A method and apparatus for dynamically controlling operation permissions, a computing device, and a storage medium

Abstract

The application discloses an operation permission dynamic control method and device, a computing device and a storage medium, and relates to the technical field of computer operation permission control. The method comprises the following steps: acquiring initial operation permission information of a client; determining an associated container of the client based on the initial operation permission information of the client, copying the associated container to obtain a copied container; determining an operation behavior record of the client according to the associated container and the copied container of the client; updating the operation permission information of the client according to the operation behavior record; and controlling the operation permission of the client for the associated container according to the updated operation permission information. The application can update the operation permission information of the client in real time based on the operation behavior record of the client, has more detailed operation permission control for container operation, and avoids malicious operation or misoperation of the client on the container on the host.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and specifically to a method, apparatus, computing device, and storage medium for dynamic control of operation permissions. Background Technology

[0002] Docker is an open-source application container engine that allows developers to package their applications and dependencies into a portable container and deploy it on any popular Linux or Windows machine. This portable container uses a sandbox mechanism. In existing technologies, any client with permission to log in to the host where the container is deployed has the authority to read, write, modify, and restart all containers. Host resources are typically large, and to fully utilize them, a single host is often shared by multiple systems or projects, with containers from multiple systems deployed on the same host. Containers on the same host have the same access permissions for all logged-in clients, and these permissions are not further categorized. For example, a user on system A may have permission to operate containers on system A, and also have permission to view and modify containers on system B. Therefore, malicious or accidental operations can pose a risk to the system. Summary of the Invention

[0003] In view of the above problems, the present invention is proposed to provide a method, apparatus, computing device and storage medium for dynamic control of operation permissions that overcomes or at least partially solves the above problems.

[0004] According to one aspect of the present invention, a method for dynamic control of operation permissions is provided, comprising:

[0005] Obtain the initial operation permission information of the client;

[0006] Based on the client's initial operation permission information, the associated container of the client is determined, and the associated container is copied to obtain a copied container;

[0007] The client's operation behavior records are determined based on the associated container and the replication container of the client;

[0008] Update the client's operation permission information based on the operation behavior record;

[0009] Based on the updated operation permission information, the client's operation permissions for the associated container are controlled.

[0010] According to another aspect of the present invention, a dynamic control device for operation permissions is provided, comprising:

[0011] The initial operation permission acquisition module is used to acquire the initial operation permission information of the client;

[0012] The copy container determination module is used to determine the associated container of the client based on the client's initial operation permission information, and copy the associated container to obtain a copy container;

[0013] The operation behavior record determination module is used to determine the operation behavior record of the client based on the associated container and the replication container of the client;

[0014] An operation permission update module is used to update the client's operation permission information based on the operation behavior record;

[0015] The control module is used to control the client's operation permissions for the associated container based on the updated operation permission information.

[0016] According to another aspect of the present invention, a computing device is provided, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus;

[0017] The memory is used to store at least one executable instruction, which causes the processor to perform the operation corresponding to the above-described dynamic operation permission control method.

[0018] According to another aspect of the present invention, a computer storage medium is provided, wherein the storage medium stores at least one executable instruction, the executable instruction causing a processor to perform an operation corresponding to the above-described dynamic operation permission control method.

[0019] According to a method, apparatus, computing device, and storage medium for dynamic control of operation permissions based on the present invention, the method obtains initial operation permission information of a client; determines the client's associated containers based on the initial operation permission information, and copies the associated containers to obtain a copied container; determines the client's operation behavior records based on the client's associated containers and the copied container; updates the client's operation permission information based on the operation behavior records; and controls the client's operation permissions for the associated containers based on the updated operation permission information. The present invention dynamically updates the client's operation permission information in real time based on the client's operation behavior records, providing more granular control over container operations and preventing malicious or accidental operations by the client on containers on the host.

[0020] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0021] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0022] Figure 1 A flowchart of a dynamic operation permission control method provided by an embodiment of the present invention is shown;

[0023] Figure 2a A flowchart of another dynamic operation permission control method provided by an embodiment of the present invention is shown;

[0024] Figure 2b This diagram illustrates the container association of a client according to an embodiment of the present invention.

[0025] Figure 3a This diagram illustrates a backup container image fragmentation according to an embodiment of the present invention.

[0026] Figure 3b This diagram illustrates a method for rapid rollback using backup container image shards, as described in an embodiment of the present invention.

[0027] Figure 4 This diagram illustrates the structure of a dynamic operation permission control device provided in an embodiment of the present invention.

[0028] Figure 5 A schematic diagram of the structure of a computing device provided in an embodiment of the present invention is shown. Detailed Implementation

[0029] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this invention will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0030] Figure 1 A flowchart of another embodiment of the dynamic control method for operation permissions of the present invention is shown, as follows: Figure 1 As shown, the method includes the following steps:

[0031] S110: Obtain the client's initial operation permission information.

[0032] In an optional manner, step S110 further includes: in response to the client's container association request, associating the client with the corresponding associated container; obtaining the client's client information, the associated container's business monitoring information, and the host monitoring information, and determining the client's initial operation permission information.

[0033] In this step, the initial operation permission information of the client on the operation host for multiple associated containers is obtained. It should be noted that this initial operation permission information can be set to a fixed value in the backend of multiple associated containers, or it can be calculated based on the client's client information, the business monitoring information of the associated containers, and the host monitoring information.

[0034] S120: Determine the associated container of the client based on the client's initial operation permission information, and copy the associated container to obtain the copied container.

[0035] In an optional manner, step S120 further includes: if the client's initial operation permission information records that the client is prohibited from performing modification operations on the associated container, when a modification operation is received from the client on the associated container, the associated container is copied to obtain a first copied container and a second copied container.

[0036] Specifically, the operation permission information records the operations that are allowed and / or prohibited by the client to perform on the associated container. In this step, in response to the client's container association request, the corresponding associated container is associated for the client. If the client's initial operation permission information records that the client is prohibited from performing modification operations on the associated container, when the client's modification operation on the associated container is received, the associated container is copied to obtain the first copied container and the second copied container.

[0037] Step S130: Determine the client's operation behavior records based on the client's associated container and replication container.

[0038] In an optional manner, step S130 further includes: executing the instruction corresponding to the modification operation in the first replication container, synchronizing the host directory information corresponding to the modification operation to the second replication container, and backing up the container image shards based on the host directory information; determining whether the modification operation has a business impact on the first replication container; if so, triggering and recording the first alarm information for the client, and determining the client's operation behavior record based on the first alarm information; if not, executing the modification operation in the associated container.

[0039] In an optional manner, step S130 further includes: determining whether the modification operation has a business impact on the associated container; if so, triggering and recording a second alarm message for the client, determining the client's operation behavior record based on the second alarm message, and using the backed-up container image shards to perform rollback processing on the associated container; if not, deleting the backed-up container image shards.

[0040] Specifically, if the operation permission information records a restriction prohibiting clients from performing modification operations on associated containers, when a client's modification operation on an associated container is received, the associated container is copied to obtain a first copied container and a second copied container. The instruction corresponding to the modification operation is executed in the first copied container, and this instruction is cached. At this point, normal traffic continues to run normally in the associated container, while the instruction corresponding to the modification operation has not yet been actually executed. By analyzing whether the instruction corresponding to the modification operation generates a first alarm message in the first copied container, the associated container can be protected from damage by malicious or erroneous instructions. If no first alarm message is generated, it indicates that the execution of the modification operation within the first preset time period has not affected the business, and the modification operation is not problematic. An instruction is then sent to execute the cached instruction corresponding to the modification operation sequentially in the associated container.

[0041] While the first copy container executes the instruction corresponding to the modification operation, the host directory information corresponding to the modification operation is synchronized to the second copy container. The second copy container does not execute any operation instructions and retains the original stable version of the container environment. If a second alarm message is generated within a certain period of time (e.g., a second preset period) during the execution of the instruction corresponding to the modification operation in the associated container, and this affects the business, the associated container can be quickly rolled back using the backup container image shards.

[0042] If the first alarm message or the second alarm message is generated, the record of the operation behavior is obtained and saved.

[0043] Step S140: Update the client's operation permission information based on the operation behavior record.

[0044] In this step, based on the operation behavior record that generated the first or second alarm information, the client's operation permission information is updated on the basis of the initial operation permission information. Specifically, depending on the severity of the first or second alarm information, the client's operation permission information can be updated by prohibiting the client from performing certain operations on the associated container.

[0045] Step S150: Based on the updated operation permission information, control the client's operation permissions for the associated container.

[0046] The method in this embodiment obtains the client's initial operation permission information; determines the client's associated container based on the initial operation permission information, and copies the associated container to obtain a copied container; determines the client's operation behavior records based on the client's associated container and the copied container; updates the client's operation permission information based on the operation behavior records; and controls the client's operation permissions for the associated container based on the updated operation permission information. This method dynamically updates the client's operation permission information in real time based on the client's operation behavior records, providing more granular operation permission control for container operations and preventing the client from performing malicious or accidental operations on containers on the host.

[0047] Figure 2a A flowchart of another embodiment of the dynamic control method for operation permissions of the present invention is shown, as follows: Figure 2a As shown, the method includes the following steps:

[0048] Step S210: In response to the client's container association request, associate the corresponding associated container for the client.

[0049] In this step, all clients operating the host need to request which system containers they are associated with operating. Figure 2b A diagram illustrating container association on the client side, such as... Figure 2b As shown, a host deploys three containers from two systems, system1 and system2. For example, client1 requests to associate a container (service1-container) from system1, client2 requests to associate two containers (service2-container and service3-container) from system2, and client3 requests to associate all three containers from both system1 and system2. In response to these container association requests from the clients, the system associates the corresponding containers for each client.

[0050] Step S220: Obtain client information, associated container business monitoring information, and host monitoring information from the client, and determine the client's operation permission information.

[0051] In one optional approach, the client information includes: client attribute information and operation behavior records; step S220 further includes: determining the client's operation permission weight based on the client attribute information, business monitoring information, and host monitoring information; calculating the client's basic permission score based on the client's operation behavior records; and determining the client's operation permission information based on the operation permission weight and the basic permission score.

[0052] In one alternative approach, the client attribute information includes one or more of the following: role information, location information, and operation time of the client-initiated operation in the development process; business monitoring information includes: system throughput and concurrent processing of associated containers; host monitoring information includes: CPU utilization and memory usage of the host system.

[0053] Specifically, the client attribute information includes one or more of the following: role information corresponding to the development process, location information, and the operation time when the client initiates the operation. The role information corresponding to the development process refers to the different roles assigned to the operator corresponding to the client IP address within the development process; for example, development roles, testing roles, and operations and maintenance roles, each with different operation permissions. In practical applications, the operation permissions of each role can be adjusted through settings; for example, the operation permissions of development and testing roles are lower than those of operations and maintenance roles. In this embodiment, the role information corresponding to the development process can be referred to as Factor A, and the weight of the operation permissions for development and testing roles is set to 0.9, while the weight of the operation permissions for operations and maintenance roles is 0.95.

[0054] Location information refers to the location information corresponding to each client IP (hereinafter referred to as Factor B). For example, the operation permissions corresponding to the operation within and outside the company are different. Generally speaking, the operation permissions within the company are greater than those outside the company. In this embodiment, the weight corresponding to the operation permission within the company can be set to 0.95, and the weight corresponding to the operation permission outside the company can be set to 0.9.

[0055] The operation time (hereinafter referred to as Factor C) refers to whether the operation is initiated during the day or night. Generally, operation permissions at night are greater than those during the day. In this embodiment, the weight of operation permissions during the day can be set to 0.9, and the weight of operation permissions at night can be set to 0.95.

[0056] Furthermore, business monitoring information can be collected by installing plugins on each container. This business monitoring information includes: the system throughput (Transactions Per Second, TPS) and concurrent processing of the associated container; specifically, the real-time TPS (hereinafter referred to as Factor D1) and concurrent processing of the business modules deployed within the container (hereinafter referred to as Factor D2); host monitoring information includes: the central processing unit (CPU) utilization (hereinafter referred to as Factor D3) and memory utilization (hereinafter referred to as Factor D4) of the host system. Table 1 shows the range of indicator data for business monitoring information and host monitoring information and their corresponding operation permission weight values. As shown in Table 1, if the indicator data is relatively low, there is a greater operation permission; if the indicator data is relatively high, the operation permission will be reduced.

[0057]

[0058] Table 1. Data ranges of metrics for business monitoring information and host monitoring information, and their corresponding operation permission weights.

[0059] As shown in Table 1, factor D includes factors D1, D2, D3, and D4. If D1 < 10, D2 is 1, D3 is less than 5%, and D4 is less than 5%, then the corresponding operation authority weight for factor D is (1 + 1 + 1 + 1) / 4 = 1. If 10 < D1 < 100, 1 < D2 < 10, 5% < D3 < 10%, and D4 < 5%, then the corresponding operation authority weight for factor D is (1 + 1 + 1 + 0.9) / 4 = 0.975. If D1 > 10000, D2 > 1000, D3 > 50%, and D4 > 50%, then the corresponding operation authority weight for factor D is (0.7). 4) / 4 = 0.7.

[0060] Step S230: Based on the operation permission information, control the client's operation permissions for the associated container.

[0061] In an optional manner, step S230 further includes: calculating the client's permission score based on the operation permission weight and the basic permission score; matching the permission score with multiple preset score ranges, and using the operation permission information corresponding to the matching preset score range as the client's operation permission information.

[0062] In one alternative approach, the operation permission information records the operations that are allowed and / or prohibited for clients to perform against the associated container.

[0063] It is important to note that after associating the client with the corresponding container, the client's operation permissions also need to be initialized, for example... Figure 2bIn the example, client1 maps to one container of system1, client2 maps to two containers of system2, and client3 maps to all three containers. After initialization, client1, client2, and client3 have the same operation permissions (their corresponding basic permission scores can all be set to 100).

[0064] Furthermore, the client's permission score is calculated based on the operation permission weight and the basic permission score. If the permission score is within the first threshold range, the client is determined to be at the first level; if the permission score is within the second threshold range, the client is determined to be at the second level; if the permission score is within the third threshold range, the client is determined to be at the third level; if the permission score is within the fourth threshold range, the client is determined to be at the fourth level. Among these, the first level is all system containers on the readable and writable host; the second level is associated readable and writable containers, and / or, readable other system containers; the third level is associated readable and writable containers; and the fourth level is associated readable containers.

[0065] For example, the first threshold range for the first level can be set to 85-100 points, with corresponding operation permissions of reading and writing all system containers on the host; the second threshold range for the second level can be 70-84 points, with corresponding operation permissions of reading and writing only the associated container, and reading other system containers; the third threshold range for the third level can be 60-69 points, with corresponding operation permissions of reading and writing only the associated container; and the fourth threshold range for the fourth level can be less than or equal to 60 points, with corresponding operation permissions of reading only the associated container and not writing to the associated system containers.

[0066] For example, if client1's IP corresponds to a development role in the R&D process (factor A = 0.95), its location is within the company (factor B = 0.95), and the operation time is evening (factor C = 0.95), and the associated container's business monitoring information and host monitoring information D1 = 5, D2 = 1, D3 = 3%, D4 = 3%, which are all within range 1 in Table 1, then D = 1, and client1's operation permission score = 100. A B C D is 100 0.95 0.95 0.95 1 = 85.7375, corresponding to the first level, meaning the operation permission information is all containers on the read-write host. Assuming the weights of factors A, B, C, and D for client2 are 0.95, 0.95, 0.95, and 0.975 respectively, then client2's operation permission score is 100. 0.95 0.95 0.95 0.975 = 83.594, corresponding to the second level, which allows read-write access to the associated system container and read access to other system containers; assuming client3's operation permission score is 100. 0.95 0.95 0.95 0.7 = 60.0163, corresponding to the third level, a read-only and write-only associated system. Table 2 shows the permission scores and corresponding levels of the three clients in the above example.

[0067]

[0068] Table 2 shows the permission scores and corresponding levels of the three clients in the example.

[0069] It should be noted that during the process of a client connecting to the system container, the client's operation behavior on the host is recorded, resulting in an operation behavior record. Therefore, as the operation behavior record changes, the client's basic permission score will also change. The client's corresponding level can be continuously calculated based on the operation behavior record and operation permission weight, and the client can be controlled according to the corresponding level to have read, write, or read-write permissions on the container associated with the corresponding request.

[0070] In an alternative approach, the method may further include steps S240-S280:

[0071] Step S240: If the operation permission information record prohibits the client from performing modification operations on the associated container, when the client performs a modification operation on the associated container, the associated container is copied to obtain the first copied container and the second copied container.

[0072] Step S250: Execute the instruction corresponding to the modification operation in the first replication container, and synchronize the host directory information corresponding to the modification operation to the second replication container. Back up the container image fragments based on the host directory information.

[0073] Step S260: Determine whether the modification operation has a business impact on the first replication container; if yes, proceed to step 270; if no, proceed to step 280.

[0074] Step S270: Trigger and record the first alarm information for the client.

[0075] Step S280: Perform the modification operation in the associated container.

[0076] In one alternative approach, after performing the modification operation in the associated container, step S280 further includes: determining whether the modification operation has a business impact on the associated container; if so, triggering and recording a second alarm message for the client, and using the backed-up container image shards to roll back the associated container; if not, deleting the backed-up container image shards.

[0077] Specifically, if the operation permission information records a restriction prohibiting clients from performing modification operations on associated containers, when a client's modification operation on an associated container is received, the associated container is copied to obtain a first copied container and a second copied container. The instruction corresponding to the modification operation is executed in the first copied container, and this instruction is cached. At this point, normal traffic continues to run normally in the associated container, while the instruction corresponding to the modification operation has not yet been actually executed. By analyzing whether the instruction corresponding to the modification operation generates a first alarm message in the first copied container, the associated container can be protected from damage by malicious or erroneous instructions. If no first alarm message is generated, it indicates that the execution of the modification operation within the first preset time period has not affected the business, and the modification operation is not problematic. An instruction is then sent to execute the cached instruction corresponding to the modification operation sequentially in the associated container.

[0078] While the first copy container executes the instructions corresponding to the modification operation, the host directory information corresponding to the modification operation is synchronized to the second copy container. The second copy container does not execute any operation instructions and retains the original stable version of the container environment. Figure 3a This diagram illustrates the backup container image sharding in this embodiment. Figure 3a As shown, based on the host directory information modified by the corresponding instruction, the container image shards are backed up according to the host directory information dimension. For example, if instruction 1 (command1) modifies the / home directory of the first replicated container host, then the container shard of the second replicated container 1.1 is packaged into an image (i.e., a container image shard) and uploaded to the image repository. If instruction 2 (command2) modifies the / etc directory of the first replicated container host, then the container image shard of the second replicated container 1.3 is backed up and uploaded to the image repository. The container image shards are stored using a linked list.

[0079] If a second alarm is generated within a certain period of time (e.g., the second preset period) when the instruction corresponding to the modification operation is executed in the associated container, and this affects the business, the associated container can be quickly rolled back using the backup container image shards. Figure 3b This diagram illustrates the process of quickly rolling back container images using backup shards after a problem occurs. Figure 3bAs shown, specifically, by downloading container image fragments 1.1 and 1.3, and since container image fragments are stored using a linked list, during the rollback process, either container image fragment 1.1 or 1.3 is automatically used to overwrite the modified original image, completing a fast rollback installation of the system containers. After the second preset time period, the second alarm message disappears, the business runs normally, and the stored linked lists of container image fragments 1.1 and 1.3 are deleted, reducing the storage pressure on the image repository.

[0080] In one optional approach, the first and second alarm information include: critical alarm, severe alarm, and moderate alarm. Specifically, if a critical alarm occurs, the corresponding client's basic privilege score is reduced by a first score (e.g., 10 points); if a severe alarm occurs, the corresponding client's basic privilege score is reduced by a second score (e.g., 3 points); and if a moderate alarm occurs, the corresponding client's basic privilege score is reduced by a third score (e.g., 1 point).

[0081] Specifically, the parameter values ​​of the first preset duration x and the second preset duration y are related to the impact level of the instruction corresponding to the modification operation. If the impact level of the instruction corresponding to the modification operation is divided into 1-10 levels, with level 1 being the highest, and the impact level of the instruction corresponding to the modification operation is defined as level 1, then the values ​​of x and y are directly taken from the configured time. If the impact level of the instruction corresponding to the modification operation is level 2, and the scope of the modification is defined as level 2, then the values ​​of x and y are x / 2 and y / 2, respectively. This ensures that there is a longer observation time x / {highest impact level} and a longer rollback container image shard storage time y / {highest impact level} for operations with higher impact levels.

[0082] Furthermore, if a first alarm is generated within the execution time *x* of the instruction corresponding to the modification operation in the first replication container, the first alarm is sent to the operations and maintenance personnel. The operations and maintenance personnel need to intervene and check the first alarm to determine whether the instruction corresponding to the modification operation needs to continue execution. At the same time, since the instruction corresponding to the modification operation, the host directory information corresponding to the modification operation, and the container image shards are cached, the rollback can be automatically performed according to the backed-up container image shards to narrow down the operation behavior that caused the problem. Table 3 shows the instruction corresponding to the modification operation and its corresponding information. As shown in Table 3, for example, if a first alarm is generated in the first replication container (e.g., a fatal alarm), the container image shard list 1.1 can be rolled back to overwrite the first replication container, and the alarm situation can be observed. If the first alarm stops at this time, it means that the instructions corresponding to instruction numbers 1 and 2 have affected the associated containers; if the first alarm does not stop, the container image shard list 1.3 can be rolled back to overwrite the first replication container, and the alarm situation can be observed.

[0083]

[0084] Table 3 shows the corresponding instructions and information for the modification operations.

[0085] Combining steps S210-S280, the method of this embodiment is adopted, such as... Figure 2b In the example, client1 is associated with one container of system1, client2 is associated with two containers of system2, and client3 is associated with all three containers. After initialization, client1, client2, and client3 have the same operation permissions (they can all be set to a basic permission score of 100). The following scenarios 1-4 may occur.

[0086] Scenario 1: Client1 is a client of system1, but performs modifications to the system container of system2 outside of its authorized permissions. Each modification that triggers the first alert in the first replicated container results in a deduction of points. If the first alert contains a fatal alert, this action will deduct 10 points from the basic permission score. Client1's basic permission score is 100-10=90, and the operation permission weight is 0.95. 0.95 0.95 1. Therefore, the permission score is equal to 90. 0.95 0.95 0.95 1 = 77.164, within the second threshold range, becomes the second level. Table 4 shows the permission scores and levels of each client in case 1. As shown in Table 4, client2 and client1 still maintain the permission scores and levels in Table 2.

[0087]

[0088] Table 4 shows the permission scores and levels for each client in scenario 1.

[0089] Scenario 2: Client2 is a client of system2 and operates on the system container of system1. Each operation that triggers the first alarm message in the first replication container results in a deduction of points. The first alarm message contains two critical alarms and one moderate alarm; a critical alarm deducts 3 points, and a moderate alarm deducts 1 point. Client2's basic permission score becomes 83.594 - 6 - 1 = 76.594, and the operation permission weight is 0.95. 0.95 0.95 Table 5 shows the permission scores and corresponding levels for each client in scenario 2. As shown in Table 5, client2's permission score is 76.594. 0.95 0.95 0.95 0.975 = 64.028, the level becomes 3.

[0090]

[0091] Table 5. Permission scores and corresponding levels for each client in scenario 2.

[0092] Scenario 3: Client2 continues to operate on other system containers and triggers the first alarm message. The total score drops below 60, and the level is reduced to the fourth level. The operation permission changes to: after client2 logs into the host, it can only read the associated system container and cannot write to the associated system container. When it performs write or modification operations, it will trigger the first alarm message and cache the corresponding instruction for modification operation. Running it in the first replication container ensures that no alarm message is generated. The cached instruction will only be executed in the associated container after the operation and maintenance personnel intervene and grant operation permissions.

[0093] Scenario 4: Each time a client performs a modification operation, it runs without generating alarms in the first replication container, and there are no issues after a duration x observation period. Based on the highest impact level of the command corresponding to the modification operation, safe and reliable operations will receive a bonus to the client. For example, if client2 currently has a basic permission score of 70, its permission score is: 70. 0.95 0.95 0.95 0.975 = 58.516, the client performed a modification operation, the operation instructions are shown in Table 6:

[0094]

[0095] Table 6 shows the commands and related information for client2 performing modification operations.

[0096] The above modification operation's corresponding instruction ran without generating any alarms in the first replication container, had no issues during the observation period (duration x), and did not experience any rollback during the image caching period (duration y). The highest impact level for the modification operation's instruction is level 2. Therefore, after client2 completes this operation, its base score becomes: {current score} + 1 / {impact level} = 70 + 1 / 2 = 70.5 points. Multiplying this by the operation permission weights ABCD, and dynamically adjusting the permission scores for each client based on their current score, client2's current score is 70.5. 0.95 0.95 0.95 0.975 = 58.934. As you can see, a critical alarm deducts 10 points, a serious alarm deducts 3 points, and a moderate alarm deducts 1 point. However, a single command with the highest impact level and no alarms only adds 1 base point. Therefore, each client needs to be more cautious with every modification operation.

[0097] The method of this embodiment responds to the container association request from the client and associates the client with the corresponding associated container; obtains the client's client information, the business monitoring information of the associated container, and the host monitoring information to determine the client's operation permission information; and controls the client's operation permissions for the associated container based on the operation permission information. This invention determines the operation permission information of clients sending container association requests based on client information, business monitoring information of the associated container, and host monitoring information. Appropriate operation permissions are assigned according to this information. The data sources used for permission control are more comprehensive, providing more granular control over container operations and preventing malicious or accidental operations by clients on the host. The invention also determines the client's operation permission weight based on client attribute information, the business monitoring information, and the host monitoring information. A basic permission score is calculated in real-time based on the client's operation behavior records. A permission score is calculated based on the basic permission score and the operation permission weight. Operation permission levels are assigned according to these scores, and operation permissions are dynamically allocated based on these levels. For clients with lower levels, writing or modifying operations on the associated container will trigger an alarm, notifying the relevant system maintenance personnel. Only after authorization from maintenance personnel can further writing or modify operations be performed on the associated system container. Subsequently, the basic permission score is increased or decreased based on the operation records, enabling real-time intelligent adjustment of operation permissions according to multi-dimensional data.

[0098] Figure 4 A schematic diagram of an embodiment of the dynamic control device for operation permissions according to the present invention is shown. Figure 4 As shown, the device includes: an association module 410, an operation permission determination module 420, a dynamic control module 430, and a dynamic processing module 440.

[0099] The association module 410 is used to respond to the client's container association request and associate the corresponding associated container for the client.

[0100] The operation permission determination module 420 is used to obtain client information, associated container business monitoring information, and host monitoring information from the client to determine the client's operation permission information.

[0101] In one optional approach, the client information includes: client attribute information and operation behavior records; the operation permission determination module 420 is further used to: determine the client's operation permission weight based on the client attribute information, business monitoring information, and host monitoring information; calculate the client's basic permission score based on the client's operation behavior records; and determine the client's operation permission information based on the operation permission weight and the basic permission score.

[0102] In one alternative approach, the client attribute information includes one or more of the following: role information, location information, and operation time of the client-initiated operation in the development process; business monitoring information includes: system throughput and concurrent processing of associated containers; host monitoring information includes: CPU utilization and memory usage of the host system.

[0103] The dynamic control module 430 is used to control the client's operation permissions for associated containers based on operation permission information.

[0104] In an optional manner, the dynamic control module 430 is further configured to: calculate the client's permission score based on the operation permission weight and the basic permission score; match the permission score with multiple preset score ranges, and use the operation permission information corresponding to the matching preset score range as the client's operation permission information.

[0105] In one alternative approach, the operation permission information records the operations that are allowed and / or prohibited for clients to perform against the associated container.

[0106] In one optional embodiment, the device further includes a dynamic processing module 440, configured to: if the operation permission information records a prohibition on the client performing modification operations on the associated container, when a modification operation is received from the client on the associated container, copy the associated container to obtain a first copied container and a second copied container; execute the instruction corresponding to the modification operation in the first copied container and synchronize the host directory information corresponding to the modification operation to the second copied container; back up the container image fragments based on the host directory information; determine whether the modification operation has a business impact on the first copied container; if so, trigger and record a first alarm message for the client; if not, execute the modification operation in the associated container.

[0107] In an optional manner, the dynamic processing module 440 is further configured to: determine whether the modification operation has a business impact on the associated container; if so, trigger and record a second alarm message for the client, and use the backed-up container image shards to roll back the associated container; if not, delete the backed-up container image shards.

[0108] The apparatus of this embodiment responds to a container association request from a client, associating the client with a corresponding container; it obtains the client's client information, the associated container's business monitoring information, and the host monitoring information to determine the client's operation permission information; and based on the operation permission information, it controls the client's operation permissions for the associated container. This apparatus determines the operation permission information of the client sending the container association request based on the client's client information, the associated container's business monitoring information, and the host monitoring information, and assigns corresponding operation permissions according to the operation permission information. The data source dimensions on which permission control is based are more comprehensive, providing more granular operation permission control for container operations and preventing malicious or erroneous operations by the client on the host. This embodiment of the invention provides a non-volatile computer storage medium storing at least one executable instruction, which can execute one of the dynamic operation permission control methods in any of the above method embodiments.

[0109] Executable instructions can specifically be used to cause the processor to perform the following operations:

[0110] In response to a client's container association request, associate the corresponding container for the client;

[0111] Obtain client information, associated container business monitoring information, and host monitoring information to determine the client's operation permission information;

[0112] Based on the operation permission information, control the client's operation permissions for associated containers.

[0113] Figure 5 The diagram shows a structural schematic of an embodiment of the computing device of the present invention. The specific embodiments of the present invention do not limit the specific implementation of the computing device.

[0114] like Figure 5 As shown, the computing device may include:

[0115] Processor, Communications Interface, Memory, and Communications Bus.

[0116] The processor, communication interface, and memory communicate with each other via a communication bus. The communication interface is used to communicate with other network elements, such as clients or other servers. The processor executes programs, specifically the relevant steps in one of the above-described embodiments of the dynamic operation permission control method.

[0117] Specifically, the program may include program code, which includes computer operation instructions.

[0118] The processor may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The server may include one or more processors of the same type, such as one or more CPUs; or it may include processors of different types, such as one or more CPUs and one or more ASICs.

[0119] Memory is used to store programs. Memory may include high-speed RAM, and may also include non-volatile memory, such as at least one disk drive.

[0120] Specifically, the program can be used to cause the processor to perform the following operations:

[0121] In response to a client's container association request, associate the corresponding container for the client;

[0122] Obtain client information, associated container business monitoring information, and host monitoring information to determine the client's operation permission information;

[0123] Based on the operation permission information, control the client's operation permissions for associated containers.

[0124] The algorithms or displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, the embodiments of the present invention are not directed to any particular programming language. It should be understood that the content of the invention described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing the best mode of implementation of the invention.

[0125] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0126] Similarly, it should be understood that, in order to simplify the invention and aid in understanding one or more of the various inventive aspects, features of the embodiments of the invention are sometimes grouped together in a single embodiment, figure, or description thereof in the above description of exemplary embodiments of the invention. However, this disclosure should not be construed as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, the inventive aspect lies in fewer than all features of the single embodiment disclosed above. Therefore, the claims following the detailed description are hereby expressly incorporated into that detailed description, wherein each claim itself is a separate embodiment of the invention.

[0127] Those skilled in the art will understand that modules in the device of the embodiments can be adaptively changed and placed in one or more devices different from that embodiment. Modules, units, or components in the embodiments can be combined into a single module, unit, or component, and further, they can be divided into multiple sub-modules, sub-units, or sub-components. Except where at least some of such features and / or processes or units are mutually exclusive, any combination can be used to combine all features disclosed in this specification (including the accompanying claims, abstract, and drawings) and all processes or units of any method or device so disclosed. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstract, and drawings) may be replaced by an alternative feature that serves the same, equivalent, or similar purpose.

[0128] Furthermore, those skilled in the art will understand that although some embodiments herein include certain features included in other embodiments but not others, combinations of features from different embodiments are intended to be within the scope of the invention and form different embodiments. For example, any of the claimed embodiments can be used in any combination.

[0129] The various component embodiments of the present invention can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components according to the embodiments of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such a program implementing the present invention can be stored on a computer-readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0130] It should be noted that the above embodiments are illustrative of the invention and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be construed as limiting the order of execution.

Claims

1. A method for dynamically controlling operation permissions, characterized in that, include: Obtain the client's initial operation permission information; Based on the client's initial operation permission information, the associated container of the client is determined, and the associated container is copied to obtain a copied container; the copied container includes a first copied container and a second copied container; The client's operation behavior records are determined based on the associated container and the replication container of the client; Update the client's operation permission information based on the operation behavior record; Based on the updated operation permission information, control the client's operation permissions for the associated container; The step of determining the client's operation behavior records based on the client's associated container and replication container further includes: In the first replication container, execute the instruction corresponding to the client's modification operation, and synchronize the host directory information corresponding to the modification operation to the second replication container. Based on the host directory information, back up the container image fragments. If the modification operation does not affect the business operations of the first replicated container, the modification operation is performed in the associated container; the container image shard is used to roll back the associated container if the modification operation affects the business operations of the associated container. The step of determining the associated container of the client based on the client's initial operation permission information and copying the associated container to obtain a copied container further includes: If the client's initial operation permission information records that the client is prohibited from performing modification operations on the associated container, when a modification operation is received from the client on the associated container, the associated container is copied to obtain a first copied container and a second copied container.

2. The method according to claim 1, characterized in that, The step of obtaining the initial operation permission information of the client further includes: In response to a client's container association request, associate the corresponding associated container for the client; Obtain the client information of the client, the business monitoring information of the associated container, and the host monitoring information, and determine the initial operation permission information of the client.

3. The method according to claim 1, characterized in that, The step of determining the client's operation behavior records based on the client's associated container and replication container further includes: Determine whether the modification operation affects the business of the first replication container; if so, trigger and record the first alarm information for the client, and determine the operation behavior record of the client based on the first alarm information.

4. The method according to claim 3, characterized in that, After performing the modification operation in the associated container, the method further includes: Determine whether the modification operation has a business impact on the associated container; If so, a second alarm message for the client is triggered and recorded. The operation behavior record of the client is determined based on the second alarm message, and the associated container is rolled back using the backed-up container image shards. If not, delete the backed-up container image shards.

5. The method according to claim 2, characterized in that, The client information includes: client attribute information and operation behavior records; The process for determining the client's operation permission information is as follows: The operation permission weight of the client is determined based on the client attribute information, the service monitoring information, and the host monitoring information; Calculate the client's basic permission score based on the client's operation behavior records; The operation permission information of the client is determined based on the operation permission weight and the basic permission score.

6. The method according to claim 5, characterized in that, The process of determining the client's operation permission information based on the operation permission weight and the basic permission score includes: The client's permission score is calculated based on the operation permission weight and the basic permission score. The permission score is matched with multiple preset score ranges, and the operation permission information corresponding to the matching preset score range is used as the operation permission information of the client.

7. A dynamic control device for operation permissions, characterized in that, include: The initial operation permission acquisition module is used to obtain the client's initial operation permission information; The copy container determination module is used to determine the associated container of the client based on the client's initial operation permission information, and copy the associated container to obtain a copy container; the copy container includes a first copy container and a second copy container; The operation behavior record determination module is used to determine the operation behavior record of the client based on the associated container and the replication container of the client; An operation permission update module is used to update the client's operation permission information based on the operation behavior record; The control module is used to control the client's operation permissions for the associated container based on the updated operation permission information; The operation behavior recording and determination module is further used for: In the first replication container, execute the instruction corresponding to the client's modification operation, and synchronize the host directory information corresponding to the modification operation to the second replication container. Based on the host directory information, back up the container image fragments. If the modification operation does not affect the business operations of the first replicated container, the modification operation is performed in the associated container; the container image shard is used to roll back the associated container if the modification operation affects the business operations of the associated container. The replication container determination module is further used for: If the client's initial operation permission information records that the client is prohibited from performing modification operations on the associated container, when a modification operation is received from the client on the associated container, the associated container is copied to obtain a first copied container and a second copied container.

8. A computing device, characterized in that, include: The processor, memory, communication interface, and communication bus are provided, wherein the processor, memory, and communication interface communicate with each other via the communication bus. The memory is used to store at least one executable instruction, which causes the processor to perform an operation corresponding to the operation permission dynamic control method as described in any one of claims 1-6.

9. A computer storage medium, characterized in that, The storage medium stores at least one executable instruction, which causes the processor to perform an operation corresponding to the dynamic operation permission control method as described in any one of claims 1-6.

Images