Method and system for controlling multi-level security grading of cloud users

Abstract

The invention relates to a method and a system for controlling multi-level security grading of cloud users, and belongs to the technical field of computers. The method comprises the following steps: judging whether a scanning server runs normally or not; under the condition that the scanning server runs normally, the security levels of a subject and an object are determined based on a BLP model and a Biba model, the subject is used for indicating a user or a process sending a resource access request, and the object is used for indicating accessed data or resources; executing read-write operation on the subject according to the security levels of the subject and the object; and under the condition of executing the read-write operation on the subject, performing permission setting on the subject, and adjusting the security level of the object based on the abnormal alarm information. According to the method, the security of the cloud environment can be remarkably improved, the access control precision is enhanced, the cloud environment management is optimized, and the compliance is promoted. And a safer, more reliable and more efficient cloud service environment is provided for cloud users.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and in particular, relates to a method and system for controlling multi-level security classification of cloud users. Background Art

[0002] In related technologies, the cloud security center may be blocked by the server's security protection measures (such as WAF, SOC) when performing application vulnerability scanning, and the scanner IP needs to be added to the whitelist; at the same time, the BLP model has defects in ensuring information confidentiality and fails to effectively restrict the unauthorized flow of information. In a cloud computing environment, due to the characteristics of virtualization technology, it becomes necessary to implement multi-level security access control. Summary of the invention

[0003] In view of the above shortcomings of the prior art, the purpose of the invention is to provide a method and system for controlling multi-level security classification of cloud users. The method can significantly improve the security of the cloud environment, enhance the accuracy of access control, optimize cloud environment management, and promote compliance.

[0004] In a first aspect of the present invention, a method for controlling multi-level security grading of cloud users is proposed, comprising: S1, determining whether a scanning server is operating normally; S2, when the scanning server is operating normally, determining the security level of a subject and an object based on a BLP model and a Biba model, wherein the subject refers to a user or process that issues a request to access a resource, and the object refers to data or resources being accessed; S3, performing read and write operations on the subject according to the security levels of the subject and the object; S4, when performing read and write operations on the subject, setting permissions for the subject, and adjusting the security level of the object based on abnormal alarm information.

[0005] Furthermore, determining that the scanning server is operating normally includes: when scanning the server, determining whether the server is securely deployed; and when determining that the server is securely deployed, adding the address of the server to a whitelist.

[0006] Further, according to the security levels of the subject and the object, read and write operations are performed on the subject, including: when the security level of the subject is greater than the security level of the object, only write operations are performed on the subject; when the security level of the subject is not greater than the security level of the object, only read operations are performed on the subject.

[0007] Furthermore, setting permissions for the subject includes: obtaining an access policy for data set by a data owner based on a data tag; and determining permission settings for the subject based on the access policy.

[0008] Further, adjusting the security level of the object based on the abnormal alarm information includes: judging whether it is an abnormal diagnosis based on the abnormal alarm information; and lowering the security level of the object when it is determined to be the abnormal diagnosis.

[0009] Furthermore, the method further includes: if it is determined that the object has not been degraded within a preset time, upgrading the security level of the object.

[0010] Furthermore, it also includes: judging whether it is an abnormal fluctuation based on the abnormal alarm information; and adding the object to a downgrade observation list if it is determined to be the abnormal fluctuation.

[0011] In a second aspect of the present invention, a system for controlling multi-level security grading of cloud users is proposed, comprising: a judgment module, used to judge whether a scanning server is operating normally; a determination module, used to determine the security level of a subject and an object based on a BLP model and a Biba model when the scanning server is operating normally, wherein the subject refers to a user or process that issues a request to access a resource, and the object refers to data or resources being accessed; an execution module, used to perform read and write operations on the subject according to the security levels of the subject and the object; an adjustment module, used to set permissions for the subject when performing read and write operations on the subject, and to adjust the security level of the object based on abnormal alarm information.

[0012] According to a third aspect of the present invention, an electronic device is proposed, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any of the methods described in the first aspect of the present invention.

[0013] According to a fourth aspect of the present invention, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute any one of the methods according to the first aspect of the present invention.

[0014] The beneficial effects of the present invention are as follows:

[0015] The method and system for controlling multi-level security classification of cloud users described in the present invention judge whether the scanning server is operating normally; when the scanning server is operating normally, the security level of the subject and the object is determined based on the BLP model and the Biba model, the subject is used to refer to the user or process that issues a request to access resources, and the object is used to refer to the data or resources being accessed; according to the security level of the subject and the object, read and write operations are performed on the subject; when read and write operations are performed on the subject, permissions are set for the subject, and the security level of the object is adjusted based on abnormal alarm information. This method can significantly improve the security of the cloud environment, enhance the accuracy of access control, optimize cloud environment management, and promote compliance. Together, it provides cloud users with a more secure, reliable, and efficient cloud service environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings are only used to illustrate specific embodiments and are not considered to limit the present invention. In the entire drawings, the same reference symbols represent the same components. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings.

[0017] Figure 1 is a flow chart of a method for controlling multi-level security classification of cloud users according to an embodiment of the present invention;

[0018] Figure 2 is a flow chart of a method for controlling multi-level security classification of cloud users according to a specific embodiment of the present invention;

[0019] Figure 3 is a schematic diagram of forming a tag set according to an embodiment of the present invention;

[0020] Figure 4 is a schematic diagram of a system for controlling multi-level security classification of cloud users according to an embodiment of the present invention;

[0021] Figure 5 It is a structural block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in the field without making creative work should fall within the scope of protection of the present invention.

[0023] Furthermore, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessarily obscuring the concepts disclosed in the present invention.

[0024] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the orientation or position relationship indicated by the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inside", "outside", etc. is based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation of the present invention. In addition, the terms "first", "second", and "third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. The terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be a connection between the two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0025] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of methods and systems consistent with some aspects of the present invention as detailed in the appended claims.

[0026] When the Cloud Security Center scans application vulnerabilities, it will simulate hacker intrusion attacks through the public network (only send request messages, no actual attack behavior will be performed) to perform security scans on your server. If your server has security protection or monitoring deployment, such as Web Application Firewall (WAF) or SOC (Security Operations Center), it is recommended that you add the IP address of the Web scanner to the whitelist to ensure the normal operation of the scanning service. Multi-level security is to divide objects with different security levels into different groups, and implement security control on the information flow between objects of different security levels through access control policies. Among them, the security levels between groups are different, while the security levels of objects in the same group are the same. In the study of multi-level security, the BLP model and the Biba model are the most common. The BLP model is the most typical model to ensure the security of the operating system. It describes the reasonable flow path of information in the security system and defines the security characteristics of the system state security. The BLP model is mainly used in military systems to ensure the confidentiality of information. In this model, the relevant rules are "no read up" and "no write down". However, the BLP model does not take effective measures to restrict unauthorized information, resulting in the possibility of illegal operations. For cloud computing, it is necessary to implement multi-level security in the virtual machine system. The reason is that virtualization technology can assign processes to different virtual machines, and virtual machines belonging to different organizations or departments (usually with different security levels) may run on the same virtual machine monitor. Based on this feature, a multi-level security access control model based on the three-layer structure of the cloud platform can be constructed. The virtual machine monitor (VMM) is taken as the top layer, the virtual machine (VM) running on the same virtual machine monitor is taken as the middle layer, and the process (P) running in the virtual machine is taken as the bottom layer. After the hierarchical division is implemented, it is also necessary to set the security level for the processes in the bottom layer and the virtual machines in the middle layer according to the multi-level security standards to form a multi-level security model for cloud computing.

[0027] The present invention proposes a method, system and related equipment for controlling multi-level security classification of cloud users. Specifically, the following describes a method, system and related equipment for controlling multi-level security classification of cloud users according to an embodiment of the present invention with reference to the accompanying drawings.

[0028] Figure 1 This is a flow chart of a method for controlling multi-level security classification of cloud users according to an embodiment of the present invention. It should be noted that the method for controlling multi-level security classification of cloud users in the embodiment of the present invention can be applied to the system for controlling multi-level security classification of cloud users in the embodiment of the present invention. The system for controlling multi-level security classification of cloud users can be configured on an electronic device or in a server. This embodiment of the present application does not limit this.

[0029] like Figure 1 As shown, the method for controlling the multi-level security classification of cloud users includes:

[0030] S110, determining whether the scanning server operates normally.

[0031] In an embodiment of the present invention, when the cloud security center scans application vulnerabilities, it will simulate a hacker intrusion attack through the public network (only send request messages, and will not perform any actual attack behavior), perform a security scan on the server, and then determine whether the scanned server is operating normally.

[0032] S120, when the scanning server operates normally, the security levels of the subject and the object are determined based on the BLP model and the Biba model, where the subject refers to the user or process that issues a request to access a resource, and the object refers to the data or resource being accessed.

[0033] In the embodiment of the present invention, when scanning a server, it is determined whether the server has a secure deployment; if it is determined that there is a secure deployment, the address of the server is added to the whitelist, thereby determining that the scanning server is operating normally. If the scanning server is operating normally, the security level of the subject and the object is determined based on the BLP model and the Biba model.

[0034] S130, performing read and write operations on the subject according to the security levels of the subject and the object.

[0035] In the embodiment of the present invention, when the security levels of the subject and the object are determined, the read and write operations on the subject can be performed by comparing the security levels of the subject and the object. The specific implementation method can refer to the subsequent embodiments.

[0036] S140, when performing read and write operations on the subject, setting permissions for the subject, and adjusting the security level of the object based on abnormal alarm information.

[0037] According to the method for controlling the multi-level security classification of cloud users in an embodiment of the present invention, it is determined whether the scanning server is operating normally; when the scanning server is operating normally, the security level of the subject and the object is determined based on the BLP model and the Biba model, the subject is used to refer to the user or process that issues a request to access a resource, and the object is used to refer to the data or resource being accessed; according to the security level of the subject and the object, read and write operations are performed on the subject; when performing read and write operations on the subject, permissions are set for the subject, and the security level of the object is adjusted based on abnormal alarm information. This method can significantly improve the security of the cloud environment, enhance the accuracy of access control, optimize cloud environment management, and promote compliance. Together, it provides cloud users with a more secure, reliable, and efficient cloud service environment.

[0038] In order to make it easier for those skilled in the art to understand the present invention, Figure 2A method for controlling multi-level security classification of cloud users according to a specific embodiment of the present invention is as follows. Figure 2 As shown, the method for controlling multi-level security classification of cloud users includes:

[0039] S210, determining whether the scanning server operates normally.

[0040] In the embodiment of the present invention, the implementation of step S210 may refer to the implementation of step S110 described above, and the present invention will not elaborate on this any more.

[0041] S220, determining that the scanning server operates normally.

[0042] In an embodiment of the present invention, when scanning a server, it is determined whether the server is securely deployed; if it is determined that the server is securely deployed, the address of the server is added to a whitelist to determine that the scanned server is operating normally.

[0043] Based on the server's response to the simulated attack, the server's configuration, security policies, firewall rules, etc. are further analyzed to confirm whether there is effective security deployment. This includes but is not limited to checking whether the server's security patches, firewall settings, intrusion detection systems (IDS) and intrusion prevention systems (IPS) are enabled and configured correctly.

[0044] S230, when the scanning server operates normally, the security levels of the subject and the object are determined based on the BLP model and the Biba model, where the subject refers to the user or process that issues a request to access a resource, and the object refers to the data or resource being accessed.

[0045] In the embodiment of the present invention, the BLP (Bell-LaPadula) model and the Biba model are both data access control models for computer system security.

[0046] The BLP model is mainly used to protect the confidentiality of data, while the Biba model is used to protect the integrity of data. Both models are based on mandatory access control, which controls the subject's access to the object through security levels.

[0047] Among them, the security level of the subject and object in the BLP model is determined by the following rules: Simple security attribute: The subject can only read data with a security level equal to or lower than its own (read down). Asterisk attribute: The subject can only write data to an object with a security level higher than its own (write up). Autonomous security attribute: Use the access matrix to specify autonomous access control. These rules ensure that data can only flow from a low security level to a high security level, thereby preventing the illegal leakage of sensitive data.

[0048] Among them, the security level of the subject and object in the Biba model is determined by the following rules: Simple security attribute: The subject can only modify data with a security level equal to or higher than its own (write up). Asterisk attribute: The subject cannot modify data with a security level lower than its own (write down). Calling feature: When the integrity level of a subject is not less than the integrity level of another subject, another subject cannot be called. These rules ensure the integrity of the data and prevent unauthorized modifications.

[0049] S240, performing read and write operations on the subject according to the security levels of the subject and the object.

[0050] In an embodiment of the present invention, when determining the security levels of a subject and an object, the security levels of the subject and the object are compared, and when the security level of the subject is greater than the security level of the object, only a write operation is performed on the subject; when the security level of the subject is not greater than the security level of the object, only a read operation is performed on the subject.

[0051] That is, if the security level of the object is lower than that of the subject, the subject can only perform "write" operations, which aims to prevent illegal users from creating or modifying the information of high-security level objects and prohibit all similar unauthorized activities. This means that data with a high integrity level can only be modified by subjects of the same or higher level, thereby protecting the integrity of the data. On the contrary, if the security level of the object is higher than that of the subject, the subject can perform "read" operations on the object, which helps prevent data from being modified without authorization.

[0052] S250, when performing read and write operations on the subject, setting permissions for the subject.

[0053] In an embodiment of the present invention, when a read or write operation is performed on a subject, an access policy for data set by a data owner based on a data tag is obtained, and permission settings for the subject are determined based on the access policy.

[0054] Among them, the access policy defines which subjects can access the data and how to access it, that is, the subject's permission settings.

[0055] In a specific embodiment of the present invention, a distributed information flow control method (i.e., Decentralized Information Flow Control, DIFC) enables data owners to set data access policies based on data tags. The core idea of ​​the distributed information flow control method is to give data owners full control over their data, that is, data owners have the right to decide the access policies and usage of data. This control method breaks the limitations of traditional centralized information flow control and makes information flow more flexible and secure.

[0056] Among them, the autonomy of data owners: In DIFC, data owners have full control over their data. They have the right to decide who can access their data and how the data can be accessed. This autonomy is achieved by data owners setting labels for their data. Labels are identifiers of the "security level" or "access policy" of data, which determine which subjects (such as users, processes or systems) can read, write or perform operations related to the data.

[0057] Tags are at the core of access policies: Tags are a core concept of DIFC, which are used to represent access rights and restrictions on data. Data owners specify which subjects can access data by assigning specific tags to data. These tags may contain information about resources, such as reader collections, owners, etc., to ensure that data access policies are accurately implemented.

[0058] Specifically, data owners label the security level of their data based on tags. Tags may contain information about their resources, so tags must reflect the policy of each resource. For example, if two integers are multiplied, the tag of the operation must reflect the information of the two operands. If a resource set contains two values ​​​​labeled with L1 and L2 respectively, the result should have the minimum restrictive tag, forming a corresponding tag set (such as Figure 3 As shown), to retain all information restrictions of L1 and L2. The label is constructed as L1∪L2, the label set L1∪L2 is the union of L1 and L2, and the reader set of each resource in L1 and L2 is the intersection of its reader sets. According to the above definition, this rule can be written as readers(L,W), where S that is not in the data owner set is defined as the subject set, because W does not specify restrictions on information transmission, then the label L1∪L2 union rule can be expressed as the following. That is, owers(L1∪L2)=owers(L1)∪owers(L2), readers(L1∪L2, W)=readers(L1, W)∩readers(L2, W), where, This is true for all tags L1 and L2, and the union is limited in use, so it does not reveal information.

[0059] Among them, tag-based access control: In the DIFC model, data access control is based on tags. Only when the subject's tag meets the data's access policy can the subject access the data. This tag-based access control mechanism ensures the confidentiality and integrity of the data, because only authorized subjects can access sensitive data, while unauthorized subjects cannot access it.

[0060] Among them, relabeling is an important concept in the DIFC model. It refers to the replacement or update of data labels according to certain rules and conditions during data propagation or processing. Among them, relabeling is safe in the following four situations. That is, 1. Reduction or deletion of data readers. The fewer readers accessing system data, the safer the data; 2. Increase of data readers. The added readers can represent a reader in the original policy; 3. Addition of data policies. The more access control policies for system data, the safer the data; 4. Replacement of data owners. The owner used for replacement can represent an owner in the original policy.

[0061] Among them, label reset rules: In order to protect the security of data, DIC defines a set of label reset rules to ensure the legality of label reset, including restriction rules and decryption rules to allow owners to modify their information flow policies.

[0062] Specifically, for labels L1 and L2, if Right now or Then the L1 to L2 tag reset is valid. Simply think that it removes the reader, adds the owner, or both.

[0063] Only when the process represents the owner W, the label is reset, and decryption includes adding readers to some W or removing some W, and there is a transfer of behavioral relationships. For example, if a process can represent subject P, then it can also represent all subjects Q that subject P can represent, and can decrypt the data owned by Q. DIFC provides better security for applications and processes by using effective fine-grained information flow control. The model provides each user with the ability to define information flow policies at the level of personal data items. Each user has the ability to decrypt his own data without leaking the data of other users.

[0064] S260, adjusting the security level of the object based on the abnormal alarm information.

[0065] In an embodiment of the present invention, whether it is an abnormal diagnosis is determined based on the abnormal alarm information; if it is determined to be an abnormal diagnosis, the security level of the object is reduced.

[0066] In an embodiment of the present invention, when it is determined that the object has not been degraded within a preset time, the security level of the object is upgraded.

[0067] In an embodiment of the present invention, whether it is an abnormal fluctuation is determined based on the abnormal alarm information; if it is determined to be an abnormal fluctuation, the object is added to a degradation observation list.

[0068] Among them, abnormal diagnosis is to find individual values ​​in the data that are different from most values. From the definition of abnormality, we know that the number of abnormalities must be very small relative to the normal number, and is often discontinuous in time. For example, before time T, the data distribution basically maintains a stable fluctuation between 0 and 1; after time T, it suddenly increases to fluctuate between 5 and 6. There was an increase at time T, and it lasted for a long time after the increase. This is an abnormal fluctuation. The amplitude of the numerical change in abnormal fluctuations has no absolute size relationship with the difference between the abnormal value and the normal value found by abnormal diagnosis. It is not possible to judge whether it is an abnormal fluctuation or an abnormal value by the size of a certain value, but it is possible to judge whether an abnormal fluctuation occurs by the size of multiple consecutive values.

[0069] Abnormal fluctuation detection scenarios are often used for purposes such as fixing previous parts or equipment bugs, improving performance, and increasing demand. After software or equipment updates and deployments, service performance will fluctuate to a certain extent. The parameters of the original abnormal diagnosis algorithm are based on the distribution of historical data. When abnormal fluctuations occur and the data increases or decreases several times, the abnormal diagnosis algorithm will produce false alarms. For example, for the abnormal diagnosis method based on expert rules, the original threshold is definitely not applicable to the value after a drastic fluctuation. Other algorithms based on statistics and machine learning will also be affected, and the parameters need to be modified accordingly.

[0070] According to the method for controlling multi-level security classification of cloud users in accordance with an embodiment of the present invention, the BLP model and the Biba model are used in combination to protect the confidentiality of data (BLP model) and ensure the integrity of data (Biba model). This dual protection mechanism significantly enhances the security of the system; the distributed information flow control method (DIFC) allows data owners to have full control over their data, thereby further reducing unauthorized access and modification and improving the overall security of the system; through the access policy setting based on data labels, data owners can flexibly define which subjects can access their data and in what way, which increases the flexibility and granularity of data access control; label reset rules allow data labels to be replaced or updated according to rules and conditions during data propagation or processing, which further improves the flexibility and adaptability of data access control; a status check is performed on the scanning server at the beginning of the system to ensure that the server is operating normally before subsequent operations are performed, which helps to avoid system crashes or data loss due to server failures; through By dynamically adjusting the security levels of subjects and objects, we can respond to security threats in a timely manner according to actual conditions, thereby improving the response speed and stability of the system; performing read and write operations on subjects according to their security levels helps prevent low-security-level subjects from illegally accessing and modifying high-security-level data, thereby optimizing resource allocation and management; by adding abnormally fluctuating objects to the downgrade observation list, they can be continuously monitored and analyzed so that problems can be discovered in a timely manner and appropriate measures can be taken to avoid waste of resources and potential security risks. The automated and intelligent security level adjustment and permission setting process reduces the need for manual intervention, and reduces the complexity and workload of security management and operation and maintenance work; by providing clear abnormal alarm information and security level adjustment records, it helps operation and maintenance personnel quickly locate and solve security problems, thereby improving operation and maintenance efficiency and quality.

[0071] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods of each embodiment of the present application.

[0072] According to one aspect of an embodiment of the present invention, a system for controlling multi-level security classification of cloud users is also proposed. Figure 4 is a schematic diagram of a system for controlling multi-level security classification of cloud users according to an embodiment of the present invention; Figure 4 As shown, including:

[0073] The determination module 410 is used to determine whether the scanning server is operating normally;

[0074] A determination module 420, configured to determine the security level of a subject and an object based on a BLP model and a Biba model when the scanning server is operating normally, wherein the subject refers to a user or process that issues a resource access request, and the object refers to data or resources that are accessed;

[0075] An execution module 430, configured to perform read and write operations on the subject according to the security levels of the subject and the object;

[0076] The adjustment module 440 is used to set permissions for the subject when performing read and write operations on the subject, and to adjust the security level of the object based on abnormal alarm information.

[0077] According to the system for controlling the multi-level security classification of cloud users in the embodiment of the present invention, it is determined whether the scanning server is operating normally; when the scanning server is operating normally, the security level of the subject and the object is determined based on the BLP model and the Biba model, where the subject is used to refer to the user or process that issues a request to access a resource, and the object is used to refer to the data or resource being accessed; according to the security level of the subject and the object, read and write operations are performed on the subject; when performing read and write operations on the subject, permissions are set for the subject, and the security level of the object is adjusted based on abnormal alarm information. This can significantly improve the security of the cloud environment, enhance the accuracy of access control, optimize cloud environment management, and promote compliance. Together, a more secure, reliable, and efficient cloud service environment is provided for cloud users.

[0078] Optionally, the determination module 420 is specifically used to determine whether the server has a secure deployment when scanning the server; if it is determined that the server has a secure deployment, add the address of the server to the whitelist.

[0079] Optionally, the execution module 430 is specifically used to perform only write operations on the subject when the security level of the subject is greater than the security level of the object; and to perform only read operations on the subject when the security level of the subject is not greater than the security level of the object.

[0080] Optionally, the adjustment module 440 is specifically used to obtain an access policy set by the data owner based on the data tag to set the data; and determine the permission setting of the subject based on the access policy.

[0081] Optionally, the adjustment module 440 is specifically configured to determine whether it is an abnormal diagnosis based on the abnormal alarm information; if it is determined to be the abnormal diagnosis, reduce the security level of the object.

[0082] Optionally, the adjustment module 440 is specifically configured to upgrade the security level of the object when it is determined that the object has not been degraded within a preset time.

[0083] Optionally, the system further includes a list adding module, which is specifically used to determine whether it is an abnormal fluctuation based on the abnormal alarm information; if it is determined to be the abnormal fluctuation, the object is added to a degradation observation list.

[0084] According to one aspect of an embodiment of the present invention, an electronic device is provided.

[0085] Figure 5 Schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Figure 5 As shown, the electronic device may include one or more ( Figure 5 Only one is shown in the figure) processor 102 (processor 102 may include but is not limited to a microprocessor (Microprocessor Unit, referred to as MPU) or a programmable logic device (Programmable logic device, referred to as PLD)) and a memory 104 for storing data. In an exemplary embodiment, the electronic device may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 5 The structure shown is for illustration only and does not limit the structure of the above terminal device. Figure 5 More or fewer components as shown, or with Figure 5 Equivalent functions or comparisons shown Figure 5 A different configuration with more features is shown.

[0086] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the method for controlling the multi-level security classification of cloud users in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the terminal device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0087] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the switching device. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0088] The present invention provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable the computer to execute a method for controlling multi-level security classification of cloud users.

[0089] The applicant of the present invention has made a detailed explanation and description of the implementation examples of the present invention in conjunction with the drawings in the specification. However, those skilled in the art should understand that the above implementation examples are only preferred implementation schemes of the present invention, and the detailed description is only to help readers better understand the spirit of the present invention, but not to limit the scope of protection of the present invention. On the contrary, any improvements or modifications based on the inventive spirit of the present invention should fall within the scope of protection of the present invention.

[0090] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0091] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present invention. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present invention.

[0092] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, rather than to limit them. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the above embodiments, or replace some of the technical features therein by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. Any changes or replacements that can be easily thought of by those skilled in the art within the technical scope disclosed in the present invention should be covered within the protection scope of the present invention.

Claims

1. A method for controlling multi-level security classification of cloud users, characterized in that: include: S1, determine whether the scanning server is operating normally; S2, when the scanning server operates normally, determining the security level of the subject and the object based on the BLP model and the Biba model, wherein the subject refers to the user or process that issues a request to access a resource, and the object refers to the data or resource being accessed; S3, performing read and write operations on the subject according to the security levels of the subject and the object; S4, when performing read and write operations on the subject, setting permissions for the subject, and adjusting the security level of the object based on abnormal alarm information.

2. The method for controlling multi-level security classification of cloud users according to claim 1, characterized in that: Determining that the scanning server is operating normally includes: When scanning the server, determining whether the server is securely deployed; When it is determined that there is a secure deployment, the address of the server is added to the whitelist.

3. The method for controlling multi-level security classification of cloud users according to claim 1, characterized in that: Performing read and write operations on the subject according to the security levels of the subject and the object, including: When the security level of the subject is greater than the security level of the object, only a write operation is performed on the subject; In the case where the security level of the subject is not greater than the security level of the object, only a read operation is performed on the subject.

4. The method for controlling multi-level security classification of cloud users according to claim 1, characterized in that: Setting permissions for the subject, including: Get the data owner to set the data access policy based on the data tag; A permission setting for the subject is determined based on the access policy.

5. The method for controlling multi-level security classification of cloud users according to claim 1, characterized in that: Adjusting the security level of the object based on the abnormal alarm information includes: Determining whether it is an abnormal diagnosis based on the abnormal alarm information; In the case where the abnormal diagnosis is determined, the security level of the object is lowered.

6. The method for controlling multi-level security classification of cloud users according to claim 5, characterized in that: Also includes: When it is determined that the object has not been degraded within a preset time, the security level of the object is upgraded.

7. The method for controlling multi-level security classification of cloud users according to claim 1, characterized in that: Also includes: Determine whether it is an abnormal fluctuation based on the abnormal alarm information; In the case where it is determined to be the abnormal fluctuation, the object is added to a downgrade observation list.

8. A system for controlling multi-level security classification of cloud users, characterized in that: include: A judgment module is used to judge whether the scanning server is operating normally; A determination module, used for determining the security level of a subject and an object based on a BLP model and a Biba model when the scanning server is operating normally, wherein the subject refers to a user or process that issues a resource access request, and the object refers to data or resources that are accessed; An execution module, used for performing read and write operations on the subject according to the security levels of the subject and the object; The adjustment module is used to set permissions for the subject when performing read and write operations on the subject, and to adjust the security level of the object based on abnormal alarm information.

9. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 7.

Images