Authority control method and device

Abstract

The invention discloses an authority control method and device, relates to the technical field of authority management, and mainly aims to improve data security under a dynamic change condition. According to the main technical scheme, the method comprises the following steps: acquiring an access request in a service system, wherein the access request comprises an access subject, an accessed object, an access environment and an access action; according to the access subject and the accessed object, retrieving a corresponding specified authority control strategy from an access strategy library; according to the access environment, judging whether the current time is a safe access opportunity; if not, whether the specified permission control strategy is adjusted or not is determined according to the access action, a target permission control strategy is obtained, the access request is processed according to the target permission control strategy, and the target permission control strategy is a strategy for guaranteeing data security in the accessed object at the non-security access opportunity currently; and if yes, processing the access request according to a specified authority control strategy. The method and the device are used for authority control when the access action exists.

Description

Technical Field

[0001] The present invention relates to the technical field of authority management, and in particular to a method and device for authority control. Background Art

[0002] With the rapid development of information technology, the access requirements of subjects (such as users, processes or threads that initiate resource access actions in the system and other objects that can perform operations) to objects (such as resources or entities that can be operated or accessed in the system, usually files, devices, memory blocks, processes, network links, etc.) are increasing. Therefore, it is necessary to introduce permission control methods to ensure data security and compliance. When a subject issues an access request to access an object, the permission control method can determine whether the subject has the permission to perform a specific operation.

[0003] The current permission control method mainly defines static permission control policies, including which subjects can access which objects and which operations can be performed on the objects. For example, a user may be granted read permission for a database, but cannot write or delete data in the database. This permission control method guarantees data security to a certain extent.

[0004] However, the existing permission control method also has obvious limitations. Specifically, this static permission control method cannot adapt to the security needs under dynamic changes. For example, in some enterprises, when there are high requirements for data confidentiality, if an employee's location changes from an office location to a non-office location and logs into the company's business system, it may cause security issues such as threats to corporate data in the business system. Summary of the invention

[0005] In view of the above problems, the present invention provides a permission control method and device, the main purpose of which is to improve data security under dynamic changes.

[0006] In order to solve the above technical problems, the present invention proposes the following solutions:

[0007] In a first aspect, the present invention provides a permission control method, the method comprising:

[0008] Obtaining an access request in a business system, wherein the access request includes an access subject, an accessed object, an access environment, and an access action;

[0009] According to the access subject and the accessed object, a corresponding designated authority control policy is retrieved from an access policy library;

[0010] Determining whether it is a safe access opportunity according to the access environment;

[0011] If not, determining whether to adjust the specified permission control policy according to the access action, obtaining a target permission control policy, and processing the access request according to the target permission control policy, wherein the target permission control policy is a policy for ensuring data security in the accessed object when the access is currently in a non-secure access opportunity;

[0012] If so, the access request is processed according to the specified permission control policy.

[0013] In a second aspect, the present invention provides a permission control device, the device comprising:

[0014] A request acquisition unit, used to acquire an access request in the business system, wherein the access request includes an access subject, an accessed object, an access environment, and an access action;

[0015] A policy retrieval unit, configured to retrieve a corresponding designated authority control policy from an access policy library according to the access subject and the accessed object parsed by the request acquisition unit;

[0016] A timing judgment unit, used to judge whether it is a safe access timing according to the access environment parsed by the request acquisition unit;

[0017] A policy adjustment unit, configured to determine whether to adjust the specified permission control policy according to the access action if the judgment result of the timing judgment unit is no, and obtain a target permission control policy, so as to process the access request according to the target permission control policy, wherein the target permission control policy is a policy for ensuring the security of data in the accessed object when the access timing is currently in a non-secure access opportunity;

[0018] The request processing unit is used to process the access request according to the specified authority control policy if the judgment result of the opportunity judgment unit is yes.

[0019] In order to achieve the above object, according to a third aspect of the present invention, a storage medium is provided, wherein the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the permission control method of the first aspect.

[0020] In order to achieve the above objective, according to a fourth aspect of the present invention, a processor is provided, the processor being used to run a program, wherein the permission control method of the first aspect is executed when the program is run.

[0021] By means of the above technical scheme, a permission control method and device provided by the present invention can effectively protect the data security in the accessed object when the access is currently in a non-safe access opportunity. Specifically, the access request in the business system can be obtained first, and then the corresponding specified permission control policy can be retrieved in the access policy library according to the access subject and the accessed object in the access request; at the same time, it is determined whether it is currently in a safe access opportunity according to the access environment. If it is not currently in a safe access opportunity, it can be determined whether to adjust the specified permission control policy according to the access action to obtain the target permission control policy, so as to process the access request according to the target permission control policy, wherein the target permission control policy is a policy that ensures the data security in the accessed object when the access is currently in a non-safe access opportunity; if it is in a safe access opportunity, no adjustment is required, and the access request can be directly processed according to the specified permission control policy. Compared with the prior art, the present invention does not directly define a static access policy, but adjusts the existing access policy according to the actual situation to ensure the data security in the accessed object under non-safe access opportunities.

[0022] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0024] Figure 1 A flowchart of a permission control method provided by an embodiment of the present invention is shown;

[0025] Figure 2 Another method for controlling permissions provided by an embodiment of the present invention is shown in the flowchart;

[0026] Figure 3 A block diagram showing a composition of a permission control device provided by an embodiment of the present invention is shown;

[0027] Figure 4 A block diagram showing the composition of another permission control device provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0028] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0029] In view of the problem that the current static permission control method cannot adapt to the security needs under dynamic changes, the inventor has developed a permission control method through creative work. This method can adjust the existing permission control strategy according to the real-time situation, so as to effectively protect the data security of the accessed object. When implemented, the execution subject is the permission control system, which integrates multiple parts, namely: permission control strategy definition area, access decision module, timing judgment module, policy sharing area, audit center, checkpoint interception system and request filtering layer.

[0030] Specifically, the permission control policy definition area is responsible for customizing and configuring permission control policies; the policy sharing area is used to store parsed and customized permission control policies for invocation by the access decision module and the timing decision module. When the checkpoint interception system receives an access request, it is responsible for interrupting the access process and extracting key information from the access request, including the access subject, the object being accessed, the access environment, and the access action. The extracted access environment information is passed to the timing decision module for security timing assessment, while the access subject, the object being accessed, and the access action are processed by the access decision module.

[0031] The timing judgment module determines whether the current access timing is safe based on the access environment information, and decides whether the corresponding permission control policy stored in the policy sharing area needs to be adjusted. The access decision module searches for the corresponding permission control policy in the policy sharing area based on the information of the access subject and the object being accessed, and decides whether to allow the access action to be executed based on the evaluation results of the timing judgment module. The audit center is responsible for recording and storing the results of whether the access action is executed for subsequent auditing and monitoring.

[0032] Finally, the request filtering layer performs preliminary screening and processing of access requests before they reach the system, ensuring the efficiency and security of subsequent processing. Through this design, the method of the present invention not only improves the flexibility and response speed of permission control, but also enhances the system's defense capability when facing complex security threats.

[0033] It should be noted that the present invention provides a policy sharing area because the present invention distinguishes between user state and kernel state. The user state program part can read and parse the permission control policy, and convert the parsed permission control policy into a corresponding program framework, which is then stored in the policy sharing area for use by the kernel state access adjudication module.

[0034] In the present invention, when setting and configuring the permission control policy in the permission control policy definition area, it is allowed to perform detailed granular management on subjects such as processes, threads, users, and objects such as files, devices, and networks. Specifically, specific attribute fields can be extracted for these objects, and these field information can be included in the permission control policy. For example, the attribute of the creation time of the thread can be extracted and configured. In this way, the permission control policy will be more accurate and comprehensive.

[0035] For example, there is a file management system where strict control of user access to files is required. In the permission control policy definition area, the following configuration can be performed:

[0036] Subject: User "Zhang San"

[0037] Object: Important company document "Financial report.docx"

[0038] Fine-grained configuration:

[0039] Extract fields: file creation date, file size, file modification times

[0040] Permission control policy: Only "Zhang San" is allowed to view files when the file creation date is more than one year and the file size does not exceed 10MB. If the file is modified more than 5 times, "Zhang San" is prohibited from editing.

[0041] Through such configuration, precise control of Zhang San's access to the "Financial Report.docx" file is achieved. This policy not only takes into account the basic permissions of users and files, but also combines the attribute fields of the file, thereby improving the flexibility and security of permission management.

[0042] Next, a permission control method provided by the present invention is described, and its specific execution steps are as follows: Figure 1 As shown, including:

[0043] 101. Obtain access requests in the business system.

[0044] The above-mentioned permission control system of the present invention can be applied to any business system. When a user or other subject (such as a process or thread, etc.) initiates an access request in the business system, the checkpoint interception system can intercept the access request and parse it, and extract the access subject, accessed object, access environment and access action contained in the access request.

[0045] 102. According to the access subject and the accessed object, the corresponding designated permission control policy is retrieved from the access policy library.

[0046] In an embodiment of the present invention, business personnel can customize and configure the permission control policy in advance in the permission control policy definition area. When configuring, it can be done according to a predetermined template or by other configuration methods. Specifically, during the configuration process, different subjects can be divided into different roles or types, and multiple permissions can be assigned to the accessed objects, such as reading a certain part of the content or writing in a certain part of the content. In addition, it is also necessary to define which subjects have which permissions on which objects.

[0047] After the definition is completed, it can be saved in the policy sharing area in the form of subject-object-authority control policy, where the subject can be embodied as a role or type. In addition, the corresponding relationship between each subject and its corresponding role or type can also be stored.

[0048] In this way, when the access request is obtained in step 101, the access subject obtained by parsing in step 101 can be used to find the role or type corresponding to the subject in the corresponding relationship table between the subject and the role or type, and then find the corresponding designated permission control policy in the policy sharing area according to the role or type of the subject and the object being accessed.

[0049] For example, define roles and types:

[0050] Different subjects (users) are divided into different roles, such as "administrator", "project manager", "ordinary employee", etc.

[0051] The objects (documents) to be accessed are divided into different types, such as "public documents", "department documents", and "confidential documents".

[0052] Subject-object-authority control strategy:

[0053] Admin - Public Documents - Read / Write

[0054] Admin - Department Documents - Read / Write

[0055] Administrators - Confidential Documents - Read / Write

[0056] Project Manager-Public Documents-Read

[0057] Project Manager - Department Documents - Read / Write

[0058] Ordinary Employees-Public Documents-Read

[0059] Ordinary Employee-Department Document-Read

[0060] In addition, the correspondence between each subject and its corresponding role is stored:

[0061] Zhang San-Administrator

[0062] Li Si-Project Manager

[0063] Wang Wu-Ordinary Employee

[0064] In this way, when the system receives an access request, it obtains and parses the access request, extracts the access subject (Li Si), the accessed object (confidential document), the access environment (for example, time, place, etc.) and the access action (read).

[0065] Find roles:

[0066] According to the subject and role correspondence table, it is found that the role of "Li Si" is "Project Manager".

[0067] Find the permission control policy:

[0068] In the policy sharing area, search for the corresponding permission control policy based on the Project Manager role and Confidential Documents.

[0069] It should be noted that when configuring the authority control strategy in the present invention, for some common accessed objects, a unified authority can be given when each subject accesses.

[0070] 103. Determine whether it is a safe access opportunity based on the access environment.

[0071] In this embodiment, some exemplary scenarios will be described, such as financial business systems and business systems of enterprises. For financial business systems, due to their business characteristics, they often have strong timeliness and sensitivity. Financial transactions need to be processed at precise time points, and any time deviation may lead to transaction failure or financial loss. In addition, financial business systems have extremely high requirements for data security and integrity, and any unauthorized access or tampering may lead to serious consequences, such as financial fraud, capital loss or reputation damage.

[0072] Enterprise business systems usually follow fixed office hours. Under normal circumstances, employees can access business systems smoothly during the specified working hours and office locations. However, if employees access the system during non-working hours or non-office locations and tamper with system data, it is very likely to cause significant losses to the enterprise, including but not limited to the leakage of business secrets, operational chaos and reduced market competitiveness.

[0073] To prevent such risks, you can determine whether it is a safe access opportunity by judging the access environment, and make adaptive follow-up operations based on whether it is a safe access opportunity.

[0074] Specifically, different criteria can be used to determine whether the current access is safe or not based on the access environment. When the access subject is a process or thread, it can be checked whether the currently initiated operation is within the pre-set permitted time period; and when the access subject is a user, it can be determined whether the current access is safe or not based on the access account, access location, access time or access network environment in the access environment obtained by parsing the access request initiated by the user in the logged-in business system.

[0075] Take the financial business system as an example:

[0076] 1. The access subject is a process or thread:

[0077] Scenario: Batch processing jobs in financial business systems are usually executed at night to process a large amount of transaction data. Therefore, the allowed time period is from 10 pm to 6 am the next day.

[0078] Example: At 8:00 p.m., a batch job in the system starts. At this time, the system checks whether the current time is within the allowed time period. If it is not within the allowed time period, it is considered that the current time is not a safe access time and the job is not allowed to continue.

[0079] The access subject is the user:

[0080] Scenario: Traders need to access the system to perform trading operations during office hours.

[0081] Judgment criteria: The allowed time period is 9:00 am to 5:00 pm on weekdays; the allowed location is the company's internal network.

[0082] Example: At 10 a.m., a trader initiates a transaction in the company's internal network environment. The system checks whether the access time is within the allowed time period and confirms that the access network environment is the company's internal network. Therefore, it is determined that the current access time is safe and the transaction operation is allowed to continue.

[0083] When it is determined according to the access environment that the current access opportunity is safe, step 105 is executed; otherwise, step 104 is executed.

[0084] 104. Determine whether to adjust the specified permission control policy according to the access action, and obtain the target permission control policy.

[0085] In this embodiment, it is not necessary to adjust the specified permission control policy. It is also necessary to determine whether the specified permission control policy needs to be adjusted in combination with the permission control content in the permission control policy and the specific access action.

[0086] In one possible implementation, if the permission control content allows write-class access actions to be performed in the accessed object, and the current access action is a write-class access action, since the write-class action will affect the data change in the accessed object, in this case, it is necessary to adjust the specified permission control policy to obtain the target permission control policy to prevent the data in the accessed object from being tampered with. Of course, if the access action is a read-class access action, or the permission control content is to allow read-class access actions to be performed in the accessed object, there is no need to adjust the specified permission control policy.

[0087] During adjustment, the permission control content in the specified permission control policy may be changed to prohibit access actions from being performed on the accessed object during non-safe access opportunities.

[0088] In another possible implementation, it is also possible to determine whether the specified authority control policy needs to be adjusted in combination with the properties of the accessed object and the access action. In this case, the properties of the accessed object play a decisive role.

[0089] Specifically, if the accessed object is a confidential document, even if the access action at this time is a read-type access action, and the permission control content in the specified permission control policy is to allow read-type access actions, the specified permission control policy needs to be changed. This is because even if you just view a confidential document, it may lead to the leakage of the document through other channels (such as taking photos, etc.). In this case, the permission control content in the specified permission control policy needs to be adjusted to prohibit the execution of read-type access actions in the accessed object during non-secure access opportunities, so as to obtain the target permission control policy.

[0090] Alternatively, the above two methods can be directly selected at the beginning of the scheme, or can be freely selected according to the different objects to be accessed in each access request. For example, some objects to be accessed may be just ordinary documents, which will not have any impact even if they are read.

[0091] In summary, the nature of the accessed object and the access action can be combined to determine whether to adjust the specified permission control policy. For example, if the accessed object is a confidential document, regardless of whether the access action is a read-type access action or a write-type access action, if the original specified permission control policy is to allow read-type access actions or to allow write-type access actions, then the specified permission control policy needs to be adjusted; on the contrary, if it is a common document or other document, the access action is a write-type access action, and the permission control content in the original specified permission control policy is to allow write-type access actions, then the specified permission control policy needs to be adjusted.

[0092] It should be noted that, in the present invention, a form that is not explicitly stated as not permitted can be used.

[0093] The target permission control strategy is a strategy for ensuring the security of data in the accessed object when the access is currently in a non-secure access opportunity.

[0094] In this step, if the adjusted target permission control policy does not allow access actions to be performed in the accessed object, it is necessary to return a no-authority prompt to the access subject corresponding to the access request and indicate the reason for no-authority. It can be because the current stage is not a safe access opportunity, and the result is reported to the audit center.

[0095] 105. Process the access request according to the specified permission control policy.

[0096] In this step, if the permission control content in the specified permission control policy is to allow the access action to be performed in the accessed object, the corresponding resource can be found in the accessed object and returned to the access subject of the access request, and the access information will be reported to the audit center.

[0097] For example, user A requests to read a document named "Project Plan". The checkpoint interception system intercepts the access request and parses it out:

[0098] Access subject: User A, Access object: Project plan, Access environment: During office hours, office location, Access action: Read

[0099] The access decision module searches for the corresponding permission control policy in the policy sharing area based on user A and the "project plan".

[0100] It is found that the permission control policy allows user A to read the "Project Plan".

[0101] Next, the timing judgment module can be used to confirm that the current safe access timing (within office hours, office location) is reached.

[0102] Then, the access decision module confirms the permission control policy to allow user A to read the "project plan" based on the result output by the timing judgment module.

[0103] The access adjudication module allows user A to perform a read action and find the corresponding document resource in the "project plan" and returns the document resource to user A.

[0104] Based on the above Figure 1 It can be seen from the implementation method that the permission control method provided by the present invention can effectively protect the data security in the accessed object when it is currently in a non-safe access opportunity. Specifically, the access request in the business system can be obtained first, and then the corresponding specified permission control policy can be retrieved in the access policy library according to the access subject and the accessed object in the access request; at the same time, it is determined whether it is currently in a safe access opportunity according to the access environment. If it is not currently in a safe access opportunity, it can be determined whether to adjust the specified permission control policy according to the access action to obtain the target permission control policy, so as to process the access request according to the target permission control policy, wherein the target permission control policy is a policy that ensures the data security in the accessed object when it is currently in a non-safe access opportunity; if it is in a safe access opportunity, no adjustment is required, and the access request can be directly processed according to the specified permission control policy. Compared with the prior art, the present invention does not directly define a static access policy, but adjusts the existing access policy according to the actual situation to ensure the data security in the accessed object under non-safe access opportunities.

[0105] Furthermore, as a Figure 1 The embodiment shown in the figure is refined and expanded. The embodiment of the present invention also provides another permission control method, such as Figure 2 As shown, the specific steps are as follows:

[0106] 201. Determine at the request filtering layer whether the access request to be accessed is accessible.

[0107] In this embodiment, before the access request is formally accessed, filtering can be performed at the request filtering layer. Specifically, it is to check whether the access request to be accessed is compliant.

[0108] The request filtering layer may first detect whether there is an access request to be accessed. If so, the request filtering layer may first parse the request to obtain the access subject, the accessed object, the access environment, and the access action.

[0109] At this point, if the access subject is a user, it is possible to further check whether the access account in the access environment is in the pre-maintained blacklist account list. If so, the access request is rejected; otherwise, the access request is allowed to pass the request filtering layer.

[0110] If the access subject is a thread, it can be further checked whether the thread belongs to a predefined trusted thread list. If so, the access request of the thread is allowed to pass through the request filtering layer; otherwise, the access request of the thread is rejected.

[0111] That is, this step includes determining whether the access subject is a user. If so, the following steps are executed: "further check whether the access account in the access environment is in the pre-maintained blacklist account list. If so, the access request is rejected; otherwise, the access request is allowed to pass through the request filtering layer"; if it is a thread, the following steps are executed: "further check whether the thread belongs to the pre-defined trusted thread list. If so, the access request of the thread is allowed to pass through the request filtering layer; otherwise, the access request of the thread is rejected."

[0112] 202. Obtain access requests in the business system.

[0113] It should be noted that what is obtained in this step is the access request after passing step 201. In this step, the checkpoint interception system further formally analyzes the access request to obtain the access subject, the accessed object, the access environment and the access action.

[0114] 203. According to the access subject and the accessed object, the corresponding designated authority control policy is retrieved from the access policy library.

[0115] Among them, some implementation methods of step 203 are the same as those of step 102, and can achieve the same technical effects and solve the same technical problems, and will not be repeated here.

[0116] It should be additionally explained that in this embodiment, a pending review list can also be separately maintained to store the access request in the pending review list when there is no designated authority control policy corresponding to the access subject and the accessed object in the access policy library.

[0117] At the same time, in order for business personnel to review as quickly as possible, the list to be reviewed can also be sent to the display terminal to notify the business personnel to review. The purpose of the review is to confirm whether the request has the authority to execute.

[0118] 204. Determine whether it is a safe access opportunity based on the access environment.

[0119] In this embodiment, if the access subject is a user, the access time, access location and access account in the access environment can be obtained, and then multiple historical access locations corresponding to the access account in the historical time period can be obtained.

[0120] Next, the location with the most occurrences among the multiple historical access locations is determined as the frequently visited location. It can then be determined whether the access location in the access request is consistent with the frequently visited location. If not, it is determined that the current access time is a non-safe access time; conversely, if consistent, it is further determined whether the access time is within the preset regular access time period in the business system. If so, it is determined that the current access time is a safe access time; if not, it is determined that the current access time is a non-safe access time.

[0121] When the access subject is a process or thread, it can be checked whether the currently initiated operation is within a preset allowed time period. If so, it is determined that the current access time is safe, otherwise, it is an unsafe access time.

[0122] The preset regular access time period corresponding to the user and the preset allowed time period corresponding to the thread or process may be determined according to the business requirements of the business system or the working hours of the enterprise.

[0123] If it is a safe access opportunity, execute step 206; otherwise, execute step 205.

[0124] 205. Determine whether to adjust the specified permission control policy according to the access action, obtain the target permission control policy, and process the access request according to the target permission control policy.

[0125] In this embodiment, in order to improve processing efficiency, it can be determined whether to adjust the specified permission control policy based only on the access action. Specifically, it can be determined whether the access action is a write-type access action and the permission control content in the specified permission control policy includes allowing the access action to be performed on the accessed object, and the write-type access action is an access action that is prohibited from being performed under non-secure access conditions; if so, the permission control content in the specified permission control policy is adjusted to prohibit the execution of this type of access action in the accessed object under non-secure access conditions, so as to obtain the target permission control policy.

[0126] At this time, the target permission control policy is to prohibit the execution of such access actions in the accessed object at the time of non-safe access. If the access action is a write-type access action, the execution of such access actions is not allowed. A prompt indicating that the access subject does not have permission can be returned, and the reason for the lack of permission can be indicated, such as at a non-safe access time.

[0127] The target permission control strategy is a strategy for ensuring the security of data in the accessed object when the access is currently in a non-secure access opportunity.

[0128] 206. Process the access request according to the specified permission control policy.

[0129] Among them, the implementation method of step 206 is the same as that of step 105, and can achieve the same technical effect and solve the same technical problem, and will not be repeated here.

[0130] Furthermore, as a response to the above Figure 1 In order to realize the method shown in the figure, the embodiment of the present invention also provides a permission control device for Figure 1 The device embodiment corresponds to the aforementioned method embodiment. For ease of reading, this device embodiment will not repeat the details of the aforementioned method embodiment one by one, but it should be clear that the device in this embodiment can correspond to all the contents of the aforementioned method embodiment. Figure 3 As shown, the device comprises:

[0131] The request acquisition unit 301 is used to acquire the access request in the business system, wherein the access request includes the access subject, the accessed object, the access environment and the access action;

[0132] The policy retrieval unit 302 is used to retrieve the corresponding designated authority control policy from the access policy library according to the access subject and the accessed object parsed by the request acquisition unit 301;

[0133] A timing determination unit 303, configured to determine whether the current access timing is safe according to the access environment analyzed by the request acquisition unit 301;

[0134] A policy adjustment unit 304 is used to determine whether to adjust the specified permission control policy according to the access action if the judgment result of the timing judgment unit 303 is no, and obtain a target permission control policy to process the access request according to the target permission control policy, wherein the target permission control policy is a policy that ensures the security of data in the accessed object when the access timing is not secure;

[0135] The request processing unit 305 is configured to process the access request according to the specified authority control policy if the judgment result of the opportunity judgment unit 303 is yes.

[0136] Furthermore, as a response to the above Figure 2 In order to realize the method shown in the figure, the embodiment of the present invention also provides another permission control device for Figure 2 The device embodiment corresponds to the aforementioned method embodiment. For ease of reading, this device embodiment will not repeat the details of the aforementioned method embodiment one by one, but it should be clear that the device in this embodiment can correspond to all the contents of the aforementioned method embodiment. Figure 4 As shown, the device comprises:

[0137] The request acquisition unit 301 is used to acquire the access request in the business system, wherein the access request includes the access subject, the accessed object, the access environment and the access action;

[0138] The policy retrieval unit 302 is used to retrieve the corresponding designated authority control policy from the access policy library according to the access subject and the accessed object parsed by the request acquisition unit 301;

[0139] A timing determination unit 303, configured to determine whether the current access timing is safe according to the access environment analyzed by the request acquisition unit 301;

[0140] A policy adjustment unit 304 is used to determine whether to adjust the specified permission control policy according to the access action if the judgment result of the timing judgment unit 303 is no, and obtain a target permission control policy to process the access request according to the target permission control policy, wherein the target permission control policy is a policy that ensures the security of data in the accessed object when the access timing is not secure;

[0141] The request processing unit 305 is configured to process the access request according to the specified authority control policy if the judgment result of the opportunity judgment unit 303 is yes.

[0142] In an optional implementation manner, the timing judgment unit 303 is specifically configured to:

[0143] Obtaining the access time, access location and access account in the access environment;

[0144] Obtain multiple historical access locations corresponding to the access account within a historical time period;

[0145] It is determined whether it is currently a safe access opportunity according to the multiple historical access locations, the access time and the access location.

[0146] In an optional implementation manner, when the timing determination unit 303 determines whether the current time is a safe access time according to the multiple historical access locations, the access time, and the access location, it is specifically configured to:

[0147] determining frequently visited locations among the plurality of historically visited locations;

[0148] If the access location is inconsistent with the commonly used access location, it is determined that the current access time is unsafe;

[0149] If the access location is consistent with the commonly used access location, determining whether the access time is within a preset regular access time period in the business system;

[0150] If so, it is determined that the current access time is safe;

[0151] If not, it is determined that the current access time is not safe.

[0152] In an optional implementation manner, the policy adjustment unit 304 is specifically configured to:

[0153] Obtaining the permission control content in the specified permission control policy;

[0154] Determine whether to adjust the specified permission control policy according to the access action and the permission control content, and obtain a target permission control policy.

[0155] In an optional implementation manner, when the policy adjustment unit 304 determines whether to adjust the specified permission control policy according to the access action and the permission control content to obtain the target permission control policy, it is specifically used to:

[0156] Determine whether the access action is a write-type access action and the permission control content includes allowing the access action to be performed on the accessed object, and the write-type access action is an access action that is prohibited from being performed under non-safe access opportunities;

[0157] If so, the permission control content in the specified permission control policy is adjusted to prohibit the access action from being performed on the accessed object during non-safe access opportunities.

[0158] In an optional implementation, before the request acquisition unit 301 acquires the access request in the business system, the device further includes a request filtering unit 306, and the request filtering unit 306 is specifically configured to:

[0159] Detect whether there is an access request to be received;

[0160] If it exists, the access request is parsed at the request filtering layer to obtain the access subject, the accessed object, the access environment and the access action;

[0161] Determine whether the access account in the access environment is in a pre-maintained blacklist account list;

[0162] If yes, deny the access request;

[0163] If not, the access request is allowed to pass through the request filtering layer.

[0164] In an optional implementation, when the policy retrieval unit 302 retrieves the corresponding specified permission control policy from the access policy library according to the access subject and the accessed object, the device further includes a request review unit 307, and the request review unit 307 is specifically used to:

[0165] If the access policy library does not contain the designated authority control policy corresponding to the access subject and the accessed object, the access request is stored in a pending review list;

[0166] The list to be reviewed is sent to the display terminal to notify the business personnel to review.

[0167] Furthermore, an embodiment of the present invention further provides a storage medium, wherein the storage medium is used to store a computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the above Figure 1-2 The permission control method described in .

[0168] Furthermore, an embodiment of the present invention further provides a processor, the processor is used to run a program, wherein the program executes the above Figure 1-2 The permission control method described in .

[0169] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0170] It is understandable that the related features in the above methods and devices can be referenced to each other. In addition, the "first", "second" and the like in the above embodiments are used to distinguish the embodiments, but do not represent the advantages and disadvantages of the embodiments.

[0171] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0172] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description of the above specific languages ​​is for disclosing the best mode of the present invention.

[0173] In addition, the memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0174] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0175] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0176] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0177] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0178] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0179] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0180] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0181] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0182] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0183] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A permission control method, characterized in that: The method comprises: Obtaining an access request in a business system, wherein the access request includes an access subject, an accessed object, an access environment, and an access action; According to the access subject and the accessed object, a corresponding designated authority control policy is retrieved from an access policy library; Determining whether it is a safe access opportunity according to the access environment; If not, determining whether to adjust the specified permission control policy according to the access action, obtaining a target permission control policy, and processing the access request according to the target permission control policy, wherein the target permission control policy is a policy for ensuring data security in the accessed object when the access is currently in a non-secure access opportunity; If so, the access request is processed according to the specified permission control policy.

2. The method according to claim 1, characterized in that Determining whether it is a safe access opportunity according to the access environment includes: Obtaining the access time, access location and access account in the access environment; Obtain multiple historical access locations corresponding to the access account within a historical time period; It is determined whether it is currently a safe access opportunity according to the multiple historical access locations, the access time and the access location.

3. The method according to claim 2, characterized in that Determining whether it is currently a safe access opportunity according to the multiple historical access locations, the access time, and the access location includes: determining frequently visited locations among the plurality of historically visited locations; If the access location is inconsistent with the commonly used access location, it is determined that the current access time is unsafe; If the access location is consistent with the commonly used access location, determining whether the access time is within a preset regular access time period in the business system; If so, it is determined that the current access time is safe; If not, it is determined that the current access time is not safe.

4. The method according to claim 1, characterized in that Determining whether to adjust the specified permission control policy according to the access action to obtain a target permission control policy includes: Obtaining the permission control content in the specified permission control policy; Determine whether to adjust the specified permission control policy according to the access action and the permission control content, and obtain a target permission control policy.

5. The method according to claim 4, characterized in that Determining whether to adjust the specified permission control policy according to the access action and the permission control content to obtain a target permission control policy includes: Determine whether the access action is a write-type access action and the permission control content includes allowing the access action to be performed on the accessed object, and the write-type access action is an access action that is prohibited from being performed under non-safe access opportunities; If so, the permission control content in the specified permission control policy is adjusted to prohibit the access action from being performed on the accessed object during non-safe access opportunities.

6. The method according to claim 1, characterized in that Before obtaining the access request in the business system, the method further includes: Detect whether there is an access request to be received; If it exists, the access request is parsed at the request filtering layer to obtain the access subject, the accessed object, the access environment and the access action; Determine whether the access account in the access environment is in a pre-maintained blacklist account list; If yes, deny the access request; If not, the access request is allowed to pass through the request filtering layer.

7. The method according to claim 1, characterized in that When retrieving a corresponding designated authority control policy from an access policy library according to the access subject and the accessed object, the method further includes: If the access policy library does not contain the designated authority control policy corresponding to the access subject and the accessed object, the access request is stored in a pending review list; The list to be reviewed is sent to the display terminal to notify the business personnel to review.

8. A permission control device, characterized in that: The device comprises: A request acquisition unit, used to acquire an access request in the business system, wherein the access request includes an access subject, an accessed object, an access environment, and an access action; A policy retrieval unit, configured to retrieve a corresponding designated authority control policy from an access policy library according to the access subject and the accessed object parsed by the request acquisition unit; A timing judgment unit, used to judge whether it is a safe access timing according to the access environment parsed by the request acquisition unit; A policy adjustment unit, configured to determine whether to adjust the specified permission control policy according to the access action if the judgment result of the timing judgment unit is no, and obtain a target permission control policy, so as to process the access request according to the target permission control policy, wherein the target permission control policy is a policy for ensuring the security of data in the accessed object when the access timing is currently in a non-secure access opportunity; The request processing unit is used to process the access request according to the specified authority control policy if the judgment result of the opportunity judgment unit is yes.

9. A storage medium, characterized in that: The storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the permission control method according to any one of claims 1 to 7.

10. A processor, characterized in that: The processor is used to run a program, wherein the program executes the permission control method according to any one of claims 1 to 7 when running.

Images