Method and device for evaluating identity permission risk of cloud service account

Abstract

The invention relates to a cloud service account identity permission risk assessment method and device. The method comprises the steps that original data of the identity authority of a to-be-evaluated account in a cloud service is acquired, the original data comprises data of the identity authority in multiple dimensions, and the multiple dimensions are divided according to identity authority operation performed by the to-be-evaluated account on the cloud service; the original data of the multiple dimensions are scored, and the score of each dimension is determined; and determining an identity permission risk score of the to-be-evaluated account according to the score of each dimension and the corresponding weight. The problems that in the prior art, due to the fact that an account identity system is complex, account identity authority management difficulty is high, security vulnerabilities are likely to be caused, and risks are high are solved.

Description

Technical Field

[0001] The present application relates to the field of cloud service technology, and in particular to a method and device for assessing identity authority risks of a cloud service account. Background Art

[0002] After enterprises move to the cloud, the complexity of the user identity system on the cloud has increased significantly. In addition to the roles of the operation and maintenance team, the system development team, security and compliance team, financial management team, and other roles also need to participate in the management and use of the cloud. Account security and reasonable resource authorization are the first door locks to build a three-dimensional protection system on the cloud.

[0003] The product capabilities provided by cloud vendors in related technologies mainly provide users with usage data related to cloud identity credentials and passwords, and display usage reports. However, there is a lack of attention to core issues in the governance field, such as account security settings, standardized use of credentials, and refined management of permissions. Due to the complexity of the account identity system, there are still problems such as high difficulty in managing account identity permissions, which is prone to security vulnerabilities and high risks. Summary of the invention

[0004] The embodiment of the present invention provides a method and device for assessing the identity and authority risks of a cloud service account, which at least solves the problem that the related art has a complex account identity system, high difficulty in managing account identity and authority, and is prone to security vulnerabilities and high risks.

[0005] An embodiment of the present invention provides a method for assessing the identity authority risk of a cloud service account, comprising: obtaining original data of the identity authority of an account to be assessed in a cloud service, wherein the original data includes data of the identity authority in multiple dimensions, and the multiple dimensions are divided according to the identity authority operations performed by the account to be assessed on the cloud service; scoring the original data of the multiple dimensions respectively to determine the score of each dimension; and determining the identity authority risk score of the account to be assessed according to the score of each dimension and the corresponding weight.

[0006] The beneficial effects of the embodiments of the present invention are as follows: by obtaining the original data of the identity authority of the account to be evaluated in the cloud service in multiple dimensions, scoring them respectively, and calculating the identity authority risk score of the account to be evaluated according to the weight of the dimension, the level of the identity authority risk of the account to be evaluated is determined. Compared with the related technology that only provides the usage data related to the identity credentials and passwords on the cloud, the identity authority risk is determined more accurately and precisely, the difficulty of identity authority management is reduced, and the problem of high risk of security vulnerabilities is avoided.

[0007] As an optional embodiment, obtaining the original data of the identity authority of the account to be evaluated in the cloud service includes: collecting the original data of each dimension according to the collection module created on the cloud service, wherein the collection module is used to collect the original data of the corresponding dimension, and each collection module collects the original data of at least one dimension; obtaining the original data of multiple dimensions collected by the collection module.

[0008] By deploying the collection module on the cloud service to collect raw data of various dimensions, the raw data can be collected more accurately and effectively.

[0009] As an optional embodiment, the original data of multiple dimensions are scored respectively, and determining the score of each dimension includes: determining the score of the original data according to the scoring rules corresponding to each item of original data, wherein each dimension includes at least one item of original data; and calculating the score of the corresponding dimension according to the weight and score of each item of original data.

[0010] According to the scoring rules of each item of raw data in the dimension, the score of the raw data is calculated, and then the score of the dimension is calculated using the weight of each item of raw data. In this way, the risk score of the dimension can be represented by multiple pieces of raw data, which is more comprehensive and accurate.

[0011] As an optional embodiment, determining the score of the original data according to the scoring rule corresponding to each item of original data includes: obtaining the scoring rule corresponding to the original data, wherein each item of original data corresponds to a scoring rule; calculating the parameters of the original data according to the scoring rule to determine the score of the original data, wherein each item of original data includes at least one parameter.

[0012] The specific content of the original data of different items is different, and the corresponding scoring rules are also different. The corresponding scoring rules are used to calculate the parameters of the original data to obtain the scores of the original data, thereby accurately determining the scores of each item of original data.

[0013] As an optional embodiment, determining the identity authority risk score of the account to be evaluated according to the scores and corresponding weights of each dimension includes: determining the weights of each dimension; and calculating the identity authority risk score of the account to be evaluated by weighted summation according to the scores and weights of each dimension.

[0014] According to the scores and weights of multiple dimensions, the identity and permission risk score of the account to be evaluated is calculated by weighted summation, so that the identity and permission risk score of the account to be evaluated can be represented by the original data of multiple dimensions, which is more comprehensive and accurate.

[0015] As an optional embodiment, after determining the identity authority risk score of the account to be evaluated based on the scores of each dimension and the corresponding weights, the method also includes: determining the risk level to which the identity authority risk score belongs, wherein the risk level is a plurality of levels pre-divided according to the value range of the identity authority risk score; and displaying the identity authority risk score and the risk level according to the display method corresponding to the risk level.

[0016] Determine the corresponding risk level based on the identity permission risk score, and display the identity permission risk score and risk level according to the display method corresponding to the risk level, so as to more effectively show the risk level of identity permissions to users.

[0017] As an optional embodiment, displaying the identity authority risk score and the risk level according to the display method corresponding to the risk level includes: displaying the identity authority risk score and the risk level according to the display method corresponding to the risk level, and hiding the scores of each dimension in a display control; when the display control is triggered, displaying the scores of each dimension through a display window.

[0018] Different risk levels are displayed in different ways to help users intuitively understand the degree of risk. The scores of each dimension are displayed through display controls, which allows users to understand the detailed details of the risk so that they can make improvements and reduce risks.

[0019] As an optional embodiment, the method further includes: determining a risk governance method based on the identity authority risk score and risk level, wherein the risk governance method includes at least one original data governance method; and displaying the risk governance method.

[0020] Based on the identity authority risk score and risk level, the corresponding risk governance method can be determined and displayed to guide users in risk governance.

[0021] As an optional embodiment, after determining the identity and authority risk score of the account to be evaluated based on the scores of each dimension and the corresponding weights, the method also includes: sending the identity and authority risk score to a cloud governance model, wherein the cloud governance model is used to evaluate the resource governance maturity of the cloud service based on multiple types of scores, and the multiple types of scores include the identity and authority risk score.

[0022] The identity and permission risk scores obtained can also be used for cloud governance. By combining multiple types of scores, the resource governance maturity of cloud services can be evaluated and support can be provided for the management of cloud services.

[0023] As an optional embodiment, the multiple dimensions include at least one of the following: a credential management dimension, an account management dimension, and a permission management dimension.

[0024] By calculating identity and permission risk scores from multiple dimensions such as credential management, account management, and permission management, we can more comprehensively and accurately determine the identity and permission risks of the accounts to be assessed.

[0025] An embodiment of the present invention also provides an assessment device for the identity authority risk of a cloud service account, comprising: an acquisition module, used to obtain original data of the identity authority of the account to be assessed in the cloud service, wherein the original data includes data of the identity authority in multiple dimensions, and the multiple dimensions are divided according to the identity authority operations performed by the account to be assessed on the cloud service; a scoring module, used to score the original data of multiple dimensions respectively to determine the score of each dimension; and a determination module, used to determine the identity authority risk score of the account to be assessed based on the score of each dimension and the corresponding weight.

[0026] The beneficial effects of the embodiments of the present invention are as follows: by obtaining the original data of the identity authority of the account to be evaluated in the cloud service in multiple dimensions, scoring them respectively, and calculating the identity authority risk score of the account to be evaluated according to the weight of the dimension, the level of the identity authority risk of the account to be evaluated is determined. Compared with the related technology that only provides the usage data related to the identity credentials and passwords on the cloud, the identity authority risk is determined more accurately and precisely, the difficulty of identity authority management is reduced, and the problem of high risk of security vulnerabilities is avoided.

[0027] An embodiment of the present invention further provides an electronic device, comprising: a processor, and a memory storing a program, wherein the program comprises instructions, and when the instructions are executed by the processor, the processor executes any one of the methods described above.

[0028] An embodiment of the present invention further provides a non-transitory machine-readable medium storing computer instructions, wherein the computer instructions are used to enable the computer to execute any one of the methods described above.

[0029] An embodiment of the present invention further provides a cloud service system, which is used to perform cloud storage and cloud processing on data, wherein the cloud processing executes any one of the methods described above.

[0030] The details of one or more embodiments of the invention are set forth in the following drawings and description so that other features, objects, and advantages of the invention are more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other embodiments can be obtained based on these drawings without creative work.

[0032] Figure 1 It is a flow chart of a method for assessing identity authority risk of a cloud service account according to an embodiment of the present invention.

[0033] Figure 2 It is a flowchart of another method for assessing identity authority risk of a cloud service account according to an embodiment of the present invention.

[0034] Figure 3 It is a flowchart of another method for assessing identity authority risk of a cloud service account according to an embodiment of the present invention.

[0035] Figure 4 It is a flowchart of another method for assessing identity authority risk of a cloud service account according to an embodiment of the present invention.

[0036] Figure 5 It is a schematic diagram of a device for assessing identity authority risk of a cloud service account according to an embodiment of the present invention.

[0037] Figure 6 It is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0038] Embodiments of the present embodiment will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present embodiment are shown in the accompanying drawings, it should be understood that the present embodiment can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein, which are instead provided for a more thorough and complete understanding of the present embodiment. It should be understood that the drawings and embodiments of the present embodiment are only for exemplary purposes and are not intended to limit the scope of protection of the present embodiment.

[0039] In the process of information automation production and office work, enterprises use IT (information technology) governance to rationally utilize IT resources and properly manage IT-related risks. "IT governance" plays a key role in the digital transformation of enterprises. As a key technology of the digital economy, cloud computing is helping more and more enterprises build efficient and automated management mechanisms and infrastructure environments in the process of informatization construction and digital transformation of domestic and foreign enterprises.

[0040] However, due to the technical characteristics of cloud computing such as "elasticity, real-time delivery, and decentralization", it has also brought new management problems and potential risks to the enterprise's IT governance field. For example, after the enterprise goes to the cloud, the complexity of the user identity system on the cloud is significantly improved. In addition to the roles of the operation and maintenance team, the system development team, security and compliance team, financial management team and other roles must also participate in the management and use of the cloud.

[0041] Account security and reasonable resource authorization are the first locks in building a three-dimensional cloud protection system. How to ensure the security of account and credential usage and refined permission management and control for the complex cloud identity system has become an issue that enterprises need to consider urgently.

[0042] Currently, all industries have accelerated the process of moving data to the cloud, and at the same time, new requirements have been put forward for enterprises to use and manage the cloud, hoping to solve the problem of balancing "risk" and "control" and to solve the problems of inefficiency and uncontrollable hidden dangers of manual processing. However, there are no similar solutions for related technologies. For the governance of cloud identities and permissions, most of them refer to traditional security compliance standards and principles, and no solutions that fit the characteristics of cloud computing itself have been proposed, nor have corresponding tool capabilities been provided.

[0043] The product capabilities provided by other cloud vendors mainly provide users with usage data related to cloud identity credentials and passwords, and display usage reports. However, they lack attention to core issues in the governance field, such as account security settings, standardized use of credentials, and refined management of permissions. Due to the complexity of the account identity system, there are still problems such as high difficulty in managing account identity permissions, which is prone to security vulnerabilities and high risks.

[0044] In order to solve the problem in the related art that due to the complexity of the account identity system, the account identity authority management is still difficult, which is easy to cause security vulnerabilities and has high risks, the embodiment of the present invention provides a method for assessing the identity authority risk of a cloud service account. An assessment method and evaluation system for the identity authority risk of users on the cloud are provided. Through the risk assessment of the identity authority on the cloud, IT assets on the cloud can be used at low cost, low risk and high efficiency, solving the pain points of risk, reducing costs and improving efficiency.

[0045] From the perspective of security compliance and risk control, a complete risk assessment strategy is provided, relevant assessment models are established, and a unified governance solution is given, so that users' identity and authority security can be identified and governed when using and managing the cloud, and maintained at a healthy level.

[0046] Figure 1 is a flow chart of a method for assessing identity and authority risks of a cloud service account according to an embodiment of the present invention. Figure 1 As shown, a method for assessing identity authority risk of a cloud service account provided by an embodiment of the present invention includes the following steps:

[0047] Step S101, obtaining original data of identity authority of the account to be evaluated in the cloud service, wherein the original data includes data of identity authority in multiple dimensions, and the multiple dimensions are divided according to the identity authority operations performed by the account to be evaluated on the cloud service;

[0048] Step S102, scoring the original data of multiple dimensions respectively to determine the score of each dimension;

[0049] Step S103, determining the identity authority risk score of the account to be evaluated based on the scores of each dimension and the corresponding weights.

[0050] The method for assessing the identity and authority risk of the cloud service account provided in the embodiment of the present invention obtains the original data of the identity and authority of the account to be assessed in the cloud service in multiple dimensions, scores them respectively, and calculates the identity and authority risk score of the account to be assessed according to the weight of the dimension, so as to determine the level of the identity and authority risk of the account to be assessed. Compared with the related technology that only provides the usage data related to the identity credentials and passwords on the cloud, it determines the identity and authority risk more accurately and precisely, reduces the difficulty of identity and authority management, and thus avoids the problem of high risk that easily causes security vulnerabilities.

[0051] The above cloud services can use cloud servers to provide relevant cloud services for accounts. Accounts usually have different identity permissions in cloud services, including access rights to some data, service permissions, operation permissions, etc. The original data of the above identity permissions can be understood as data related to identity permissions, mainly including data that needs to be operated with corresponding identity permissions, that is, data for operations linked to identity permissions.

[0052] Identity authority operations can include the use of identity authority, the authorization of identity authority, the management of identity authority, etc. Identity authority can also be divided into the use of credentials, passwords, accounts, permissions, etc. The original data of the account to be evaluated can be divided into multiple dimensions according to the identity authority operations.

[0053] For example, the original data can be divided into credential management dimension, account management dimension, permission management dimension, etc. according to identity permission operations. The details are as follows:

[0054] The credential management dimension mainly includes the usage behaviors and data related to user credentials. Specifically, it can include the following raw data: password management, MFA (Multi-Factor Authentication) management, and AK (Access Key) management. The credential management dimension can measure the user's management of the security of passwords and access credentials for cloud accounts, and can also include raw data such as password strength rules, MFA usage ratio, and regular rotation of permanent access credentials.

[0055] The account management dimension mainly includes the use of the main and sub-accounts by the cloud account. Specifically, it can include the following raw data: user management, identity authentication management, and identity audit management. The credential management dimension can measure the user's account management level for the cloud account, and can also include raw data such as whether the user has a large number of idle sub-users, the proportion of logins through the main account, and the proportion of logins using SSO (Single Sign On).

[0056] The permission management dimension mainly includes the use of various user permissions. Specifically, it can include the following raw data: permission abuse, fine-grained authorization, and authorization efficiency. The permission management dimension can measure the user's permission configuration and use of cloud accounts. It can also include raw data such as the number of identities authorized to the super administrator Admin permissions and the authorization with restrictions.

[0057] In addition to the above three dimensions, other dimensions can be added based on the use of identity permissions to measure other management data of users in identity permissions, and to examine the management of user identity permissions.

[0058] The original data can be counted and collected by the cloud service for the identity authority management function module of the account to be evaluated. In this embodiment, the original data can be collected by the collection module created on the cloud service.

[0059] As an optional embodiment, obtaining the original data of the identity authority of the account to be evaluated in the cloud service includes: collecting the original data of each dimension according to the collection module created on the cloud service, wherein the collection module is used to collect the original data of the corresponding dimension, and each collection module collects the original data of at least one dimension; obtaining the original data of multiple dimensions collected by the collection module.

[0060] By deploying the collection module on the cloud service to collect raw data of various dimensions, the raw data can be collected more accurately and effectively.

[0061] There may be multiple collection modules, each collecting raw data of multiple dimensions. For example, it may include a credential management module, an account management module, and a permission management module. The credential management module is used to collect raw data of the credential management dimension, the account management module is used to collect raw data of the account management dimension, and the permission management module is used to collect raw data of the permission management dimension. Other modules may also be set to meet the needs of dimensional expansion.

[0062] The multiple acquisition modules can all be functional modules, which can be a whole in practice, or can be a combination of functions abstracted from various actual implementation modules. At the same time, the collected original data can be part, all, or further expanded.

[0063] Each collection module collects raw data of at least one dimension. As mentioned above, the credential management module, the account management module, and the permission management module can collect raw data of corresponding individual dimensions. Another module for expansion can also be set up, and the other module can collect raw data of multiple dimensions of expansion.

[0064] The collection of raw data may include using a calculation formula to perform calculations on the directly collected data. For example, in the credential management dimension, a raw data item may include that the user currently has 100 permanent access credentials on the cloud, that is, the total number of permanent access credentials is 100; the number of idle and unused credentials is 50. The idle credential ratio of the user is 0.5. The raw data may include the total number of permanent access credentials, the limit on the number of unused credentials, and the limit on the credential ratio.

[0065] After collecting the raw data of multiple dimensions, the raw data of multiple dimensions are scored respectively to determine the scores of each dimension. Each dimension can correspond to multiple raw data, each of which can be scored separately, and then the scores of multiple raw data set in the dimension are summarized to obtain the score corresponding to the dimension.

[0066] After the scores of multiple dimensions are determined, the identity and permission risk score of the account to be evaluated is determined based on the scores of each dimension and the corresponding weights. The weights of the above dimensions can be preset weights or adjusted according to needs. The weights of the dimensions can be empirical values ​​obtained through experiments.

[0067] Then, the identity authority risk score of the account to be assessed is determined through the original data of identity authority in multiple dimensions, so that users can control and manage identity authority, reduce identity authority risks, and avoid security vulnerabilities.

[0068] Compared with related technologies that only provide usage data related to cloud identity credentials and passwords, it can more accurately and finely determine identity permission risks, reduce the difficulty of identity permission management, and thus avoid problems that are prone to security vulnerabilities and higher risks.

[0069] Figure 2 FIG. 1 is a flow chart of another method for assessing identity and authority risks of a cloud service account according to an embodiment of the present invention. Figure 2 As shown, the embodiment of the present invention also provides another method for assessing the identity and authority risk of a cloud service account. Optionally, the method for assessing the identity and authority risk of a cloud service account provided by the embodiment of the present invention can be used in the method for assessing the identity and authority risk of a cloud service account provided by the above embodiment. As an optional embodiment, the original data of multiple dimensions are scored respectively, and the score of each dimension is determined to include:

[0070] Step S201, determining the score of the original data according to the scoring rule corresponding to each item of original data, wherein each dimension includes at least one item of original data;

[0071] Step S202, calculate the score of the corresponding dimension according to the weight and score of each original data.

[0072] The method for assessing the identity and authority risks of cloud service accounts provided in this embodiment calculates the score of each item of original data in the dimension according to the scoring rules of the original data, and then calculates the score of the dimension using the weights of each item of original data, thereby representing the risk score of the dimension through multiple pieces of original data, which is more comprehensive and accurate.

[0073] As described above, the raw data of each dimension may include multiple items. Each item of raw data is different and needs to be scored using different scoring rules to evaluate the score of the raw data.

[0074] The scoring rule may be only for one item of the original data, such as the idle voucher ratio mentioned above. The scoring rule may be a rule set in advance by humans, and the scoring rules for each item of original data in each dimension must be consistent in principle. For example, the higher the security, the higher the score.

[0075] Specifically, it can be calculated by the following formula.

[0076] O i =ω i (K j |1≤j≤m)

[0077] In the formula, O is the current dimension, and the score of each original data is O i , there are n items in total; each item of original data is K j , there are m parameters in total. iis the scoring rule function of the original data.

[0078] According to the weight and score of each original data, the score of the corresponding dimension can be calculated using the following formula.

[0079]

[0080] In the formula, S is the score of the dimension, λ i is the score weight of the original data.

[0081] Thus, the score of the dimension is calculated by scoring multiple pieces of original data, which more accurately reflects the risk of the dimension. In this embodiment, the higher the score, the better the risk management capability in this aspect.

[0082] Specifically, the score of the credential management dimension mainly measures the user's management level of security protection measures such as passwords and keys on the cloud, whether there is a risk of key leakage, etc. The score of the account management dimension mainly measures the user's management level of various identities on the cloud, including but not limited to the main account, sub-accounts, and roles. The score of the permission management dimension mainly measures the user's permission control level when using the cloud, whether authorization is abused, whether authorization is authorized at the minimum granularity, etc.

[0083] As an optional embodiment, determining the score of the original data according to the scoring rule corresponding to each item of original data includes: obtaining the scoring rule corresponding to the original data, wherein each item of original data corresponds to a scoring rule; calculating the parameters of the original data according to the scoring rule to determine the score of the original data, wherein each item of original data includes at least one parameter.

[0084] The specific content of the original data of different items is different, and the corresponding scoring rules are also different. The corresponding scoring rules are used to calculate the parameters of the original data to obtain the scores of the original data, thereby accurately determining the scores of each item of original data.

[0085] It should be noted that the scoring rules for raw data can be set manually. Raw data usually include at least one parameter. A scoring rule can be summarized based on the numerical value of the parameter and the empirical value of the risk.

[0086] The essence of the scoring rule is to calculate the numerical values ​​of the parameters in the original data to determine the score of the original data.

[0087] As an optional embodiment, determining the identity authority risk score of the account to be evaluated based on the scores and corresponding weights of each dimension includes: determining the weights of each dimension; and calculating the identity authority risk score of the account to be evaluated by weighted summation based on the scores and weights of each dimension.

[0088] According to the scores and weights of multiple dimensions, the identity and permission risk score of the account to be evaluated is calculated by weighted summation, so that the identity and permission risk score of the account to be evaluated can be represented by the original data of multiple dimensions, which is more comprehensive and accurate.

[0089] The identity and permission risk score of the account to be evaluated can be calculated by the following formula based on the scores and weights of each dimension through weighted summation.

[0090]

[0091] In the formula, the identity authority risk score is Q, S t is the score of the tth dimension, there are T dimensions in total, ρ t is the calculation weight of the tth dimension.

[0092] The following uses the above-mentioned credential management dimension as an example to illustrate.

[0093] In the credential management dimension, a certain raw data may include that the user currently has 100 permanent access credentials on the cloud, that is, the total number of permanent access credentials is 100, and the number of idle unused credentials is 50. The idle credential ratio of the user is 0.5, and the score of the raw data can be calculated according to the scoring rules, which is 100*0.5=50 points.

[0094] Assuming that the weight of the idle voucher situation dimension in the voucher management dimension is 0.2, and the total score of the original data of other items in the voucher management dimension is 70, the score of the voucher management dimension is 70+50*0.2=80 points.

[0095] Assuming that the weight of the credential management dimension in the user's identity authority risk score is 0.4, and the sum of the scores of other dimensions of identity authority is 45, the user's identity authority risk score is 45+80*0.4=77 points.

[0096] Figure 3 FIG. 1 is a flow chart of another method for assessing identity and authority risks of a cloud service account according to an embodiment of the present invention. Figure 3 As shown, the embodiment of the present invention also provides another method for assessing the identity and authority risk of a cloud service account. Optionally, the method for assessing the identity and authority risk of a cloud service account provided by the embodiment of the present invention can be used in the method for assessing the identity and authority risk of a cloud service account provided by the above embodiment. As an optional embodiment, after determining the identity and authority risk score of the account to be assessed based on the scores and corresponding weights of each dimension, the method further includes:

[0097] Step S301, determining the risk level to which the identity authority risk score belongs, wherein the risk level is a plurality of levels pre-divided according to the value range of the identity authority risk score;

[0098] Step S302: display the identity authority risk score and risk level according to the display method corresponding to the risk level.

[0099] The method for assessing the identity authority risk of a cloud service account in this embodiment determines the corresponding risk level according to the identity authority risk score, and displays the identity authority risk score and risk level according to the display method corresponding to the risk level, so as to more effectively display the risk level of the identity authority to the user.

[0100] After the identity permission risk score is determined, the risk level to which the identity permission risk score belongs can be displayed to the user, so that the user can intuitively understand the risk of the identity permission.

[0101] Different risk levels can be displayed in different ways. A higher risk level can be displayed in a more eye-catching way, including more eye-catching colors, more eye-catching display methods, and alarms. A lower risk level can be displayed in a softer way. This makes it easier for users to understand the risk levels of different risk levels.

[0102] As an optional embodiment, displaying the identity authority risk score and risk level according to the display method corresponding to the risk level includes: displaying the identity authority risk score and risk level according to the display method corresponding to the risk level, and hiding the scores of each dimension in a display control; when the display control is triggered, displaying the scores of each dimension through a display window.

[0103] Different risk levels are displayed in different ways, which makes it easier for users to intuitively understand the risk level. The scores of each dimension are displayed through display controls, which makes it easier for users to understand the details of the risk so that they can make improvements and reduce the risk. In addition, the determination of risk scores and risk levels can also be used to determine risk governance methods to reduce the risk of cloud systems in terms of identity permissions.

[0104] When displaying risk levels and identity permission risk scores, you can trigger display controls to display scores in multiple dimensions so that users can understand the specific details of the identity permission risk scores, thereby facilitating the identification of reasons for high risks and making governance countermeasures accordingly.

[0105] It should be noted that risk governance can be conducted independently, that is, risk governance of identity permissions can be conducted only for cloud systems according to user needs. It can also be displayed and governed together with other types of governance scores in the cloud governance model to improve the governance efficiency of the cloud system.

[0106] As an optional embodiment, the method also includes: determining a risk governance method based on the identity authority risk score and the risk level, wherein the risk governance method includes at least one governance method for original data; and displaying the risk governance method.

[0107] Based on the identity authority risk score and risk level, the corresponding risk governance method can be determined and displayed to guide users in risk governance.

[0108] It can also automatically generate risk management methods based on identity authority risk scores and risk levels, and display them to users so that they can quickly manage them and improve user experience.

[0109] Based on the identity authority risk score and risk level, a risk governance method is generated. The original data can be statistically determined by scoring, and the original data with lower scores can be identified. The cause of the risk can be judged to determine the corresponding risk governance method.

[0110] When determining the cause of the risk, it can be determined based on the rule design of the model and the original data of the user. In other embodiments, it can also be determined based on historical governance data. Specifically, the same or similar situations can be found in the historical governance data based on the original data with lower scores, and the risk cause in this situation can be obtained.

[0111] For some risks that have no historical governance experience, they can also be determined based on machine learning. Specifically, the machine learning model can be trained by including input risk data and output risk reasons as training data. The risk data can include the above-mentioned risk scores, risk levels, and original data with lower scores.

[0112] After the machine learning model is trained, the risk data such as the risk score, risk level, or original data with lower scores are input into the machine learning model, and the machine learning model directly outputs the corresponding risk cause. After the risk cause is determined, the risk governance method is determined according to its corresponding governance countermeasures.

[0113] Figure 4 FIG. 1 is a flow chart of another method for assessing identity and authority risks of a cloud service account according to an embodiment of the present invention. Figure 4 As shown, the embodiment of the present invention also provides another method for assessing the identity and authority risk of a cloud service account. Optionally, the method for assessing the identity and authority risk of a cloud service account provided by the embodiment of the present invention can be used in the method for assessing the identity and authority risk of a cloud service account provided by the above embodiment. As an optional embodiment, after determining the identity and authority risk score of the account to be assessed based on the scores and corresponding weights of each dimension, the method further includes:

[0114] Step S401, sending the identity permission risk score to the cloud governance model, wherein the cloud governance model is used to evaluate the resource governance maturity of the cloud service based on multiple types of scores, and the multiple types of scores include the identity permission risk score.

[0115] The identity and permission risk scores obtained can also be used for cloud governance. By combining multiple types of scores, the resource governance maturity of cloud services can be evaluated and support can be provided for the management of cloud services.

[0116] The above-mentioned multiple types of scores may include at least one of the following: a score for identity authority, a score for resource management, a score for user behavior, a score for cloud automation, etc.

[0117] By obtaining the original cloud governance data generated by the user's management of cloud resources, and based on the original cloud governance data, determining the user's cloud governance maturity, and presenting the cloud governance assessment results to the user; compared with the related technology's method of using traditional IT governance to conduct cloud governance assessment without considering the characteristics of cloud computing, this method can not only accurately assess the user's governance deficiencies and potential risks in the cloud governance process in real time, but also accurately measure the user's maturity in using the cloud, and improve the user's risk control ability in using the cloud.

[0118] For example, when the identity and permission management function of the cloud management center guides users to complete the management of idle credentials based on the model calculation results, assuming that the number of idle credentials of users is 0 after management, the current score of the idle credentials dimension of the user is 100.

[0119] The score of the credential management module is 70+100*0.2=90 points.

[0120] The total risk score of user identity and authority is 45+90*0.4=81 points. The total score is increased by 4 points.

[0121] It should be noted that the scores may not be limited to the percentage system, and similar scores may be easily extended to other modules in the identity and authority risk model.

[0122] At the same time, we can further assume that the total score of identity permission risk is 100 points, and the score level is classified as follows: more than 80 points are safe, more than 60 points are risky, and less than 60 points are high risk. According to the above classification criteria, the total score of user identity permission risk before governance is 77 points, indicating that the user's cloud identity permission level is at a risk level. After the governance is completed, it reaches 81 points, indicating that the user's identity permission risk level has entered a safe level.

[0123] As an optional embodiment, the multiple dimensions include at least one of the following: a credential management dimension, an account management dimension, and a permission management dimension.

[0124] By calculating identity and permission risk scores from multiple dimensions such as credential management, account management, and permission management, we can more comprehensively and accurately determine the identity and permission risks of the accounts to be assessed.

[0125] Figure 5 is a schematic diagram of an apparatus for assessing identity and authority risks of a cloud service account according to an embodiment of the present invention. Figure 5 As shown, based on the above-mentioned cloud service account identity authority risk assessment method provided by the embodiment of the present invention, the embodiment of the present invention also provides a cloud service account identity authority risk assessment device, which is used to execute the above-mentioned cloud service account identity authority risk assessment method, and the device includes: an acquisition module 51, a scoring module 52, and a determination module 53. The device is described in detail below.

[0126] An acquisition module 51 is used to acquire original data of the identity authority of the account to be evaluated in the cloud service, wherein the original data includes data of the identity authority in multiple dimensions, and the multiple dimensions are divided according to the identity authority operations performed by the account to be evaluated on the cloud service; a scoring module 52 is connected to the above-mentioned acquisition module 51, and is used to score the original data of multiple dimensions respectively to determine the score of each dimension; a determination module 53 is connected to the above-mentioned scoring module 52, and is used to determine the identity authority risk score of the account to be evaluated based on the score of each dimension and the corresponding weight.

[0127] The apparatus for assessing the identity and authority risk of the cloud service account provided in the embodiment of the present invention obtains the original data of the identity and authority of the account to be assessed in the cloud service in multiple dimensions, scores them respectively, and calculates the identity and authority risk score of the account to be assessed according to the weight of the dimensions to determine the level of the identity and authority risk of the account to be assessed. Compared with the related technology that only provides the usage data related to the identity credentials and passwords on the cloud, it determines the identity and authority risk more accurately and precisely, reduces the difficulty of identity and authority management, and thus avoids the problem of high risk that easily causes security vulnerabilities.

[0128] As an optional embodiment, it also includes: a collection module, which is deployed on the cloud service and is used to collect original data of each dimension for acquisition by the acquisition module, wherein the collection module is used to collect original data of corresponding dimensions, and each collection module collects original data of at least one dimension.

[0129] As an optional embodiment, the scoring module includes: a scoring unit, used to determine the score of the original data according to the scoring rules corresponding to each item of original data, wherein each dimension includes at least one item of original data; a scoring unit, used to calculate the score of the corresponding dimension according to the weight and score of each item of original data.

[0130] As an optional embodiment, the scoring unit includes: an acquisition subunit, used to acquire scoring rules corresponding to the original data, wherein each item of original data corresponds to a scoring rule; a calculation subunit, used to calculate parameters of the original data according to the scoring rules to determine the score of the original data, wherein each item of original data includes at least one parameter.

[0131] As an optional embodiment, the determination module includes: a weight unit, which is used to determine the weight of each dimension; and a summation unit, which is used to calculate the identity authority risk score of the account to be evaluated by weighted summation based on the scores and weights of each dimension.

[0132] As an optional embodiment, it also includes: a level module, used to determine the risk level to which the identity authority risk score belongs, wherein the risk level is a plurality of levels pre-divided according to the value range of the identity authority risk score; and a display module, used to display the identity authority risk score and risk level according to the display method corresponding to the risk level.

[0133] As an optional embodiment, the display module includes: a display unit, used to display the identity authority risk score and risk level according to the display method corresponding to the risk level, and hide the scores of each dimension in the display control; when the display control is triggered, the scores of each dimension are displayed through the display window.

[0134] As an optional embodiment, it also includes: a governance module, which is used to determine the risk governance method based on the identity authority risk score and the risk level, wherein the risk governance method includes at least one governance method for original data; and display the risk governance method.

[0135] As an optional embodiment, it also includes: a sending module for sending the identity permission risk score to the cloud governance model, wherein the cloud governance model is used to evaluate the resource governance maturity of the cloud service based on multiple types of scores, and the multiple types of scores include the identity permission risk score.

[0136] As an optional embodiment, the multiple dimensions include at least one of the following: a credential management dimension, an account management dimension, and a permission management dimension. The acquisition module includes at least one of the following: a credential management module, an account management module, and a permission management module.

[0137] An embodiment of the present invention further provides an electronic device, comprising: at least one processor; and a memory in communication with the at least one processor. The memory stores a computer program executable by the at least one processor, and when the computer program is executed by the at least one processor, the electronic device executes the method of the embodiment of the present invention.

[0138] An embodiment of the present invention further provides a non-transitory machine-readable medium storing a computer program, wherein the computer program, when executed by a processor of a computer, is used to cause the computer to execute the method of the embodiment of the present invention.

[0139] An embodiment of the present invention further provides a computer program product, including a computer program, wherein the computer program, when executed by a processor of a computer, is used to enable the computer to execute the method of the embodiment of the present invention.

[0140] An embodiment of the present invention further provides a cloud service system, which is used to perform cloud storage and cloud processing on data, wherein the cloud processing executes any one of the methods described above.

[0141] refer to Figure 6 , a block diagram of an electronic device that can be used as a server or client of an embodiment of the present invention will now be described, which is an example of a hardware device that can be applied to various aspects of the present invention. Electronic devices are intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0142] like Figure 6 As shown, the electronic device includes a computing unit 601, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device can also be stored. The computing unit 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0143] Multiple components in the electronic device are connected to the I / O interface 605, including: an input unit 606, an output unit 607, a storage unit 608, and a communication unit 609. The input unit 606 can be any type of device that can input information to the electronic device, and the input unit 606 can receive input digital or character information, and generate key signal input related to user settings and / or function control of the electronic device. The output unit 607 can be any type of device that can present information, and can include but is not limited to a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 608 can include but is not limited to a disk, an optical disk. The communication unit 609 allows the electronic device to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and can include but is not limited to a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0144] The computing unit 601 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a CPU, a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 601 performs the various methods and processes described above. For example, in some embodiments, the method embodiments of the present invention may be implemented as a computer program, which is tangibly contained in a machine-readable medium, such as a storage unit 608. In some embodiments, part or all of the computer program may be stored in a ROM.

[0145] 602 and / or the communication unit 609 are loaded and / or installed on the electronic device. In some embodiments, the computing unit 601 can be configured to execute the above method in any other appropriate manner (for example, by means of firmware).

[0146] The computer programs for implementing the methods of the embodiments of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer programs are executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer programs may be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0147] In the context of an embodiment of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable signal medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, a cloud storage medium, a cloud storage server, a cloud storage virtual server, a cloud database, or any suitable combination of the foregoing.

[0148] It should be noted that the term "including" and its variations used in the embodiments of the present invention are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". The modifications of "one" and "multiple" mentioned in the embodiments of the present invention are illustrative rather than restrictive. Those skilled in the art should understand that unless the context clearly indicates otherwise, it should be understood as "one or more".

[0149] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of the present invention are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0150] The various steps described in the method implementation methods provided in the embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method implementation methods may include additional steps and / or omit the steps shown. The scope of protection of the present invention is not limited in this respect.

[0151] The term "embodiment" in this specification refers to specific features, structures or characteristics described in conjunction with the embodiment that can be included in at least one embodiment of the present invention. The appearance of this phrase in various places in the specification does not necessarily mean the same embodiment, nor does it mean that it is mutually exclusive with other embodiments and is independent or optional. The various embodiments in this specification are described in a related manner, and the same or similar parts between the various embodiments refer to each other. In particular, for the device, equipment, and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts refer to the partial description of the method embodiment.

[0152] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of patent protection. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the attached claims.

Claims

1. A method for assessing identity and authority risks of a cloud service account, comprising: Obtaining original data of identity authority of the account to be evaluated in the cloud service, wherein the original data includes data of identity authority in multiple dimensions, and the multiple dimensions are divided according to the identity authority operations performed by the account to be evaluated on the cloud service; Score the original data of multiple dimensions separately to determine the score of each dimension; The identity authority risk score of the account to be evaluated is determined based on the scores of each dimension and the corresponding weights.

2. The method according to claim 1, wherein: The original data of the account to be evaluated and its identity permissions in the cloud service include: According to the collection modules created on the cloud service, the raw data of each dimension is collected, wherein the collection modules are used to collect the raw data of the corresponding dimensions, and each collection module collects the raw data of at least one dimension; Acquire the raw data of multiple dimensions collected by the collection module.

3. The method according to claim 1, wherein: The raw data of multiple dimensions are scored separately to determine the scores of each dimension, including: Determine the score of the original data according to the scoring rule corresponding to each item of original data, wherein each dimension includes at least one item of original data; According to the weight and score of each original data, the score of the corresponding dimension is calculated.

4. The method according to claim 3, wherein: According to the scoring rules corresponding to each item of original data, determining the score of the original data includes: Obtaining scoring rules corresponding to the original data, where each item of original data corresponds to a scoring rule; The parameters of the original data are calculated according to the scoring rule to determine the score of the original data, wherein each item of the original data includes at least one parameter.

5. The method according to claim 4, wherein: According to the scores and corresponding weights of each dimension, the identity authority risk score of the account to be evaluated is determined including: Determine the weight of each dimension; According to the scores and weights of each dimension, the identity authority risk score of the account to be evaluated is calculated by weighted summation.

6. The method according to claim 1, wherein: After determining the identity authority risk score of the account to be evaluated according to the scores of each dimension and the corresponding weights, the method further includes: Determine the risk level to which the identity authority risk score belongs, wherein the risk level is a plurality of levels pre-divided according to the value range of the identity authority risk score; The identity authority risk score and the risk level are displayed according to the display method corresponding to the risk level.

7. The method according to claim 6, wherein: According to the display method corresponding to the risk level, displaying the identity authority risk score and the risk level includes: According to the display method corresponding to the risk level, the identity authority risk score and the risk level are displayed, and the scores of each dimension are hidden in the display control; When the display control is triggered, the scores of each dimension are displayed through the display window.

8. The method according to claim 6, wherein: The method further comprises: Determine a risk governance method according to the identity authority risk score and risk level, wherein the risk governance method includes at least one original data governance method; Demonstrate the risk management approach.

9. The method according to any one of claims 1 to 8, wherein: After determining the identity authority risk score of the account to be evaluated according to the scores of each dimension and the corresponding weights, the method further includes: The identity authority risk score is sent to a cloud governance model, wherein the cloud governance model is used to evaluate the resource governance maturity of the cloud service based on multiple types of scores, including the identity authority risk score.

10. The method according to any one of claims 1 to 8, wherein: The multiple dimensions include at least one of the following: a credential management dimension, an account management dimension, and a permission management dimension.

11. A device for assessing identity authority risk of a cloud service account, comprising: An acquisition module, used to acquire original data of identity authority of the account to be evaluated in the cloud service, wherein the original data includes data of identity authority in multiple dimensions, and the multiple dimensions are divided according to the identity authority operations performed by the account to be evaluated on the cloud service; The scoring module is used to score the raw data of multiple dimensions respectively and determine the score of each dimension; The determination module is used to determine the identity authority risk score of the account to be evaluated based on the scores of each dimension and the corresponding weights.

12. An electronic device comprising: A processor, and a memory storing a program, wherein the program comprises instructions which, when executed by the processor, cause the processor to perform the method according to any one of claims 1 to 10.

13. A non-transitory machine-readable medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 10.

14. A cloud service system, the cloud service system is used for cloud storage and cloud processing of data, wherein: The cloud processing performs the method according to any one of claims 1 to 10.

Images