A method and device for access control based on ownership and scope

Abstract

The present invention discloses an access control method and device based on ownership and scope. The access control method includes: collecting resource basic data and configuring ownership for each piece of resource basic data, wherein the resource basic data includes: resource type, resource domain, and resource path; dividing the resource basic data into different data resource sets according to resource type, and dividing the data resource sets into scopes according to resource domain; generating access rules based on the ownership, scope, and preset security policies of the resource basic data; upon receiving an access request, determining the accessible data that satisfies the access rule; and outputting the accessible data. By setting ownership for each piece of resource basic data, multi-level division can be achieved between each piece of resource basic data according to the level to which the ownership belongs. By dividing the scope, domain division can be achieved for each piece of data resource set, thereby achieving isolation between resource basic data and facilitating unified management of the data resource set.

Description

Technical Field

[0001] The present invention relates to the technical field of rights management, and in particular to an access control method and device based on ownership and scope. Background Art

[0002] With the development of information technology, the amount of information data is increasing. To ensure data security, various applications have increasingly stringent requirements for data access permissions. Access control, as a key component of information system security, is particularly important. Currently, the main access control models include ACL (Access Control List), DAC (Discretionary Access Control), MAC (Mandatory Access Control), and RBAC (Role-Based Access Control). RBAC supports the decoupling of operating subjects and access rights through abstract roles and is widely adopted by various information systems. However, when subjects and roles have a many-to-many relationship, permission management is inconsistent, operations are complex, and data isolation between different applications is not achieved. Summary of the Invention

[0003] The present invention overcomes the shortcomings of the prior art and, in response to the problems of data isolation and access between different applications, provides an access control method and device based on ownership and scope. By configuring ownership for each resource-based data and dividing the scope of the data resource set, a storage system for isolation management between all resource-based data is established. At the same time, the access permission relationship of accessible data is confirmed based on the tree-like relationship between ownership nodes, making access convenient and efficient, and facilitating the maintenance and management of user roles and resources in the system.

[0004] In order to solve the above technical problems, the technical solutions of the present invention are as follows:

[0005] The present invention provides an access control method based on ownership and scope, comprising:

[0006] Collect resource basic data and assign ownership to each piece of resource basic data. The resource basic data includes resource type, resource domain, and resource path.

[0007] Divide resource basic data into different data resource sets according to resource type, and divide the scope of data resource sets according to resource domain;

[0008] Generate access rules based on the ownership, scope and preset security policies of resource-based data;

[0009] Upon receiving an access request, determining that the access request satisfies the accessible data under the access rules;

[0010] Output accessible data.

[0011] By setting ownership for each resource-based data, you can implement multi-level division between each resource-based data according to the ownership level. By dividing the scope, you can achieve domain division of each data resource set, thus achieving isolation between resource-based data and ensuring security between data resource sets.

[0012] Access to resource-based data is achieved based on ownership and the nodes to which it belongs, which unifies the access control requirements of resource-based data and facilitates the unified management of data resource sets.

[0013] Preferably, determining that the access request satisfies the accessible data under the access rule includes:

[0014] Get access ownership in the access request;

[0015] Determine a first node corresponding to the access ownership in the data resource set, record the resource basic data corresponding to the first node as first accessible data, and the access requester has a first access right to the first accessible data;

[0016] Determine the descendant nodes of the first node, record the resource basic data corresponding to the descendant nodes of the first node as second accessible data, and the access requester has a second access right to the second accessible data;

[0017] The first access permission and the second access permission are different access permissions.

[0018] Preferably, the first access permission includes: view, create, edit, delete and configure;

[0019] The second access right includes: View.

[0020] Each resource-based data has one and only one ownership at any time, so that ownership can be used as the unique authentication identifier of the resource-based data. The resource-based data is divided based on ownership, and an ownership isolation mechanism is established to store resource-based data at different levels separately, thereby achieving basic access isolation to the resource-based data. At the same time, data duplication will not occur, and data isolation can be achieved more efficiently and accurately.

[0021] Preferably, when the access request includes an access scope, determining the accessible data that satisfies the access rule in the access request further includes:

[0022] Determine the second node after the access scope is expanded, record the resource basic data corresponding to the second node as third accessible data, and the access requester has a third access right to the third accessible data;

[0023] Determine the descendant nodes of the second node, record the resource basic data corresponding to the descendant nodes of the second node as fourth accessible data, and the access requester has a fourth access right to the fourth accessible data;

[0024] The third access permission and the fourth access permission are different access permissions.

[0025] Preferably, the third access permission includes: view, create, edit, delete and configure;

[0026] The fourth access right includes: viewing.

[0027] Each resource-based data can belong to multiple scopes at the same time. The data resource set is divided based on the scope. While achieving basic access isolation for resource-based data, the resource-based data in the same scope are associated, expanding the viewing permissions for resource-based data and achieving cross-level access to resource-based data.

[0028] Preferably, the resource path location method includes: URI location method.

[0029] Preferably, the attributes of the resource type include: capacity attributes, positioning attributes and extension attributes.

[0030] Preferably, the extended attributes include: user attributes, environment attributes and operation attributes.

[0031] The present invention also provides an access control device based on ownership and scope, comprising:

[0032] The first data module is used to collect resource basic data and configure ownership for each piece of resource basic data;

[0033] The second data module is used to divide the resource basic data into different data resource sets according to the resource type of the resource basic data, and to divide the data resource sets into scopes according to the resource domain of the resource basic data;

[0034] The rule generation module is used to generate access rules based on the ownership, scope and preset security policy of the resource basic data; the access judgment module is used to determine the accessible data that meets the access rules when receiving an access request;

[0035] Data output module, used to output accessible data.

[0036] The first data module sets ownership for each resource basic data, and the second data module divides the resource basic data into scopes. Multi-level division between each resource basic data can be achieved according to the level of ownership, thereby achieving isolation between resource basic data, ensuring security between data, and facilitating unified management of data resource sets.

[0037] Preferably, the access judgment module includes: an access parser and an access controller.

[0038] Compared with the prior art, the beneficial effects that can be achieved by at least one of the above technical solutions adopted in this specification include at least:

[0039] By setting ownership for each resource-based data, you can implement multi-level division between each resource-based data according to the ownership level. By dividing the scope, you can achieve domain division of each data resource set, thus achieving isolation between resource-based data and ensuring data security.

[0040] Access to resource-based data is achieved based on ownership and the nodes to which it belongs, which unifies the access control requirements of resource-based data and facilitates the unified management of data resource sets. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Other features, objects, and advantages of the present invention will become more apparent upon reading the detailed description of non-limiting embodiments made with reference to the following drawings. The drawings are provided for the purpose of illustrating preferred embodiments only and are not to be construed as limiting the present invention. Like reference characters are used throughout the drawings to designate like parts.

[0042] Figure 1 A flowchart of an access control method based on ownership and scope provided by the present invention;

[0043] Figure 2 A schematic structural diagram of an access control device based on ownership and scope provided by the present invention. DETAILED DESCRIPTION

[0044] In order to make the objectives, technical solutions and advantages of the present invention more clear, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific implementation method described herein is only an optimal embodiment of the present invention, which is only used to explain the present invention and does not limit the scope of protection of the present invention. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0045] Before discussing the exemplary embodiments in more detail, it should be mentioned that some exemplary embodiments are described as processes or methods depicted as flow charts. Although the flow charts describe the operations (or steps) as sequential processes, many of the operations (or steps) therein can be performed in parallel, concurrently, or simultaneously. In addition, the order of the operations can be rearranged. The process can be terminated when its operations are completed, but can also have additional steps not included in the figures; the process can correspond to a method, function, procedure, subroutine, subprogram, etc.

[0046] In order to make the contents of the present invention more clearly understood, the present invention is further described below in detail based on specific implementation methods in conjunction with the accompanying drawings.

[0047] Example: Figure 1 As shown, the embodiment of this specification provides an access control method based on ownership and scope, including:

[0048] Collect resource basic data and assign ownership to each piece of resource basic data. The resource basic data includes resource type, resource domain, and resource path.

[0049] Divide resource basic data into different data resource sets according to resource type, and divide the scope of data resource sets according to resource domain;

[0050] Generate access rules based on the ownership, scope and preset security policies of resource-based data;

[0051] Upon receiving an access request, determining that the access request satisfies the accessible data under the access rules;

[0052] Output accessible data.

[0053] During implementation, all business objects or master data objects that require access control are considered resources, and resource-based data of the resources are collected, including: resource type, resource domain and resource path; among them, resource type is used to classify resource-based data, and different types of resource-based data have different resource type attributes; resource domain is used to indicate the ownership relationship of resource-based data, and each resource-based data belongs to a certain subject; resource path is part of the description of the characteristics of resource-based data, which is generally the primary key of the resource. The storage location of the resource-based data can be found according to the resource path.

[0054] During implementation, ownership is configured for resource basic data. Through ownership, SaaS services can be divided into three levels, namely platform level, tenant level, and application level. When the ownership of resource basic data is at the platform level, the entire platform can query this resource basic data; when the ownership of resource basic data is at the tenant level, the tenant and its applications can query this resource basic data; when the ownership of resource basic data is at the application level, the application can query this resource basic data.

[0055] During implementation, resource basic data is divided into different data resource sets according to resource types, and data resource sets are divided into scopes according to resource domains to aggregate resources with the same information. For example, scopes are divided according to identity permissions, and all resource basic data with tenant identity permissions are divided into one scope, and all resource basic data with APP identity permissions are divided into one scope, etc.

[0056] During implementation, when the resource base data is within the scope to which it belongs, the resource base data is valid data. When the resource base data is moved out of the scope, the memory corresponding to the resource base data is released and the resource base data becomes invalid data.

[0057] During implementation, the ownership, scope, and other attributes of resource-based data are combined and access rules are generated based on pre-set security policies. When an access request satisfies the access rules, the subject issuing the access request is granted access rights and the accessible data is output; otherwise, the subject issuing the access request is denied access.

[0058] Preferably, each resource base data in each data resource set includes an access rule for protecting the resource base data from unauthorized access requests.

[0059] By setting ownership for each resource-based data, you can implement multi-level division between each resource-based data according to the ownership level. By dividing the scope, you can achieve domain division of each data resource set, thus achieving isolation between resource-based data and ensuring security between data resource sets.

[0060] Access to resource-based data is achieved based on ownership and the nodes to which it belongs, which unifies the access control requirements of resource-based data and facilitates the unified management of data resource sets.

[0061] In some implementations, determining that the access request satisfies the accessible data under the access rule includes:

[0062] Get access ownership in the access request;

[0063] Determine a first node corresponding to the access ownership in the data resource set, record the resource basic data corresponding to the first node as first accessible data, and the access requester has a first access right to the first accessible data;

[0064] Determine the descendant nodes of the first node, record the resource basic data corresponding to the descendant nodes of the first node as second accessible data, and the access requester has a second access right to the second accessible data;

[0065] The first access permission and the second access permission are different access permissions.

[0066] In some embodiments, the first access rights include: view, create, edit, delete, and configure;

[0067] The second access right includes: View.

[0068] During implementation, ownership is configured for each resource-based data. Ownership is a tree structure with an empty root node and multiple nodes. Without introducing ownership extension, the access ownership is determined to the first node corresponding to the data resource set. The resource-based data corresponding to the first node has the first access permission and supports viewing, creation, editing, deletion and configuration; the resource-based data corresponding to the descendant nodes of the first node has the second access permission and supports viewing.

[0069] In a specific embodiment, the access ownership is tenant1. In the absence of other access request restrictions, the resource base data corresponding to the first node owned by tenant1 has the first access permission, and the resource base data corresponding to the descendant nodes of the first node owned by tenant1 has the second access permission.

[0070] That is, when an access request satisfies the access rules, the user who issues the access request can view, create, edit, delete, and configure the resource base data corresponding to the first node owned by tenant1. The user who issues the access request can only view the resource base data corresponding to the descendant nodes of the first node.

[0071] The access permissions for resource basic data are shown in Table 1 below:

[0072] Table 1. Access rights list

[0073]

[0074] Each resource-based data has one and only one ownership at any time, so that ownership can be used as the unique authentication identifier of the resource-based data. The resource-based data is divided based on ownership, and an ownership isolation mechanism is established to store resource-based data at different levels separately, thereby achieving basic access isolation to the resource-based data. At the same time, data duplication will not occur, and data isolation can be achieved more efficiently and accurately.

[0075] In some implementations, when the access request includes an access scope, determining that the access request satisfies the accessible data under the access rule further includes:

[0076] Determine the second node after the access scope is expanded, record the resource basic data corresponding to the second node as third accessible data, and the access requester has a third access right to the third accessible data;

[0077] Determine the descendant nodes of the second node, record the resource basic data corresponding to the descendant nodes of the second node as fourth accessible data, and the access requester has a fourth access right to the fourth accessible data;

[0078] The third access permission and the fourth access permission are different access permissions.

[0079] In some embodiments, the third access permission includes: view, create, edit, delete, and configure;

[0080] The fourth access right includes: viewing.

[0081] During implementation, a scope is configured for each resource-based data element. A scope is a fundamental form of ownership extension. A scope consists of a number representing the ownership hierarchy: -1 represents only the current node, 0 represents the root node and its descendant nodes, 1 represents the first-level node and its descendant nodes, 2 represents the second-level node and its descendant nodes, and so on. With a scope, access to the resource-based data corresponding to the second node after the scope is extended grants third-level access rights, allowing viewing, creation, editing, deletion, and configuration. Starting with the second node as the starting node, the resource-based data corresponding to the second node's descendant nodes grants fourth-level access rights, allowing viewing.

[0082] In a specific embodiment, the access ownership is tenant1, the scope is 1, and in the absence of other access request restrictions, the resource basic data corresponding to the node owned by tenant1 has the third access right, and the resource basic data corresponding to the descendant nodes of the node owned by tenant1 has the fourth access right.

[0083] The access permissions for resource basic data are shown in Table 2 below:

[0084] Table 2. Access rights list

[0085] Resource ID ownership Scope View Operations 001 0 Default scope, globally public 002 tenant1 1 Default scope: only nodes with ownership = tenant1 and their descendant nodes 003 tenant2 1 Default scope: only nodes with ownership = tenant2 and their descendant nodes 004 tenant3 -1 Only nodes with ownership = tenant3 005 tenant1 / app1 2 Default scope: only nodes with ownership = tenant1 / app1 and their descendant nodes 006 tenant1 / app1 0 Globally public 007 tenant1 / app2 1 Only nodes with ownership = tenant1 and their descendant nodes 008 tenant2 / app3 -1 Only nodes with ownership = tenant2 / app3

[0086] Each resource-based data can belong to multiple scopes at the same time. The data resource set is divided based on the scope. While achieving basic access isolation for resource-based data, the resource-based data in the same scope are associated, expanding the viewing permissions for resource-based data and achieving cross-level access to resource-based data.

[0087] In some implementations, the resource path location method includes: a URI (Uniform Resource Identifier) ​​location method.

[0088] During implementation, the resource basic data is located according to the resource path. Specifically, the URI positioning method is: resource type: / / resource domain / resource path?resource attribute name=attribute value.

[0089] The resource path location of the resource basic data is shown in Table 3 below:

[0090] Table 3. Location list of resource paths

[0091]

[0092] In some implementations, the attributes of a resource type include: capacity attributes, location attributes, and extension attributes.

[0093] In implementation, the capacity attribute is consumable. Each additional user consumes a certain amount of capacity. When the capacity attribute of the resource base data is insufficient, the resource base data can no longer be used. The positioning attribute is used to further locate the resource base data and is a supplement to the positioning of the resource base data. The extension attribute is used to describe the extension of different categories of resource base data.

[0094] Preferably, the attributes of the resource type can be dynamically defined through the resource type model, or can be implemented through an extended model.

[0095] In some implementations, the extended attributes include: user attributes, environment attributes, and operation attributes.

[0096] In practice, user attributes include age, gender, and hobbies; environmental attributes include system time; and operation attributes include view, create, edit, delete, and configure. When an access request includes multiple extended attributes, all of them must satisfy the access rule for the request to be considered satisfied.

[0097] In a specific implementation, the access request is: User A issues a deletion request for a certain resource basic data in June 2022. When the three conditions of "User A", "June 2022" and "User A has deletion permission" are all met, this access request is established.

[0098] Examples, such as Figure 2 As shown, the embodiment of this specification provides an access control device based on ownership and scope, including:

[0099] The first data module is used to collect resource basic data and configure ownership for each piece of resource basic data;

[0100] The second data module is used to divide the resource basic data into different data resource sets according to the resource type of the resource basic data, and to divide the data resource sets into scopes according to the resource domain of the resource basic data;

[0101] The rule generation module is used to generate access rules based on the ownership, scope and preset security policy of the resource basic data; the access judgment module is used to determine the accessible data that meets the access rules when receiving an access request;

[0102] Data output module, used to output accessible data.

[0103] During implementation, ownership is configured for resource-based data. Through ownership, SaaS services can be divided into three levels, namely platform level, tenant level, and application level. Resource-based data are divided into different data resource sets according to resource types, and data resource sets are scoped according to resource domains to aggregate resources with the same information. The ownership, scope and other attributes of resource-based data are combined together, and access rules are generated according to preset security policies. When an access request meets the access rules, the subject that issues the access request is granted access rights and outputs accessible data.

[0104] The first data module sets ownership for each resource basic data, and the second data module divides the resource basic data into scopes. Multi-level division between each resource basic data can be achieved according to the level of ownership, thereby achieving isolation between resource basic data, ensuring security between data, and facilitating unified management of data resource sets.

[0105] In some implementations, the access determination module includes: an access parser and an access controller.

[0106] During implementation, the access request includes: access ownership and access scope. The access resolver deconstructs the access ownership and access scope, and the access controller obtains the corresponding resource basic data according to the resolved access ownership and access scope.

[0107] The specific implementation described above is a preferred implementation of an access control method and device based on ownership and scope of the present invention, and is not intended to limit the specific implementation scope of the present invention. The scope of the present invention includes but is not limited to this specific implementation. Any equivalent changes made in accordance with the shape and structure of the present invention are within the scope of protection of the present invention.

Claims

1. An access control method based on ownership and scope, characterized in that: include: Collecting resource basic data and configuring ownership for each piece of resource basic data, wherein the resource basic data includes: resource type, resource domain, and resource path; Dividing the resource basic data into different data resource sets according to the resource type, and dividing the data resource sets into scopes according to the resource domain; Generate access rules based on the ownership, scope and preset security policy of the resource basic data; Upon receiving an access request, determining that the access request satisfies the accessible data of the access rule includes: Obtaining access ownership in the access request; Determine a first node corresponding to the access ownership in the data resource set, record the resource basic data corresponding to the first node as first accessible data, and the access requester has a first access right to the first accessible data; Determining descendant nodes of the first node, recording the resource basic data corresponding to the descendant nodes of the first node as second accessible data, and the access requester has a second access right to the second accessible data; The first access permission and the second access permission are different access permissions; When the access request includes an access scope, it also includes: Determine a second node after the access ownership is extended to the access scope, record the resource basic data corresponding to the second node as third accessible data, and the access requester has a third access right to the third accessible data; Determining descendant nodes of the second node, recording the resource basic data corresponding to the descendant nodes of the second node as fourth accessible data, and the access requester having a fourth access right to the fourth accessible data; The third access permission and the fourth access permission are different access permissions; The accessible data is output.

2. The access control method based on ownership and scope according to claim 1, characterized in that: The first access rights include: viewing, modifying and deleting; The second access right includes: viewing.

3. The access control method based on ownership and scope according to claim 1, characterized in that: The third access right includes: viewing, modifying and deleting; The fourth access right includes: viewing.

4. The access control method based on ownership and scope according to claim 1, characterized in that: The resource path location method includes: URI location method.

5. The access control method based on ownership and scope according to claim 1, characterized in that: The attributes of the resource type include: capacity attributes, positioning attributes and extension attributes.

6. The access control method based on ownership and scope according to claim 5, characterized in that: The extended attributes include: user attributes, environment attributes and operation attributes.

7. An access control device based on ownership and scope, characterized in that: include: A first data module is used to collect resource basic data and configure ownership for each piece of resource basic data; A second data module is configured to divide the resource base data into different data resource sets according to resource types of the resource base data, and to divide the data resource sets into scopes according to resource domains of the resource base data; A rule generation module, configured to generate access rules based on the ownership, scope, and preset security policy of the resource base data; The access determination module is configured to, upon receiving an access request, determine whether the access request satisfies the accessible data of the access rule, including: obtaining access ownership in the access request; Determine a first node corresponding to the access ownership in the data resource set, record the resource basic data corresponding to the first node as first accessible data, and the access requester has a first access right to the first accessible data; Determining descendant nodes of the first node, recording the resource basic data corresponding to the descendant nodes of the first node as second accessible data, and the access requester has a second access right to the second accessible data; The first access permission and the second access permission are different access permissions; When the access request includes an access scope, it also includes: Determine a second node after the access ownership is extended to the access scope, record the resource basic data corresponding to the second node as third accessible data, and the access requester has a third access right to the third accessible data; Determining descendant nodes of the second node, recording the resource basic data corresponding to the descendant nodes of the second node as fourth accessible data, and the access requester having a fourth access right to the fourth accessible data; The third access permission and the fourth access permission are different access permissions; A data output module is used to output the accessible data.

8. The access control device based on ownership and scope according to claim 7, characterized in that: The access judgment module includes: an access parser and an access controller.

Images