression, the calculation result can still be expressed using the current syntax (such as JSON format). If the result of a Policy after semantic calculation cannot be expressed using the current syntax of the Policy, the semantics of the Policy are said to be logically incomplete. For example, Action and NotAction cannot exist in the same Statement at the same time. If the two authorization policies respectively contain the following authorization statements. As mentioned above, as long as there is a Deny between multiple Statements, the entire Policy is Deny, then the second statement cannot be expressed and is an invalid authorization policy.

[0086] Deny if the action matches "ecs:*" and the resource matches "*".

[0087] Allow when the action matches "ecs:ListInstance" and the resource matches "*".

[0088] The above regular expression is not closed at the intersection, so semantic calculation cannot be performed. However, the string in the authorization policy is not equivalent to a regular expression when it does not contain special characters (other characters besides wildcards). The wildcard string that does not contain special characters is closed at the intersection and can be semantically calculated. This embodiment proposes a semantic calculation method for the authorization policy on this basis. However, in view of the fact that wildcard strings, range variables (including numerical values ​​and dates) and IP variables are not closed at the union and complement calculation levels, the results of the semantic calculation (including the final result and the intermediate result) cannot be effectively expressed. This embodiment also designs an intermediate representation layer to represent the authorization policy. The intermediate representation layer conforms to the preset grammatical structure and can perform semantic calculation. After the semantic calculation is performed, the semantic calculation result can also be expressed using the grammatical structure of the authorization policy before the conversion, that is, the preset grammatical structure can perform semantic calculation and can be converted to each other with the grammatical structure to which the first authorization policy and the second authorization policy belong.

[0089] This embodiment converts the authorization policy into an intermediate representation layer that conforms to a preset grammatical structure, so that the calculation result after semantic calculation can be expressed in the grammatical format before the authorization policy is converted. This can achieve the closure of the authorization policy in semantic calculation, thereby realizing the semantic calculation between two authorization policies. Then, when authorizing a user, the newly written authorization policy can be semantically calculated with the user's existing authorization policy, and based on the semantic calculation result, it can be determined whether the newly written authorization policy is the same as the user's existing authorization policy, or partially duplicated, or conflicting with each other, etc., and then it can be determined whether the newly written authorization policy can take effect (when the newly written authorization policy conflicts with the existing authorization policy, the newly written authorization policy cannot take effect, or the existing authorization policy is invalid, etc.), and whether it is a redundant authorization, and the location of the conflicting information or repeated information can be specifically determined, and the customer can be prompted with the invalid information and the reason for the invalidity, to help the user perform authorization analysis.

[0090] It is understood that the two authorization policies described above can be identical or different. In the case of identical authorization policies, semantic computation can be performed on a single authorization policy, enabling simplification and semantic inversion of the single policy, thereby optimizing the authorization policy and reducing the amount of authentication computation. In the case of different authorization policies, semantic computation can be performed on the two authorization policies to determine whether they are identical, whether they contain an inclusion relationship, and whether they conflict with each other.

[0091] It should be noted that this embodiment uses the authorization policy in JSON format as an example, but this embodiment is not limited to the authorization policy in JSON format. It can also be in other formats, such as XML or other private formats, as long as it can be converted into each other with the preset grammatical structure provided by this application.

[0092] In some embodiments, logical connectives can be added to the original expression to solve the problem of inexpressible semantic calculation results, so that all semantic calculations meet the closed property. Specifically, the step of converting the first authorization policy into a first intermediate representation layer that conforms to the preset grammatical structure can include the following processing: determining each first element of the first authorization policy and the expressions contained therein; based on the position information of each first element, adding logical connectives to the expressions corresponding to each first element to obtain the first intermediate representation layer that conforms to the preset grammatical structure. Similarly, the step of converting the first authorization policy into a second intermediate representation layer that conforms to the preset grammatical structure can also include similar processing, namely, first determining each second element of the second authorization policy and the expressions contained therein; based on the position information of each second element, adding logical connectives to the expressions corresponding to each second element to obtain the second intermediate representation layer that conforms to the preset grammatical structure.

[0093] The first and second elements can be any of the aforementioned basic elements, such as authorization statements, effects, resources, operations, and conditions. The element's position information can be understood as the element's position within the authorization policy, used to determine which of the aforementioned basic elements it is. The expression contained in the element can be understood as the expression corresponding to the value of the first element.

[0094] In order to solve the problem of logical incompleteness of the current policy semantics mentioned above, this embodiment allows the new policy generated by semantic calculation to contain both Action and NotAction (do not perform the operation). In this way, the semantic logic of the authorization policy is complete, and each element expression is closed during the semantic calculation process. Therefore, referring to the current authorization policy language, according to the method of aggregating the same conditional keywords in each authorization policy, logical connectives can be added to the original expressions, and expressions with the same conditional keywords can be aggregated into a set, thereby constructing a corresponding intermediate representation layer. This can obtain a logically complete and closed intermediate representation layer, and this intermediate representation layer can be converted between the authorization policy and the authorization policy.

[0095] It is understandable that the specific logical connectives to be added can be set according to the position information of the elements, and this embodiment does not make any specific limitation on this.

[0096] For elements of wildcard string type, the following grammatical structure can be used to form the intermediate representation layer of the wildcard string:

[0097] public class StringSetExp implements ValueExp{ / / String expression type data

[0098] private final List <innerstringexp>equalLst; / / matching set

[0099] private final List <innerstringexp>notEqualLst; / / Does not match the set

[0100] private final DataType dataType; / / Specific data type

[0101] }

[0102] Among them, equalLst represents the A1 set, notEqualLst represents the B1 set, and dataType is used to distinguish between Action, Principal, Resource and general wildcard strings. If equalLst is null, it means that the equalLst whitelist is not matched, which means that A1 is always true; if equalLst is an empty List, then no matter what is input, equalLst is not satisfied, and the logical semantics of the entire Key must be false; if notEqualLst is null, it means that the notEqualLst blacklist is not matched, so B1 is always true, and the logical semantics of the entire Key must be false; if notEqualLst is empty, it means that any input of the key cannot match B1, so B1 can be said to be always false. Therefore, the empty set can be defined as: this.equalLst is an empty set and notEqualLst is equal to null; the full set can be defined as: this.equalLst is null and notEqualLst is empty. Then define the List <stringsetexp>The relationship between multiple StringSetExps represented is "or".

[0103] For data types and date type elements, it's necessary to consider scenarios involving equality (Equals), inequality (NotEquals), and ranges. Because different Conditions within a statement are in an AND relationship, a statement can only contain one range at a time. If multiple expressions contain the greater-than character (GreaterThan), the largest one is used; if multiple expressions contain the less-than character (LessThan), the smallest one is used. Based on this principle, the following grammatical structure can be used to form the intermediate representation layer for range variables:

[0104] class AbstractRangeValueExp<T extends ValueExp> { / / Abstract range data expression

[0105] private final DataType dataType; / / Specific data type

[0106] private final Range <t>range; / / data range

[0107] private final List <t>equalLst; / / match single point data

[0108] private final List <t>notEqualLst; / / Does not match single point data

[0109] private final boolean matchAll; / / Is it the full set?

[0110] }

[0111] class Range<T extends Comparable> { / / Range numerical expression

[0112] private final T lowerData; / / Lower limit of range

[0113] private final boolean lowerClose; / / Can I take the lower limit value?

[0114] private final T upperData; / / Range upper limit

[0115] private final boolean upperClose; / / Can the upper limit be taken?

[0116] private final boolean matchAll; / / Is it the full set?

[0117] }

[0118] Among them, dataType is used to distinguish whether it is a number or a date; range represents an interval. If it is an interval to positive infinity, upperData is null, and if it is an interval to negative infinity, lowerData is null; lowerClose and upperClose represent closed and open spaces respectively; matchAll is used to assist in representing the entire set.

[0119] For Boolean type elements, since Boolean variables are exclusive and have only four possible values, when performing intermediate-level conversion on Boolean type elements, it is only necessary to supplement the definitions of the empty set and the full set of the elements to make them closed during the semantic calculation process.

[0120] For IP-type elements, IP-type variables cannot be considered range variables because they cannot represent network segments with arbitrary starting and ending addresses in subnet expressions. Instead, they are treated as wildcard strings. Only one of its four operators distinguishes whether to use boundary values: IpAddress (matches IP addresses), NotIpAddress (does not match IP addresses), IpAddressIncludeBorder (IP addresses include boundary values), and NotIpAddressIncludeBorder (IP addresses do not include boundary values). Because it distinguishes between IPv4 and IPv6, and between single IP addresses and subnet segments, its model can be designed as follows:

[0121] public class IpExp implements ValueExp{ / / IP expression

[0122] private final List <inneripexp>equalLst; / / match IP set

[0123] private final List <inneripexp>notEqualLst; / / Does not match IP set

[0124] private final List <innersubnetexp>rangeLst; / / The matching IP segment represented by the range

[0125] private final List <innersubnetexp>notRangeLst; / / The range indicates the mismatched IP segment

[0126] private final boolean matchAll; / / Is it the full set?

[0127] }

[0128] Among them, equalLst and notEqualLst respectively represent a set of expressions with the same IP as the keyword; rangeLst and notRangeLst are network segments; matchAll is used to assist in expressing the full set. If matchAll is true, it represents the full set. The logical relationship between each member is as follows:

[0129] (equalLst or rangeLst)and not(notEqualLst or notRangeLst)

[0130] For the intermediate representation layer of the wildcard string, (equalLst or rangeLst) here corresponds to equalLst in the wildcard string, and (notEqualLst or notRangeLst) corresponds to notEqualLst in the wildcard string. The semantic calculation method is basically consistent with the wildcard string, but the calculation of network segments and single IP addresses needs to be distinguished, which requires classification discussion.

[0131] For elements of other data types, specific settings can be made according to the specific semantics and related attributes of the elements, referring to the above-mentioned intermediate representation layer construction method of wildcard strings and data type variables, and will not be listed one by one in this embodiment.

[0132] In some embodiments, as Figure 2 As shown, the above-mentioned step S3 may include the following specific steps: step S31, respectively determining each first element contained in the first intermediate representation layer and the position information of each first element, and each second element contained in the second expression and the position information of each second element; step S32, performing semantic calculation on the first elements and the second elements at the same position in the first intermediate representation layer and the second intermediate representation layer according to the position information of each first element and the position information of each second element; step S33, obtaining the semantic calculation results of the first authorization policy and the second authorization policy based on the calculation results of the semantic calculation of the first elements and the second elements at the same position.

[0133] Among them, the first element and the second element in the same position can be understood as the first element and the second element having the same element type, for example, both are authorization statements, or both are conditions, or both are the same data type, that is, when performing semantic calculations, elements of the same dimension are used for semantic calculations.

[0134] In the present application, the first element and the second element respectively contained in the first authorization policy and the second authorization policy are first determined, and then the position information corresponding to the first element and the second element is determined, and then the semantic calculation can be performed on the first element and the second element with the same position. For example, the semantic calculation of the statement dimension can be performed between two authorization statements, the semantic calculation of the condition dimension can be performed between two conditions of the same condition keyword, the semantic calculation of the data variable dimension can be performed between two identical data variables, and the semantic calculation of the expression dimension can be performed between different expressions of the same data variable. Then, based on the semantic calculation results of each dimension, the semantic calculation results of the first authorization policy and the second authorization policy are obtained. In this way, semantic calculations of different dimensions can be performed on each element in the first authorization policy and the second authorization policy according to the different positions of the elements, and then the semantic calculation results of the first authorization policy and the second authorization policy are formed based on the semantic calculation results of each dimension, thereby realizing the semantic calculation between the two authorization policies and ensuring the integrity of the semantic calculation of the authorization policies.

[0135] It can be understood that this embodiment performs semantic calculations based on the intermediate representation layer, and the calculation results conform to the grammatical structure of the intermediate representation layer. The semantic calculation results of the first authorization policy and the second authorization policy formed based on the semantic calculation results of each dimension are also calculation results that conform to the grammatical structure of the intermediate representation layer. The semantic calculation results in the form of the intermediate representation layer can be grammatically converted into the original grammatical structure of the authorization policy.

[0136] In other embodiments, when the position information of the first element and the position information of the second element both indicate data types, such as Figure 3 As shown, the above-mentioned step S32 may include the following specific steps: step S321, determining the target first element and the target second element with the same data type based on the position information of each first element and the position information of each second element; step S322, determining a first logical expression set containing the target first element, and a second logical expression set containing the target second element; step S323, performing set operations on the first logical expression set and the second logical expression set to obtain the semantic calculation results of the data type dimension.

[0137] The position information indication data types of the first element and the second element can be understood as follows: the first element includes the data type conditionally included in the first authorization policy, and the second element may include the data type conditionally included in the second authorization policy.

[0138] In this embodiment, based on the principle of semantic calculation of elements of the same dimension, the target first element and the target second element of the same data type are first determined. Since there may be multiple identical or different data types in the same authorization condition, the target first element and the target second element here can both include one or more, so the expression containing the target first element and the target second element can also be multiple. Therefore, after determining the target first element and the target second element, this embodiment can further determine the first logical expression set and the first logical expression set containing the target first element and the target second element respectively, and then perform set operations on the expression sets corresponding to the target first element and the target second element respectively, so as to obtain the semantic calculation result of the data type dimension.

[0139] Specifically, if the data type includes a wildcard string type; then the above-mentioned step of performing set operations on the first logical expression set and the second logical expression set may include the following processing: determining the state transition equations corresponding to the first logical expression set and the second logical expression set; when the state transition equation represents that there is an intersection between the first logical expression set and the second logical expression set, based on the state transition equation, determining the intersection of the first logical expression set and the second logical expression set of the wildcard string type; based on the intersection of the first logical expression set and the second logical expression set, determining the union and complement of the first logical expression set and the second logical expression set.

[0140] In a dynamic programming algorithm, the relationship between two states is expressed in a recursive form similar to a sequence based on a state transition equation, and the next state is obtained based on the change in the previous state. In this embodiment, the state transition equation is used to determine whether the first set of logical expressions and the second set of logical expressions intersect.

[0141] This embodiment notes that the dynamic programming transfer equation has left-right symmetry, and thus conceives of using a dynamic programming algorithm to determine whether two wildcard strings have an intersecting or containing relationship. The intersection of two expression sets containing wildcard strings can be further calculated, and then based on the calculated intersection and the two original expression sets containing wildcard strings, the union and complement of the two expression sets containing wildcard strings can be calculated, thereby realizing the set calculation of the two expression sets containing wildcard strings, that is, completing the semantic calculation of the two wildcard strings.

[0142] For wildcard characters, the following semantically equivalent situations are possible:

[0143] 1) Multiple consecutive wildcard characters * are equivalent to one wildcard character *. For example, "ecs:****" is equivalent to "ecs:*";

[0144] 2) When the wildcard characters ? and * are consecutive, their order does not affect the semantics. For example, "ecs:?*?", "ecs:??*", and "ecs:*??" all have the same semantics.

[0145] In this embodiment, before determining the state transition equation, the wildcard character strings in the expression set may be pre-processed according to the following rules to eliminate the above-mentioned semantic uncertainty.

[0146] 1) When ? and * are consecutive, all ? are placed in front and * in the back. For example, "ecs:?*?" is converted to "ecs:??*";

[0147] 2) Continuous * is eliminated into a single *, for example: "ecs:?*?*?*" is converted into "ecs:???*".

[0148] Specifically, for any two wildcard strings, which can be denoted as left and right respectively, the transfer equation to determine whether they have an intersection is as follows:

[0149] dp[i][j]=(left[i]=='*'||right[j]=='*')&&(dp[i-1][j]||dp[i][j-1])

[0150] ||dp[i-1][j-1]&&(left[i]==right[j]||left[i]=='?'||right[j]=='?')

[0151] Among them, left[i] represents any character in the wildcard string left, right[j] represents any character in the wildcard string right, left[i-1] represents any character in the prefix substring of the wildcard string left, and right[j-1] represents any character in the prefix substring of the wildcard string left.

[0152] The principle of determining whether there is an intersection between two wildcard strings based on the state transition equation is discussed in detail below.

[0153] If the wildcard strings left and right have an intersection, then for any prefix substring left.subString(0,i) of the wildcard string left, there exists a prefix substring right.subString(0,j) of the wildcard string right, and this prefix substring right.subString(0,j) also intersects with the prefix substring left.subString(0,i). Otherwise, the wildcard strings left and right do not have an intersection.

[0154] We can define dp[i][j]==true, indicating that there is an intersection between the prefix substrings left.subString(0,i) and right.subString(0,j); conversely, dp[i][j]==false, indicating that there is no intersection between the prefix substrings left.subString(0,i) and right.subString(0,j). From this, we can derive the following dp equation:

[0155] When dp[0][0]=true; dp[0][1]=right[0]=='*'; dp[1][0]=left[0]=='*'.

[0156] When dp[i][j] = true, it can be deduced that dp[i][j+1] = true, dp[i+1][j] = true, and dp[i][j+1] = true. The specific principle is as follows:

[0157] If left[i+1] is a wildcard *, then for this *:

[0158] If no characters are matched, then left.subString(0,i+1) and right.subString(0,j) have an intersection, and it can be deduced that dp[i+1][j]=true holds.

[0159] If right[j+1] is matched, then left.subString(0,i) and right.subString(0,j+1) have an intersection, and it can be deduced that dp[i][j+1]=true holds.

[0160] Similarly, right[j+1] is *, then for this *:

[0161] If no characters are matched, left.subString(0,i) and right.subString(0,j+1) intersect, and we can deduce that dp[i][j+1]=true.

[0162] If left[j+1] is matched, left.subString(0,i+1) and right.subString(0,j) intersect, and it can be deduced that dp[i+1][j]=true holds.

[0163] If left[i+1] is a wildcard? Or right[j+1] is a wildcard? Or if left[i+1] == right[j+1], then we can deduce that left.subString(0,i+1) and right.subString(0,j+1) intersect, and therefore dp[i+1][j+1] = true.

[0164] Further optionally, the above-mentioned step of determining the intersection of the first logical expression set and the second logical expression set of the wildcard string type based on the state transition equation may include the following specific processing: determining the dynamic programming matrix of the first logical expression set and the second logical expression set based on the state transition equation; determining the intersection of the first logical expression set and the second logical expression set of the wildcard string type based on the dynamic programming matrix.

[0165] The dynamic programming matrix can be understood as the matrix representation of the state transition equations described above. For example, consider two wildcard strings, d?*f and df*zf. The DP matrix for determining whether these two wildcard strings intersect is shown in Table 1. If the two wildcard strings left and right intersect, a path with all true values ​​can be found from the top left corner of the dynamic programming matrix to the bottom right corner. By summing the two ends of this path, the intersection of the two wildcard strings can be determined. For the wildcard strings d?*f and df*zf, a path can be found from the top left corner of the DP matrix to the right, bottom, or bottom right corner to the bottom right corner. By taking the characters with the smallest wildcard meaning at each end, multiple strings that meet the requirements can be obtained, such as: df?zzff, df?*zff, df?zzf, and so on. Observing these strings, we can see that they all contain the wildcard string d? *f and df*zf, but not necessarily their intersection. The intersection of the two can be understood as the shortest path from the upper left corner to the lower right corner that maximizes the match of all wildcard characters in the path. For example, the shortest paths represented by the nodes in bold and italics in Table 1 have an intersection of df*zf, which is equal to the string on the right.

[0166] Table 1

[0167]

[0168]

[0169] The same intersection calculation method applies to prefixes of the wildcard strings d?*f and df*zf. Specifically, for the prefix strings a*cbd?*f and a12dc*df*zf, their dp matrices are shown in Table 2 below. In Table 2, all 1s indicate that left.subString(0,i) and right.subeString(0,j) intersect. Any path from the top left corner to the bottom right corner, one step to the right, one step down, or one step to the bottom right, is a subset of left and right. Table 2 shows that the shortest path from the top left corner to the bottom right corner always takes the one with the smaller wildcard range at both ends. The resulting wildcard string is a subset of the two. For example, the shortest path represented by the bold and italicized nodes in Table 2 indicates that the subset of the two is: a12dcbdf*zf.

[0170] Table 2

[0171]

[0172] The previous article described the intersection calculation process for wildcard strings containing * and ?. However, for strings containing colons, the colon, as a delimiter in authorization policies, has a special meaning and cannot be matched by wildcards. Therefore, strings containing colons can be processed as follows: first, the string is segmented by the colon, and then each segment is processed using the algorithm described above. Given the uniformity of the algorithm, the colon can be uniformly handled in the DP transition equation. The DP transition equation that considers the colon is as follows. The process for calculating the intersection of strings containing colons is essentially the same as that for wildcard strings described above and is not further explained here.

[0173] if (left[i]==':'||right[j]==':'){

[0174] dp[i][j]=left[i]=='*'&&dp[i-1][j]||right[j]=='*'&&dp[i][j-1]

[0175] ||left[i]==right[j]&&dp[i-1][j-1]

[0176] }otherwise{

[0177] dp[i][j]=right[j]=='*'&&(dp[i-1][j]||dp[i][j-1])

[0178] ||dp[i-1][j-1]&&(left[i]==right[j]||right[j]=='?')

[0179] }

[0180] Among them, left[i] represents any character in the wildcard string left, right[j] represents any character in the wildcard string right, left[i-1] represents any character in the prefix substring of the wildcard string left, and right[j-1] represents any character in the prefix substring of the wildcard string left.

[0181] The above describes the semantic computation process of strings at the expression level. When performing semantic computation on wildcard strings at the data type level, the wildcard string is treated as a whole variable. Intersection, union, and complement operations can be performed based on the grammatical structure of the intermediate representation layer. The specific process is as follows:

[0182] The intersection, union, and complement of any wildcard string can be calculated using the following logical expression: (A1 and not B1)||(A2 and not B2)||(A3 and not B3)||... Here, A1, A2, A3... and B1, B2, B3... each represent a set of wildcard string logical expressions. That is, A1, A2, A3... are different subsets of the same set, and B1, B2, B3... are different subsets of another set. Furthermore, B1 is a subset of A1, B2 is a subset of A2, B3 is a subset of A3, etc., and no one of A1, A2, A3... is a subset of the other; therefore, they can intersect. Then, if A1 is the complete set, then (A1and not B1)=>(not B1); if B1 is the empty set, then (A1 and not B1)=>(A1); if A1 is the empty set, then (A1 and not B1)=>empty set; if B1 is the complete set, then (A1 and not B1)=>empty set.

[0183] The intersection of any two wildcard string expression sets can be expressed as: (A1 and not B1) and (A2 and not B2) => (A1 and A2) and not (B1 or B2). Using the intermediate representation layer described above for semantic computation, we can take the intersection of the two equalLst statements and the union of their notEqualLst statements, and then reconstruct a new Statement.

[0184] The union of any two wildcard string expression sets can be expressed as: (A1 and not B1) or (A2 and not B2) = > ((A1 and not B1) or A2) and ((A1 and not B1) or not B2) = > (A1 or A2) and (not B1 or A2) and (A1 or not B2) and not (B1 and B2). This shows that when calculating the union, the intermediate data of the intersection and the data of each set can be used to obtain the union of the two sets.

[0185] The complement of any two wildcard string expressions can be expressed as: (A1 and not B1) - (A2 and not B2) => (A1 and not B1) and (not (A2 and not B2)) => (A1 and not B1) and (not A2) and (B2). This calculation shows that complement is equivalent to a negation and union operation. Similarly, the complement can be calculated by calling the intersection calculated above.

[0186] Intersection, union, and complement calculations for range variables can be performed using the number axis method. Specifically, the unsimplified variable expression can be standardized first. Then, based on the mathematical symbols contained in the range variable, such as equality, inequality, interval, empty set, and the entire set, intersection, union, and complement operations can be performed, referring to the calculation method for numerical values ​​on the coordinate axis. The complement of range variables can also be completed using the antithesis and intersection method, which will not be further explained here.

[0187] If the data type includes a Boolean variable type; then performing set operations on the first logical expression set and the second logical expression set may include: using an empty set and a full set to supplement the operation results of any two Boolean variable expressions to form a Boolean variable operation set; the Boolean variable operation set is used to record the operation rules of the Boolean variable expression; based on the Boolean variable operation set, determining the intersection, union, and complement of the first logical expression set and the corresponding second logical expression set respectively.

[0188] When performing set operations on Boolean variable expressions, we can complete the concepts of empty sets and full sets that define Boolean variable expressions, forming a calculation table as shown in Table 3 below. Then, according to Table 3, we can implement set operations on any two Boolean variable expressions with high computational efficiency.

[0189] Table 3

[0190]

[0191]

[0192] Further optionally, the above-mentioned step S33 may specifically include the following processing: generating the semantic calculation results of the conditional dimension based on the semantic calculation results of the first element and the second element with the same conditional keyword; generating the semantic calculation results of the first element and the second element of the statement based on the semantic calculation results of the first element and the second element of the statement; generating the semantic calculation results of the first authorization policy and the second authorization policy based on the semantic calculation results of the first element and the second element of the statement.

[0193] In this embodiment, semantic calculation is performed on the first element and the second element at the same position, that is, after semantic calculation of each dimension is performed, the semantic calculation results can be summarized one by one based on the position information of the elements to form the final semantic calculation result.

[0194] Specifically, corresponding semantic calculators can be configured for semantic calculations of different dimensions, and each calculator can perform parallel processing to improve semantic calculation efficiency. For example, a semantic calculator can be set up separately for the variable dimension, the expression dimension, the same condition keyword dimension, the condition dimension, the statement dimension, and the policy dimension. The semantic calculation results can then be aggregated upward based on the element's position information to form the final semantic calculation result. Specifically, the semantic calculation result of the variable dimension can be substituted into the semantic calculation result of the expression dimension to generate the final calculation result of the expression dimension; similarly, the semantic calculation result of the expression dimension can be substituted into the semantic calculation result of the same condition keyword dimension to generate the final calculation result of the same condition keyword dimension; the semantic calculation result of the same condition keyword dimension can be substituted into the semantic calculation result of the condition dimension to generate the final semantic calculation structure of the condition dimension; the semantic calculation result of the condition dimension can be substituted into the semantic calculation result of the statement dimension to generate the final semantic calculation of the statement dimension; the semantic calculation result of the statement dimension can be substituted into the semantic calculation result of the policy dimension to generate the final semantic calculation result of the policy dimension, that is, the final semantic calculation result of the two authorization policies in the form of an intermediate representation layer.

[0195] Specifically, when the position information of the first element and the second element both indicate conditions in the authorization policy, the third logical expression set corresponding to the target conditions with the same condition keywords in the first intermediate representation layer and the fourth logical expression set corresponding to the target conditions with the same condition keywords in the second intermediate representation layer can be determined respectively; set operations are performed on the third logical expression set and the fourth logical expression set to obtain the semantic calculation results of the condition dimension; based on the semantic calculation results of the data type dimension, a logical expression of the semantic calculation results of the condition dimension is formed.

[0196] In other embodiments, before performing semantic calculations on each element dimension in the first and second intermediate representation layers, the logical expressions may be simplified and standardized. Specifically, semantic calculations may be performed on different logical expressions containing the same element in the first intermediate representation layer. If the semantic calculation results intersect, duplicate information located by the intersection is determined; then, the duplicate information in the first intermediate representation layer is deleted. Similarly, semantic calculations may be performed on different logical expressions containing the same element in the second intermediate representation layer. If the semantic calculation results intersect, duplicate information located by the intersection is determined; then, the duplicate information in the second intermediate representation layer is deleted.

[0197] In this embodiment, as described above, there may be repeated expressions and string information in the authorization policy. After the authorization policy is converted into the intermediate representation layer, repeated data still exists. When performing semantic calculations, the authorization policy can be minimized and standardized to reduce the multiple expressions under the same semantic situation. At the same time, redundant and invalid expressions can also be deleted to reduce the complexity of semantic calculations and the difficulty of coding, thereby further improving the efficiency and accuracy of semantic calculations.

[0198] In addition, after implementing the above-mentioned semantic calculation, this embodiment can also be further applied, specifically including: when the semantic calculation result indicates that there is an intersection between the first authorization policy and the second authorization policy, determining the target element information located by the intersection; when the effective information of the target element information in the first authorization policy and the effective information in the second authorization policy are the same, determining that the target element information in the first authorization policy and the target element information in the second authorization policy are repeated; when the effective information of the target element information in the first authorization policy and the effective information in the second authorization policy are different, determining that the target element information in the first authorization policy and the target element information in the second authorization policy are repeated as conflicting information.

[0199] In this embodiment, in addition to the above-mentioned judgment of whether the newly written authorization policy can take effect and whether it is a redundant authorization to help users perform authorization analysis, solve the problem of invalid authorization, and simplify the application of authorization policies, it can also be applied to the following situations.

[0200] 1) In actual applications, some complex operations often require users to have sufficient permissions to perform the operations. Based on the semantic computing method provided in this embodiment, the permission set of a sub-account / role can be semantically calculated with the target permission set required to implement the complex operation to determine whether the permission set of the sub-account / role is a subset of the target permission set, so as to judge whether a sub-account / role meets the requirements.

[0201] 2) The semantic computing method provided in this embodiment can also be applied to the scenario of authorized agents. For example, after a user creates an authorized agent, the authorized agent can be granted bounded authorization capabilities. Through the semantic computing method provided in this embodiment, it can be determined whether the authorization granted by the authorized agent to other sub-accounts / roles exceeds its authorization boundary. It can also specifically locate the authorized content that exceeds the boundary and calculate the authorization policy that complies with the authorization boundary.

[0202] 3) The semantic computing method provided in this embodiment can also help users modify authorization policies. For example, as users modify authorization policies multiple times, the complexity of the authorization policies will gradually increase. When modifying the authorization policies subsequently, it is necessary to pay attention to the impact of the modified portions on the entire authorization policy. In this embodiment, the user only needs to describe the modified portion of the authorization policy. Based on the semantic computing method of the authorization policy provided in this embodiment, the conflicting portions with the entire authorization policy and the conflicting portions between the modified portion and the entire authorization policy can be calculated and displayed to the user. After the user makes a selection on the conflicting portion, the semantic computing method can calculate the corresponding new authorization policy.

[0203] 4) The semantic computing method provided in this embodiment can also be applied to the automated testing system of authorization semantics. For example, based on the semantic computing method provided in this embodiment, the semantic logic of the authorization policy can be identified, and a test case (Case) that fully covers the semantic logic of the authorization policy can be generated. Subsequent tests can modify and cover the changed authorization policy based on the test case to obtain a new test case, and then complete the test, which can greatly reduce the authentication engine testing cost and increase the application scope of the test coverage.

[0204] Some embodiments of the present application further provide a semantic computing device for authorization policies, which is used to execute the semantic computing method for authorization policies provided in any of the above embodiments. Figure 4 A schematic diagram of the semantic computing device of the authorization policy is shown as follows: Figure 4 As shown, the semantic computing device of the authorization policy includes:

[0205] A policy acquisition module, configured to acquire a first authorization policy and a second authorization policy for a target resource;

[0206] A language conversion module, configured to convert the first authorization policy and the second authorization policy into a first intermediate representation layer and a second intermediate representation layer respectively conforming to a preset grammatical structure; the preset grammatical structure and the grammatical structures of the first authorization policy and the second authorization policy can be converted into each other;

[0207] The semantic calculation module is used to perform semantic calculation on the first intermediate representation layer and the second intermediate representation layer to obtain semantic calculation results of the first authorization policy and the second authorization policy.

[0208] It can be understood that the semantic computing device of the authorization policy provided in this embodiment and the semantic computing method of the authorization policy provided in the embodiment of this application are based on the same inventive concept, and have at least the same beneficial effects as the methods adopted, run or implemented by them, and the various implementation methods of the embodiment of the semantic computing method of the authorization policy are also applicable to the embodiment of the semantic computing device of the authorization policy.

[0209] Specifically, the language conversion module may include a pre-conversion module and a post-conversion module. The pre-conversion module is used to convert the first authorization policy and the second authorization policy into a first intermediate representation layer and a second intermediate representation layer, respectively, that conform to a preset grammatical structure. Specifically, it is used to: determine each first element of the first authorization policy and the expressions contained therein; based on the position information of each first element, add logical connectives to the expressions corresponding to each first element to obtain a first intermediate representation layer that conforms to the preset grammatical structure; and determine each second element of the second authorization policy and the expressions contained therein; based on the position information of each second element, add logical connectives to the expressions corresponding to each second element to obtain a second intermediate representation layer that conforms to the preset grammatical structure.

[0210] The post-conversion module can be used to convert the semantic calculation results in the intermediate representation layer into the authorization policy language.

[0211] In some embodiments, the semantic computing module can be specifically used to: respectively determine each first element contained in the first intermediate representation layer and the position information of each first element, as well as each second element contained in the second expression and the position information of each second element; perform semantic computing on the first elements and the second elements in the same position in the first intermediate representation layer and the second intermediate representation layer according to the position information of each first element and the position information of each second element; obtain the semantic computing results of the first authorization policy and the second authorization policy based on the calculation results of the semantic computing of the first elements and the second elements in the same position.

[0212] When the position information of the first element and the position information of the second element both indicate data types, the semantic calculation module can be specifically used to: determine the target first element and the target second element of the same data type based on the position information of each first element and the position information of each second element; determine a first logical expression set containing the target first element, and a second logical expression set containing the target second element; perform set operations on the first logical expression set and the second logical expression set to obtain the semantic calculation result of the data type dimension.

[0213] When the data type includes a wildcard string type, the semantic calculation module can be specifically used to: determine the state transition equation corresponding to the first logical expression set and the second logical expression set; the state transition equation is used to determine whether there is an intersection between the first logical expression set and the second logical expression set; when the state transition equation represents that there is an intersection between the first logical expression set and the second logical expression set, based on the state transition equation, determine the intersection of the first logical expression set and the second logical expression set of the wildcard string type; based on the intersection of the first logical expression set and the second logical expression set, determine the union and complement of the first logical expression set and the second logical expression set.

[0214] When the data type includes a Boolean variable type, the semantic computing module can be specifically used to: use the empty set and the full set to supplement the operation results of any two Boolean variable expressions to form a Boolean variable operation set; the Boolean variable operation set is used to record the operation rules of the Boolean variable expression; based on the Boolean variable operation set, determine the intersection, union and complement of the first logical expression set and the corresponding second logical expression set respectively.

[0215] The semantic calculation module is also specifically used to: generate the semantic calculation results of the conditional dimension based on the semantic calculation results of the first element and the second element with the same conditional keyword; generate the semantic calculation results of the first element and the second element of the containing statement based on the semantic calculation results of the first element and the second element of the containing condition; generate the semantic calculation results of the first authorization policy and the second authorization policy based on the semantic calculation results of the first element and the second element of the containing statement.

[0216] Furthermore, if Figure 5 As shown, the semantic calculation module in this embodiment may include multiple semantic calculators, which can perform semantic calculations of different dimensions, and each calculator can perform parallel processing to improve the efficiency of semantic calculations. Specifically, a semantic calculator for the variable dimension, a semantic calculator for the expression dimension, a semantic calculator for the same condition keyword dimension, a semantic calculator for the condition dimension, a semantic calculator for the statement dimension, and a semantic calculator for the policy dimension can be set separately. Among them, the semantic calculator for the variable dimension can be, but is not limited to, the semantic calculation of range-type variables, the semantic calculation of wildcard string type variables, the semantic calculation of IP type variables, and the semantic calculation of Boolean variables. The semantic calculator for the expression dimension can be, but is not limited to, the semantic calculation of operation expressions, the semantic calculation of resource expressions, the semantic calculation of date expressions, the semantic calculation of string expressions, and the semantic calculation of numerical expressions. Then, based on the position information of the elements, the semantic calculation results can be summarized one by one to form the final semantic calculation result.

[0217] In order to further reduce the amount of calculation and improve the calculation efficiency, the semantic calculation device of the authorization policy can also include a standardization module, which is used to: before performing semantic calculations on the dimensions of each element of the first intermediate representation layer and the second intermediate representation layer, simplify the authorization policy through the semantic calculation module. Specifically, semantic calculations can be performed on different logical expressions containing the same elements in the first intermediate representation layer. When there is an intersection in the semantic calculation results, the repeated information located by the intersection is determined; then the repeated information in the first intermediate representation layer is deleted, thereby deleting the redundant information of the authorization policy, thereby realizing the simplification and standardization of the authorization policy.

[0218] In addition, the semantic computing device of the authorization policy may further include an application module, which may perform the following applications: when the semantic computing result indicates that there is an intersection between the first authorization policy and the second authorization policy, determining the target element information located by the intersection; when the effective information of the target element information in the first authorization policy and the effective information in the second authorization policy are the same, determining that the target element information in the first authorization policy and the target element information in the second authorization policy are repeated; when the effective information of the target element information in the first authorization policy and the effective information in the second authorization policy are different, determining that the target element information in the first authorization policy and the target element information in the second authorization policy are repeated as conflicting information.

[0219] Based on this application module, it is not only possible to determine whether the newly written authorization policy is effective and whether it is redundant authorization, so as to help users conduct authorization analysis and solve the problem of authorization failure. It is also possible to perform semantic calculations on the permission set of a sub-account / role and the target permission set required to implement the complex operation, determine whether the permission set of the sub-account / role is a subset of the target permission set, and judge whether the sub-account / role meets the requirements. It is also possible to determine whether the authorization granted by the authorized agent to other sub-accounts / roles exceeds its authorization boundary, and specifically locate the authorization content that exceeds the boundary, and calculate the authorization policy that meets the authorization boundary. It is also possible to calculate the conflicting parts of the authorization policy written by the customer and the entire authorization policy, as well as the conflicting parts between the modified part and the entire authorization policy, and display them to the user. After the user makes a selection on the conflicting part, the corresponding new authorization policy can be calculated. It can also identify the semantic logic of the authorization policy and generate a test case that fully covers the semantic logic of the authorization policy. Subsequent tests can modify and cover the changed authorization policy based on the test case to obtain a new test case and then complete the test, which can greatly reduce the authentication engine testing cost and increase the application scope of the test coverage.

[0220] The implementation process of the functions and effects of each module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0221] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are merely illustrative, wherein the modules described as separate components may or may not be physically separated, and the components illustrated as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present application scheme. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0222] The embodiments of the present application also provide an electronic device corresponding to the semantic computing method of the authorization policy provided in the aforementioned embodiments, so as to execute the aforementioned semantic computing method of the authorization policy.

[0223] Please refer to Figure 6 , which shows a schematic diagram of the hardware structure of the electronic device provided by some embodiments of the present application. Figure 6 As shown, the electronic device 6 includes: a processor 600, a memory 601, a bus 602 and a communication interface 603, wherein the processor 600, the communication interface 603 and the memory 601 are connected via the bus 602; the memory 601 stores a computer program that can be run on the processor 600, and when the processor 600 runs the computer program, it executes the semantic calculation method of the authorization policy or the semantic calculation method of the authorization policy provided in any of the aforementioned embodiments of the present application.

[0224] Memory 601 may be any electronic, magnetic, optical, or other physical storage device, and may contain stored information, such as executable instructions, data, and the like. Specifically, memory 601 may be RAM (Random Access Memory), flash memory, a storage drive (such as a hard disk drive), any type of storage disk (such as a CD, DVD, etc.), or similar storage media, or a combination thereof. Communication between the device network element and at least one other network element is achieved through at least one communication interface 603 (which may be wired or wireless), and may utilize the Internet, a wide area network, a local area network, a metropolitan area network, and the like.

[0225] The bus 602 may be an ISA bus, a PCI bus, an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc.

[0226] The processor 600 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by hardware integrated logic circuits in the processor 600 or by software instructions. The above processor 600 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in conjunction with the embodiments of this application can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium mature in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory 601 , and the processor 600 reads the information in the memory 601 and completes the steps of the above method in combination with its hardware.

[0227] The electronic device provided in the embodiment of the present application and the semantic computing method of the authorization policy or the semantic computing method of the authorization policy provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, operated or implemented therein.

[0228] The present application also provides a computer-readable storage medium corresponding to the semantic calculation method of the authorization policy or the semantic calculation method of the authorization policy provided in the above embodiment. Figure 7 The computer-readable storage medium shown is a CD-ROM 70, on which a computer program (i.e., a program product) is stored. When the computer program is run by the processor, it will execute the semantic calculation method of the authorization policy or the semantic calculation method of the authorization policy provided by any of the aforementioned embodiments.

[0229] It should be noted that examples of computer-readable storage media may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0230] An embodiment of the present application also provides a computer program product, including a computer program, which is executed by a processor to implement the semantic calculation method of the authorization policy or the semantic calculation method of the authorization policy of any of the above embodiments.

[0231] The computer-readable storage medium and computer program product provided in the above-mentioned embodiments of the present application are based on the same inventive concept as the semantic calculation method of the authorization policy or the semantic calculation method of the authorization policy provided in the embodiments of the present application, and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0232] It should be noted that:

[0233] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known structures and technologies are not shown in detail so as not to obscure the understanding of this description.

[0234] Similarly, it should be understood that in order to streamline the present application and aid in understanding one or more of the various inventive aspects, in the above description of the exemplary embodiments of the present application, various features of the present application are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting a schematic diagram that the claimed application requires more features than those explicitly recited in the individual claims. Rather, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims following the detailed description are hereby expressly incorporated into this detailed description, with each claim itself serving as a separate embodiment of the present application.

[0235] Furthermore, those skilled in the art will appreciate that although some embodiments herein include certain features included in other embodiments but not other features, combinations of features from different embodiments are intended to be within the scope of this application and to form different embodiments. For example, in the claims below, any of the claimed embodiments may be used in any combination.

[0236] The above are merely preferred embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.< / innersubnetexp> < / innersubnetexp> < / inneripexp> < / inneripexp> < / t> < / t> < / t> < / stringsetexp> < / innerstringexp> < / innerstringexp>

Claims

1. A semantic computing method for authorization policy, characterized in that: The method comprises: Obtain the first authorization policy and the second authorization policy; Converting the first authorization policy and the second authorization policy into a first intermediate representation layer and a second intermediate representation layer respectively that conform to a preset grammatical structure; the preset grammatical structure and the grammatical structures to which the first authorization policy and the second authorization policy belong can be converted into each other; Perform semantic calculation on the first intermediate representation layer and the second intermediate representation layer to obtain semantic calculation results of the first authorization policy and the second authorization policy.

2. The method according to claim 1, characterized in that The performing semantic calculation on the first intermediate representation layer and the second intermediate representation layer includes: respectively determining each first element included in the first intermediate representation layer and position information of each first element, and each second element included in the second expression and position information of each second element; performing semantic calculation on the first elements and the second elements at the same position in the first intermediate representation layer and the second intermediate representation layer according to the position information of each of the first elements and the position information of each of the second elements; The semantic calculation results of the first authorization policy and the second authorization policy are obtained based on the calculation results of the semantic calculation of the first element and the second element at the same position.

3. The method according to claim 2, characterized in that When both the position information of the first element and the position information of the second element indicate a data type, performing semantic calculation on the first element and the second element at the same position in the first intermediate representation layer and the second intermediate representation layer according to the position information of each first element and the position information of each second element includes: Determine, according to the position information of each of the first elements and the position information of each of the second elements, a target first element and a target second element having the same data type; Determine a first logical expression set including the target first element, and a second logical expression set including the target second element; A set operation is performed on the first logical expression set and the second logical expression set to obtain a semantic calculation result of the data type dimension.

4. The method according to claim 3, characterized in that When the data type includes a wildcard string type, performing a set operation on the first logical expression set and the second logical expression set includes: Determine a state transition equation corresponding to the first logical expression set and the second logical expression set; the state transition equation is used to determine whether the first logical expression set and the second logical expression set have an intersection; In a case where the state transition equation represents that the first logical expression set and the second logical expression set have an intersection, determining the intersection of the first logical expression set and the second logical expression set of a wildcard string type based on the state transition equation; Based on the intersection of the first logical expression set and the second logical expression set, a union and a complement of the first logical expression set and the second logical expression set are determined.

5. The method according to claim 4, characterized in that The determining, based on the state transition equation, the intersection of the first logical expression set and the second logical expression set of the wildcard string type includes: Determining a dynamic programming matrix of the first set of logical expressions and the second set of logical expressions based on the state transition equation; Based on the dynamic programming matrix, an intersection of the first logical expression set and the second logical expression set of the wildcard string type is determined.

6. The method according to claim 3, characterized in that When the data type includes a Boolean variable type, performing a set operation on the first logical expression set and the second logical expression set includes: The empty set and the full set are used to supplement the operation results of any two Boolean variable expressions to form a Boolean variable operation set; the Boolean variable operation set is used to record the operation rules of the Boolean variable expressions; Based on the Boolean variable operation set, the intersection, union and complement of the first logical expression set and the corresponding second logical expression set are respectively determined.

7. The method according to claim 2, characterized in that The semantic calculation results of the first authorization policy and the second authorization policy are obtained by performing the semantic calculation based on the first element and the second element having the same position, including: Generate a semantic calculation result of the conditional dimension based on the semantic calculation results of the first element and the second element with the same conditional keyword; Generate semantic calculation results of the first and second elements of the inclusion statement based on semantic calculation results of the first and second elements of the inclusion condition; The semantic calculation results of the first authorization policy and the second authorization policy are generated based on the semantic calculation results of the first elements and the second elements of the inclusion statement.

8. The method according to any one of claims 1 to 7, characterized in that Converting the first authorization policy into a first intermediate representation layer conforming to a preset grammatical structure includes: Determining each first element of the first authorization policy and the expressions contained therein; Based on the position information of each first element, logical connectives are added to the expressions corresponding to the first elements to obtain a first intermediate representation layer that conforms to a preset grammatical structure.

9. The method according to any one of claims 1 to 7, characterized in that Before performing semantic calculations on the first intermediate representation layer and the second intermediate representation layer for each element dimension, the method further includes: performing semantic calculations on different logical expressions containing the same element in the first intermediate representation layer, and determining duplicate information located by the intersection when the semantic calculation results have an intersection; The repeated information in the first intermediate representation layer is deleted.

10. The method according to any one of claims 1 to 7, characterized in that After performing semantic calculation on the first elements and the second elements at the same position in the first intermediate representation layer and the second intermediate representation layer according to the position information of each first element and the position information of each second element, the method further includes: If the semantic calculation result indicates that the first authorization policy and the second authorization policy have an intersection, determining target element information located by the intersection; When the validity information of the target element information in the first authorization policy and the validity information in the second authorization policy are the same, determining that the target element information in the first authorization policy and the target element information in the second authorization policy are repeated; When the validity information of the target element information in the first authorization policy is different from the validity information in the second authorization policy, it is determined that the target element information in the first authorization policy and the target element information in the second authorization policy are repeated as conflicting information.

11. A semantic computing device for authorization policy, characterized in that: The device comprises: A policy acquisition module, configured to acquire a first authorization policy and a second authorization policy; a language conversion module, configured to convert the first authorization policy and the second authorization policy into a first intermediate representation layer and a second intermediate representation layer, respectively, that conform to a preset grammatical structure; the preset grammatical structure being convertible between the grammatical structure to which the first authorization policy and the second authorization policy belong; The semantic calculation module is used to perform semantic calculation on the first intermediate representation layer and the second intermediate representation layer to obtain semantic calculation results of the first authorization policy and the second authorization policy.

12. An electronic device, characterized in that: The system comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method according to any one of claims 1 to 10.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the method according to any one of claims 1 to 10.

14. A computer program product comprising a computer program, characterized in that The computer program is executed by a processor to implement the method according to any one of claims 1 to 10.

Images