High-security AD domain storage management method and system for cloud desktop

Abstract

The invention provides a high-security AD domain storage management method and system for a cloud desktop, and belongs to the technical field of cloud desktops. The method comprises the following steps: upgrading an AD domain storage management system by taking a user as a center; collecting storage requirements and behavioral habits of a user, and matching permission configuration of the user in the AD domain storage management system according to a collection result; the AD domain storage management system provides corresponding services according to the permission configuration of the user; and optimizing a data storage structure in the AD domain storage management system by monitoring data and user behaviors in real time. The AD domain storage management system is upgraded with the user as the center, fine-grained authority management can be achieved, safety and flexibility of AD domain service are improved, meanwhile, a data storage structure can be optimized, and storage space can be released.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud desktops, and in particular to a high-security AD domain storage management method and system for cloud desktops. Background Art

[0002] As a desktop delivery model based on cloud computing, cloud desktop provides users with remote office and virtualized desktop experience by running PCs in the cloud. In this model, AD domain is usually used to implement identity authentication and domain access rights management. It can flexibly deploy multiple application system images according to the user's application scenario requirements, thereby delivering a diverse desktop environment.

[0003] The existing management strategy is to bind AD users and cloud desktops to achieve unified allocation and management of user access rights, and use AD to mount storage services to enhance centralized data management and access control. Under this management model, different users can share a unified set of permissions when accessing the same cloud desktop, which not only simplifies the complexity of permission management, but also greatly improves the efficiency of collaboration between team members.

[0004] However, the existing AD domain storage management methods also have some potential security and management issues, such as excessive concentration of permissions leading to increased risk of data leakage or abuse, lack of flexibility in permissions to meet the specific needs of different users or user groups, the growth in the number of users and needs leading to the difficulty of managing a unified set of permissions and a corresponding increase in the amount of data stored, and the high dependence of the cloud desktop environment leading to the risk of single point failure.

[0005] The inventors of the present invention have found that the above technology has at least the following technical problems:

[0006] The existing AD domain storage management strategy has the problems of low security, poor flexibility and difficulty in releasing storage space. Summary of the invention

[0007] The purpose of the present invention is to overcome the defects of the prior art and provide a high-security AD domain storage management method and system for cloud desktops to solve the problems of low security, poor flexibility and difficulty in releasing storage space in the AD domain storage management strategy in the prior art.

[0008] In order to achieve the above objectives and other objectives, the present invention is implemented by including the following technical solutions: As a first aspect, the present invention proposes a high-security AD domain storage management method for a cloud desktop, comprising the steps of:

[0009] Upgrade the AD domain storage management system with user as the center;

[0010] Collecting the user's storage requirements and behavior habits, and matching the user's permission configuration in the AD domain storage management system according to the collected results;

[0011] The AD domain storage management system provides corresponding services according to the authority configuration of the user;

[0012] By real-time monitoring of data and user behavior, the data storage structure in the AD domain storage management system is optimized.

[0013] In one embodiment, the AD domain storage management system includes an AD domain control module, including an AD and cloud desktop binding management mode and an AD and user binding management mode; a storage service module, used for data storage and retrieval services to ensure data security and accessibility; a desktop mounting module, used to dynamically mount the corresponding storage space according to the user's identity and permissions; a storage system module, which interacts with the AD domain control module, the storage service module and the desktop mounting module respectively to provide actual storage space.

[0014] In one embodiment, the storage system module includes a plurality of virtualized physical storage devices managed in parallel.

[0015] In one embodiment, the "collecting the user's storage needs and behavioral habits, and matching the user's permission configuration in the AD domain storage management system based on the collection results" specifically means that AI collects the user's storage needs and behavioral habits, and matches the user's permission configuration in the AD domain control module based on the collection results.

[0016] In one embodiment, the permission configuration process of the AD and user binding management mode includes the steps of:

[0017] In the cloud desktop environment, a parent-child account structure is adopted, and each child account is assigned an independent AD domain identity;

[0018] The administrator configures fine-grained access rights for each AD domain identity;

[0019] The administrator sets a storage permission quota for each of the AD domain identities.

[0020] In one embodiment, the fine-grained access rights refer to accurately defining and limiting the user's access rights to the virtualized physical storage device according to the user's role, task, and needs.

[0021] In one embodiment, the “optimizing the data storage structure in the AD domain storage management system by real-time monitoring of data and user behavior” comprises the following steps:

[0022] In the AD and user binding mode, the user accessing or operating the stored data is located by real-time querying the stored data on different cloud desktops; at the same time, a comparison is performed in the AD and cloud desktop binding mode to confirm whether the same stored data exists in the two storage modes. If so, the same data is marked and a call link is generated;

[0023] In the AD and user binding mode, user behavior is analyzed based on changes in the stored data; outdated or useless data is identified and cleaned up by continuously monitoring changes in data usage.

[0024] As a second aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements any of the methods described in the first aspect.

[0025] One or more technical solutions provided in the embodiments of the present invention have at least the following technical effects or advantages:

[0026] The present invention upgrades the original AD domain storage management system with users as the center, forms an AD domain storage management system in which AD and cloud desktop binding management mode and AD and user binding management mode coexist, and can provide personalized storage solutions according to users' storage needs and behavior habits, especially in the AD and user binding management mode, fine-grained permission management can be achieved to improve the security and flexibility of AD domain services. In addition, by real-time monitoring of data and user behavior, data storage strategies can be adjusted in time, and outdated or no longer needed data can be identified and removed to free up storage space and optimize data storage structure. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 Shown is a flow chart of a high-security AD domain storage management method for a cloud desktop of the present invention.

[0028] Figure 2 Shown is a schematic diagram of the architecture of the AD domain storage management system in the present invention.

[0029] Figure 3 Shown is a schematic diagram of the management method of the AD and cloud desktop binding management mode in the present invention.

[0030] Figure 4 Shown is a schematic diagram of the management method of the AD and user binding management mode in the present invention.

[0031] Figure 5 Shown is a schematic diagram of the reverse management method in the present invention. DETAILED DESCRIPTION

[0032] The embodiments of the present invention provide a high-security AD domain storage management method and system for a cloud desktop, thereby solving the problems of low security, poor flexibility, and difficulty in releasing storage space in existing AD domain storage management strategies.

[0033] Below, the technical solutions in the embodiments of the present invention will be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments of the present invention. It should be understood that the present invention is not limited to the example embodiments described herein. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. It should also be noted that, for the convenience of description, only the parts related to the present invention are shown in the accompanying drawings, rather than all of them.

[0034] The overall idea of ​​the technical solution provided by the present invention is as follows: a high-security AD domain storage management method for cloud desktops, the method comprising:

[0035] Upgrade the AD domain storage management system with user as the center;

[0036] Collecting the user's storage requirements and behavior habits, and matching the user's permission configuration in the AD domain storage management system according to the collected results;

[0037] The AD domain storage management system provides corresponding services according to the authority configuration of the user;

[0038] By real-time monitoring of data and user behavior, the data storage structure in the AD domain storage management system is optimized.

[0039] The main idea is: by upgrading the original AD domain storage management system with users as the center, adding AD and user binding management mode to the original AD and cloud desktop binding management mode, it can provide personalized storage solutions according to users' storage needs and behavior habits, especially in the AD and user binding management mode, it can realize fine-grained permission management and improve the security and flexibility of AD domain services. In addition, the two storage management modes are managed in a unified way, and the data storage strategy can be adjusted in time through real-time monitoring of data and user behavior, and outdated or no longer needed data can be identified and removed to free up storage space and optimize the data storage structure.

[0040] After introducing the basic principles of the present invention, various non-limiting implementation methods of the present invention will be specifically described below in conjunction with the accompanying drawings.

[0041] Embodiment 1

[0042] like Figure 1 As shown, this embodiment provides a high-security AD domain storage management method for a cloud desktop, including the steps of:

[0043] S1. Upgrade the AD domain storage management system with user as the center;

[0044] Specifically, Figure 2 The figure is a schematic diagram of the architecture of the upgraded AD domain storage management system with user-centricity. The system includes four modules, namely AD domain control module, storage service module, desktop mounting module and storage system module. The following is a definition or introduction of the four modules:

[0045] The AD domain control module is the user authentication and permission management center of the system. The core of the user-centered upgrade of the AD domain storage management system is to inherit the original AD domain control module, upgrade the AD domain control module with the user as the center, and form two parallel management modes in the AD domain control module. Among them, the first management mode is the original AD and cloud desktop binding management mode. This mode focuses on the centralized management of cloud desktop resources, ensuring the consistency and security of access control. It is mainly suitable for scenarios that require strict control of user environment and application access, such as corporate standard working environments or regulated industries. The second management mode is a user-centered AD and user binding management mode. This mode focuses on providing customized access permission settings and flexible permission allocation for users based on their specific roles, responsibilities, work content and business needs. It is mainly suitable for scenarios that require highly personalized access and dynamic permission adjustment, such as R&D teams or creative studios.

[0046] The storage service module is used for data storage and retrieval services to ensure data security and accessibility;

[0047] The desktop mounting module is used to dynamically mount the corresponding storage space according to the user's identity and authority;

[0048] The storage system module interacts with the AD domain control module, storage service module and desktop mounting module respectively to provide actual storage space.

[0049] In this embodiment, the original storage system module is also upgraded. Specifically, the original AD domain control module only includes one AD and cloud desktop binding management mode. Figure 3 In the AD and cloud desktop binding management mode, different sub-users can access different cloud desktops according to their permissions, and the storage space they can access must be mounted to the cloud desktop through the AD corresponding to the cloud desktop. Therefore, the storage system module usually stores all data directly without splitting. The upgraded AD domain control module has added an AD and user binding management mode. Figure 4In the AD and user binding management mode, different sub-users can directly access the corresponding storage space and / or cloud desktop according to the size of the permissions corresponding to their identities. Therefore, in order to increase the number of parallel storage resources and improve storage efficiency and flexibility, multiple physical storage devices can be virtualized in the storage system module to achieve parallel management of storage data. For example, one user is configured with a virtualized physical storage device. At the same time, since the AD domain control module has two modes, in order to facilitate management, you can also configure a virtualized physical storage device for each management mode first, and then configure a virtualized physical storage device for each user or desktop in the management mode. In addition, when the same user has multiple tasks, you can also configure a virtualized physical storage device for each task. Specifically, the number and classification of virtualized physical storage devices can be customized according to user needs.

[0050] After the upgrade of the above AD domain control module and storage system module, the AD domain storage management system can flexibly select and implement different storage management strategies according to the actual application scenarios to adapt to different business needs and security requirements.

[0051] S2. Collect the user's storage requirements and behavior habits, and match the user's permission configuration in the AD domain storage management system according to the collected results;

[0052] Specifically, by collecting and analyzing historical data, building and training models, and generating AI, the system can automatically match user permission configurations based on their storage needs and behavioral habits to provide personalized storage solutions. It can also directly adjust the management mode that suits the user's needs based on the user's own choice.

[0053] S3, the AD domain storage management system provides corresponding services according to the user's authority configuration;

[0054] Among them, the permission configuration process of the AD and cloud desktop binding management mode inherits the original method; the permission configuration process of the AD and user binding management mode includes the following steps: first, in the cloud desktop environment, a parent-child account structure is adopted to assign an independent AD domain identity to each sub-account in the cloud desktop environment; then, based on the AD domain identity of each sub-account, the administrator configures fine-grained access rights for it to ensure that each user or user group can obtain the appropriate access level according to their role and needs, thereby optimizing data security and compliance; thirdly, a storage permission quota is set for each sub-account to ensure the flow controllability of storage resources to improve concurrent processing capabilities.

[0055] The parent-child account structure means that the parent account represents a department or team, and the child account represents the team members under the department. Each child account can have its own permissions and policies, but they are all managed and supervised by the parent account.

[0056] The fine-grained access rights refer to accurately defining and limiting the user's access rights to storage resources based on multiple factors such as the user's role, task, and needs. At the same time, the storage resources in the storage system module (such as databases, software plug-ins, computing power, etc.) are divided and access controlled in a detailed and specific manner.

[0057] S4. Optimize the data storage structure in the AD domain storage management system by real-time monitoring of data and user behavior.

[0058] Among them, the AD and user binding management mode and the AD and cloud desktop binding management mode are uniformly reverse managed to meet the needs of data iteration and business changes.

[0059] like Figure 5 As shown, the reverse management refers to tracking user behavior in reverse according to data changes to identify and clean up outdated or useless data. Specifically, the reverse management includes the following steps:

[0060] S41, in the AD and user binding mode, by real-time querying the storage data on different cloud desktops, quickly locate the sub-user AD that accesses or operates these storage data; at the same time, in the AD and cloud desktop binding mode, compare to confirm whether there is the same storage data in the two storage modes, if so, mark the same data and generate a call link;

[0061] Due to the limitations of the AD and cloud desktop binding mode, it is impossible to locate users directly based on desktop usage. However, by associating the same data in the two modes, deleting the same data in one management mode and generating a link to call the data in the other management mode, storage space can be freed up and the data storage structure can be optimized.

[0062] S42, in the AD and user binding mode, analyzing the behavior pattern of the relevant user according to the change of the stored data;

[0063] The change of the stored data refers to the access volume, access frequency, access interval, etc. of the stored data. When the access volume decreases, the access frequency decreases, or the access interval increases, it can be judged that the popularity of the data decreases, and the possibility of users using the stored data in the future decreases;

[0064] S43. By continuously monitoring changes in data usage and user behavior, timely identify and remove obsolete or no longer needed data to free up storage space and optimize data storage structure.

[0065] The AD domain storage management system can provide the monitored data changes and user behavior analysis to the user, allowing the user to adjust the data strategy in a timely manner and confirm whether the identified outdated or no longer needed data needs to be deleted, so as to clear unnecessary stored data in a timely manner when the storage space is limited.

[0066] Embodiment 2

[0067] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method of the first embodiment is implemented.

[0068] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention belong to the scope of the same technology of the present invention, the present invention is also intended to include these modifications and variations.

Claims

1. A high-security AD domain storage management method for cloud desktops, characterized in that: Includes steps: Upgrade the AD domain storage management system with user as the center; Collecting the user's storage requirements and behavior habits, and matching the user's permission configuration in the AD domain storage management system according to the collected results; The AD domain storage management system provides corresponding services according to the authority configuration of the user; By real-time monitoring of data and user behavior, the data storage structure in the AD domain storage management system is optimized.

2. The high-security AD domain storage management method for cloud desktop according to claim 1 is characterized in that: The AD domain storage management system includes AD domain control module, including AD and cloud desktop binding management mode and AD and user binding management mode; Storage service module, used for data storage and retrieval services, ensuring data security and accessibility; Desktop mounting module, used to dynamically mount corresponding storage space according to user's identity and permissions; The storage system module interacts with the AD domain control module, the storage service module and the desktop mounting module respectively to provide actual storage space.

3. The high-security AD domain storage management method for cloud desktop according to claim 2 is characterized in that: The storage system module includes a plurality of virtualized physical storage devices managed in parallel.

4. The high-security AD domain storage management method for cloud desktop according to claim 2 is characterized in that: The "collecting the user's storage needs and behavioral habits, and matching the user's permission configuration in the AD domain storage management system based on the collection results" specifically means that AI collects the user's storage needs and behavioral habits, and matches the user's permission configuration in the AD domain control module based on the collection results.

5. The high-security AD domain storage management method for cloud desktop according to claim 2 is characterized in that: The permission configuration process of the AD and user binding management mode includes the steps In the cloud desktop environment, a parent-child account structure is adopted, and each child account is assigned an independent AD domain identity; The administrator configures fine-grained access rights for each AD domain identity; The administrator sets a storage permission quota for each of the AD domain identities.

6. The high-security AD domain storage management method for cloud desktop according to claim 5 is characterized in that: The fine-grained access rights refer to accurately defining and limiting the user's access rights to the virtualized physical storage device according to the user's role, task and needs.

7. The high-security AD domain storage management method for cloud desktop according to claim 3 is characterized in that: The “optimizing the data storage structure in the AD domain storage management system by real-time monitoring of data and user behavior” includes the following steps: In the AD and user binding mode, the user accessing or operating the stored data is located by real-time querying the stored data on different cloud desktops; at the same time, a comparison is performed in the AD and cloud desktop binding mode to confirm whether the same stored data exists in the two storage modes. If so, the same data is marked and a call link is generated; In the AD and user binding mode, analyzing user behavior according to changes in the stored data; Identify and clean up obsolete or useless data by continuously monitoring changes in data usage.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images