Access control methods and devices

Abstract

This application discloses an access control method and apparatus, relating to the field of computer technology. The method includes: acquiring an access request and determining at least one corresponding workflow sequence based on the access request; wherein the workflow sequence is an operation to be executed representing the access request; acquiring the sensitivity level of the workflow sequence and determining the sensitivity level of the operation target corresponding to the workflow sequence; comparing the sensitivity level of the workflow sequence with the sensitivity level of the operation target, and executing the target operation based on the comparison result, wherein the target operation includes a first operation; wherein the first operation is to allow the execution of the operation corresponding to the workflow sequence when the comparison result shows that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target. This application is used to implement access control functions.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an access control method and apparatus. Background Technology

[0002] With the development of technology, data access and interaction between devices are becoming increasingly frequent. When a device or cluster receives an access request, the requested party will perform corresponding operations based on the access request, including but not limited to data reading and writing. However, in actual access processes, some data is sensitive and not accessible to all users. If this sensitive data is obtained by unauthorized users, data leakage risks will arise. Therefore, how to manage and control these access behaviors has become an increasingly important issue in the field.

[0003] Currently, existing access control processes generally determine whether an access request should be executed based on the user's identity. If the identity is verified, the access request is allowed. However, in practical applications, if a user's access request involves multiple different operations, and some operations involve sensitive data for which the user does not have the necessary permissions, the access request will be blocked due to identity mismatch, thus affecting the smooth execution of other operations that are valid for the user's identity. Therefore, how to more accurately control access behavior has become an urgent problem to be solved in this field. Summary of the Invention

[0004] This application provides an access control method and apparatus, the main purpose of which is to implement an access control method to solve the problem of poor accuracy in existing access control processes.

[0005] To address the aforementioned technical problems, this application provides the following technical solutions:

[0006] Firstly, this application provides an access control method, the method comprising:

[0007] Obtain an access request and determine at least one corresponding workflow sequence based on the access request; wherein, the workflow sequence is an operation to be executed that represents the access request request.

[0008] Obtain the sensitivity level of the workflow sequence and determine the sensitivity level of the operation target corresponding to the workflow sequence;

[0009] The sensitivity level of the workflow sequence is compared with the sensitivity level of the operation target, and the target operation is executed based on the comparison result. The target operation includes a first operation. The first operation is to allow the operation corresponding to the workflow sequence to be executed when the comparison result is that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target.

[0010] Secondly, this application also provides an access control device, the device comprising:

[0011] The first determining unit is configured to acquire an access request and determine at least one corresponding workflow sequence based on the access request; wherein the workflow sequence is an operation to be executed that represents the access request application;

[0012] The second determining unit is used to obtain the sensitivity level of the workflow sequence and determine the sensitivity level of the operation target corresponding to the workflow sequence;

[0013] An execution unit is configured to compare the sensitivity level of the workflow sequence with the sensitivity level of the operation target, and execute a target operation based on the comparison result. The target operation includes a first operation. The first operation is to allow the execution of the operation corresponding to the workflow sequence when the comparison result is that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target.

[0014] Thirdly, this application also provides a storage medium including a stored program, wherein the program, when running, controls the device where the storage medium is located to execute the access control method described in the first aspect.

[0015] Fourthly, this application also provides an access control device, the device including a storage medium; and one or more processors, the storage medium being coupled to the processors, the processors being configured to execute program instructions stored in the storage medium; the program instructions, when executed, perform the access control method described in any one of the first aspects.

[0016] By employing the above-described technical solution, the technical solution provided in this application has at least the following advantages:

[0017] This application provides an access control method and apparatus. The method first acquires an access request and determines at least one corresponding workflow sequence based on the access request; wherein the workflow sequence is an operation to be executed representing the access request; then, it acquires the sensitivity level of the workflow sequence and determines the sensitivity level of the operation target corresponding to the workflow sequence; finally, it compares the sensitivity level of the workflow sequence with the sensitivity level of the operation target and executes the target operation based on the comparison result, wherein the target operation includes a first operation; wherein the first operation is to allow the execution of the operation corresponding to the workflow sequence when the comparison result shows that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target, thereby realizing the access control function. Compared to existing technologies, this application, during the access control process, can break down the specific operations involved in the access request according to a workflow sequence. This ensures that when a user's access request involves multiple different operations, management can be based on the sensitivity level of the workflow sequence corresponding to each operation. As long as the sensitivity level of the workflow sequence is the same as the sensitivity level of its corresponding operation target, the operation corresponding to the workflow sequence can be executed. This ensures that during the access control process, the implementation of other operations involved in the access request is not affected due to the insufficient sensitivity level of a certain operation. This achieves the function of filtering specific behaviors during the access process, avoiding the problem that other operations are affected by individual operations involving higher-level sensitive data, improving the accuracy of the access control process, and solving the problem of poor accuracy in the access control process of existing technologies.

[0018] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0019] The above and other objects, features, and advantages of exemplary embodiments of this application will become readily understood by reading the following detailed description with reference to the accompanying drawings. In the drawings, several embodiments of this application are illustrated by way of example and not limitation, with the same or corresponding reference numerals denoteing the same or corresponding parts, wherein:

[0020] Figure 1 A flowchart of an access control method provided in an embodiment of this application is shown;

[0021] Figure 2 A flowchart of another access control method provided in an embodiment of this application is shown;

[0022] Figure 3This illustration shows a block diagram of an access control device provided in an embodiment of this application;

[0023] Figure 4 A block diagram of another access control device provided in an embodiment of this application is shown. Detailed Implementation

[0024] Exemplary embodiments of this application will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of this application are shown in the drawings, it should be understood that this application may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of this application and to fully convey the scope of this application to those skilled in the art.

[0025] It should be noted that, unless otherwise stated, the technical or scientific terms used in this application shall have the ordinary meaning as understood by one of ordinary skill in the art to which this application pertains.

[0026] This application provides a flowchart of an access control method, such as... Figure 1 As shown, the method includes:

[0027] 101. Obtain an access request and determine at least one corresponding workflow sequence based on the access request.

[0028] The workflow sequence refers to the pending operations that represent the access request.

[0029] In this embodiment, the target of the access request can be a service device, including a cluster. The specific content requested in the access request includes, but is not limited to, requests for remote data querying and retrieval, remote invocation of related functions or services, remote computation, and other similar needs. There is no limitation on the specific functions / services requested or the number of requested functions / services; they can be selected based on the actual situation.

[0030] Furthermore, in practical applications, since the purpose of an access request is to invoke a remote service cluster to provide corresponding services or functions, a single access request may involve multiple different, more specific operations or events. These operations or events may involve invoking specific lower-level functions or services, or targeting different data, and the importance, or sensitivity, of these data or services varies. Therefore, when managing access requests, analysis can be performed based on the sensitivity of the data or services involved in these operations.

[0031] Therefore, in this embodiment, the currently acquired access request can be broken down according to the requested operation to be executed. Each operation can be represented by a workflow sequence. In other words, an access request can be broken down into multiple different workflow sequences in this manner. For example, when access request A wants to perform a data extraction operation, this extraction operation can be simply broken down into two operations: querying data and extracting data. Each operation can generate a workflow sequence, namely workflow sequence 1 and workflow sequence 2. This realizes the process of breaking down the "large function" requested by the access request into multiple "small functions" of specific actions. Specifically, the process of determining the corresponding workflow sequence based on the access request can be including but not limited to the above method, and the specific execution process can be selected based on actual needs.

[0032] 102. Obtain the sensitivity level of the workflow sequence and determine the sensitivity level of the operation target corresponding to the workflow sequence.

[0033] In the preceding steps, the access request has been "split" into multiple workflow sequences, which is equivalent to breaking down a "large function" into "small functions". Since the operation target of each "small function" may be different, and the sensitivity of its execution behavior may also be different, in this step, the sensitivity level corresponding to each workflow sequence can be obtained. At the same time, it is also necessary to determine the sensitivity level of the object that the workflow sequence actually wants to operate on, that is, the sensitivity level of the operation target.

[0034] It should be noted that, in this embodiment, the sensitivity levels of workflow sequences and operation targets can be pre-tested and generated based on user needs, i.e., based on historical data analysis. For example, when certain data has a high security level and can only be queried and accessed by administrators or quantity engineers, then this type of data can have a higher sensitivity level when used as an operation target. For workflow sequences, historical data analysis can determine which operations are most frequently used in this service cluster, and the sensitivity level of the workflow sequences corresponding to these operations can be lower. Conversely, workflow sequences corresponding to operations involving data security or system security can have a higher sensitivity level. Of course, the setting method in this embodiment is merely exemplary. In practical applications of the access control method described in this embodiment, other methods can also be used, which are not limited here.

[0035] 103. Compare the sensitivity level of the workflow sequence with the sensitivity level of the operation target, and execute the target operation based on the comparison result.

[0036] The target operation includes a first operation; wherein the first operation is to allow the operation corresponding to the workflow sequence to be executed when the comparison result shows that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target.

[0037] After determining the sensitivity levels of the workflow sequence and the operation target, the next step is to compare their sensitivity levels to determine the appropriate target operation. In this embodiment, only when the comparison result shows that the sensitivity level of the current workflow sequence matches that of the operation target can the operation be performed, ensuring that the permissions required for the operation are consistent with the permissions of the data being processed. This allows the operation corresponding to the workflow sequence to proceed smoothly. By comparing the sensitivity levels of the workflow sequence and the operation target for access control, it ensures that when access control involves multiple different workflow sequences, management and control can be based on the permissions of each workflow sequence. This avoids situations where some operations cannot be executed when managing access requests as a whole, thus improving the accuracy of access control.

[0038] Based on this, this embodiment provides an access control method that, compared to existing technologies, can break down the specific operations involved in an access request into a workflow sequence during the access control process. This ensures that when a user's access request involves multiple different operations, management can be based on the sensitivity level of the workflow sequence corresponding to each operation. As long as the sensitivity level of the workflow sequence is the same as the sensitivity level of its corresponding operation target, the operation corresponding to the workflow sequence can be executed. This ensures that during the access control process, the implementation of other operations involved in the access request is not affected due to the insufficient sensitivity level of a certain operation. This achieves the function of filtering specific behaviors during the access process, avoiding the problem that individual operations involving higher-level sensitive data will affect other operations, improving the accuracy of the access control process, and solving the problem of poor accuracy in the access control process of existing technologies.

[0039] Furthermore, as a further description and refinement of the foregoing embodiments, this application also provides an access control, specifically as follows: Figure 2 As shown:

[0040] 201. Obtain historical access data and parse the business behavior involved in each historical request from the historical access data.

[0041] In cluster service systems, different scenarios typically involve different business operations, and the specific operations to be performed for each business are not entirely the same. In this embodiment, when performing access control on access requests received by the cluster service system, historical data can be used to analyze the actual operations involved in each request and their corresponding relationships. This allows for the direct determination of the workflow sequence corresponding to subsequent access requests. Specifically, this step involves analyzing historical access data to identify the business behaviors involved in each previously occurring access request, i.e., the business behaviors involved in historical requests.

[0042] 202. Determine at least one workflow sequence corresponding to each business behavior, and establish a corresponding relationship to obtain a preset mapping relationship.

[0043] Since each business behavior can actually consist of multiple different operations, as can be seen from the description of the foregoing embodiments, the workflow sequence can represent an operation. Therefore, the workflow sequence can be used to represent each business behavior and record the relationship between them for use in subsequent steps.

[0044] In some embodiments, to simplify the description of workflow sequences, they can also be based on attributes involved in specific operations. Therefore, in this step, "determining at least one workflow sequence corresponding to each business behavior and establishing a corresponding relationship to obtain a preset mapping relationship" can be executed as follows:

[0045] First, determine at least one underlying operation corresponding to each business behavior, and obtain the attribute information of each underlying operation, wherein the underlying operation is the specific operation required to implement the business behavior; the attribute information includes at least one of the following: container information to be accessed, behavior information to be executed, and operation target information.

[0046] Then, based on at least one of the attribute information, a workflow sequence corresponding to each historical request is generated, and the corresponding relationship is recorded to obtain the preset mapping relationship.

[0047] In this way, by using the "business behavior - underlying operation - attribute information" approach, the process of breaking down business behavior into characteristic information of different operations is realized. That is, the process of generating a workflow sequence by using the container information to be accessed, the behavior information to be executed, and the operation target information in the attribute information involved in the underlying operation. This can ensure that it represents the overall meaning of the business behavior and also reflects each specific operation involved in a business behavior.

[0048] For example, in this embodiment, suppose that business behavior A is determined to have two corresponding workflow sequences according to the method in this step: workflow sequence 1 "Container 1; Query; Data X" and workflow sequence 2 "Copy". This means that this business behavior actually uses the function of container 1 to find data X and then copies it after finding the data X.

[0049] Of course, in some cases, due to differences in compiled languages, operating systems, etc., certain operations are actually multiple operational behaviors. In such cases, when determining the underlying operation, these multiple specific operational behaviors can be combined into one operation. For example, continuing with the aforementioned business behavior A, when the copy operation in the system involves querying and copying operations executed by a single instruction or function, then it is not necessary to split them into two underlying operations. Instead, they are treated as a single underlying operation. Following the method in this step, the final workflow sequence determined for business behavior A is only one, namely workflow sequence 3 "[container 1; query; data X]; [copy]", recording the correspondence between business behavior A and workflow sequence 3. Here, the process of determining business behaviors as underlying operations and determining their corresponding workflow sequences can be carried out using any of the methods described above. Specifically, the number and method of workflow sequences that each business behavior can be "split" into are not limited, and are subject to the actual operating system or compiled language.

[0050] 203. Determine the sensitivity level of the workflow sequence based on the operational behaviors involved in the workflow sequence.

[0051] Before performing access control based on the sensitivity level of the workflow sequence and the sensitivity level of the operation target in this embodiment, the sensitivity level of each workflow sequence and operation target can be set in advance in accordance with the method of this step 203 and subsequent step 204.

[0052] Specifically, this step can be performed as follows:

[0053] Step A: When the workflow sequence includes information about the container to be accessed, information about the behavior to be executed, and information about the operation target, the sensitivity index of the container to be accessed, the sensitivity index of the behavior to be executed, and the sensitivity index of the operation target are obtained respectively; wherein, the container to be accessed is determined based on the information about the container to be accessed. As described above in the embodiments, the workflow sequence may include the involved containers, the behavior to be executed, and the targeted data. Therefore, in this step, sensitivity indices can be set for these three elements. These sensitivity indices can be understood as a quantitative way to characterize the sensitivity of the container, operation, or data. Of course, in this embodiment, the higher the sensitivity index, the more protection the data or container requires; conversely, the lower the sensitivity index, the lower its importance and the less stringent the protection required.

[0054] Step B: Determine a sensitivity score based on the sensitivity indices of the container to be accessed, the behavior to be executed, and the operation target, and determine the sensitivity level of the workflow sequence based on the sensitivity score. After determining the sensitivity indices of the container to be accessed, the behavior to be executed, and the operation target, the sensitivity level of the workflow sequence can be determined based on these three sensitivity indices. Specifically, a score representing the sensitivity level of the current workflow sequence can be determined based on the three sensitivity indices, and its sensitivity level can be determined based on this score. This realizes the function of determining the sensitivity level of a workflow sequence by quantifying the score, making the sensitivity level determination process more intuitive and scientific.

[0055] Furthermore, in this step, step B, "determining a sensitivity score based on the sensitivity index of the container to be accessed, the sensitivity index of the behavior to be executed, and the sensitivity index of the operation target, and determining the sensitivity level of the workflow sequence based on the sensitivity score," can be performed in either of the following two ways:

[0056] Method 1: Obtain the security level of the container to be accessed, the security level of the behavior to be executed, and the security level of the operation target, respectively. Determine the sensitivity score based on the highest security level, and then determine the corresponding sensitivity level in a preset level score table as the sensitivity level of the workflow sequence. By analyzing the security levels of these three entities and assigning the highest security level as the sensitivity score, it can be ensured that when any important behavior, container, or behavior target is set to a high security level, it will not be affected by other lower-level security levels. This ensures that the sensitivity level of the workflow sequence is directly influenced by its highest-level container, behavior, or operation target. Consequently, when determining the sensitivity level later, adjusting only the security level of the underlying operation's attribute information can affect the sensitivity of the entire workflow sequence, simplifying the operation process.

[0057] Method 2: Obtain the score weights of the container to be accessed, the behavior to be executed, and the operation target, respectively. Determine the sensitivity score based on the container score, behavior score, and operation target score. Then, determine the sensitivity level corresponding to the sensitivity score in a preset level score table as the sensitivity level of the workflow sequence. Specifically, the container score is calculated based on the score weight of the container to be accessed and its sensitivity index; the behavior score is calculated based on the score weight of the behavior to be executed and its sensitivity index; and the operation target score is calculated based on its score weight and sensitivity index. By calculating the scores of each of the three elements using their respective sensitivity indices and corresponding weights, and then determining the sensitivity level based on the total score, it ensures that while comprehensively considering the sensitivity of the container to be accessed, the behavior to be executed, and the operation target, the different levels of importance (weights) of each element also affect the overall result. This ensures a more accurate determination of the sensitivity of the workflow sequence representing the operation behavior.

[0058] Specifically, the weights can be set in a 2:1:1 ratio, meaning the container to be accessed is the most important, followed by the action and operation target. This allows the container to be prioritized in controlling the access process when it is of higher importance.

[0059] 204. Determine the sensitivity level of each operational target based on the data security level of the operational target.

[0060] The operation target includes the data to be operated on; the sensitivity level of the operation target is positively correlated with the data security level of the operation target.

[0061] In this step, all data related to business activities in the cluster service system can be used as operation targets to set corresponding sensitivity levels. Specifically, the sensitivity level can be set according to the data security level of each data. For example, a higher sensitivity level can be set for more sensitive core data, while a lower sensitivity level can be set for a lot of commonly disclosed data.

[0062] 205. Obtain an access request and determine at least one corresponding workflow sequence based on the access request.

[0063] The workflow sequence refers to the pending operations that represent the access request.

[0064] Specifically, based on the description of the aforementioned steps, since the workflow sequence has a pre-established correspondence based on business behavior, i.e., a preset mapping relationship, in this step, when an access request is obtained, its corresponding workflow sequence can be determined through this preset mapping relationship.

[0065] Based on this, in this step, "determining at least one corresponding workflow sequence based on the access request" can be specifically executed as follows: determining the corresponding target business behavior according to the access request, and determining the workflow sequence of the corresponding target business behavior in the preset mapping relationship.

[0066] In this way, by determining the workflow sequence corresponding to the access request through a preset mapping relationship, the process of determining the underlying operations involved in the access request is eliminated, thereby simplifying the process of determining the workflow sequence and improving the overall efficiency of the access control described in this embodiment.

[0067] Furthermore, based on the aforementioned steps, it is clear that the functions involved in the access request actually correspond to different containers. Since containers themselves have different security levels, some containers may not involve functions related to the use of sensitive data, while others may. Therefore, before executing step 205, the container information corresponding to the workflow sequence in the access request can be analyzed. If it is determined that the container involved belongs to a container with operations related to sensitive data, then the subsequent steps are executed; otherwise, the subsequent steps can be skipped, and the access request can be executed directly. This ensures that containers involving sensitive data can be managed and controlled based on subsequent steps when an access request is made, and also ensures that when the access request itself does not involve sensitive data, it can be executed directly, saving the process of subsequent analysis and management, thus improving access efficiency.

[0068] 206. Obtain the sensitivity level of the workflow sequence and determine the sensitivity level of the operation target corresponding to the workflow sequence.

[0069] As described in the preceding steps, since corresponding sensitivity levels are set for all possible workflow sequences in advance, and all data related to business behavior in the cluster service system is also set with sensitivity levels, in this embodiment, the data can be obtained directly based on the sensitivity levels set in the preceding steps.

[0070] 207. Compare the sensitivity level of the workflow sequence with the sensitivity level of the operation target, and execute the target operation based on the comparison result.

[0071] The target operation includes a first operation; specifically, the first operation is to allow the operation corresponding to the workflow sequence to be executed when the comparison result shows that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target.

[0072] In some embodiments, the target operation further includes a second operation; the second operation is used to perform the data reading behavior in the access request;

[0073] Based on this, in this step, comparing the sensitivity level of the workflow sequence with the sensitivity level of the operation target, and executing the target operation based on the comparison result, may include the following during execution:

[0074] The sensitivity level of the workflow sequence is compared with the sensitivity level of the operation target. When it is determined that the sensitivity level of the workflow sequence is higher than the sensitivity level of the operation target, a second operation is performed. The second operation is used to perform the data reading behavior in the access request.

[0075] In this step, when the sensitivity level of a workflow sequence is determined to be higher than the sensitivity level of the data it is meant to manipulate (the target of the operation), it indicates that some of the multiple actions involved in the workflow sequence may be targeting a higher-sensitivity target, rather than the target being operated on. Ideally, however, the sensitivity levels set for the target and the corresponding workflow sequences should correspond. If the sensitivity level of a workflow sequence exceeds the sensitivity level of the target it intends to execute, the access request may be forged by hackers or other attackers to prevent them from performing operations such as writing to certain data. To prevent internal system data from being tampered with, in this embodiment, when the sensitivity level of a workflow sequence is higher than that of the operation target, only the second operation can be executed, allowing only its read behavior. This not only prevents some personnel from forging workflow sequences with higher sensitivity levels to tamper with data, but also ensures that if some staff members request access to the wrong operation target, they can know the content and understand why the operation corresponding to the workflow sequence they requested could not be executed successfully. This improves security and allows staff members who make mistakes to read the content of the target they wanted to operate on, which is beneficial for re-initiating requests in the future.

[0076] It should be noted that in this embodiment, the target operation may further include a third operation. This third operation is used to allow the execution of non-data export behavior when the comparison result determines that the sensitivity level of the workflow sequence is lower than the sensitivity level of the operation target. This non-data export behavior can be understood as not feeding back relevant internal system data to the requesting party. For example, certain functional behaviors are allowed, such as calling a function to perform remote calculation. In this process, the internal system data will not be exported, but will be executed based on certain functions. The data operated on in this process can actually be provided by the requesting party. This ensures that such users can still use some remote service functions of this system without setting a high sensitivity level for their workflow sequence, thereby improving convenience and practicality.

[0077] Furthermore, as a response to the above Figure 1 and Figure 2 In addition to the implementation of the method shown, another embodiment of this application also provides an access control device. This device embodiment corresponds to the foregoing method embodiment. For ease of reading, this device embodiment will not repeat the details of the foregoing method embodiment, but it should be understood that the device in this embodiment can implement all the contents of the foregoing method embodiment. This device is specifically designed to implement an access control method as follows: Figure 3 As shown, the device includes:

[0078] The first determining unit 31 can be used to obtain an access request and determine at least one corresponding workflow sequence based on the access request; wherein, the workflow sequence is an operation to be executed that represents the access request application;

[0079] The second determining unit 32 can be used to obtain the sensitivity level of the workflow sequence determined by the first determining unit 31, and determine the sensitivity level of the operation target corresponding to the workflow sequence;

[0080] The execution unit 33 can be used to compare the sensitivity level of the workflow sequence determined by the second determining unit 32 with the sensitivity level of the operation target determined by the second determining unit 32, and execute the target operation based on the comparison result. The target operation includes a first operation. The first operation is to allow the operation corresponding to the workflow sequence to be executed when the comparison result is that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target.

[0081] Furthermore, such as Figure 4 As shown, the device further includes:

[0082] The parsing unit 34 can be used to obtain historical access data and parse the business behavior involved in each historical request from the historical access data;

[0083] The construction unit 35 can be used to determine at least one workflow sequence corresponding to each business behavior obtained by the parsing unit 34, and establish a correspondence to obtain a preset mapping relationship;

[0084] The first determining unit 31 can be specifically used to determine the corresponding target business behavior based on the access request, and to determine the workflow sequence of the corresponding target business behavior in the preset mapping relationship obtained by the building unit 35.

[0085] Furthermore, such as Figure 4 As shown, the construction unit 35 can also be used to determine at least one underlying operation corresponding to each business behavior, and obtain attribute information for each underlying operation, wherein the underlying operation is the specific operation behavior required to implement the business behavior; the attribute information includes at least one of the following: container information to be accessed, behavior information to be executed, and operation target information; and, based on at least one of the attribute information, to generate a workflow sequence corresponding to each historical request, and record the corresponding relationship to obtain the preset mapping relationship.

[0086] Furthermore, such as Figure 4 As shown, the device further includes:

[0087] The third determining unit 36 ​​can be used to determine the sensitivity level of the workflow sequence based on the operational behaviors involved in the workflow sequence;

[0088] The fourth determining unit 37 can be used to determine the sensitivity level of each operation target according to the data security level of the operation target; the operation target includes the data to be operated; the sensitivity level of the operation target is positively correlated with the data security level of the operation target.

[0089] Furthermore, such as Figure 4 As shown, the third determining unit 36 ​​can be specifically used to obtain the sensitivity index of the container to be accessed, the sensitivity index of the behavior to be executed, and the sensitivity index of the operation target respectively when the workflow sequence contains information about the container to be accessed, information about the behavior to be executed, and information about the operation target; wherein the container to be accessed is determined based on the information about the container to be accessed; and, a sensitivity score is determined based on the sensitivity index of the container to be accessed, the sensitivity index of the behavior to be executed, and the sensitivity index of the operation target, and the sensitivity level of the workflow sequence is determined based on the sensitivity score.

[0090] Furthermore, such as Figure 4As shown, the third determining unit 36 ​​can also be used to obtain the security level of the container to be accessed, the security level of the behavior to be executed, and the security level of the operation target, respectively, and determine the sensitivity index of the highest security level as the sensitivity score, and determine the sensitivity level corresponding to the sensitivity score in the preset level score table as the sensitivity level of the workflow sequence.

[0091] The third determining unit 36 ​​can also be specifically used to obtain the score weight of the container to be accessed, the score weight of the behavior to be executed, and the score weight of the operation target, and determine the sensitivity score based on the container score, behavior score, and operation target score, and determine the sensitivity level corresponding to the sensitivity score in a preset level score table as the sensitivity level of the workflow sequence; wherein, the container score is calculated based on the score weight of the container to be accessed and the sensitivity index of the container to be accessed; the behavior score is calculated based on the score weight of the behavior to be executed and the sensitivity index of the behavior to be executed; and the operation target score is calculated based on the score weight of the operation target and the sensitivity index of the operation target.

[0092] Furthermore, such as Figure 4 As shown, the target operation further includes a second operation; the second operation can be used to perform the data reading behavior in the access request;

[0093] The execution unit 33 can also be used to compare the sensitivity level of the workflow sequence with the sensitivity level of the operation target. When it is determined that the sensitivity level of the workflow sequence is higher than the sensitivity level of the operation target, a second operation is performed. The second operation can be used to perform the data reading behavior in the access request.

[0094] To achieve the above objectives, according to another aspect of this application, an embodiment of this application also provides a storage medium, the storage medium including a stored program, wherein, when the program is running, it controls the device where the storage medium is located to execute the access control method described above.

[0095] To achieve the above objectives, according to another aspect of this application, an access control device is also provided, the device including a storage medium; and one or more processors, the storage medium being coupled to the processors, the processors being configured to execute program instructions stored in the storage medium; the program instructions executing the access control method described above.

[0096] This application provides an access control method and apparatus. In this embodiment, an access request is first acquired, and at least one corresponding workflow sequence is determined based on the access request. The workflow sequence represents the operation to be executed in response to the access request. Then, the sensitivity level of the workflow sequence is acquired, and the sensitivity level of the operation target corresponding to the workflow sequence is determined. Finally, the sensitivity level of the workflow sequence is compared with the sensitivity level of the operation target, and the target operation is executed based on the comparison result. The target operation includes a first operation. The first operation allows the execution of the operation corresponding to the workflow sequence when the comparison result indicates that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target, thereby achieving access control functionality. Compared to existing technologies, in this embodiment, the access control process can be broken down into specific operations involved in the access request according to a workflow sequence. This ensures that when a user's access request involves multiple different operations, management can be based on the sensitivity level of the workflow sequence corresponding to each operation. As long as the sensitivity level of the workflow sequence is the same as the sensitivity level of its corresponding operation target, the operation corresponding to the workflow sequence can be executed. This ensures that the access control process avoids the implementation of other operations involved in the access request being affected by the insufficient sensitivity level of a certain operation. This achieves the function of filtering specific behaviors during the access process, avoiding the problem that individual operations involving higher-level sensitive data will affect other operations, improving the accuracy of the access control process, and solving the problem of poor accuracy in the access control process of existing technologies.

[0097] The access control device includes a processor and a memory. The first determining unit, the second determining unit, and the execution unit are all stored in the memory as program units. The processor executes the program units stored in the memory to achieve the corresponding functions.

[0098] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and by adjusting kernel parameters, an access control method can be implemented to address the problem of poor accuracy in existing access control processes.

[0099] This application provides an access control device, the device including a storage medium and one or more processors, the storage medium being coupled to the processors, the processors being configured to execute program instructions stored in the storage medium; the program instructions, when executed, perform the access control method described in any of the preceding claims.

[0100] This application provides a storage medium that includes a stored program, wherein the program, when running, controls the device where the storage medium is located to execute the access control method described above.

[0101] Storage media may include non-permanent memory in the form of computer-readable media, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0102] This application provides an apparatus including a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it performs the following steps: acquiring an access request and determining at least one corresponding workflow sequence based on the access request; wherein the workflow sequence is an operation to be executed representing the access request; acquiring the sensitivity level of the workflow sequence and determining the sensitivity level of the operation target corresponding to the workflow sequence; comparing the sensitivity level of the workflow sequence with the sensitivity level of the operation target, and executing the target operation based on the comparison result, wherein the target operation includes a first operation; wherein the first operation is to allow the execution of the operation corresponding to the workflow sequence when the comparison result shows that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target.

[0103] Furthermore, prior to obtaining the access request, the method further includes:

[0104] Obtain historical access data and parse the business behaviors involved in each historical request from the historical access data;

[0105] Determine at least one workflow sequence corresponding to each business behavior, establish a corresponding relationship, and obtain a preset mapping relationship;

[0106] Determining at least one corresponding workflow sequence based on the access request includes:

[0107] The corresponding target business behavior is determined based on the access request, and the workflow sequence of the corresponding target business behavior is determined in the preset mapping relationship.

[0108] Furthermore, determining at least one workflow sequence corresponding to each business behavior and establishing a corresponding relationship to obtain a preset mapping relationship includes:

[0109] Each business behavior corresponds to at least one underlying operation, and attribute information of each underlying operation is obtained, wherein the underlying operation is the specific operation required to implement the business behavior; the attribute information includes at least one of the following: container information to be accessed, behavior information to be executed, and operation target information.

[0110] Based on at least one of the attribute information, a workflow sequence corresponding to each historical request is generated, and the corresponding relationship is recorded to obtain the preset mapping relationship.

[0111] Furthermore, before obtaining the sensitivity level of the workflow sequence and determining the sensitivity level of the operation target corresponding to the workflow sequence, the method further includes:

[0112] The sensitivity level of the workflow sequence is determined based on the operational behaviors involved in the workflow sequence;

[0113] The sensitivity level of each operation target is determined according to the data security level of the operation target; the operation target includes the data to be operated; the sensitivity level of the operation target is positively correlated with the data security level of the operation target.

[0114] Furthermore, determining the sensitivity level of the workflow sequence based on the operational behaviors involved in the workflow sequence includes:

[0115] When the workflow sequence contains information about the container to be accessed, information about the behavior to be executed, and information about the operation target, the sensitivity index of the container to be accessed, the sensitivity index of the behavior to be executed, and the sensitivity index of the operation target are obtained respectively; wherein, the container to be accessed is determined based on the information about the container to be accessed.

[0116] A sensitivity score is determined based on the sensitivity index of the container to be accessed, the sensitivity index of the behavior to be performed, and the sensitivity index of the operation target, and the sensitivity level of the workflow sequence is determined based on the sensitivity score.

[0117] Furthermore, determining a sensitivity score based on the sensitivity index of the container to be accessed, the sensitivity index of the behavior to be executed, and the sensitivity index of the operation target, and determining the sensitivity level of the workflow sequence based on the sensitivity score, includes:

[0118] The security level of the container to be accessed, the security level of the behavior to be executed, and the security level of the operation target are obtained respectively. The sensitivity index of the highest security level is determined as the sensitivity score, and the sensitivity level corresponding to the sensitivity score is determined in the preset level score table as the sensitivity level of the workflow sequence.

[0119] or,

[0120] The score weights of the container to be accessed, the behavior to be executed, and the operation target are obtained respectively. The sensitivity score is determined based on the container score, behavior score, and operation target score. The sensitivity level corresponding to the sensitivity score is determined in a preset level score table as the sensitivity level of the workflow sequence. The container score is calculated based on the score weight of the container to be accessed and the sensitivity index of the container to be accessed. The behavior score is calculated based on the score weight of the behavior to be executed and the sensitivity index of the behavior to be executed. The operation target score is calculated based on the score weight of the operation target and the sensitivity index of the operation target.

[0121] Furthermore, the target operation also includes a second operation; the second operation is used to perform the data reading behavior in the access request;

[0122] The step of comparing the sensitivity level of the workflow sequence with the sensitivity level of the operation target, and performing the target operation based on the comparison result, includes:

[0123] The sensitivity level of the workflow sequence is compared with the sensitivity level of the operation target. When it is determined that the sensitivity level of the workflow sequence is higher than the sensitivity level of the operation target, a second operation is performed. The second operation is used to perform the data reading behavior in the access request.

[0124] This application also provides a computer program product capable of performing corresponding functions, including: acquiring an access request and determining at least one corresponding workflow sequence based on the access request; wherein the workflow sequence is an operation to be executed representing the access request; acquiring the sensitivity level of the workflow sequence and determining the sensitivity level of the operation target corresponding to the workflow sequence; comparing the sensitivity level of the workflow sequence with the sensitivity level of the operation target, and executing the target operation based on the comparison result, wherein the target operation includes a first operation; wherein the first operation is to allow the execution of the operation corresponding to the workflow sequence when the comparison result is that the sensitivity level of the workflow sequence is the same as the sensitivity level of the operation target.

[0125] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0126] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0127] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0128] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0129] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0130] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0131] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0132] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0133] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0134] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. An access control method characterized by, The method comprises: acquiring an access request and determining at least one corresponding workflow sequence based on the access request, wherein the workflow sequence represents a to-be-executed operation of the access request application; when the workflow sequence contains container information to be accessed, behavior information to be executed, and operation target information, acquiring a sensitive index of the to-be-accessed container, a sensitive index of the to-be-executed behavior, and a sensitive index of the operation target respectively, wherein the to-be-accessed container is determined based on the to-be-accessed container information; determining a sensitive score based on the sensitive index of the to-be-accessed container, the sensitive index of the to-be-executed behavior, and the sensitive index of the operation target, and determining a sensitive level of the workflow sequence based on the sensitive score; determining a sensitive level of each operation target according to a data security level of the operation target, wherein the operation target includes to-be-operated data, and the sensitive level of the operation target is positively correlated with the data security level of the operation target; comparing the sensitive level of the workflow sequence with the sensitive level of the operation target, and performing a target operation based on the comparison result, wherein the target operation includes a first operation; when the comparison result is that the sensitive level of the workflow sequence is the same as the sensitive level of the operation target, the first operation allows the execution of the operation corresponding to the workflow sequence.

2. The method of claim 1, wherein, Before the access request is acquired, the method further comprises: acquiring historical access data and parsing a business behavior involved in each historical request in the historical access data; determining at least one workflow sequence corresponding to each business behavior and establishing a corresponding relationship to obtain a preset mapping relationship; the determination of the at least one corresponding workflow sequence based on the access request comprises: determining a corresponding target business behavior according to the access request, and determining a workflow sequence of the corresponding target business behavior in the preset mapping relationship.

3. The method of claim 2, wherein, the determination of the at least one workflow sequence corresponding to each business behavior and the establishment of the corresponding relationship to obtain the preset mapping relationship comprise: determining at least one bottom operation corresponding to each business behavior respectively, and acquiring attribute information of each bottom operation, wherein the bottom operation is a specific operation behavior required to realize the business behavior; and the attribute information at least includes one of to-be-accessed container information, to-be-executed behavior information, and operation target information; generating a workflow sequence corresponding to each historical request based on at least one attribute information, and recording a corresponding relationship to obtain the preset mapping relationship.

4. The method of claim 1, wherein, the determination of the sensitive score based on the sensitive index of the to-be-accessed container, the sensitive index of the to-be-executed behavior, and the sensitive index of the operation target, and the determination of the sensitive level of the workflow sequence based on the sensitive score comprise: acquiring a security level of the to-be-accessed container, a security level of the to-be-executed behavior, and a security level of the operation target respectively, determining the sensitive index of the one with the highest security level as the sensitive score, and determining a sensitive level corresponding to the sensitive score in a preset level score table as the sensitive level of the workflow sequence; or The score weight of the container to be accessed, the score weight of the behavior to be executed, and the score weight of the operation target are obtained respectively, and the sensitive score is determined based on the container score, the behavior score, and the operation target score, and a sensitive level corresponding to the sensitive score in a preset level score table is determined as the sensitive level of the workflow sequence; the container score is calculated based on the score weight of the container to be accessed and the sensitive index of the container to be accessed; the behavior score is calculated based on the score weight of the behavior to be executed and the sensitive index of the behavior to be executed; and the operation target score is calculated based on the score weight of the operation target and the sensitive index of the operation target.

5. The method of claim 1, wherein, The target operation further includes a second operation; and the second operation is used to execute a data reading behavior in the access request. The comparison of the sensitive level of the workflow sequence and the sensitive level of the operation target, and the execution of the target operation based on the comparison result include: The comparison of the sensitive level of the workflow sequence and the sensitive level of the operation target is performed, and when it is determined that the comparison result is that the sensitive level of the workflow sequence is higher than the sensitive level of the operation target, a second operation is executed, and the second operation is used to execute a data reading behavior in the access request.

6. An access control device, characterized by The apparatus includes: A first determination unit is configured to obtain an access request and determine a corresponding at least one workflow sequence based on the access request; wherein the workflow sequence represents a to-be-executed operation of the access request application; A second determination unit is configured to obtain a sensitive index of a to-be-accessed container, a sensitive index of a to-be-executed behavior, and a sensitive index of an operation target when the workflow sequence contains to-be-accessed container information, to-be-executed behavior information, and operation target information, wherein the to-be-accessed container is determined based on the to-be-accessed container information, a sensitive score is determined based on the sensitive index of the to-be-accessed container, the sensitive index of the to-be-executed behavior, and the sensitive index of the operation target, and a sensitive level of the workflow sequence is determined based on the sensitive score; and a sensitive level of each operation target is determined according to a data security degree of the operation target, the operation target includes to-be-operated data, and the sensitive level of the operation target is positively correlated with the data security degree of the operation target. An execution unit is configured to compare the sensitive level of the workflow sequence and the sensitive level of the operation target, and execute a target operation based on a comparison result, wherein the target operation includes a first operation; and the first operation is used to allow the execution of the operation corresponding to the workflow sequence when the comparison result is that the sensitive level of the workflow sequence is the same as the sensitive level of the operation target.

7. A storage medium, characterized by The storage medium includes a stored program, wherein the program controls a device where the storage medium is located to execute the access control method in any one of claims 1-5 when the program is running.

8. An access control device, characterized by The device comprises a storage medium and one or more processors, the storage medium is coupled with the processors, the processors are configured to execute program instructions stored in the storage medium; the program instructions perform the access control method in any one of claims 1-5 when running.

Images