Cross-domain access permission determination method, server, medium and product

Abstract

The invention discloses a cross-domain access permission determination method, a server, a medium and a product, and relates to the technical field of Internet, the method comprises the following steps: receiving an original access request sent by a subject and used for requesting to access an object, the subject and the object belong to different security domains, and the original access request carries a subject identifier; obtaining the main body identifier carried in the original access request; and determining the access authority of the main body based on the main body identifier, wherein the access authority comprises access permission and access dispermission. On the premise of ensuring the security of the internet, the subject with the access authority is allowed to access the object, so that the access of the subject to the object is facilitated, the limitation of internet data interaction is reduced, and the convenience and flexibility of internet data access are improved.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a method, server, medium and product for determining cross-domain access rights. Background Art

[0002] With the rapid development of the Internet, cross-domain access has received more and more attention, so the security of cross-domain access has become more and more important.

[0003] In the Internet environment, secure and effective access control is an important technical measure to ensure Internet security. Access control actually allows or restricts users' access to Internet resources or services through specified access control rules or policies. Due to the distribution, dynamics and heterogeneity of resources and services in the Internet environment, it becomes more complicated to implement secure access control. Although there are many models and methods to implement access control in the traditional IT operating environment, these models and methods all require that the object that owns the data and the subject that wants to access the data are in the same trust domain.

[0004] However, if the access subject and the accessed object do not belong to the same trusted security domain, that is, when accessing across domains, the subject accessing the data is unknown. Therefore, when accessing across domains, the subject's access request will generally be directly rejected, resulting in limited and inflexible data transmission on the Internet. Summary of the invention

[0005] The purpose of this application is to provide a cross-domain access rights determination method, server, medium and product to solve the problems described in the background technology.

[0006] To achieve the above objectives, this application provides the following solutions:

[0007] In a first aspect, the present application provides a method for determining cross-domain access rights, including:

[0008] Receiving an original access request sent by a subject for requesting access to an object, the subject and the object belong to different security domains, and the original access request carries a subject identifier;

[0009] Obtaining the subject identifier carried in the original access request;

[0010] The access rights of the subject are determined based on the subject identification, where the access rights include allowing access and not allowing access.

[0011] Optionally, obtaining the subject identifier carried in the original access request includes:

[0012] Converting the original access request into an attribute access request, where the attribute access request carries the subject identifier and can be identified by the object;

[0013] The subject identifier is extracted from the attribute access request.

[0014] Optionally, determining the access rights of the subject based on the subject identifier includes:

[0015] Obtaining an access policy, wherein the access policy records the subject identifiers that can access the object;

[0016] When the subject identifier is stored in the access policy, determining that the access permission of the subject is to allow access;

[0017] When the subject identifier is not stored in the access policy, it is determined that the access permission of the subject is not allowed to access.

[0018] Optionally, the original access request further carries an access content identifier, and the attribute access request also carries an access content identifier. After determining the access rights of the subject based on the subject identifier, the method further includes:

[0019] When the access permission is to allow access, querying the access path corresponding to the access content identifier;

[0020] The content corresponding to the access content identifier is searched according to the access path, and the searched content is returned to the subject.

[0021] Optionally, the method further includes: when the access permission is not allowed access, sending a reminder of not allowed access to the subject.

[0022] Optionally, when the access permission is allowed, the method further comprises: determining whether the subject has permission to access the access content;

[0023] When the access right is granted, executing the query of the access path corresponding to the access content identifier;

[0024] When the subject does not have the access right, a reminder of the access right not having access to the content is sent to the subject.

[0025] Optionally, when the access permission is allowed, the method further includes:

[0026] Sending a password input instruction to the subject, so that the subject enters a password after receiving the password input instruction;

[0027] When the password is correct, the access content is queried and returned to the subject.

[0028] In a second aspect, the present application provides a server, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of any one of the methods described in the first aspect above.

[0029] In a third aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any one of the methods described in the first aspect.

[0030] In a fourth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of any one of the methods in the first aspect.

[0031] According to the specific embodiments provided in this application, this application discloses the following technical effects:

[0032] The present application provides a method, server, medium and product for determining cross-domain access rights. The method is that after an object receives an original access request sent by a subject in a different security domain from the object, it obtains the subject identification carried in the original access request; the object then determines the access rights of the subject according to the subject identification, and only allows the subject with the access right to access the object, thereby prohibiting the subject without the access right from accessing the object, thereby reducing the restrictions on Internet data interaction while ensuring the security of the object and the security of the Internet environment; with respect to the prior art, when an object receives an access request from a subject in a security domain different from the object, the object directly rejects the access request, which ensures the security of the Internet but limits the data interaction on the Internet; the present application allows the subject with the access right to access the object on the premise of ensuring the security of the Internet, thereby facilitating the subject's access to the object, reducing the restrictions on Internet data interaction, and improving the convenience and flexibility of Internet data access. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0035] Figure 1 This is an application environment diagram of a method for determining cross-domain access rights in one embodiment of the present application;

[0036] Figure 2 A flowchart of a method for determining cross-domain access rights provided in one embodiment of the present application;

[0037] Figure 3 A schematic diagram of a process for obtaining a subject identification provided in an embodiment of the present application;

[0038] Figure 4 A schematic diagram of a process for determining access rights provided in another embodiment of the present application;

[0039] Figure 5 A schematic diagram of a cross-domain access process provided by an embodiment of the present application;

[0040] Figure 6 A schematic diagram of a cross-domain access process provided by another embodiment of the present application;

[0041] Figure 7 A schematic diagram of a cross-domain access process provided in yet another embodiment of the present application.

[0042] Figure 8 A schematic diagram of a cross-domain access process provided in yet another embodiment of the present application.

[0043] Fig. 9 A schematic diagram of the structure of a server provided in one embodiment of the present application. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0045] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0046] The method for determining cross-domain access rights provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown, the application environment includes a first subject, a first server, a second subject and a second server.

[0047] The first server includes a first local server and a first cloud server. The first entity, the first local server and the first cloud server belong to a first security domain.

[0048] The second server includes a second local server and a second cloud server. The second entity, the second local server and the second cloud server belong to a second security domain. The first security domain and the second security domain are different security domains.

[0049] In the present application, the first subject sends an original access request to the server of the second security domain, and the second subject sends an original access request to the server of the first security domain.

[0050] Taking the example of the second subject sending an original access request to the first cloud server, when the first cloud server receives the original access request, it determines whether the second subject has the permission to access the first cloud server; when the second subject has the permission to access the first cloud server, the first cloud server can send the content that the second subject wants to access to the second subject.

[0051] The subject may be, but is not limited to, various desktop computers, laptops, smart phones, tablet computers, IoT devices and portable wearable devices. IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. The server may be implemented as an independent server or a server cluster consisting of multiple servers, or a cloud server.

[0052] In an exemplary embodiment, Figure 2 As shown, a method for determining cross-domain access rights is provided. The method is executed by a server, and can be specifically executed by a local server or a cloud server. In the embodiment of the present application, the method is applied to Figure 1 Taking the first cloud server or the second cloud server in the example as an example, the following steps 201 to 203 are included. Among them:

[0053] Step 201: receiving an original access request sent by a subject for requesting to access an object, wherein the subject and the object belong to different security domains, and the original access request carries a subject identifier.

[0054] The cross-domain and heterogeneous domains mentioned in this application can be understood as the subject and object belonging to different security domains.

[0055] The subject is the object that initiates the access request, which may be a user terminal, a terminal where a service is located, a terminal where a process is located, etc. Furthermore, the subject attributes include the subject's identity, role, position, ability, location, department, etc.

[0056] Among them, the object is the object accessed by the subject. The object is generally a server, which can be a local server or a cloud server, as long as the subject and the object are in different security domains. Furthermore, the server stores data, such as files, pictures, applications, etc. The purpose of the subject accessing the object is to access the data stored in the object. Object attributes are similar to subject attributes. Customer attributes include object identity, location, department, role, type, data structure, etc.

[0057] In addition, when the subject and the object are in the same security domain, the subject generally has the authority to access the object and can directly access the object.

[0058] The original access request is used to request access to an object, which is generally the recipient of the original access request, that is, the server. Figure 1 As shown, the subject sending the original access request can be the first subject or the second subject. If it is the first subject, the object receiving the access request is the second object; if it is the second subject, the object receiving the access request is the first object.

[0059] The subject identifier is used to enable the object to identify the subject for further operations.

[0060] Exemplarily, the original access request received by the object may be: querying for a picture with a picture identifier of 33.

[0061] Step 202: Obtain the subject identifier carried in the original access request.

[0062] Step 203: Determine the access rights of the subject based on the subject identifier, where the access rights include allowing access and not allowing access.

[0063] When each object receives an original access request, it will determine the subject's access rights. Only subjects with access rights can access the object to ensure the security of the subject.

[0064] The present application provides a method for determining cross-domain access rights through steps 201 to 203, wherein after an object receives an original access request sent by a subject in a different security domain from the object, the object obtains the subject identifier carried in the original access request; the object then determines the access rights of the subject based on the subject identifier, and only allows subjects with access rights that allow access to access the object, thereby prohibiting subjects without access rights from accessing the object, thereby reducing restrictions on Internet data interaction while ensuring the security of the object and the security of the Internet environment; with respect to the prior art, when an object receives an access request from a subject that is not in the same security domain as itself, the object directly rejects the access request, which ensures the security of the Internet but limits Internet data interaction; the present application allows subjects with access rights to access objects on the premise of ensuring Internet security, thereby facilitating the subject's access to the object, reducing restrictions on Internet data interaction, and improving the convenience and flexibility of Internet data access.

[0065] Alternatively, see Figure 3 In one embodiment of the present application, step 202 is implemented by the following steps 2021 and 2022:

[0066] Step 2021: convert the original access request into an attribute access request, wherein the attribute access request carries the subject identifier and can be recognized by the object.

[0067] Since different objects have different requirements on the format of access requests, after receiving the original access request, it is necessary to convert the original access request into an attribute access request that can be recognized by the object.

[0068] For example, still taking the above example, the converted attribute access request is: subject identifier: 11, access type identifier: 22, object identifier: 44. Of course, if the original access request also includes other attributes, the converted attribute access request also includes other attributes. For example, if the original access request also includes access time: 16:00 access object, the converted attribute access request also includes the access time.

[0069] Step 2022: extract the subject identifier from the attribute access request.

[0070] After being converted into an attribute access request, the object can recognize the access request and thus extract the subject's identifier from the access request.

[0071] Exemplarily, the extracted subject identifier is 11.

[0072] Alternatively, see Figure 4 , step 203 is implemented by the following method:

[0073] Step 2031: Obtain an access policy, wherein the access policy records the subject identifiers that can access the object.

[0074] The access policy is stored in advance in the memory of the object and is used to record the subject that can access the object. That is, the subject identifier recorded in the access policy indicates that the subject corresponding to the subject identifier can access the object, and the subject identifier not recorded in the access policy indicates that the subject corresponding to the subject identifier cannot access the object.

[0075] Furthermore, the access policy may be manually set or generated through other means, which will not be described in detail in this application.

[0076] Step 2032: When the subject identifier is stored in the access policy, determine that the access permission of the subject is allowed access.

[0077] Step 2033: When the subject identifier is not stored in the access policy, determine that the access permission of the subject is not allowed to access.

[0078] Optionally, in another embodiment of the present application, the original access request also carries an access content identifier, and the attribute access request obtained after the original access request is converted also includes the access content identifier. Figure 5 The method further comprises steps 204 and 205:

[0079] Step 204: When the access permission is to allow access, query the access path corresponding to the access content identifier.

[0080] It should be noted here that, after the access path is queried, the converted attribute access request also includes the access path, that is, the attribute access request includes the access content identifier and the access path.

[0081] The object stores the correspondence between the content identifier and the access path in advance, so that when the original access request includes the access content identifier, the object can determine an access path according to the access content identifier and query the desired content according to the access path.

[0082] Step 205: query the content corresponding to the access content identifier according to the access path, and return the queried content to the subject.

[0083] Alternatively, see Figure 6 In another embodiment of the present application, the method further includes step 206: when the access permission is not allowed, sending a reminder of not allowed access to the subject.

[0084] In this way, the subject can promptly know that it does not have the authority to access the object.

[0085] Optionally, in order to further improve the security of the object, when the subject has the right to access the object, it can be further verified whether the subject has the right to access the access content. Figure 7 The method further includes step 207: when the access permission is to allow access, determining whether the subject has the permission to access the access content.

[0086] If the subject has the access right, the step 205 is executed. If the subject does not have the access right, a reminder is sent to the subject that the subject does not have the access right to access the content.

[0087] Optionally, to further improve the security of the object, when the subject has the right to access the object or has the right to access the content, see Figure 8 , the method further comprises steps 208 and 209:

[0088] Step 208: Send a password input instruction to the subject, so that the subject inputs a password after receiving the password input instruction.

[0089] Step 209: When the password is correct, query the access content and return it to the subject.

[0090] In an exemplary embodiment, a server is provided. The server may be a server or a terminal. The internal structure diagram thereof may be as follows: Fig. 9 As shown. The server includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the server is used to provide computing and control capabilities. The memory of the server includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the server is used for relevant data of the method for determining cross-domain access rights. The input / output interface of the server is used to exchange information between the processor and an external device. The communication interface of the server is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for determining cross-domain access rights is implemented.

[0091] Those skilled in the art will understand that Fig. 9 The structure shown in the figure is only a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the server to which the solution of the present application is applied. The specific server may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0092] In an exemplary embodiment, a server is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0093] In an exemplary embodiment, a computer-readable storage medium is provided, storing a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0094] In an exemplary embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0095] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0096] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM may be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0097] The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. The non-relational database may include a distributed database based on blockchain, etc., but is not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but is not limited thereto.

[0098] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0099] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A method for determining cross-domain access rights, characterized in that: include: Receiving an original access request sent by a subject for requesting access to an object, the subject and the object belong to different security domains, and the original access request carries a subject identifier; Obtaining the subject identifier carried in the original access request; The access rights of the subject are determined based on the subject identification, where the access rights include allowing access and not allowing access.

2. The method for determining cross-domain access rights according to claim 1, characterized in that: The obtaining the subject identifier carried in the original access request includes: Converting the original access request into an attribute access request, where the attribute access request carries the subject identifier and can be identified by the object; The subject identifier is extracted from the attribute access request.

3. The method for determining cross-domain access rights according to claim 2, characterized in that: The determining the access rights of the subject based on the subject identifier includes: Obtaining an access policy, wherein the access policy records the subject identifiers that can access the object; When the subject identifier is stored in the access policy, determining that the access permission of the subject is to allow access; When the subject identifier is not stored in the access policy, it is determined that the access permission of the subject is not allowed to access.

4. The method for determining cross-domain access rights according to claim 2, characterized in that: The original access request also carries an access content identifier, and the attribute access request also carries an access content identifier. After determining the access rights of the subject based on the subject identifier, the method further includes: When the access permission is to allow access, querying the access path corresponding to the access content identifier; The content corresponding to the access content identifier is searched according to the access path, and the searched content is returned to the subject.

5. The method for determining cross-domain access rights according to claim 2, characterized in that: The method further includes: when the access permission is not allowed, sending an access-not-allowed reminder to the subject.

6. The method for determining cross-domain access rights according to claim 4, characterized in that: When the access permission is allowed, the method further includes: determining whether the subject has permission to access the access content; When the access right is granted, executing the query of the access path corresponding to the access content identifier; When the subject does not have the access right, a reminder of the access right not having access to the content is sent to the subject.

7. The method for determining cross-domain access rights according to any one of claims 1 to 6, characterized in that: When the access permission is allowed, the method further includes: Sending a password input instruction to the subject, so that the subject enters a password after receiving the password input instruction; When the password is correct, the access content is queried and returned to the subject.

8. A server, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method for determining cross-domain access rights according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for determining cross-domain access rights described in any one of claims 1 to 7 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method for determining cross-domain access rights described in any one of claims 1 to 7 is implemented.

Images