Cloud resource access authority management method and device, equipment and storage medium

Abstract

The invention discloses a cloud resource access authority management method, device and equipment and a storage medium, and relates to the technical field of cloud computing, the method comprises the following steps: when an authority request is received, obtaining corresponding request main body information; a current organization is determined according to the request subject information, a preset role permission strategy template is updated according to the current organization, a current response strategy is generated, and the preset role permission strategy template comprises at least one piece of declaration information containing placeholders; and processing the permission request according to the current response strategy. According to the dynamic generation technology based on the role permission policy template, the response policy can be generated in real time according to the current organization to which the request main body belongs when the right is actually asked, so that the configuration amount of the static policy is reduced, the problem of expansion of the traditional IAM static policy is solved, a permission management scheme with high flexibility and expansibility is provided, and the permission management efficiency is improved. The method is suitable for large-scale cloud resources and multi-tenant organization environments.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to a method, apparatus, device and storage medium for managing access rights of cloud resources. Background Art

[0002] In the existing cloud resource Identity and Access Management (IAM) system, each role needs to be bound to multiple policies and control access rights to subordinate resources. In a multi-tenant organizational environment, as the number of tenant organizations increases, the configuration items of roles and policies within the organization will grow exponentially.

[0003] The existing technology often adopts a static role and policy binding method, but as the number of tenant organizations or resources increases, the same type of role has many repeated policies in different tenant organizations, resulting in policy redundancy and increased management costs, which in turn affects the flexibility of cloud resource access control. Summary of the invention

[0004] The main purpose of this application is to provide a method for managing access rights of cloud resources, aiming to solve the technical problem that the existing static policy configuration method affects the flexibility of cloud resource access control due to lengthy and inefficient configuration policies when applied to multi-tenant cloud resource scenarios.

[0005] To achieve the above objectives, the present application proposes a method for managing access rights to cloud resources, the method comprising:

[0006] When receiving a permission request, obtain the corresponding request subject information;

[0007] Determine the current organization according to the request subject information, and update the preset role authority policy template according to the current organization to generate a current response policy, wherein the preset role authority policy template includes at least one declaration information containing a placeholder;

[0008] The permission request is processed according to the current response policy.

[0009] In one embodiment, the step of determining the current organization according to the request subject information, and updating the preset role permission policy template according to the current organization to generate the current response policy includes:

[0010] Traversing the cloud resource policy table, and determining a preset role authority policy template in the cloud resource policy table;

[0011] Determine the current organization to which the request subject belongs according to the request subject information, and replace the placeholder in the declaration information with the current organization;

[0012] Generate the current response strategy based on the replacement result.

[0013] In one embodiment, the placeholder includes: a subject field placeholder and a resource field placeholder, and the step of replacing the placeholder in the declaration information with the current organization includes:

[0014] The subject field placeholder in the declaration information is replaced with the current organization, and the resource field placeholder in the declaration information is replaced with the current organization.

[0015] In one embodiment, the step of generating a current response strategy according to the replacement result includes:

[0016] The preset role authority policy template is materialized according to the replacement result to generate a current response policy;

[0017] The current response strategy includes: strategy subject information, strategy resource information, strategy operation information and strategy effect information.

[0018] In one embodiment, the step of processing the permission request according to the current response policy includes:

[0019] Obtaining requested resource information and requested operation information corresponding to the permission request;

[0020] Determining whether the requested resource information matches the policy resource information, and determining whether the requested operation information matches the policy operation information;

[0021] When the requested resource information matches the policy resource information and the requested operation information matches the policy operation information, the permission request is processed according to the policy effect information.

[0022] In one embodiment, after the step of determining whether the requested resource information matches the policy resource information and determining whether the requested operation information matches the policy operation, the step further includes:

[0023] When the requested resource information does not match the policy resource information and / or the requested operation information does not match the policy operation information, the permission request is rejected.

[0024] In one embodiment, after the step of traversing the cloud resource strategy table, the method further includes:

[0025] Determining a conventional permission policy in the cloud resource policy table;

[0026] Determine whether the request subject information, request resource information, and request operation information match the subject information, resource information, and operation information in the conventional permission policy;

[0027] If yes, processing the permission request according to the effect information in the conventional permission policy;

[0028] If not, the permission request is denied.

[0029] In addition, to achieve the above purpose, the present application also proposes a cloud resource access rights management device, the device comprising:

[0030] The request receiving module is used to obtain the corresponding request subject information when receiving the permission request;

[0031] A policy generation module, used to determine the current organization according to the request subject information, and update the preset role authority policy template according to the current organization to generate a current response policy, wherein the preset role authority policy template includes at least one declaration information containing a placeholder;

[0032] A request processing module is used to process the permission request according to the current response strategy.

[0033] In addition, to achieve the above-mentioned purpose, the present application also proposes a cloud resource access permission management device, the device comprising: a memory, a processor, and a cloud resource access permission management program stored on the memory and executable on the processor, the cloud resource access permission management program being configured to implement the steps of the cloud resource access permission management method as described above.

[0034] In addition, to achieve the above objectives, the present application also proposes a storage medium, which stores an access permission management program for cloud resources. When the access permission management program for cloud resources is executed by a processor, the steps of the access permission management method for cloud resources described above are implemented.

[0035] The present application proposes a method for managing access rights of cloud resources, including: upon receiving a permission request, obtaining corresponding request subject information; determining the current organization based on the request subject information, and updating a preset role permission policy template based on the current organization to generate a current response policy, wherein the preset role permission policy template includes at least one declaration information containing a placeholder; and processing the permission request based on the current response policy. The present application is based on the dynamic generation technology of the role permission policy template, and can instantly generate a response policy based on the current organization to which the request subject belongs when actually requesting permissions, thereby reducing the amount of static policy configuration, which not only solves the problem of traditional IAM static policy expansion, but also provides a highly flexible and scalable permission management solution suitable for large-scale cloud resources and multi-tenant organizational environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0037] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0038] Figure 1 This is a flowchart of the first embodiment of the method for managing access rights to cloud resources of the present application;

[0039] Figure 2 This is a flow chart of a second embodiment of the method for managing access rights to cloud resources of the present application;

[0040] Figure 3 This is an example diagram of the data structure of the role permission policy template;

[0041] Figure 4 A flowchart of a third embodiment of the method for managing access rights to cloud resources of the present application;

[0042] Figure 5 A schematic diagram of the role permission policy template in the access permission management method for cloud resources in this application;

[0043] Figure 6 A schematic diagram of the IAM permission verification process based on the access permission management method for cloud resources in this application;

[0044] Figure 7 This is a schematic diagram of the module structure of the first embodiment of the access permission management device for cloud resources of the present application;

[0045] Figure 8 This is a schematic diagram of the structure of the access permission management device for cloud resources in this application.

[0046] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0047] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0048] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0049] The present application provides a method for managing access rights of cloud resources. Figure 1 , Figure 1 This is a flow chart of a first embodiment of a method for managing access rights to cloud resources of the present application. In this embodiment, the method includes: Steps S10 to S30:

[0050] Step S10: When receiving a permission request, obtain the corresponding request subject information.

[0051] It should be noted that the embodiments of the present application can be applied to IAM scenarios of large-scale or multi-tenant organizations to manage user access rights. The executor of the method of this embodiment can be a computing electronic device with data processing, network communication, and program running, such as: a mobile phone, a tablet, a rights management server, etc., or other electronic devices that can access the cloud resource rights management system. The following takes the access rights management device that can access the cloud resource rights management system (hereinafter referred to as the "system") as an example to explain the embodiments of the present application.

[0052] It should be understood that when a user issues a permission request, the system can first authenticate the user based on the user name / user ID and user password. When the identity authentication is passed, the request information corresponding to the permission request is obtained, and the request information may include: request subject information, request resource information, request operation information, and restriction condition information.

[0053] The request subject information may include: the permission role category possessed by the request subject (user) and the tenant organization to which the request subject belongs.

[0054] Step S20: Determine the current organization according to the request subject information, and update the preset role authority policy template according to the current organization to generate a current response policy, wherein the preset role authority policy template includes at least one declaration information containing a placeholder.

[0055] It should be understood that when receiving a permission request, the system can first perform fuzzy matching based on the request subject information and the policy subject information in the role permission policy template to determine the preset role permission policy template applicable to the permission role category possessed by the request subject.

[0056] It should be noted that the preset role permission policy template may include at least one declaration information, and any declaration information may be composed of: operation information (Action), effect information (Effect), resource information (Resource), identification information (Sid) and permission subject information (Subject), and are recorded in corresponding fields respectively.

[0057] It should also be noted that in the Subject field and Resource field of the above declaration information, dynamic variables can be framed by using the placeholder "<>" field, so that the dynamic variables can be replaced with specific organization instances in real time according to the request subject.

[0058] Furthermore, the fields in the role permission policy template are described as follows:

[0059] Action: represents the operation that is allowed to be performed.

[0060] Effect: The execution effect of the policy, which can be "allow" or "deny".

[0061] Resource: The resource object that the policy acts on, representing the variables during dynamic generation. It will be replaced by the specific organization name in the actual request.

[0062] Sid: A unique identifier for a policy, used to identify the policy.

[0063] Subject: The subject of the permission request, which represents the variables generated dynamically.

[0064] In the specific implementation, first, the permission role category possessed by the request subject and the tenant organization (current organization) to which the request subject belongs can be determined based on the request subject information, and then the preset role permission policy template of the corresponding role category is fuzzy matched according to the permission role category, and then the placeholders in the preset role permission policy template are replaced according to the current organization to generate a policy applicable to the current organization (current response policy).

[0065] Step S30: Processing the permission request according to the current response policy.

[0066] It should be noted that after the current response strategy is generated, the corresponding field items in the permission request can be matched in sequence based on the field items in the current response strategy, so as to complete the user's permission verification according to the matching results.

[0067] In a specific implementation, according to the current response policy, the request information of the user who issues the permission request and passes the authentication can be matched in sequence based on various field items such as Resource and Action. If the match is consistent, the current request can be allowed / rejected according to the Effect field in the current response policy.

[0068] When receiving a permission request, this embodiment obtains the corresponding request subject information; determines the current organization based on the request subject information, and updates the preset role permission policy template based on the current organization to generate a current response policy, wherein the preset role permission policy template includes at least one declaration information containing a placeholder; and processes the permission request based on the current response policy. Since this embodiment is based on the dynamic generation technology of the role permission policy template, it can instantly generate a response policy based on the current organization to which the request subject belongs when actually requesting permission, thereby reducing the amount of static policy configuration, which not only solves the problem of traditional IAM static policy expansion, but also provides a highly flexible and scalable permission management solution suitable for large-scale cloud resources and multi-tenant organizational environments.

[0069] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 2 , Figure 2 This is a flow chart of the second embodiment of the method for managing access rights to cloud resources of the present application.

[0070] In this embodiment, considering that the system also includes conventional permission policies, in order to obtain the role permission policy template in each IAM policy table, step S20 specifically includes: steps S201 to S203:

[0071] Step S201: traverse the cloud resource policy table, and determine a preset role authority policy template in the cloud resource policy table.

[0072] It should be noted that the cloud resource policy table may include preset role permission policy templates and general permission policies.

[0073] Step S202: Determine the current organization to which the request subject belongs according to the request subject information, and replace the placeholder in the declaration information with the current organization.

[0074] It should be noted that the placeholder in the declaration information can be located in the Subject field, the Resource field, or even in the Action field. The role permission policy template containing placeholders in different field positions can be pre-set according to different policy configuration requirements. Here, a role permission policy template containing a subject field placeholder (located in the Subject field) and a resource field placeholder (located in the Resource field) can be set as an example.

[0075] For example, in a traditional IAM policy, the subject is usually statically specified, such as organization1 / role / organizationAdmin, organization2 / role / organizationAdmin, etc. In the role permission policy template, the Subject field can be expressed in a templated form as follows: organization / <organization> / roleTemplate / organizationAdmin. When a permission request arrives, the system can automatically match the corresponding organization name according to the organization to which the request subject belongs, and replace the subject field placeholder <organization>Replace with the actual organization instance name.

[0076] Similarly, the Resource field also uses <organization>variables. This allows the system to automatically convert resource field placeholders <organization>Replace with the actual organization name.

[0077] In a specific implementation, the system may replace the subject field placeholder in the declaration information with the current organization, and simultaneously replace the resource field placeholder in the declaration information with the current organization.

[0078] Step S203: Generate a current response strategy according to the replacement result.

[0079] It is understandable that after replacing the placeholders in the declaration information in the preset role permission policy template with specific organization instances, the template policy can be instantiated to obtain the instantiated current response policy. The declaration information in the current response policy includes: policy subject information, policy resource information, policy operation information, and policy effect information.

[0080] Further, refer to Figure 3 Here, we can use the role permission policy template that applies to the organizationAdmin role category of all tenant organizations to perform operations on resources within their organization as an example to illustrate the dynamic policy matching mechanism. Figure 3 The following is an example diagram of the data structure of a role permission policy template.

[0081] exist Figure 3 In the statement, the statement is configured based on the JSON format, where the Action field can be configured to perform an operation on the artifactory service (for example, configured as artifact:action1); the Effect field can be configured to allow (allow); the Resource field can be configured to contain "organization / <organization> / *", where "*" represents all resources in the organization; the Sid field is a randomly generated policy identification string; the Subject field can be configured to contain "organization / <organization> / roleTemplate / organizationAdmin".

[0082] Based on the declaration information with placeholders in the above role permission policy template, the system can <organization>Replace it with a specific tenant organization name, such as organization1 or organization2, to generate dynamic policies for different tenant organizations to solve the problem of traditional IAM static policy expansion.

[0083] This embodiment traverses the cloud resource policy table and determines the preset role permission policy template in the cloud resource policy table; determines the current organization to which the requesting subject belongs according to the requesting subject information, replaces the subject field placeholder in the declaration information with the current organization, and replaces the resource field placeholder in the declaration information with the current organization; generates the current response policy according to the replacement result. Since this embodiment can accurately extract the actual organization name from the identity of the requesting subject (user) when receiving the permission request, and replaces the placeholder in the template with the current organization name, the current response policy is generated according to the replacement result. <organization>Replace with a specific value, and the replacement process includes not only replacing the subject field placeholder, but also replacing the resource field placeholder with the organization instance name. This allows users of the same role category in different tenant organizations to generate the current response policy in real time through dynamic matching, reducing the redundant configuration of a large number of duplicate policies.

[0084] Based on the first and second embodiments of the present application, in the third embodiment of the present application, the same or similar contents as those of the first and second embodiments can be referred to the above description, and will not be described in detail later. Figure 4 , Figure 4 This is a flowchart of the third embodiment of the method for managing access rights to cloud resources of the present application.

[0085] In this embodiment, in order to specifically illustrate the authorization process of the permission request based on the current response policy, step S30 specifically includes: steps S301 to S303:

[0086] Step S301: Obtain requested resource information and requested operation information corresponding to the permission request.

[0087] Step S302: Determine whether the requested resource information matches the policy resource information, and determine whether the requested operation information matches the policy operation information.

[0088] It should be noted that first, it can be determined whether the resource requested by the user belongs to the resource range restricted by the policy resource information in the above current response policy; if so, then continue to match whether the operation requested by the user belongs to the operation range restricted by the policy operation information in the above current response policy.

[0089] Step S303: When the requested resource information matches the policy resource information and the requested operation information matches the policy operation information, the permission request is processed according to the policy effect information.

[0090] It is understandable that if the resources and operations requested by the user are in accordance with the resource scope and operation scope restricted in the above-mentioned current response policy, the user's permission request can be processed according to the policy effect information in the current response policy. Specifically, if the policy effect information is allowed, the user's permission request is approved; if the policy effect information is denied, the user's permission request is denied.

[0091] It should also be noted that when the current response policy includes multiple declaration information, if the matching results of the resources and operations requested by the user in each declaration information are different, the user's permission request can be processed according to the priority of each declaration information. Specifically, the user's request information can be directly matched with each declaration information, and the user's permission request can be allowed or denied based on the matching result corresponding to the declaration information with a higher priority.

[0092] Furthermore, after step S302, the method further includes:

[0093] Step S303': when the requested resource information does not match the policy resource information and / or the requested operation information does not match the policy operation information, reject the permission request.

[0094] It should be noted that if the resource requested by the user does not fall within the resource scope restricted by the policy resource information in the above current response policy, or the operation requested by the user does not fall within the operation scope restricted by the policy operation information in the above current response policy, the system can directly reject the user's permission request.

[0095] In this implementation, the current response policy is generated through the role permission policy template to authenticate the user's permissions. Compared with the existing method, it can generate specific policy entries when the user actually requests permissions, thereby greatly reducing the resource space occupied by storage policies in the system, and reducing the time spent on searching for adaptation policies in a large number of static policies, further improving the speed of user permission authentication.

[0096] Furthermore, considering that the cloud resource policy table also includes conventional authority policies, that is, the user's authority verification is also subject to the constraints of conventional authority policies, after step S201, the following steps are further included: steps S30' to S60':

[0097] Step S30': determining a conventional authority policy in the cloud resource policy table.

[0098] It should be understood that the conventional permission policy is an IAM policy in which each field item such as Subject, Resource, Action, etc. is statically specified.

[0099] Step S40': Determine whether the request subject information, request resource information and request operation information match the subject information, resource information and operation information in the conventional authority policy.

[0100] Step S50': If yes, the permission request is processed according to the effect information in the conventional permission policy;

[0101] Step S60 ′: If not, reject the permission request.

[0102] It should be noted that, according to the general permission policy, the request information of the user who issues the permission request and passes the identity authentication can be matched in sequence based on the Subject, Resource, Action and other field items. If the match is consistent, the current request can be allowed / rejected according to the Effect field in the general permission policy.

[0103] Furthermore, this can be combined with Figure 5 The role of the role permission policy template in the IAM system in the access permission management method of cloud resources in this application is specifically explained. Figure 5 This is a schematic diagram of the role permission policy template in the access permission management method for cloud resources in this application.

[0104] exist Figure 5 In the example, when a user issues a permission request, the system performs identity authentication based on the user's username / password. When the identity authentication is successful, the system obtains the request information corresponding to the request subject (for example: Subject1, Object1, Action1);

[0105] Next, perform the permission verification process: determine the normal permission policy (normalPolicies) and the role permission policy template (rolePermissionTemplatePolicy1) in the IAM policy library.

[0106] Conventional permission policies are system-predefined policies, which can usually be written in JSON format and include elements such as subject, resource, action, effect, and condition. Role permission policy templates use dynamic variables, such as subject dynamic variables (roleTemplate1) and resource dynamic variables (resourceTemplate1) to define permissions, which can automatically generate policies that match users and resources, thereby reducing the amount of static policy configuration.

[0107] Actions refer to the operations that the request subject requests to perform on resources, such as read, write, delete, etc. Different requests (Service1, 2, 3, etc.) can correspond to different actions (Action1, 2, etc.).

[0108] Resources refer to the objects that the request subject wants to access, such as computing instances, storage buckets, network interfaces, etc. Different requests (Service1, 2, 3, etc.) can correspond to different actions (Resource1, 2, etc.).

[0109] Here you can also combine Figure 6 Explain the whole process of system permission verification. Figure 6 The following is a schematic diagram of the IAM permission verification process based on the access permission management method for cloud resources in this application.

[0110] exist Figure 6 In the example, after completing the user identity authentication, the IAM policy table in the system is traversed to determine whether each IAM policy is a role permission policy template. If not, the IAM policy is a regular permission policy, and the request information is directly matched based on the Subject, Resource, Action and other fields, and the current request is allowed / rejected based on the matching result.

[0111] If so, a fuzzy match is performed based on the permission role category possessed by the requesting subject: the role permission policy template corresponding to the permission role category is determined; then the value of the dynamic variable in the preset role permission policy template is determined according to the tenant organization to which the requesting subject belongs, that is, the subject field (Subject) placeholder in the declaration information is replaced with the current organization, and the resource (Resource) field placeholder in the declaration information is also replaced with the current organization; thereby materializing the preset role permission policy template and generating the current response policy; and then matching is performed based on the policy resource information and policy operation information in the current response policy. If the match is consistent, the current request is allowed / rejected according to the policy effect information in the current response policy.

[0112] In this embodiment, when obtaining the user's request information, the system can first try to match the regular permission policy. If the regular permission policy fails to match, the system can try to match the role permission policy target. If the role permission template policy matches successfully, the request can be authorized; if all IAM policy matches fail, the request is rejected. By introducing a dynamic policy matching mechanism, the system can allow more refined and dynamic permission control, especially when permissions need to be dynamically adjusted according to user roles or other conditions, which is conducive to greatly improving the flexibility and scalability of user permission management in large-scale IAM and multi-tenant environments.

[0113] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the access permission management method for cloud resources of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0114] In addition, the present application also provides a cloud resource access rights management device, referring to Figure 7 , Figure 7 This is a structural block diagram of the first embodiment of the access permission management device for cloud resources of the present application; Figure 7 As shown, the device comprises:

[0115] The request receiving module 701 is used to obtain the corresponding request subject information when receiving the permission request;

[0116] A policy generation module 702 is used to determine the current organization according to the request subject information, and update the preset role authority policy template according to the current organization to generate a current response policy, wherein the preset role authority policy template includes at least one declaration information containing a placeholder;

[0117] The request processing module 703 is used to process the permission request according to the current response policy.

[0118] Furthermore, the policy generation module 702 is also used to traverse the cloud resource policy table and determine the preset role authority policy template in the cloud resource policy table; determine the current organization to which the request subject belongs based on the request subject information, and replace the placeholder in the declaration information with the current organization; generate the current response policy based on the replacement result; wherein the placeholder includes: subject field placeholder and resource field placeholder.

[0119] Furthermore, the policy generation module 702 is further configured to replace a subject field placeholder in the declaration information with the current organization, and replace a resource field placeholder in the declaration information with the current organization.

[0120] Furthermore, the policy generation module 702 is also used to materialize the preset role authority policy template according to the replacement result to generate a current response policy; wherein the current response policy includes: policy subject information, policy resource information, policy operation information and policy effect information.

[0121] Furthermore, the request processing module 703 is also used to obtain the request resource information and request operation information corresponding to the permission request; determine whether the request resource information matches the policy resource information, and determine whether the request operation information matches the policy operation information; when the request resource information matches the policy resource information and the request operation information matches the policy operation information, process the permission request according to the policy effect information.

[0122] Furthermore, the request processing module 703 is further configured to reject the permission request when the requested resource information does not match the policy resource information and / or the requested operation information does not match the policy operation information.

[0123] Furthermore, the request processing module 703 is also used to determine the general permission policy in the cloud resource policy table; determine whether the request subject information, request resource information and request operation information match the subject information, resource information and operation information in the general permission policy; if so, process the permission request according to the effect information in the general permission policy; if not, reject the permission request.

[0124] This embodiment is based on the dynamic generation technology of role permission policy templates. When actually requesting permissions, it can instantly generate a response policy according to the current organization to which the requesting subject belongs, thereby reducing the configuration amount of static policies. It not only solves the problem of traditional IAM static policy expansion, but also provides a highly flexible and scalable permission management solution, which is suitable for large-scale cloud resources and multi-tenant organizational environments.

[0125] Other embodiments or specific implementations of the device for managing access rights for cloud resources described in the present application may refer to the above-mentioned method embodiments and will not be described in detail here.

[0126] The present application also provides an access permission management device for cloud resources, the access permission management device for cloud resources comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the access permission management method for cloud resources in the above-mentioned embodiment one.

[0127] Reference below Figure 8 , Figure 8 The schematic diagram of the structure of the access rights management device of the cloud resources of the present application. The access rights management device of the cloud resources in the embodiments of the present application may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 8 The access permission management device for cloud resources shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0128] like Figure 8 As shown, the access permission management device for cloud resources may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. Various programs and data required for the operation of the access permission management device for cloud resources are also stored in RAM1004. The processing device 1001, ROM1002, and RAM1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1009. The communication device 1009 can allow the access permission management device for cloud resources to communicate wirelessly or wired with other devices to exchange data. Although the figure shows the access permission management device for cloud resources with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have instead.

[0129] The present application also provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, the computer-readable program instructions being used to execute the method for managing access rights to cloud resources in the above-mentioned embodiment.

[0130] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0131] It should be noted that, in this article, the term "includes", "comprising" or any other variation thereof is intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other elements in the process, method, article or system including the element.

[0132] The serial numbers of the above-mentioned embodiments of the present invention are only for description and do not represent the advantages and disadvantages of the embodiments. They are only some embodiments of the present application and do not limit the patent scope of the present application. All equivalent structural transformations made by using the contents of the description and drawings of the present application under the technical concept of the present application, or direct / indirect application in other related technical fields are included in the patent protection scope of the present application.< / organization> < / organization> < / organization> < / organization> < / organization> < / organization> < / organization> < / organization>

Claims

1. A method for managing access rights of cloud resources, characterized in that: The method comprises: When receiving a permission request, obtain the corresponding request subject information; Determine the current organization according to the request subject information, and update the preset role authority policy template according to the current organization to generate a current response policy, wherein the preset role authority policy template includes at least one declaration information containing a placeholder; The permission request is processed according to the current response policy.

2. The method according to claim 1, characterized in that The step of determining the current organization according to the request subject information, and updating the preset role authority policy template according to the current organization to generate the current response policy includes: Traversing the cloud resource policy table, and determining a preset role authority policy template in the cloud resource policy table; Determine the current organization to which the request subject belongs according to the request subject information, and replace the placeholder in the declaration information with the current organization; Generate the current response strategy based on the replacement result.

3. The method according to claim 2, characterized in that The placeholders include: a subject field placeholder and a resource field placeholder. The step of replacing the placeholders in the declaration information with the current organization includes: The subject field placeholder in the declaration information is replaced with the current organization, and the resource field placeholder in the declaration information is replaced with the current organization.

4. The method according to claim 3, characterized in that The step of generating the current response strategy according to the replacement result includes: The preset role authority policy template is materialized according to the replacement result to generate a current response policy; The current response strategy includes: strategy subject information, strategy resource information, strategy operation information and strategy effect information.

5. The method according to claim 4, characterized in that The step of processing the permission request according to the current response strategy includes: Obtaining requested resource information and requested operation information corresponding to the permission request; Determining whether the requested resource information matches the policy resource information, and determining whether the requested operation information matches the policy operation information; When the requested resource information matches the policy resource information and the requested operation information matches the policy operation information, the permission request is processed according to the policy effect information.

6. The method according to claim 5, characterized in that After the step of determining whether the requested resource information matches the policy resource information and determining whether the requested operation information matches the policy operation, the method further includes: When the requested resource information does not match the policy resource information and / or the requested operation information does not match the policy operation information, the permission request is rejected.

7. The method according to claim 5, characterized in that After the step of traversing the cloud resource strategy table, the method further includes: Determining a conventional permission policy in the cloud resource policy table; Determine whether the request subject information, request resource information, and request operation information match the subject information, resource information, and operation information in the conventional permission policy; If yes, processing the permission request according to the effect information in the conventional permission policy; If not, the permission request is denied.

8. A cloud resource access rights management device, characterized in that: The device comprises: The request receiving module is used to obtain the corresponding request subject information when receiving the permission request; A policy generation module, used to determine the current organization according to the request subject information, and update the preset role authority policy template according to the current organization to generate a current response policy, wherein the preset role authority policy template includes at least one declaration information containing a placeholder; A request processing module is used to process the permission request according to the current response strategy.

9. A cloud resource access rights management device, characterized in that: The access permission management device for cloud resources includes: a memory, a processor, and an access permission management program for cloud resources stored in the memory and executable on the processor. When the access permission management program for cloud resources is executed by the processor, the steps of the method for access permission management for cloud resources as described in any one of claims 1 to 7 are implemented.

10. A storage medium, characterized in that: The storage medium stores a cloud resource access permission management program, which, when executed by a processor, implements the steps of the cloud resource access permission management method according to any one of claims 1 to 7.

Images