Access control method and device

Abstract

The invention discloses an access control method and device, and relates to the technical field of computers. The method comprises the following steps: acquiring an access request, and determining at least one corresponding workflow sequence based on the access request; wherein the workflow sequence is a to-be-executed operation for representing the access request application; obtaining a sensitive level of the workflow sequence, and determining a sensitive level of an operation target corresponding to the workflow sequence; comparing the sensitivity level of the workflow sequence with the sensitivity level of the operation target, and executing a target operation based on a comparison result, the target operation including a first operation; wherein the first operation is that when the comparison result is that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target, the operation corresponding to the workflow sequence is allowed to be executed. The method is used for realizing an access control function.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an access control method and device. Background Art

[0002] With the development of technology, data access and interaction between devices are becoming more frequent. When a device or cluster receives an access request, the requested party will perform corresponding operations based on the access request, including but not limited to data reading, data writing, and other operations. However, in the actual access process, some data is sensitive data and is not open to all visitors. If the sensitive data is obtained by users who do not have permission, there will be a risk of data leakage. Therefore, how to manage and control these access behaviors has become an issue that people in the field are gradually paying attention to.

[0003] At present, in the existing access control process, whether the access request is executed is generally determined based on the user's identity. If the identity is confirmed to be correct, the access request is allowed to be executed. However, in actual applications, once a user's access request involves multiple different operations, if some operations involve sensitive data and his identity does not have access permissions, the access request will be prohibited from being executed due to the identity mismatch, thereby affecting the smooth execution of other operations that meet his identity. Based on this, how to control access behavior more accurately has become an urgent problem to be solved in the field. Summary of the invention

[0004] The embodiments of the present application provide an access control method and device, the main purpose of which is to implement an access control method to solve the problem of poor access control accuracy in the existing access control process.

[0005] In order to solve the above technical problems, the embodiments of the present application provide the following technical solutions:

[0006] In a first aspect, the present application provides an access control method, the method comprising:

[0007] Obtaining an access request, and determining at least one corresponding workflow sequence based on the access request; wherein the workflow sequence is an operation to be performed that represents the access request application;

[0008] Acquire the sensitivity level of the workflow sequence, and determine the sensitivity level of the operation target corresponding to the workflow sequence;

[0009] The sensitivity level of the workflow sequence is compared with the sensitivity level of the operation target, and a target operation is performed based on the comparison result, wherein the target operation includes a first operation; wherein the first operation is to allow execution of the operation corresponding to the workflow sequence when the comparison result is that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target.

[0010] In a second aspect, the present application further provides an access control device, the device comprising:

[0011] A first determining unit is used to obtain an access request and determine at least one corresponding workflow sequence based on the access request; wherein the workflow sequence is an operation to be executed that represents the access request application;

[0012] A second determining unit, configured to obtain a sensitivity level of the workflow sequence and determine a sensitivity level of an operation target corresponding to the workflow sequence;

[0013] An execution unit is used to compare the sensitivity level of the workflow sequence with the sensitivity level of the operation target, and perform a target operation based on the comparison result, wherein the target operation includes a first operation; wherein the first operation is to allow execution of the operation corresponding to the workflow sequence when the comparison result is that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target.

[0014] In a third aspect, the present application further provides a storage medium, which includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the access control method described in the first aspect.

[0015] In a fourth aspect, the present application also provides an access control device, comprising a storage medium; and one or more processors, wherein the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, the access control method described in any one of the first aspects is executed.

[0016] By means of the above technical solution, the technical solution provided by this application has at least the following advantages:

[0017] The present application provides an access control method and device, which can first obtain an access request and determine at least one corresponding workflow sequence based on the access request; wherein the workflow sequence is an operation to be executed that characterizes the access request application; then, obtain the sensitivity level of the workflow sequence, and determine the sensitivity level of the operation target corresponding to the workflow sequence; finally, compare the sensitivity level of the workflow sequence with the sensitivity level of the operation target, and execute the target operation based on the comparison result, wherein the target operation includes a first operation; wherein the first operation is to allow the execution of the operation corresponding to the workflow sequence when the comparison result is that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target, thereby realizing the access control function. Compared with the prior art, in the present application, during the access control process, the specific operations involved in the access request can be split according to the workflow sequence. This ensures that when the user's access request involves multiple different operations, it can be managed based on the sensitivity level of the workflow sequence corresponding to each operation. As long as the sensitivity level of the workflow sequence is the same as the sensitivity level of the corresponding operation target, the operation corresponding to the workflow sequence can be executed. This ensures that during the access control process, the implementation of other operation behaviors involved in the access request is not affected by the insufficient sensitivity level of a certain operation, thereby realizing the screening function of specific behaviors during the access process, avoiding the problem of individual operation behaviors involving higher-level sensitive data affecting other operations, improving the accuracy of the access control process, and solving the problem of poor accuracy in the access control process of the prior art.

[0018] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] By reading the detailed description below with reference to the accompanying drawings, the above and other purposes, features and advantages of the exemplary embodiments of the present application will become easy to understand. In the accompanying drawings, several embodiments of the present application are shown in an exemplary and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0020] Figure 1 A flow chart of an access control method provided by an embodiment of the present application is shown;

[0021] Figure 2 Another access control method flow chart provided by an embodiment of the present application is shown;

[0022] Figure 3A block diagram of an access control device provided by an embodiment of the present application is shown;

[0023] Figure 4 A composition block diagram of another access control device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0024] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0025] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by technicians in the field to which this application belongs.

[0026] The present application embodiment provides a flowchart of an access control method, such as Figure 1 As shown, the method includes:

[0027] 101. Obtain an access request, and determine at least one corresponding workflow sequence based on the access request.

[0028] The workflow sequence is an operation to be performed that represents the access request application.

[0029] In this embodiment, the target of the access request may be a service device including a cluster. The specific content requested by the access request includes but is not limited to remote data query and acquisition, remote invocation of related functions or services, remote computing and other requests of different requirements. Here, there is no limitation on the specific functions / services requested by the access request and the number of the requested functions / services, which can be selected based on actual conditions.

[0030] In addition, in actual applications, since the purpose of an access request is to call a remote service cluster to provide corresponding services or functions, the specific operations involved in an access request may be multiple different more specific operations or events, and these operations or events may involve calling specific lower-level functions or services, or the targeted data are different, and the importance of these data or services is different, that is, their sensitivity is different. Therefore, when managing access requests, you can split and analyze them based on the sensitivity of the data or services involved in these operations.

[0031] In view of this, in this embodiment, the currently acquired access request can be split, that is, according to the operations to be executed that it is to apply for, so that each operation after the split can be represented by a workflow sequence, that is, an access request can be split into multiple different workflow sequences in the manner of this step. For example, when access request A wants to perform a data extraction operation, then the extraction operation can be simply split into two operations, querying data and extracting data. Each operation can generate a workflow sequence, which are workflow sequence 1 and workflow sequence 2, respectively. In this way, the process of splitting the "big function" requested by the access request into multiple "small functions" of specific behaviors is realized. Specifically, the process of determining the corresponding workflow sequence based on the access request can include but is not limited to the above-mentioned method, and the specific execution process can be selected based on actual needs.

[0032] 102. Obtain the sensitivity level of the workflow sequence, and determine the sensitivity level of the operation target corresponding to the workflow sequence.

[0033] In the case where the access request has been "split" into multiple workflow sequences in the aforementioned steps, it is equivalent to realizing the process of splitting the "big function" into "small functions". Since the operation target of each "small function" may be different, and the sensitivity of the behavior it executes may also be different, therefore, in this step, the sensitivity level corresponding to each workflow sequence can be obtained separately. At the same time, it is also necessary to determine the sensitivity level of the object that the workflow sequence actually wants to operate, that is, the sensitivity level of the operation target.

[0034] It should be noted that, in this embodiment, the setting method of the sensitivity level of the workflow sequence and the sensitivity level of the operation target can be pre-tested and generated based on user needs, that is, based on historical data analysis. For example, when the security level of certain data is high and only administrators or quantitative engineers can query and obtain it, then when such data is used as an operation target, its sensitivity level can be set to a higher level. For the workflow sequence, historical data analysis can be used to determine which operations are most commonly used in this service cluster, then the sensitivity level of the workflow sequence corresponding to such operations can be lower, and for some operations involving data security or system security, the workflow sequence corresponding to such operations can be set to a higher sensitivity level. Of course, the setting method in this embodiment is only exemplary. In the actual application of the access control method described in this embodiment, it can also be set based on other methods, which are not limited here.

[0035] 103. Compare the sensitivity level of the workflow sequence with the sensitivity level of the operation target, and execute the target operation based on the comparison result.

[0036] The target operation includes a first operation; wherein the first operation is to allow execution of the operation corresponding to the workflow sequence when the comparison result shows that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target.

[0037] After determining the sensitivity level of the workflow sequence and the sensitivity level of the operation target, the next step is to compare the sensitivity levels of the two to perform subsequent target operations. Of course, in this embodiment, only when the comparison result is that the sensitivity level of the current workflow sequence is the same as the sensitivity level of the operation target, which means that the permissions that the operation to be performed at this time can have are consistent with the permissions of the data to be executed, then the operation corresponding to the workflow sequence can be allowed to proceed smoothly. In this way, access control is performed by comparing the sensitivity level of the workflow sequence with the sensitivity level of the operation target, ensuring that when access control involves multiple different workflow sequences, it can be managed and controlled based on the permissions of each workflow sequence, avoiding the situation where some operations cannot be performed when management is performed directly based on the access request as a whole, thereby improving the accuracy of access control.

[0038] Based on this, the present embodiment provides an access control method compared to the prior art. In the present application, during the access control process, the specific operations involved in the access request can be split according to the workflow sequence. This ensures that when the user's access request involves multiple different operations, it can be managed based on the sensitivity level of the workflow sequence corresponding to each operation. As long as the sensitivity level of the workflow sequence is the same as the sensitivity level of the corresponding operation target, the operation corresponding to the workflow sequence can be executed. This ensures that during the access control process, the implementation of other operation behaviors involved in the access request is not affected by the insufficient sensitivity level of a certain operation, thereby realizing the screening function of specific behaviors during the access process, avoiding the problem of individual operation behaviors involving higher-level sensitive data affecting other operations, improving the accuracy of the access control process, and solving the problem of poor accuracy in the access control process of the prior art.

[0039] Furthermore, as a further description and refinement of the above-mentioned embodiment, the present application also provides an access control, specifically as follows Figure 2 As shown:

[0040] 201. Obtain historical access data, and parse the business behavior involved in each historical request in the historical access data.

[0041] In a cluster service system, there are generally different businesses for different scenarios, and the specific operations to be performed by each business are also different. In this embodiment, when performing access control on the access requests received by the cluster service system, the operations actually involved in each request and the corresponding relationship between them can be analyzed based on historical data first, so that when an access request appears later, the workflow sequence actually corresponding to the access request can be directly determined. Specifically, in this step, analysis can be performed based on historical access data to determine the business behavior involved in each access request that has appeared in the historical access data, that is, the business behavior involved in the historical request.

[0042] 202. Determine at least one of the workflow sequences corresponding to each business behavior, and establish a corresponding relationship to obtain a preset mapping relationship.

[0043] Since each business behavior can actually be composed of multiple different operations, based on the description of the above embodiments, it can be seen that the workflow sequence can represent an operation. Therefore, the workflow sequence can be used to represent each business behavior and record the relationship between the two for use in subsequent steps.

[0044] In some embodiments, in order to simplify the description of the workflow sequence, it can also be performed based on the attributes involved in the specific operation. Based on this, in this step, "determine at least one workflow sequence corresponding to each business behavior, and establish a corresponding relationship to obtain a preset mapping relationship" can be executed as follows:

[0045] First, at least one underlying operation corresponding to each business behavior is determined, and attribute information of each underlying operation is obtained, wherein the underlying operation is a specific operation behavior required to implement the business behavior; the attribute information includes at least one of container information to be accessed, behavior information to be executed, and operation target information;

[0046] Then, based on at least one of the attribute information, a workflow sequence corresponding to each historical request is generated, and the corresponding relationship is recorded to obtain the preset mapping relationship.

[0047] In this way, through the "business behavior-underlying operation-attribute information" approach, the process of splitting the business behavior into characteristic information of different operations is realized, that is, the process of generating a workflow sequence in the form of container information to be accessed, behavior information to be executed, and operation target information in the attribute information involved in the underlying operation is obtained. This can ensure that the overall meaning of the business behavior is represented and each specific operation involved in a business behavior is reflected.

[0048] For example, in this embodiment, assume that business behavior A determines that its corresponding two workflow sequences are: workflow sequence 1 "Container 1; Query; Data X" and workflow sequence 2 "Copy" according to the method in this step. This means that this business behavior actually uses the function of container 1 to search for data X, and copies the data X after finding it.

[0049] Of course, in some cases, based on differences in compiled languages, operating systems, etc., some operations are actually multiple operations. In this case, when determining the underlying operation, these multiple specific operations can be combined into one operation. For example, taking the aforementioned example business behavior A as an example, when the copy operation in the system involves two operations, query and copy, which are executed by an instruction or function, there is no need to split them into two underlying operations here, but to regard the two as one underlying operation as a whole. Then, according to the method of this step, the business behavior A finally determines only one workflow sequence, that is, workflow sequence 3 "[Container 1; Query; Data X]; [Copy]", and records the corresponding relationship between business behavior A and workflow sequence 3. Here, for the process of determining the business behavior as the underlying operation and determining the corresponding workflow sequence, any of the above methods can be used. Specifically, the number and method of workflow sequences that can be "split" out of each business behavior are not limited, and are subject to the actual operating system or compiled language.

[0050] 203. Determine a sensitivity level of the workflow sequence based on the operation behaviors involved in the workflow sequence.

[0051] Before performing access control based on the sensitivity level of the workflow sequence and the sensitivity level of the operation target in this embodiment, the sensitivity level of each workflow sequence and operation target may be set in advance in accordance with step 203 and subsequent step 204.

[0052] Specifically, this step may be performed as follows:

[0053] Step A: When the workflow sequence contains container information to be accessed, behavior information to be executed, and operation target information, respectively obtain the sensitivity index of the container to be accessed, the sensitivity index of the behavior to be executed, and the sensitivity index of the operation target; wherein, the container to be accessed is determined based on the container information to be accessed. Based on the foregoing description of the embodiment, it can be known that the workflow sequence may contain the containers involved, the behaviors to be executed, and the targeted data. Therefore, in this step, the sensitivity index of these three can be set. The sensitivity index can be understood as a quantitative way to characterize the sensitivity of the container, operation, or data. Of course, in this embodiment, the higher the sensitivity index, the more the data or container needs to be protected. Conversely, it means that it is less important and does not require more stringent protection.

[0054] Step B, determine the sensitivity score based on the sensitivity index of the container to be accessed, the sensitivity index of the behavior to be executed, and the sensitivity index of the operation target, and determine the sensitivity level of the workflow sequence based on the sensitivity score. After determining the sensitivity indexes of the container to be accessed, the behavior to be executed, and the operation target, the sensitivity level of the workflow sequence can be determined based on the sensitivity indexes of the three. Specifically, a score representing the sensitivity of the current workflow sequence can be determined based on the sensitivity indexes of the three, and its sensitivity level can be determined on this basis. In this way, the function of determining the sensitivity level of the workflow sequence in a quantitative scoring manner is realized, making the process of determining the sensitivity level more intuitive and scientific.

[0055] Furthermore, in this step, step B "determines a sensitivity score based on the sensitivity index of the container to be accessed, the sensitivity index of the behavior to be executed, and the sensitivity index of the operation target, and determines the sensitivity level of the workflow sequence based on the sensitivity score" can be performed in any of the following two ways, specifically:

[0056] Method 1: respectively obtain the security level of the container to be accessed, the security level of the behavior to be executed, and the security level of the operation target, and determine the sensitivity index of the highest security level as the sensitivity score, and determine the sensitivity level corresponding to the sensitivity score in the preset level score table as the sensitivity level of the workflow sequence. In this way, by analyzing the security levels of the three and using the highest security level as the sensitivity score, it can be ensured that when any of some important behaviors, containers or behavior targets is set to a higher security level, it will not be affected by other lower levels, thereby ensuring that the sensitivity level of the workflow sequence can be directly affected by the container, behavior or operation target with the highest security level, so that when determining the sensitivity level later, only adjusting the security level of the attribute information of the underlying operation can affect the sensitivity of the entire workflow sequence, simplifying the operation process.

[0057] Method 2: respectively obtain the score weight of the container to be accessed, the score weight of the behavior to be executed, and the score weight of the operation target, and determine the sensitivity score based on the container score, the behavior score, and the operation target score, and determine the sensitivity level corresponding to the sensitivity score in the preset level score table as the sensitivity level of the workflow sequence; wherein, the container score is calculated based on the score weight of the container to be accessed and the sensitivity index of the container to be accessed; the behavior score is calculated based on the score weight of the behavior to be executed and the sensitivity index of the behavior to be executed; and the operation target score is calculated based on the score weight of the operation target and the sensitivity index of the operation target. By calculating the scores of the three through their respective sensitivity indexes and corresponding weights, and then determining the sensitivity level by obtaining the total score based on each score, it can be ensured that under the premise of comprehensively considering the sensitivity of the container to be accessed, the behavior to be executed, and the operation target, the different importance (weight) between them can also be taken into account. The overall impact, thereby ensuring that the sensitivity of the workflow sequence representing the operation behavior can be more accurately determined.

[0058] Specifically, the weights may be set in the following manner: 2:1:1, that is, the container to be accessed is of the highest importance, and the behavior to be executed and the operation target are second. This allows the access process to be controlled primarily based on the container when the container is more important.

[0059] 204. Determine the sensitivity level of each operation target according to the data security level of the operation target.

[0060] The operation target includes data to be operated; the sensitivity level of the operation target is positively correlated with the data security level of the operation target.

[0061] In this step, all data related to business behaviors in the cluster service system can be used as operation targets to set corresponding sensitivity levels. Specifically, it can be set according to the data security level of each data. For example, for more sensitive core data, a higher sensitivity level can be set, while for many commonly disclosed data, a lower sensitivity level can be set.

[0062] 205. Obtain an access request, and determine at least one corresponding workflow sequence based on the access request.

[0063] The workflow sequence is an operation to be performed that represents the access request application.

[0064] Specifically, based on the description of the above steps, since the workflow sequence has established a corresponding relationship based on the business behavior in advance, that is, a preset mapping relationship, in this step, after obtaining the access request, the corresponding workflow sequence can be determined through the preset mapping relationship.

[0065] Based on this, in this step, "determining at least one corresponding workflow sequence based on the access request" can be specifically performed as follows: determining the corresponding target business behavior according to the access request, and determining the workflow sequence corresponding to the target business behavior in the preset mapping relationship.

[0066] In this way, the workflow sequence corresponding to the access request is determined by presetting the mapping relationship, which saves the process of determining the underlying operation involved in the access request, thereby simplifying the process of determining the workflow sequence and improving the efficiency of the access control described in this embodiment as a whole.

[0067] Further, based on the description of the above steps, it can be known that, since the functions involved in the access request actually correspond to different containers, and since the containers themselves have different security levels, some containers may not involve functions related to the use of sensitive data, while some may involve functions related to the use of sensitive data. Therefore, before executing this step 205, the container information corresponding to the workflow sequence in the access request can also be analyzed. When it is determined that the container involved belongs to a container with related operations with sensitive data, the method of executing the subsequent steps is executed. Otherwise, the subsequent steps can be skipped and the access request can be executed. In this way, it can ensure that the container involving sensitive data can be managed and controlled based on the subsequent steps when the access request is applied, and it can also ensure that when the access request itself does not involve sensitive data, it can be directly executed, eliminating the process of analyzing and managing the subsequent steps, which can improve access efficiency.

[0068] 206. Obtain the sensitivity level of the workflow sequence, and determine the sensitivity level of the operation target corresponding to the workflow sequence.

[0069] Based on the description of the preceding steps, it can be seen that, since corresponding sensitivity levels are set in advance for all possible workflow sequences, sensitivity levels are set for all data related to business behaviors in the cluster service system. Therefore, in this embodiment, the data can be directly obtained based on the sensitivity levels set in the preceding steps.

[0070] 207. Compare the sensitivity level of the workflow sequence with the sensitivity level of the operation target, and perform the target operation based on the comparison result.

[0071] The target operation includes a first operation; specifically, the first operation is to allow execution of the operation corresponding to the workflow sequence when the comparison result shows that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target.

[0072] In some embodiments, the target operation further includes a second operation; the second operation is used to execute the data reading behavior in the access request;

[0073] Based on this, in this step, the sensitivity level of the workflow sequence is compared with the sensitivity level of the operation target, and the target operation is performed based on the comparison result. When executing, the following may be included:

[0074] The sensitivity level of the workflow sequence is compared with the sensitivity level of the operation target. When it is determined that the comparison result is that the sensitivity level of the workflow sequence is higher than the sensitivity level of the operation target, a second operation is performed, and the second operation is used to execute the data reading behavior in the access request.

[0075] In this step, when it is determined that the sensitivity level of the workflow sequence is higher than the sensitivity level of the data (operation target) to be operated, it means that some of the multiple behaviors involved in the workflow sequence may be for operation targets with higher sensitivity levels, rather than the current operation targets to be operated. However, in an ideal situation, when the staff sets the sensitivity level for the operation target and the sensitivity level of the corresponding workflow sequence, they are mutually corresponding. If the sensitivity level of the workflow sequence exceeds the sensitivity level of the operation target it wants to perform, then the access request may be forged and counterfeited by hackers and other attackers. In order to prevent them from performing operations such as writing behaviors on certain data, , to avoid tampering of internal data of the system. In this embodiment, when the sensitivity level of the workflow sequence is higher than the sensitivity level of the operation target, only the second operation can be executed, and only the execution of its reading behavior is allowed. This can not only prevent some personnel from forging workflow sequences with higher sensitivity levels to tamper with data, but also ensure that when some staff members apply for the wrong operation target when initiating an access request, they can know the content therein and find out why the operation corresponding to the workflow sequence they require to execute has not been successfully executed. This can not only improve security, but also enable the staff members who make the wrong operation to read the content of the target they want to operate, which is conducive to the subsequent re-initiation of the request.

[0076] It should be noted that, in this embodiment, the target operation may also include a third operation, and the third operation is used to allow the execution of non-data export behavior when it is determined that the comparison result is that the sensitivity level of the workflow sequence is lower than the sensitivity level of the operation target. The non-data export behavior can be understood as the behavior of not feeding back relevant internal system data to the initiator of the request. For example, certain functional behaviors are allowed, such as calling a certain function for remote computing. In this process, the data inside the system will not be exported, but will be executed based on certain functions it possesses. In this process, the data operated on can actually be provided by the initiator of the request. This ensures that such users can use some remote service functions of the system without setting their workflow sequences to have a higher sensitivity level, thereby improving convenience and practicality.

[0077] Furthermore, as a response to the above Figure 1 and Figure 2 In order to realize the method shown in the figure, another embodiment of the present application also provides an access control device. This device embodiment corresponds to the aforementioned method embodiment. For ease of reading, this device embodiment will not repeat the details of the aforementioned method embodiment one by one, but it should be clear that the device in this embodiment can correspond to all the contents of the aforementioned method embodiment. In order to realize an access control method, the device is specifically as follows Figure 3 As shown, the device comprises:

[0078] The first determining unit 31 may be used to obtain an access request and determine at least one corresponding workflow sequence based on the access request; wherein the workflow sequence is an operation to be performed that represents the access request application;

[0079] The second determining unit 32 may be used to obtain the sensitivity level of the workflow sequence determined by the first determining unit 31, and determine the sensitivity level of the operation target corresponding to the workflow sequence;

[0080] The execution unit 33 can be used to compare the sensitivity level of the workflow sequence determined by the second determination unit 32 with the sensitivity level of the operation target determined by the second determination unit 32, and perform the target operation based on the comparison result, and the target operation includes a first operation; wherein the first operation is to allow the execution of the operation corresponding to the workflow sequence when the comparison result is that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target.

[0081] Further, such as Figure 4 As shown, the device also includes:

[0082] The parsing unit 34 may be used to obtain historical access data and parse the business behavior involved in each historical request in the historical access data;

[0083] The construction unit 35 may be used to determine at least one workflow sequence corresponding to each business behavior obtained by the analysis unit 34, and establish a corresponding relationship to obtain a preset mapping relationship;

[0084] The first determining unit 31 may be specifically configured to determine a corresponding target business behavior according to the access request, and determine a workflow sequence corresponding to the target business behavior in the preset mapping relationship obtained by the constructing unit 35 .

[0085] Further, such as Figure 4 As shown, the construction unit 35 can also be specifically used to determine at least one underlying operation corresponding to each business behavior, and obtain attribute information of each underlying operation, wherein the underlying operation is a specific operation behavior required to implement the business behavior; the attribute information includes at least one of the container information to be accessed, the behavior information to be executed, and the operation target information; and, based on at least one of the attribute information, generate a workflow sequence corresponding to each historical request, and record the corresponding relationship to obtain the preset mapping relationship.

[0086] Further, such as Figure 4 As shown, the device also includes:

[0087] A third determining unit 36 ​​may be used to determine a sensitivity level of the workflow sequence based on the operation behavior involved in the workflow sequence;

[0088] The fourth determination unit 37 can be used to determine the sensitivity level of each operation target according to the data security level of the operation target; the operation target includes data to be operated; the sensitivity level of the operation target is positively correlated with the data security level of the operation target.

[0089] Further, such as Figure 4 As shown, the third determination unit 36 ​​can be specifically used to obtain the sensitivity index of the container to be accessed, the sensitivity index of the behavior to be executed, and the sensitivity index of the operation target respectively when the workflow sequence contains container information to be accessed, behavior information to be executed, and operation target information; wherein the container to be accessed is determined based on the container information to be accessed; and, based on the sensitivity index of the container to be accessed, the sensitivity index of the behavior to be executed, and the sensitivity index of the operation target, a sensitivity score is determined, and the sensitivity level of the workflow sequence is determined based on the sensitivity score.

[0090] Further, such as Figure 4As shown, the third determination unit 36 ​​can also be specifically used to respectively obtain the security level of the container to be accessed, the security level of the behavior to be executed, and the security level of the operation target, and determine the sensitivity index of the highest security level as the sensitivity score, and determine the sensitivity level corresponding to the sensitivity score in the preset level score table as the sensitivity level of the workflow sequence;

[0091] The third determination unit 36 ​​can also be specifically used to respectively obtain the score weight of the container to be accessed, the score weight of the behavior to be executed, and the score weight of the operation target, and determine the sensitivity score based on the container score, the behavior score, and the operation target score, and determine the sensitivity level corresponding to the sensitivity score in the preset level score table as the sensitivity level of the workflow sequence; wherein the container score is calculated based on the score weight of the container to be accessed and the sensitivity index of the container to be accessed; the behavior score is calculated based on the score weight of the behavior to be executed and the sensitivity index of the behavior to be executed; and the operation target score is calculated based on the score weight of the operation target and the sensitivity index of the operation target.

[0092] Further, such as Figure 4 As shown, the target operation also includes a second operation; the second operation can be used to execute the data reading behavior in the access request;

[0093] The execution unit 33 can also be specifically used to compare the sensitivity level of the workflow sequence with the sensitivity level of the operation target. When it is determined that the comparison result is that the sensitivity level of the workflow sequence is higher than the sensitivity level of the operation target, a second operation is executed, and the second operation can be used to execute the data reading behavior in the access request.

[0094] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an embodiment of the present application further provides a storage medium, wherein the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the above-mentioned access control method.

[0095] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an embodiment of the present application also provides an access control device, which includes a storage medium; and one or more processors, the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, the access control method described above is executed.

[0096] The embodiment of the present application provides an access control method and apparatus. In the embodiment of the present application, an access request can be first obtained, and at least one corresponding workflow sequence can be determined based on the access request; wherein the workflow sequence is an operation to be performed that characterizes the access request application; then, the sensitivity level of the workflow sequence is obtained, and the sensitivity level of the operation target corresponding to the workflow sequence is determined; finally, the sensitivity level of the workflow sequence is compared with the sensitivity level of the operation target, and the target operation is performed based on the comparison result, and the target operation includes a first operation; wherein the first operation is to allow the execution of the operation corresponding to the workflow sequence when the comparison result is that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target, thereby realizing the access control function. Compared with the prior art, in the access control process of the embodiment of the present application, the specific operations involved in the access request can be split according to the workflow sequence. This ensures that when the user's access request involves multiple different operations, it can be managed based on the sensitivity level of the workflow sequence corresponding to each operation. As long as the sensitivity level of the workflow sequence is the same as the sensitivity level of the corresponding operation target, the operation corresponding to the workflow sequence can be executed. This ensures that in the access control process, the implementation of other operation behaviors involved in the access request is not affected by the insufficient sensitivity level of a certain operation, thereby realizing the screening function of specific behaviors in the access process, avoiding the problem of individual operation behaviors involving higher-level sensitive data affecting other operations, improving the accuracy of the access control process, and solving the problem of poor accuracy in the access control process of the prior art.

[0097] The access control device includes a processor and a memory. The first determining unit, the second determining unit, and the executing unit are all stored in the memory as program units. The processor executes the program units stored in the memory to implement corresponding functions.

[0098] The processor includes a kernel, and the kernel calls the corresponding program unit from the memory. One or more kernels can be set, and an access control method is implemented by adjusting kernel parameters to solve the problem of poor access control accuracy in the existing access control process.

[0099] An embodiment of the present application provides an access control device, which includes a storage medium; and one or more processors, wherein the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, any of the access control methods described above is executed.

[0100] An embodiment of the present application provides a storage medium, which includes a stored program, wherein when the program is executed, a device where the storage medium is located is controlled to execute the access control method described above.

[0101] The storage medium may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one storage chip.

[0102] An embodiment of the present application provides a device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the following steps are implemented: obtaining an access request, and determining at least one corresponding workflow sequence based on the access request; wherein the workflow sequence is an operation to be executed that characterizes the access request application; obtaining a sensitivity level of the workflow sequence, and determining a sensitivity level of an operation target corresponding to the workflow sequence; comparing the sensitivity level of the workflow sequence with the sensitivity level of the operation target, and executing a target operation based on the comparison result, wherein the target operation includes a first operation; wherein the first operation is to allow execution of the operation corresponding to the workflow sequence when the comparison result shows that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target.

[0103] Furthermore, before obtaining the access request, the method further includes:

[0104] Obtain historical access data and parse the business behavior involved in each historical request in the historical access data;

[0105] Determine at least one of the workflow sequences corresponding to each business behavior, and establish a corresponding relationship to obtain a preset mapping relationship;

[0106] The determining at least one corresponding workflow sequence based on the access request comprises:

[0107] A corresponding target business behavior is determined according to the access request, and a workflow sequence corresponding to the target business behavior is determined in the preset mapping relationship.

[0108] Further, the determining of at least one workflow sequence corresponding to each business behavior and establishing a corresponding relationship to obtain a preset mapping relationship includes:

[0109] Determine at least one underlying operation corresponding to each business behavior, and obtain attribute information of each underlying operation, wherein the underlying operation is a specific operation behavior required to implement the business behavior; the attribute information includes at least one of container information to be accessed, behavior information to be executed, and operation target information;

[0110] Based on at least one of the attribute information, a workflow sequence corresponding to each historical request is generated, and the corresponding relationship is recorded to obtain the preset mapping relationship.

[0111] Furthermore, before obtaining the sensitivity level of the workflow sequence and determining the sensitivity level of the operation target corresponding to the workflow sequence, the method further includes:

[0112] Determining a sensitivity level of the workflow sequence based on the operational behaviors involved in the workflow sequence;

[0113] The sensitivity level of each operation target is determined according to the data security level of the operation target; the operation target includes data to be operated; the sensitivity level of the operation target is positively correlated with the data security level of the operation target.

[0114] Further, determining the sensitivity level of the workflow sequence based on the operation behaviors involved in the workflow sequence includes:

[0115] When the workflow sequence includes information about a container to be accessed, information about a behavior to be executed, and information about an operation target, respectively obtaining a sensitivity index of the container to be accessed, a sensitivity index of the behavior to be executed, and a sensitivity index of the operation target; wherein the container to be accessed is determined based on the information about the container to be accessed;

[0116] A sensitivity score is determined based on the sensitivity index of the container to be accessed, the sensitivity index of the behavior to be executed, and the sensitivity index of the operation target, and the sensitivity level of the workflow sequence is determined based on the sensitivity score.

[0117] Further, determining a sensitivity score based on the sensitivity index of the container to be accessed, the sensitivity index of the behavior to be executed, and the sensitivity index of the operation target, and determining the sensitivity level of the workflow sequence based on the sensitivity score includes:

[0118] The security level of the container to be accessed, the security level of the behavior to be executed, and the security level of the operation target are respectively obtained, and the sensitivity index of the highest security level is determined as the sensitivity score, and the sensitivity level corresponding to the sensitivity score is determined in a preset level score table as the sensitivity level of the workflow sequence;

[0119] or,

[0120] The score weight of the container to be accessed, the score weight of the behavior to be executed, and the score weight of the operation target are respectively obtained, and the sensitivity score is determined based on the container score, the behavior score, and the operation target score, and the sensitivity level corresponding to the sensitivity score is determined in a preset level score table as the sensitivity level of the workflow sequence; wherein the container score is calculated based on the score weight of the container to be accessed and the sensitivity index of the container to be accessed; the behavior score is calculated based on the score weight of the behavior to be executed and the sensitivity index of the behavior to be executed; and the operation target score is calculated based on the score weight of the operation target and the sensitivity index of the operation target.

[0121] Furthermore, the target operation also includes a second operation; the second operation is used to execute the data reading behavior in the access request;

[0122] The comparing the sensitivity level of the workflow sequence with the sensitivity level of the operation target and performing the target operation based on the comparison result includes:

[0123] The sensitivity level of the workflow sequence is compared with the sensitivity level of the operation target. When it is determined that the comparison result is that the sensitivity level of the workflow sequence is higher than the sensitivity level of the operation target, a second operation is performed, and the second operation is used to execute the data reading behavior in the access request.

[0124] The present application also provides a computer program product, which can execute corresponding functions, including: obtaining an access request, and determining at least one corresponding workflow sequence based on the access request; wherein the workflow sequence is an operation to be executed that characterizes the access request application; obtaining the sensitivity level of the workflow sequence, and determining the sensitivity level of the operation target corresponding to the workflow sequence; comparing the sensitivity level of the workflow sequence with the sensitivity level of the operation target, and executing the target operation based on the comparison result, wherein the target operation includes a first operation; wherein the first operation is to allow the execution of the operation corresponding to the workflow sequence when the comparison result is that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target.

[0125] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0126] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0127] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0128] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0129] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0130] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0131] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0132] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0133] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0134] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. An access control method, characterized in that: The method comprises: Obtaining an access request, and determining at least one corresponding workflow sequence based on the access request; wherein the workflow sequence is an operation to be performed that represents the access request application; Acquire the sensitivity level of the workflow sequence, and determine the sensitivity level of the operation target corresponding to the workflow sequence; The sensitivity level of the workflow sequence is compared with the sensitivity level of the operation target, and a target operation is performed based on the comparison result, wherein the target operation includes a first operation; wherein the first operation is to allow execution of the operation corresponding to the workflow sequence when the comparison result is that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target.

2. The method according to claim 1, characterized in that Before obtaining the access request, the method further includes: Obtain historical access data and parse the business behavior involved in each historical request in the historical access data; Determine at least one of the workflow sequences corresponding to each business behavior, and establish a corresponding relationship to obtain a preset mapping relationship; The determining at least one corresponding workflow sequence based on the access request includes: A corresponding target business behavior is determined according to the access request, and a workflow sequence corresponding to the target business behavior is determined in the preset mapping relationship.

3. The method according to claim 2, characterized in that The determining of at least one workflow sequence corresponding to each business behavior, establishing a corresponding relationship, and obtaining a preset mapping relationship includes: Determine at least one underlying operation corresponding to each business behavior, and obtain attribute information of each underlying operation, wherein the underlying operation is a specific operation behavior required to implement the business behavior; the attribute information includes at least one of container information to be accessed, behavior information to be executed, and operation target information; Based on at least one of the attribute information, a workflow sequence corresponding to each historical request is generated, and the corresponding relationship is recorded to obtain the preset mapping relationship.

4. The method according to claim 1, characterized in that: Before obtaining the sensitivity level of the workflow sequence and determining the sensitivity level of the operation target corresponding to the workflow sequence, the method further includes: Determining a sensitivity level of the workflow sequence based on the operational behaviors involved in the workflow sequence; The sensitivity level of each operation target is determined according to the data security level of the operation target; the operation target includes data to be operated; the sensitivity level of the operation target is positively correlated with the data security level of the operation target.

5. The method according to claim 4, characterized in that Determining the sensitivity level of the workflow sequence based on the operation behaviors involved in the workflow sequence includes: When the workflow sequence includes information about a container to be accessed, information about a behavior to be executed, and information about an operation target, respectively obtaining a sensitivity index of the container to be accessed, a sensitivity index of the behavior to be executed, and a sensitivity index of the operation target; wherein the container to be accessed is determined based on the information about the container to be accessed; A sensitivity score is determined based on the sensitivity index of the container to be accessed, the sensitivity index of the behavior to be executed, and the sensitivity index of the operation target, and the sensitivity level of the workflow sequence is determined based on the sensitivity score.

6. The method according to claim 1, characterized in that The determining of a sensitivity score based on the sensitivity index of the container to be accessed, the sensitivity index of the behavior to be executed, and the sensitivity index of the operation target, and determining the sensitivity level of the workflow sequence based on the sensitivity score, includes: The security level of the container to be accessed, the security level of the behavior to be executed, and the security level of the operation target are respectively obtained, and the sensitivity index of the highest security level is determined as the sensitivity score, and the sensitivity level corresponding to the sensitivity score is determined in a preset level score table as the sensitivity level of the workflow sequence; or, The score weight of the container to be accessed, the score weight of the behavior to be executed, and the score weight of the operation target are respectively obtained, and the sensitivity score is determined based on the container score, the behavior score, and the operation target score, and the sensitivity level corresponding to the sensitivity score is determined in a preset level score table as the sensitivity level of the workflow sequence; wherein the container score is calculated based on the score weight of the container to be accessed and the sensitivity index of the container to be accessed; the behavior score is calculated based on the score weight of the behavior to be executed and the sensitivity index of the behavior to be executed; and the operation target score is calculated based on the score weight of the operation target and the sensitivity index of the operation target.

7. The method according to claim 1, characterized in that The target operation also includes a second operation; the second operation is used to execute the data reading behavior in the access request; The comparing the sensitivity level of the workflow sequence with the sensitivity level of the operation target and performing the target operation based on the comparison result includes: The sensitivity level of the workflow sequence is compared with the sensitivity level of the operation target. When it is determined that the comparison result is that the sensitivity level of the workflow sequence is higher than the sensitivity level of the operation target, a second operation is performed, and the second operation is used to execute the data reading behavior in the access request.

8. An access control device, characterized in that: The device comprises: A first determining unit is used to obtain an access request and determine at least one corresponding workflow sequence based on the access request; wherein the workflow sequence is an operation to be executed that represents the access request application; A second determining unit, configured to obtain a sensitivity level of the workflow sequence and determine a sensitivity level of an operation target corresponding to the workflow sequence; An execution unit is used to compare the sensitivity level of the workflow sequence with the sensitivity level of the operation target, and perform a target operation based on the comparison result, wherein the target operation includes a first operation; wherein the first operation is to allow execution of the operation corresponding to the workflow sequence when the comparison result is that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target.

9. A storage medium, characterized in that: The storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the access control method described in any one of claims 1 to 7.

10. An access control device, characterized in that: The device includes a storage medium; and one or more processors, the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, the access control method described in any one of claims 1-7 is executed.

Images