Methods, devices, equipment and storage media for managing access permissions of cloud resources

Abstract

This application discloses a method, apparatus, device, and storage medium for cloud resource access control, relating to the field of cloud computing technology. The method includes: upon receiving a permission request, obtaining corresponding request subject information; determining the current organization based on the request subject information, and updating a preset role-based permission policy template according to the current organization to generate a current response policy. The preset role-based permission policy template includes at least one declaration containing placeholders; and processing the permission request according to the current response policy. Based on a dynamic generation technology for role-based permission policy templates, this application can instantly generate a response policy based on the current organization to which the requesting subject belongs when actually requesting permissions, thereby reducing the configuration volume of static policies. This not only solves the problem of bloated traditional IAM static policies but also provides a highly flexible and scalable permission management solution suitable for large-scale cloud resources and multi-tenant organizational environments.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a method, apparatus, device and storage medium for managing access permissions of cloud resources. Background Technology

[0002] In existing cloud resource Identity and Access Management (IAM) systems, each role needs to be bound to multiple policies and control access permissions to subordinate resources. In a multi-tenant organizational environment, as the number of tenant organizations increases, the number of configured roles and policies within the organization grows exponentially.

[0003] Existing technologies often employ static role and policy binding methods. However, as the number of tenant organizations or resources increases, the same type of role has many duplicate policies in different tenant organizations, leading to policy redundancy and increased management costs, which in turn affects the flexibility of cloud resource access control. Summary of the Invention

[0004] The main purpose of this application is to provide a method for managing access permissions for cloud resources, which aims to solve the technical problem that existing static policy configuration methods, when applied to multi-tenant cloud resource scenarios, affect the flexibility of cloud resource access control due to the lengthy and inefficient configuration policies.

[0005] To achieve the above objectives, this application proposes a method for managing access permissions of cloud resources, the method comprising:

[0006] Upon receiving a permission request, obtain the corresponding request subject information;

[0007] The current organization is determined based on the request subject information, and the preset role permission policy template is updated based on the current organization to generate the current response policy. The preset role permission policy template includes at least one declaration information containing placeholders.

[0008] The permission request is processed according to the current response policy.

[0009] In one embodiment, the step of determining the current organization based on the request subject information, updating the preset role permission policy template based on the current organization, and generating the current response policy includes:

[0010] Traverse the cloud resource policy table and determine the preset role permission policy template in the cloud resource policy table;

[0011] The current organization to which the requesting subject belongs is determined based on the requesting subject information, and the placeholders in the declaration information are replaced with the current organization;

[0012] The current response strategy is generated based on the replacement results.

[0013] In one embodiment, the placeholders include: a body field placeholder and a resource field placeholder, and the step of replacing the placeholders in the declaration information with the current organization includes:

[0014] Replace the placeholders in the main field of the declaration information with the current organization, and replace the placeholders in the resource field of the declaration information with the current organization.

[0015] In one embodiment, the step of generating the current response strategy based on the replacement result includes:

[0016] Based on the replacement results, the preset role permission policy template is materialized to generate the current response policy;

[0017] The current response strategy includes: strategy subject information, strategy resource information, strategy operation information, and strategy effect information.

[0018] In one embodiment, the step of processing the permission request according to the current response policy includes:

[0019] Obtain the request resource information and request operation information corresponding to the permission request;

[0020] Determine whether the requested resource information matches the policy resource information, and determine whether the requested operation information matches the policy operation information;

[0021] When the requested resource information matches the policy resource information and the requested operation information matches the policy operation information, the permission request is processed according to the policy effect information.

[0022] In one embodiment, after the steps of determining whether the requested resource information matches the policy resource information and determining whether the requested operation information matches the policy operation, the method further includes:

[0023] The permission request is rejected when the requested resource information does not match the policy resource information and / or the requested operation information does not match the policy operation information.

[0024] In one embodiment, after the step of traversing the cloud resource policy table, the method further includes:

[0025] Determine the regular permission policy in the cloud resource policy table;

[0026] Determine whether the request subject information, request resource information, and request operation information match the subject information, resource information, and operation information in the conventional permission policy;

[0027] If so, the permission request will be processed according to the effect information in the conventional permission policy;

[0028] If not, then the permission request is denied.

[0029] Furthermore, to achieve the above objectives, this application also proposes a cloud resource access permission management device, the device comprising:

[0030] The request receiving module is used to obtain the corresponding request subject information when a permission request is received;

[0031] The strategy generation module is used to determine the current organization based on the request subject information, update the preset role permission policy template based on the current organization, and generate the current response policy. The preset role permission policy template includes at least one declaration information containing placeholders.

[0032] The request processing module is used to process the permission request according to the current response policy.

[0033] In addition, to achieve the above objectives, this application also proposes a cloud resource access permission management device, the device comprising: a memory, a processor, and a cloud resource access permission management program stored on the memory and executable on the processor, the cloud resource access permission management program being configured to implement the steps of the cloud resource access permission management method described above.

[0034] In addition, to achieve the above objectives, this application also proposes a storage medium storing a cloud resource access permission management program, wherein when the cloud resource access permission management program is executed by a processor, it implements the steps of the cloud resource access permission management method described above.

[0035] This application proposes a method for managing access permissions for cloud resources, comprising: upon receiving a permission request, obtaining corresponding request subject information; determining the current organization based on the request subject information, and updating a preset role-based permission policy template based on the current organization to generate a current response policy, wherein the preset role-based permission policy template includes at least one declaration information containing placeholders; and processing the permission request according to the current response policy. Based on a dynamic generation technology of role-based permission policy templates, this application can instantly generate a response policy based on the current organization to which the request subject belongs when actually requesting permissions, thereby reducing the configuration workload of static policies. This not only solves the problem of bloated traditional IAM static policies but also provides a highly flexible and scalable permission management solution suitable for large-scale cloud resources and multi-tenant organizational environments. Attached Figure Description

[0036] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0037] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 This is a flowchart illustrating the first embodiment of the cloud resource access permission management method of this application;

[0039] Figure 2 This is a flowchart illustrating the second embodiment of the cloud resource access permission management method of this application;

[0040] Figure 3 Example diagram of the data structure for a role-based access control (RBAC) policy template;

[0041] Figure 4 This is a flowchart illustrating the third embodiment of the cloud resource access permission management method of this application;

[0042] Figure 5 This is a schematic diagram illustrating the role of the role-based access control strategy template in the cloud resource access control method of this application.

[0043] Figure 6 This is a schematic diagram of the IAM permission verification process for the cloud resource access permission management method based on this application;

[0044] Figure 7 This is a schematic diagram of the module structure of the cloud resource access permission management device of the first embodiment of this application;

[0045] Figure 8 This is a schematic diagram of the structure of the cloud resource access permission management device in this application.

[0046] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0047] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0048] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0049] This application provides a method for managing access permissions to cloud resources, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the cloud resource access permission management method of this application. In this embodiment, the method includes: steps S10 to S30:

[0050] Step S10: Upon receiving a permission request, obtain the corresponding request subject information.

[0051] It should be noted that the embodiments of this application can be applied to user access control in IAM scenarios of large-scale or multi-tenant organizations. The executing entity of the method in this embodiment can be a computing electronic device with data processing, network communication, and program execution capabilities, such as a mobile phone, tablet, access control server, or other electronic devices that can access a cloud resource access control system. The following uses an access control device (hereinafter referred to as "system") that can access a cloud resource access control system as an example to explain the various embodiments of this application.

[0052] It should be understood that when a user issues a permission request, the system can first authenticate the user based on the username / user ID and password. Upon successful authentication, the system retrieves the request information corresponding to the permission request, which may include: request subject information, requested resource information, requested operation information, and restriction information.

[0053] The request subject information may include: the permission role category possessed by the request subject (user) and the tenant organization to which the request subject belongs.

[0054] Step S20: Determine the current organization based on the request subject information, and update the preset role permission policy template based on the current organization to generate the current response policy. The preset role permission policy template includes at least one declaration information containing placeholders.

[0055] It should be understood that when a permission request is received, the system can first perform a fuzzy match between the request subject information and the policy subject information in the role permission policy template to determine the preset role permission policy template applicable to the permission role category possessed by the request subject.

[0056] It should be noted that the preset role permission policy template may include at least one declaration information. Any declaration information may consist of: action information, effect information, resource information, identification information (Sid), and permission subject information (Subject), and each of these shall be recorded by the corresponding field.

[0057] It should also be noted that in the Subject and Resource fields of the above declaration information, dynamic variables can be defined by using placeholders "<>", which can then be replaced with specific organization instances in real time according to the request subject.

[0058] Furthermore, the fields in this role-based permission policy template are explained as follows:

[0059] Action: Represents the allowed operations.

[0060] Effect: The effect of the policy execution can be "allow" or "deny".

[0061] Resource: The resource object on which the strategy applies represents a dynamically generated variable, which will be replaced with the specific organization name in the actual request.

[0062] Sid: A unique identifier for a policy, used to identify the policy.

[0063] Subject: The subject requesting permissions, representing a variable generated dynamically.

[0064] In the specific implementation, the permission role category of the requesting subject and the tenant organization to which the requesting subject belongs (the current organization) can be determined first based on the requesting subject information. Then, the preset role permission policy template corresponding to the permission role category is fuzzy matched according to the permission role category. Finally, the placeholders in the preset role permission policy template are replaced according to the current organization to generate a policy applicable to the current organization (the current response policy).

[0065] Step S30: Process the permission request according to the current response policy.

[0066] It should be noted that after the current response policy is generated, the corresponding fields in the permission request can be matched sequentially based on the fields in the current response policy, thereby completing the user's permission verification based on the matching results.

[0067] In practice, the request information of a user who has issued a permission request and has been authenticated can be matched sequentially based on various fields such as Resource and Action, according to the current response policy. If a match is found, the current request can be allowed or denied according to the Effect field in the current response policy.

[0068] This embodiment, upon receiving a permission request, obtains the corresponding request subject information; determines the current organization based on the request subject information, and updates the preset role-based permission policy template according to the current organization to generate a current response policy. The preset role-based permission policy template includes at least one declaration message containing placeholders; and processes the permission request according to the current response policy. Because this embodiment is based on dynamic generation technology of role-based permission policy templates, it can instantly generate a response policy based on the current organization to which the requesting subject belongs when actually requesting permissions, thereby reducing the configuration amount of static policies. This not only solves the problem of bloated traditional IAM static policies but also provides a highly flexible and scalable permission management solution suitable for large-scale cloud resources and multi-tenant organizational environments.

[0069] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in the first embodiment described above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 2 , Figure 2 This is a flowchart illustrating the second embodiment of the cloud resource access permission management method of this application.

[0070] In this embodiment, considering that the system also includes conventional permission policies, in order to obtain the role permission policy template in each IAM policy table, step S20 specifically includes: steps S201 to S203:

[0071] Step S201: Traverse the cloud resource policy table and determine the preset role permission policy template in the cloud resource policy table.

[0072] It should be noted that the cloud resource policy table may include preset role permission policy templates and regular permission policies.

[0073] Step S202: Determine the current organization to which the requesting subject belongs based on the requesting subject information, and replace the placeholder in the declaration information with the current organization.

[0074] It should be noted that the placeholders in this declaration information can be located in the Subject field, the Resource field, or even the Action field. Role permission policy templates containing placeholders in different field positions can be pre-set according to different policy configuration requirements. Here, we can set a role permission policy template containing Subject field placeholders (located in the Subject field) and Resource field placeholders (located in the Resource field) as an example.

[0075] For example, in traditional IAM policies, the subject is usually statically specified, such as organization1 / role / organizationAdmin, organization2 / role / organizationAdmin, etc. In this role-based permission policy template, the Subject field can be represented in a templated form as: organization / <organization> / roleTemplate / organizationAdmin. When a permission request arrives, the system can automatically match the corresponding organization name based on the organization to which the requesting subject belongs, and place the subject field placeholder. <organization>Replace with the actual organization instance name.

[0076] Similarly, the Resource field also uses <organization>Variables. Therefore, the system can automatically place resource field placeholders. <organization>Replace with the actual organization name.

[0077] In practice, the system can replace the placeholders for the main fields in the declaration information with the current organization, and at the same time, it can also replace the placeholders for the resource fields in the declaration information with the current organization.

[0078] Step S203: Generate the current response strategy based on the replacement results.

[0079] Understandably, by replacing the placeholders in the declaration information of the preset role permission policy template with specific organization instances, the template policy can be materialized, resulting in the materialized current response policy. The declaration information in this current response policy includes: policy subject information, policy resource information, policy operation information, and policy effect information.

[0080] Further, refer to Figure 3 This section uses a role permission policy template, applicable to all tenant organizations, to illustrate the dynamic policy matching mechanism by demonstrating how the `organizationAdmin` role performs operations on resources within that organization. Figure 3 This is a sample diagram of the data structure for a role-based access control (RBAC) policy template.

[0081] exist Figure 3 In the configuration, the statement is based on JSON format. The Action field can be configured to perform an operation on the Artifactory service (e.g., configured as arti:action1); the Effect field can be configured to allow; and the Resource field can be configured to include "organization / <organization> / *, where "*" represents all resources within this organization; the Sid field is a randomly generated strategy identifier string; the Subject field can be configured to include "organization / <organization> / roleTemplate / organizationAdmin".

[0082] Based on the placeholder declaration information in the aforementioned role-based permission policy template, the system can use the placeholder information from the declaration information when requesting permissions. <organization>Replace it with a specific tenant organization name, such as organization1 or organization2, to generate dynamic policies for different tenant organizations, thus solving the problem of expansion of traditional IAM static policies.

[0083] This embodiment traverses the cloud resource policy table and determines a preset role-based permission policy template within it. Based on the request subject information, it determines the current organization to which the request subject belongs, replaces the subject field placeholders in the declaration information with the current organization, and replaces the resource field placeholders in the declaration information with the current organization. Based on the replacement results, it generates the current response policy. Because this embodiment can accurately extract the actual organization name from the request subject (user) upon receiving a permission request, and replaces the template with the current organization... <organization>The replacement process involves not only replacing the placeholders in the subject field but also replacing the placeholders in the resource field with the organization instance name. This allows users with the same role category in different tenant organizations to dynamically match and generate the current response policy in real time, reducing redundant configurations of numerous duplicate policies.

[0084] Based on the first and second embodiments of this application, in the third embodiment of this application, the content that is the same as or similar to that in embodiments one and two above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 4 , Figure 4 This is a flowchart illustrating the third embodiment of the cloud resource access permission management method of this application.

[0085] In this embodiment, to specifically illustrate the authorization process for permission requests based on the current response policy, step S30 specifically includes: steps S301 to S303:

[0086] Step S301: Obtain the request resource information and request operation information corresponding to the permission request.

[0087] Step S302: Determine whether the requested resource information matches the policy resource information, and determine whether the requested operation information matches the policy operation information.

[0088] It should be noted that, firstly, it can be determined whether the resource requested by the user falls within the resource range restricted by the policy resource information in the current response policy; if so, it can continue to match whether the operation requested by the user falls within the operation range restricted by the policy operation information in the current response policy.

[0089] Step S303: When the requested resource information matches the policy resource information and the requested operation information matches the policy operation information, the permission request is processed according to the policy effect information.

[0090] Understandably, if the resources and operations requested by the user conform to the resource and operation ranges restricted in the current response policy, the user's permission request can be processed according to the policy effect information in the current response policy. Specifically, if the policy effect information is "allow," the user's permission request is granted; if the policy effect information is "deny," the user's permission request is denied.

[0091] It should also be noted that when the current response strategy includes multiple declarations, if the matching results of the resources and operations requested by the user differ among the various declarations, the user's permission request can be processed according to the priority of each declaration. Specifically, the user's request information can be directly matched with each declaration, and the user's permission request can be allowed or denied based on the matching result corresponding to the declaration with higher priority.

[0092] Furthermore, after step S302, the following steps are also included:

[0093] Step S303': When the requested resource information does not match the policy resource information and / or the requested operation information does not match the policy operation information, the permission request is rejected.

[0094] It should be noted that if the resource requested by the user is not within the scope of resources restricted by the policy resource information in the current response policy, or if the operation requested by the user is not within the scope of operations restricted by the policy operation information in the current response policy, the system may directly reject the user's permission request.

[0095] In this embodiment, the current response policy is generated by the role-based permission policy template to authenticate users. Compared with the existing method, the specific policy entry can be generated when the user actually requests permission, which greatly reduces the resource space occupied by the policy storage in the system and reduces the time spent querying the appropriate policy in a large number of static policies, thereby further improving the speed of user permission authentication.

[0096] Furthermore, considering that the cloud resource policy table also includes regular permission policies, meaning that user permission verification is also subject to regular permission policies, after step S201, the following steps are also included: steps S30' to S60':

[0097] Step S30': Determine the regular permission policy in the cloud resource policy table.

[0098] It should be understood that this standard permission policy uses statically specified IAM policies for each field, such as Subject, Resource, and Action.

[0099] Step S40': Determine whether the request subject information, request resource information, and request operation information match the subject information, resource information, and operation information in the conventional permission policy.

[0100] Step S50': If yes, then process the permission request according to the effect information in the conventional permission policy;

[0101] Step S60': If not, then reject the permission request.

[0102] It should be noted that, according to this standard permission policy, the request information of users who issue permission requests and are authenticated can be matched sequentially based on various fields such as Subject, Resource, and Action. If a match is found, the current request can be allowed / denied according to the Effect field in the standard permission policy.

[0103] Furthermore, this can be combined with Figure 5 This paper provides a detailed explanation of the role-based access control (RBAC) policy template within the IAM system, as part of the cloud resource access control method described in this application. Figure 5 This is a schematic diagram illustrating the role of the role-based access control strategy template in the cloud resource access control method of this application.

[0104] exist Figure 5 In the process, when a user issues a permission request, the system authenticates the user based on the user's username / password. If the authentication is successful, the system obtains the request information corresponding to the request subject (e.g., Subject1, Object1, Action1).

[0105] Next, the permission verification process is executed: the normal permission policies (normalPolicies) and the role permission policy template (rolePermissionTemplatePolicy1) are determined in the IAM policy library.

[0106] Standard permission policies are predefined policies by the system and are usually written in JSON format, including elements such as Subject, Resource, Action, Effect, and Condition. Role-based permission policy templates use dynamic variables, such as dynamic variables for the Subject (roleTemplate1) and Resource (resourceTemplate1), to define permissions. This can automatically generate policies that match users and resources, thereby reducing the amount of configuration required for static policies.

[0107] Actions refer to the operations performed on a resource that the requesting entity requests, such as reading, writing, and deleting. Different requests (Service1, 2, 3, etc.) can correspond to different actions (Action1, 2, etc.).

[0108] Resources refer to the objects that the requesting entity wants to access, such as compute instances, storage buckets, and network interfaces. Different requests (Service1, 2, 3, etc.) can correspond to different actions (Resource1, 2, etc.).

[0109] This can also be combined Figure 6 The entire process of system permission verification is explained. Figure 6 This is a schematic diagram of the IAM permission verification process for the cloud resource access permission management method based on this application.

[0110] exist Figure 6 In the process, after user authentication is completed, the IAM policy table in the system is traversed to determine whether each IAM policy is a role-based access control (RBAC) policy template. If not, the IAM policy is a regular access control policy, and the request information is directly matched based on the Subject, Resource, Action, and other fields. The current request is allowed or denied based on the matching result.

[0111] If so, a fuzzy match is performed based on the permission role category possessed by the requesting subject: the role permission policy template corresponding to the permission role category is determined; then, the value of the dynamic variable in the preset role permission policy template is determined according to the tenant organization to which the requesting subject belongs, that is, the placeholder of the Subject field in the declaration information is replaced with the current organization, and the placeholder of the Resource field in the declaration information is also replaced with the current organization; thus, the preset role permission policy template is materialized, and the current response policy is generated; then, the policy resource information and policy operation information in the current response policy are matched, and if the match is consistent, the current request is allowed / denied according to the policy effect information in the current response policy.

[0112] In this embodiment, when obtaining user request information, the system can first attempt to match a regular permission policy. If the regular permission policy match fails, the system can attempt to match a role-based permission policy target. If the role-based permission template policy match successfully, the request can be authorized; if all IAM policy matches fail, the request is rejected. By introducing a dynamic policy matching mechanism, the system can allow for more granular and dynamic permission control, especially when permissions need to be dynamically adjusted based on user roles or other conditions. This significantly improves the flexibility and scalability of user permission management in large-scale IAM and multi-tenant environments.

[0113] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the access permission management method of cloud resources in this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0114] In addition, this application also provides a cloud resource access permission management device, referring to Figure 7 , Figure 7 This is a structural block diagram of the first embodiment of the cloud resource access permission management device of this application; as shown below. Figure 7 As shown, the device includes:

[0115] The request receiving module 701 is used to obtain the corresponding request subject information when a permission request is received;

[0116] The strategy generation module 702 is used to determine the current organization based on the request subject information, update the preset role permission policy template based on the current organization, and generate the current response policy. The preset role permission policy template includes at least one declaration information containing placeholders.

[0117] The request processing module 703 is used to process the permission request according to the current response policy.

[0118] Furthermore, the policy generation module 702 is also used to traverse the cloud resource policy table and determine a preset role permission policy template in the cloud resource policy table; determine the current organization to which the request subject belongs based on the request subject information, and replace the placeholder in the declaration information with the current organization; generate the current response policy based on the replacement result; wherein, the placeholder includes: subject field placeholder and resource field placeholder.

[0119] Furthermore, the strategy generation module 702 is also used to replace the main field placeholder in the declaration information with the current organization, and to replace the resource field placeholder in the declaration information with the current organization.

[0120] Furthermore, the strategy generation module 702 is also used to materialize the preset role permission strategy template according to the replacement result and generate the current response strategy; wherein, the current response strategy includes: strategy subject information, strategy resource information, strategy operation information and strategy effect information.

[0121] Furthermore, the request processing module 703 is also used to obtain request resource information and request operation information corresponding to the permission request; determine whether the request resource information matches the policy resource information, and determine whether the request operation information matches the policy operation information; when the request resource information matches the policy resource information and the request operation information matches the policy operation information, process the permission request according to the policy effect information.

[0122] Furthermore, the request processing module 703 is also configured to reject the permission request when the requested resource information does not match the policy resource information and / or the requested operation information does not match the policy operation information.

[0123] Furthermore, the request processing module 703 is also used to determine a regular permission policy in the cloud resource policy table; determine whether the request subject information, request resource information, and request operation information match the subject information, resource information, and operation information in the regular permission policy; if yes, process the permission request according to the effect information in the regular permission policy; if no, reject the permission request.

[0124] This embodiment is based on the dynamic generation technology of role-based permission policy templates. When actually requesting permissions, it can generate a response policy in real time according to the current organization to which the requesting subject belongs, thereby reducing the configuration amount of static policies. It not only solves the problem of the expansion of traditional IAM static policies, but also provides a highly flexible and scalable permission management solution, which is suitable for large-scale cloud resources and multi-tenant organizational environments.

[0125] Other embodiments or specific implementations of the cloud resource access permission management device described in this application can be found in the above-described method embodiments, and will not be repeated here.

[0126] This application also provides a cloud resource access permission management device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, which are executed by the at least one processor to enable the at least one processor to perform the cloud resource access permission management method in the first embodiment described above.

[0127] The following is for reference. Figure 8 , Figure 8 This is a schematic diagram of the cloud resource access permission management device of this application. The cloud resource access permission management device in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), etc., as well as fixed terminals such as digital TVs, desktop computers, etc. Figure 8 The cloud resource access control device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0128] like Figure 8 As shown, the cloud resource access control device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1002 or a program loaded from storage device 1003 into random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the cloud resource access control device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the cloud resource access management device to communicate wirelessly or wiredly with other devices to exchange data. Although cloud resource access management devices with various systems are shown in the figure, it should be understood that it is not required to implement or possess all the systems shown. More or fewer systems may be implemented alternatively.

[0129] This application also provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the cloud resource access permission management method in the above embodiments.

[0130] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0131] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other elements in the process, method, article, or system that includes that element.

[0132] The sequence numbers of the above embodiments of the present invention are merely for description and do not represent the superiority or inferiority of the embodiments. They are only some embodiments of this application and do not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the content of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included within the patent protection scope of this application.< / organization> < / organization> < / organization> < / organization> < / organization> < / organization> < / organization> < / organization>

Claims

1. A method for managing access permissions for cloud resources, characterized in that, The method includes: Upon receiving a permission request, obtain the corresponding request subject information; The current organization is determined based on the request subject information, and the preset role permission policy template is updated based on the current organization to generate the current response policy. The preset role permission policy template includes at least one declaration information containing placeholders. The declaration information includes: operation information, effect information, resource information, identification information, and permission subject information. The placeholders are located in the fields corresponding to the permission subject information and the resource information, respectively. The permission request is processed according to the current response policy; The step of determining the current organization based on the request subject information, updating the preset role permission policy template based on the current organization, and generating the current response policy includes: Traverse the cloud resource policy table and determine the preset role permission policy template in the cloud resource policy table; The current organization to which the requesting subject belongs is determined based on the requesting subject information, and the placeholders in the declaration information are replaced with the current organization; The current response strategy is generated based on the replacement results.

2. The method as described in claim 1, characterized in that, The placeholders include: body field placeholders and resource field placeholders. The step of replacing the placeholders in the declaration information with the current organization's placeholders includes: Replace the placeholders in the main field of the declaration information with the current organization, and replace the placeholders in the resource field of the declaration information with the current organization.

3. The method as described in claim 2, characterized in that, The step of generating the current response strategy based on the replacement result includes: Based on the replacement results, the preset role permission policy template is materialized to generate the current response policy; The current response strategy includes: strategy subject information, strategy resource information, strategy operation information, and strategy effect information.

4. The method as described in claim 3, characterized in that, The step of processing the permission request according to the current response policy includes: Obtain the request resource information and request operation information corresponding to the permission request; Determine whether the requested resource information matches the policy resource information, and determine whether the requested operation information matches the policy operation information; When the requested resource information matches the policy resource information and the requested operation information matches the policy operation information, the permission request is processed according to the policy effect information.

5. The method as described in claim 4, characterized in that, After the steps of determining whether the requested resource information matches the policy resource information and determining whether the requested operation information matches the policy operation, the method further includes: The permission request is rejected when the requested resource information does not match the policy resource information and / or the requested operation information does not match the policy operation information.

6. The method as described in claim 4, characterized in that, Following the step of traversing the cloud resource policy table, the following is also included: Determine the regular permission policy in the cloud resource policy table; Determine whether the request subject information, request resource information, and request operation information match the subject information, resource information, and operation information in the conventional permission policy; If so, the permission request will be processed according to the effect information in the conventional permission policy; If not, then the permission request is denied.

7. A cloud resource access permission management device, characterized in that, The device includes: The request receiving module is used to obtain the corresponding request subject information when a permission request is received; The strategy generation module is used to determine the current organization based on the request subject information, update the preset role permission policy template based on the current organization, and generate the current response policy. The preset role permission policy template includes at least one declaration information containing placeholders. The declaration information includes: operation information, effect information, resource information, identification information, and permission subject information. The placeholders are located in the fields corresponding to the permission subject information and the resource information, respectively. The request processing module is used to process the permission request according to the current response policy; The policy generation module is also used to traverse the cloud resource policy table and determine a preset role permission policy template in the cloud resource policy table; determine the current organization to which the request subject belongs based on the request subject information, and replace the placeholder in the declaration information with the current organization; and generate the current response policy based on the replacement result.

8. A cloud resource access permission management device, characterized in that, The cloud resource access permission management device includes: a memory, a processor, and a cloud resource access permission management program stored in the memory and executable on the processor. When the cloud resource access permission management program is executed by the processor, it implements the steps of the cloud resource access permission management method as described in any one of claims 1 to 6.

9. A storage medium, characterized in that, The storage medium stores a cloud resource access permission management program, which, when executed by a processor, implements the steps of the cloud resource access permission management method as described in any one of claims 1 to 6.

Images