Authority management method and device based on logical volume, equipment and medium

Abstract

The invention relates to the technical field of file authority management, and discloses an authority management method, device and equipment based on a logical volume and a medium, the method comprises the following steps: obtaining an access request of a first main body, the access request being used for accessing a first file, and the first main body being a user or a process; determining a first main body identifier corresponding to the first main body and a check field and an operation authority of a logical volume corresponding to the first file; determining a main body identifier group associated with the verification field according to a preset mapping relationship, and judging whether the first main body identifier is located in the main body identifier group or not; when the first main body identifier is located in the main body identifier group, the first main body is allowed to access the first file based on the operation authority, and the specific operation authority attribute and the verification field attribute are set in the logical volume, so that the access authority of the access main body is determined according to the main body identifier group corresponding to the verification field; the authority control of the file system can be realized from the perspective of a higher bottom layer, and the security of file data is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of file authority management, and in particular to a authority management method, device, equipment and medium based on logical volumes. Background Art

[0002] Large-scale project delivery is often delivered together with the software and the hardware platform on which it runs, forming a simple and easy-to-use chassis box with a relatively closed operation entrance. This allows all user operations to be within a controllable range, forming a stable human-computer interaction function boundary. At the same time, only the debugging interface for developers is reserved for the system inside the device for maintenance and upgrade.

[0003] In the delivered equipment, the system integrated in the chassis is generally provided with upgrade functions according to the service life provided. However, the protection of core data and applications is generally achieved by closing the access rights of the built-in operating system.

[0004] Under this permission management method, in some special cases, such as forcibly dismantling the machine to remove the disk and mount it for reading, it may lead to the leakage of important business data and cause property losses to the manufacturer. Therefore, the existing permission management method has data protection risks and cannot fully guarantee the security of file data. Summary of the invention

[0005] In view of this, the present invention provides a method, apparatus, computer device and storage medium for rights management based on logical volumes to solve the problem that existing rights management methods cannot fully guarantee the security of file data.

[0006] In a first aspect, the present invention provides a permission management method based on a logical volume, which is applied to an operating system, wherein the attributes of the logical volume include: an operation permission attribute and a check field attribute, and the method includes:

[0007] Obtaining an access request from a first subject, where the access request is used to access a first file, and the first subject is a user or a process;

[0008] Determine a first subject identifier corresponding to the first subject and a check field and operation authority of a logical volume corresponding to the first file;

[0009] Determine the subject identification group associated with the check field according to a preset mapping relationship, and judge whether the first subject identification is in the subject identification group;

[0010] When the first subject identifier is in the subject identifier group, the first subject is allowed to access the first file based on the operation authority.

[0011] The method sets operation permission attributes and check field attributes in a logical volume, thereby determining the check field of the logical volume corresponding to the accessed file when receiving an access request to a file from a user or a process, and determining the subject identification group of the check field according to a preset mapping relationship, thereby determining whether to allow the user or process to access the file based on the operation permission in the logical volume according to whether the subject identification corresponding to the accessed user or process is within the subject identification group, so as to achieve deeper permission control at the level of the logical volume, thereby further improving the security of file data in the file system, and through the permissions and check fields in the logical volume, unified permission control can be performed on the files under the directory mounted by the logical volume, thereby improving the efficiency of permission management.

[0012] In an optional implementation, after obtaining the access request of the first subject, the method further includes:

[0013] Obtaining a mandatory access control policy of the operating system, and determining whether to allow the first subject's access request to the first file based on the mandatory access control policy;

[0014] When the first subject's access request to the first file is allowed, the step of determining a first subject identifier corresponding to the first subject and a check field and an operation authority of a logical volume corresponding to the first file is performed.

[0015] In this implementation, the security of the file system can be further improved by performing a first round of permission judgment according to the mandatory access control policy within the operating system before judging according to the subject identification group corresponding to the check field in the logical volume.

[0016] In an optional implementation, the operating system includes: a logical volume management module;

[0017] The setting method of the operation permission attribute and the check field attribute in the logical volume is:

[0018] When receiving a logical volume creation instruction from a user, determining whether the logical volume creation instruction includes permission configuration information, the permission configuration information including: a first check field and a first operation permission corresponding to a target logical volume to be created;

[0019] When the logical volume creation instruction includes permission configuration information, the target logical volume is created by the logical volume management module, and the attributes of the target logical volume are set based on the first check field and the first operation permission.

[0020] In this implementation, operation permission attributes and check field attributes are added to the logical volume, and permission configuration information is carried in the creation instruction when the logical volume is created. Therefore, when the logical volume is created, the corresponding attributes of the logical volume are set according to the check field in the permission configuration information and the corresponding operation permissions, thereby ensuring that the files under the directory where the logical volume is mounted can be controlled by permissions through a unified strategy.

[0021] In an optional embodiment, the method further includes:

[0022] When the logical volume creation instruction does not include permission configuration information, obtaining default permission configuration information, the default permission configuration information including: a second check field and a second operation permission corresponding to the logical volume to be created;

[0023] A target logical volume is created by the logical volume management module, and attributes of the target logical volume are set based on the second check field and the second operation permission.

[0024] This implementation method obtains preset default permission configuration information to set the properties of the logical volume to be created when the permission configuration information is not included in the logical volume creation instruction, thereby ensuring that the files under the logical volume mount directory can obtain basic permission control to ensure the security of the file system.

[0025] In an optional implementation manner, before creating a target logical volume by the logical volume management module and setting the attribute of the target logical volume based on the first check field and the first operation permission, the method further includes:

[0026] Calling a built-in user group of the operating system, and determining whether the user is in the built-in user group;

[0027] When the user is in the built-in user group, executing the steps of creating a target logical volume through the logical volume management module and setting the attributes of the target logical volume based on the first check field and the first operation permission;

[0028] When the user is not in the built-in user group, the current logical volume creation operation is terminated.

[0029] This implementation method determines whether a user can set logical volume permissions based on whether the user is in the built-in user group of the operating system when the user creates a logical volume. Only when the user has the corresponding logical volume creation permission is the logical volume creation allowed and the corresponding permissions are set, which can further ensure the security of permission management in logical volumes in the operating system.

[0030] In an optional implementation, the obtaining of default permission configuration information includes:

[0031] Obtain the mandatory access control policy of the operating system, and determine the permission control mode with a default mark in the mandatory access control policy as the default permission configuration information.

[0032] In this implementation, by pre-marking a specific permission control method in the mandatory access control policy of the operating system, when a logical volume is created, if the user does not specify permission configuration information, the default permission configuration information of the logical volume can be obtained through the mandatory access control policy. On the one hand, it can avoid conflicts with the mandatory access policy, and on the other hand, it can more conveniently obtain the default permission configuration information, and by modifying the annotation in the mandatory access policy, the default permission configuration information can be quickly modified.

[0033] In an optional implementation, the operation permission attributes include: read and / or write and / or execute;

[0034] The allowing the first subject to access the first file based on the operation permission includes:

[0035] The first subject is allowed to read and / or write and / or execute the first file.

[0036] In this implementation mode, by setting the operation permission to read and / or write and / or execute, the subject can be better controlled to operate the file based on the operation permission corresponding to the logical volume, thereby ensuring the security of the file.

[0037] In a second aspect, the present invention provides a rights management device based on a logical volume, the device comprising:

[0038] A request acquisition module, used to acquire an access request of a first subject, where the access request is used to access a first file, and the first subject is a user or a process;

[0039] A permission determination module, used to determine a first subject identifier corresponding to the first subject and a check field and an operation permission of a logical volume corresponding to the first file;

[0040] an identification judgment module, used to determine the subject identification group associated with the check field according to a preset mapping relationship, and to judge whether the first subject identification is in the subject identification group;

[0041] An access release module is used to allow the first subject to access the first file based on the operation authority when the first subject identifier is located in the subject identifier group.

[0042] In a third aspect, the present invention provides a computer device comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the logical volume-based permission management method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0043] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the logical volume-based permission management method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 It is a flowchart of a method for managing rights based on logical volumes according to an embodiment of the present invention;

[0046] Figure 2 This is an example diagram of an LVM implementation principle according to an embodiment of the present invention;

[0047] Figure 3 is a flow chart of another logical volume-based rights management method according to an embodiment of the present invention;

[0048] Figure 4 is a flow chart of a method for setting attributes of a logical volume according to an embodiment of the present invention;

[0049] Figure 5a is an example diagram of a process for creating a security lock based on a logical volume according to an embodiment of the present invention;

[0050] Figure 5b is an example diagram of an update process of a security lock based on a logical volume according to an embodiment of the present invention;

[0051] Figure 5c is an example diagram of a use process of a security lock based on a logical volume according to an embodiment of the present invention;

[0052] Figure 5d is an example diagram of a logical volume expansion and reduction process according to an embodiment of the present invention;

[0053] Figure 6is a structural block diagram of a rights management device based on a logical volume according to an embodiment of the present invention;

[0054] Figure 7 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0056] Large-scale project delivery is often delivered together with the software and the hardware platform on which it runs, forming a simple and easy-to-use chassis box with a relatively closed operation entrance. This allows all user operations to be within a controllable range, forming a stable human-computer interaction function boundary. At the same time, only the debugging interface for developers is reserved for the system inside the device for maintenance and upgrade.

[0057] In the delivered equipment, the system integrated in the chassis is generally provided with upgrade functions according to the service life provided. However, the protection of core data and applications is generally achieved by closing the access rights of the built-in operating system.

[0058] Under this permission management method, in some special cases, such as forcibly dismantling the machine to remove the disk and mount it for reading, it may lead to the leakage of important business data and cause property losses to the manufacturer. Therefore, the existing permission management method has data protection risks and cannot fully guarantee the security of file data.

[0059] To this end, an embodiment of the present invention provides a permission management method based on a logical volume. By setting operation permission attributes and check field attributes in the logical volume, when a user or process receives an access request to a file, the check field of the logical volume corresponding to the accessed file is determined, and the subject identification group of the check field is determined according to a preset mapping relationship. Therefore, according to whether the subject identification corresponding to the accessing user or process is located in the subject identification group, it is determined whether the user or process is allowed to access the file based on the operation permissions in the logical volume, so as to achieve deeper permission control at the logical volume level, thereby further improving the security of file data in the file system, and through the permissions and check fields in the logical volume, unified permission control can be performed on files under the directory where the logical volume is mounted, thereby improving permission management efficiency.

[0060] According to an embodiment of the present invention, a method for rights management based on a logical volume is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0061] In this embodiment, a permission management method based on a logical volume is provided, which is applied to an operating system. The attributes of the logical volume include: an operation permission attribute and a check field attribute. Figure 1 is a flow chart of a method for managing rights based on logical volumes according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0062] Step S101: obtaining an access request of a first subject, where the access request is used to access a first file, and the first subject is a user or a process.

[0063] In an operating system, an access subject, i.e., a user or a process, can initiate an access request to a file, for example, to read, write, or execute the file. A process can be a process created directly or indirectly by a user, or a process corresponding to some application programs. When a subject initiates access to a first file, the operating system obtains the access request and determines whether the subject, i.e., the user or process initiating the access request, has the corresponding access rights, thereby deciding whether to grant the access request.

[0064] Step S102: Determine a first subject identifier corresponding to the first subject and a check field and an operation permission of a logical volume corresponding to the first file.

[0065] For a user, he has an independent user ID, and the associated processes directly or indirectly created by the same user will also inherit the user ID. For other application processes in the computer, they will also have corresponding IDs to distinguish the processes. For these IDs, the operating system can directly read them from the relevant information of the process or user. The relevant process ID or user ID is common information in the operating system and will not be described here.

[0066] In order to facilitate understanding of the technical solution of the present invention, the logical volume is explained as follows to facilitate understanding of the solution. The logical volume management module, namely the Lvm module, is a logical volume management function provided in the operating system kernel. Its specific implementation consists of two parts: the kernel driver and the application layer tool. Different from the way that ordinary hardware storage device partitions are directly mounted to the file system, it creates a logical layer as a transition. In this logical layer, there are concepts of physical volumes, volume groups, logical volumes, and physical blocks. LVM uses these concepts as management units to schedule storage space and corresponding relationships. Its bottom layer uses the device-mapper function in the operating system kernel to realize the virtualization of the storage system.

[0067] In a file system based on the LVM storage management module, the process from a disk to a file directory directly used by the user must go through the following steps: Figure 2 The following is an example diagram of the LVM implementation principle. The specific process is as follows:

[0068] Partition the disk. When the disk is first obtained, its storage space is accessed by the original start and end addresses, or the start address + sector size. Partitioning it actually divides a sector and formats it according to the specified partition type, such as fat32, NTFS, LVM, exFat, etc. After the partition is formatted in this way, the external device ID, such as / dev / sda1, is obtained to be managed as a storage device, and the internal device blocks are divided into different device blocks (different partition types have different device blocks) to provide read and write scheduling for the file system.

[0069] Generally, after partitioning, you can directly mount it to the file system. At this time, the mount point of the file system is fixed and the sector cannot be moved.

[0070] If divided by LVM partition type, it can be included in the LVM management scheduling. First, each partition is initialized as a physical volume. At this time, the corresponding partition will be divided into device blocks (PE) one by one.

[0071] Multiple physical volumes can be added to different volume groups. In this case, the physical volume is added to the volume group with its own PE, which is broken up and redistributed. The logical volume extracts a certain number of PEs from the volume group as needed to expand its own space.

[0072] Each logical volume, like a disk partition, corresponds to a mount point in the file system (so a logical layer is created to virtualize the disk partition).

[0073] The advantage of this is that after the physical disk is partitioned, it cannot be changed unless it is removed from the mount, re-partitioned and then mounted again, at which point the data is gone. However, in the form of LVM, the logical volume can obtain PE from the volume group, and the volume group can obtain a new PE from the physical volume, and the physical volume can be obtained by adding sectors. At this time, the file system cannot perceive the change, and the mount point and existing data are still there. Therefore, this method is more flexible, not only convenient for expansion and reduction, but also can use the effect of its virtual disk partition to do soft RAID at the operating system level to achieve data backup and parallel storage.

[0074] It can be understood that a physical disk is divided into multiple virtual logical volumes through LVM, and the logical volumes are mounted to corresponding file directories in the file system, so that all files under the file directory are stored through the corresponding logical volumes.

[0075] In the attribute information of the logical volume itself, the name, capacity and other attribute information of the logical volume can be represented. By customizing the Lvm module in the operating system, the present invention can add new extended members in the attributes of the logical volume to enrich the attribute information of the logical volume, including but not limited to read permission identification (controlling read permission to achieve hidden effect), write permission identification (controlling write permission to achieve read-only effect), execute permission identification (controlling execute permission, GID check field (by design, only members of the security management group built into the operating system can call API changes to achieve controllable permission collection).

[0076] For example, the attribute corresponding to logical volume LV1 can be: rx 1001; the attribute corresponding to logical volume LV2 is: r--1002; the attribute corresponding to logical volume LV3 is: -wx 1003. The attribute corresponding to logical volume LV1 means that only the process or user corresponding to the check field 1001 has read (r) and execute (x) permissions for the files mounted under logical volume LV1; similarly, the attribute corresponding to logical volume LV2 means that only the process or user corresponding to the check field 1002 has read (r) permissions for the files mounted under logical volume LV2; the attribute corresponding to logical volume LV3 means that only the process or user corresponding to the check field 1003 has write (w) permissions and execute (x) permissions for the files mounted under logical volume LV3, and so on.

[0077] Among them, rx, r--, -wx in the logical volume are the operation permission attributes of the corresponding logical volume, and 1001, 1002, 1003 are the check field attributes in the corresponding logical volume.

[0078] After understanding the implementation logic of the logical volume and the newly added attributes of the embodiment of the present invention in the logical volume, return to the above step S102. After receiving an access request from a subject, the operating system determines the logical volume mounted in the directory where the file desired to be accessed by the access request is located, thereby obtaining the operation permission and check field corresponding to the logical volume. For example, if an access request desires to access file 1, file 1 is located in the directory / data, and the logical volume corresponding to the directory is LV3, then its corresponding operation permission is -wx, and the check field is 1003.

[0079] Step S103: determining the subject identification group associated with the check field according to a preset mapping relationship, and judging whether the first subject identification is in the subject identification group.

[0080] In the operating system, there is a pre-set mapping relationship table, which includes identification groups corresponding to different check fields.

[0081] For example, in the mapping relationship table, the identification group corresponding to field 1001 is {identifier A, identifier B, identifier C, identifier D}; the identification group corresponding to field 1002 is {identifier A, identifier B, identifier C, identifier D, identifier E}; and the identification group corresponding to field 1003 is {identifier B, identifier C, identifier E}.

[0082] In the above step S102, the check field and operation permission corresponding to the logical volume where the first file being accessed is located, as well as the subject identifier corresponding to the first subject accessing the first file have been obtained. Assuming that the check field corresponding to the logical volume where the first file is located is 1003, and the access identifier corresponding to the access subject is identifier C, based on the above example, it can be known that the identifier group corresponding to field 1003 is {identifier B, identifier C, identifier E}, and identifier C is located therein, indicating that the access subject has the corresponding operation permission, i.e. -wx, that is, the first subject can perform write and write operations on the first file.

[0083] The above mapping table can be understood as a mapping table created by the administrator user according to actual needs, and the mapping table can be modified according to actual needs. For example, when the administrator wants the user or process identified as G to access the files under the corresponding mount directory of the logical volume LV1 according to the corresponding permissions, the administrator can directly add the identifier G to the subject identifier group under the corresponding check field of LV1 in the mapping table, thereby realizing the management of file system permissions.

[0084] It should be noted that for all users and processes whose subject identifiers are in the corresponding subject identifier group, their access rights to all files under the logical volume corresponding to the subject identifier group are the same. For example, LV1, its corresponding operation permissions are write and execute. Therefore, all users and processes whose subject identifiers are in the corresponding subject identifier group can only perform write and execute operations on the files under the logical volume.

[0085] Therefore, the permissions in the logical volume can be used to achieve unified management of files under the mounted directory, which is convenient for batch file permission control, thereby improving the efficiency of file system permission management.

[0086] In one example, it can be set that for users or processes whose subject identifiers are not in the corresponding identifier group, they do not have any operation permissions for files under the corresponding logical volume, while for users and processes whose subject identifiers are in the corresponding subject identifier group, they have corresponding operation permissions.

[0087] In another example, it can also be set that for users or processes whose subject identifiers are not in the corresponding identification group, they can have all operation permissions for files under the corresponding logical volume, and for users and processes whose subject identifiers are in the corresponding subject identification group, they only have corresponding operation permissions.

[0088] Step S104: when the first subject identifier is in the subject identifier group, the first subject is allowed to access the first file based on the operation authority.

[0089] When the first subject identifier is in the above subject identifier group, it means that the first subject can perform corresponding access according to the operation permission corresponding to the logical volume. Taking LV3 as an example, its corresponding operation permission is write and execute. At this time, the operating system determines what operation the first subject's access request for the first file specifically expects to perform. If the access request is for write or execute processing, it is allowed; if the access request is for read operation, it is not allowed.

[0090] The logical volume-based permission management method provided in the present embodiment sets operation permission attributes and check field attributes in the logical volume, so that when receiving a user or process access request to a file, the check field of the logical volume corresponding to the accessed file is determined, and the subject identification group of the check field is determined according to a preset mapping relationship, so as to determine whether the user or process is allowed to access the file based on the operation permissions in the logical volume according to whether the subject identification corresponding to the accessing user or process is within the subject identification group, thereby achieving deeper permission control at the logical volume level, thereby further improving the security of file data in the file system, and through the permissions and check fields in the logical volume, unified permission control can be performed on the files under the directory mounted by the logical volume, thereby improving the efficiency of permission management.

[0091] According to an embodiment of the present invention, another embodiment of a rights management method based on a logical volume is provided, which is applied to an operating system, and the attributes of the logical volume include: an operation permission attribute and a check field attribute. Figure 3 FIG. 1 is a flowchart of another method for managing rights based on logical volumes according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0092] Step S201, obtaining an access request from a first subject, the access request is used to access a first file, and the first subject is a user or a process. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0093] Step S202: Obtain the mandatory access control policy of the operating system, and determine whether to allow the first subject's access request to the first file based on the mandatory access control policy.

[0094] When the first subject's access request to the first file is allowed, step S203 is executed.

[0095] It can be understood that before determining the operating authority of the access subject based on the check field in the logical volume, a first-level check can be performed through the operating system's own mandatory access control policy. When the mandatory access control policy allows the access request of the first subject, the subsequent permission determination step based on the logical volume is performed.

[0096] Furthermore, before making a permission judgment on the first subject's access request to the first file based on the mandatory access control policy, a first-level permission judgment can be made based on the file's own access permissions to achieve layer-by-layer release, and finally relevant permission judgments can be made based on the check fields and operation permissions in the logical volume.

[0097] The embodiment of the present invention implements multi-layer permission control through these two permission control modes, thereby further improving the overall permission control security. For the mandatory access control strategy in the operating system and the access rights of the file itself, reference can be made to the relevant technical solutions, which will not be repeated here.

[0098] Step S203, determining the first subject identifier corresponding to the first subject and the check field and operation authority of the logical volume corresponding to the first file. Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0099] Step S204: determine the subject identification group associated with the check field according to the preset mapping relationship, and determine whether the first subject identification is in the subject identification group. Figure 1Step S103 of the illustrated embodiment will not be described in detail here.

[0100] Step S205: when the first subject identifier is in the subject identifier group, the first subject is allowed to access the first file based on the operation authority.

[0101] Specifically, the above-mentioned operation permission attributes include read and / or write and / or execute;

[0102] In step S205, allowing the first subject to access the first file based on the operation authority includes:

[0103] The first subject is allowed to read and / or write and / or execute the first file.

[0104] It can be understood that the operation permission attributes in the logical volume specifically include: read and / or write and / or execute permissions. When the subject identifier corresponding to the first subject is located in the subject identifier group under the check field in the logical volume corresponding to the first file being accessed, the first subject can perform corresponding access according to the specific operation permission attributes of the logical volume.

[0105] For example, if the operation permission corresponding to the logical volume is write and / or execute, the first subject can write and execute the first file but cannot read it, and so on, the first subject's permission control method for other files is the same.

[0106] Specifically, the operating system used in the above method embodiment includes: a logical volume management module. For the above method embodiment, the setting method of the operation permission attribute and the check field attribute of the logical volume can be as follows: Figure 4 FIG. 1 is a flow chart of a method for setting logical volume attributes according to an embodiment of the present invention. Figure 4 As shown, the process includes the following steps:

[0107] Step S301, when receiving a logical volume creation instruction from a user, it is determined whether the logical volume creation instruction contains permission configuration information, the permission configuration information including: a first check field and a first operation permission corresponding to a target logical volume to be created.

[0108] It can be understood that when a user creates a logical volume, he or she will choose whether to configure specific permission configuration information for the logical volume, that is, the logical volume creation instruction includes specific operation permission attribute information and check field information. Therefore, when the operating system receives the user's logical volume creation instruction, it will determine whether the instruction contains specific permission configuration information, where the permission configuration information is the first operation permission and the first check field corresponding to the logical volume that the user expects to be created.

[0109] Step S302: when the logical volume creation instruction includes permission configuration information, a target logical volume is created by a logical volume management module, and attributes of the target logical volume are set based on a first check field and a first operation permission.

[0110] When the user directly carries the specific operation permission information and check field information of the logical volume in the creation instruction, the operating system can create the corresponding logical volume through the logical volume management module, that is, the LVM module, and during the creation process, set the operation permission attribute of the logical volume to the first operation permission, and set the check field attribute of the logical volume to the first check field to obtain the target logical volume.

[0111] Specifically, in step S302, before creating a target logical volume through the logical volume management module and setting the attributes of the target logical volume based on the first check field and the first operation permission, it is necessary to determine whether the user can execute the creation of the logical volume and the setting of the corresponding attributes, which specifically includes:

[0112] Step S302-A, calling the built-in user group of the operating system, and determining whether the user is in the built-in user group.

[0113] It can be understood that when receiving an instruction from a user to create a logical volume, it is necessary to first call the pre-set built-in user group in the operating system to determine whether the user who creates the logic is in it, so as to determine whether he has the authority to set the operation permission attributes and check fields of the logical volume.

[0114] Step S302-B, when the user is in the built-in user group, execute the step of creating a target logical volume through the logical volume management module and setting the attributes of the target logical volume based on the first check field and the first operation permission.

[0115] Step S302-C: when the user is not in the built-in user group, terminate the current logical volume creation operation.

[0116] When the user does not belong to the built-in user group, it means that the user does not have the corresponding operation authority and the qualification to set the attributes of the verification field. Therefore, the creation process of the logical volume can be terminated to ensure the security of the logical volume permission setting.

[0117] In one example, even if the user does not belong to the built-in user group, the logical volume can continue to be created based on the memory allocation, logical volume ID and other information in the logical volume. However, the operation permission attributes and verification field attributes of the logical volume are no longer set according to the permission configuration information in the logical volume creation instruction. Instead, the specific operation permission attributes and verification field attributes are set according to the default policy, that is, the logical volume creation instruction initiated by the user is deemed to contain no specific permission configuration information.

[0118] Step S303: when the logical volume creation instruction does not include permission configuration information, obtain default permission configuration information, the default permission configuration information includes: a second check field and a second operation permission corresponding to the logical volume to be created.

[0119] When the logical volume creation instruction does not include specific permission configuration information, the operating system can obtain preset default permission configuration information, which can be pre-set fixed operation permissions and check fields. When creating a logical volume, the LVM module sets the check fields and operation permissions of the target logical volume according to the pre-set operation permissions and check fields.

[0120] Specifically, in step S303, obtaining default permission configuration information includes:

[0121] Obtain the mandatory access control policy of the operating system, and determine the permission control method with a default mark in the mandatory access control policy as the default permission configuration information.

[0122] It can be understood that, for the default permission configuration information, in addition to being set through fixed operating permissions and verification fields, it can also be set in combination with the operating system's own mandatory access control policy. Specifically, the mandatory access control policy in the operating system can be simply understood as setting which types of files can be accessed by which types of subjects for the global file system.

[0123] For example: Strategy 1: typeA files can be read and written to type1 subjects; Strategy 2: typeB files can be executed and written to type4 subjects, and so on. Assuming that Strategy 1 is a default permission control method with annotations, the check field corresponding to the type1 subject identifier can be determined according to the preset mapping relationship table in the operating system, and the check field is used as the check field attribute in the default permission configuration information. At the same time, the permissions corresponding to Strategy 1, i.e., read and write, are used as the operation permission attributes in the default permission configuration information. In this way, the default permission configuration information based on the mandatory access control policy can be obtained for subsequent logical volume creation.

[0124] By determining the default permission configuration information through the mandatory access control policy, the permission control method of the logical volume and the mandatory access control policy can be compatible to a certain extent. At the same time, the default permission configuration information can be modified by modifying the annotations in the mandatory access control policy to facilitate the modification of the default permissions.

[0125] Step S304: Create a target logical volume through the logical volume management module, and set the attributes of the target logical volume based on the second check field and the second operation permission.

[0126] After obtaining the default permission configuration information, referring to the above step S302, the target logical volume can be created through the logical volume management module LVM, and when creating the target logical volume, the corresponding attributes of the target logical volume are set based on the second check field and the second operation permission in the default permission configuration information.

[0127] The logical volume-based permission management method provided by the embodiment of the present invention sets specific operation permission attributes and check field attributes in the logical volume when the user creates the logical volume. Therefore, when the subject accesses the file under the directory mounted by the logical volume, the specific permissions of the access subject relative to the accessed file can be determined based on the attributes and check fields in the logical volume, so as to control the permissions of the file system from the logical volume level, thereby further improving the security of file data in the file system, and through the permissions and check fields in the logical volume, unified permission control can be performed on the files under the directory mounted by the logical volume, thereby improving the efficiency of permission management.

[0128] In order to facilitate understanding of the above method embodiment, a security lock solution based on a logical volume is provided, for example, to implement permission management of a file system at the logical volume level. Figure 5a FIG. 1 is a flowchart illustrating a process of creating a security lock based on a logical volume according to an embodiment of the present invention.

[0129] First, the user's LV creation instruction is received, and the logical volume ID, volume name and other configuration information are allocated according to the normal logical volume creation process. Then, before dividing the storage space and mapping the storage address, the security lock operation is added. The specific steps are as follows:

[0130] 1. First, obtain the security policy for the mandatory access system module. This step is to obtain the default configuration when the logical volume creation instruction does not contain specific permission configuration information.

[0131] 2. Determine whether there are any specified logic permission parameters in the instructions issued for this operation. If not, the default configuration of the obtained security policy shall prevail.

[0132] 3. If yes, determine whether the GID to which the current user belongs has the configuration permission. The GID used to modify the LV security lock here is a built-in user group that cannot be created or changed. It is hard-coded. The users in the group are called "security administrators."

[0133] 4. If the user is not a member of the built-in GID, the current operation is terminated immediately. If the user is a GID user, the permission configuration issued by the user is compared with the configuration of the security policy, and the security policy issued by the user is given the highest priority. The permissions are configured and take effect, and the marked security lock takes effect on each storage unit (PE).

[0134] After that, the normal process is entered, and the storage unit (PE) corresponding to the logical volume is mapped to the file system along with the LV. The specific implementation method can refer to the logical volume creation process in the above embodiment, which will not be repeated here.

[0135] After creating a logical volume, users can still update the operation permission attributes and verification field attributes in the logical volume according to actual needs. For the specific process, please refer to Figure 5b , is an example diagram of an update process of a logical volume-based security lock according to an embodiment of the present invention.

[0136] like Figure 5b As shown, when the user wants to update the lv permission, the default permission control method marked in the mandatory access control module is modified to make the permission of the security lock in the logical volume consistent with the mandatory access control module to a certain extent. Similarly, the user can also directly issue new specific permission configuration information to update the permission information in the security lock. The specific implementation method can also refer to the logical volume creation process example diagram in the above method embodiment.

[0137] After the operating system receives the user's logical volume security lock update request, it first needs to determine whether the user has the corresponding modification permission, that is, whether the user is in the built-in user group. Only administrator users in the built-in user group can configure the permissions in the logical volume. If not, the execution of the update operation is terminated directly. If yes, it is further determined whether the target LV to be changed is occupied. If the target LV is not occupied, the permission configuration can be updated to complete the update of the operation permission information and / or the check field attributes in the logical volume.

[0138] For the specific use process of the security lock in the logical volume, such as Figure 5c FIG. 1 is a flowchart showing an example of a use process of a security lock based on a logical volume according to an embodiment of the present invention.

[0139] First, after obtaining the read and write request of the user or process, the security policy of the mandatory access control module will be obtained to perform the first-level judgment on the access request. The permission module control at this level is bound to the file system and the user system, which belongs to the conventional file system permission control method. After the first-level permission judgment is passed, it is considered that the read and write request has the corresponding permission, and further permission judgment is performed based on the operation permission and check field in the LV. The specific implementation method can refer to the corresponding content in the above embodiment, which will not be repeated here. The permission control performed through the built-in field of the logical segment belongs to the permission control method isolated from the user permission module and the file system module, which can further ensure the effectiveness and comprehensiveness of the permission control.

[0140] For logical volumes, you need to expand or shrink them according to actual usage. For details, refer to Figure 5d , is an example diagram of a logical volume expansion and reduction process according to an embodiment of the present invention.

[0141] When the logical volume needs to be expanded or reduced, it is not much different from the logical volume without a safety lock, because the safety lock is recorded in the logical volume, and the PE in the logical volume is removed. It is only necessary to determine whether the PE is occupied normally. That is, when expanding, a specified number of unoccupied PE blocks are allocated from the volume group to the LV, and the mapping of the logical volume in the file system is updated. Similarly, when reducing, it is necessary to find empty value blocks in the logical volume, that is, PE blocks with all ' / 0' values, and release them to the volume group, and update the mapping.

[0142] Compared with the method of controlling the execution process permissions through the user permission system and the file system controlling the file attributes, the above-mentioned security lock solution based on logical volumes prevents malicious processes from accessing and tampering with core data. This solution can use the attributes of the logical volume mount point to implement read and write control, blocking the possibility of malicious processes attacking core data from the virtual disk attributes, and adding an additional line of defense on the storage device. At the same time, since the control unit of this solution is in the form of a logical volume, it is convenient for users or upper-level management software to classify and group key data according to business needs, greatly improving the flexibility of use. And because the execution unit is a mount point rather than individual files in the file system, the response speed is improved for batch operations on a large number of files.

[0143] In this embodiment, a permission management device based on a logical volume is also provided, and an operating system is applied. The attributes of the logical volume include: an operation permission attribute and a check field attribute. The device is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0144] This embodiment provides a rights management device based on logical volumes, such as Figure 6 As shown, including:

[0145] A request acquisition module 401 is used to acquire an access request from a first subject, where the access request is used to access a first file, and the first subject is a user or a process;

[0146] The permission determination module 402 is used to determine the first subject identifier corresponding to the first subject and the check field and operation permission of the logical volume corresponding to the first file;

[0147] The identification judgment module 403 is used to determine the subject identification group associated with the check field according to the preset mapping relationship, and to judge whether the first subject identification is in the subject identification group;

[0148] The access release module 403 is used to allow the first subject to access the first file based on the operation authority when the first subject identifier is in the subject identifier group.

[0149] In some optional implementations, the request acquisition module 401, after acquiring the access request of the first subject, is further used to acquire the mandatory access control policy of the operating system, and determine whether to allow the first subject's access request to the first file based on the mandatory access control policy;

[0150] When the first subject's access request to the first file is allowed, the permission determination module 402 executes the step of determining the first subject identification corresponding to the first subject and the check field and operation permission of the logical volume corresponding to the first file.

[0151] In an optional implementation, the operating system includes: a logical volume management module;

[0152] The rights management device based on logical volumes also includes: a logical volume creation module 404, and the setting method of the check field and the operation rights of the logical volume is:

[0153] When receiving a logical volume creation instruction from a user, determining whether the logical volume creation instruction includes permission configuration information, the permission configuration information including: a first check field and a first operation permission corresponding to the target logical volume to be created;

[0154] When the logical volume creation instruction includes permission configuration information, a target logical volume is created through the logical volume management module, and the attribute of the target logical volume is set based on the first check field and the first operation permission.

[0155] In an optional implementation, when the logical volume creation instruction does not include permission configuration information, the logical volume creation module 404 obtains default permission configuration information, and the default permission configuration information includes: a second check field and a second operation permission corresponding to the logical volume to be created;

[0156] A target logical volume is created through a logical volume management module, and attributes of the target logical volume are set based on the second check field and the second operation permission.

[0157] In some optional implementations, the logical volume creation module 404, before creating the target logical volume through the logical volume management module and setting the attribute of the target logical volume based on the first check field and the first operation permission, the method further includes:

[0158] Call the built-in user group of the operating system and determine whether the user is in the built-in user group;

[0159] When the user is in the built-in user group, executing the steps of creating a target logical volume through the logical volume management module and setting the attribute of the target logical volume based on the first check field and the first operation permission;

[0160] When the user is not in the built-in user group, terminate the current logical volume creation operation.

[0161] In some optional implementations, the logical volume creation module 404, when acquiring the default permission configuration information, includes:

[0162] Obtain the mandatory access control policy of the operating system, and determine the permission control method with a default mark in the mandatory access control policy as the default permission configuration information.

[0163] In some optional implementations, the operation permission attributes include: read and / or write and / or execute;

[0164] The access release module 403 allows the first subject to access the first file based on the operation authority, including:

[0165] The first subject is allowed to read and / or write and / or execute the first file.

[0166] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0167] The logical volume-based permission management device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0168] The embodiment of the present invention also provides a computer device having the above Figure 6 A logical volume-based rights management device is shown.

[0169] See also Figure 7 , Figure 7 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 7As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 7 A processor 10 is taken as an example.

[0170] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0171] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0172] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0173] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0174] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 7 The example of connecting through bus is taken in the following.

[0175] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0176] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0177] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A rights management method based on logical volumes, applied to an operating system, characterized in that: The attributes of the logical volume include: an operation permission attribute and a check field attribute, and the method includes: Obtaining an access request from a first subject, where the access request is used to access a first file, and the first subject is a user or a process; Determine a first subject identifier corresponding to the first subject and a check field and operation authority of a logical volume corresponding to the first file; Determine the subject identification group associated with the check field according to a preset mapping relationship, and judge whether the first subject identification is in the subject identification group; When the first subject identifier is in the subject identifier group, the first subject is allowed to access the first file based on the operation authority.

2. The method according to claim 1, characterized in that: After obtaining the access request of the first subject, the method further includes: Obtaining a mandatory access control policy of the operating system, and determining whether to allow the first subject's access request to the first file based on the mandatory access control policy; When the first subject's access request to the first file is allowed, the step of determining a first subject identifier corresponding to the first subject and a check field and an operation authority of a logical volume corresponding to the first file is performed.

3. The method according to claim 1, characterized in that The operating system includes: a logical volume management module; The setting method of the operation permission attribute and the check field attribute in the logical volume is: When receiving a logical volume creation instruction from a user, determining whether the logical volume creation instruction includes permission configuration information, the permission configuration information including: a first check field and a first operation permission corresponding to a target logical volume to be created; When the logical volume creation instruction includes permission configuration information, the target logical volume is created by the logical volume management module, and the attributes of the target logical volume are set based on the first check field and the first operation permission.

4. The method according to claim 3, characterized in that The method further comprises: When the logical volume creation instruction does not include permission configuration information, obtaining default permission configuration information, the default permission configuration information including: a second check field and a second operation permission corresponding to the logical volume to be created; A target logical volume is created by the logical volume management module, and attributes of the target logical volume are set based on the second check field and the second operation permission.

5. The method according to claim 3, characterized in that: Before creating a target logical volume by the logical volume management module and setting the attribute of the target logical volume based on the first check field and the first operation permission, the method further includes: Calling a built-in user group of the operating system, and determining whether the user is in the built-in user group; When the user is in the built-in user group, executing the steps of creating a target logical volume through the logical volume management module and setting the attributes of the target logical volume based on the first check field and the first operation permission; When the user is not in the built-in user group, the current logical volume creation operation is terminated.

6. The method according to claim 4, characterized in that The obtaining of default permission configuration information includes: Obtain the mandatory access control policy of the operating system, and determine the permission control mode with a default mark in the mandatory access control policy as the default permission configuration information.

7. The method according to claim 1, characterized in that The operation permission attributes include: read and / or write and / or execute; The allowing the first subject to access the first file based on the operation permission includes: The first subject is allowed to read and / or write and / or execute the first file.

8. A rights management device based on logical volumes, characterized in that: The device comprises: A request acquisition module, used to acquire an access request of a first subject, where the access request is used to access a first file, and the first subject is a user or a process; A permission determination module, used to determine a first subject identifier corresponding to the first subject and a check field and an operation permission of a logical volume corresponding to the first file; an identification judgment module, used to determine the subject identification group associated with the check field according to a preset mapping relationship, and to judge whether the first subject identification is in the subject identification group; An access release module is used to allow the first subject to access the first file based on the operation authority when the first subject identifier is located in the subject identifier group.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the logical volume-based permission management method described in any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the logical volume-based rights management method according to any one of claims 1 to 7.

Images