Access control method and device

Abstract

The invention discloses an access control method and device, and relates to the technical field of computers. The method comprises the steps of obtaining an access request, wherein the access request comprises a to-be-accessed container and a to-be-executed operation behavior; obtaining an access control strategy from a preset shared memory area, and determining whether the access request conforms to the access control strategy or not; wherein the access control strategy is used for determining operation behaviors allowed to be executed in each container; if yes, executing the access request; and if not, forbidding the access request. The method is used for realizing an access control function.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an access control method and device. Background Art

[0002] With the development of technology, data access and interaction between devices are becoming more frequent. When a device or cluster receives an access request, the requested party will perform corresponding operations based on the access request, including but not limited to data transmission, remote computing, etc. However, in the actual access process, some access requests themselves will affect the data security of the accessed device or cluster. Therefore, when faced with a large number of access requests, how to manage and control these access behaviors has become an issue that people in the field are gradually paying attention to.

[0003] At present, in the existing access control process, access requests are generally analyzed and identified by setting some simple rules, from which problematic access requests are determined and processed. However, in actual applications, the existing access control method only performs a simple analysis at the behavioral level of the access request, but ignores the different impacts of certain operations in different areas. For example, in container A, certain operations are allowed to be executed, but for container B, the same operation may pose a greater security risk. In this way, it is very easy to ignore such situations and cause data security risks in the existing access control process. Based on this, how to control access behavior more accurately has become an urgent problem to be solved in the field. Summary of the invention

[0004] The embodiments of the present application provide an access control method and device, the main purpose of which is to implement an access control method to solve the problem of poor access control accuracy and prone to data security risks in the existing access control process.

[0005] In order to solve the above technical problems, the embodiments of the present application provide the following technical solutions:

[0006] In a first aspect, the present application provides an access control method, the method comprising:

[0007] Obtaining an access request, where the access request includes a container to be accessed and an operation to be performed;

[0008] Obtaining an access control policy from a preset shared memory area, and determining whether the access request complies with the access control policy; wherein the access control policy is used to determine the operation behavior allowed to be executed in each container;

[0009] If it meets the requirements, the access request is executed;

[0010] If not, the access request is prohibited.

[0011] In a second aspect, the present application further provides an access control device, the device comprising:

[0012] An acquisition unit, configured to acquire an access request, wherein the access request includes a container to be accessed and an operation behavior to be performed;

[0013] A determination unit, configured to obtain an access control policy from a preset shared memory area and determine whether the access request complies with the access control policy; wherein the access control policy is used to determine the operation behavior allowed to be executed in each container;

[0014] A first execution unit, configured to execute the access request if it is determined that the access request complies with the access control policy;

[0015] The second execution unit is configured to prohibit the access request if it is determined that the access request does not comply with the access control policy.

[0016] In a third aspect, the present application further provides a storage medium, which includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the access control method described in the first aspect.

[0017] In a fourth aspect, the present application also provides an access control device, comprising a storage medium; and one or more processors, wherein the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, the access control method described in any one of the first aspects is executed.

[0018] By means of the above technical solution, the technical solution provided by this application has at least the following advantages:

[0019] The present application provides an access control method and device. The present application can first obtain an access request, wherein the access request includes a container to be accessed and an operation behavior to be executed; then, obtain an access control policy from a preset shared memory area, and determine whether the access request complies with the access control policy; wherein the access control policy is used to determine the operation behavior allowed to be executed in each container; finally, if it complies, the access request is executed, otherwise, if it does not comply, the access request is prohibited, thereby realizing the access control function. Compared with the prior art, in the access control process of the present application, the access control process can be verified from both the computing and application dimensions. In this way, in the access control process, it can be ensured that no matter what kind of access request is, whether it can be allowed to be executed can be analyzed according to the container to be accessed and the operation behavior to be performed. In this way, the security of the access request can be determined from the container level, avoiding the impact of certain operations on data security when executed in individual containers, so that the access request can be controlled based on the operation behaviors allowed to be executed in different containers, which solves the problem that in the prior art, when access requests are managed only from the operation behavior, some access requests may cause data security to be affected when executed in individual containers. While improving the security of access request control, different containers can also be controlled separately by access control policies, thereby realizing the function of more flexible management of access request control.

[0020] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] By reading the detailed description below with reference to the accompanying drawings, the above and other purposes, features and advantages of the exemplary embodiments of the present application will become easy to understand. In the accompanying drawings, several embodiments of the present application are shown in an exemplary and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0022] Figure 1 A flow chart of an access control method provided by an embodiment of the present application is shown;

[0023] Figure 2 Another access control method flow chart provided by an embodiment of the present application is shown;

[0024] Figure 3 A block diagram of an access control device provided by an embodiment of the present application is shown;

[0025] Figure 4A composition block diagram of another access control device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0026] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0027] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by technicians in the field to which this application belongs.

[0028] The present application embodiment provides a flowchart of an access control method, such as Figure 1 As shown, the method includes:

[0029] 101. Get access request.

[0030] The access request includes the container to be accessed and the operation behavior to be performed.

[0031] In this embodiment, the target of the access request may be a service device including a cluster. The specific content requested by the access request includes but is not limited to remote data query and acquisition, remote invocation of related functions or services, remote computing and other requests of different requirements. Here, there is no limitation on the specific functions / services requested by the access request and the number of the requested functions / services, which can be selected based on actual conditions.

[0032] In addition, in actual applications, different functions or services are separately set in different containers in service devices such as clusters. That is to say, when a user sends an access request to the cluster on a local device, the functions or services requested for different needs are different, so the targeted containers and the operations to be performed in the containers are also different. Therefore, in this step, the access request can be specifically regarded as two parts, one part is used to determine the container to be accessed, and the other part is used to determine the operation behavior to be performed in the container.

[0033] 102. Obtain an access control policy from a preset shared memory area, and determine whether the access request complies with the access control policy.

[0034] The access control policy is used to determine the operation behaviors that are allowed to be executed in each container.

[0035] In this embodiment, the preset shared memory area can be understood as an area dedicated to storing and sharing data content in the cluster system or access control system deployed by the method described in this embodiment. The preset shared memory area stores an access control policy, which is used for the operation behavior that the container corresponding to each function or service of the node in the current cluster system or access control system is allowed to execute when accessed by the outside world, so that the access control policy can be used to determine whether the access request from the outside world can be allowed to execute.

[0036] Based on the judgment result, when it is determined that the access request complies with the access control policy, step 103 is executed; otherwise, when it is determined that it does not comply with the access control policy, step 104 is executed.

[0037] 103. If it is in compliance, execute the access request.

[0038] When it is determined that the access request complies with the access control policy, it means that the container to be accessed and the operation behavior to be executed corresponding to the access request are consistent with the operation behavior allowed to be executed in the same container in the access control policy. At this time, for the staff who set the access control policy, this access request will not affect or endanger the data security of the cluster. Therefore, such an access request can be executed.

[0039] 104. If not, prohibit the access request.

[0040] When it is determined that the access request does not comply with the access control policy, it means that either the container involved in the access request is not in the access control policy, that is, the access request wants to access a container that is not allowed to be accessed, or the operation behavior to be performed in the container by the access request is inconsistent with the operation behavior allowed to be performed in the access control policy. For these two situations, no matter which one, it means that the behavior of the access request should not be executed, so the access request needs to be prohibited according to the method in this step.

[0041] Based on this, the present embodiment provides an access control method. Compared with the prior art, in the present application, during the access control process, the access control process can be verified from both the computing and application dimensions, so that during the access control process, it can be ensured that no matter what kind of access request is, whether it can be allowed to be executed can be analyzed according to the container to be accessed and the operation behavior to be executed, so that the security of the access request can be determined from the container level, avoiding the impact of certain operations on data security when executed in individual containers, so that the access request can be controlled based on the operation behaviors allowed to be executed in different containers, solving the problem that in the prior art, when access requests are managed only from the operation behavior, some access requests may cause data security to be affected when executed in individual containers, while improving the security of access request control, and different containers can be controlled separately by access control policies, thereby realizing the function of managing the control of access requests more flexibly.

[0042] Furthermore, as a further description and refinement of the above-mentioned embodiment, the present application also provides an access control, specifically as follows Figure 2 As shown:

[0043] 201. Get access request.

[0044] The access request includes the container to be accessed and the operation behavior to be performed.

[0045] The cluster system or access control system deployed by the access control method described in this embodiment is divided into two levels, one is the kernel layer, and the other is the user layer, wherein the kernel layer is used to monitor and manage the operation of the container, and the user layer is used to receive data input from the outside and receive feedback information obtained after the kernel layer processes the container-related operations. Specifically, in the user layer, newly added or modified access control policies can be received from the outside, and the processing and audit results of the relevant data during the container runtime in the kernel layer will be received. In the kernel layer, various kernel events are monitored, including the monitoring and management of the operation process related to the container, such as file opening, network activity, device block access, etc., and behaviors such as hooking and deciding whether to allow or deny certain operations based on the return value.

[0046] Based on this, in some embodiments, the preset shared memory area is set in the kernel layer, and the kernel layer is used to monitor the container and the behavior of accessing the container;

[0047] Thus, when executing the "get access request" in this step, it specifically includes:

[0048] Each container is monitored through the kernel layer, and when it is detected that there is a process accessing the container, the access request is obtained from the process.

[0049] Since the kernel layer can monitor the operation status of each container, when there is an access request to a container, it can be monitored based on the kernel layer and determine which container is being accessed. Of course, the specific process is to determine whether there is a process accessing the container. If so, it means that there is currently an access request.

[0050] 202. When it is determined that the namespace to be mounted by the process corresponding to the access request belongs to the host machine, execute the access request.

[0051] Since the access request may be to access the container or to access the host machine where the container is set, for the host machine, the access request to it can generally be understood as the operation performed by the current user. Therefore, for such requests, the subsequent steps can be controlled without performing the control, but the access request can be directly executed based on the method of this step. Of course, when determining whether the process corresponding to the current access request is to access the host machine itself, it can be based on the namespace that the process needs to mount. Since the namespace of the host machine itself and the namespace in the container are different, determining whether the current access request is to directly access the host machine based on the namespace can ensure the accuracy of determining the target targeted by the access request, avoid the situation where misjudgment is caused by direct analysis based on the operation behavior, and ensure the security of the access control process.

[0052] 203. Obtain an access control policy from a preset shared memory area, and determine whether the access request complies with the access control policy.

[0053] The access control policy is used to determine the operation behaviors that are allowed to be executed in each container.

[0054] Based on the above steps, it can be known that since the preset shared memory area is set in the kernel layer, the step of "obtaining the access control policy from the preset shared memory area" may include:

[0055] The access control policy is obtained in a preset shared memory area of ​​the kernel layer.

[0056] In this embodiment, the preset shared memory is set in the kernel layer, and the access control policy is stored in the preset shared memory. In this way, since the data in the kernel layer will not be directly affected by the external input data, but requires the user layer as a buffer, it is ensured that when the access control method described in this embodiment is executed, the access control policy obtained from the preset shared memory will not interrupt the execution of the current access control method due to temporary external adjustments, thereby ensuring the smooth execution of the method described in this embodiment.

[0057] Furthermore, in some embodiments, the access control policy may specifically control the subject information and object information corresponding to each container, wherein the subject information is used to characterize the operation behavior allowed to be executed in the container, and the object information includes the file name and the container name;

[0058] Based on this, the step of "determining whether the access request complies with the access control policy" can be specifically performed in the following manner:

[0059] Step A, determining the namespace that the process needs to mount from the access request;

[0060] Step B: Determine the target container corresponding to the namespace to be mounted by the process by using a preset space container mapping relationship, wherein the preset control container mapping relationship includes a container corresponding to each namespace;

[0061] Step C: Determine whether there is subject information and object information corresponding to the target container in the access control policy, and determine whether both the subject information and object information corresponding to the target container match the access request.

[0062] Since the process accesses the container through the namespace mounted inside the container, when determining the container targeted by the access request in this step, the namespace required to be mounted by the process corresponding to the access request can be used to accurately determine which container the access request targets, thereby laying the foundation for the accuracy of the subsequent process of determining whether the current access request matches the access control policy.

[0063] In addition, in this embodiment, the access control policy is set based on subject information and object information, wherein the subject information is mainly used to determine the operation behavior allowed to be executed in the container, that is, what is allowed to be done in the container, and the object information is the file name and container name, respectively, which are used to indicate which container it is and which file is targeted when the operation is performed. In this way, when determining whether the access request matches the access control policy, a match can be made based on these contents to determine the container targeted by the access request, the operation behavior to be performed in the container, and whether the file corresponding to the operation behavior is consistent with the subject information and object information in the access control policy. If they are consistent, it means that "what" the access request wants to do is consistent with "what" allowed in the container set by the user, then the access request is fine, and the access request can be allowed to execute smoothly later.

[0064] Further, for step C, determining whether there is subject information and object information corresponding to the target container in the access control policy, and determining whether both the subject information and object information corresponding to the target container match the access request, the execution may be as follows:

[0065] First, in the access control policy, it is determined whether there is object information matching the container name of the target container;

[0066] Then, when it is determined that there is object information matching the container name of the target container, it is determined whether the file name in the object information is the file to be operated in the access request;

[0067] Finally, when it is determined that the file name in the object information is consistent with the file to be operated in the access request, it is determined whether the operation behavior in the subject information corresponding to the object information is consistent with the operation behavior to be performed in the access request.

[0068] Through the three-stage analysis and judgment of "container name-file name-operation behavior", it is determined whether the current access request and the access control policy match. This can ensure that during the judgment process, it can be judged in an orderly manner according to a certain order. At the same time, it can ensure that subsequent judgments can be stopped when the current step determines that there is a mismatch, thereby saving judgment time and improving judgment efficiency.

[0069] Further, based on the foregoing description, it can be known that the cluster system or access control system in this embodiment is divided into two levels, namely the user layer and the kernel layer, both of which involve operations of different functions. Based on this, in some embodiments, before obtaining the access control policy in the preset shared memory area of ​​the kernel layer, the method further includes:

[0070] Performing a change operation on the initial access control policy at the user layer, wherein the change operation includes adding, modifying, and deleting the initial access control policy;

[0071] If it is determined that the initial access control policy in the user layer has been changed, the changed initial access control policy is obtained from the user layer, and the changed initial access control policy is added to the preset shared memory area in the kernel layer as the access control policy.

[0072] In this way, after the initial access control policy in the user layer is changed, it is updated to the preset shared memory in the kernel layer based on the changed policy. This ensures that when the user needs to modify or add a new access control policy, it can be updated based on the user layer-kernel layer transmission method, avoiding direct modification and operation of the access control policy on the preset shared memory area in the kernel layer, so that the modification and update process can be carried out in an orderly manner, and it also avoids directly modifying the access control policy in the kernel layer, causing interference and impact on the currently being controlled process. It can also ensure that when some updates do not need to take effect immediately, they can be transitioned to the kernel layer based on the user layer cache, which can have the effect of delayed update.

[0073] Based on the judgment result, when it is determined that the access request complies with the access control policy, step 204 is executed; otherwise, when it is determined that it does not comply with the access control policy, step 205 is executed.

[0074] 204. If it is in compliance, executing the access request;

[0075] Based on the description of the above steps, it can be known that in the case where the access control policy includes subject information and object information corresponding to each container, based on this, this step of "if it meets the requirements, then execute the access request" includes: if it is determined that there is subject information and object information corresponding to the target container, and it is determined that the subject information and object information corresponding to the target container both match the access request, then execute the access request.

[0076] Since the access control policy in the above steps is set in the form of subject information and object information, when determining whether it is necessary to execute the access request, it is necessary to ensure that the container involved in the access request is in the access control policy, and the above subject information and object information match the access request. This means that the specific operation to be performed by the current access request, whether in terms of container name, file name or operation behavior, is in compliance with what is allowed when the user sets the access control policy. In this case, the access request is fine and can be executed.

[0077] 205. If not, prohibit the access request.

[0078] Further, based on the above step description, it can be known that when the access control policy includes subject information and object information corresponding to each container, the step of "if not in compliance, prohibiting the access request" can be performed in any of the following two aspects, specifically:

[0079] Aspect A: if it is determined that there is no subject information and object information corresponding to the target container, prohibiting the access request;

[0080] Aspect B: If it is determined that subject information and object information corresponding to the target container exist, but it is determined that the subject information and / or object information corresponding to the target container does not match the access request, the access request is prohibited.

[0081] When the access request does not comply with the access control policy, it is generally divided into one of the above two situations. For aspect A, this means that the container to be accessed by the current access request is not a container included in the access control policy, which means that the target container is not allowed to be accessed by the outside world, so the execution of the access request is prohibited at this time. For aspect B, this means that the subject information and object information involved in the target container do exist, that is, the target container corresponding to the access request is accessible, but it needs to meet the subject information and object information. If it is found that the access request does not match at least one of the subject information and / or object information, it means that either the operation behavior is inconsistent or the targeted file is inconsistent, which is equivalent to performing an operation that should not be performed in a container that allows the execution of some operation behaviors, so the execution of the access request also needs to be prohibited at this time.

[0082] Furthermore, as a response to the above Figure 1 and Figure 2 In order to realize the method shown in the figure, another embodiment of the present application also provides an access control device. This device embodiment corresponds to the aforementioned method embodiment. For ease of reading, this device embodiment will not repeat the details of the aforementioned method embodiment one by one, but it should be clear that the device in this embodiment can correspond to all the contents of the aforementioned method embodiment. In order to realize an access control method, the device is specifically as follows Figure 3 As shown, the device comprises:

[0083] An acquisition unit 31 may be used to acquire an access request, wherein the access request includes a container to be accessed and an operation to be performed;

[0084] The determination unit 32 may be used to obtain an access control policy from a preset shared memory area and determine whether the access request obtained by the obtaining unit 31 complies with the access control policy; wherein the access control policy may be used to determine the operation behavior allowed to be executed in each container;

[0085] A first execution unit 33 may be configured to execute the access request if the determination unit 32 determines that the access request complies with the access control policy;

[0086] The second execution unit 34 may be configured to prohibit the access request if the determination unit 32 determines that the access request does not comply with the access control policy.

[0087] Further, such as Figure 4 As shown, the preset shared memory area is set in the kernel layer, and the kernel layer can be used to monitor the container and the behavior of accessing the container;

[0088] The acquisition unit 31 may be specifically configured to monitor each container through the kernel layer, and when a process accessing the container is detected, acquire the access request from the process;

[0089] The determining unit 32 may be configured to obtain the access control policy in a preset shared memory area of ​​the kernel layer.

[0090] Further, such as Figure 4 As shown, the device also includes:

[0091] The changing unit 35 may be used to perform a change operation on the initial access control policy at the user layer, wherein the change operation includes adding, modifying and deleting the initial access control policy;

[0092] The adding unit 36 ​​can be used to obtain the changed initial access control policy from the user layer if it is determined that the initial access control policy in the user layer has been changed by the changing unit 35, and add the changed initial access control policy to the preset shared memory area in the kernel layer as the access control policy, so that the determining unit 32 obtains the access control policy.

[0093] Further, such as Figure 4 As shown, the access control policy includes subject information and object information corresponding to each container, wherein the subject information can be used to characterize the operation behavior allowed to be executed in the container, and the object information includes the file name and the container name;

[0094] The determination unit 32 may also be used to determine the namespace to be mounted by the process from the access request; and determine the target container corresponding to the namespace to be mounted by the process using a preset space container mapping relationship, wherein the preset control container mapping relationship includes a container corresponding to each namespace; and, in the access control policy, determine whether there is subject information and object information corresponding to the target container, and determine whether the subject information and object information corresponding to the target container both match the access request;

[0095] The first execution unit 33 may be specifically configured to execute the access request if it is determined that subject information and object information corresponding to the target container exist and it is determined that both the subject information and object information corresponding to the target container match the access request.

[0096] Further, such as Figure 4 As shown, the second execution unit 34 may also be used to prohibit the access request if it is determined that there is no subject information and object information corresponding to the target container;

[0097] The second execution unit 34 may also be configured to prohibit the access request if it is determined that subject information and object information corresponding to the target container exist, but it is determined that the subject information and / or object information corresponding to the target container does not match the access request.

[0098] Further, such as Figure 4 As shown, the device also includes:

[0099] The third execution unit 37 may be configured to execute the access request when it is determined that the namespace to be mounted by the process corresponding to the access request obtained by the obtaining unit 31 belongs to the host machine.

[0100] Further, such as Figure 4 As shown, the determination unit 32 can also be specifically used to determine whether there is object information matching the container name of the target container in the access control policy; and, when it is determined that there is object information matching the container name of the target container, determine whether the file name in the object information is the file to be operated in the access request; and, when it is determined that the file name in the object information is consistent with the file to be operated in the access request, determine whether the operation behavior in the subject information corresponding to the object information is consistent with the operation behavior to be performed in the access request.

[0101] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an embodiment of the present application further provides a storage medium, wherein the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the above-mentioned access control method.

[0102] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an embodiment of the present application also provides an access control device, which includes a storage medium; and one or more processors, the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, the access control method described above is executed.

[0103] An embodiment of the present application provides an access control method and device. The present application can first obtain an access request, wherein the access request includes a container to be accessed and an operation behavior to be performed; then, obtain an access control policy from a preset shared memory area, and determine whether the access request complies with the access control policy; wherein the access control policy is used to determine the operation behavior allowed to be performed in each container; finally, if it complies, the access request is executed, otherwise, if it does not comply, the access request is prohibited, thereby realizing the access control function. Compared with the prior art, in the access control process of the present application, the access control process can be verified from both the computing and application dimensions. In this way, in the access control process, it can be ensured that no matter what kind of access request is, whether it can be allowed to be executed can be analyzed according to the container to be accessed and the operation behavior to be performed. In this way, the security of the access request can be determined from the container level, avoiding the impact of certain operations on data security when executed in individual containers, so that the access request can be controlled based on the operation behaviors allowed to be executed in different containers, which solves the problem that in the prior art, when access requests are managed only from the operation behavior, some access requests may cause data security to be affected when executed in individual containers. While improving the security of access request control, different containers can also be controlled separately by access control policies, thereby realizing the function of more flexible management of access request control.

[0104] The access control device includes a processor and a memory. The acquisition unit, the determination unit, the first execution unit and the second execution unit are all stored in the memory as program units. The processor executes the program units stored in the memory to implement corresponding functions.

[0105] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and an access control method is implemented by adjusting kernel parameters to solve the problem of poor access control accuracy and data security risks in the existing access control process.

[0106] An embodiment of the present application provides an access control device, which includes a storage medium; and one or more processors, wherein the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, any of the access control methods described above is executed.

[0107] An embodiment of the present application provides a storage medium, which includes a stored program, wherein when the program is executed, a device where the storage medium is located is controlled to execute the access control method described above.

[0108] The storage medium may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one storage chip.

[0109] An embodiment of the present application provides a device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the following steps are implemented: obtaining an access request, wherein the access request includes a container to be accessed and an operation behavior to be executed; obtaining an access control policy from a preset shared memory area, and determining whether the access request complies with the access control policy; wherein the access control policy is used to determine the operation behavior allowed to be executed in each container; if it complies, the access request is executed; if it does not comply, the access request is prohibited.

[0110] Furthermore, the preset shared memory area is set in the kernel layer, and the kernel layer is used to monitor the container and the behavior of accessing the container;

[0111] The obtaining access request includes:

[0112] Monitor each container through the kernel layer, and when detecting the presence of a process accessing the container, obtain the access request from the process;

[0113] The obtaining of the access control policy from the preset shared memory area includes:

[0114] The access control policy is obtained in a preset shared memory area of ​​the kernel layer.

[0115] Furthermore, before obtaining the access control policy in the preset shared memory area of ​​the kernel layer, the method further includes:

[0116] Performing a change operation on the initial access control policy at the user layer, wherein the change operation includes adding, modifying, and deleting the initial access control policy;

[0117] If it is determined that the initial access control policy in the user layer has been changed, the changed initial access control policy is obtained from the user layer, and the changed initial access control policy is added to the preset shared memory area in the kernel layer as the access control policy.

[0118] Furthermore, the access control policy includes subject information and object information corresponding to each container, wherein the subject information is used to characterize the operation behavior allowed to be executed in the container, and the object information includes the file name and the container name;

[0119] The determining whether the access request complies with the access control policy includes:

[0120] Determine, from the access request, a namespace to be mounted by the process;

[0121] Determine a target container corresponding to the namespace to be mounted by the process by using a preset space container mapping relationship, wherein the preset control container mapping relationship includes a container corresponding to each namespace;

[0122] In the access control policy, determining whether subject information and object information corresponding to the target container exist, and determining whether both the subject information and object information corresponding to the target container match the access request;

[0123] If the conditions are met, executing the access request includes:

[0124] If it is determined that subject information and object information corresponding to the target container exist, and it is determined that both the subject information and object information corresponding to the target container match the access request, the access request is executed.

[0125] Furthermore, if the conditions do not match, prohibiting the access request includes:

[0126] If it is determined that there is no subject information and object information corresponding to the target container, prohibiting the access request;

[0127] or,

[0128] If it is determined that subject information and object information corresponding to the target container exist, but it is determined that the subject information and / or object information corresponding to the target container do not match the access request, the access request is prohibited.

[0129] Furthermore, before determining whether the access request complies with the access control policy, the method further includes:

[0130] When it is determined that the namespace to be mounted by the process corresponding to the access request belongs to the host machine, the access request is executed.

[0131] Further, in the access control policy, determining whether there is subject information and object information corresponding to the target container, and determining whether both the subject information and object information corresponding to the target container match the access request includes:

[0132] In the access control policy, determining whether object information matching the container name of the target container exists;

[0133] When it is determined that there is object information matching the container name of the target container, determining whether the file name in the object information is a file to be operated in the access request;

[0134] When it is determined that the file name in the object information is consistent with the file to be operated in the access request, it is determined whether the operation behavior in the subject information corresponding to the object information is consistent with the operation behavior to be performed in the access request.

[0135] The present application also provides a computer program product that can execute corresponding functions, including: obtaining an access request, wherein the access request includes a container to be accessed and an operation behavior to be executed; obtaining an access control policy from a preset shared memory area, and determining whether the access request complies with the access control policy; wherein the access control policy is used to determine the operation behavior allowed to be executed in each container; if it complies, executing the access request; if it does not comply, prohibiting the access request.

[0136] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0137] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0138] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0139] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0140] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0141] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0142] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0143] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0144] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0145] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. An access control method, characterized in that: The method comprises: Obtaining an access request, where the access request includes a container to be accessed and an operation to be performed; Obtaining an access control policy from a preset shared memory area, and determining whether the access request complies with the access control policy; wherein the access control policy is used to determine the operation behavior allowed to be executed in each container; If it meets the requirements, the access request is executed; If not, the access request is prohibited.

2. The method according to claim 1, characterized in that The preset shared memory area is set in the kernel layer, and the kernel layer is used to monitor the container and the behavior of accessing the container; The obtaining access request includes: Monitor each container through the kernel layer, and when detecting the presence of a process accessing the container, obtain the access request from the process; The obtaining of the access control policy from the preset shared memory area includes: The access control policy is obtained in a preset shared memory area of ​​the kernel layer.

3. The method according to claim 2, characterized in that Before acquiring the access control policy in the preset shared memory area of ​​the kernel layer, the method further includes: Performing a change operation on the initial access control policy at the user layer, wherein the change operation includes adding, modifying, and deleting the initial access control policy; If it is determined that the initial access control policy in the user layer has been changed, the changed initial access control policy is obtained from the user layer, and the changed initial access control policy is added to the preset shared memory area in the kernel layer as the access control policy.

4. The method according to claim 1, characterized in that: The access control policy includes subject information and object information corresponding to each container, wherein the subject information is used to characterize the operation behavior allowed to be executed in the container, and the object information includes the file name and the container name; The determining whether the access request complies with the access control policy includes: Determine, from the access request, a namespace to be mounted by the process; Determine a target container corresponding to the namespace to be mounted by the process by using a preset space container mapping relationship, wherein the preset control container mapping relationship includes a container corresponding to each namespace; In the access control policy, determining whether subject information and object information corresponding to the target container exist, and determining whether both the subject information and object information corresponding to the target container match the access request; If the conditions are met, executing the access request includes: If it is determined that subject information and object information corresponding to the target container exist, and it is determined that both the subject information and object information corresponding to the target container match the access request, the access request is executed.

5. The method according to claim 4, characterized in that If the access request is not met, the access request is prohibited, including: If it is determined that there is no subject information and object information corresponding to the target container, prohibiting the access request; or, If it is determined that subject information and object information corresponding to the target container exist, but it is determined that the subject information and / or object information corresponding to the target container do not match the access request, the access request is prohibited.

6. The method according to claim 1, characterized in that Before determining whether the access request complies with the access control policy, the method further includes: When it is determined that the namespace to be mounted by the process corresponding to the access request belongs to the host machine, the access request is executed.

7. The method according to claim 3 or 5, characterized in that: Determining whether there is subject information and object information corresponding to the target container in the access control policy, and determining whether both the subject information and object information corresponding to the target container match the access request includes: In the access control policy, determining whether object information matching the container name of the target container exists; When it is determined that there is object information matching the container name of the target container, determining whether the file name in the object information is a file to be operated in the access request; When it is determined that the file name in the object information is consistent with the file to be operated in the access request, it is determined whether the operation behavior in the subject information corresponding to the object information is consistent with the operation behavior to be performed in the access request.

8. An access control device, characterized in that: The device comprises: An acquisition unit, configured to acquire an access request, wherein the access request includes a container to be accessed and an operation behavior to be performed; A determination unit, configured to obtain an access control policy from a preset shared memory area and determine whether the access request complies with the access control policy; wherein the access control policy is used to determine the operation behavior allowed to be executed in each container; A first execution unit, configured to execute the access request if it is determined that the access request complies with the access control policy; The second execution unit is configured to prohibit the access request if it is determined that the access request does not comply with the access control policy.

9. A storage medium, characterized in that: The storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the access control method described in any one of claims 1 to 7.

10. An access control device, characterized in that: The device includes a storage medium; and one or more processors, the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, the access control method described in any one of claims 1-7 is executed.

Images