Access control method and device applied to knowledge base, computer equipment, readable storage medium and program product

Abstract

The invention relates to an access control method and device applied to a knowledge base, equipment, a readable storage medium and a program product, and relates to the technical field of information security. By adopting the method, the detection accuracy of the security of accessing the knowledge base can be improved. The method comprises the steps of obtaining user identification information and target resource identification information in a knowledge base access request; obtaining user security mark information and resource security mark information corresponding to the user identification information; performing security mark information judgment on the knowledge base access request according to the user security mark information and the resource security mark information; under the condition that the security mark information judgment result is that the knowledge base access request passes, target resource identification information in the knowledge base access request is replaced with a target resource path, and the replaced knowledge base access request is forwarded to a target resource corresponding to the target resource path; and sending a response result of the target resource for the knowledge base access request to the client.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an access control method, apparatus, computer equipment, computer-readable storage medium, and computer program product applied to a knowledge base. Background Art

[0002] A knowledge base is a centralized data repository that contains the knowledge, experience, data, and information within an organization, usually in electronic form. With the development of information security technology, power monitoring systems have emerged to detect the security of user access to knowledge bases.

[0003] However, the existing power monitoring system has little monitoring power on users' access to the knowledge base, and cannot accurately and effectively verify whether the user's access behavior is legal and compliant, resulting in frequent illegal access phenomena such as unauthorized access, non-valid access, and cross-level access. There is a problem of low detection accuracy of access to the knowledge base security. Summary of the invention

[0004] Based on this, it is necessary to provide an access control method, apparatus, computer device, computer-readable storage medium and computer program product applied to a knowledge base in order to solve the above technical problems.

[0005] In a first aspect, the present application provides an access control method applied to a knowledge base. The method comprises:

[0006] In response to a knowledge base access request sent by a client, obtaining user identification information and target resource identification information in the knowledge base access request;

[0007] Acquire user security marking information corresponding to the user identification information, and resource security marking information corresponding to the target resource identification information;

[0008] Performing security tag information determination on the knowledge base access request according to the user security tag information and the resource security tag information to obtain a security tag information determination result;

[0009] In the case where the security tag information determines that the knowledge base access request is approved, the target resource identification information in the knowledge base access request is replaced with a target resource path, and the replaced knowledge base access request is forwarded to the target resource corresponding to the target resource path;

[0010] The response result of the target resource to the knowledge base access request is sent to the client.

[0011] In one embodiment, the performing security tag information determination on the knowledge base access request according to the user security tag information and the resource security tag information to obtain the security tag information determination result includes:

[0012] Compare each user preset indicator in the user security tag information with each target resource preset indicator in the resource security tag information to obtain a comparison result corresponding to each user preset indicator; when the comparison results corresponding to each user preset indicator are all judged as passed, confirm that the security tag information judgment result is that the knowledge base access request is passed.

[0013] In one embodiment, the user preset indicators include a first access level, a first organization, a first region, a first role, a first access validity period, and a list of accessible resources corresponding to the user, and the target resource preset indicators include a second access level, a second organization, a second region, a second role, and a second access validity period;

[0014] When the comparison results corresponding to the preset indicators are all judged as passed, confirming that the security mark information judgment result is that the knowledge base access request is passed includes:

[0015] When the first access level is greater than or equal to the second access level, the first organization is included in the second organization, the first region is included in the second region, the first role is the same as the second role, the access time corresponding to the knowledge base access request is within the first access validity period and the second access validity period, and the list of accessible resources includes the target resource identification information, confirm that the security tag information judgment result is that the knowledge base access request is approved.

[0016] In one embodiment, before obtaining the user security tag information corresponding to the user identification information and the resource security tag information corresponding to the target resource identification information, the method further includes:

[0017] Verifying the user identification information to obtain the identity authentication result of the user;

[0018] The acquiring of user security marking information corresponding to the user identification information and resource security marking information corresponding to the target resource identification information includes:

[0019] When the identity authentication result is that the identity authentication of the user is passed, user security marking information corresponding to the user identification information and resource security marking information corresponding to the target resource identification information are acquired.

[0020] In one embodiment, the verifying the user identification information to obtain the identity verification result of the user includes:

[0021] Obtain the first user identity information in the user identification information and the second user identity information in the certificate; compare the first user identity information with the second user identity information; and when the first user identity information and the second user identity information are the same, confirm that the identity authentication result is that the user's identity authentication is passed.

[0022] In one embodiment, the method further comprises:

[0023] Record the access behavior of the client to the target resource; when an abnormality occurs to the target resource, identify abnormal clients and abnormal users using the abnormal clients from the clients accessing the target resource according to the recorded access behavior.

[0024] In a second aspect, the present application also provides an access control device applied to a knowledge base. The device comprises:

[0025] A request receiving module, used to respond to a knowledge base access request sent by a client and obtain user identification information and target resource identification information in the knowledge base access request;

[0026] An information acquisition module, used to acquire user security tag information corresponding to the user identification information, and resource security tag information corresponding to the target resource identification information;

[0027] A result determination module, configured to perform security tag information determination on the knowledge base access request according to the user security tag information and the resource security tag information, and obtain a security tag information determination result;

[0028] A request forwarding module, configured to replace the target resource identification information in the knowledge base access request with a target resource path, and forward the replaced knowledge base access request to a target resource corresponding to the target resource path, if the security tag information determines that the knowledge base access request is passed;

[0029] The resource sending module is used to send the response result of the target resource to the knowledge base access request to the client.

[0030] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0031] In response to a knowledge base access request sent by a client, user identification information and target resource identification information in the knowledge base access request are obtained; user security tag information corresponding to the user identification information and resource security tag information corresponding to the target resource identification information are obtained; security tag information is determined for the knowledge base access request based on the user security tag information and the resource security tag information to obtain a security tag information determination result; if the security tag information determination result is that the knowledge base access request is passed, the target resource identification information in the knowledge base access request is replaced with a target resource path, and the replaced knowledge base access request is forwarded to the target resource corresponding to the target resource path; and a response result of the target resource to the knowledge base access request is sent to the client.

[0032] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0033] In response to a knowledge base access request sent by a client, user identification information and target resource identification information in the knowledge base access request are obtained; user security tag information corresponding to the user identification information and resource security tag information corresponding to the target resource identification information are obtained; security tag information is determined for the knowledge base access request based on the user security tag information and the resource security tag information to obtain a security tag information determination result; if the security tag information determination result is that the knowledge base access request is passed, the target resource identification information in the knowledge base access request is replaced with a target resource path, and the replaced knowledge base access request is forwarded to the target resource corresponding to the target resource path; and a response result of the target resource to the knowledge base access request is sent to the client.

[0034] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0035] In response to a knowledge base access request sent by a client, user identification information and target resource identification information in the knowledge base access request are obtained; user security tag information corresponding to the user identification information and resource security tag information corresponding to the target resource identification information are obtained; security tag information is determined for the knowledge base access request based on the user security tag information and the resource security tag information to obtain a security tag information determination result; if the security tag information determination result is that the knowledge base access request is passed, the target resource identification information in the knowledge base access request is replaced with a target resource path, and the replaced knowledge base access request is forwarded to the target resource corresponding to the target resource path; and a response result of the target resource to the knowledge base access request is sent to the client.

[0036] The access control method, device, computer equipment, computer-readable storage medium and computer program product applied to the knowledge base, by obtaining the user identification information and target resource identification information in the knowledge base access request, and obtaining the user security tag information corresponding to the user identification information, and the resource security tag information corresponding to the target resource identification information, and then performing security tag information determination on the knowledge base access request according to the user security tag information and the resource security tag information, to obtain the security tag information determination result, and when the security tag information determination result is that the knowledge base access request is passed, the target resource identification information in the knowledge base access request is replaced with the target resource path, and the replaced knowledge base access request is forwarded to the target resource corresponding to the target resource path, and finally the target resource's response result to the knowledge base access request is sent to the client. In summary, the entire technical scheme, when verifying the legitimacy of the user's access to the knowledge base, adopts a variety of indicators for comprehensive verification, which can accurately and effectively verify whether the user's access to the knowledge base is legal and compliant, and reduce the occurrence of illegal access phenomena such as unauthorized access, non-valid access and cross-level access, thereby improving the detection accuracy of the security of access to the knowledge base. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] FIG1 is an application environment diagram of an access control method applied to a knowledge base in one embodiment;

[0038] FIG2 is a schematic diagram of a flow chart of an access control method applied to a knowledge base in one embodiment;

[0039] FIG3 is a schematic diagram of a flow chart of an access control method applied to a knowledge base in a specific embodiment;

[0040] FIG4 is a structural block diagram of an access control device applied to a knowledge base in one embodiment;

[0041] FIG. 5 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0043] The access control method for a knowledge base provided in an embodiment of the present application can be applied in an application environment as shown in FIG1 . The client communicates with the server via a network. A knowledge base is a centralized data repository that contains knowledge, experience, data, and information within an organization, and is intended to store, manage, and share knowledge for quick retrieval and use. The knowledge base can be integrated on a server or placed on a cloud or other network server.

[0044] Specifically, the access control method applied to the knowledge base provided in the embodiment of the present application can be executed by a server.

[0045] Exemplarily, the server responds to a knowledge base access request sent by a client and obtains user identification information and target resource identification information in the knowledge base access request; the server obtains user security tag information corresponding to the user identification information, and resource security tag information corresponding to the target resource identification information; the server performs a security tag information determination on the knowledge base access request based on the user security tag information and the resource security tag information, and obtains a security tag information determination result; when the security tag information determination result is that the knowledge base access request is passed, the server replaces the target resource identification information in the knowledge base access request with the target resource path, and forwards the replaced knowledge base access request to the target resource corresponding to the target resource path; the server sends the target resource's response result to the knowledge base access request to the client.

[0046] In the application environment shown in FIG1 , the client may be, but is not limited to, various personal computers, laptops, smart phones, and tablet computers. The server may be implemented as an independent server or a server cluster consisting of multiple servers.

[0047] In one embodiment, as shown in FIG. 2 , an access control method applied to a knowledge base is provided, and the method is described by taking the application of the method to the server in FIG. 1 as an example, and includes the following steps:

[0048] Step S201, in response to a knowledge base access request sent by a client, obtaining user identification information and target resource identification information in the knowledge base access request.

[0049] Among them, the knowledge base access request refers to the request initiated by the user to the server through the network to access the target resources in the knowledge base; the user identification information includes the user identity information and the actual status of the user, the status includes but is not limited to the access validity period, the list of accessible resources, the historical access records and the corresponding role permissions, etc.; the target resource identification information includes the actual status of the target resource, the status includes but is not limited to the access level, the access validity period, the affiliated organization and the affiliated region, etc.

[0050] Specifically, the server generates an information acquisition instruction carrying the identification of the information to be acquired in response to the knowledge base access request sent by the client, and acquires the user identification information and the target resource identification information in the knowledge base access request according to the instruction.

[0051] Step S202: Acquire user security tag information corresponding to the user identification information and resource security tag information corresponding to the target resource identification information.

[0052] Specifically, the server obtains user security marking information corresponding to the user identification information and resource security marking information corresponding to the target resource identification information according to the information acquisition instruction.

[0053] For example, the server obtains the organization, region, role, access level, validity period and accessible resource list in the user security tag information, as well as the organization, region, role, access level and validity period in the resource security tag information according to the information acquisition instruction.

[0054] Step S203: Perform security tag information determination on the knowledge base access request according to the user security tag information and the resource security tag information to obtain a security tag information determination result.

[0055] The security tag information determination may be a determination operation performed on the organization, region, role, access level, validity period, and accessible resource list, etc.

[0056] Specifically, the server receives a security tag information determination instruction, and performs security tag information determination on the knowledge base access request according to the instruction requirement, to obtain a security tag information determination result.

[0057] Step S204, when the security tag information determines that the knowledge base access request is approved, the target resource identification information in the knowledge base access request is replaced with the target resource path, and the replaced knowledge base access request is forwarded to the target resource corresponding to the target resource path.

[0058] Among them, the target resource path refers to the service address. For example, we need a service to access a file or download a picture. The service address here is the target resource path; the target resource refers to various resources in the knowledge base. For example, an application system, a picture, a file or a web page can be regarded as a resource.

[0059] Specifically, when the security tag information determines that the knowledge base access request is passed, the server receives a resource forwarding instruction, and according to the instruction requirements, replaces the target resource identification information in the knowledge base access request with the target resource path, and forwards the replaced knowledge base access request to the target resource corresponding to the target resource path.

[0060] Step S205: Send the response result of the target resource to the knowledge base access request to the client.

[0061] Specifically, the server receives a result forwarding instruction, and according to the instruction requirement, receives a response result of the target resource corresponding to the target resource path to the knowledge base access request; and forwards the response result to the knowledge base access request to the client.

[0062] The access control method applied to the knowledge base obtains the user identification information and the target resource identification information in the knowledge base access request, obtains the user security tag information corresponding to the user identification information, and the resource security tag information corresponding to the target resource identification information, and then performs security tag information determination on the knowledge base access request based on the user security tag information and the resource security tag information to obtain the security tag information determination result. When the security tag information determination result is that the knowledge base access request is passed, the target resource identification information in the knowledge base access request is replaced with the target resource path, and the replaced knowledge base access request is forwarded to the target resource corresponding to the target resource path, and finally the target resource's response result to the knowledge base access request is sent to the client. In summary, the entire technical solution uses a variety of indicators for comprehensive verification when verifying the legality of the user's access to the knowledge base, which can accurately and effectively verify whether the user's access to the knowledge base is legal and compliant, and reduce the occurrence of illegal access phenomena such as unauthorized access, non-valid access, and cross-level access, thereby improving the detection accuracy of the security of access to the knowledge base.

[0063] In one embodiment, in the above step S203, the security tag information of the knowledge base access request is determined according to the user security tag information and the resource security tag information to obtain the security tag information determination result, which specifically includes the following steps:

[0064] Compare each user preset indicator in the user security tag information with each target resource preset indicator in the resource security tag information to obtain a comparison result corresponding to each user preset indicator; when the comparison results corresponding to each user preset indicator are all judged as passed, confirm that the security tag information judgment result is that the knowledge base access request is passed.

[0065] Among them, user preset indicators include organization, region, role, access level, validity period and list of accessible resources; target resource preset indicators include organization, region, role, access level and validity period.

[0066] Specifically, the server receives a preset indicator comparison instruction, and according to the instruction requirements, compares each user preset indicator in the user security tag information with each target resource preset indicator in the resource security tag information to obtain a comparison result corresponding to each user preset indicator; when the comparison results corresponding to each user preset indicator are all passed, it is confirmed that the security tag information judgment result is that the knowledge base access request is passed.

[0067] In this embodiment, by comparing each user preset indicator in the user security tag information with each target resource preset indicator in the resource security tag information, the comparison results corresponding to each user preset indicator are obtained. Therefore, when determining the security tag information of the knowledge base access request, a variety of indicators are used for comprehensive comparison, which can accurately and effectively verify whether the user's access behavior is legal and compliant.

[0068] In one embodiment, the user preset indicators include a first access level, a first organization, a first region, a first role, a first access validity period and a list of accessible resources corresponding to the user, and the target resource preset indicators include a second access level, a second organization, a second region, a second role and a second access validity period; the above steps confirm that the security tag information judgment result is that the knowledge base access request is passed when the comparison results corresponding to each user preset indicator are all judged as passed, and specifically include the following steps: when the first access level is greater than or equal to the second access level, the first organization is included in the second organization, the first region is included in the second region, the first role is the same as the second role, the access time corresponding to the knowledge base access request is within the first access validity period and the second access validity period, and the list of accessible resources includes the target resource identification information, confirm that the security tag information judgment result is that the knowledge base access request is passed.

[0069] Among them, the first organization and the first region refer to the organization and region to which the user belongs respectively; the second organization and the second region refer to the organization and region to which the user belongs respectively; and the accessible resource list refers to the content list of resources that the user can currently access.

[0070] Specifically, when the server identifies that the first access level is greater than or equal to the second access level, the first organization is included in the second organization, the first region is included in the second region, the first role is the same as the second role, the access time corresponding to the knowledge base access request is within the first access validity period and the second access validity period, and the list of accessible resources includes the target resource identification information, it confirms that the security tag information judgment result is that the knowledge base access request is approved.

[0071] In this embodiment, by comparing each user preset indicator in the user security tag information with each target resource preset indicator in the resource security tag information, the comparison results corresponding to each user preset indicator are obtained. Therefore, when the security tag information is determined for the knowledge base access request, a comprehensive comparison of multiple indicators can be used to accurately and effectively verify whether the user's access behavior is legal and compliant, and reduce the occurrence of illegal access phenomena such as unauthorized access, non-valid access, and cross-level access.

[0072] In one embodiment, before obtaining the user security tag information corresponding to the user identification information and the resource security tag information corresponding to the target resource identification information, the method of the present application further includes the following steps:

[0073] Verify the user identification information to obtain the user's identity verification result;

[0074] In the above step S202, obtaining the user security tag information corresponding to the user identification information and the resource security tag information corresponding to the target resource identification information specifically includes the following steps:

[0075] When the identity authentication result is that the user's identity authentication is passed, user security tag information corresponding to the user identification information and resource security tag information corresponding to the target resource identification information are obtained.

[0076] Specifically, the server receives an identity authentication instruction, verifies the user identification information according to the instruction requirements, obtains the user's identity authentication result as the user's identity authentication is passed, and then obtains the user security tag information corresponding to the user identification information, and the resource security tag information corresponding to the target resource identification information.

[0077] In this embodiment, before obtaining the user security tag information corresponding to the user identification information and the resource security tag information corresponding to the target resource identification information, the user identification information is verified, which helps to improve the detection accuracy of the security of accessing the knowledge base.

[0078] In one embodiment, the above steps verify the user identification information to obtain the user's identity authentication result, which specifically includes the following:

[0079] Obtain the first user identity information in the user identification information and the second user identity information in the certificate; compare the first user identity information and the second user identity information; if the first user identity information and the second user identity information are the same, confirm that the identity authentication result is that the user's identity authentication is passed.

[0080] Among them, the certificate stores identity information and public keys, while the user has a private key that is virtually stored. Certificate authentication uses digital certificates issued by a certificate authority and public key encryption to verify the user's identity.

[0081] Specifically, the server receives an identity information verification instruction, and according to the instruction requirements, obtains the first user identity information in the user identification information and the second user identity information in the certificate; compares the first user identity information and the second user identity information, and obtains the result that the first user identity information and the second user identity information are the same, and then confirms that the identity authentication result is that the user's identity authentication is passed.

[0082] In this embodiment, verifying the user identity information by means of certificate verification can effectively verify whether the user's access behavior is legal and compliant.

[0083] In one embodiment, before sending the response result of the target resource to the knowledge base access request to the client, the method of the present application further includes the following steps:

[0084] Record the client's access behavior to the target resource; in the event of an abnormality in the target resource, identify the abnormal client and the abnormal user using the abnormal client from the clients accessing the target resource based on the recorded access behavior.

[0085] Among them, the record of the client's access behavior to the target resource can be queried in the future.

[0086] Specifically, the server receives an access behavior recording instruction, and records the user's access behavior to the target resource according to the instruction requirements. When an abnormality is identified in the target resource, the server identifies the abnormal client and the abnormal user using the abnormal client from the clients accessing the target resource based on the recorded access behavior.

[0087] In this embodiment, by recording the user's access behavior to the target resource, it is convenient to query and verify the user's access behavior in the future.

[0088] In one embodiment, as shown in FIG3 , an access control method applied to a knowledge base in a specific embodiment is provided, which specifically includes the following steps:

[0089] Step S301, in response to a knowledge base access request sent by a client, obtaining user identification information and target resource identification information in the knowledge base access request.

[0090] Step S302, obtaining the first user identity information in the user identification information and the second user identity information in the certificate; comparing the first user identity information and the second user identity information; if the first user identity information and the second user identity information are the same, confirming that the identity authentication result is that the user's identity authentication is successful.

[0091] Step S303: when the identity authentication result is that the user's identity authentication is passed, obtain user security tag information corresponding to the user identification information and resource security tag information corresponding to the target resource identification information.

[0092] Step S304: compare each user preset indicator in the user security mark information with each target resource preset indicator in the resource security mark information to obtain a comparison result corresponding to each user preset indicator.

[0093] Step S305, when the first access level is greater than or equal to the second access level, the first organization is included in the second organization, the first region is included in the second region, the first role is the same as the second role, the access time corresponding to the knowledge base access request is within the first access validity period and the second access validity period, and the list of accessible resources includes the target resource identification information, confirm that the security tag information judgment result is that the knowledge base access request is passed.

[0094] Step S306, when the security tag information determines that the knowledge base access request is passed, the target resource identification information in the knowledge base access request is replaced with the target resource path, and the replaced knowledge base access request is forwarded to the target resource corresponding to the target resource path, and the response result of the target resource to the knowledge base access request is sent to the client.

[0095] The beneficial effects brought by the above embodiments are as follows:

[0096] The access control method applied to the knowledge base proposed in the present application adopts multiple indicators for comprehensive verification when verifying the legitimacy of the user's access to the knowledge base. It can accurately and effectively verify whether the user's access to the knowledge base is legal and compliant, and reduce the occurrence of illegal access phenomena such as unauthorized access, non-valid access, and cross-level access, thereby improving the detection accuracy of the security of access to the knowledge base.

[0097] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0098] Based on the same inventive concept, the embodiment of the present application also provides an access control device applied to a knowledge base for implementing the access control method applied to a knowledge base involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of one or more access control devices applied to a knowledge base provided below can refer to the limitations of the access control method applied to a knowledge base above, and will not be repeated here.

[0099] In one embodiment, as shown in FIG4 , an access control device applied to a knowledge base is provided, comprising:

[0100] The request receiving module 401 is used to respond to the knowledge base access request sent by the client and obtain the user identification information and the target resource identification information in the knowledge base access request;

[0101] The information acquisition module 402 is used to acquire user security tag information corresponding to the user identification information and resource security tag information corresponding to the target resource identification information;

[0102] Result determination module 403, used to perform security tag information determination on the knowledge base access request according to the user security tag information and the resource security tag information, and obtain a security tag information determination result;

[0103] The request forwarding module 404 is used to replace the target resource identification information in the knowledge base access request with the target resource path when the security tag information determines that the knowledge base access request is passed, and forward the replaced knowledge base access request to the target resource corresponding to the target resource path;

[0104] The resource sending module 405 is used to send the response result of the target resource to the knowledge base access request to the client.

[0105] In one embodiment, the result determination module 403 is also used to compare each user preset indicator in the user security tag information with each target resource preset indicator in the resource security tag information to obtain a comparison result corresponding to each user preset indicator; when the comparison results corresponding to each user preset indicator are all judged as passed, the security tag information judgment result is confirmed to be a knowledge base access request passed.

[0106] In one embodiment, the user preset indicators include a first access level, a first organization, a first region, a first role, a first access validity period and a list of accessible resources corresponding to the user, and the target resource preset indicators include a second access level, a second organization, a second region, a second role and a second access validity period; the result judgment module 403 is also used to confirm that the security tag information judgment result is that the knowledge base access request is passed when the first access level is greater than or equal to the second access level, the first organization is included in the second organization, the first region is included in the second region, the first role is the same as the second role, the access time corresponding to the knowledge base access request is within the first access validity period and the second access validity period, and the list of accessible resources includes the target resource identification information.

[0107] In one embodiment, the access control device applied to the knowledge base also includes an information verification module, which is used to verify the user identification information and obtain the user's identity authentication result; the information acquisition module 402 is also used to obtain the user security tag information corresponding to the user identification information and the resource security tag information corresponding to the target resource identification information when the identity authentication result is that the user's identity authentication is passed.

[0108] In one embodiment, the information verification module is also used to obtain the first user identity information in the user identification information and the second user identity information in the certificate; compare the first user identity information and the second user identity information; and when the first user identity information and the second user identity information are the same, confirm that the identity authentication result is that the user's identity authentication is passed.

[0109] In one embodiment, the access control device applied to the knowledge base also includes an access recording module for recording the client's access behavior to the target resource; in the event of an abnormality in the target resource, the abnormal client and the abnormal user using the abnormal client are identified from the clients accessing the target resource based on the recorded access behavior.

[0110] Each module in the access control device applied to the knowledge base can be implemented in whole or in part by software, hardware and a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module.

[0111] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG5. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external client through a network connection. When the computer program is executed by the processor, an access control method applied to a knowledge base is implemented.

[0112] Those skilled in the art will understand that the structure shown in FIG. 5 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0113] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0114] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0115] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0116] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0117] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0118] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0119] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An access control method applied to a knowledge base, characterized in that: The method comprises: In response to a knowledge base access request sent by a client, obtaining user identification information and target resource identification information in the knowledge base access request; Acquire user security marking information corresponding to the user identification information, and resource security marking information corresponding to the target resource identification information; Performing security tag information determination on the knowledge base access request according to the user security tag information and the resource security tag information to obtain a security tag information determination result; In the case where the security tag information determines that the knowledge base access request is approved, the target resource identification information in the knowledge base access request is replaced with a target resource path, and the replaced knowledge base access request is forwarded to the target resource corresponding to the target resource path; The response result of the target resource to the knowledge base access request is sent to the client.

2. The method according to claim 1, characterized in that The step of performing security tag information determination on the knowledge base access request according to the user security tag information and the resource security tag information to obtain a security tag information determination result includes: Compare each user preset indicator in the user security mark information with each target resource preset indicator in the resource security mark information to obtain a comparison result corresponding to each user preset indicator; When the comparison results corresponding to the respective user preset indicators are all judged as passed, the security mark information judgment result is confirmed as the knowledge base access request being passed.

3. The method according to claim 2, characterized in that The user preset indicators include a first access level, a first organization, a first region, a first role, a first access validity period and a list of accessible resources corresponding to the user, and the target resource preset indicators include a second access level, a second organization, a second region, a second role and a second access validity period; When the comparison results corresponding to the preset indicators are all judged as passed, confirming that the security mark information judgment result is that the knowledge base access request is passed includes: When the first access level is greater than or equal to the second access level, the first organization is included in the second organization, the first region is included in the second region, the first role is the same as the second role, the access time corresponding to the knowledge base access request is within the first access validity period and the second access validity period, and the list of accessible resources includes the target resource identification information, confirm that the security tag information judgment result is that the knowledge base access request is approved.

4. The method according to claim 3, characterized in that Before acquiring the user security marking information corresponding to the user identification information and the resource security marking information corresponding to the target resource identification information, the method further includes: Verifying the user identification information to obtain the identity authentication result of the user; The acquiring of user security marking information corresponding to the user identification information and resource security marking information corresponding to the target resource identification information includes: When the identity authentication result is that the identity authentication of the user is passed, user security marking information corresponding to the user identification information and resource security marking information corresponding to the target resource identification information are acquired.

5. The method according to claim 4, characterized in that The verifying the user identification information to obtain the identity authentication result of the user includes: Obtaining first user identity information in the user identification information and second user identity information in the certificate; comparing the first user identity information and the second user identity information; When the first user identity information and the second user identity information are the same, confirm that the identity authentication result is that the identity authentication of the user is passed.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Recording the access behavior of the client to the target resource; In the case that an abnormality occurs in the target resource, an abnormal client and an abnormal user who uses the abnormal client are identified from the clients accessing the target resource according to the recorded access behavior.

7. An access control device applied to a knowledge base, characterized in that: The device comprises: A request receiving module, used to respond to a knowledge base access request sent by a client, and obtain user identification information and target resource identification information in the knowledge base access request; An information acquisition module, used to acquire user security tag information corresponding to the user identification information, and resource security tag information corresponding to the target resource identification information; A result determination module, configured to perform security tag information determination on the knowledge base access request according to the user security tag information and the resource security tag information, and obtain a security tag information determination result; A request forwarding module, configured to replace the target resource identification information in the knowledge base access request with a target resource path, and forward the replaced knowledge base access request to a target resource corresponding to the target resource path, if the security tag information determines that the knowledge base access request is passed; The resource sending module is used to send the response result of the target resource to the knowledge base access request to the client.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images