Security authentication method and device, electronic equipment, medium and program product

Abstract

The present disclosure provides a security authentication method and device, electronic equipment, medium and program product, relates to the technical field of artificial intelligence, in particular to the technical fields of cloud computing, information security, large model, etc. The security authentication method comprises: in response to receiving an access request for accessing model data, determining a service address, a service identifier of a first access service and a second access service to be accessed, wherein the first access service and the service address respectively represent a service and an address of the service initiating the access request, and the second access service is used for managing the model data; calling the second access service, performing security authentication on the service address and the service identifier, obtaining a security authentication result, and performing an operation matched with the security authentication result.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of artificial intelligence, in particular to the technical field of cloud computing, information security, large model, etc. Especially, it relates to a security authentication method and device, electronic equipment, medium and program product. BACKGROUND

[0002] With the continuous development of artificial intelligence technology, large model technology is also gradually improving. In the development, training and application process of large model, there will be various model data.

[0003] At present, there are still problems in the access control of model data of large model. For example, the access of model data in the development, training, testing and application process is flexibly changed, and the secure access of model data in the dynamic environment is more complex. SUMMARY

[0004] The present disclosure provides a security authentication method, device, electronic equipment, medium and program product.

[0005] According to an aspect of the present disclosure, a security authentication method is provided, including: in response to receiving an access request for accessing model data, determining a service address, a service identifier of a first access service and a second access service to be accessed, wherein the first access service and the service address respectively represent a service initiating the access request and an address of the service, and the second access service is used for managing the model data; calling the second access service, performing security authentication on the service address and the service identifier, obtaining a security authentication result, and performing an operation matched with the security authentication result.

[0006] According to another aspect of the present disclosure, a security authentication device is provided, including: a determination module, configured to, in response to receiving an access request for accessing model data, determine a service address, a service identifier of a first access service and a second access service to be accessed, wherein the first access service and the service address respectively represent a service initiating the access request and an address of the service, and the second access service is used for managing the model data; and an authentication module, configured to call the second access service, perform security authentication on the service address and the service identifier, obtain a security authentication result, and perform an operation matched with the security authentication result.

[0007] According to another aspect of the present disclosure, an electronic equipment is provided, including: at least one processor; and a memory connected with the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method as above.

[0008] According to another aspect of the present disclosure, there is provided a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause the computer to perform the method as described above.

[0009] According to another aspect of the present disclosure, there is provided a computer program product comprising a computer program which, when executed by a processor, implements the method as described above.

[0010] It should be understood that the contents described in this part are not intended to identify key or important features of the embodiments of the present disclosure, nor to limit the scope of the present disclosure. Other features of the present disclosure will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0011] The accompanying drawings are used to better understand the present scheme, and do not limit the present disclosure. Among them:

[0012] Figure 1 An exemplary system architecture to which the security authentication method and device according to embodiments of the present disclosure can be applied is schematically shown;

[0013] Figure 2 A flowchart of a security authentication method according to embodiments of the present disclosure is schematically shown;

[0014] Figure 3 A flowchart of determining a security authentication result according to a specific embodiment of the present disclosure is schematically shown;

[0015] Figure 4A An application scenario diagram of calling a first sub-service and a second sub-service for security authentication according to an embodiment of the present disclosure is schematically shown;

[0016] Figure 4B An application scenario diagram of calling a fourth sub-service for security authentication according to an embodiment of the present disclosure is schematically shown;

[0017] Figure 5 A scenario diagram of security authentication for model data of a large model according to embodiments of the present disclosure is schematically shown;

[0018] Figure 6 A block diagram of a security authentication device according to embodiments of the present disclosure is schematically shown;

[0019] Figure 7 A block diagram of an electronic device suitable for implementing a security authentication method according to embodiments of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0020] The following description of exemplary embodiments of the present disclosure is made in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding. These details should be considered as merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0021] In the field of large models, the development, training, testing, and application processes involve a variety of heterogeneous data, which are often stored on heterogeneous network architectures. For example, core code in the development phase, training data, training parameters, model files, etc. in the training phase; business data, feedback data, optimization data, etc. of large models in the application phase. The model data involved in large models uses a variety of heterogeneous network architectures, including server clusters, cloud computing, distributed architectures, and storage structures. In addition, during the application of large models, the resources storing model data will undergo irregular expansion and contraction. For example, when model data increases exponentially, the server capacity will be expanded; when the model structure is optimized and the occupied resources decrease, the server capacity will be reduced; when new tasks are added to the large model, the server capacity of the core code, training data, training parameters, model files, etc. will be adaptively expanded to accommodate the new tasks.

[0022] As can be seen, in the large-scale model domain, model data is characterized by its wide scope, highly heterogeneous network architecture, and dynamic environment. Current pre-emptive access control strategies include: network address (IP address) + port software / hardware firewalls, host-level network access control such as iptables, cloud computing-level access control such as security groups, and application-level username / IP-based access control. These pre-emptive access control strategies have the following drawbacks in the context of large-scale model data security: 1) Manually maintaining access control policies in scenarios such as changes, expansion, and reduction is costly, and timeliness and reliability cannot be guaranteed. 2) In highly heterogeneous network architectures, it is difficult to implement unified access control for model data in large models, and authentication for secure access is complex. Modifying heterogeneous network architectures also carries high costs. Furthermore, enabling unauthenticated services for resource access during development and testing reduces model data security.

[0023] In the model data security control scenario of a large model, there are technical problems such as how to ensure secure access to model data and how to ensure the convenience of secure access in a dynamic environment.

[0024] To this end, the present disclosure provides a security authentication method including: in response to receiving an access request for accessing model data, determining a service address, a service identifier of a first access service, and a second access service to be accessed, wherein the first access service and the service address respectively represent the service that initiates the access request, and the address of the service, and the second access service is used to manage the model data; calling the second access service, performing security authentication on the service address and the service identifier, and obtaining a security authentication result, so as to execute an operation matching the security authentication result, thereby realizing seamless security authentication of model data in a dynamic environment, and thereby realizing secure access to model data in a dynamic environment.

[0025] Figure 1 An exemplary system architecture that can be applied to a security authentication method and apparatus according to an embodiment of the present disclosure is schematically shown.

[0026] It should be noted that Figure 1 The examples shown are merely examples of system architectures to which the embodiments of the present disclosure may be applied, to help those skilled in the art understand the technical content of the present disclosure, but do not imply that the embodiments of the present disclosure may not be applied to other devices, systems, environments, or scenarios. For example, in another embodiment, an exemplary system architecture to which the security authentication method and apparatus may be applied may include a terminal device, but the terminal device may implement the security authentication method and apparatus provided by the embodiments of the present disclosure without interacting with a server.

[0027] like Figure 1 As shown, the system architecture 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used as a medium for providing communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired and / or wireless communication links, etc.

[0028] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as knowledge reading applications, web browser applications, search applications, instant messaging tools, email clients, and / or social platform software (for example only). For example, model data can be accessed through terminal devices 101, 102, and 103.

[0029] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0030] Server 105 may be a server that provides various services, such as a background permission management server (for example only) that supports content browsed by users using terminal devices 101, 102, and 103. The background permission management server may analyze and process received data such as user requests, and feed back the processing results (e.g., web pages, information, or data obtained or generated based on user requests) to the terminal device.

[0031] The server can be a cloud server, also known as a cloud computing server or cloud host. It is a hosting product within the cloud computing service system that addresses the management difficulties and poor scalability of traditional physical hosts and VPS services ("Virtual Private Servers" or "VPS"). The server can also be a distributed system server or a server integrated with blockchain.

[0032] It should be noted that the security authentication method provided by the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the security authentication device provided by the embodiment of the present disclosure can generally be set in the server 105. The security authentication method provided by the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the security authentication device provided by the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Alternatively, the security authentication method provided by the embodiment of the present disclosure can also generally be executed by the terminal devices 101, 102, or 103. Accordingly, the security authentication device provided by the embodiment of the present disclosure can generally be set in the terminal devices 101, 102, or 103.

[0033] For example, a user may initiate an access request through a first access service on terminal devices 101, 102, or 103. In response to receiving the access request for accessing model data, server 105 determines the service address, the service identifier of the first access service, and the second access service to be accessed. The server then calls the second access service, performs security authentication on the service address and the service identifier, obtains a security authentication result, executes an operation matching the security authentication result, and returns the access result to terminal devices 101, 102, or 103. In some embodiments, the second access service may be an access service in a network structure such as a cloud native platform, a storage platform, or a code repository platform. The network structure such as the cloud native platform, the storage platform, or the code repository platform may adopt either a distributed architecture or a centralized architecture.

[0034] It should be understood that Figure 1The number of terminal devices, networks and servers in the above-mentioned embodiments is only illustrative. Any number of terminal devices, networks and servers can be provided according to implementation needs.

[0035] In the embodiments of the present disclosure, the collection, storage, use, processing, transmission, provision, disclosure and application of user personal information comply with relevant laws and regulations, necessary security measures are taken, and do not violate public order and good customs.

[0036] In the technical solutions of the present disclosure, the authorization or consent of the user is obtained before the user's personal information is acquired or collected.

[0037] Figure 2 A flowchart of a security authentication method according to an embodiment of the present disclosure is schematically shown. As shown in Figure 2 Embodiment 200 includes operations S210-S220.

[0038] In operation S210, in response to receiving an access request for accessing model data, a service address, a service identity of a first access service and a second access service to be accessed are determined.

[0039] The first access service and the service address respectively represent a service and an address of the service that initiates the access request, and the second access service is used to manage model data. In the large model scenario, a user can initiate an access request for accessing model data in a development environment, a training environment, a test environment or an application environment. The first access service can be a service for access requests in the development environment, the training environment or the application environment.

[0040] For example, the first access service can be a service that can access code data in the development environment, a service that accesses training samples, training parameters of a model, a model configuration file and other model data in the training environment, a service that accesses test results, test parameters and other model data in the test environment, and a service that accesses model tasks and other model data of a large model in the application environment. The first access service can be a service on a development server or a service deployed by a virtual machine in a virtualization architecture.

[0041] In one embodiment, the first access service can be a service in a secure environment. For example, a login operation is performed on a development server or a virtual machine, and the identity of the user is securely authenticated. If the security authentication is passed, the user can initiate an access request through the first access service on the development server or the virtual machine; if the security authentication is not passed, the user cannot log in to the secure environment and cannot initiate an access request.

[0042] The service address can be the address of the service that initiates the access request, for example, it can be an IP address and / or a port. The first access service can be represented by a service identity, which can be the service name of the first access service.

[0043] For example, the first access service can be service A on a development machine, and thus the first access service can be represented by service identity "A". In addition, the service identity can also include an environment in which the first access service is located. The development environment, the training environment, the training environment, and the application environment correspond to the first environment identity, the second environment identity, the third environment identity, and the fourth environment identity, respectively. For example, the first environment identity, the second environment identity, the third environment identity, and the fourth environment identity and the service name of the first access service constitute the service identity.

[0044] The second access service is used to manage model data to be accessed by the access request. For example, a server or a service cluster can store model data, and the second access service is a service on the server or the service cluster for managing the model data. The server or the service cluster storing the model data can also be in the form of a platform, such as a cloud-native platform.

[0045] In the large model scenario, a plurality of model data can be managed by a plurality of services. Thus, in response to receiving an access request for accessing model data, the service address, the service identity of the first access service, and the second access service are determined, and the access request can be forwarded to the second access service.

[0046] In operation S220, the second access service is invoked, and the service address and the service identity are securely authenticated to obtain a secure authentication result to perform an operation matching the secure authentication result.

[0047] The second access service can have a secure authentication function, and when the access request is received, the service address and the service identity are securely authenticated by the secure authentication function of the second access service.

[0048] The secure authentication result includes pass and fail. The secure authentication of the service address and the service identity can be: securely authenticating the service address and the service identity respectively, and determining the secure authentication result by comprehensively considering the secure authentication sub-results of the service address and the service identity, such as when the secure authentication sub-results are all passed, the secure authentication result is passed. Alternatively, the secure authentication of the service address and the service identity can also be performed in a predetermined order, and the secure authentication result can be determined by comprehensively considering the predetermined order and the secure authentication sub-results of the service address and the service identity. For example, the secure authentication of the service address can be performed first, and then the secure authentication of the service identity; or the secure authentication of the service identity can be performed first, and then the secure authentication of the service address.

[0049] The operation that is performed according to the security authentication result can be: in a case where the security authentication result is passed, the second access service can obtain the model data and return the model data to the first access service; in a case where the security authentication result is failed, the access request is rejected. In addition, feedback information can also be returned on the basis of rejecting the access request, and / or the current access request can be recorded.

[0050] In an embodiment of the present disclosure, since the expansion and contraction processing in the large model scenario is for dynamic changes in the resources of the server, but the service of the server accessing the model data does not change, such as the service in the development environment / training environment / testing environment / application environment. Therefore, the embodiments of the present disclosure perform security authentication on the service identifier and service address of the first access service, which can realize security authentication at the service granularity, and adapt to the dynamic changes of the large model through security authentication of the service identifier, thereby realizing security authentication of the model data in the large model dynamic change scenario and ensuring the security of the model data.

[0051] According to an embodiment of the present disclosure, for operation S220, the method further includes: calling the second access service, obtaining permission data matched with the second access service, wherein the permission data changes over time; and performing security authentication on the service address and the service identifier respectively according to the permission data, to obtain a security authentication result.

[0052] The permission data represents a benchmark for security authentication of the service address and the service identifier. For example, the permission data includes service addresses and service identifiers that have access permissions. The permission data matched with the second access service can be understood as: service addresses and service identifiers that are allowed to access the model data managed by the second access service. In an embodiment, the permission data can record service addresses and service identifiers that have access permissions through a white list.

[0053] The permission data matched with the second access service changes over time, that is, dynamically changes.

[0054] For example, at time t1, the permission data matched with the second access service includes the service identifier of service S1 and the service addresses D1 and D2 under service S1. After expansion of service 1 at time t2, a new service address D3 is added. Therefore, for the same second access service, the permission data obtained at time t1 is different from the permission data obtained at time t2.

[0055] In an embodiment, a special permission elastic management service can be used to manage the permission data matched with each second access service, and support dynamic modification of the permission data matched with each second access service by a user who has the permission.

[0056] Multiple second access services used to manage various types of model data can have the same or different permission data. For example, if the model data is the training parameters of a large model, the permission data matching the second access service used to manage the training parameters may include the service addresses and service identifiers of all or some services in the training environment, thereby allowing all or some services in the training environment to access the training data. In this case, if the first access service is a service in the training environment, the security authentication result is determined to be passed based on the permission data; if the first access service is a service in the development environment, the security authentication result is determined to be failed based on the permission data.

[0057] Separately performing security authentication on the service address and service identifier based on the permission data may include: matching the service address of the first accessed service against multiple service addresses in the permission data, and determining a security authentication sub-result for the service address based on whether the service address of the first accessed service matches; and matching the service identifier of the first accessed service against multiple service identifiers in the permission data, and determining a security authentication sub-result for the service identifier based on whether the service identifier of the first accessed service matches. Subsequently, the security authentication sub-results for the service address and service identifier are combined to determine a security authentication result. Alternatively, security authentication may be performed on the service address and service identifier separately in a predetermined order, and the security authentication result and whether to proceed with subsequent security authentication (service address) may be determined based on the security authentication sub-result of the prior security authentication (service identifier). Alternatively, security authentication may be performed on the service address first, followed by security authentication on the service identifier.

[0058] In the disclosed embodiments, service addresses and service identifiers are securely authenticated using permission data that changes over time. This supports secure authentication of service addresses and service identifiers in dynamic environments. This not only ensures the isolation of model data under each secondary access service, improving model data security, but also simplifies security authentication. Furthermore, by invoking the secondary access service for security authentication, security authentication can be performed at the source of model data acquisition, further ensuring the security of the model data.

[0059] In a specific embodiment, the authority data includes first authority data and second authority data; according to the authority data, the service address and the service identifier are respectively security authenticated to obtain a security authentication result, including: performing security authentication on the service address according to the first authority data to obtain an address authentication result; and when it is determined that the address authentication result is failed, performing security authentication on the service identifier according to the second authority data to obtain a security authentication result.

[0060] The first permission data may include a service address with access rights, and the second permission data may include a service identifier with access rights. The first permission data and the second permission data may be in a whitelist format.

[0061] In the case of a large model expansion or contraction, development servers or virtual machines are usually added or deleted, which causes the service address of the first access service in the permission data to change, but the service identifier of the first access service does not change. Therefore, the first permission data and the second permission data can be stored separately.

[0062] Both the first permission data and the second permission data can change over time, and their frequency of change can be the same or different. For example, the first permission data can be updated more frequently than the second permission data to accommodate dynamic changes in capacity expansion / contraction in a large model. Furthermore, the frequency of updating the first permission data can be determined based on actual circumstances, taking into account both dynamic changes and the utilization of update resources.

[0063] The service address of the first access service is matched against the multiple service addresses included in the first permission data to perform security authentication of the service address and obtain an address authentication result. The address authentication result may be pass or fail. For example, if the first permission data includes the service address of the first access service, the address authentication result is pass; if the first permission data does not include the service address of the first access service, the address authentication result is fail. Furthermore, if the address authentication result is pass, the security authentication result may be directly determined as pass.

[0064] If the address authentication result is determined to be unsuccessful, the service identifier of the first access service is matched with the multiple service identifiers included in the second permission data to perform security authentication of the service identifiers and obtain a security authentication result. For example, if the second permission data includes the service identifier of the first access service, the security authentication result is passed; if the second permission data does not include the service identifier of the first access service, the security authentication result is unsuccessful.

[0065] In the embodiment of the present disclosure, since the service address has a higher security level for identity authentication, the service address is first security authenticated, and when the address authentication result is passed, the security authentication result is determined to be passed to ensure the security of the model data. However, the first authority data may not be updated in time, resulting in the address authentication result being failed, which is difficult to apply to the expansion and reduction scenarios of large models. Therefore, in the embodiment of the present disclosure, when it is determined that the address authentication result is failed, the service identifier is security authenticated according to the second authority data to obtain a security authentication result, and a bottom-up authentication is performed in the dimension of the service identifier to ensure security authentication in the expansion and reduction scenarios of large models.

[0066] In another embodiment, the permission data can further include third permission data for authenticating the process of the first access service. At this time, the process information, the service address and the service identifier can be securely authenticated according to the third permission data. For example, the secure authentication result can be determined by integrating the respective secure authentication sub-results of the process information, the service address and the service identifier.

[0067] Figure 3 A flowchart for determining a secure authentication result according to an embodiment of the present disclosure is schematically shown. As shown in Figure 3 Embodiment 300 includes operation S310 to operation S360.

[0068] In operation S310, the service address is securely authenticated according to the first permission data, and an address authentication result is obtained.

[0069] In operation S320, it is determined whether the address authentication result is passed. In the case where the address authentication result is passed, operation S350 is performed; in the case where the address authentication result is not passed, operation S330 is performed.

[0070] In operation S330, the service identifier is securely authenticated according to the second permission data. For example, it can be determined from the second permission data whether the service identifier is included for secure authentication.

[0071] In operation S340, it is determined whether the service identifier is authenticated. In the case where the service identifier is included in the second permission data, the service identifier is authenticated, and operation S350 is performed; in the case where the service identifier is not included in the second permission data, the service identifier is not authenticated, and operation S360 is performed.

[0072] In operation S350, it is determined that the secure authentication result is passed, and an access operation is performed.

[0073] In operation S360, it is determined that the secure authentication result is not passed, and the access is rejected.

[0074] Since the large model involves various model data, for the sake of understanding, the process of secure authentication will be described in detail below with respect to various model data and a second access service for managing the model data.

[0075] According to an embodiment of the present disclosure, the second access service includes a first sub-service for storing encrypted model data and a second sub-service for decrypting the encrypted model data; the secure authentication of the service address and the service identifier includes: calling the first sub-service to mount the storage path of the encrypted model data to a predetermined directory of the first access service; and calling the second sub-service to securely authenticate the service address and the service identifier to obtain a secure authentication result.

[0076] The model data can be training data and / or model data, and the second access service can allow all or part of the services in the development environment, the training environment, the test environment, and the application environment to access the model data. The permission data matched with the second access service can configure different permission sub-data for different environments to achieve the separate authorization of the multiple services in the multiple environments.

[0077] The first sub-service can be a storage platform for storing the encrypted model data. The second sub-service can be a security management platform for decrypting the encrypted model data.

[0078] For example, the model data encrypted in the first sub-service can be pre-registered in the second sub-service so that the second sub-service can decrypt the encrypted model data. For example, the resource identifier of the model data can be registered in the second sub-service to achieve the registration of the encrypted model data.

[0079] After determining the service address, the service identifier, and the second access service in response to receiving the access request for accessing the model data, the access request can be forwarded to the first sub-service. Thus, the first sub-service can determine the model data to be accessed according to the access request and mount the storage path of the encrypted model data to the predetermined directory of the first access service.

[0080] The storage path can be a file path in the first sub-service for storing the encrypted model data.

[0081] The predetermined directory can be a directory for caching the model data accessed by the first access service. Alternatively, the predetermined directory can also include multiple sub-directories, each of which corresponds to a service address to store the model data accessed by each service address in the corresponding sub-directory.

[0082] For example, the first access service can be initiated by a node machine or an instance of a development server / training cluster / application cluster. The storage path can be mounted to a predetermined directory under the development server / training cluster / application cluster, or mounted to a predetermined directory of a node machine or a predetermined directory of a container under the development server / training cluster / application cluster.

[0083] In response to receiving an access request for accessing model data, after determining the service address, service identifier, and second access service, a decryption request may be initiated to the second sub-service, and the service address and service identifier may be sent to the second sub-service. The second sub-service may then determine the model data to be accessed based on the decryption request, perform security authentication on the service address and service identifier, and obtain a security authentication result. For example, the second sub-service may obtain permission data from the permission elasticity management service and perform security authentication on the service address and service identifier based on the permission data to obtain a security authentication result. Please refer to the above description for details, which will not be repeated here.

[0084] In another embodiment, the permission data may further include third permission data for authenticating the process accessing the first service. In this case, the second sub-service may receive the access request, process information, service address, and service identifier, and perform security authentication on the process information, service address, and service identifier based on the third permission data.

[0085] In an embodiment of the present disclosure, the storage path of the encrypted model data is mounted to a predetermined directory of the first access service by calling the first sub-service; and the second sub-service is called to perform security authentication on the service address and service identifier to obtain a security authentication result. In the above manner, the model data stored in the first sub-service is also encrypted model data, and when accessing the model data through an access request, only the encrypted model data can be obtained, thereby ensuring the security of the model data during the storage process. Furthermore, by performing security authentication of the service identifier and service address through an additional second sub-service, the storage and security authentication of the model data are separated to ensure that even when the storage platform is attacked, the plaintext model data cannot be obtained, thereby reducing the modification of the first sub-service and reducing the modification cost while ensuring the security of the model data.

[0086] According to an embodiment of the present disclosure, after calling the second sub-service for security authentication, the first access service can perform an operation that matches the security authentication result, which includes: if the security authentication result is passed, determining the decrypted model data based on the storage path and the key information returned by the second sub-service.

[0087] If the second sub-service passes security authentication, key information for the model data can be obtained from the second sub-service. The encrypted model data can then be retrieved from the storage path and decrypted using the key information to obtain the decrypted model data. For example, the encrypted model data can be decrypted using read-time streaming decryption using the key information to obtain the decrypted model data.

[0088] The key information may be generated according to an encryption and decryption technology, and the key information corresponds to the encryption key information used when encrypting the model data, so that the decrypted model data can be obtained according to the key information.

[0089] If the second sub-service fails security authentication, the first access service's predefined directory contains only the encrypted model data storage path. This storage path consumes minimal resources, and the encrypted model data is stored in this path. Therefore, if the second sub-service fails security authentication, the storage path can be deleted or not processed.

[0090] The model data stored in the first sub-service is usually large, and the first sub-service is usually a distributed structure. For example, the model data can be stored through multiple distributed storage nodes. The model data stored in each storage node is uncertain, especially after the storage node is expanded or reduced in capacity, the model data stored in each storage node will also change accordingly.

[0091] In the embodiments of the present disclosure, the encrypted model data and security authentication are isolated, and when the security authentication result is passed, further decryption is performed based on the obtained key information and in the security environment of the first access service. This eliminates the need to modify the storage platform, thereby reducing the difficulty and modification cost of security authentication for model data of large models.

[0092] Similarly, when storing model data, the first sub-service may obtain encryption key information from the second sub-service according to the resource identifier of the model data, encrypt the model data according to the encryption key information, and store the encrypted model data in the first sub-service.

[0093] According to an embodiment of the present disclosure, the method also includes: calling a first sub-service, authenticating the object identifier in the access request, and obtaining a first object authentication result; and when the first object authentication result is passed, mounting the storage path of the encrypted model data to a predetermined directory.

[0094] The first sub-service may include a native authentication service capable of securely authenticating access requests. Access requests may include an object identifier, such as a username, representing the user initiating the access request. For example, the object identifier may be securely authenticated using fourth permission data. If the object identifier, included in the fourth permission data and indicating permission to access the encrypted model data, matches the object identifier in the access request, the first object authentication result is considered a pass; otherwise, the first object authentication result is a fail.

[0095] In another embodiment, the access request may further include a dynamic password. The first sub-service is invoked to perform security authentication on the dynamic password and the object identifier. If both the dynamic password and the object identifier are authenticated successfully, the first object authentication result is determined to be successful. The dynamic password may be generated using an existing password authentication method.

[0096] Therefore, within the first sub-service, the object identifier is authenticated according to the fourth authority data to obtain a first object authentication result, and if the first object authentication result is passed, the storage path of the encrypted model data is mounted to a predetermined directory.

[0097] In an embodiment of the present disclosure, the object identification security authentication is first performed by calling the first sub-service. If the first object security authentication result is passed, the storage path of the encrypted model data is mounted to a predetermined directory. The object identification authentication can be performed before obtaining the encrypted model data, thereby further improving the security of the model data.

[0098] Figure 4A The following schematically illustrates an application scenario diagram of calling a first sub-service and a second sub-service for security authentication according to an embodiment of the present disclosure.

[0099] like Figure 4A As shown, in embodiment 400A, a user can initiate an access request through first access service 401 on a development server or virtual machine. In response to the access request, after determining the service address, service identifier, and the first sub-service to be accessed, first sub-service 402 is called to determine encrypted model data 4021 and the storage path 4011 of encrypted model data 4021, and then mount storage path 4011 under a predetermined directory of first access service 401. Furthermore, first sub-service 402 can authenticate the object identifier in the access request. If the first object authentication result is successful, storage path 4011 is mounted under a predetermined directory of first access service 401.

[0100] In response to the access request, a decryption request may also be sent to the second sub-service 403. In response to the decryption request, the second sub-service 403 performs security authentication on the service identifier and service address based on the permission data obtained from the flexible permission management service 404. If the security authentication result is successful, key information 4012 is returned to the first access service. The first access service can obtain decrypted model data 4013 based on the storage path 4011 and key information 4012.

[0101] According to an embodiment of the present disclosure, the model data includes shared file data used by the development model and / or the training model, the second access service includes a third sub-service for managing the shared file data; the calling of the second access service, the security authentication of the service address and the service identity, and the obtaining of the security authentication result include: calling the third sub-service, performing security authentication on the service address and the service identity, and obtaining the security authentication result, so that the shared file data can be accessed through the storage path of the shared file data when the security authentication result is passed.

[0102] The model data includes shared file data used by the development model and / or the training model, and the second access service can allow all or part of the services on the development environment and the test environment to access the shared file data.

[0103] The shared file data can be a model parameter explanation file, a configuration file, a task explanation file, etc., and the shared file data can be accessed through a storage path. For example, the shared file data can be accessed through a uniform resource locator (URL).

[0104] For example, the third sub-service can be a modified simple http service, and the shared file data can be accessed based on the storage path after security authentication by calling the modified simple http service. For example, the service identity and the service address can be used as patch request parameters of the simple http service, and after calling the third sub-service, the security authentication of the incoming service identity and service address is performed, and the shared file data is accessed through the storage path of the shared file data when the security authentication result is passed. For example, the storage path can be included in the access request, and the shared file data can be accessed according to the storage path when the security authentication result is passed. The security authentication of the service identity and the service address is as described above, and will not be described here.

[0105] In an embodiment of the present disclosure, for the shared file data, the existing simple http service is modified so that the modified simple http service (third sub-service) can perform security authentication on the service address and the service identity, and the security authentication of the shared file data is performed without the user's awareness, thereby improving the access security of the shared file data.

[0106] According to an embodiment of the present disclosure, the model data includes model task instance data stored in the cloud native, the second access service includes a fourth sub-service, and the fourth sub-service is used to manage the model task instance data; calling the second access service, performing security authentication on the service address and service identifier, and obtaining a security authentication result, including: calling the first authentication module in the fourth sub-service, determining the second object authentication result based on the data identifier of the model task instance data and the object identifier in the access request; if the second object authentication result is passed, sending the service address and service identifier to the second authentication module in the fourth sub-service; calling the second authentication module in the fourth sub-service, performing security authentication on the service address and service identifier, and obtaining a security authentication result.

[0107] Model task instance data can be task instances that can be executed by a large model, stored in containers on a cloud-native platform. For example, the fourth sub-service can be a cloud-native platform that can store multiple model task instance data in containers. The fourth sub-service can allow all or some services in the test environment or application environment to access the model task instance data.

[0108] The first authentication module in the fourth sub-service may be a native authentication module of the fourth sub-service, configured to perform security authentication on the data identifier of the model task instance data and the object identifier in the access request based on the native security control policy to obtain a second object authentication result. For example, the security control policy may be a security group.

[0109] In one embodiment, a second object authentication result may be obtained by determining whether the object identifier has permission to access the model task instance data corresponding to the data identifier. If the object identifier has permission to access the model task instance data corresponding to the data identifier, the second object authentication result is passed; otherwise, the second object authentication result is failed.

[0110] For example, the container pod to which the data identifier belongs can be determined, and whether the object identifier has access rights to the container pod can be determined. If the object identifier has access rights to the container pod, the second object authentication result is determined to be passed. Alternatively, the namespace to which the data identifier belongs can be determined, and whether the object identifier has access rights to the namespace can be determined. If the object identifier has access rights to the namespace, the second object authentication result is determined to be passed. Otherwise, the second object authentication result is determined to be failed.

[0111] The second authentication module in the fourth sub-service can be an authentication module added to the first authentication module native to the fourth sub-service, and performs security authentication on the service address and service identifier to obtain a security authentication result. The authentication logic of the second authentication module is the same or similar to that of operation S220 above and will not be repeated here.

[0112] For example, in the case where the second object authentication result is passed, the service address and the service identity are directly sent to the second authentication module in the fourth sub-service. Alternatively, the service address and the service identity are bound with the credential authenticated by the first authentication module, and the credential bound with the service address and the service identity is sent to the second authentication module in the fourth sub-service.

[0113] For example, when accessing the model task instance data under a certain namespace or a certain pod through the first access service, the first authentication module in the fourth sub-service determines the second object authentication result according to the data identity of the model task instance data and the object identity in the access request. In the case where the second object authentication result is passed, the service address and the service identity are bound with the authentication credential of the first authentication module, and the credential bound with the service address and the service identity is sent to the second authentication module in the fourth sub-service through the micro-service interface API Server of the fourth sub-service. Thus, the service address and the service identity are securely authenticated by the newly added second authentication module, and if the secure authentication result is passed, the access to the model task instance data under a certain namespace or a certain pod is allowed.

[0114] In an embodiment of the present disclosure, the secure authentication of the object identity and the data identity is performed by calling the first authentication module in the fourth sub-service, and the secure authentication of the service address and the service identity is performed by newly adding the second authentication module in the fourth sub-service. In addition to the two-level authentication mode, the elastic authentication mode of the service identity and the service address is also implemented to achieve the secure authentication in the dynamic change scenario of the large model.

[0115] In another embodiment, when the secure authentication result of the second authentication module is passed, a first container access request for the container to which the data identity belongs can be generated, and the container access request is sent to the cloud-native platform to allow access to the model task instance data stored in the container. In addition, the second authentication module can also generate a second container access request for the container to which the data identity belongs, the second container access request being used to allow access to the model task instance data stored in the container and record the access record of the model task instance data. For example, the access record can include the service address, the service identity, the data identity, and the object identity.

[0116] Figure 4B An application scenario diagram of calling the fourth sub-service for secure authentication according to an embodiment of the present disclosure is schematically shown.

[0117] As Figure 4BAs shown, in embodiment 400B, a user can initiate an access request through the first access service 401. In response to receiving the access request, the service address, service identifier and the fourth sub-service 405 to be accessed are determined. The first authentication module 4051 in the fourth sub-service 405 is called to determine the second object authentication result based on the data identifier and the object identifier. In the case where the second object authentication result is passed, the service address, service identifier and the credentials generated by the first authentication module 4051 are bound, and the bound credentials are forwarded to the second authentication module 4052, and the second authentication module 4052 performs security authentication on the service identifier and service address to generate a security authentication result. In the case where the security authentication result is passed, the accessed model task instance data 4053 is returned to the first access service. Specifically, the second authentication module 4052 can periodically obtain permission data from the permission elasticity management service 404 to perform security authentication on the service identifier and service address based on the permission data.

[0118] According to an embodiment of the present disclosure, the second access service also includes a fifth sub-service for managing model code data. For example, the fifth sub-service can be a code library platform. Model data includes code data. The fifth sub-service can allow all or some services in the development environment or training environment to access the model code data.

[0119] Regarding operation S220, the method includes: invoking a fifth sub-access service to perform security authentication on the service identifier and service address, and obtaining a security authentication result. If the security authentication result is successful, returning the code data corresponding to the access request; alternatively, writing the code data corresponding to the access request. The fifth sub-service performs security authentication on the service identifier and service address as described above and will not be further described here.

[0120] Figure 5 The following schematically shows a scenario diagram of security authentication of model data of a large model according to an embodiment of the present disclosure. Figure 5 As shown, in embodiment 500, the second access service may include a storage platform, a security management platform, a server cluster, a cloud native platform, and a code library platform, corresponding to the first sub-service, the second sub-service, the third sub-service, the fourth sub-service, and the fifth sub-service, respectively. In addition, the second access service may also include a permission elastic management service for storing dynamically changing permission data.

[0121] For the code base platform: In operation S1.1, users can register the permission data of the code base platform on demand. Alternatively, the code base platform periodically queries the permission data from the permission elastic management service. In operation S1.2, the user can initiate an access request through the first access service on the bastion host, and forward the access request to the code base platform via the server cluster or cloud native platform. At this time, the server cluster or cloud native platform can be regarded as a springboard. In operation S1.3, the code base platform performs security authentication on the service address and service identifier internally based on the permission data to obtain a security authentication result. In operation S1.4, if the security authentication result is passed, read or write operations on the code data in the code base are allowed.

[0122] For the storage platform: In operation S2.1, users can register permission data for the model data stored in the code library platform on the security management platform as needed. Alternatively, the security management platform can periodically query permission data from the permission elastic management service. In operation S2.2, when the model data is stored in the storage platform, the model data is encrypted according to the encryption key information of the security management platform, and the encrypted model data is stored in the storage platform. Figure 5 As shown, the encrypted model data of the storage platform can be a model or data. In operation S2.3, the user can initiate an access request through the first access service on the bastion host, and forward the access request to the storage platform via the server cluster or cloud native platform. In operation S2.4, the storage platform mounts the storage path of the encrypted model data if the first object authentication result is passed. In operation S2.5, a decryption request can also be sent to the security management platform. In operation S2.6, the service address and service identifier are securely authenticated within the security management platform to obtain a security authentication result. In operation S2.7, if the security authentication result is passed, the security management platform returns the key information.

[0123] For server clusters, the third sub-service can be called to obtain shared file data. In operation S3.1, patch secure access under the simple HTTP service is natively supported through the traditional seven-layer transmission model. In operation S3.2, the user initiates an access request through the first access service on the bastion host, calling the third sub-service to perform security authentication on the service address and service ID. If the security authentication result is passed, the shared file data can be accessed through the storage path.

[0124] For the cloud native platform, in operation S4.1, the first authentication model of the cloud native platform can be authorized for namespaces and containers. In operation S4.2, the user can initiate an access request through the first access service on the bastion host, calling the first authentication module of the cloud native platform to determine the second object authentication result based on the object identifier and data identifier. In operation S4.3, if the second object authentication result is passed, the second authentication module is called to perform security authentication on the service identifier and service address. If the security authentication result is passed, access to the model task instance data is allowed.

[0125] In addition, the cloud-native platform can automatically register / update services with the elastic permissions management service during capacity expansion or contraction. Alternatively, users can register / update services by interacting with the elastic permissions management service during capacity expansion or contraction.

[0126] In the disclosed embodiments, a security authentication method using a dynamically changing service identifier and service address can simultaneously support multiple requirements, such as service access and user access, and is well-suited for heterogeneous and dynamically scalable scenarios involved in large-scale model development, training, and application. Furthermore, by invoking a systematic method inherent to the second access service, security authentication can be performed directly on various heterogeneous infrastructure platforms (such as storage platforms, code repository platforms, and cloud-native platforms) and native services (simple HTTP), eliminating the need for additional development and collaboration, and reducing development and transformation costs.

[0127] Figure 6 Schematically shows a block diagram of a security authentication device according to an embodiment of the present disclosure. Figure 6 As shown, the security authentication device 600 includes: a determination module 610 and an authentication module 620.

[0128] Determination module 610 is used to determine the service address, the service identifier of the first access service and the second access service to be accessed in response to receiving an access request for accessing model data, wherein the first access service and the service address respectively represent the service that initiates the access request, and the second access service is used to manage model data.

[0129] The authentication module 620 is used to call the second access service, perform security authentication on the service address and the service identifier, obtain a security authentication result, and execute an operation matching the security authentication result.

[0130] According to an embodiment of the present disclosure, the authentication module 620 includes: calling the second access service so as to

[0131] The acquisition submodule is configured to acquire permission data matching the second access service, wherein the permission data changes over time.

[0132] The first authentication submodule is used to perform security authentication on the service address and the service identifier according to the authority data to obtain a security authentication result.

[0133] According to an embodiment of the present disclosure, the authority data includes first authority data and second authority data; the first authentication submodule includes:

[0134] The first authentication unit is used to perform security authentication on the service address according to the first authority data to obtain an address authentication result.

[0135] The second authentication unit is used to perform security authentication on the service identifier according to the second authority data to obtain a security authentication result when it is determined that the address authentication result is failed.

[0136] According to an embodiment of the present disclosure, the second access service includes a first sub-service for storing encrypted model data and a second sub-service for decrypting the encrypted model data; the authentication module 620 includes:

[0137] A first calling submodule is used to call the first sub-service and mount the storage path of the encrypted model data to a predetermined directory of the first access service;

[0138] The second calling submodule is used to call the second sub-service, perform security authentication on the service address and service identifier, and obtain a security authentication result.

[0139] According to an embodiment of the present disclosure, the security authentication device 600 further includes: an execution module for determining the decrypted model data according to the storage path and the key information returned by the second sub-service when the security authentication result is passed.

[0140] According to an embodiment of the present disclosure, the first calling submodule further includes:

[0141] The calling unit is used to call the first sub-service, perform security authentication on the object identifier in the access request, and obtain a first object authentication result.

[0142] The mounting unit is used to mount the storage path of the encrypted model data to a predetermined directory when the first object authentication result is passed.

[0143] According to an embodiment of the present disclosure, the model data includes shared file data used for developing the model and / or training the model, the second access service includes a third sub-service for managing the shared file data; and the authentication module 620 includes:

[0144] The second authentication submodule is used to call the third subservice, perform security authentication on the service address and service identifier, and obtain a security authentication result, so as to access the shared file data through the storage path of the shared file data if the security authentication result is passed.

[0145] According to an embodiment of the present disclosure, the model data includes model task instance data stored in the cloud native, the second access service includes a fourth sub-service, and the fourth sub-service is used to manage the model task instance data; the authentication module 620 includes:

[0146] The third calling sub-module is used to call the first authentication module in the fourth sub-service, and determine the second object authentication result based on the data identifier of the model task instance data and the object identifier in the access request; if the second object authentication result is passed, the service address and service identifier are sent to the second authentication module in the fourth sub-service.

[0147] The fourth calling submodule is used to call the second authentication module in the fourth subservice, perform security authentication on the service address and service identifier, and obtain a security authentication result.

[0148] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0149] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0150] According to an embodiment of the present disclosure, an electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method described above.

[0151] According to an embodiment of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause a computer to execute the method described above.

[0152] According to an embodiment of the present disclosure, a computer program product includes a computer program, and when the computer program is executed by a processor, the computer program implements the method described above.

[0153] Figure 7A block diagram of an electronic device suitable for implementing a security authentication method according to an embodiment of the present disclosure is schematically shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0154] like Figure 7 As shown, electronic device 700 includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 into a random access memory (RAM) 703. Various programs and data required for the operation of electronic device 700 may also be stored in RAM 703. Computing unit 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to bus 704.

[0155] Multiple components in electronic device 700 are connected to input / output (I / O) interface 705, including: an input unit 706, such as a keyboard, mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a magnetic disk, optical disk, etc.; and a communication unit 709, such as a network card, modem, wireless communication transceiver, etc. The communication unit 709 allows electronic device 700 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0156] The computing unit 701 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 701 performs the various methods and processes described above, such as the security authentication method. For example, in some embodiments, the security authentication method may be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed onto the electronic device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded into the RAM 703 and executed by the computing unit 701, one or more steps of the security authentication method described above may be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to perform the security authentication method via any other suitable means (e.g., via firmware).

[0157] Various embodiments of the systems and techniques described above can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-a-chip systems (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0158] The program code for implementing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0159] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of machine-readable storage media may include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fibers, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0160] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0161] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0162] A computer system may include a client and a server. The client and server are generally remote from each other and typically interact through a communication network. The client-server relationship arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server may be a cloud server, a server in a distributed system, or a server integrated with a blockchain.

[0163] It should be understood that the various forms of flow shown above can be used to reorder, add, or delete steps. For example, the steps described in the present disclosure can be performed in parallel, in series, or in a different order, as long as the desired results of the technology disclosed in the present disclosure can be achieved, which is not limited herein.

[0164] The above detailed description does not constitute a limitation on the protection scope of the present disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements, and improvements made within the spirit and principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A security authentication method, comprising: In response to receiving an access request for accessing model data, determining a service address, a service identifier of a first access service, and a second access service to be accessed, wherein the first access service and the service address represent a service that initiates the access request and an address of the service, respectively, and the second access service is used to manage the model data; calling the second access service, performing security authentication on the service address and the service identifier, obtaining a security authentication result, and executing an operation matching the security authentication result; The model data includes shared file data used for developing a model and / or training a model, the second access service includes a third sub-service for managing the shared file data; and the calling of the second access service and performing security authentication on the service address and the service identifier to obtain a security authentication result include: The third sub-service is called to perform security authentication on the service address and the service identifier to obtain the security authentication result, so as to access the shared file data through the storage path of the shared file data if the security authentication result is passed.

2. The method according to claim 1, wherein The calling of the second access service, performing security authentication on the service address and the service identifier, and obtaining a security authentication result includes: calling the second access service, Obtaining permission data matching the second access service, wherein the permission data changes over time; According to the authority data, security authentication is performed on the service address and the service identifier respectively to obtain the security authentication result.

3. The method according to claim 2, wherein: The permission data includes first permission data and second permission data; and performing security authentication on the service address and the service identifier according to the permission data to obtain the security authentication result includes: Performing security authentication on the service address according to the first authority data to obtain an address authentication result; and When it is determined that the address authentication result is failed, security authentication is performed on the service identifier according to the second authority data to obtain the security authentication result.

4. The method according to any one of claims 1 to 3, wherein The second access service includes a first sub-service for storing the encrypted model data and a second sub-service for decrypting the encrypted model data; The calling of the second access service, performing security authentication on the service address and the service identifier, and obtaining a security authentication result includes: Calling the first sub-service to mount the storage path of the encrypted model data to a predetermined directory of the first access service; The second sub-service is called, security authentication is performed on the service address and the service identifier, and a security authentication result is obtained.

5. The method according to claim 4, wherein The performing of an operation matching the security authentication result includes: When the security authentication result is passed, the decrypted model data is determined according to the storage path and the key information returned by the second sub-service.

6. The method according to claim 4, further comprising: Invoking the first sub-service to perform security authentication on the object identifier in the access request to obtain a first object authentication result; as well as When the first object authentication result is passed, the storage path of the encrypted model data is mounted to the predetermined directory.

7. The method according to any one of claims 1 to 3, wherein The model data includes model task instance data stored in cloud native, and the second access service includes a fourth sub-service, and the fourth sub-service is used to manage the model task instance data; The calling of the second access service, performing security authentication on the service address and the service identifier, and obtaining a security authentication result includes: calling the first authentication module in the fourth sub-service to determine a second object authentication result based on the data identifier of the model task instance data and the object identifier in the access request; and sending the service address and the service identifier to the second authentication module in the fourth sub-service if the second object authentication result is passed; The second authentication module in the fourth sub-service is called to perform security authentication on the service address and the service identifier to obtain the security authentication result.

8. A security authentication device comprising: a determining module, configured to, in response to receiving an access request for accessing model data, determine a service address, a service identifier of a first access service, and a second access service to be accessed, wherein the first access service and the service address represent a service that initiates the access request and an address of the service, respectively, and the second access service is used to manage the model data; an authentication module, configured to call the second access service, perform security authentication on the service address and the service identifier, obtain a security authentication result, and execute an operation matching the security authentication result; The model data includes shared file data used for developing a model and / or training a model, and the second access service includes a third sub-service for managing the shared file data; The authentication module includes: a second authentication sub-module, which is used to call the third sub-service, perform security authentication on the service address and the service identifier, and obtain the security authentication result, so as to access the shared file data through the storage path of the shared file data if the security authentication result is passed.

9. The device according to claim 8, wherein The authentication module includes: calling the second access service, an acquisition submodule, configured to acquire permission data matching the second access service, wherein the permission data changes over time; The first authentication submodule is configured to perform security authentication on the service address and the service identifier respectively according to the authority data to obtain the security authentication result.

10. The device according to claim 9, wherein The authority data includes first authority data and second authority data; the first authentication submodule includes: a first authentication unit, configured to perform security authentication on the service address according to the first authority data to obtain an address authentication result; and The second authentication unit is configured to, when it is determined that the address authentication result is failed, perform security authentication on the service identifier according to the second authority data to obtain the security authentication result.

11. The device according to any one of claims 8 to 10, wherein: The second access service includes a first sub-service for storing the encrypted model data and a second sub-service for decrypting the encrypted model data; The authentication module includes: A first calling submodule, configured to call the first sub-service and mount the storage path of the encrypted model data to a predetermined directory of the first access service; The second calling submodule is used to call the second sub-service, perform security authentication on the service address and the service identifier, and obtain a security authentication result.

12. The apparatus according to claim 11, further comprising: An execution module is used to determine the decrypted model data according to the storage path and the key information returned by the second sub-service when the security authentication result is passed.

13. The apparatus according to claim 11, wherein the first calling submodule further comprises: a calling unit, configured to call the first sub-service, perform security authentication on the object identifier in the access request, and obtain a first object authentication result; as well as The mounting unit is configured to mount the storage path of the encrypted model data to the predetermined directory when the first object authentication result is passed.

14. The device according to any one of claims 8 to 10, wherein: The model data includes model task instance data stored in cloud native, and the second access service includes a fourth sub-service, and the fourth sub-service is used to manage the model task instance data; The authentication module includes: a third calling submodule, configured to call the first authentication module in the fourth subservice, determine a second object authentication result based on the data identifier of the model task instance data and the object identifier in the access request; and send the service address and the service identifier to the second authentication module in the fourth subservice if the second object authentication result is passed; The fourth calling submodule is used to call the second authentication module in the fourth subservice, perform security authentication on the service address and the service identifier, and obtain the security authentication result.

15. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

16. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to enable the computer to execute the method according to any one of claims 1 to 7.

17. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the method according to any one of claims 1 to 7.

Images