Method and apparatus for controlling authority, electronic device, and storage medium

Abstract

Embodiments of the present application provide a permission control method and device, electronic equipment and storage medium. The permission control method comprises: setting a target role for a subject based on a role in a preset ABAC permission management model, wherein the ABAC permission management model has a plurality of roles, the role has a permission set, the permissions in the permission set are determined based on resource classification, and the permissions include attribute description rules corresponding to the resource classification; and controlling the permissions of the subject based on the permission set described by the target role. In the ABAC permission management, the user describes the action and the rule by grouping the resources, and the order is stronger. Furthermore, the rule set is combined as a role and is bound with the subject to form an authorization relationship, so that the permission is easy to manage. In a complex business scenario, the difficulty of ABAC permission rule management is reduced, and the permission management and control based on rule definition role are realized.

Description

Technical Field

[0001] This invention relates to the field of access control technology, and in particular to an access control method, device, electronic device, and storage medium. Background Technology

[0002] In existing ABAC (Attribute-Based Access Control) permission models, permission rules are directly bound to subjects (such as users), leading to high management complexity and an excessive number of rules bound to a single subject. In other words, the ABAC permission model is rule-centric, radiating outwards to resources and actions. However, the rules themselves are not convergent and have very fine-grained descriptions. Therefore, in permission management, users can easily set a large number of rules for a single subject, resulting in disorganized and difficult-to-manage rules. Summary of the Invention

[0003] To address the problems in the prior art, embodiments of the present invention provide an access control method, apparatus, electronic device, and storage medium.

[0004] Specifically, the embodiments of the present invention provide the following technical solutions:

[0005] In a first aspect, embodiments of the present invention provide an access control method, including:

[0006] Based on the roles in the preset ABAC permission management model, target roles are set for the subject. The ABAC permission management model has multiple roles, each role has a permission set, and the permissions in the permission set are determined based on resource classification. The permissions include attribute description rules corresponding to the resource classification.

[0007] Based on the permission set described in the target role description, the permissions of the subject are controlled.

[0008] Furthermore, before assigning target roles to subjects based on the pre-defined roles in the ABAC access control model, the following steps are also included:

[0009] Based on the permissions of the selected resource category, create roles in the ABAC permission management model.

[0010] Furthermore, before creating roles in the ABAC permission management model based on the permissions of the selected resource category, the following steps are also included:

[0011] For the resource categories, one or more different permissions are set based on different attribute description rules.

[0012] Furthermore, the permissions in the permission set of the role description include permission scope, resource category, operation corresponding to the resource category, and attribute description rules corresponding to the resource category. The attribute description rules corresponding to the resource category include resource attribute rules, subject attribute rules, and environment attribute rules.

[0013] Furthermore, for the aforementioned resource classification, one or more different permissions are set based on different attribute description rules, including:

[0014] For the resource classification, attribute description rules corresponding to the resource classification are created based on at least one of resource attribute rules, subject attribute rules, and environmental attribute rules.

[0015] Based on the attribute description rules corresponding to the created resource category, set one or more different permissions.

[0016] Furthermore, the attributes include subject attributes, operation attributes, object attributes, and environment attributes, and the subject includes users, services, applications, and terminal devices.

[0017] Furthermore, it also includes: generating a rule execution tree for verifying the attribute description rules for each resource category based on the attribute description rules, so as to verify the attribute description rules through the rule execution tree.

[0018] Secondly, embodiments of the present invention also provide an access control device, comprising:

[0019] The setting module is used to set target roles for a subject based on roles in a preset ABAC permission management model. The ABAC permission management model has multiple roles, each role has a permission set, and the permissions in the permission set are determined based on resource classification. The permissions include attribute description rules corresponding to the resource classification.

[0020] The access control module is used to control the permissions of the subject based on the permission set described in the target role.

[0021] Thirdly, embodiments of the present invention also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the access control method as described in the first aspect.

[0022] Fourthly, embodiments of the present invention also provide a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the access control method as described in the first aspect.

[0023] Fifthly, embodiments of the present invention also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the access control method as described in the first aspect.

[0024] As can be seen from the above technical solutions, the permission control method, device, electronic device, and storage medium provided in the embodiments of the present invention, based on the roles in the preset ABAC permission management model, set target roles for subjects. Since the permissions of roles are determined based on resource classification, this method can radiate outwards from resources as the center to actions and rules. Because resources themselves are convergent and have a coarser granularity of description, in ABAC permission management, users describe actions and rules by grouping resources, resulting in a more organized approach. Furthermore, combining sets of rules into roles and binding them with subjects forms an authorization relationship, making permissions easier to manage. In complex business scenarios, this reduces the difficulty of ABAC permission rule management and realizes permission management and control based on role definitions according to rules. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 A flowchart of an access control method provided in an embodiment of the present invention;

[0027] Figure 2 This is a structural block diagram of an access control device provided in an embodiment of the present invention;

[0028] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] Figure 1 A flowchart of the access control method provided by an embodiment of the present invention is shown. Figure 1As shown, the access control method provided in this embodiment of the invention includes the following steps:

[0031] Step 101: Based on the roles in the preset ABAC permission management model, set target roles for the subject. The ABAC permission management model has multiple roles, each role has a permission set, and the permissions in the permission set are determined based on resource classification. The permissions include attribute description rules corresponding to the resource classification.

[0032] ABAC is an attribute-based permission management model, which includes subject attributes, operation attributes, object attributes, and context attributes (environment attributes). Subject attributes include, for example, the subject's employee ID and job title; operation attributes include, for example, add, delete, and modify; and object attributes are also called resource attributes.

[0033] In the above description, the subject should be interpreted broadly, including, but not limited to, actual users, applications, services, and terminal devices. Rules are expressions of attributes.

[0034] In this embodiment of the invention, the role refers to a role in attribute-based access control (ABAC). In other words, the ABAC permission management model of this embodiment pre-defines multiple roles, each role being a set of permissions. Each permission set includes at least one permission, which is determined based on resource classification. Furthermore, the permissions include attribute description rules corresponding to the resource classification. For example, for a resource classification, such as resource A, multiple different permissions can be set, such as three different permissions. These three different permissions all correspond to resource A. That is, resource A can have three types of permissions, each determined by different attribute description rules.

[0035] Since the access control method of this embodiment is based on roles in the ABAC access control model, before setting a target role for a subject based on the roles in the preset ABAC access control model, the method needs to establish the ABAC access control model. For example, roles in the ABAC access control model can be created based on the permissions of the selected resource category. In this example, before creating roles in the ABAC access control model based on the permissions of the selected resource category, the method further includes: for the resource category, setting one or more different permissions based on different attribute description rules. Specifically, for the resource category, attribute description rules corresponding to the resource category are created based on at least one of resource attribute rules, subject attribute rules, and environment attribute rules; and one or more different permissions are set based on the created attribute description rules corresponding to the resource category.

[0036] For example, resource A might have three different permissions: permission 1, permission 2, and permission 3. Each permission is determined based on different attribute description rules. In other words, resource A can have three different permissions. Correspondingly, multiple roles can be set for resource A based on these different permissions. For example, three roles can be set for each of the three permissions for resource A.

[0037] In one embodiment of the present invention, the permissions in the permission set of the role description include permission scope, resource category, operation corresponding to the resource category, and attribute description rules corresponding to the resource category. Further, the attribute description rules corresponding to the resource category include, but are not limited to, resource attribute rules, subject attribute rules, and environment attribute rules, wherein the environment attribute rules can also be called context attribute rules.

[0038] As a concrete example, a permission can be described by a four-tuple (domain, category, action, tags), where:

[0039] domain: the scope of permissions, which is generally an organization, product, or asset, etc.

[0040] Category: Resource classification, such as: user, branch, terminal, etc.;

[0041] actions: Multiple operations corresponding to resource categories, such as read, write, delete, etc.

[0042] tags: Attribute description rules corresponding to resource categories, for example: sector = "XX Company / XX Department / Identity Platform Group".

[0043] Tags can be divided into ResourceTag, SubjectTag, and SessionTag (contextual attribute rules), among which:

[0044] Resource attribute rules (ResourceTag) can be described as follows: "The grouping attribute of the [User] resource is [Company / Department / Identity Platform Group]".

[0045] Subject attribute rules, such as SubjectTag, can be described as follows: the subject's [gender] attribute is [male].

[0046] Contextual attribute rules, such as SessionTag, can be described as follows: the context's "time" attribute is from 0:00 to 6:00.

[0047] In one embodiment of the present invention, the access control method further includes: generating a rule execution tree for validating attribute description rules for each resource category based on attribute description rules, so as to validate the attribute description rules through the rule execution tree. That is, rule execution is generated for each resource with each attribute description rule as the center, thereby improving the efficiency of attribute description rule validation. For example, the rule execution tree includes branches corresponding to each resource category, and the validation performed on each branch is specific to the resource category corresponding to that branch. Thus, when an attribute description rule needs to be validated, it is not necessary to traverse all validation functions as in existing validation methods. Instead, the resource category corresponding to the attribute description rule is first determined, and then validation is performed through that branch. Therefore, traversal is not required, effectively improving the execution efficiency of rule validation.

[0048] According to the permission control method of this invention, target roles are set for subjects based on roles in a preset ABAC permission management model. Since the permissions of roles are determined based on resource classification, this method can radiate outward from resources to actions and rules. Because resources themselves are convergent and have a coarse-grained description, in ABAC permission management, users describe actions and rules by resource grouping, resulting in a more organized approach. Furthermore, the set of rules is combined into roles and bound to subjects to form an authorization relationship, making permissions easier to manage. In complex business scenarios, this reduces the difficulty of ABAC permission rule management and realizes permission management and control based on role definition of rules.

[0049] Figure 2 A schematic diagram of the access control device provided in an embodiment of the present invention is shown. Figure 2 As shown, the access control device provided in this embodiment includes: a setting module 210 and an access control module 220, wherein:

[0050] The setting module 210 is used to set target roles for a subject based on roles in a preset ABAC permission management model. The ABAC permission management model has multiple roles, each role has a permission set, and the permissions in the permission set are determined based on resource classification. The permissions include attribute description rules corresponding to the resource classification.

[0051] The permission control module 220 is used to control the permissions of the subject according to the permission set described by the target role.

[0052] According to the permission control device of this invention, target roles are set for subjects based on roles in a preset ABAC permission management model. Since the permissions of roles are determined based on resource classification, this method can radiate outward from resources to actions and rules. Because resources themselves are convergent and have a coarse-grained description, in ABAC permission management, users describe actions and rules by resource grouping, resulting in a more organized approach. Furthermore, the set of rules is combined into roles and bound to subjects to form an authorization relationship, making permissions easier to manage. In complex business scenarios, this reduces the difficulty of ABAC permission rule management and realizes permission management and control based on role definition of rules.

[0053] According to one embodiment of the present invention, before setting a target role for a subject based on roles in a preset ABAC permission management model, the method further includes:

[0054] Based on the permissions of the selected resource category, create roles in the ABAC permission management model.

[0055] According to one embodiment of the present invention, before creating roles in the ABAC permission management model based on the permissions of the selected resource category, the method further includes:

[0056] For the resource categories, one or more different permissions are set based on different attribute description rules.

[0057] According to one embodiment of the present invention, the permissions in the permission set of the role description include permission scope, resource category, operation corresponding to the resource category, and attribute description rules corresponding to the resource category, wherein the attribute description rules corresponding to the resource category include resource attribute rules, subject attribute rules, and environment attribute rules.

[0058] According to one embodiment of the present invention, for the resource classification, one or more different permissions are set based on different attribute description rules, including:

[0059] For the resource classification, attribute description rules corresponding to the resource classification are created based on at least one of resource attribute rules, subject attribute rules, and environmental attribute rules.

[0060] Based on the attribute description rules corresponding to the created resource category, set one or more different permissions.

[0061] According to one embodiment of the present invention, the attributes include subject attributes, operation attributes, object attributes, and environment attributes, wherein the subject includes user, service, application, and terminal device.

[0062] According to one embodiment of the present invention, the attributes include subject attributes, operation attributes, object attributes, and environment attributes, wherein the subject includes user, service, application, and terminal device.

[0063] According to one embodiment of the present invention, the method further includes: generating a rule execution tree for verifying the attribute description rules for each resource category based on the attribute description rules, so as to verify the attribute description rules through the rule execution tree.

[0064] Since the permission control device provided in this embodiment of the invention can be used to execute the permission control method described in the above embodiment, and its working principle and beneficial effects are similar, it will not be described in detail here. For details, please refer to the description of the above embodiment.

[0065] In this embodiment, it should be noted that the various modules in the device of the present invention can be integrated into one unit or deployed separately. The above modules can be combined into one module or further divided into multiple sub-modules.

[0066] Based on the same inventive concept, another embodiment of the present invention provides an electronic device, see [link to previous document]. Figure 3 The electronic device specifically includes the following components: processor 401, memory 402, communication interface 403, and communication bus 404;

[0067] The processor 401, memory 402, and communication interface 403 communicate with each other through the communication bus 404.

[0068] The processor 401 is used to call the computer program in the memory 402. When the processor executes the computer program, it implements all the steps of the above-mentioned permission control method. For example, when the processor executes the computer program, it implements the following process: based on the roles in the preset ABAC permission management model, a target role is set for the subject. The ABAC permission management model has multiple roles, and each role has a permission set. The permissions in the permission set are determined based on resource classification, and the permissions include attribute description rules corresponding to the resource classification. Based on the permission set described by the target role, the permissions of the subject are controlled.

[0069] It is understood that the refined and extended functions that the computer program can execute can be referred to the description of the above embodiments.

[0070] Based on the same inventive concept, another embodiment of the present invention provides a non-transitory computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements all the steps of the above-described access control method. For example, when the processor executes the computer program, it performs the following process: setting a target role for a subject based on roles in a preset ABAC access control model, wherein the ABAC access control model has multiple roles, each role has a set of permissions, and the permissions in the set of permissions are determined based on resource classification, the permissions including attribute description rules corresponding to the resource classification; and controlling the subject's permissions based on the set of permissions described by the target role.

[0071] It is understood that the refined and extended functions that the computer program can execute can be referred to the description of the above embodiments.

[0072] Based on the same inventive concept, another embodiment of the present invention provides a computer program product, which includes a computer program that, when executed by a processor, implements all the steps of the above-described permission control method. For example, when the processor executes the computer program, it implements the following process: setting a target role for a subject based on roles in a preset ABAC permission management model, wherein the ABAC permission management model has multiple roles, each role has a permission set, and the permissions in the permission set are determined based on resource classification, the permissions including attribute description rules corresponding to the resource classification; and controlling the permissions of the subject based on the permission set described by the target role.

[0073] It is understood that the refined and extended functions that the computer program can execute can be referred to the description of the above embodiments.

[0074] Furthermore, the logical instructions in the aforementioned memory can be implemented as software functional units and sold or used as independent products, and can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0075] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the embodiments of the present invention according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0076] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the traffic auditing method described in various embodiments or some parts of embodiments.

[0077] Furthermore, in this invention, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0078] Furthermore, in this invention, the use of terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refers to a specific feature, structure, material, or characteristic described in connection with that embodiment or example, which is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0079] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for access control, characterized in that, include: Based on the roles in the preset ABAC permission management model, target roles are set for the subject. The ABAC permission management model has multiple roles, and each role has a permission set. The permissions in the permission set are determined based on resource classification, including at least one permission, and each permission is determined according to the different attribute description rules corresponding to the resource classification. Based on the permission set described in the target role description, the permissions of the subject are controlled; It also includes: generating a rule execution tree branch for validating the attribute description rules for each resource category based on the attribute description rules, so as to validate the attribute description rules through the rule execution tree branch; wherein the attribute description rules are created based on at least one of resource attribute rules, subject attribute rules and environment attribute rules.

2. The access control method according to claim 1, characterized in that, Before assigning target roles to subjects in the pre-defined ABAC access control model, the following steps are also included: Based on the permissions of the selected resource category, create roles in the ABAC permission management model.

3. The access control method according to claim 2, characterized in that, Before creating roles in the ABAC permission management model based on the permissions of the selected resource category, the following steps are also included: For the resource categories, one or more different permissions are set based on different attribute description rules.

4. The access control method according to claim 3, characterized in that, The permissions in the permission set described in the role description include permission scope, resource category, operation corresponding to the resource category, and attribute description rules corresponding to the resource category. The attribute description rules corresponding to the resource category include resource attribute rules, subject attribute rules, and environment attribute rules.

5. The access control method according to claim 4, characterized in that, For the aforementioned resource categories, one or more different permissions are set based on different attribute description rules, including: For the resource classification, attribute description rules corresponding to the resource classification are created based on at least one of resource attribute rules, subject attribute rules, and environmental attribute rules. Based on the attribute description rules corresponding to the created resource category, set one or more different permissions.

6. An access control device, characterized in that, include: The setting module is used to set target roles for a subject based on roles in a preset ABAC permission management model. The ABAC permission management model has multiple roles, and each role has a permission set. The permissions in the permission set are determined based on resource classification, including at least one permission, and each permission is determined according to the different attribute description rules corresponding to the resource classification. The access control module is used to control the permissions of the subject based on the permission set described by the target role. It also includes: generating a rule execution tree branch for validating the attribute description rules for each resource category based on the attribute description rules, so as to validate the attribute description rules through the rule execution tree branch; wherein the attribute description rules are created based on at least one of resource attribute rules, subject attribute rules and environment attribute rules.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the access control method according to any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the access control method according to any one of claims 1 to 5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the access control method according to any one of claims 1 to 5.

Images