Access control method and system

Abstract

The invention provides an access control method and system, and the method comprises the steps: obtaining a first group joining request which indicates that members outside a first group of an IAM join the first group, and members in the first group inherit the resource access authority carried by the first group, the resource access authority carried by the first group comprises the access authority of the first resource; and determining whether to allow the members outside the group to join the first group according to a group joining auditing strategy of the first group, wherein the group joining auditing strategy of the first group comprises one or more first access control rules extracted from the access control strategy of the first resource. According to the scheme, the access efficiency is improved while the security of resource access is ensured.

Description

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on July 18, 2023, with application number 202310882612.7, and priority to the Chinese patent application with the invention name “Method and system for access control”, all contents of which are incorporated by reference in this application. Technical Field

[0002] The present application relates to the field of information security, and more specifically, to an access control method and system. Background Art

[0003] When accessing resources, it is usually necessary to review the identity and access rights of the visitor to ensure the security of resource access. Taking cloud services as an example, administrators have access rights to resources in cloud accounts. Through authorization policies, they can authorize some or all access rights to resources in cloud accounts to other users. Administrators can authorize groups to improve authorization efficiency. Members in a group can inherit the access rights of the group's resources. However, for some resources with higher security levels, there may still be greater security risks even if they are authorized by the administrator. Summary of the invention

[0004] The present application provides an access control method and system, which are conducive to improving the efficiency of resource access while ensuring the security of resource access.

[0005] In a first aspect, a method for access control is provided, the method comprising: the method is applied to a cloud management platform, the cloud management platform is used to manage infrastructure, the infrastructure comprises at least one cloud data center, the method comprising: an access control device in the cloud management platform obtains an input first group entry request, the first group entry request indicates that members outside a first group of identity and access management (IAM) are to be added to the first group, members within the first group inherit resource access rights carried by the first group, the resource access rights carried by the first group include access rights to a first resource, the access rights to the first resource indicate that access to the first resource is allowed; the access control device determines whether to allow members outside the first group to join the first group according to an entry review policy of the first group, the entry review policy of the first group indicates conditions for allowing members outside the first group to join the first group, and / or conditions for refusing members to join the first group, the entry review policy of the first group includes one or more first access control rules extracted from an access control policy of a first resource.

[0006] In the scheme of the embodiment of the present application, whether a member can be allowed to join the group is determined by the group entry audit strategy, which increases the restriction conditions for member entry, strengthens the control of authorization, and is conducive to improving the security of resource access. The group entry audit strategy of the group is related to the access control strategy of the resources allowed to be accessed by the authority carried by the group, so that the audit process of the access control strategy in the resource call stage can be partially or completely pre-placed to the group entry audit stage. In other words, it can be judged whether the member has met some or all conditions in the access control strategy of the resource in the group entry audit stage. In the resource call stage, by judging whether the visitor has inherited the authority of the corresponding group, for example, whether it is in the corresponding group, it can be judged whether the visitor has met some or all conditions in the access control strategy of the resource. This is conducive to reducing the number of access control rules that need to be audited in the resource call stage, thereby reducing the authentication time consumption in the resource call stage, improving the authentication efficiency, preventing authentication timeout, and ensuring the security of resource access. Improve the response speed of resource access, and then help improve user experience. At the same time, it is also conducive to preventing security risks caused by authentication timeout.

[0007] The access control policy of the first resource may indicate conditions for allowing and / or denying access to the first resource.

[0008] In combination with the first aspect, in some implementations of the first aspect, the first grouping request is triggered by an administrator.

[0009] In combination with the first aspect, in certain implementations of the first aspect, the method also includes: the gateway obtains an access request for the first resource; when the access request comes from a member within the first group, the access control device authenticates the access request according to access control rules in the access control policy of the first resource except for one or more first access control rules.

[0010] Exemplarily, the access control device may be a gateway or a functional module in the gateway. In this case, after receiving the access request of the first resource, the gateway may authenticate the access request.

[0011] Exemplarily, the access control device is set independently of the gateway. In this case, after the gateway receives the access request of the first resource, the access control device can authenticate the access request.

[0012] In combination with the first aspect, in some implementations of the first aspect, the first resource includes a first application programming interface (API).

[0013] In combination with the first aspect, in some implementations of the first aspect, the gateway includes at least one of an API gateway or an application gateway.

[0014] In combination with the first aspect, in some implementations of the first aspect, the method further includes: the access control device obtains an input entry review policy of the first group.

[0015] In combination with the first aspect, in certain implementations of the first aspect, the method also includes: the access control device controls the display of one or more second access control rules extracted from the access control policy of the first resource, and the entry review policy of the first group includes the selection results of the one or more second access control rules.

[0016] In combination with the first aspect, in certain implementations of the first aspect, the parameter value of the first parameter of the first member in the first group is the first parameter value, and the first member inherits the resource access rights carried by the first group. After the parameter value of the first parameter of the first member is changed from the first parameter value to the second parameter value, the first member no longer inherits the resource access rights carried by the first group.

[0017] In the solution of the embodiment of the present application, the changes in member information can be monitored, so as to timely adjust the status of whether members in the group can inherit group permissions, realize dynamic management of members, and further ensure the security of resource access.

[0018] In combination with the first aspect, in certain implementations of the first aspect, the first parameter belongs to a parameter indicated by an entry review policy of the first group, and the method also includes: after the parameter value of the first parameter of the first member is changed from the first parameter value to the second parameter value, determining according to the entry review policy of the first group that the first member no longer inherits the resource access rights carried by the first group.

[0019] In the solution of the embodiment of the present application, when the information of a member changes, the member can be re-examined for group entry to determine whether the member can inherit group permissions, thereby further ensuring the security of resource access.

[0020] In combination with the first aspect, in certain implementations of the first aspect, the status of members in the first group includes a valid state and an invalid state, members in the valid state inherit the resource access rights carried by the first group, and members in the invalid state do not inherit the resource access rights carried by the first group.

[0021] In combination with the first aspect, in certain implementations of the first aspect, the parameter value of the second parameter of the second member in the first group is the third parameter value, and the second member is in an invalid state. After the parameter value of the second parameter of the second member is changed from the third parameter value to the fourth parameter value, the second member is in a valid state.

[0022] In the scheme of the embodiment of the present application, the changes in member information can be monitored, so as to timely adjust the status of whether members in the group can inherit group permissions, realize dynamic management of members, and eliminate the need for administrators to repeatedly add members, which is conducive to ensuring user experience.

[0023] In combination with the first aspect, in certain implementations of the first aspect, the second parameter belongs to a parameter indicated by the admission review policy of the first group, and the method also includes: after the parameter value of the second parameter of the second member is changed from the third parameter value to the fourth parameter value, determining that the second member is in a valid state according to the admission review policy of the first group.

[0024] In a second aspect, a method for access control is provided, comprising: receiving an access request from a visitor, the access request indicating that the visitor requests access to a first resource; allowing the visitor to access the first resource if the visitor is in a group that carries access rights to the first resource, wherein members of the group that carries access rights to the first resource comply with an admission review policy of the group that carries access rights to the first resource, and the admission review policy of the group that carries access rights to the first resource is related to the access policy of the first resource.

[0025] Further, the visitor is in a valid state in the group carrying the access rights to the first resource. The members in a valid state in the group carrying the access rights to the first resource inherit the access rights to the first resource. If the visitor is in a valid state in the group carrying the access rights to the first resource, the visitor is allowed to access the first resource.

[0026] In combination with the second aspect, in some implementations of the second aspect, if the visitor is outside the group that has access rights to the first resource, the visitor is denied access to the first resource.

[0027] In combination with the second aspect, in some implementations of the second aspect, when a visitor is in an invalid state within a group that carries access rights to the first resource, the visitor is denied access to the first resource.

[0028] In combination with the second aspect, in certain implementations of the second aspect, the entry review policy of the group carrying access rights to the first resource includes one or more first access control rules extracted from the access control policy of the first resource. When the visitor is in the group carrying access rights to the first resource and the visitor satisfies other access control rules in the access control policy of the first resource except the one or more first access control rules, the visitor is allowed to access the first resource.

[0029] In a third aspect, a system for access control is provided, which is applied to a cloud management platform, and the cloud management platform is used to manage infrastructure, and the infrastructure includes at least one cloud data center. The system includes an access control device, and the device includes: a management module, which is used to obtain an input first group entry request, the first group entry request indicates that members outside the first group of the IAM are added to the first group, and members in the first group inherit the resource access rights carried by the first group, and the resource access rights carried by the first group include access rights to the first resource, and the access rights to the first resource indicate that access to the first resource is allowed; an audit module, which is used to determine whether members outside the first group are allowed to join the first group according to an entry audit policy of the first group, the entry audit policy of the first group indicates conditions for allowing members to join the first group, and / or conditions for refusing members to join the first group, and the entry audit policy of the first group includes one or more first access control rules extracted from the access control policy of the first resource.

[0030] In combination with the third aspect, in certain implementations of the third aspect, the system also includes a gateway, which is used to obtain an access request for the first resource; and the access control device also includes an authentication module, which is used to authenticate the access request according to the access control rules in the access control policy of the first resource except for the one or more first access control rules when the access request comes from a member within the first group.

[0031] In combination with the third aspect, in some implementations of the third aspect, the first resource includes a first application programming interface (API).

[0032] In combination with the third aspect, in some implementations of the third aspect, the gateway includes at least one of an API gateway or an application gateway.

[0033] In combination with the third aspect, in certain implementations of the third aspect, the management module is further used to: obtain an input admission review policy for the first group.

[0034] In combination with the third aspect, in certain implementations of the third aspect, the management module is also used to: control the display of one or more second access control rules extracted from the access control policy of the first resource, and the entry review policy of the first group includes the selection results of the one or more second access control rules.

[0035] In combination with the third aspect, in certain implementations of the third aspect, the parameter value of the first parameter of the first member in the first group is the first parameter value, and the first member inherits the resource access rights carried by the first group. After the parameter value of the first parameter of the first member is changed from the first parameter value to the second parameter value, the first member no longer inherits the resource access rights carried by the first group.

[0036] In combination with the third aspect, in certain implementations of the third aspect, the first parameter belongs to a parameter indicated by the entry review policy of the first group, and the review module is also used to: after the parameter value of the first parameter of the first member is changed from the first parameter value to the second parameter value, determine according to the entry review policy of the first group that the first member no longer inherits the resource access rights carried by the first group.

[0037] In combination with the third aspect, in certain implementations of the third aspect, the status of members in the first group includes a valid state and an invalid state, members in a valid state inherit the resource access rights carried by the first group, and members in an invalid state do not inherit the resource access rights carried by the first group.

[0038] In combination with the third aspect, in certain implementations of the third aspect, the parameter value of the second parameter of the second member in the first group is the third parameter value, and the second member is in an invalid state. After the parameter value of the second parameter of the second member is changed from the third parameter value to the fourth parameter value, the second member is in a valid state.

[0039] In combination with the third aspect, in certain implementations of the third aspect, the second parameter belongs to the parameter indicated by the entry review policy of the first group, and the review module is also used to: after the parameter value of the second parameter of the second member is changed from the third parameter value to the fourth parameter value, determine that the second member is in a valid state according to the entry review policy of the first group.

[0040] In a fourth aspect, an access control device is provided, comprising: an acquisition module for receiving an access request from a visitor, the access request indicating that the visitor requests access to a first resource; a processing module for allowing the visitor to access the first resource if the visitor is in a group that carries access rights to the first resource, wherein members of the group that carries access rights to the first resource comply with the admission review policy of the group that carries access rights to the first resource, and the admission review policy of the group that carries access rights to the first resource is related to the access policy of the first resource.

[0041] Furthermore, the visitor is in a valid state in the group carrying the access rights to the first resource. The members in a valid state in the group carrying the access rights to the first resource inherit the access rights to the first resource.

[0042] In combination with the fourth aspect, in some implementations of the fourth aspect, the processing module is further used to: deny the visitor access to the first resource when the visitor is outside the group that has access rights to the first resource.

[0043] In combination with the fourth aspect, in certain implementations of the fourth aspect, the processing module is further used to: when the visitor is in an invalid state in the group carrying the access rights to the first resource, deny the visitor access to the first resource.

[0044] In combination with the fourth aspect, in certain implementations of the fourth aspect, the entry review policy of the group carrying access rights to the first resource includes one or more first access control rules extracted from the access control policy of the first resource, and the processing module is specifically used to: allow the visitor to access the first resource if the visitor is in the group carrying access rights to the first resource and the visitor satisfies other access control rules in the access control policy of the first resource except the one or more first access control rules.

[0045] It should be understood that the expansion, limitation, explanation and description of the relevant contents in the above-mentioned first aspect also apply to the same contents in the second to fourth aspects.

[0046] In a fifth aspect, a computing device cluster is provided, including at least one computing device, each computing device including a processor and a memory. The processor of at least one computing device is used to execute instructions stored in the memory of at least one computing device, so that the computing device cluster executes the method in any one of the implementations of the first aspect or the second aspect.

[0047] In a sixth aspect, a computer-readable medium is provided, comprising computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the method in any one of the implementations of the first aspect or the second aspect.

[0048] In a seventh aspect, a computer program product comprising instructions is provided. When the instructions are executed by a computing device cluster, the computing device cluster executes the method in any one of the implementations of the first aspect or the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 The following is a schematic flowchart of adding a user to a group.

[0050] Figure 2 The following is a schematic flowchart of an access process.

[0051] Figure 3 A schematic diagram of a cloud service scenario applicable to an embodiment of the present application.

[0052] Figure 4 A schematic flowchart of an access control method according to an embodiment of the present application.

[0053] Figure 5A schematic block diagram of an access control device according to an embodiment of the present application.

[0054] Figure 6 A schematic diagram of a resource access process according to an embodiment of the present application.

[0055] Figure 7 A schematic diagram of another resource access process according to an embodiment of the present application.

[0056] Figure 8 A schematic diagram of a group management process and a resource access process according to an embodiment of the present application.

[0057] Fig. 9 A schematic diagram of the architecture of an access control system according to an embodiment of the present application.

[0058] Fig.10 A schematic diagram of the architecture of another access control system according to an embodiment of the present application.

[0059] Fig.11 A schematic diagram of an access control device according to an embodiment of the present application.

[0060] Fig.12 A schematic block diagram of a computing device according to an embodiment of the present application.

[0061] Fig.13 It is a schematic block diagram of a computing device cluster according to an embodiment of the present application.

[0062] Fig.14 It is a schematic block diagram of another computing device cluster according to an embodiment of the present application. DETAILED DESCRIPTION

[0063] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0064] The present application will present various aspects, embodiments or features around a system including multiple devices, components, modules, etc. It should be understood and appreciated that each system may include additional devices, components, modules, etc., and / or may not include all devices, components, modules, etc. discussed in conjunction with the figures. In addition, combinations of these schemes may also be used.

[0065] In the embodiments of the present application, "corresponding (corresponding, relevant)" and "corresponding (corresponding)" can sometimes be used interchangeably. It should be pointed out that when the distinction between them is not emphasized, the meanings they intend to express are consistent.

[0066] The business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. A person of ordinary skill in the art can appreciate that, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0067] References to "one embodiment" or "some embodiments" etc. described in this specification mean that a particular feature, structure or characteristic described in conjunction with the embodiment is included in one or more embodiments of the present application. Thus, the phrases "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear at different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0068] In the present application, "at least one" means one or more, and "plurality" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: including the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0069] In order to better illustrate the solutions of the embodiments of the present application, the terms that may be involved in the embodiments of the present application are explained below.

[0070] 1. Cloud service: Cloud service providers provide cloud service resources to tenants through the Internet, so that tenants can manage and use the technical services provided by the providers without having to purchase, own and maintain physical data centers and servers.

[0071] 2. Cloud service resources: The related resources of technical services provided by cloud service providers to tenants through the Internet based on tenant needs, such as computing power, storage capacity, database, etc., which can be referred to as cloud resources.

[0072] 3. Tenant: An organization or individual that rents cloud service resources from a cloud service provider. The organization or individual can use and manage the cloud service resources it rents. For example, it can authorize users (such as users within the organization or other users) to use some or all of the cloud service resources as needed.

[0073] 4. User: An organization or individual who accesses cloud service resources. Users can include the tenant itself or other organizations or individuals to whom the tenant grants access to cloud service resources.

[0074] Cloud service providers allow tenants to use and manage corresponding cloud service resources through cloud accounts. By default, cloud account resources are private, that is, only the tenant who owns the cloud account has access to the resources in the cloud account. In order to allow other users to access cloud service resources, tenants can authorize some or all access rights to resources in the cloud account to other users through authorization policies.

[0075] 5. IAM: IAM is used to authenticate and verify access rights when resource access occurs. For example, the resources being accessed may include servers, databases, virtual machines, or applications. After passing the verification, the visitor can access the resource. Otherwise, the resource access request will be rejected. This framework is conducive to improving the security of resource access.

[0076] IAM can implement authorization through the group function. That is, authorization can be performed on a group basis to improve authorization efficiency. Authorization refers to adding permissions to access resources. Groups can also be called user groups. Users who join a specific group will inherit the permissions of the group and can use resources based on these permissions. When a user joins multiple groups, the user will have the permissions of multiple groups, that is, the full set of permissions of the multiple groups.

[0077] Administrators can create groups and add users to groups so that users in the group can obtain the permissions of the group.

[0078] Authorization policies are usually displayed in the form of JSON files, which can be used to describe who can perform certain operations on certain resources under certain conditions.

[0079] For example, an authorization policy can be represented as a set of statements that "allow" or "deny" resource access requests. For example, user A is allowed to perform operation A on resource A under condition A, or a user who meets condition B is allowed to perform operations other than operation B on resource B, or resource C is denied to perform operation C, etc. All statements in an authorization policy together constitute a set of resource access permissions.

[0080] Policy rules can be the content of the authorization policy, and the specific content of the policy can be restricted through policy rules. The effect of the rule can be "allow", "deny" and other effects in the policy.

[0081] Figure 1 A schematic diagram showing a process of adding a user to a group.

[0082] like Figure 1 As shown, the administrator can create a group and add resource access permissions to the group, for example, allowing the call to API#1. After receiving the request to add members to the group, the identity and permissions of the request initiator are confirmed. Then the user indicated by the administrator is added to the group. Members in the group can inherit the permissions of the group, that is, they have the permissions of the group.

[0083] When accessing some resources with a higher security level, it is usually necessary to review the visitor's identity and access rights to ensure the security of resource access. In this process, if the authentication takes a long time, it will affect the response speed of resource access and affect the user experience.

[0084] The following takes the cloud platform as an example for explanation.

[0085] Application services provide external resource access interfaces, namely APIs. APIs are predefined functions. Applications encapsulate their own service capabilities into APIs and open them to users for calling.

[0086] For example, a cloud service includes multiple cloud applications or cloud products, and developers can develop cloud APIs to provide tenants with service interfaces for various resources of cloud applications or cloud products. For example, in a cloud computing scenario, different APIs in an application can provide different services to tenants or users.

[0087] Fine-grained access control can be achieved through API access authentication, which is conducive to ensuring the security of resource access. Specifically, when an access request is received, the access request can be authenticated at the API call stage to determine whether the service is allowed to be provided.

[0088] In the cloud platform, authentication of API access can be achieved by cooperating with services that provide identity and permission management, authentication and authorization capabilities, and gateway services.

[0089] Figure 2 A schematic diagram of an access process is shown below. Figure 2 Describe the API access process in the cloud platform.

[0090] like Figure 2As shown, IAM services can be used to provide identity and authority management, authentication and authorization capabilities. Gateway services can include API gateways and / or application gateways.

[0091] Administrator (such as Figure 2 A1 to A4 in the Figure 2 Each group may include one or more members (e.g. Figure 2 M1 to M3 in the figure). The entry restriction of each group is that members are added by the administrator. The administrator can add resource access permissions to the group (such as Figure 2 For example, administrator A1 can add the resource access permission "Allow API#1 to be called" to group G1, and members M1 and M2 in the group can inherit the permission of the group, that is, they can call API#1.

[0092] like Figure 2 As shown in Figure 1, IAM can be used to provide identity and credential management services as well as policy management services. Visitors use IAM to authenticate their identities and obtain a token. Visitors call an API to request access to a resource, and the resource access request carries the authentication token. Gateways (such as Figure 2 The API gateway and application gateway in the APP can call IAM to complete the visitor identity verification and access permission verification. Specifically, the IAM service reviews the visitor's permissions and whether the visitor meets the access conditions. If the review is passed, the gateway allows the visitor to access resources.

[0093] In the above API call stage, there are many fine-grained access control condition audit items, and the authentication process needs to be audited item by item, which takes a long time and has the risk of authentication timeout. In addition, in some solutions, in order to avoid the problem of authentication timeout, or if authentication timeout occurs, in order to avoid affecting the user experience, access may be allowed directly before the authentication process is completed, which poses a security risk of illegal access.

[0094] In view of this, an embodiment of the present application provides an access control method, which is conducive to ensuring the security of resource access.

[0095] In a possible implementation, the solution of the embodiment of the present application can be applied to a cloud service scenario. The method is executed by a cloud management platform in the cloud service. In order to better describe the solution of the present application, the cloud service scenario is described below.

[0096] Figure 3 It is a schematic diagram of a cloud service scenario applicable to an embodiment of the present application.

[0097] like Figure 3As shown, the scenario may include a cloud management platform 110 , the Internet 120 , and a client 130 .

[0098] like Figure 3 As shown, the cloud management platform 110 is used to manage the infrastructure that provides multiple cloud services. The infrastructure includes multiple cloud data centers, each of which includes multiple servers, each of which includes cloud service resources to provide corresponding cloud services for tenants.

[0099] The cloud management platform 110 may provide an access interface (such as an interface or API). The tenant may operate the client 130 to remotely access the access interface to register a cloud account and password on the cloud management platform 110, and log in to the cloud management platform 110. After the cloud management platform 110 successfully authenticates the cloud account and password, the tenant may further pay to select and purchase a virtual machine with specific specifications (processor, memory, disk) on the cloud management platform 110. After the payment is successful, the cloud management platform 110 provides the remote login account and password of the purchased virtual machine, and the client 130 may remotely log in to the virtual machine, and install and run the tenant's application in the virtual machine.

[0100] Tenants of cloud services can be individuals, enterprises, schools, hospitals, administrative agencies, etc.

[0101] The functions that the cloud management platform 110 can provide include, but are not limited to, user console, computing management service, network management service, storage management service, authentication service, and image management service. The user console provides an interface or API to interact with tenants, the computing management service is used to manage servers running virtual machines and containers and bare metal servers, the network management service is used to manage network services (such as gateways, firewalls, etc.), the storage management service is used to manage storage services (such as data bucket services), the authentication service is used to manage tenant accounts and passwords, and the image management service is used to manage virtual machine images.

[0102] The tenant can use the client 130 to log in to the cloud management platform 110 through the Internet 120 to manage the rented cloud services.

[0103] For example, in an embodiment of the present application, a tenant can call a cloud API through a cloud management platform, or can implement complete API life cycle management through an API gateway service or an API management application provided by the cloud management platform.

[0104] It should be understood that the above is only an example, and the solution of the embodiment of the present application can also be applied to other resource access scenarios, and the embodiment of the present application is not limited to this.

[0105] Figure 4An access control method provided by an embodiment of the present application is shown. The method 400 is used to implement the review of members to be added to a group, and can also be referred to as a group entry review method.

[0106] like Figure 4 As shown, method 400 may include the following steps.

[0107] 410 , obtain a first joining request, where the first joining request indicates an out-of-group member to be added to the first group.

[0108] Members in the first group can inherit the resource access rights carried by the first group. The rights carried by the first group include a first right, and the first right indicates that access to the first resource is allowed.

[0109] The "first" in "first group", "first group entry request", "first permission" and "first resource" is only used for convenience of description and has no other limiting function. For example, the "first group" can be any group in one or more groups, the "first group entry request" can be any group entry request, and the "first resource" can be any resource, etc. For the sake of ease of description, the embodiments of the present application are mainly described by taking the first group as an example, and other groups can also be processed in the same way as the first group.

[0110] A request to join a group may also be called a request to add a member.

[0111] The resource access rights carried by a group can also be called the group's permissions. Members in a group are eligible to inherit the group's permissions. If a member inherits the group's permissions, the member has the access rights to the resources carried by the group and can access the resources.

[0112] The first permission is the access permission of the first resource. If a member of the first group inherits the first permission of the first group, then the member has the access permission of the first resource and can access the first resource.

[0113] 420 , judging whether to allow the non-group member to join the first group according to the admission review policy of the first group.

[0114] In other words, whether to allow the first admission request is determined according to the admission review policy of the first group. In other words, it is determined whether the out-group member meets the admission review policy of the first group.

[0115] The admission review policy of the group indicates the admission conditions of the group. Step 420 is to determine whether the out-group member meets the admission conditions of the first group according to the admission review policy of the first group.

[0116] For example, when the out-group member meets the admission conditions of the first group (i.e., complies with the admission review policy of the first group), the out-group member is allowed to join the first group; when the out-group member does not meet the admission conditions of the first group (i.e., does not comply with the admission review policy of the first group), the out-group member is denied to join the first group.

[0117] The admission review policy of the first group may include conditions for allowing and / or refusing to join the first group. For example, the admission review policy of the first group may include allowing admission to the group if condition A is met. In this case, the out-group member's compliance with the admission review policy of the first group includes the out-group member's satisfaction of condition A. For another example, the admission review policy of the group may include refusing admission to the group if condition B is met. In this case, the out-group member's compliance with the admission review policy of the first group includes the out-group member's failure to meet condition B.

[0118] The above is only an example, and the embodiments of the present application do not limit the specific form of the admission review strategy.

[0119] In a possible application scenario, method 400 may be applied to a cloud management platform. The cloud management platform is used to manage infrastructure, and the infrastructure includes at least one cloud data center. Each cloud data center may be provided with multiple servers. Method 400 is described below in conjunction with this application scenario.

[0120] Exemplarily, the method 400 may be applied to a public cloud, a hybrid cloud, or a private cloud.

[0121] Method 400 may be performed by an access control device. The access control device may be used to provide identity management and access control functions. The access control device may be deployed in a cloud management platform. The access control device may be an independent product (such as a cloud platform application, service, or microservice, etc.), or may be a functional module in a product.

[0122] The access control device may also be referred to as an identity authority management platform, or simply referred to as a platform.

[0123] Exemplarily, the access control method may be performed by any of the following: an IAM service, an API gateway, or an application gateway, etc. This embodiment of the present application does not limit this.

[0124] Figure 5 FIG. 1 is a schematic block diagram of an access control device according to an embodiment of the present application. Figure 5 As shown, the access control device may include an identity and credential management module 510 and a policy management module 520 .

[0125] The identity and credential management module 510 may include a group management module 511 .

[0126] The policy management module 520 may include a group permission module 521 and a group admission review module 522 .

[0127] The group management module 511 is used to receive a group joining request and call the group joining review module 522 to review the non-group members to be added to the group indicated by the group joining request.

[0128] The group admission review module 522 is used to review the non-group member according to the group admission review policy, that is, to review whether the non-group member complies with the group admission review policy. If it complies, the review is passed; if it does not comply, the review is not passed.

[0129] After receiving the group joining request, the group management module 511 may call the group joining review module 522 to review whether the out-of-group member indicated by the group joining request complies with the group joining review policy.

[0130] Furthermore, the group management module 511 may also be used to monitor changes in relevant information of the group.

[0131] Optionally, the group management module 511 can also be used to monitor changes in member information. When a member's information changes, the group management module 511 can be used to call the group admission review module 522 to review the member whose information has changed.

[0132] The monitored members may include members in the current group, or members in the current group and members in previous groups.

[0133] Exemplarily, the group management module 511 can connect with other modules to obtain dynamic information in real time. Alternatively, the group management module 511 can obtain changes in member information by passively receiving notifications, that is, when member information changes, other modules can notify the group management module 511 of the changes.

[0134] The above is only an example, and the group management module 511 may also monitor changes in relevant information of the group in other ways, which is not limited in this embodiment of the present application.

[0135] The group authority module 521 is used to set authority for the group and manage the authority of the group.

[0136] Furthermore, the admission review module 522 may also be used to set an admission review strategy.

[0137] Figure 5 The detailed description of each module shown can be found in the following text and will not be elaborated here.

[0138] It should be understood that Figure 5The division method of the modules in the access control device shown, the number of modules, the location of the modules and the connection relationship, etc. are only examples and do not constitute a limitation on the access control device of the embodiment of the present application.

[0139] The identity rights management platform in the embodiment of the present application supports the setting of groups. The group is the IAM group. Members in the group and members outside the group are all IAM members. The group can be set by the administrator.

[0140] A group may also be referred to as a user group. In the embodiment of the present application, a group may be understood as an identity group carrying permissions.

[0141] Exemplarily, the identity may be the identity of an organization or an individual, or the identity of an application.

[0142] Resources may include applications, services, microservices, servers, databases, or virtual machines, etc. The embodiments of the present application are mainly described by taking applications, services, or microservices as examples, and do not limit the solutions of the embodiments of the present application.

[0143] Exemplarily, a resource may include an API. Accessing a resource is calling an API. The first resource may include a first API.

[0144] Method 400 may be performed by Figure 5 For example, step 410 may be performed by the group management module 511, and step 420 may be performed by the group admission review module 522. After receiving the first group admission request, the group management module 511 may call the group admission review module 522 to review the out-of-group members.

[0145] In method 400 , the joining request may be triggered by an administrator, or in other words, the identity of the subject who triggers the joining request is the administrator.

[0146] Administrators can set access permissions for members or groups. When an administrator triggers a request to add a member to a group, the administrator can review whether the request is allowed based on the group admission review policy.

[0147] Optionally, the first join request may be triggered by an administrator.

[0148] When the administrator adds members, some members can join the group, while some members will be rejected.

[0149] Specifically, only members who meet the admission review policy can join the group, and members who do not meet the admission review policy will be denied admission.

[0150] The group admission review policy may not include the system's default restrictions, such as length restrictions, or identities that are not registered on the management platform. For example, whether the member to be admitted has registered his identity on the management platform has nothing to do with whether the member can pass the group admission review.

[0151] As a possible example, the subject that triggers the enroll request can be any identity.

[0152] Exemplarily, step 420 may include: determining whether to allow the first admission request according to a subject that triggers the first admission request and an admission review policy of the first group.

[0153] After obtaining the first group admission request, it can be reviewed whether the subject that triggered the first group admission request is the administrator of the first group, and whether the members outside the audit group meet the admission audit policy of the first group. If the subject that triggered the first group admission request is the administrator of the first group, and the members outside the audit group meet the admission audit policy of the first group, the members outside the audit group are added to the first group. Otherwise, the first group admission request is rejected. The embodiment of the present application does not limit the execution order of the audit.

[0154] As another possible example, the identity of the subject that triggers the join request is an administrator.

[0155] In other words, the platform can only support administrators' requests to add members. Only administrators can trigger a request to join a group, and entities with other identities cannot trigger a request to join a group.

[0156] In this way, after obtaining the first group entry request, there is no need to review the identity of the subject that triggered the first group entry request. If the out-of-group member meets the group entry review policy of the first group, the out-of-group member is added to the first group. Otherwise, the first group entry request is rejected.

[0157] The above is only an example and does not constitute a limitation on the solutions of the embodiments of the present application.

[0158] As described above, the entry restriction of the first group includes that the out-group member to be added to the first group needs to be added by the administrator and the out-group member needs to pass the verification of the entry review policy.

[0159] For example, Fig. 9 As shown, G1 can be used as an example of the first group. The entry restriction of G1 includes both administrator addition and policy verification, that is, verification of the entry review policy. When adding members, it is necessary to verify the identity and authority of the operator, and to restrict the operated object, that is, the added member. That is, only when the operator's identity is administrator A1 and the added member meets the entry review policy, the member is allowed to join the group. Figure 1Compared with the scheme shown in the figure, the group entry restriction of G1 adds the verification condition of the group entry audit policy, which realizes stricter control over the group entry behavior and is conducive to ensuring the security of resource access.

[0160] In the solution of the embodiment of the present application, whether a member can be allowed to join the group is determined by the group admission review policy, which increases the restriction conditions for member admission, enhances the authorization management and control, and is conducive to improving the security of resource access.

[0161] Optionally, the admission review policy of the first group is related to the access control policy of the first resource.

[0162] In other words, the admission review policy of the first group is determined according to the access control policy of the first resource.

[0163] The access control policy of a resource can also be called the access condition of the resource. Only visitors who meet the access condition of the resource (i.e., meet the access control policy of the resource) can access the resource.

[0164] The access control policy of a resource may indicate conditions for allowing and / or denying access to the resource. For example, the access control policy of a first resource may include allowing access to the first resource if condition C is satisfied. In this case, the visitor's compliance with the access control policy of the first resource may include the visitor satisfying condition C. For another example, the access control policy of the first resource may include denying access to the first resource if condition D is satisfied. In this case, the visitor's compliance with the access control policy of the first resource may include the visitor not satisfying condition D.

[0165] The above is only an example, and the embodiments of the present application do not limit the specific form of the resource access control policy.

[0166] Exemplarily, the access control policy of the first resource may indicate the conditions for allowing access to the first resource. For example, the conditions for allowing access to the first resource may include: the visitor's authentication credibility is high, and the visitor's login Internet Protocol (IP) address is in the whitelist of login IP addresses. For another example, the conditions for allowing access to the first resource may include that the visitor's login IP address is a common login IP address of the visitor, etc.

[0167] The visitor's authentication credibility may be the credibility of the visitor's identity authentication method. For example, the credibility of the identity authentication method may be based on password complexity. A high password complexity means a high credibility of the identity authentication method.

[0168] The level of authentication credibility can be set as required.

[0169] Exemplarily, the level of authentication credibility can be determined according to the complexity of the password. For example, a password including uppercase letters, lowercase letters, numbers, and special symbols can be considered to have high authentication credibility; a password including only numbers can be considered to have low authentication credibility, and the rest of the passwords can be considered to have medium authentication credibility.

[0170] Exemplarily, the level of authentication credibility can be determined according to the login method. For example, the login method of logging in through an account and password can be regarded as having low authentication credibility; the login method of logging in through a mobile phone number verification method can be regarded as having medium authentication credibility; and the login method of logging in through face recognition can be regarded as having high authentication credibility.

[0171] The above is only an example and does not constitute a limitation on the setting method of the authentication credibility level in the embodiment of the present application.

[0172] For example, the rule that the visitor's login IP address is in the whitelist of login IP addresses can be applied to the scenario where the access request is triggered by a fixed IP. This rule can also be applied to other scenarios, which are not limited in the embodiments of the present application.

[0173] The access control policy of a resource may include one or more access control rules. Alternatively, the access control policy of a resource may be understood as a collection of access control rules of the resource.

[0174] For example, the access control policy of the first resource may indicate that access to the first resource is allowed when the visitor's authentication credibility is high and the visitor's login IP address is in the whitelist of login IP addresses. The access control policy can be considered to include two access control rules, namely, the visitor's authentication credibility is high and the visitor's login IP address is in the whitelist of login IP addresses.

[0175] Optionally, the admission audit policy of the first group may include one or more first access control rules extracted from the access control policy of the first resource.

[0176] The "first" in "first access control rule" is only used to limit the access control rule to be extracted from the access control policy of the first resource and belongs to the admission review policy of the first group, and has no other limiting effect. That is, if an access control rule extracted from the access control policy of the first resource belongs to the admission review policy of the first group, then the access control rule is the first access control rule.

[0177] Exemplarily, the one or more first access control rules may be part or all of the access control rules in the access control policy of the first resource.

[0178] As mentioned above, the access control policy of the first resource can be regarded as a set of access control rules of the first resource. The set consisting of one or more first access control rules can be regarded as a subset of the set of access control rules of the first resource.

[0179] If a group carries access rights to a resource, when an outside member joins the group, the outside member can be audited according to the access control rules extracted from the access control policy of the resource. The outside member can join the group only if he / she passes the audit. In other words, the members of the group meet the access control rules extracted from the access control policy of the resource.

[0180] Optionally, when the access request to the first resource comes from a member within the first group, the access control rules used to authenticate the access request may include access control rules in the access control policy of the first resource other than the one or more first access control rules.

[0181] It should be understood that the group entry audit policy of the first resource may include all access control rules in the access control policy of the first resource, that is, the one or more first access control rules may be all access control rules in the access control policy of the first resource. In the case where the access request to the first resource comes from a member in the first group, the set of access control rules used to authenticate the access request is an empty set. That is, if the visitor is in a group that carries access rights to the resource, there is no need to review whether the visitor meets the access conditions of the resource during the resource call phase.

[0182] The access request may be received by a gateway. The gateway may include an application gateway and / or an API gateway. After receiving the access request, the gateway may authenticate the access request.

[0183] Exemplarily, the authentication operation can be performed by the gateway itself, or by the gateway through an access control device. For example, the access control device can be an IAM service, and the gateway can call the IAM service to perform authentication.

[0184] Taking the group entry audit policy of a group carrying access rights to a resource as an example, including all access control rules extracted from the access control policy of the resource, when an out-group member joins the group, the out-group member needs to be audited according to all access control rules. Only out-group members who pass the audit may join the group. In this way, after receiving the access request to the resource, it can be determined whether the visitor has inherited the access rights to the resource, for example, whether the visitor is in the group carrying the access rights to the resource. If the visitor is in the group carrying the access rights to the resource, there is no need to audit whether the visitor meets the access conditions of the resource during the resource call stage, and the visitor is allowed to access the resource. This reduces the number of access control rules that need to be judged during the resource call stage, thereby reducing the authentication time, while ensuring the security of resource access, and improving the response speed of resource access.

[0185] Taking the group entry audit strategy of a group carrying access rights to a resource as an example, including some access control rules extracted from the access control policy of the resource, when an out-group member joins the group, the out-group member needs to be audited according to the part of the access control rules. Only out-group members who pass the audit may join the group. In this way, after receiving the access request to the resource, it can be determined whether the visitor has inherited the access rights to the resource, for example, whether the visitor is in the group carrying the access rights to the resource. If the visitor is in the group carrying the access rights to the resource, it can only be determined whether the visitor meets the remaining access control rules in the access control policy of the resource. If so, the visitor is allowed to access the resource. This reduces the number of access control rules that need to be judged in the resource call stage, thereby reducing the authentication time, while ensuring the security of resource access, improving the response speed of resource access.

[0186] In an embodiment of the present application, the group admission review policy is related to the access control policy of the resources that the group carries and is allowed to access, so that the review process of the access control policy in the resource call phase can be partially or completely pre-placed in the group admission review phase. In other words, in the group admission review phase, it can be determined whether the members have met some or all of the conditions for accessing the resources, which can reduce the number of access control rules that need to be reviewed in the resource call phase, thereby reducing the authentication time consumption in the resource call phase, improving the authentication efficiency, and preventing authentication timeouts, which is beneficial to improving the response speed of resource access while ensuring the security of resource access, and thus helping to improve user experience. At the same time, it is also beneficial to prevent security risks caused by authentication timeouts.

[0187] Exemplarily, if the first group carries access rights to multiple resources, the admission audit policy of the first group may be related to the access control policy of each of the multiple resources. For example, the first group carries access rights to a first resource and access rights to a second resource, and the admission audit policy of the first group may include one or more access control rules extracted from the access control policy of the first resource and one or more access control rules extracted from the access control policy of the second resource. For another example, the admission audit policy of the first group may include the same access control rules in the access control policy of the first resource and the access control policy of the second resource.

[0188] Alternatively, if the first group carries access rights to multiple resources, the admission audit policy of the first group may be related to the access control policies of some of the multiple resources. For example, the first group carries access rights to a first resource and access rights to a second resource, the admission audit policy of the first group may include one or more access control rules extracted from the access control policy of the first resource, and the admission audit policy of the first group may be independent of the access control policy of the second resource.

[0189] Optionally, the method 400 may further include: receiving a first permission setting request, where the first permission setting request indicates adding a first permission for the first group.

[0190] The permission setting request may be triggered by an administrator, or in other words, the subject of the permission setting request is an administrator. After obtaining a request for setting permissions for a group triggered by an administrator of the group, corresponding permissions can be added to the group.

[0191] Optionally, the first permission setting request may be triggered by an administrator.

[0192] As a possible example, the subject that triggers the enroll request can be any identity.

[0193] Exemplarily, the method 400 may further include: determining whether to add the first permission for the first group according to a subject that triggers the permission setting request.

[0194] After obtaining the permission setting request, it can be checked whether the subject that triggers the permission setting request is the administrator of the first group. If the subject that triggers the permission setting request is the administrator of the first group, the first permission is added to the first group.

[0195] As another possible example, the identity of the subject that triggers the permission setting request is an administrator.

[0196] In other words, the platform can only support requests from administrators to add permissions. The only subject that can trigger a permission setting request is the administrator, and subjects with other identities cannot trigger a permission setting request.

[0197] In this way, after the first permission setting request is obtained, the first permission is added to the first group.

[0198] For example, Fig. 9 The group permission module 521 in the embodiment can be used to add a first permission to the first group.

[0199] The above is only an example and does not constitute a limitation on the solutions of the embodiments of the present application.

[0200] The following describes how to set the group admission review policy.

[0201] In a possible implementation, the admission review policy of the first group may be set by an administrator.

[0202] Optionally, the method 400 may further include step 401 and step 402 (not shown in the figure).

[0203] 401, Get the first input strategy.

[0204] 402. Determine an admission review strategy for the first group according to the first strategy.

[0205] Exemplarily, step 401 and step 402 may be performed by Figure 5 The entry review module 522 is executed.

[0206] The "first" in "first strategy" is only used to limit the strategy as the input strategy, and does not limit other contents such as the number and order of strategies.

[0207] Optionally, the first policy may be input by an administrator.

[0208] That is, the platform can support administrators to add group admission review policies.

[0209] As a possible example, the identity of the subject who adds the group entry audit policy is an administrator.

[0210] In other words, the platform can only support the addition of group entry review policies by administrators. Only administrators can add group entry review policies, or in other words, only administrators can trigger the addition request of group entry review policies. Subjects with other identities cannot add group entry review policies.

[0211] In this way, after obtaining the input policy, there is no need to verify the identity of the subject who inputs the policy.

[0212] Exemplarily, after receiving a setting request for the admission audit policy of the first group, it is not necessary to audit the identity of the subject that triggered the setting request. The policy indicated by the setting request is the first policy.

[0213] As another possible example, any identity can be added to the group entry review policy.

[0214] After obtaining the input policy, the platform can determine whether the policy is input by the administrator.

[0215] Exemplarily, after receiving a setting request for the admission audit policy of the first group, it may be checked whether the subject triggering the setting request is an administrator of the first group. If so, the policy indicated by the setting request is the first policy, otherwise, the policy indicated by the setting request is not the first policy.

[0216] Exemplarily, the first policy may be used as the admission review policy for the first group. In this case, the above steps may also be understood as: obtaining the input admission review policy for the first group.

[0217] Exemplarily, the first policy may be customized by an administrator.

[0218] That is, the first policy may be a policy written by an administrator.

[0219] Alternatively, the first policy may be selected from one or more second access control rules extracted from an access control policy of the first resource.

[0220] That is, the first policy may be a selection result of the one or more second access control rules.

[0221] The "second" in "second access control rule" is only used to limit the access control rule to be extracted from the access control policy of the first resource and provided to the administrator for selection, and has no other limiting effect. That is, if an access control rule extracted from the access control policy of the first resource is provided to the administrator for selection, then the access control rule is the second access control rule.

[0222] Exemplarily, the one or more second access control rules may be part or all of the access control rules in the access control policy of the first resource.

[0223] As mentioned above, the access control policy of the first resource can be regarded as a set of access control rules of the first resource. The set of one or more second access control rules can be regarded as a subset of the set of access control rules of the first resource.

[0224] Exemplarily, the one or second access control rule may be referred to as a general access control rule of the first resource. The general access control rule of the first resource may also be referred to as a general rule or general policy of the first resource. The set formed by the one or second access control rule may also be referred to as a general policy set of the first resource.

[0225] Common access control rules for resources can be extracted in a variety of ways.

[0226] For example, the general access control rule of the first resource may be extracted from the access control policy of the first resource by a functional module for extracting the general control rule. Fig. 9 As shown, the API gateway is provided with an API general rule management module 911. The API general rule management module 911 can be used to extract general access control rules for resources.

[0227] For another example, the general access control rule of the first resource may be extracted by the designer of the first resource from the access control policy of the first resource.

[0228] The embodiment of the present application does not limit the specific method of extracting the general access control rules.

[0229] The definition method of the general access control rule of the first resource can be set as needed.

[0230] Exemplarily, the rule items in the access control policy of the first resource that are related to information with a low frequency of change in the visitor's information can be used as the general access control rules of the first resource.

[0231] For example, the general access control rule of the first resource may include that the visitor's login IP is in the login IP whitelist, and / or that the visitor's authentication credibility is high.

[0232] The above is only an example, and the embodiment of the present application does not limit the definition method of the general access control rules.

[0233] Optionally, before step 401, method 400 may further include: obtaining the one or more second access control rules; displaying the one or more second access control rules; and obtaining a selection result of the one or more second access control rules. The first policy may be a selection result of the one or more second access control rules.

[0234] Exemplarily, the one or more second access control rules may be composed of Fig. 9 The entry review module 522 from Fig. 9 The API general rule management module 911 is obtained and displayed through the front-end interface.

[0235] Exemplarily, after setting the first group to carry the first permission, the general access control rules of the first resource can be displayed through the front-end interface and configured by the administrator. The access control rules selected by the administrator can be used as the entry review policy for the first group. For example, if the administrator selects all of the general access control rules, the entry review module 522 can associate the general access control rules of the first resource with the first group.

[0236] As mentioned above, the admission audit policy of the first group may include one or more first access control rules extracted from the access control policy of the first resource. The one or more first access control rules may be selected by the administrator from one or more second access control rules. That is, the first policy may include the one or more first access control rules.

[0237] In one possible implementation, the group admission review policy may be set by the platform.

[0238] Optionally, the method 400 may further include: obtaining one or more second access control rules; and determining an admission review policy for the first group according to the one or more second access control rules.

[0239] As mentioned above, the admission audit policy of the first group may include one or more first access control rules extracted from the access control policy of the first resource. The one or more first access control rules may be selected by the platform from one or more second access control rules.

[0240] For example, after setting the first group to carry the first permission, the platform sets the one or more second access control rules as the admission review policy of the first group.

[0241] The above settings can also be used in combination. For example, some rules in the admission audit policy of the first group can be customized by the administrator, and some rules can be selected by the administrator from the one or more second access control rules. For another example, some rules in the admission audit policy of the first group can be the one or more second access control rules preset by the platform, and some rules can be customized by the administrator.

[0242] In addition, the above is only an example and does not constitute a limitation on the solution of the embodiment of the present application. The entry review strategy can also be set in other ways.

[0243] Furthermore, when the relevant information of a group changes, the inheritance of the members' permissions to the group may change.

[0244] Optionally, when relevant information of the group changes, the group entry review can be triggered again to determine whether the member can inherit the permissions of the group.

[0245] For example, the changes in the relevant information of the group can be represented by Figure 5 The group management module 511 in the group management module 511 monitors. When the group management module 511 monitors that the relevant information of the group has changed, the group entry review module 522 can be called to process.

[0246] In this way, the relevant information of the group can be dynamically monitored, so as to timely adjust the status of whether the members in the group can inherit the group permissions, thereby ensuring the security of resource access.

[0247] In a possible implementation, the relevant information of the group may include information of members in the group. That is, when the information of a member in the group changes, whether the member can inherit the authority of the group may change.

[0248] For a member who currently inherits the permissions of the first group, if the information of the member changes, the member may no longer inherit the permissions of the first group.

[0249] Optionally, the parameter value of the first parameter of the first member in the current first group is the first parameter value, and the first member inherits the permissions of the first group. After the parameter value of the first parameter of the first member is changed from the first parameter value to the second parameter value, the first member no longer inherits the permissions of the first group.

[0250] "First member" can be any member of the current first group who inherits the permissions of the first group, and "first" has no other limiting effect. "First parameter value" and "second parameter value" are only used to limit two different parameter values ​​and have no other limiting effect.

[0251] Whether a member inherits the group's permissions can be achieved in a variety of ways.

[0252] As a possible example, all members in the first group inherit the permissions of the first group. Members outside the first group cannot inherit the permissions of the first group.

[0253] Exemplarily, after the parameter value of the first parameter of the first member is changed from the first parameter value to the second parameter value, the first member is deleted from the first group.

[0254] That is, the first member is delisted and is no longer a member of the first group. Thus, the first member no longer inherits the authority of the first group.

[0255] As another possible example, whether a member of the first group inherits the authority of the first group is indicated by the status of the member. The status may include a valid status and an invalid status.

[0256] Members in the first group that are in a valid state inherit the permissions of the first group. Members in the first group that are in an invalid state do not inherit the permissions of the first group. The platform can support viewing the status of members in the group.

[0257] Or it can be understood as follows: in the first group, only members in a valid state are regarded as members of the first group, and members in an invalid state in the first group may not be regarded as members of the first group.

[0258] Exemplarily, after the parameter value of the first parameter of the first member is changed from the first parameter value to the second parameter value, the first member is changed from a valid state to an invalid state. In this way, the first member no longer inherits the authority of the first group.

[0259] It should be understood that the above is only an example, and other methods may be used to prevent members in the first group from inheriting the permissions of the first group, which is not limited in this embodiment of the present application.

[0260] For a member who once inherited the authority of the first group but currently no longer inherits the authority of the first group, if the information of the member changes, the member may resume inheritance of the authority of the first group.

[0261] As described above, the status of a member in the first group may be used to indicate whether the member inherits the authority of the first group.

[0262] Optionally, the parameter value of the second parameter of the second member is the third parameter value, and the second member is in an invalid state in the first group. After the parameter value of the second parameter of the second member is changed from the third parameter value to the fourth parameter value, the second member is changed from the invalid state to the valid state. In this way, the second member resumes inheritance of the permissions of the first group.

[0263] The "second member" can be any member that does not currently inherit the permissions of the first group, and "second" has no other limiting effect. The "third parameter value" and "fourth parameter value" are only used to limit two different parameter values ​​and have no other limiting effect.

[0264] The first parameter and the second parameter may be the same parameter or different parameters.

[0265] As described above, for a member who originally inherited the authority of the first group, if his information changes, he can be delisted from the group. If the information of the member changes after delisting, he can be re-listed.

[0266] As an example, the degrouping process may be to transfer the member from the first group to a first backup group of the first group. The first backup group of the first group includes all members degrouped from the first group.

[0267] For example, if the second member in the first backup group of the first group is not in the first group, after the parameter value of the second parameter of the second member is changed from the third parameter value to the fourth parameter value, the second member is re-grouped, that is, the second member is transferred from the first backup group of the first group to the first group. In this way, the second member resumes inheritance of the permissions of the first group.

[0268] As an example, the second backup group of the first group may include all members who have joined the first group, that is, no matter whether the member is currently in the first group, as long as the member has joined the first group, the member can join the second backup group of the first group.

[0269] For example, the second member in the second backup group of the first group is not in the first group. After the parameter value of the second parameter of the second member is changed from the third parameter value to the fourth parameter value, the second member is re-grouped, that is, the second member is added to the first group. In this way, the second member resumes inheritance of the permissions of the first group.

[0270] As an example, the third backup group of the first group may include all members added by the administrator. That is, no matter whether the member has passed the verification of the admission audit policy of the first group or has been delisted, as long as the member has been added to the first group by the administrator, he or she can join the third backup group of the first group.

[0271] For example, the second member in the third backup group of the first group is not in the first group. After the parameter value of the second parameter of the second member is changed from the third parameter value to the fourth parameter value, the second member is re-grouped, that is, the second member is added to the first group. In this way, the second member inherits the authority of the first group.

[0272] In this way, the platform can monitor member information changes so that members can restore inherited group permissions, for example, allowing members to rejoin the group without the need for administrators to add them again.

[0273] The first backup group, the second backup group, and the third backup group may have a cleanup function. Taking the first backup group as an example, for example, the system may support the administrator to clear the members in the first backup group; for another example, the system may automatically clean up the members in the first backup group. For example, the system may monitor the information of the members in the first backup group, and if the member in the first backup group has expired (for example, the user has logged out), the member may be removed from the first backup group.

[0274] It should be understood that the above is only an example, and the member may also be restored to inherit the permissions of the first group in other ways, which is not limited in this embodiment of the present application.

[0275] Furthermore, when a member's information is changed, a group entry review may be triggered to determine whether the member can inherit the permissions of the first group.

[0276] In other words, after a member's information is changed, the member can be reviewed again according to the admission review policy of the first group. If the review is passed, the member can inherit the permissions of the first group. Otherwise, the member cannot inherit the permissions of the first group.

[0277] For example, after a member's information is changed, the member can be reviewed again according to the first group's review policy, and the member's status is recorded according to the review result. If the review is passed, the member's status is recorded as valid, otherwise, the member's status is recorded as invalid.

[0278] The first parameter and the second parameter belong to the range of information indicated by the admission audit policy of the first group.

[0279] by Figure 5 For example, the group management module 511 can record the status of the member according to the review result of the group entry review module 522.

[0280] In this case, the first member no longer inherits the authority of the first group, which may be determined according to the admission review policy of the first group.

[0281] Optionally, after the parameter value of the first parameter of the first member is changed from the first parameter value to the second parameter value, it is determined according to the admission review policy of the first group that the first member no longer inherits the authority of the first group.

[0282] After the parameter value of the first parameter of the first member is changed from the first parameter value to the second parameter value, the first member is audited according to the admission audit policy of the first group. If the audit fails, the first member no longer inherits the authority of the first group.

[0283] In this case, whether the second member resumes inheriting the permissions of the first group may be determined according to the admission review policy of the first group.

[0284] Optionally, after the parameter value of the second parameter of the second member is changed from the third parameter value to the fourth parameter value, it is determined according to the admission review policy of the first group that the second member resumes inheriting the permissions of the first group.

[0285] After the parameter value of the second parameter of the second member is changed from the third parameter value to the fourth parameter value, the second member is audited according to the admission audit policy of the first group. If the audit is passed, the second member resumes inheriting the permissions of the first group.

[0286] The platform may monitor changes in information of members in the first group. For example, the platform may monitor changes in information of members in the current first group. For example, the platform may monitor changes in information of members in the current first group and information of members in any backup group of the first group.

[0287] For example, the monitoring method may be that the platform obtains dynamic information in real time through other modules. For another example, the monitoring method may also be that when the member's information changes, other modules notify the platform. The embodiment of the present application does not limit the monitoring method of the member's information change.

[0288] Exemplarily, the scope of the monitored member information may be the scope of the member information indicated by the group entry audit policy.

[0289] The first parameter belongs to the scope of the member information indicated by the group audit policy.

[0290] For example, the admission audit policy of the first group includes that the login IP of the auditee is in the whitelist of login IPs. The information indicated by the admission audit policy includes the login IP. The first parameter may be the login IP. The second parameter may be the login IP. The platform may monitor the changes in the login IPs of the members in the first group, and if the login IP of a member changes, the admission audit is triggered.

[0291] In a possible implementation, the relevant information of the group may include the group's admission review policy. That is, when the group's admission review policy changes, members of the group may no longer inherit the group's permissions. Alternatively, when the group's admission review policy changes, members of the group may resume inheriting the group's permissions.

[0292] For example, the administrator can modify the admission review policy of the first group.

[0293] For another example, the administrator can modify the access rights of the resources of the first group, and accordingly, the admission review policy of the first group may change.

[0294] The above is only an example, and the embodiment of the present application does not limit the method of changing the admission review policy.

[0295] Optionally, the third member in the first group inherits the permissions of the first group. After the admission review policy of the first group is changed from the first admission review policy to the second admission review policy, the third member no longer inherits the permissions of the first group.

[0296] The "third member" can be any member of the current first group who inherits the permissions of the first group. "Third" does not have any other limiting effect. The "first group admission review strategy" and "second group admission review strategy" are only used to limit two different group admission review strategies and do not have any other limiting effect.

[0297] For a member who currently inherits the permissions of the first group, if the admission review policy of the first group changes, the member may no longer inherit the permissions of the first group.

[0298] Exemplarily, after the admission review policy of the first group is changed from the first admission review policy to the second admission review policy, the third member is deleted from the first group.

[0299] Alternatively, after the admission review policy of the first group is changed from the first admission review policy to the second admission review policy, the status of the third member is changed from a valid status to an invalid status.

[0300] For a detailed description of how the third member no longer inherits the permissions of the first group, please refer to the related description of the first member in the previous text. To avoid repetition, it will not be repeated here.

[0301] For a member who currently does not inherit the permissions of the first group, if the admission review policy of the first group changes, the member may be able to resume inheriting the permissions of the first group.

[0302] After the admission review strategy of the first group is changed from the third admission review strategy to the fourth admission review strategy, the status of the fourth member is changed from the invalid status to the valid status.

[0303] The "fourth member" can be any member of the current first group who has not inherited the permissions of the first group. "Fourth" does not have any other limiting effect. The "third group admission review strategy" and the "fourth group admission review strategy" are only used to limit two different group admission review strategies and do not have any other limiting effect.

[0304] Furthermore, when the group admission review policy of a group is changed, the group admission review can be triggered to determine whether members in the group can inherit the permissions of the group.

[0305] In other words, after the group's admission review policy is changed, the group members can be reviewed again according to the changed admission review policy. If the review is passed, the member can inherit the group's permissions. Otherwise, the member cannot inherit the group's permissions.

[0306] For example, after the group admission review policy is changed, the members in the group can be reviewed according to the changed admission review policy, and the status of the member can be recorded according to the review result. If the review is passed, the status of the member is recorded as valid, otherwise, the status of the member is recorded as invalid.

[0307] In this case, whether the third member no longer inherits the permissions of the first group may be determined according to the second group admission review policy.

[0308] Optionally, after the admission review policy of the first group is changed from the first admission review policy to the second admission review policy, it is determined according to the second admission review policy that the third member no longer inherits the authority of the first group.

[0309] After the admission review strategy of the first group is changed from the first admission review strategy to the second admission review strategy, the third member is reviewed according to the second admission review strategy. If the review fails, the third member no longer inherits the permissions of the first group.

[0310] In this case, whether the fourth member resumes inheriting the permissions of the first group may be determined according to the fourth group admission review policy.

[0311] Optionally, after the admission review policy of the first group is changed from the third admission review policy to the fourth admission review policy, it is determined according to the fourth admission review policy whether the fourth member resumes inheriting the authority of the first group.

[0312] After the admission review strategy of the first group is changed from the third admission review strategy to the fourth admission review strategy, the fourth member is reviewed according to the fourth admission review strategy. If the review is passed, the fourth member resumes inheriting the permissions of the first group.

[0313] The platform can monitor changes in the admission review strategy for the first group.

[0314] For example, the monitoring method may be to obtain dynamic information in real time from the platform. The embodiment of the present application does not limit the monitoring method.

[0315] For the sake of convenience, when describing the resource access process later, the example that all members in the group can inherit the group's permissions is mainly used for explanation, and the scheme of the embodiment of the present application is not limited. For other permission inheritance schemes, refer to the schemes below for adaptive adjustment. For example, if a member in a valid state in the group inherits the group's permissions, then in step 620, it is determined whether the visitor is in a valid state in the group carrying the first permission.

[0316] Figure 6 and Figure 7 The following is a schematic diagram of two resource access processes provided by the embodiments of the present application. Figure 6and Figure 7 The process shown can be performed by a gateway. Alternatively, Figure 6 and Figure 7 The process shown can be executed by the gateway calling the access control service.

[0317] For example, the access control service can be Fig. 9 or Fig.10 in IAM.

[0318] For example, gateways can include application gateways and API gateways, such as Fig.10 As shown, the access control service can be Fig.10 For example, the gateway can include an API gateway, such as Fig. 9 As shown, the access control service can Fig. 9 For example, the gateway may include an application gateway.

[0319] like Figure 6 As shown, the resource access process may include the following steps.

[0320] 610. Obtain a visitor's access request to a first resource.

[0321] 620 , determine whether the visitor is in a group with a first authority (eg, a first group).

[0322] The admission audit policy of the group carrying the first permission may include all access control rules extracted from the access control policy of the first resource.

[0323] 630: If the visitor is in a group with the first permission, the visitor is allowed to access the first resource. Otherwise, the visitor is denied access to the first resource.

[0324] For example, if the group with the first permission only includes the first group, if the visitor is in the first group, the visitor is allowed to access the first resource. If the visitor is not a member of the first group, the visitor is denied access to the first resource.

[0325] Exemplarily, the group carrying the first permission may also include other groups other than the first group, that is, the group carrying the first permission includes multiple groups. The group entry audit policy of each of the multiple groups may include all access control rules extracted from the access control policy of the first resource. In this case, if the visitor is in any group of the multiple groups, the visitor may be allowed to access the first resource, otherwise, the visitor is denied access to the first resource.

[0326] In this way, during the authentication process of step 620, it is only necessary to determine whether the visitor is in a group with access rights, thereby reducing authentication time and improving resource access efficiency.

[0327] Figure 7 A schematic diagram of another resource access process provided in an embodiment of the present application is shown.

[0328] 710. Obtain a visitor's access request to a first resource.

[0329] 720, determine whether the visitor is in a group with the first permission (for example, the first group), and whether the visitor meets other access conditions in the access control policy of the first resource except the admission review policy of the group with the first permission.

[0330] The admission audit policy of the group carrying the first permission may include some access control rules extracted from the access control policy of the first resource. For example, the admission audit policy of the group carrying the first permission may be the general access control rules of the first resource, and the general access control rules of the first resource may be some access control rules extracted from the access control policy of the first resource. In step 720, it may be determined whether the visitor is in the group carrying the first permission and whether the visitor meets other access conditions in the access control policy of the first resource except the general access control rules.

[0331] 730, if the visitor is in the group with the first permission and the visitor meets other access conditions in the access control policy of the first resource except the admission review policy of the group with the first permission, then the visitor is allowed to access the first resource. Otherwise, the visitor is denied access to the first resource.

[0332] For example, if the group with the first permission only includes the first group, the admission review policy of the first group can be the general access control rule of the first resource. If the visitor is in the first group and the visitor meets other access conditions in the access control policy of the first resource except the general access control rule, the visitor is allowed to access the first resource. Otherwise, the visitor is denied access to the first resource.

[0333] Exemplarily, the group carrying the first permission may also include other groups other than the first group, that is, the group carrying the first permission includes multiple groups. The admission audit policy of each of the multiple groups is the general access control rule of the first resource. In this case, if the visitor is in any of the multiple groups and the visitor meets other access conditions in the access control policy of the first resource except the general access control rule, the visitor may be allowed to access the first resource, otherwise, the visitor is denied access to the first resource.

[0334] It should be understood that Figure 6 and Figure 7 The resource access process shown is only an example and does not limit the solution of the embodiment of the present application.

[0335] Figure 8 A schematic diagram of a group management process and a resource access process provided by an embodiment of the present application is shown. Fig. 9 and Fig.10 Schematic diagrams of two access control system architectures provided by embodiments of the present application are shown. Figures 8 to 10 The resource is mainly described as an application program, and does not limit the solution of this application. For example, the resource can also be a service or microservice provided by a cloud platform.

[0336] For example, Fig. 9 and Fig.10 The access control system shown can be used to implement Figure 8 As shown in the process. Fig. 9 and Fig.10 As shown, the gateway can call IAM for authentication. Fig. 9 and Fig.10 Only the gateway calling IAM is used as an example for explanation. In other implementations, the gateway can also be replaced by other access control nodes, and the IAM can be replaced by other functional modules that can provide group management, authority management, and authentication capabilities. This embodiment of the application does not limit this.

[0337] Fig. 9 and Fig.10 The difference mainly lies in the gateway. Fig.10 The gateways shown include an API gateway and an application gateway. Fig. 9 The gateway shown is an API gateway. Fig. 9 Take this as an example for illustration.

[0338] by Fig. 9 For example, the API gateway may include an API lifecycle management module 910 and an API call processing module 920 .

[0339] The API lifecycle management module 910 may be used to implement registration, update, abandonment, deletion, and release of applications, etc. Further, the API lifecycle management module 910 may include an API general rule management module 911. The API general rule management module 911 may be used to manage general access control rules of APIs.

[0340] For example, Fig. 9 As shown, the API general rule management module 911 can be used to perform at least one of the following:

[0341] Extract common access control rules of an API from the access control policy of the API, store common access control rules of an API, delete common access control rules of an API, or query common access control rules of an API.

[0342] For example, when an application is registered or updated, the API general rule management module 911 may extract general access control rules from the access control policy of the API of the application and store the general access control rules of the API.

[0343] For another example, when an application is registered or updated, the general access control rules can be manually extracted from the access control policy of the API of the application, and the general access control rules of the API can be stored by the API general rule management module 911.

[0344] The API call processing module 920 may be used to process resource access requests, ie, API call requests.

[0345] Specifically, the API call processing module 920 may call the IAM to authenticate the access request.

[0346] It should be understood that Fig. 9 The number, position, and relationship of the modules shown are only examples and do not limit the solutions of the embodiments of the present application. Fig. 9 In the illustrated solution, the API general rule management module 911 is disposed in the API gateway. In other possible implementations, the API general rule management module 911 may also be located outside the API gateway, which is not limited in the embodiments of the present application.

[0347] Fig. 9 The IAM in can be understood as Figure 5 A specific implementation of the access control device shown in Figure 5 The description of the same module can be referred to Figure 5 To avoid repetition, the description in will not be repeated here.

[0348] Compared to Figure 5 The access control device shown is as follows Fig. 9 As shown, the identity and credential management module 510 may further include an identity management module 512, a credential management module 513, and an identity authentication module 514. The policy management module may further include a policy authentication module 523.

[0349] The identity management module 512 may be used to manage account information or identification information of an application program, and the like.

[0350] The credential management module 513 can be used to manage credential information. For example, if the members of the group are people, the credential information may include the user's account password or multi-factor authentication (MFA) credential information, etc. For another example, if the members of the group are applications, the credential information may include a key for application access, etc.

[0351] The identity verification module 514 may be used to verify the identity of the visitor. For example, the identity verification module 514 may be used to verify the visitor's account number and password to determine whether the visitor's identity is legitimate.

[0352] The policy authentication module 523 may be used to perform permission verification. Exemplarily, the policy authentication module 523 may be used to determine whether the visitor is in a group that carries access rights to the resources that the visitor wants to access.

[0353] The specific functions of the above modules can be found in the following text and will not be described in detail here.

[0354] like Figure 8 As shown, after designing the API for the application, you can set the corresponding access control policy.

[0355] Exemplarily, the access control policy of the API may be set according to the risk level of the data operable by the API of the application program and the risk level of the operation scenario.

[0356] Table 1 shows an example of access control policies for two APIs (API_1 and API_2).

[0357] Table 1

[0358]

[0359] The risk level of the data that can be operated by API_1 is high, and the highest risk level of the supported operation scenarios is high. Accordingly, the access control policy of API_1 is stricter. The access control policy of API 1 includes the visitor's authentication credibility is high and the visitor's login IP is in the login IP whitelist.

[0360] The risk level of the operable data of API_2 is low, and the highest risk level of the supported operation scenarios is low. Accordingly, the access control policy of API_2 is more relaxed. The access control policy of API_2 includes the identity verification of the visitor.

[0361] It should be understood that Fig. 9 The access control policy of the API in is only an example and does not limit the solution of the embodiment of the present application. Fig. 9 In the illustrated solution, the access control policy indicates conditions for allowing access. In other implementations, the access control policy may also indicate conditions for denying access.

[0362] The common access control rules of the API can be extracted from the access control policy of the API. i}. i Represents the i-th general access control rule, where i is a positive integer.

[0363] For example, the general access control rules of the API can be Fig. 9 The API general rule management module 911 shown is used to extract the general access control rules of the API. Alternatively, the general access control rules of the API can also be manually extracted. The general access control rules of the API can be stored in the general rule management module 911 of the API.

[0364] For example, Figure 1 As shown, the general access control rules of API_1 extracted from the access control policy of API_1 may include: the visitor's authentication credibility is high and the visitor's login IP is in the login IP whitelist. For API_2, no general access control rules are extracted.

[0365] Figure 8 The group management process shown can be regarded as a specific implementation of method 400 and does not limit the solution of the embodiment of the present application. Figure 8 Some descriptions are omitted appropriately in the process shown.

[0366] like Figure 8 As shown, the group management process may include the following steps.

[0367] 811, create group G1 (an example of the first group).

[0368] The administrator triggers a request to create a group. In response to the request to create a group, a group is created.

[0369] Exemplarily, step 811 may be performed by Fig. 9 The group management module 511 executes.

[0370] The group management module 511 receives the group creation request triggered by the administrator and creates a corresponding group G1.

[0371] 812, add permissions for G1.

[0372] The administrator triggers an add permission request. In response to the add permission request, the administrator adds corresponding resource access rights to G1, that is, the rights indicated by the set permission request.

[0373] For example, step 812 may be performed by Fig. 9 The group permission module 521 executes.

[0374] The group management module 511 receives the permission setting request triggered by the administrator, calls the group permission module 521 to set the corresponding permission for G1, and manages the permission of G1 through the group permission module 521. Fig. 9As shown, the permission added to G1 may be a calling permission of API_1 (an example of the first permission). The calling permission of API_1 indicates that calling API_1 is allowed.

[0375] 813, set the G1 group admission review policy.

[0376] Exemplarily, step 813 may be performed by Fig. 9 The entry review module 522 is shown to execute.

[0377] For example, the administrator triggers a request to set the group entry review policy for G1. After receiving the request to set the group entry review policy for G1, the group management module 511 calls the group entry review module 522 for processing. The group entry review module 522 obtains the general access control rules of API_1 from the API general rule management module 911 and displays them through the front-end interface. After the administrator makes a selection, the administrator's selection result is set as the group entry review policy for G1. For example, if the administrator selects all of API_1's general access control rules, the group entry review module 522 can associate API_1's general access control rules with G1.

[0378] For example, as shown in Table 2, the group entry review policy of G1 may be the general access control rule of API_1.

[0379] Table 2

[0380]

[0381] Among them, the group entry review module 522 can actively obtain the general access control rules of API_1 from the API general rule management module 911. Alternatively, the group entry review module 522 can receive the general access control rules of API_1 pushed from the API general rule management module 911. The embodiment of the present application does not limit the way in which the group entry review module 522 obtains the general access control rules of the API.

[0382] For another example, after adding permissions to G1, the group management module 511 can call the group entry review module 522 to set the group entry review policy for G1. The group entry review module 522 obtains the general access control rules of API_1 from the API general rule management module 911 and associates the general access control rules of API_1 with G1. In this case, the group entry review policy can be automatically set by the system without the need for administrator operation.

[0383] It should be understood that the above is only an example, and the admission review strategy of G1 can also be set in other ways. For a specific description, please refer to the method 400 in the previous text, which will not be repeated here.

[0384] 814. Receive a member adding request from G1 (an example of a first joining request).

[0385] Exemplarily, step 814 may be performed by the group management module 511. After receiving the member adding request of G1, the group management module 511 calls the group entry review module 522 to perform step 815.

[0386] For example, if the system only supports the administrator of the group to trigger a member adding request, after receiving the member adding request of G1, the group management module 511 can call the group entry review module 522 to review the members outside the group.

[0387] For another example, if the system supports any identity to trigger a member adding request, after the group management module 511 receives the member adding request of G1, it can call the identity authentication module 514 to determine whether the identity of the subject that triggers the member adding request of G1 is the administrator of G1. If the identity of the subject that triggers the member adding request of G1 is the administrator of G1, the group entry review module 522 can be called to review the members outside the group, otherwise, the member adding request can be rejected. In addition, it can also be determined whether the subject that triggers the member adding request of G1 has the authority to add members to G1.

[0388] 815, verify according to G1's admission review strategy.

[0389] Exemplarily, step 815 may be performed by the group entry verification module 522. After receiving the member adding request of G1, the group management module 511 calls the group entry verification module 522 to verify the out-of-group members indicated by the member adding request.

[0390] When step 815 is triggered by step 814 , step 816 is executed.

[0391] When step 815 is triggered by step 817 , step 818 is executed.

[0392] 816, if the verification succeeds, the member is admitted to the group; if the verification fails, the member is refused admission to the group.

[0393] For example, if the verification is successful, that is, the audit is passed, the group management module 511 can add the out-group member to G1. If the verification fails, that is, the audit is not passed, the group management module 511 can reject the member addition request.

[0394] It should be understood that the above is only an example, and the review method for member admission can also be set in other ways. For specific descriptions, please refer to the method 400 mentioned above, which will not be repeated here.

[0395] As mentioned above, the group management module 511 can also monitor changes in relevant information of the group.

[0396] The following description takes the member information as an example of group related information.

[0397] 817, confirm that the member's information has changed.

[0398] When the member's information changes, execute step 815.

[0399] Exemplarily, the group management module 511 can be used to dynamically monitor changes in member information. For G1, the range of the monitored information is the range indicated by the group admission audit policy of G1. For example, the monitored information may include passwords and login IP addresses, that is, the group management module 511 can monitor changes in members' passwords and login IP addresses.

[0400] When a member's information is detected to have changed, the group management module 511 may call the group entry audit module 522 to execute step 815. For example, when the group management module 511 detects that the password of a member in G1 has been modified, the group management module 511 calls the group entry audit module 522 to audit the member again. For another example, when the group management module 511 detects that the login IP of a member in G1 has changed, the group entry audit module 522 is called to audit the member again.

[0401] 818, members who pass the verification inherit the permissions of G1, and members who fail the verification do not inherit the permissions of G1.

[0402] Exemplarily, if the verification is successful, that is, the review is passed, the member's status can be recorded as a valid status.

[0403] Exemplarily, if the verification fails, that is, the audit fails, the member's status can be recorded as an invalid state. Alternatively, if the verification fails, the member can be delisted.

[0404] Exemplarily, step 818 may be performed by the group management module 511. For example, the group management module 511 may record or update the status of the members in G1 according to the audit result of the group entry audit module 522, so as to achieve dynamic management of the validity of the members.

[0405] Figure 8 The resource access process shown can be regarded as a specific implementation of method 600 or method 700, and does not limit the solution of the embodiment of the present application. Figure 8 Some descriptions are omitted appropriately in the process shown.

[0406] like Figure 8 As shown, the resource access process may include the following steps.

[0407] 821, authenticate the visitor.

[0408] After the visitor completes the identity authentication, he can obtain the identity authentication token. The visitor will carry the token when initiating the access request.

[0409] like Fig. 9 As shown, the identity of the visitor can be verified through the identity authentication module 914, and a token is returned to the visitor after successful verification.

[0410] 822, receiving a visitor's access request.

[0411] For example, the access request indicates that the visitor requests to call API_1. Alternatively, the access request indicates that the visitor requests to call API_2.

[0412] The access request carries an authentication token.

[0413] like Fig. 9 As shown, the API gateway receives the access request, and the API call processing module 920 calls the IAM to execute step 823.

[0414] 823, perform permission check on the visitor.

[0415] Exemplarily, step 823 may include: determining whether the visitor is in a corresponding group. The corresponding group carries access rights to the resource that the visitor requests to access.

[0416] Whether the visitor is in the corresponding group can realize visitor authority verification, that is, determine whether the administrator has granted the visitor access rights to the resource. At the same time, whether the visitor is in the corresponding group is also used to verify whether the visitor has met the access control policy of the resource.

[0417] Exemplarily, step 823 may be performed by Fig. 9 The policy authentication module in is executed.

[0418] For example, if a visitor requests to call API_1, IAM determines whether the visitor is in G1. If the visitor is in G1, the authentication is successful. If the visitor is not a member of G1, the authentication fails.

[0419] It should be understood that the above is only an example. If the access control policy of API_1 also includes other access control rules in addition to the general access control rules of API_1, step 823 may also include determining whether the visitor satisfies other access control rules.

[0420] 824, if the authentication is successful, access to the resource is allowed; if the authentication fails, the access request is denied.

[0421] In a possible application scenario, method 400 may be applied to a terminal device. Method 400 may be performed by an access control device. The access control device may be used to provide identity management and access control functions. The access control device may be deployed in a terminal device.

[0422] Method 400 can be used to manage multiple groups on a terminal device. For a group with sensitive permissions, a group entry review policy can be set for it. For example, the group entry review policy can be set to a strong authentication method.

[0423] The following is an exemplary description of a scenario applied to a terminal device.

[0424] Taking the terminal large screen as an example, users are allowed to use the large screen only after logging in. Different resources have different security levels and corresponding access control policies.

[0425] For example, for some files with higher security levels, after the user initiates an access request, strong identity authentication of the user is required, for example, face recognition of the user is required to achieve identity authentication, and access to the file is allowed after successful authentication; for some files with lower security levels, after the user initiates an access request, if the user is logged in, access to the file can be allowed.

[0426] The above is only an example, and the embodiments of the present application do not limit the specific setting method of the access control policy for different data.

[0427] By adopting the solution of the embodiment of the present application, a group entry review policy can be set. Only users who pass the group entry review policy verification can enter the group and inherit the group's permissions, which is conducive to ensuring the security of resource access.

[0428] Exemplarily, the administrator can create a home user group (an example of the first group). According to the admission audit policy of the home user group, the member to be added to the home user group, i.e., the user, is verified. If the verification passes, the user is added to the home user group, otherwise, the user is denied to join the home user group.

[0429] The user may be a user authorized by the administrator to join the home user group, or a user authorized by the administrator to use the large screen.

[0430] The permissions carried by the family user group allow access to the first file (an example of the first resource). The access control policy for the first file includes that the visitor needs to pass strong identity authentication. For example, strong identity authentication may include face recognition identity authentication. That is, the user needs to pass face recognition identity authentication before being allowed to access the first file. The family user group's entry review policy may include strong identity authentication, that is, members outside the group need to pass strong identity authentication before they can join the family user group.

[0431] Users can log in to the big screen in a variety of ways. For example, users can log in to the big screen using an account and password. For another example, users can log in to the big screen using voiceprint authentication. For another example, users can log in to the big screen using face recognition. If a user logs in to the big screen using face recognition, the user can be added to the family user group. Users who log in to the big screen using other methods are added to the guest user group. For example, after a user triggers an access request to a first file, if the user is in the family user group, the user can be allowed to directly access the first file. If the user is not in the family user group, the access request is rejected. Alternatively, if the user is not in the family user group, the user is prompted to perform face recognition identity authentication.

[0432] The implementation of method 400 applied to the above terminal scenario can refer to the description of application to the cloud management platform in the previous text. To avoid repetition, it will not be repeated here.

[0433] Combine the following Figures 11 to 14 The device of the embodiment of the present application is described. It should be understood that the device described below can execute the method of the embodiment of the present application, and in order to avoid unnecessary repetition, repeated descriptions are appropriately omitted when introducing the device of the embodiment of the present application.

[0434] Fig.11 2000 is a schematic block diagram of an access control device according to an embodiment of the present application. The access control system includes an access control device 2000. Fig.11 The apparatus 2000 shown can be used to perform Figure 4 or Figure 8 The method shown in the figure. The device 2000 includes a management module 2010 and an audit module 2020.

[0435] Management module 2010 is used to obtain a first joining request, the first joining request indicates that members outside the first group of the identity and access management IAM are added to the first group, and the members in the first group inherit the resource access rights carried by the first group, the resource access rights carried by the first group include access rights to the first resource, and the access rights to the first resource indicate that access to the first resource is allowed.

[0436] The audit module 2020 is used to determine whether to allow the non-group member to join the first group according to the first group entry audit policy. The first group entry audit policy indicates the conditions for allowing the member to join the first group and / or the conditions for refusing the member to join the first group, and the first group entry audit policy includes one or more first access control rules extracted from the access control policy of the first resource.

[0437] For example, the management module 2010 may be Figure 5 or Fig. 9The group management module 511 in the audit module can be Figure 5 or Fig. 9 The entry review module 522 in.

[0438] Optionally, the apparatus 2000 may further include an authentication module (not shown in the figure). The authentication module may be used to authenticate the access request to the first resource according to access control rules other than one or more first access control rules in the access control policy of the first resource when the access request to the first resource comes from a member of the first group.

[0439] Optionally, the apparatus 2000 may be a gateway or a functional module in the gateway. The gateway is configured to obtain an access request for the first resource.

[0440] Optionally, the system may further include a gateway, which is independently configured from the device 2000 and is used to obtain an access request for the first resource.

[0441] Optionally, the first resource includes a first application programming interface API.

[0442] Optionally, the gateway includes at least one of an API gateway or an application gateway.

[0443] Optionally, the management module 2010 is further used to: obtain an input admission review policy of the first group.

[0444] Optionally, the management module 2010 is further used to: control the display of one or more second access control rules extracted from the access control policy of the first resource, and the admission review policy of the first group includes the selection results of the one or more second access control rules.

[0445] Optionally, the parameter value of the first parameter of the first member in the first group is the first parameter value, and the first member inherits the resource access rights carried by the first group. After the parameter value of the first parameter of the first member is changed from the first parameter value to the second parameter value, the first member no longer inherits the resource access rights carried by the first group.

[0446] Optionally, the first parameter belongs to the parameter indicated by the entry review policy of the first group, and the review module 2020 is also used to: after the parameter value of the first parameter of the first member is changed from the first parameter value to the second parameter value, determine according to the entry review policy of the first group that the first member no longer inherits the resource access rights carried by the first group.

[0447] Optionally, the status of members in the first group includes a valid status and an invalid status. Members in the valid status inherit the resource access rights carried by the first group, and members in the invalid status do not inherit the resource access rights carried by the first group.

[0448] Optionally, the parameter value of the second parameter of the second member in the first group is the third parameter value, and the second member is in an invalid state. After the parameter value of the second parameter of the second member is changed from the third parameter value to the fourth parameter value, the second member is in a valid state.

[0449] Optionally, the second parameter belongs to the parameter indicated by the entry review policy of the first group, and the review module 2020 is also used to: after the parameter value of the second parameter of the second member is changed from the third parameter value to the fourth parameter value, determine that the second member is in a valid state according to the entry review policy of the first group.

[0450] For a detailed description, please refer to the method 400 in the previous text, which will not be repeated here.

[0451] Each module in the device 2000 may be implemented by software or hardware. For example, the management module 2010 is taken as an example to introduce the implementation of the management module 2010. Similarly, the implementation of other modules may refer to the implementation of the management module 2010.

[0452] As an example of a software functional unit, the management module 2010 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the management module 2010 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region (region) or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one data center or multiple data centers with similar geographical locations. Among them, usually a region may include multiple AZs.

[0453] Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

[0454] As an example of a hardware functional unit, the management module 2010 may include at least one computing device, such as a server, etc. Alternatively, the management module 2010 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0455] The multiple computing devices included in the management module 2010 can be distributed in the same region or in different regions. The multiple computing devices included in the management module 2010 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the management module 2010 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0456] It should be noted that, in other embodiments, the management module 2010 can be used to execute any step in the access control method, and other modules can be used to execute any step in the access control method. The steps that each module is responsible for implementing can be specified as needed, and all functions of the device 2000 are realized by implementing different steps in the access control method through each module.

[0457] The present application also provides a computing device 1000. Fig.12 As shown, computing device 1000 includes: bus 1002, processor 1004, memory 1006 and communication interface 1008. Processor 1004, memory 1006 and communication interface 1008 communicate through bus 1002. Computing device 1000 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in computing device 1000.

[0458] The bus 1002 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.12 The bus 1002 may include a path for transmitting information between various components of the computing device 1000 (eg, the memory 1006, the processor 1004, and the communication interface 1008).

[0459] The processor 1004 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0460] The memory 1006 may include a volatile memory, such as a random access memory (RAM). The processor 1004 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0461] The memory 1006 stores executable program codes, and the processor 1004 executes the executable program codes to respectively implement the functions of the aforementioned modules, thereby implementing the access control method. That is, the memory 1006 stores instructions for executing the access control method.

[0462] The communication interface 1008 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 1000 and other devices or a communication network.

[0463] The embodiment of the present application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.

[0464] like Fig.13 As shown, the computing device cluster includes at least one computing device 1000. The memory 1006 in one or more computing devices 1000 in the computing device cluster may store the same instructions for executing the access control method.

[0465] In some possible implementations, the memory 1006 of one or more computing devices 1000 in the computing device cluster may also store partial instructions for executing the access control method. In other words, the combination of one or more computing devices 1000 may jointly execute the instructions for executing the access control method.

[0466] It should be noted that the memory 1006 in different computing devices 1000 in the computing device cluster may store different instructions, which are respectively used to execute part of the functions of the access control device. For example, the instructions stored in the memory 1006 in different computing devices 1000 may implement Fig.11 The functionality of one or more of the modules shown.

[0467] In some possible implementations, one or more computing devices in the computing device cluster may be connected via a network, which may be a wide area network or a local area network. Fig.14 A possible implementation is shown. Fig.14 As shown, two computing devices 1000A and 1000B are connected via a network. Specifically, the network is connected via a communication interface in each computing device. In this type of possible implementation, the memory 1006 in the computing device 1000A stores instructions for executing the functions of the management module 2010. At the same time, the memory 1006 in the computing device 1000B stores instructions for executing the functions of the audit module 2020.

[0468] Fig.14 The connection method between the computing device clusters shown may be to consider that the access control method provided in this application may require storage of data or security issues, so it is considered to hand over the functions implemented by the audit module 2020 to the computing device 1000B for execution.

[0469] It should be understood that Fig.14The functions of the computing device 1000A shown in FIG. 1000A may also be completed by multiple computing devices 1000. Similarly, the functions of the computing device 1000B may also be completed by multiple computing devices 1000.

[0470] The embodiment of the present application also provides a computer program product including instructions. The computer program product may be a software or program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device is caused to perform an access control method.

[0471] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to perform the access control method.

[0472] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A method of access control, characterized in that: The method is applied to a cloud management platform, the cloud management platform is used to manage infrastructure, the infrastructure includes at least one cloud data center, and the method includes: The access control device in the cloud management platform obtains an input first group entry request, the first group entry request indicates adding members outside the first group of the identity and access management IAM to the first group, and members in the first group inherit resource access rights carried by the first group, the resource access rights carried by the first group include access rights for a first resource, and the access rights for the first resource indicate that access to the first resource is allowed; The access control device determines whether to allow non-group members of the first group to join the first group based on the entry review policy of the first group, the entry review policy of the first group indicates the conditions for allowing members to join the first group and / or the conditions for refusing members to join the first group, and the entry review policy of the first group includes one or more first access control rules extracted from the access control policy of the first resource.

2. The method according to claim 1, characterized in that The method further comprises: The gateway obtains an access request for the first resource; In the case where the access request comes from a member of the first group, the access control device authenticates the access request according to access control rules in the access control policy of the first resource except for the one or more first access control rules.

3. The method according to claim 2, characterized in that The gateway includes at least one of an API gateway or an application gateway.

4. The method according to any one of claims 1 to 3, characterized in that The first resource includes a first application programming interface (API).

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: The access control device obtains the input admission review policy of the first group.

6. The method according to claim 5, characterized in that The method further comprises: The access control device controls the display of one or more second access control rules extracted from the access control policy of the first resource, and the admission audit policy of the first group includes the selection results of the one or more second access control rules.

7. The method according to any one of claims 1 to 6, characterized in that The parameter value of the first parameter of the first member in the first group is the first parameter value, and the first member inherits the resource access rights carried by the first group. After the parameter value of the first parameter of the first member is changed from the first parameter value to the second parameter value, the first member no longer inherits the resource access rights carried by the first group.

8. The method according to claim 7, characterized in that The first parameter belongs to a parameter indicated by an admission audit policy of the first group, and the method further includes: After the parameter value of the first parameter of the first member is changed from the first parameter value to the second parameter value, the access control device determines, according to the admission audit policy of the first group, that the first member no longer inherits the resource access rights carried by the first group.

9. The method according to any one of claims 1 to 8, characterized in that The states of the members in the first group include a valid state and an invalid state. The members in the valid state inherit the resource access rights carried by the first group, and the members in the invalid state do not inherit the resource access rights carried by the first group.

10. The method according to claim 9, characterized in that The parameter value of the second parameter of the second member in the first group is the third parameter value, and the second member is in an invalid state. After the parameter value of the second parameter of the second member is changed from the third parameter value to the fourth parameter value, the second member is in a valid state.

11. The method according to claim 10, characterized in that The second parameter belongs to a parameter indicated by the admission audit policy of the first group, and the method further includes: After the parameter value of the second parameter of the second member is changed from the third parameter value to the fourth parameter value, the access control device determines that the second member is in a valid state according to the admission audit policy of the first group.

12. An access control system, characterized in that: The system is applied to a cloud management platform, the cloud management platform is used to manage infrastructure, the infrastructure includes at least one cloud data center, the system includes an access control device, the device includes: a management module, configured to obtain an input first group entry request, wherein the first group entry request indicates that members outside a first group of the identity and access management IAM are added to the first group, and members within the first group inherit resource access rights carried by the first group, wherein the resource access rights carried by the first group include access rights to a first resource, and the access rights to the first resource indicate that access to the first resource is allowed; An audit module is used to determine whether to allow non-group members of the first group to join the first group based on the admission audit policy of the first group, the admission audit policy of the first group indicates the conditions for allowing members to join the first group and / or the conditions for refusing members to join the first group, and the admission audit policy of the first group includes one or more first access control rules extracted from the access control policy of the first resource.

13. The system according to claim 12, characterized in that The system also includes a gateway, which is used to obtain an access request for the first resource; and the access control device also includes an authentication module, which is used to authenticate the access request according to the access control rules in the access control policy of the first resource except the one or more first access control rules when the access request comes from a member of the first group.

14. The system according to claim 13, characterized in that The gateway includes at least one of an API gateway or an application gateway.

15. The system according to any one of claims 12 to 14, characterized in that The first resource includes a first application programming interface (API).

16. The system according to any one of claims 12 to 14, characterized in that The management module is also used for: The input admission review policy of the first group is obtained.

17. The system according to claim 16, characterized in that The management module is also used for: The control displays one or more second access control rules extracted from the access control policy of the first resource, and the admission audit policy of the first group includes the selection results of the one or more second access control rules.

18. The system according to any one of claims 12 to 17, characterized in that The parameter value of the first parameter of the first member in the first group is the first parameter value, and the first member inherits the resource access rights carried by the first group. After the parameter value of the first parameter of the first member is changed from the first parameter value to the second parameter value, the first member no longer inherits the resource access rights carried by the first group.

19. The system according to claim 18, characterized in that The first parameter belongs to a parameter indicated by the entry audit policy of the first group, and the audit module is further used for: After the parameter value of the first parameter of the first member is changed from the first parameter value to the second parameter value, it is determined according to the admission audit policy of the first group that the first member no longer inherits the resource access rights carried by the first group.

20. The system according to any one of claims 12 to 19, characterized in that The states of the members in the first group include a valid state and an invalid state. The members in the valid state inherit the resource access rights carried by the first group, and the members in the invalid state do not inherit the resource access rights carried by the first group.

21. The system according to claim 20, characterized in that The parameter value of the second parameter of the second member in the first group is the third parameter value, and the second member is in an invalid state. After the parameter value of the second parameter of the second member is changed from the third parameter value to the fourth parameter value, the second member is in a valid state.

22. The system according to claim 21, characterized in that The second parameter belongs to a parameter indicated by the entry audit policy of the first group, and the audit module is further used for: After the parameter value of the second parameter of the second member is changed from the third parameter value to the fourth parameter value, it is determined that the second member is in a valid state according to the admission review policy of the first group.

23. A computing device cluster, characterized in that: comprising at least one computing device, each computing device comprising a processor and a memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1 to 11.

24. A computer-readable storage medium, characterized in that: The method comprises computer program instructions, and when the computer program instructions are executed by a computing device cluster, the computing device cluster performs the method according to any one of claims 1 to 11.

25. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device cluster, the computing device cluster is caused to perform the method according to any one of claims 1 to 11.

Images